ORIGINALLY WRITTEN JANET HAMOUS
Whether you know it or not, the security of your health information just got elevated to a new level.
In April, health-care businesses rolled out changes that will safeguard your privacy and provide better security of your health data.
These changes are a result of the Health Insurance Portability and Accountability Act of 1996, or HIPAA.
Part one of HIPAA addressed health insurance reform and brought us such things as health insurance portability and the relaxation of pre-existing-condition clauses in health-insurance contracts.
Part two provides national standards for electronic health-care transactions and, more noticeable to the public, privacy protection standards.
It is the privacy section of the law that has had health care providers scrambling to meet the April 14 deadline. Every health-care entity was required to appoint a “privacy officer” and to educate all employees about the law and new procedures resulting from it.
Implementation has been no small task-no stone could be left unturned in addressing potential privacy or security leaks.
Some of the changes are visible to patients and visitors; others happen behind the scenes.
Paperwork
If you’ve paid a visit to your doctor, dentist, pharmacy, or hospital in the last few weeks, you are aware of a new form-the Notice of Privacy Practices-for you to sign at each provider.
“By law, every provider is required to write up their own notice of privacy practices,” said Tammy Flaming, pharmacist and privacy officer at Greenhaw Pharmacy in Hillsboro. “It is specific to every place and says how we will handle privacy and protected health information.
“If a person says, ‘I already got one from my doctor’s office,’ we have to tell them it is specific to our store,” she said.
Flaming said they give the customer a copy of the notice, and it is the customer’s decision whether to read it.
“We are only required to have a signature that they received it,” she said. “We must keep them for six years. That’s a lot of paper, so we have gone to electronic signatures.”
If you are admitted to a hospital, you’ll find even more new paperwork to review and sign.
Mike Ryan, Hillsboro Community Medical Center chief executive officer, marvels at “the sheer volume of paperwork presented to patients when they go to the hospital.”
“It’s important,” he said. “They have to look at it and make decisions about what they authorize us to do. They need to understand, and it takes some explanation.”
The new paperwork requirements don’t affect just patients. Ron Leupp, administrator at Legacy Park in Peabody, said all vendors and contractors must sign HIPAA associate agreements.
“It has amounted to much more paperwork,” Leupp said. “This is now an additional set of mailings which affects us cost-wise. You don’t cover all these bases for free.”
Release of patient information
As a result of HIPAA, requests for patient information are subject to more scrutiny. Even information about who is in the hospital is carefully protected.
“If someone asks, ‘Is so and so there?’ we have to know what we can and can’t say,” said Doug Newman, CEO at St. Luke Hospital in Marion. “Everything is based on need to know.”
That creates more work for not only the admissions staff but care providers in the nursing units, Newman said.
“It’s more difficult for them to give information over the phone or in person,” he said. “There is a whole new set of rules they have to work with.
“There have been cases where patients have not wanted to let other people know they were in the hospital, and when someone comes up to the front desk, we say we don’t have the patient here. We don’t have any choice.”
He said the changes have been hard for health-care employees who “are so used to working with that caring attitude and sharing information.”
“Now it feels like you don’t care any more,” Ryan said. “But we have to follow the law and the patient’s wishes.”
Gray areas
As with any guidelines, some areas are open to interpretation.
For example, when a patient is admitted to St. Luke Hospital, they have to sign a form to give permission for their name to be printed in the newspaper as a hospital admission.
HCMC, on the other hand, discontinued printing patient admissions in the newspaper.
Ryan said this decision was made upon the advice of their attorney
“It’s a little gray area, but we did it to be on the safe, conservative side,” he said. “There are still a lot of unknowns, and no one knows how the courts are going to interpret it.”
Newman said another gray area encountered at St. Luke Hospital is how to deal with clergy who are seeking information about parishioners in the hospital.
In the past, clergy could walk in and ask if anyone from their church was there and staff would let them know.
“We can’t do that any more,” Newman said.
He said the regulations are not clear on just what information may be provided to clergy.
“I am waiting for clarification,” he said. “I think this is something that wasn’t anticipated.”
Pastor Laney Kuhn of the United Methodist Church in Hillsboro said clergy are aware of the increased need for patient privacy and confidentiality.
“I think we are blessed in Hillsboro-most of our people who enter the hospital want and encourage people to remember them through prayer and healing. However, I have had some in my church who elect not to share, and we have to respect that,” he said.
Kuhn said the church has an extensive prayer list that is read during the service.
“We ask the person, ‘Would you like your name on the prayer list?’ giving that person the freedom to say yes or no. If they don’t respond, I have to assume they do not want to be on the list,” he said.
“When someone does not come to visit them, they need to understand that they did not give permission. It is a dual responsibility,” Kuhn said.
Privacy and confidentiality
Health-care providers have also had to rethink all aspects of patient privacy and confidentiality, which has often meant tweaking processes and systems.
“Part of the education process was getting people to be aware of who is around them when they are talking to a patient,” Newman said. “You have to understand you are talking only to that patient, not to someone in the hall or the patient in the other bed.”
“You have to be careful who you allow information,” said Judy Jantz, office manager and privacy officer at Preferred Medical Associates-Hillsboro Family Practice Clinic.
“If they come in for lab work, we have to be very careful who we report that to,” she said. “If we call them back, we don’t leave it on the answering machine any more-we have to talk directly to the patient.”
Enhancing patient privacy has also meant changes at Legacy Park.
“For example, we need to allow a private phone for a resident to use,” Leupp said. “With HIPAA, it would not only mean a private phone, but to be sure that the door is closed at all times while the resident is on that phone conversation.”
Process and system changes
Some of the process and system changes have necessitated physical changes within the environment.
Leupp said they have moved their patient charts from a chart rack into a special chart room.
“There is a door barrier between the charts and other residents and the passing general public” he said.
Physical changes were also required at Greenhaw Pharmacy.
“We used to be able to help two customers at two cash registers,” said Flaming. “We can no longer do that for two reasons. We put in additional computer equipment for the HIPPA signatures, so there’s not room for the extra cash register.
“Plus, we were encouraged to look at ways private information could accidentally leak out, and one of the ways we identified was possibly at a cash register where another customer possibly could see or overhear. So we now ask people to wait, and we serve them one at a time.”
Similar changes were made at the hospitals.
“We used to have a census board, and we had to take that down,” said HCMC’s Ryan. “When a visitor comes in now, they can’t just look and see, ‘Oh, Susie’s in the hospital.’ They have to be told by someone who wants them to know. Then they can come to see that patient, but they won’t have information about other patients.”
Access to patient records
Record access has also changed as a result of HIPAA.
Customers who wanted printouts of prescription records for tax purposes found the process at Greenhaw Pharmacy a little different this year.
“They can pick up their own or their children’s-they cannot pick up the spouse’s records unless the spouse calls or comes in and fills out a form,” Flaming said.
The PMA-Hillsboro Family Practice Clinic is also dealing with the more stringent guidelines for record access, Jantz said.
She said patients may specify that certain medical information be given to others, but the request must be in writing and it must state specifically who is authorized to receive the information. No longer is medical information given out to people just because they are family members.
Under the new law, patients also have more access to their own records.
“Patients have a right to see their records,” Jantz said. “It used to be that we did not hand over the records to them. What we do now is talk to them about it first, because some people would get their records, and they would read something that wasn’t necessarily there.”
Is it overkill?
Health care providers said they were already sensitive to patient privacy and information security prior to the enactment of HIPAA. Some people question whether another layer of regulation is helpful, particularly given the burden it places on an already overloaded health-care system.
But the providers interviewed for this article said that implementing the law has opened their eyes to certain privacy or security issues within their environments, and they believe the changes made will benefit the patient.
“What HIPAA really did was quantify things that were already in place,” Newman said. “We now have more of an awareness of things.
“Your health is between you and your caregivers or physician. It is not for everyone-it is nobody’s business.”
