Memo From The Editor

HIPAA help

Marianne Dekker Mattera

This issue, we introduce a new department, HIPAA Consult. Each installment will answer questions about the HIPAA implications of situations that have been standard practice for years in many offices. Can you still use sign-in sheets and call out patients' names? Can you talk to a patient's spouse about paying a bill? Can you leave a message for a patient on an answering machine? Those questions and more will be answered by attorneys with special expertise in the HIPAA regulations.

Over the last two and a half years alone, we've done five full-length features on the HIPAA regulations and covered the implications of the regs in numerous articles on related areas of practice management. So why start a department now? For one thing, because you've asked for it. Implicitly, by reading the articles we've already done readership scores on those articles have always been among the highest in their respective issues. And explicitly in focus groups we held this winter.

For another, the timing seemed right. Better, we thought, to do a regular, practical column when you're actually dealing with the problems that arise than when there was only theory and fear. Not to mention the fact that the regs kept changing.

I encountered a perfect example of such everyday problems when I visited my primary care physician about a week after the HIPAA privacy regulations went into effect in April. After I'd checked in, I was handed several forms and told to read and sign them. The first was a statement of the practice's privacy policy. I read, I signed. The second was the most incomprehensible form I'd ever seen.

It was called "Individual Patient's Authorization" and it was full of language like "This form is to confirm your authorization to use or disclose your protected health information for a special purpose," and "Describe in detail the protected health information you are authorizing to be used and/or disclosed." What patient can answer that? Is it looking for broad generalities, or the URI he's there to be treated for that day? And most patients aren't familiar with the term "protected health information."

My favorite part of the two-sided form was section three, "Ending this authorization." You have two choices, picking a date or filling in an "event." "The event must relate to the individual or the purpose of the authorized use and/or disclosure." Impossible.

The sad thing is that the requirement for such specific authorization was rescinded last August when the final modifications were made to the privacy rule. I told that to the doctor and his practice administrator and faxed them some confirmation.

I suspect there'll be more instances of confusion in offices throughout the country now that what was theory is now practice. We welcome your questions and we look forward to helping you find a practical, legal path through the HIPAA maze.

 
Marianne Mattera. Memo from the Editor: HIPAA help. Medical Economics Jul. 11, 2003;80:11.