* How does HIPAA require facilities to shred confidential papers?
* Change revenue code for 'N' status indicator
* Pay-per-view article: Don't let documentation, digits derail diabetes coding

SUBSCRIBE to Health Care Auditing Weekly

Visit Complianceinfo.com

On Complianceinfo.com

Sample compliance policies and procedures. (For subscribers to Strategies for Health Care Compliance only)

Sample audit programs. (For subscribers to Health Care Auditing Strategies only)

The OIG Work Plan for Fiscal Year 2003

Ask the Expert

Compliance Hot Topics: Billing and Coding, EMTALA, Stark, HIPAA

Question of the Week

Welcome to Compliance Monitor Q&A!

Our mission is to answer your difficult compliance questions-and your simple ones, too. To submit a question, send it to Compliance Monitor Q & A editor Melissa Osborn at mosborn@hcpro.com. We hope you enjoy this service and we welcome your feedback.

This week's questions

• How does HIPAA require facilities to shred confidential papers?
• Change revenue code for 'N' status indicator

• Don't let documentation, digits derail diabetes coding

• When will your organization begin auditing its HIPAA compliance program?

Q: What is HIPAA's stance on shredding confidential paper? We have a lock on our paper compactor, so there is no way for someone to break into it. We also have a confidentiality agreement from our waste contractor. Is this good enough?

A: Maybe. Locked containers and a strong contract are good steps, but they're only part of the confidential paper disposal solution.

HIPAA regulations call for security safeguards including administrative, technical, and physical measures. However, they do not tell covered entities exactly how to implement those measures, because that depends on the particular level of risk in each environment. Each organization must assess its own risk. And often we find that within one organization, the risk can vary from one area to another.

In general, we know that shredding paper containing protected health information (PHI) is a standard method of ensuring confidentiality today. And it's acceptable to use locked bins or compactors for interim storage, until papers can be disposed of safely by a contractor. But there are many ways to implement a shredding policy and make sure it's effective. One important way is to hold awareness training sessions for employees

Take the example of a doctor's office with two physicians and three support staff. All five workers have discussed and understand the risks of throwing away unshredded papers containing PHI, even phone message slips. They have installed desk-side office shredders in every room, and they use them constantly. In this environment, the HIPAA law considers these safety measures appropriate and adequate.

In a larger facility-a clinic or hospital, for example-the risks are greater. There is less control over the PHI, the workforce, and the patients and their families. This leads to greater exposure.

Workers should not stockpile records, such as old reports. That tends to create a greater vulnerability. They must remember to drop records in a bin or shred their contents. And bins should be kept locked and never allowed to overflow.

Larger facilities may also choose to use a combination of shredders and locked bins. Place the larger and more costly bins in hidden areas, whereas you can put office shredders in more accessible spaces, such as under desks and at nursing stations. In any case, for workforce compliance, it's important that a shredder or bin be readily accessible throughout your building.

This question was answered by Kate Borten, CISSP. Since managing the first comprehensive information security programs at Massachusetts General Hospital in the mid '90s and later at CareGroup, she formed The Marblehead Group, Inc., a national security and privacy consulting firm focused on the health care industry.

Back to top

Do your auditing and monitoring practices meet OIG standards?

Health Care Auditing Strategies, the 12-page monthly newsletter, can help you get the most out of your audits. It offers practical how-to articles, sample policies and procedures, best practices, and auditing techniques for specific areas, including coding systems, billing systems, cost reports, credentialing processes, employee background checks, education and training programs, and quality of care.

For more information, including how you can save 10%, go to http://www.hcmarketplace.com/Prod.cfm?id=1331&s=EN1614C Or, call 800/650-6787 and mention Source Code EN1614C.

Setting up and maintaining an auditing program is never an easy task, but HCPro now offers a free resource that delivers helpful news and advice each week!

Introducing Health Care Auditing Weekly, the new e-mail newsletter designed for healthcare internal auditors and compliance professionals. Click here to sign up for your complimentary subscription.

Go to "Don't let documentation, digits derail diabetes coding " for the rest of this article. The cost is $10. Subscribers to the online version of Briefings on Coding Compliance Strategies have free access to this article. Subscribers to the print edition can find it in their July issues.

A $30 steal!

You can read this article-and much more-in the July issue of Briefings on Coding Compliance Strategies. Your cost: Three stories for only $30! You'll learn how CMS' new outlier rule could affect your facility, how to make your coding department a well-oiled machine, how to create facility-specific coding guidelines, the difference between coding aneurysms, dissections, and pseudoaneurysms, and much more.

Back to top

A how-to resource for conducting successful internal investigations and audits

The new book, "See for Yourself: A Health Care Provider's Guide to Conducting Internal Investigations and Audits," will show you how to conduct your own internal investigations and audits from start to finish. It offers practical advice and real-life examples on how to plan and staff an internal investigation or audit, and provides detailed information on the legal issues involved.

To order, or learn more, go to: http://www.hcmarketplace.com/Prod.cfm?id=1742&s=EB1054G Or, call 800/650-6787 and mention source code EB1054G.

A: To read the answer to this question, click here.

Back to top

To submit your answer, go to the Question of the Week at Complianceinfo.com.

Here are the answers to the last survey:

Would you be interested in learning how other organizations structure their compliance, privacy, and risk management functions, set procedures, train new employees, and handle reporting and budgets?

• Yes: 96%
• No: 2%
• I'm not sure what impact the rule will have on our reimbursement: 2%

Back to top

Network with your audit colleagues

"Audit Talk" is a new, moderated chat forum that members can use to post messages or questions for their peers 24-hours-a-day. "Audit Talk" offers a free forum to network, share ideas, and solve problems for those in the audit industry. Getting involved is easy. To subscribe, just send your request to this e-mail: owner-audit_talk@hcpro.com.

Share the news!

You've been benefiting from our informative e-mail newsletter, so why not pass on this resource to your peers? Sign up a colleague and get $20 off your next purchase on HCPro's Healthcare Marketplace!

Send your comments and questions about Compliance Monitor Q&A to:

Melissa Osborn
Managing Editor
mosborn@hcpro.com