*Sharing protected health information among providers
*Inpatient comes back as outpatient: Report two claims

Visit Complianceinfo.com

SUBSCRIBE to Compliance Monitor

SUBSCRIBE to Health Care Auditing Weekly

Join the Compliance Monitor team!

On Complianceinfo.com

Sample compliance policies and procedures. (For subscribers to Strategies for Health Care Compliance only)

Sample audit programs. (For subscribers to Health Care Auditing Strategies only)

The OIG Work Plan for Fiscal Year 2003

Ask the Expert

Compliance Hot Topics: Billing and Coding, EMTALA, Stark, HIPAA

Question of the Week

Welcome to Compliance Monitor Q&A.

Our mission is to answer your difficult compliance questions-and your simple ones, too. To submit a question, send it to Compliance Monitor Q & A editor Kate Alvarez at kalvarez@hcpro.com. We hope you enjoy this service and we welcome your feedback.

This week's questions

• Sharing protected health information among providers
• Inpatient comes back as outpatient: Report two claims

• Sidestepping the five most common FDA compliance pitfalls

• How does your organization handle patient financial issues?

Q: Our hospital provides outpatient lab services for local physicians, and typically, we send results to the ordering physician. But if the ordering physician asks us to send them to another physician, we require patient authorization. There is one physician who doesn't like this practice. How can I prove that we need to have a signed authorization?

A: Although it is possible that individual state laws require patient consent, HIPAA does not require or even promote the practice of obtaining a patient's authorization for providers to share PHI with each other regarding the treatment of an individual. HHS believes that patients have a reasonable expectation that professionals involved in their care can and will share relevant information about them as needed, so it imposes no constraints in this area. Unfortunately, mistakenly blaming a cumbersome process on HIPAA gives HIPAA a bad name.

On the other hand, hospitals must take reasonable steps to ensure that PHI is only released when appropriate. The organization should clarify that this is its own policy and explain the reasoning behind it. At the same time, the organization can review its policy and procedures to find a simpler, less burdensome way to achieve the same goal without requiring formal authorization.

HIPAA myths linger, but most organizations have a good grasp of the obvious requirements. And now, more subtle questions are arising as the full implications of the rule sink in. Some of these questions are in gray areas of the rule, where organizations legitimately come to different conclusions. For these, only time and test cases will tell what HHS expects.

This question was answered by Kate Borten, CISSP. Since managing the first comprehensive information security programs at Massachusetts General Hospital in the mid '90s and later at CareGroup, she formed The Marblehead Group, Inc., a national security and privacy consulting firm focused on the health care industry.

Back to top

Click here to take our quick survey on your financial policies and procedures.

LIVE AUDIOCONFERENCE: GET CASE STUDIES FOR EFFECTIVE HIPAA COMPLIANCE AUDITING AND MONITORING

Attend the 90-minute live HCPro audioconference, "Effective Auditing and Monitoring for HIPAA Compliance: How to Ensure Consistency with Your Privacy and Security Programs," on October 30 and make sure that your privacy and security practices and controls meet HIPAA requirements. To register or learn more, CLICK HERE or call 800/650-6787 and mention source code EZ22356G.

Back to top

JOIN THE COMPLIANCE MONITOR TEAM.

Are you a compliance expert? We're looking for compliance experts in coding, billing, documentation, HIPAA, EMTALA, Stark, laboratories, and many other areas of compliance. If you are interested in answering questions from your peers, please e-mail Compliance Monitor editor Kate Alvarez.

Back to top

To find out more about how the interim rule could affect your facility, order the pay-per-view article "Interim rule could change some providers' covered entity status." The cost is $10. Subscribers to the online version of Briefings on HIPAAhave free access to this article. Subscribers to the print edition can find it in their September issues.

A $30 steal.
You can read this article and much more in the September issue of Briefings on HIPAA. Your cost: Five stories for only $30. You'll also learn how the Hungerford Hospital teaches staff to have a little R-E-S-P-E-C-T, What the best approach is for facility switchboard operators when they receive calls asking for a patient's room number, what counts as notice when you have to respond to a subpoena, how to avoid five common pitfalls when preparing for security, and how to train your staff on how to respond to PHI amendment requests-Part 1.

Back to top

FIVE RESOURCES to help you build an effective and sustainable HIPAA compliance program

Give your HIPAA security and privacy compliance program a boost with the "HIPAA Security and Privacy Reminder Toolkit." Take a look at what's inside: