• E-mail
• Print
• RSS

Ensure compliance in the long-term care setting

HIPAA Training Advisor, April 19, 2007

All covered entities face the task of HIPAA compliance. However, long-term care facilities (LTCs) face special challenges that arise from staff members' close relationships with residents. Although these relationships are crucial to good patient care, they can pose difficulties when it comes to compliance.

"Long-term care is a totally different animal," says Peggy Presbyla, RHIA, CHP, HIM director and privacy officer for James Square Health and Rehabilitation Centre in Syracuse, NY. "The part that gets a little difficult is that we get to know the residents so well."

For example, Presbyla is aware of an incident at one facility in which a resident mentioned to a staff member that she had an adopted daughter; the staff member let the information slip to the daughter--who was crushed because she had no idea. But a more frequent problem occurs when residents confide in an aide about their aches and pains but don't want him or her to spread the information to other residents or staff.

Common situations
Residents and staff live and work together every day--sometimes for years--in a facility that becomes the residents' homes. So it's only human nature that staff members let their guard down. Staff members must carefully handle even seemingly innocuous situations to avoid violating HIPAA, like making an announcement when a resident has a birthday.

In addition, family members who visit regularly might become close to staff members. In these cases, employees must be careful not to disclose information that residents don't want to share with family members.

"It's quite easy when a staff member knows a visitor really well to go ahead and say, 'This is a good person,' and let them have access to the information when they really shouldn't," says Rebecca Herold, an Iowa-based information privacy, security, and compliance consultant.

To combat this problem, Presbyla and Herold recommend frequent training and reminders. It's often helpful to have staff perform role-playing exercises in which they can practice responding to certain situations, Herold says. Include examples of problems that have occurred at similar facilities and provide tips for handling those sorts of incidents. In addition to frequent training, you can post reminders in newsletters, on bulletin boards, and on your facility's intranet.

Personal representatives
LTCs must also frequently deal with patients' personal representatives. This can be complicated because many patients don't have formal healthcare proxies that designate who can make decisions for them. So LTCs need to have a system in place to ask residents with whom they want staff to share information and who they want making decisions. Staff members also need to know the limitations of those decision-making powers.

For example, a son may have a power of attorney that allows him to make financial decisions but not healthcare decisions. Or the scope of the decision-making authority may be limited to specific issues, such as artificial life support. Staff members must clearly understand these complexities to ensure that they conduct business in accordance with the patient's wishes.

"It's easy to think that one person comes every day, so we can talk to him or her," Herold says. "But it may actually be the other child--who doesn't visit--who is the personal representative.

• E-mail to a Colleague
• Print
• RSS
• Archive