Understanding HIPAA

Part Six:  Employer Guidelines For Compliance With The Privacy Rule

1.         Sit down.  Think about it.  Create a plan for compliance.  A plan for compliance will be a useful defense should you be challenged about not complying.  Do what you do well.  Make and act on a plan.

2.         The key issue is access to PHI.  Get control over PHI.  What is PHI?  Where does it come from?  What happens to it once it is here?  Who among my employees has reason to be in contact with or gain knowledge of PHI?  Why do they need this contact or knowledge?  Do I have any “business associates” who have contact with PHI about my employees?   Once it gets here where is this PHI housed?  How is it safeguarded?  Do I really need all of this PHI?  Can the amount of PHI be reduced?  How much of this PHI is disclosed?  Why is it disclosed?  Can we reduce the amount of disclosure to the minimum necessary to make the process go forward?

3.         Taking Inventory:  Deciding if it really is a health plan.  Each and every health plan maintained by the employer should be inventoried, examined, and reviewed. What is the risk involved with each of these plans?  Is this plan a Health plan as defined by HIPAA?  (Check the definitions chapter.) Is it a stand-alone plan or is it part and parcel of another plan?  What Do I tell the participants about each of these plans?  How do I describe them?  Do I describe them as group plans offering a number of services such as vision, dental, health or are these plans separate?  Is there an advantage to me by grouping them together?  Am I in a self-insured or partially self-insured plan?  Do I have business associate contracts with TPA; PPO;  HMO?

4.         What is the level of risk associated with each plan?  Using the guidelines provided above assess the level of risk or exposure you have for each plan identified in (3) above.  The guidelines provided above will help you to determine what specific steps will have to be implemented to complete this step.  Once this is done ask yourself what you can do to reduce this risk?  Determine what policies or procedures you can implement to reduce your risk.  Will some plans need to be amended?  What type and how much training will help you reduce your exposure?  Consider combining or separating plans.  There will be advantages and disadvantages to both approaches.  Choose which is best in terms of ease of administration and HIPAA compliance.

5.         The “privacy officer” and the “contact person” and the role they play in your plan of compliance.  Although highly unlikely it may turn out you are exempt from this requirement.  Most likely you will have to create the job description for a “privacy officer” and you will have to assign those duties to someone.  The same will be true for the “contact person.”  Unless you can establish that you are exempt you will be required to appoint a “privacy officer.”  Among other duties this person is responsible for policy development and implementation.  You most likely will need a designated contact person, who is responsible for receiving complaints and providing additional information about compliance with the Privacy Rule.  As part of your plan determine who will do this for you?  What training they will need?  Will this be their only job or will this be an additional responsibility?  Can you combine the responsibilities of the “privacy officer” and the ‘”contact person?”

6.         Determining what policies and procedures you will use will be an important part of your plan for HIPAA compliance.  Start by carefully evaluating the result of the risk assessment.  From there you can determine which policies and procedures will be necessary to limit access to PHI. Remember these policies must be designed to comply with the standards, implementation specifications, or other requirements of the regulations.  HHS allows you to design and implement “reasonable” plans.  You do not need to alter the flow of work at your company.  Base your policies and procedures on the size of your workforce, who has access to PHI, the number of health plans you offer; and the types of plans they are.  Below is a list of the types of policies and procedures you may want to develop and implement.

Consider policies with accompanying procedures on:

Assure individual privacy rights. This includes limiting and controlling access to, or the amendment of, and/or accounting for, disclosures of PHI

Authorizations.  Why are they needed, how are they obtained, who has to complete one, how long is it good for, procedure for revoking or altering.