By Clifford Warren Lober, MD, JD, April 01, 2014
It’s a beautiful Wednesday afternoon as Bryan returns to his office from the courtroom. As soon as he walks in, his receptionist tells him Ellen has called about one of her patients. Bryan calls her back.
Bryan: Ellen, it’s great to hear from you! It’s been a while.
Ellen: Bryan, I have a peculiar situation. One of our new patients refused to sign the Notices of Privacy Practices acknowledgment form that we are required to have signed according to HIPAA. My receptionist told her that we could not see her unless she signed the form. Was she right?
Bryan: Actually, no. While you are correct that your receptionist should always have patients read and sign the form acknowledging that they have received your Notice of Privacy Practices when they first come to your office, you should not refuse to see them solely because they refuse to sign the acknowledgment form. You must, however, document that the Notice was given to them and that they refused to sign the acknowledgment.
Ellen: Are there any circumstances under which I don’t need to give the patient the Notice?
Bryan: Yes. Emergency situations are an exception. Although it is not required by HIPAA, you may want to give the Notice to the next of kin and have them acknowledge receipt. This documents your intent to comply with the spirit of the law. In any case, as soon as the patient is stable and capable of understanding the nature of the Notice, he or she should be given a copy and sign a written acknowledgment of its receipt.
Ellen: Must I give a copy of the revised Notice to my existing patients as well as to new patients? [pagebreak]
Bryan: I know that there has been some confusion on this question. The Final Rule explicitly states that providers are “only required to give a copy of the NPP to, and obtain a good faith acknowledgment of receipt from, new patients.” The revised Notice needs to be “available upon request” to existing patients. Nevertheless, many of my legal colleagues recommend that you give the revised Notice to all patients and have them sign an acknowledgment form since it again shows your intent to comply with the spirit of the law. This may be beneficial should a legal situation arise.
Ellen: In addition to giving the Notice to my patients and having them sign for it, is there anything else I need to do with it?
Bryan: Yes. You must post it in a “clear and prominent location” in your office. Providers may post a summary of the Notice “as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part.” If you have a website, the Notice should be posted there as well.
Ellen: Our receptionist is still giving out copies of the older Notice since we have quite a few left in the office. That saves a few trees!
Bryan: Although I also love to save trees, you must use the revised Notice that we prepared for your practice. Several significant changes took effect on Sept. 23, 2013, and must be mentioned in your Notice of Privacy Practices. Discard the older forms since they no longer comply with the current law.
Ellen: I understand that the Notice must inform the patients that if they self-pay for their health care services in full they have the right to request that we not report the visit or treatment to their health plan. Is that true?
Bryan: That’s correct. If a patient pays out-of-pocket and in full, he or she may request that you not disclose that information to a health care plan for purposes of payment or health care operations. This must be mentioned in your revised Notice. [pagebreak]
Ellen: What else must be mentioned in the Notice?
Bryan: Your Notice must state that, in addition to their right to restrict certain disclosures to health plans when they pay out-of-pocket and in full, patients have the right to access, inspect, amend, and receive a copy of their protected health information. Your Notice should also spell out which disclosures the practice is allowed to make without patient authorization (so-called “permitted disclosures”), including those made for treatment, payment, or health care operations. And it should spell out which disclosures required the patient’s permission. The revised Notice must also mention that patients have the right to be informed of unauthorized disclosures of their protected health information as well as the right to file complaints with both your office and the Office for Civil Rights.
Ellen: Is that all?
Bryan: No. If you are going to use any of the patient’s protected health information for marketing, sales, or fundraising activities, you must get their prior permission. There are a few well-defined exceptions, such as face-to-face marketing. Even if you receive non-monetary compensation, such as a cruise or theater tickets, you must disclose that you are being compensated and get the patient’s permission. If you review the revised Notice that we prepared for your practice last September, you will see that all of the items we discussed, as well as others, are mentioned. You should also be aware that state laws frequently impose additional requirements on sales, marketing, and fundraising activities that involve protected health information.
Ellen: Wow! Should any of these changes affect my other office forms?
Bryan: Yes. Although not required, mentioning the restrictions on sales, marketing, and fundraising activities using protected health information on your financial form (in addition to your Notice) would again show your intent to both inform your patients and comply with financial and privacy laws. You may also want to mention the ability of a patient who self-pays in full for treatment to withhold that information from health care plans for purposes of payment or health care operations.
Ellen: Thanks, Bryan.
Bryan: You’re welcome. Please call me if I can be of any further help.
If you have any suggestions for topics to be discussed in this column, please e-mail them to me at firstname.lastname@example.org. See the February 2013 issue of Dermatology World for disclaimers.
- Effective Sept. 23, 2013, you must have updated your Notice of Privacy Practices form.
- The revised Notice does not have to be given out to existing patients. Nevertheless, giving the revised Notice to all patients shows your intent to comply with the spirit of the law. All new patients, however, must be given and should acknowledge receipt of the revised Notice.
- If the patient refuses to sign the form acknowledging receipt of the Notice, document that the Notice was given and that they refused to sign the acknowledgment form. You may still see the patient.
- The Notice must be posted in a “clear and prominent location” in your office. It should also be placed on your website (if you have one).
- New rules include the restriction of disclosure to health plans for payment and health care operations if a patient self-pays in full. There are also restrictions on sales, marketing, and fundraising activities involving protected health information.
- Practices should also be aware of the need to update their business associate agreements to comply with the updated HIPAA rules. Learn more at www.aad.org/HIPAA.
- The Notice is not required in emergency situations when immediate treatment is required or when the patient is unable to understand the nature of the Notice. You should, however, have the patient read and acknowledge receipt of the Notice as soon as reasonably practical.
AAD website, manual can help dermatologists comply with HIPAA
The Academy has developed a new HIPAA manual titled “A Guide to HIPAA and HITECH for Dermatology.” This manual contains a model business associate agreement, model notice of privacy practice form, breach notification requirements, and other guidelines, tools, and worksheets explaining all of the new HIPAA regulations. Visit the Academy’s HIPAA Web page at www.aad.org/hipaa to learn more about the new regulations and the manual.
The Academy has also developed a series of educational recordings on HIPAA focused on the new regulations as well as the privacy and security requirements. These recordings are available at www.aad.org/webinars.