Info About Insurance

Top-10 HIPAA Questions Relevant to Physician Offices

1. Can I call out the names of patients in using waiting room?
   • Yes, but you may want to consider first names only.
   • Exception example: AIDS clinic
     
      
2. Can I still use a sign-in sheet?
   • Yes.
   • Limit information to name, time of arrival
   • Exception example: AIDS clinic
     
      
3. Can I still send out reminder postcards to my patients?
   • Yes, but with minimum information (date, time, contact information).
   • Consider switching to mailed letters in envelopes.
   • Your procedure for reminding patients of appointments should be explained in your Notice of Privacy Practices.
     
      
4. Can I put charts outside the door of an examination room?
   • Yes.
   • Turn the charts around so the patient's name faces the door. This will help prevent inadvertent disclosure.
     
      
5. Can I place charts on the same shelf area where patients check in?
   • No.
     
      
6. What if my patient refuses to sign the Notice of Privacy Practices?
   Can I still treat him/her?
   • Yes.
   • Regulations require a good-faith effort at obtaining written acknowledgment.
     
      
7. Do I need to lock the cabinets I store my charts in or buy locked chart racks?
   • Locked chart racks provide the best protection, but there is no requirement for locking file systems.
   • The Office for Civil Rights (OCR) suggests the following:
     • Physical barriers (reception desk, etc.)
     • “Authorized Personnel Only” sign
     • Train staff to recognize unauthorized persons and escort them to the reception area.
     • Clear communication to janitorial staff, etc., that files should not be touched.
       
        
8. I am a member of a hospital medical staff that has formed an “Organized Health Care Arrangement.” Do I have to present each patient I see in the hospital with a Privacy notice?
   • No. You are covered by the hospital’s Notice of Privacy Practices.
   • Applies to inpatient services only.
   • Follow-up visits in a physician’s office requires a Notice of Privacy Practices and written acknowledgment of receipt.
     
      
9. What is a “business associate”? Is the lab I use a business associate?
   • A business associate includes individuals or companies who, on behalf of the physician, perform or assist in performing functions that use Protected Health Information (e.g., claims, administration, billing, UR, etc.) or provide legal, actuarial, accounting, management, etc., services involving Protected Health Information.
   • No. No agreement is required when disclosure of Protected Health Information pertains to treatment.
     
      
10. What should I do about the cleaning people who come into the office after hours?
    • No Business Associate Agreement is necessary (Office for Civil Rights, 12/3/02).
    • Any access to PHI would be incidental.