HIPAA regulations add protection

New operating procedures for hospitals, doctors and pharmacies are aimed at keeping private information, well, private.

New regulations under the Health Insurance Portability and Accountability Act that took affect April 14 require more privacy protection for patients. The act will also make the exchange of health care information between providers and payers more uniform with an Oct. 16 deadline for electronic transaction systems and codes.

Privacy

The act, which was passed in 1996, was originally set up to make the health care system more uniform, but the act was expanded to include patient privacy requirements. Patients must sign off on the release of any information at any health care office or pharmacy.

Laurie Glenn Cunningham, director of public relations for CoxHealth, said, "We've always respected our patients' privacy and asked them to indicate the category they wanted to be placed under, but I think we realize now it is a legal issue more so than ever before. Before we were just trying to provide good customer service and respect the patients' privacy, now we are legally bound to."

Melanie Schattauer, security officer for St. John's Health System, said the hospital has 14 site coordinators and nearly 9,000 people so far have completed an online training program on HIPAA privacy provisions.

"In all of our policies and forms we've encompassed all hospitals, all clinics, EMS, Mercy Villa, and home care," Schattauer said.

The hospital chose to absorb the cost of compliance for all of its providers to help smaller offices comply.

"(It has been) one of the bigger costs that we absorbed as a health system, and that's one reason we did it, because be knew the individual clinics and the smaller hospitals would not be able to pay for a lot of this," Schattauer said.

The biggest cost of HIPAA for St. John's came from the printing of documents. The hospital has already printed 1.3 million privacy notices and 300,000 brochures. Schattauer said the brochures are already gone and she hopes the privacy notices will last at least 90 days.

Over the past three years, health care providers have worked to develop policies and procedures to comply with the law. Now, patients are required by law to indicate what kind of information they want to share with the public.

"They will be asked to declare a category. They have an option of being a general information patient, limited information or no information," Cunningham said.

For a general information patient at CoxHealth, room number and phone number can be disclosed. These patients can receive visits or gifts. A specific status can be told to interested parties.

For patients requesting limited information, the hospital can verify the patient is at the hospital but the room number or phone number is not listed. The health care provider can accept cards or flowers on the patient's behalf.

For patients selecting no information, the health care provider can't even acknowledge the patient is at the facility.

Cunningham said this could cause some visitors to be unhappy.

"One of the very difficult positions to be placed in is when a family or friends absolutely know, and they insist that they have a loved one here, but that loved one has requested to have no information (released). That is an awful position to be in as an employee or volunteer, but we also recognize that every patient has a right to privacy," Cunningham said.

The way St. John's shares information is a little different. Patients are asked to check yes or no if they want information given. If no is checked, Schattauer said, flowers, cards or visits will not be allowed. Schattauer said patients can elect to give information to certain people whom they list on the form.

These same privacy laws extend to doctors, dentists and pharmacies. In these cases, patients sign a form acknowledging they understand privacy laws. In some cases, patients are asked if information may be left on a home answering machine or with another family member.

Civil and criminal penalties, up to imprisonment, apply if a company fails to follow HIPAA regulations. According to the Department of Health and Human Services, for an offense of disclosure under false pretenses the fine is a maximum of $100,000 or imprisonment for five years. If the offense is committed with the intent to sell, transfer or use for commercial advantage or personal gain or harm the fine is a maximum of $250,000 and/or imprisonment for 10 years.

Workplace privacy

Privacy issues extend to all businesses, as well. Blackwell Sanders Peper Martin is holding a seminar May 21, focusing on the rules that apply to health care plans maintained by employers. Mark Welker, partner with Blackwell Sanders and head of the employee benefits practice group, said nearly every business is affected.

"Employers have to amend their health plans and adopt policy and procedures dealing with privacy, and also train their staff relating to the privacy rules if they have a HIPAA-covered health plan," Welker said. "If it's fully insured, chances are the insurance company is going to take care of a lot of the requirements. But if it's self insurance or what is called a flexible spending account, the burden is going to fall on the employer to comply."

Complying with the rules could mean $2,000 to $6,000 in professional expenses, Welker said. He added that companies must have training on HIPAA regulations, they must appoint a privacy officer and provide training to any employee who has access to health information.

"It's not nearly as difficult for employers to comply with respect to their plans as it is for hospitals and doctors to comply with respect to their practices," Welker said.

Cost of protection

Dan Drewry, owner of Dan's Discount Drug Mart, said the new legislation has cost his store $10,000. The addition of an electronic signature device and rules requiring papers to be shredded before being thrown away has caused more headaches at the pharmacy.

"This is absolutely the worst piece of legislation. I've been in this business for 33 years, and not once, with us taking the proper precautions, have we ever had anyone going through our trash," Drewry said.

The pharmacy's most costly addition was an electronic signature device which helps keep track of customers. The machine cost $7,500, Drewry said.

"If you don't do it electronically you could spend several minutes on each patient just finding out that they a have already signed one, and then you are probably going to get duplicates and you're probably going to have misses," Drewry said.

To ensure customer protection, the pharmacy also makes sure no unauthorized person goes behind the counter and the pharmacy has placed customer prescriptions in a location that can't be seen by other customers.

Drewry said the changes will have a financial impact on customers somewhere down the line.

"You know the customer is going to pay for it in the end. We haven't got that far to checking whether the costs need to be allocated or anything. We're just trying to comply," Drewry said.

More preparation

Another part of the act requires all health care providers to have an electronic system.

By Oct. 16, according to the department of Health and Human Services, all covered entities must be ready to transmit and receive covered transactions electronically in the new standardized HIPAA format.

This act also requires all Medicare and Medicaid claims to be submitted electronically and furnishes insurance providers with in a standardized format.

Linda Jones, business office director for CoxHealth, said the hospital has been working on the project for about a year and has started testing. Jones said the total cost of updating has not been calculated, but "by the time you pay for the consultant and spend the time to pay people to review the manual and do the testing it has been an expense for Cox to accomplish this."

St. John's also has started testing for the transaction and code system deadline. These new codes mean the hospital must apply the same standard to 22 different billing systems, Schattauer said.

In the end, Jones believes the regulations will make the process smoother.

"I think it will make the insurance companies more consistent and efficient in the processing of claims and that's what the government's goal is," Jones said.