Privacy Updates For the Alternative Practice

Just when we thought the hullabaloo over theprotections against such disclosures built right in,
Health Insurance Portability and Accountability Actand that your medical billing software and medical
(HIPAA) had calmed down and we all figured outoffice software was developed by people who
what we needed to do in order to comply, alongconsider these requirements and keep up with the
comes the Health Information Technology andchanges in the law.
Clinical Health Act (HITECH), which is part of theThe section of HITECH that grants patients some
American Recovery and Reinvestment Act ofadditional rights under HIPAA states that
2009 (the "Stimulus Act") signed into effect byproviders may not share information with a
President Obama on February 17, 2009. HITECHpatient's insurance carrier, if the patient pays the
will make significant changes to HIPAA in five keyfull cost of the rendered service and makes such
areas, all of which will affect the alternativea request. Providers were not previously obligated
practice to some extent.to honor such a request. Additionally, a provider
The first change will come in the form of businesswill be responsible to provide the patient with an
associates now being held accountable foraccounting of all disclosures made electronically of
protection of protected health information (PHI)that patient's PHI for the past three years,
by adhering to the business associate agreementalthough this requirement will change depending on
into which they have entered, as well as towhen a practice implements an electronic medical
comply with the security rules related torecord system. For instance, if your practice
administrative, physical and technical safeguards.purchased an electronic medical record system on
What this means to your practice is that youor before January 1, 2009, then this provision of
need to ensure that your business associatesHITECH will become effective January 1, 2014,
understand their role, and further understand thatbut if you purchased your EMR system after
there are now civil and criminal penalties that canJanuary 1, 2009, this provision will kick in on
be imposed against business associates for theirJanuary 1, 2011, or the date that you buy your
failure to comply. Your business associates aresystem, whichever is later. Finally, on February 17,
any vendors or outside consultants that have2010, those providers maintaining electronic
access to your patients' PHI.records will be required to provide copies of those
HITECH puts forth a requirement that you notifyrecords to patients in electronic form.
your patients in the event that their PHI has beenThe final key point of HITECH deals with how
inadvertently disclosed as the result of beingcovered entities and others can be penalized for
unsecured. The interim final regulations regardingnot adhering to the regulations, and the penalties
the security breach provisions of HITECH thatcan be harsh. The best way to protect your
became effective on September 23, 2009practice from ever reaching the point of needing
(although they will not be fully enforced beforeto know about such penalties is to ensure that
February 22, 2010), set out that providers willyou have medical scheduling software, medical
need to determine a "harm threshold" for eachbillings programs, and/or medical office
disclosure of PHI in order to determine whethermanagement software that comes with built-in
or not a notification to the affected party issafeguards such as role-based logins, and log files
necessary. The best protection against having tothat create an audit trail of what information has
make such a notification to your patients is tobeen where.
ensure that your automated systems come with