HIPAA

 View Only
  • 1.  Physician office form - patient fills out indicating who the practice can communicate or share information

    Posted 10 days ago
    Good morning everyone!

    I have received a question from our Patient Access Manager for our large physician office practice regarding the form they have patient's fill out indicating who they can communicate with (i.e. spouse, child).  The question is how often should they have patient's update that form.  I have been unable to find guidance on this  particular type of form so I am reaching out for feedback.

    Thank you in advance for your assistance.  Happy Friday!

    ------------------------------
    Vicki
    ------------------------------
    Default Blank


  • 2.  RE: Physician office form - patient fills out indicating who the practice can communicate or share information

    Posted 9 days ago
    These forms are not required for HIPAA purposes because HIPAA allows healthcare providers to speak with individuals involved in a patient's care provided the patient doesn't object. In my experience though staff push for these forms which they use as a crutch because they are not comfortable with or feel empowered to act as per HIPAA, so I completely understanding why organizations obtain these. It's really an organizational decision as to how often of if you get them signed at all, or just do something different like have a practice of putting a note/flag somewhere in the patient's chart. I've developed these forms in the past as a one and done, with a statement on the form that the patient should update us as things change. Think about it from a risk perspective. If you develop a policy that says you are going to complete at every visit or annually and then do not and something happens, have you just opened yourself up to additional risk by not abiding by your own policy?

    ------------------------------
    Brenda Manning JD, CHC, CHPC
    Privacy Counsel
    Maximus, Inc.

    The views expressed herein are my own and do not represent those of my employer. They are not meant to constitute legal advice or create an attorney-client relationship.
    ------------------------------

    Default Blank


  • 3.  RE: Physician office form - patient fills out indicating who the practice can communicate or share information

    Posted 9 days ago
    I agree with everything Brenda said but would add a couple of points. As she mentioned, the authority to disclose PHI to family and close friends involved in a patient's care comes from the legislation itself. These forms are not authorisations for the release of PHI and do not even come close to meeting the requirements for such. However, as Brenda said, they are not required.  Since they are not required the Privacy and Security Rules provide no guidance. Where HIPAA is silent OCR expects a covered entity's policies and procedures to provide guidance to staff and be enforced. If you are going to use these forms I would say you need to develop such a policy, train your staff on the policy and enforce it. 

    One more important point: If you are going to disclose PHI based on these forms I believe that must be specified in your Notice of Privacy Practices. The generic version almost everyone uses has a clause like "...we may disclose your information to friends and family members involved in your care unless you object." I think a more specific description of who and how those disclosures are made would be in order. Not being an attorney, I can not provide specific verbiage guidance but I would think it starts with something like we may disclose information about your condition, care and follow up instructions to people you list on our form title People With WHom You Would Like Us to Discuss your Care.  You can change the people on that list by XXXXX. Remember the NPP is not just a boilerplate document you are required to print, post, and provide it should describe the actual practices you use at your facility. 

    Hope this is useful.
    -Alex- 

    Alexander I Slosman, MHA, CHC, CHPC





    Default Blank


  • 4.  RE: Physician office form - patient fills out indicating who the practice can communicate or share information

    Posted 8 days ago
    I wouldn't recommend being that specific in your organizational NOPP because as an organization you'd be taking on unnecessary risk by boxing yourself into a policy and procedure that goes over and above HIPAA.

    ------------------------------
    Brenda Manning JD, CHC, CHPC
    Privacy Counsel
    Maximus, Inc.

    The views expressed herein are my own and do not represent those of my employer. They are not meant to constitute legal advice or create an attorney-client relationship.
    ------------------------------

    Default Blank