HIPAA

Question 1

HIPAA is comprised of three rules. What are they?

Answer 1

1. The Privacy Rule
2. The Transaction Rule
3. The Security Rule

Question 2

What is the Privacy Rule?

Answer 2

The privacy rule of HIPAA provides regulations and safeguards regarding confidential patient information.

Question 3

What is the Transactions Rule?

Answer 3

The rule requires that a nationally standardized format be used for all health-care transactions that are transmitted electronically, most notably all insurance claims.

Question 4

What is the Security Rule?

Answer 4

The security rule addresses issues of physical security, such as locking filing cabinets and encrypting e-mails.

Question 5

What is the relationship between HIPAA and California Law?

Answer 5

HIPAA is a federal law that can take precedence over state law. Specifically, when HIPAA is stricter, it supersedes state law. In contrast, when state law is stricter, it supersedes HIPAA. When state law and HIPAA are contradictory, making it impossible to comply with both, the practitioner must follow HIPAA.

Question 6

What is Protected Health Information (PHI)?

Answer 6

Refers to health information that identifies a patient, and that is transmitted or maintained in any form (e.g., on computer, handwritten notes, etc.).

PHI includes information about the mental health condition of a patient (e.g., diagnosis, symptoms, prognosis, progress), the provision of services (e.g., medication, treatment modality, treatment plan, frequency of treatment), and payments. Typically, chart notes kept on a psychotherapy patient are considered to be PHI.

Question 7

How do you ensure that psychotherapy notes receive special protections not generally afforded to Protected Health Information (PHI)?

Answer 7

In order for process notes to be considered “psychotherapy notes” and to be accorded special protection, HIPAA requires that these notes be “separated from the rest of an individual’s medical record.”

Most analysts interpret this to mean that psychotherapy notes must be kept physically separate from the medical record.

Question 8

According to HIPAA, when can a psychologist disclose PHI without the patients consent?

Answer 8

By law, psychologists, medical doctors, and hospitals may disclose and use PHI without a patient’s consent if they are doing so for:

1. treatment (e.g., a consultation)
2. payment (e.g., billing an insurance company)
3. health care operations (e.g., utilization review).

Although patient consent is technically not needed in these three disclosure situations, it is still considered the standard of practice for psychologists to obtain written permission from patients for any disclosures of confidential information.

Question 9

According to HIPAA, what is “authorization” and when is it needed?

Answer 9

Authorization refers to obtaining patient permission to disclose information on a release of information form.

According to HIPAA, a practitioner does not need to obtain authorization for disclosures, as long as any of the disclosures are for the purposes of treatment, payment, or health care operations (as these are covered under generalized consent).

However, an authorization is needed for any other type of disclosure.

Question 10

According to HIPAA, can managed care organizations and other third- party reimbursement entities require the release of treatment notes in order to provide reimbursement?

Answer 10

No

Question 11

According to HIPAA, what are the six patient rights?

Answer 11

1. Right of Notice
2. Right to Request Restrictions
3. Right to Receive Confidential Communications by Alternative Means and Alternative Locations
4. Access to Records
5. Right of Amendment
6. Right of Accounting`

Question 12

Right of Notice

Answer 12

Patients have the right to be informed about the psychologist’s privacy policy and the ways in which personal health information may be used or disclosed. Patients should be provided with a written copy of the psychologists privacy policy

Question 13

Right to Request Restrictions

Answer 13

Psychologists are obligated to agree to “reasonable requests,” to restrict use and disclosure of PHI.

Question 14

Right to Receive Confidential Communications by Alternative Means and at Alternative Locations

Answer 14

Patients may elect to have psychologists mail their bills to an address other than their home address or not to call them at their home phone, in order to protect patients’ confidentiality.

Question 15

Access to Records

Answer 15

Patients have the right to inspect and receive a copy of personal health information (PHI) that is in the medical record.

Question 16

According to HIPAA, do patients have the right to obtain or inspect a copy of their psychotherapy notes?

Answer 16

No

Question 17

Right of Amendment

Answer 17

Patients may request changes to their PHI to improve accuracy. If a psychologist determines that such a change would make the PHI less accurate, the request may be denied. All requests for amendment, as well as whether the requests were granted or denied, must be documented.

Question 18

Can PHI information ever be expunged?

Answer 18

The record may never be expunged (i.e., inaccurate information deleted and replaced with accurate information). Instead, changes to the record should be noted as amendments.

Question 19

Right of Accounting

Answer 19

Patients have the right to receive an accounting of all the disclosures of their PHI for the past six years.

Question 20

What five general practices are necessary to he HIPAA compliant?

Answer 20

1. Written Privacy Policy
2. Tracking Disclosures
3. Compliance of Employees and Business Associates
4. Protection for Psychotherapy Notes
5. Safeguarding Access to PHI

Question 21

If you wish to maintain records electronically, what three procedures must be instituted?

Answer 21

1. The therapist must ensure that the confidentiality of the records is safeguarded.
2. The therapist must make sure they are tamper proof.
3. Off-site, backup storage system is needed.

Hardcopies may be destroyed once the records are stored electronically.

Question 22

According to HIPAA, when are you able to withhold treatment records? How does this differ from California law? How does it differ when the patient is a child versus an adult?

Answer 22

According to HIPAA, treatment records can only be withheld when doing so would endanger someone’s physical safety.

According to California law, treatment records can be withheld when doing so would adversely impact the treatment, or would be detrimental to the physical or emotional well-being of the patient.

When the patient is an adult, HIPAA overrides California law. When the patient is a child, California law overrides HIPAA.

Question 23

If a patient wants another, qualified professional to review your treatment records, are you able to decline?

Answer 23

Declining this request is never a legal option.

Question 24

What does HIPAA stand for?

Answer 24

The Health Insurance Portability and Accountability Act

Question 25

What does PHI refer to?

Answer 25

Health information that identifies a patient, and that is transmitted or maintained in any form (e.g., on computer, handwritten notes, etc.)