HIPAA Flashcards
HIPAA is comprised of three rules. What are they?
- The Privacy Rule
- The Transaction Rule
- The Security Rule
What is the Privacy Rule?
The privacy rule of HIPAA provides regulations and safeguards regarding confidential patient information.
What is the Transactions Rule?
The rule requires that a nationally standardized format be used for all health-care transactions that are transmitted electronically, most notably all insurance claims.
What is the Security Rule?
The security rule addresses issues of physical security, such as locking filing cabinets and encrypting e-mails.
What is the relationship between HIPAA and California Law?
HIPAA is a federal law that can take precedence over state law. Specifically, when HIPAA is stricter, it supersedes state law. In contrast, when state law is stricter, it supersedes HIPAA. When state law and HIPAA are contradictory, making it impossible to comply with both, the practitioner must follow HIPAA.
What is Protected Health Information (PHI)?
Refers to health information that identifies a patient, and that is transmitted or maintained in any form (e.g., on computer, handwritten notes, etc.).
PHI includes information about the mental health condition of a patient (e.g., diagnosis, symptoms, prognosis, progress), the provision of services (e.g., medication, treatment modality, treatment plan, frequency of treatment), and payments. Typically, chart notes kept on a psychotherapy patient are considered to be PHI.
How do you ensure that psychotherapy notes receive special protections not generally afforded to Protected Health Information (PHI)?
In order for process notes to be considered “psychotherapy notes” and to be accorded special protection, HIPAA requires that these notes be “separated from the rest of an individual’s medical record.”
Most analysts interpret this to mean that psychotherapy notes must be kept physically separate from the medical record.
According to HIPAA, when can a psychologist disclose PHI without the patients consent?
By law, psychologists, medical doctors, and hospitals may disclose and use PHI without a patient’s consent if they are doing so for:
- treatment (e.g., a consultation)
- payment (e.g., billing an insurance company)
- health care operations (e.g., utilization review).
Although patient consent is technically not needed in these three disclosure situations, it is still considered the standard of practice for psychologists to obtain written permission from patients for any disclosures of confidential information.
According to HIPAA, what is “authorization” and when is it needed?
Authorization refers to obtaining patient permission to disclose information on a release of information form.
According to HIPAA, a practitioner does not need to obtain authorization for disclosures, as long as any of the disclosures are for the purposes of treatment, payment, or health care operations (as these are covered under generalized consent).
However, an authorization is needed for any other type of disclosure.
According to HIPAA, can managed care organizations and other third- party reimbursement entities require the release of treatment notes in order to provide reimbursement?
No
According to HIPAA, what are the six patient rights?
- Right of Notice
- Right to Request Restrictions
- Right to Receive Confidential Communications by Alternative Means and Alternative Locations
- Access to Records
- Right of Amendment
- Right of Accounting`
Right of Notice
Patients have the right to be informed about the psychologist’s privacy policy and the ways in which personal health information may be used or disclosed. Patients should be provided with a written copy of the psychologists privacy policy
Right to Request Restrictions
Psychologists are obligated to agree to “reasonable requests,” to restrict use and disclosure of PHI.
Right to Receive Confidential Communications by Alternative Means and at Alternative Locations
Patients may elect to have psychologists mail their bills to an address other than their home address or not to call them at their home phone, in order to protect patients’ confidentiality.
Access to Records
Patients have the right to inspect and receive a copy of personal health information (PHI) that is in the medical record.
According to HIPAA, do patients have the right to obtain or inspect a copy of their psychotherapy notes?
No
Right of Amendment
Patients may request changes to their PHI to improve accuracy. If a psychologist determines that such a change would make the PHI less accurate, the request may be denied. All requests for amendment, as well as whether the requests were granted or denied, must be documented.
Can PHI information ever be expunged?
The record may never be expunged (i.e., inaccurate information deleted and replaced with accurate information). Instead, changes to the record should be noted as amendments.
Right of Accounting
Patients have the right to receive an accounting of all the disclosures of their PHI for the past six years.
What five general practices are necessary to he HIPAA compliant?
- Written Privacy Policy
- Tracking Disclosures
- Compliance of Employees and Business Associates
- Protection for Psychotherapy Notes
- Safeguarding Access to PHI
If you wish to maintain records electronically, what three procedures must be instituted?
- The therapist must ensure that the confidentiality of the records is safeguarded.
- The therapist must make sure they are tamper proof.
- Off-site, backup storage system is needed.
Hardcopies may be destroyed once the records are stored electronically.
According to HIPAA, when are you able to withhold treatment records? How does this differ from California law? How does it differ when the patient is a child versus an adult?
According to HIPAA, treatment records can only be withheld when doing so would endanger someone’s physical safety.
According to California law, treatment records can be withheld when doing so would adversely impact the treatment, or would be detrimental to the physical or emotional well-being of the patient.
When the patient is an adult, HIPAA overrides California law. When the patient is a child, California law overrides HIPAA.
If a patient wants another, qualified professional to review your treatment records, are you able to decline?
Declining this request is never a legal option.
What does HIPAA stand for?
The Health Insurance Portability and Accountability Act
