HIPAA Medical Privacy Rules: Will They Impact O&P Providers?
By Michael J. Allen, CPO, FAAOP, President  On August 14, the Department of Health and Human
Services (HHS) issued final modifications to the rule on medical
privacy as required under the Health Insurance Portability and
Accountability Act (HIPAA) to establish Standards for Privacy of
Individually Identifiable Health Information (the Privacy Rules, or
the Rules) which took effect on April 14, 2001.
Many of the difficulties and administrative burdens created by
the Privacy Rules will impact orthotic and prosthetic practitioners
to a great extent; however, these final modifications do offer
relief from some of the more onerous provisions contained in the
previous Rule. Probably the most significant modification is that
direct consent from patients will not be required to transfer their
health information in "routine" health care activities. The Rules
establish national standards for the protection of privacy
interests in individuals' medical records and other personal health
information. Generally, they afford patients increased access to
and control over their records and health information, set
boundaries on the use and disclosure of information, and require
systems and procedures intended as safeguards to the privacy of
health information. Violators of the Rules' requirements are
subject to civil andin some circumstances, criminalpenalties for
noncompliance.
Summary of Final Modifications
MarketingThe final Rules require O&P
practitioners to obtain an individual's prior written authorization
to use his or her protected health information for marketing
purposes, except for a face-to-face encounter or a communication
involving a promotional gift of "nominal value." HHS defines
marketing to distinguish between the types of communications that
are and are not marketing, and makes clear that O&P
practitioners are prohibited from selling lists of patients and
enrollees to third parties or from disclosing protected health
information to a third party for the marketing activities of the
third party, without the individual's authorization.
The Rules clarify that O&P practitioners communicating with
patients about treatment options or the practitioners' own
health-related products and services are not considered marketing.
For example, health care plans can inform patients of additional
health plan coverage and value-added items and services, such as
discounts for medical supplies related to O&P.
Consent and NoticeIn an attempt to change what
some see as barriers to treatment, HHS made written consent by the
patient optional for the transmittal of medical information for
routine health care delivery purposes (known as treatment, payment,
and health care operations). The Rules require O&P
practitioners to provide patients with notice of the patient's
privacy rights and the privacy practices of the O&P practice.
The notice requires treatment providers to make a good-faith effort
to obtain the patient's written acknowledgement of the notice of
privacy rights and practices. This change is a major departure from
the previous final Rules that established mandatory consent
requirements. However, the Rules also allow consent requirements
already in place to continue.
Uses and Disclosures Regarding Food and Drug
Administration (FDA)-Regulated Products and ActivitiesThe
final Rules permit O&P practitioners to disclose protected
health information without authorization to a person subject to the
jurisdiction of the FDA for public health purposes related to the
quality, safety, or effectiveness of FDA-regulated products or
activities, such as collecting or reporting adverse events,
dangerous products, and defects or problems with FDA-regulated
products.
Incidental Use and DisclosureThe final Rules
acknowledge that uses or disclosures that are incidental to an
otherwise permitted use or disclosure may occur. Such incidental
uses or disclosures are not considered a violation of the Rules,
provided that the covered entity has met the reasonable safeguards
and minimum necessary requirements.
AuthorizationThe final Rules clarify the
authorization requirements of the Privacy Rules to eliminate
separate authorization requirements for O&P practitioners.
Patients will have to grant permission in advance for each type of
non-routine use or disclosure, but providers will not have to use
different types of forms.
Political Reactions to Modified Final Rules
The Bush administration, which drafted the Rules, and other
supporters collectively agreed that the Rules strike just the right
balance between protecting patients and the need to share some
medical information. However, many privacy advocates stated their
displeasure with the Rules, saying they "fall woefully short."
Joanne Hustead, senior counsel to Georgetown University's Health
Privacy Project, stated that the Rules "undermine patient control
over private medical information" and "will erode patient trust in
the health care system." And according to a spokesperson for
Senator Edward Kennedy (D-MA), the senator will attempt to
strengthen the rules after the August recess. National Association for the Advancement of Orthotics and Prosthetics (NAAOP) 
Table Of Contents - October 2002
|
