HIPAA Health Insurance Portability and Accountability Act of 1996: everything you always wanted to know but were afraid to ask!

Dental Assistant, The, March-April, 2003 by Robin M. Caplan

The Health Insurance Portability and Accountability Act of 1996 was signed into law on August 21, 1996 by then President Bill Clinton. It's many provisions were designed to make health insurance more affordable and accessible. Congress included provisions in HIPAA to require Health and Human Services (HHS) to adopt national standards for certain electronic health care transactions, codes, identifiers and security. These rules may have a profound impact on healthcare organizations. At a minimum, organizations must ensure that they have written policies and procedures, training programs for staff, and methods in place to communicate with patients and ensure that their protected health information is kept private and confidential.

The Structure of the Law

HIPAA is comprised of five Titles: Title I: Portability (medical plans only), Title II: Fraud and Abuse, Subtitle F: Administrative Simplification, Title III: Tax Related, Title IV: Group Health Plans and Title V: Revenue Offsets. Dental Health care providers (as well as health plans, hospitals, etc.) are governed by the provisions in Title II, Subtitle F.

Covered Entities: those who must comply with HIPAA are health plans, healthcare clearinghouses (third party insurance), software vendors and healthcare providers (including pharmacies) who conduct certain financial and administrative transactions electronically, such as eligibility, referral authorizations and claims. Offices should contact their software vendor/clearinghouse to make sure they are compliant and determine if the office will need a software upgrade.

Title II Fraud and Abuse, Subtitle F: Administrative Simplification.

The Fraud and Abuse Control Program created under the Attorney General and Secretary of Health and Human Services acts to conduct investigations, audits and evaluations relating to delivery of health and payment for healthcare. It provides guidance on fraudulent practices and establishes a national data bank. Subtitle F mandates electronic claims filing by developing 1) Standard Healthcare Transaction and Code Set (effective 10/16/2002 or file for an extension, see below), 2) Patient Privacy Standard (effective 4/14/2003), 3) Information System Security Standard and 4) National Standard Healthcare Provider Identifier. In short, the purpose of Administrative Simplification is to streamline the processing of health care claims, reduce the volume of paperwork and provide better service for providers, insurers and patients. It is estimated that by eliminating inefficient paper forms and encouraging the use of electronic transactions, the health care industry will realize a savings of $29.9 billion over a ten year period.

Standard Health Care Transaction and Code Set: by standardizing data content, codes and electronic formats, all health plans will be required to accept these standard electronic claims, referral authorizations and other transactions. In order to apply for an extension, you must submit a plan for achieving compliance by the new deadline. The model plan is available at http://www.cms.gov/hipaa.> Patient Privacy Standard: the final modifications to the rule was published on August 14, 2002 in the Federal Register and was enacted to protect the confidentiality of medical records and other personal health information. The rule limits the use and release of individually identifiable health information; gives patients the rights to access their medical records; restricts most disclosure of health information to the minimum needed for the intended purpose; and establishes safeguards and restrictions regarding disclosure of records for certain public responsibilities such as public health, research and law enforcement. In other words:

* patients must give specific authorization before covered entities can use or disclose protected information for most non-routine circumstances.

* covered entities must provide patients with written notice of their privacy practices and patient's privacy rights.

* covered entities must first obtain an individual's specific authorization before sending them marketing materials. However, the rule permits free communication with patients about treatment options and other health related information.

* covered entities may not sell, trade, share or otherwise release patients' names to a business for the purposes of marketing.

* consents for release of information and use of health information will have to be more specific about what and how much information is released.

* offices will need to obtain written authorization from patients permitting the office to leave messages for them on their personal answering devices

* while locking file cabinets are not necessary, offices need to evaluate where patient charts are stored and who has access to those charts.

Offices may utilize patient sign in sheets, post daily schedules in operatories and conduct health related or business related conversations with patients in a semi-private setting as long as the office has made every reasonable attempt to comply with the final privacy rule. Detailed information regarding the privacy rule can be found at http://www.hhs.gov/ocr/hipaa or www.hhs.gov/ocr/hipaa/finalreg.html