# Hipaa Privacy Policies



## cynthiar (Mar 14, 2011)

I have a flyer from the AAPC "ICD-10 will change Everything".  On this it tells what the physicians office must do, what the lab must do, what billing must do etc.
It states on here waiting room/front desk, and that HIPAA policies must be revised and patients will have to sign all new forms.

Please explain to me why and if there are changes to the Privacy Notice where can I find the regulations?
thanks
C. Robinson


----------



## btadlock1 (Mar 14, 2011)

This sort of explains it...
https://www.infosecisland.com/blogv...epare-for-the-Year-of-Healthcare-Privacy.html

I don't think it's required, per se, but so much about the law has changed, that it's necessary. At least, that's how I understood it...


----------



## MnTwins29 (Mar 24, 2011)

*Watch for the final rule*

The changes that will be required in the NOPP will in the final rule that is anticipated to come out at the end of this month.  That is noted in the article Brandi referenced, and will be part of the final determination on the HIPAA changes driven by HITECH.


----------



## Lanter (Dec 7, 2011)

*Hippa*

my question is if a person is the policy holder and patient is the child who is over 18 can we give information regarding the bill to the policy holder? and  where can I find this rule?


----------



## ajs (Dec 7, 2011)

Lanter said:


> my question is if a person is the policy holder and patient is the child who is over 18 can we give information regarding the bill to the policy holder? and  where can I find this rule?



Here is a link to the HHS website that talks about billing and payment as it relates to HIPAA.  You can discuss the amount due with the policyholder, but you cannot disclose the patient's diagnosis or specific services received.  This falls under "billing and collection" activities.

http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/usesanddisclosuresfortpo.html

"Uses and Disclosures for Treatment, Payment, and Health Care Operations

How the Rule Works

 What are Treatment, Payment, and Health Care Operations? The core health care activities of â€œTreatment,â€� â€œPayment,â€� and â€œHealth Care Operationsâ€� are defined in the Privacy Rule at 45 CFR 164.501. 

•â€œTreatmentâ€� generally means the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another. 
•â€œPaymentâ€� encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care.  In addition to the general definition, the Privacy Rule provides examples of common payment activities which include, but are not limited to:  
◦Determining eligibility or coverage under a plan and adjudicating claims; 
◦Risk adjustments; 
◦Billing and collection activities; 
◦Reviewing health care services for medical necessity, coverage, justification of charges, and the like; 
◦Utilization review activities; and 
◦Disclosures to consumer reporting agencies (limited to specified identifying information about the individual, his or her payment history, and identifying information about the covered entity). 
•â€œHealth care operationsâ€� are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment. These activities, which are limited to the activities listed in the definition of â€œhealth care operationsâ€� at 45 CFR 164.501, include:  
◦ Conducting quality assessment and improvement activities, population-based activities relating to improving health or reducing health care costs, and case management and care coordination; 
◦Reviewing the competence or qualifications of health care professionals, evaluating provider and health plan performance, training health care and non-health care professionals, accreditation, certification, licensing, or credentialing activities; 
◦Underwriting and other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to health care claims
◦Conducting or arranging for medical review, legal, and auditing services, including fraud and abuse detection and compliance programs; 
◦Business planning and development, such as conducting cost-management and planning analyses related to managing and operating the entity; and 
◦Business management and general administrative activities, including those related to implementing and complying with the Privacy Rule and other Administrative Simplification Rules, customer service, resolution of internal grievances, sale or transfer of assets, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity. General Provisions at 45 CFR 164.506. "


----------



## bsesender (Apr 18, 2013)

*new hipaa forms*

anyone have a sample/template of the new Hipaa privacy policy form that they will be using when icd-10 "changes everything"


----------



## JWEILER (Nov 17, 2014)

*HIPAA Policies as they relate to ICD10*

I am also trying to understand why the change to ICD10 will require new Privacy Policies for the patient.  Is someone able to explain this?  I'm also wondering if somebody has a sample policy.  Thank you!


----------

