Gastroenterology Coding Alert

6 expert tips help you minimize your disclosure risk.

Although the HIPAA laws can be fairly straightforward in some areas, there are other aspects where you may scratch your head. For many practices, incidental disclosures are a bit of a gray area.

A covered entity (CE) that fails to take appropriate steps to curb and manage any incidental uses and disclosures of protected health information could easily find itself running into a brick wall of irate patients and potential HIPAA violations.

Review the Background

So what is an incidental use or disclosure? In short, it’s a disclosure of protected health information to somebody who’s not supposed to have it, but it’s incidental to performing your day-to-day operations.

One of the most common examples of an incidental disclosure would be one patient overhearing a PHI-laden conversation in an adjoining room between a physician and another patient.

Two requirements: Such incidental disclosures are permitted under HIPAA’s final privacy rule, but only if two very important conditions are met, according to the “Incidental Uses and Disclosures” part of the HIPAA rule listed on the Department of Health and Human Services (HHS) website.

First, you have to comply with the minimum necessary requirement, which requires entities to have already made reasonable efforts to limit staffers to the minimum amount of PHI they need to perform their jobs.

Second, you must have policies and procedures that seek to minimize incidental disclosures, which includes implementing reasonable safeguards to protect patients’ confidential health information from incidental leaks.

You have to meet both of those requirements in order to get a pass under the rule on incidental disclosures. Otherwise, it could constitute a violation.

To help your organization minimize incidental uses or disclosures — and the potential for privacy violations — consider these quick HIPAA compliance tips.

Tip 1: Figure Out What Reasonable Means to Your Organization

According to the privacy rule guidance issued by the Department of Health and Human Services’ Office for Civil Rights (OCR), a covered entity must have in place reasonable administrative, technical, and physical safeguards that will limit incidental uses and disclosures.

So when it comes to reining in incidental leaks, the question for many covered entities will be “What constitutes a reasonable safeguard?”.

OCR’s privacy guidance also specifically states that entities need not implement safeguards that would create undue financial or administrative burdens. Therefore, you don’t need to rebuild your office to create private, soundproof rooms, for example.

Instead: What’s deemed “reasonable” is largely going to depend on the individual entity, the type of disclosure, and the context in which the disclosure is made.

For example, it’s one thing to call out a patient’s name in a waiting room. It’s another thing to call out the patient’s name on the intercom system.

You should discuss what kinds of safeguards your practice deems “reasonable” and then document those decisions. This way, you should be able to produce a documented rationalization if any of its safeguards or policies are ever called into question.

Tip 2: Raise Your Staff’s Awareness

Use training time to orient your workforce with your organization’s policies concerning incidental uses and disclosures. Trainers could pose various kinds of examples and then have the staff talk it through and decide whether the use or disclosure would be deemed okay or not under the rule.

Tip 3: Keep Your Staff’s Awareness Raised

Just because you’ve already given your workforce members their one-time privacy training required by HIPAA doesn’t mean you’ve completely catalogued and contained all incidental uses and disclosures in your facility.

What you should be able to establish is that not only has appropriate training been done to sensitize your staff, but also campaigns are done to continually sensitize your staff and remind them about the potential dangers of incidental PHI disclosures. What you want to create is an environment that constantly reinforces the appropriate handling of PHI, such that employees will always know better than to talk about PHI in an elevator. Employing signs or slogans in and around the facility might help remind workforce members of their responsibilities.

Good idea: CEs can also reinforce their staff’s awareness by hosting quarterly training sessions designed to tackle the issue of incidental uses and disclosures. Privacy officials can hold regular roundtable discussions with the staff to brainstorm ways to minimize incidental disclosures without greatly upsetting workflow.

You should also keep track of news reports for real examples of privacy violations or inappropriate disclosures at other facilities. Then, bring those reports to department meetings where you can determine how such occurrences might be prevented within your own organization.

Tip 4: Maintain A Reliable and Comfortable Reporting Mechanism

Any covered entity eager to keep tabs on its incidental uses and disclosures of PHI should implement — or already have in place — a mechanism for staff to identify and report any such incidents.

What’s important for entities to keep in mind is that most unintended disclosures of PHI have more to do with bad training or lack of supervision than with a disgruntled employee who releases information. Therefore, it’s essential that your staff feel comfortable reporting any mistakes or privacy breaches they may make or witness.

Tip:  One way to both educate and involve your workforce when it comes to reporting incidental disclosures is to use staff discovery tools. These instruct employees to be on the lookout for and to record any incidental disclosures they may spot, and also allow you to continually monitor the effectiveness of your policies and procedures.

Tip 5: Look for Areas of Improvement

Incidental disclosures may be permitted under HIPAA, but is your organization constantly thinking of low-cost ways to minimize their occurrences?

For example, anyone who visits a busy hospital unit is sure to see whole banks of electronic monitors labeled with patients’ names. Anyone walking through that area might see heart rates, EKGs, and other respiratory monitoring output on virtually every patient that’s up there.

And while the regs might allow for the incidental disclosure of PHI on these machines, simply by repositioning patient monitors out of public view, entities could avoid such disclosures altogether with minimal cost and effort.

Also consider: Does your organization leave patient charts in open areas, such as at a nursing station or outside the door of a doctor’s office? If so, then maybe you could flip the chart upside down and have it face the wall. Or simply take the charts off the top of the counter and put them below in a desk drawer. These are all low-cost, easy steps any entity could take to help minimize incidental disclosures.

Tip 6: Don’t Let Safeguards Impede Patient Care

While it’s necessary for CEs to employ reasonable safeguards to curtail incidental disclosures, it’s also vital that your safeguards don’t interfere with the efficient delivery of care.

The key is balancing incidental disclosures with the idea that we still have care to provide. You don’t want to let HIPAA policies and procedures get in the way of providing care, but you have to look at how information is used and how it might be disclosed in an incidental fashion, and find ways to minimize that.

Resource: To read the entire Incidental Uses and Disclosures page on the HHS website, visit https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/inciden­tal-uses-and-disclosures/index.html.