Health Information Compliance Alert

Understand what "reasonable" protection means for your office.

Fail to take appropriate steps to curb incidental uses and disclosures of PHI, and you could easily find yourself running into a brick wall of irate patients and potential HIPAA violations.

So what is an incidental use or disclosure? "Basically, it's a disclosure of protected health information to somebody who's not supposed to have it, but it's incidental to performing your day-to-day operations," says Margret Amatayakul, president of Schaumburg, IL-based Margret A. Consulting.

One of the most common examples of an incidental disclosure would be one patient overhearing a PHI-laden conversation in an adjoining room between a physician and another patient, note Amatayakul and other experts.

Such incidental disclosures are permitted under HIPAA's final privacy rule, but only if two very important conditions are met, reports attorney Clark Stanton of Davis Wright Tremaine in San Francisco.

First: You have to comply with the minimum necessary requirement, Stanton states, which requires entities to have already made reasonable efforts to limit staffers to the minimum amount of PHI they need to perform their jobs.

Second: You should have policies and procedures that seek to minimize incidental disclosures, which includes implementing reasonable safeguards to protect patients' confidential health information from incidental leaks, advises Stanton.

"You have to meet both of those requirements in order to get a pass under the rule on incidental disclosures. Otherwise, it could constitute a violation," counsels Stanton.

1. Figure out what "reasonable" means to your organization. A covered entity must have in place reasonable administrative, technical, and physical safeguards that will limit incidental uses and disclosures, according to the privacy rule guidance issued by the Department of Health and Human Services' Office for Civil Rights.

When reining in incidental leaks, the question for many covered entities will be "What constitutes a reasonable safeguard?"

The OCR's privacy guidance also specifically states that entities need not implement particular safeguards that would create undue financial or administrative burdens, Amatayakul points out. Therefore, "we don't need to rebuild our offices" only to create private, soundproof rooms, she contends.

Instead, what's deemed "reasonable" is largely going to depend on the individual entity, the type of disclosure, and the context in which the disclosure is made.

"For example, it's one thing to call out a patient's name in a waiting room. It's another thing to call out the patient's name on the P.A. system," suggests Matthew Rosenblum, chief operations officer for CPI Directions in New York.

Tip: Discuss what kinds of safeguards or practices are "reasonable" and then document those decisions, instructs Gwen Hughes, a consultant with Chicago-based Care Communications. This way, a CE would be able to produce a documented rationalization if any of its safeguards or policies are ever called into question.

2. Raise staff awareness. "What the incidental rule is really all about is consciousness-raising," declares attorney Jack Rovner of Michael Best & Friedrich in Chicago.

Hughes recommends using training time to orient yourworkforce with your organization's policies concerning incidental uses and disclosures. Trainers could pose various kinds of examples and then have the staff talk it through and decide whether the use or disclosure would be deemed OK or not under the rule, offers Hughes.

3. Make reinforcement a top priority. Continually sensitize your staff to the potential dangers of incidental PHI disclosures, suggests Rovner. What you want to create is an environment that constantly reinforces the appropriate handling of PHI, such that employees will always know better than to "talk about PHI in an elevator," he states. Employing signs or slogans in andaround the facility might help remind workforce members of their responsibilities, he advises.

Good idea: CEs can also reinforce their staff's awareness by hosting quarterly training sessions designed to tackle the issue of incidental uses and disclosures, suggests Hughes. Privacy officials can hold regular roundtable discussions with the staff to brainstorm ways to minimize incidental disclosures without greatly upsetting workflow, she advises.

4. Maintain a reliable and comfortable reporting mechanism. Any covered entity eager to keep tabs on its incidental uses and disclosures of PHI should implement or already have in place a mechanism for staff to identify and report any such incidents.

What's important for entities to keep in mind is that most unintended disclosures of PHI have "more to do with bad policies or bad training or lack of supervision than it does with some disgruntled employee who releases a whole bunch of information," stresses Rosenblum.

5. Look for areas of improvement. Incidental disclosures may be permitted under HIPAA, but is your organization constantly thinking of low-cost ways to minimize their occurrences?

For example, notes Rosenblum, anyone who visits a hospital unit is sure to see whole banks of electronic monitors labeled with patients' names. "So anyone walking through that area might see heart rates, EKGs and other respiratory monitoring output on virtually every patient that's up there," he asserts.

And while the regs might allow for the incidental disclosure of PHI on these machines, Rosenblum contends that simply by repositioning patient monitors out of public view, entities could avoid such disclosures altogether with minimal cost and effort.

Strategy: Similarly, offices fretting over patient sign-in sheets can use peel-off signature labels. Once a patient has signed in, the receptionist can peel off the signature label and place it in a separate book away from other patients' eyes.

Also consider: Does your organization leave patient charts in open areas, such as at a nursing station or outside the door of a doctor's office? If so, "then maybe you could flip the chart upside down and have it face the wall," advises Hughes. Or simply take the charts off of the top of the counter and put them below in a desk drawer, she counsels. These are all low-cost, easy steps any entity could take to help minimize incidental disclosures, explains Hughes.

6. Don't let safeguards impede patient care. While it's necessary for CEs to employ reasonable safeguards to curtail incidental disclosures, it's also vital that your safeguards don't interfere with the efficient delivery of care, experts warn.

"The key is balancing incidental disclosures with the idea that we still have care to provide," cautions Stanton. "You don't want to let it get in the way of providing care, but you have to look at how information is used and how it might be disclosed in an incidental fashion, and find ways to minimize that."