Health Information Compliance Alert

You can stop incidental disclosures from invading your office.

Believe it or not, incidental disclosures can lead to a privacy rule violation. Use these tips to curb incidental disclosures and save your compliance efforts.

The most frequent permitted disclosures occur when your staff has confidential discussions within earshot of your patients. At times, it may be impossible to avoid this dangerous situation, but whenever possible, end the disclosure simply by asking your staff to lower their voices, says Anna Spencer, an associate with Sidley Austin Brown & Wood in Washington, DC.

Tip # 1: Designate special areas away from your patients for office staff to talk openly about patients' conditions, suggests consultant Maggie Mac of Pershing Yoakley & Associates in Clearwater, FL.

Tip # 2: Be aware of what your frontline staff is doing, Mac advises. Specifically, stay close to the front desk or hang out in the waiting room. That way, when your staff's voices start to carry, you can quickly remind them that your patients can hear them.

Change the wording your frontline staff uses with patients to both streamline your information gathering and keep your staff from disclosing a patient's PHI to others in the waiting room.

Tip #3: Swap out 'Are you still at 123 Place Street?' with 'Has your address changed since your last visit?' and 'Do you still have BlueCross BlueShield?' with 'Has your insurance information changed?'

Best practice: Ask patients to fill out a demographic sheet and ask for a copy of their insurance card each year, even if they answer 'No' to your questions about a new address. That way, you stay on top of changes without any PHI leaks, Mac says.

Good idea: Stamp the date you acquired new information on the front of patients' charts so you don't have to flip through the chart each time they visit.

It might seem easier to sweep your incidental disclosures under the rug, but you'll do your office a better service if you use slip-ups to train your staff on what to look out for, says Jenny O'Brien, Director of Corporate Compliance at Minneapolis, MN's Allina Hospitals & Clinics.

Tip #4: "Each time there is a disclosure, strip it of names and talk with your staff about how it could have been avoided," O'Brien suggests. "It hits much closer to home if our staff knows that we did this ourselves," she explains.

Tip #5: Post a disclosures 'cheat sheet' in a place where your frontline staff can see it at all times, Spencer counsels.

Example: Create a two-column chart with incidental disclosures in Column A and possible violations in Column B.

Remember: Draw on the situations common to your office when creating your examples.

Tip #6: Have your staff take online HIPAA courses or send them to local conferences, Mac recommends. "Getting certified as a privacy or security specialist will make your staff feel important," and that will make them be more careful with disclosures, Mac contends.

The Bottom Line: Incidental disclosures are permitted by the privacy rule, but the fewer your staff makes, the better, advises Spencer. If your staff doesn't take the appropriate safeguards to protect PHI, an incidental disclosure can easily slide into the realm of a HIPAA violation, she warns.