Health Information Compliance Alert

How OHCAs Can Slay The NPP Beast

Knowing how to address HIPAA's notice of privacy practices isn't always a piece of cake for physicians who work in OHCAs, but assessing the situation carefully can help you avoid conflicts and lawsuits.
 
The American Medical Association defines an Organized Health Care Arrangements (OHCA) as one that allows two or more CEs that participate in joint activities to share protected health information in order to manage and benefit their joint operations. Easy enough, right? Well, for OHCA participants - who often play different roles in different venues - they may not know which NPP to follow.    

Direct vs. Indirect Treatment

There are two key factors covered entities need to consider to determine which NPP holds sway: the first is whether you're providing direct or indirect treatment for the patient; the second is where that treatment is being administered. The most straightforward instance is when you administer direct treatment to patients in your practice, says Kristen Rosati with Coppersmith Gordon Schermer Owens & Nelson in Phoenix. In this case, there is one NPP involved: yours. You're obligated to provide the patient with the privacy statement at delivery of the first service, document the patient's receipt of the NPP, and then stow the documentation away for the next six years, Rosati says.  If your NPP meets the reg's implementation specifications, then you're in good shape.
 
It's when you provide service at a hospital that things can become more complicated. Many hospitals have established OHCAs that cover themselves, their outlying delivery facilities, their employees and members of their medical staff under a joint NPP. Oftentimes, the hospital will add a requirement to its medical staff policies to follow the joint NPP. The hospital then outlines the facilities, providers, and other OHCA participants in the NPP they distribute to patients, asserts Rosati.
 
In addition to helping hospitals, the OHCA helps patients and providers as well. Patients expect the care they receive in the hospital to be integrated, and the OHCA helps provide that, explains Brian Gradle, an attorney in the D.C office of Epstein Becker & Green. In other words, it means that a patient receives and acknowledges only one notice rather than several. 
 
Providers benefit, too, from the coverage they receive under the OHCA's joint notice.  This makes treating patients in hospitals more convenient. All providers who are CEs still need to have NPPs for their own practices, but the OHCA keeps them from having to "carry around a stack of notices with them when they come to the hospital," Rosati adds.
 
You should check with your hospital's privacy official to verify how they're handling NPPs and to review the wording of their privacy practices. You should also check to see how the hospital addresses the roles of providers and staff in its OHCA.

Some hospitals want you to sign a contract, indicating your participation in the OHCA, but more commonly "hospitals are simply requiring providers to follow the notice as a condition of having privileges at the hospital," Rosati explains.

Since the OHCA is usually included in the medical staff policies - compliance with which is generally required in the hospital's bylaws - hospitals ensure the joint NPP is in effect.

Different Strokes For Different Folks 
 
In some cases, you'll find differences in your NPP and the hospital's.  If so, you have a decision to make: If you don't feel like the differences are material, then you could simply treat patients - delivering direct or indirect treatment - under the hospital's NPP while practicing there and use your own NPP for practice business.

 (TIP: Should you choose this route, you might want to add details about this variation in service to your own NPP to notify patients).
 
However, if the hospital's NPP does have significant differences from your own NPP or professional philosophy, then talk to your hospital to see if you can opt out of their NPP. If you choose to do this, remember then that you will have to ensure delivery of your NPP as soon as possible. Finally, some hospitals don't or haven't yet employed OHCAs at all. If that's the case, you'll have to provide your own NPP at the first delivery of service to the patient.

PCPs, Referrals and Consults: Direct or Indirect Treatment
 
In instances where you're consulting with a primary care physician (PCP), there are generally two NPPs at play: yours and the PCP's. So, which notice do you follow?

If you see the patient in your office on referral and you're providing direct treatment, you should provide them with your NPP, says Rosati. But if you're providing a consult or other indirect treatment services for a PCP without seeing the patient, then you are not required to give the patient your NPP, she says.  
 
No matter what your situation, you're always bound to operate according to the terms of your notice. "The [HIPAA] obligation exists whether or not you deliver a copy of the notice to the patient," warns Gradle. Any difference in your NPP and the PCP's are not material as long as you are following your own - and it meets HIPAA's guidelines.