Health Information Compliance Alert

Simple documentation protocol is easier and less expensive than you think.

Once your organization has determined the types of PHI disclosures it must account for, your next step is to design and implement a system that will enable you to keep track of these disclosures.

Ideally, you want to capture and record all accountable disclosures in a centralized location, and you want to be able to do so in an effective -- and cost-effective -- manner, advises Rose Dunn, a consultant with St. Louis-based First Class Solutions Inc.

Accounting solutions can range from specialized software to traditional pencil-and-paper tracking techniques. Dunn has been outfitting her clients with a software product called Cortrak, which can help handle HIPAA's accounting requirements for small and large facilities alike. Though the software has been available to health care facilities since 1991, Cortrak has been updated with HIPAA enhancements to enable entities to "go online and ... capture those disclosures that they make," reports Dunn.

Cost saving tip: If you're not ready or able to invest in specialty software from a vendor, you may be able to manage your accounting functions with other software programs such as Microsoft Excel or Access, says Donna Padnos, a senior management consultant with The Superior Consultant Company in Holly Springs, NC. However, your success with these applications will depend largely on the size and scope of your facility.

And then, of course, entities might manually log all accountable disclosures directly inside the patient's medical record, "so that when the patient requests an accounting, you go to the front of the record and see what disclosures have been made," suggests Stephen Bernstein, an attorney with McDermott Will & Emery.

Time saver: And while this method may seem impractical for large-scale or continual disclosures to public health agencies, OCR has suggested that entities can use template language on its accounting forms to describe and summarize these types of disclosures to the patient, Bernstein reports.

Therefore, instead of making a note in each individual's medical record for every public health disclosure, you might append a cover sheet to your accounting form that contains a generic statement describing these disclosures, says Bernstein.

Implement Policies & Procedures

The best-laid plans for a centralized accounting system won't mean a thing unless you've established processes for handling accounting requests. For starters, this means that you've got to secure appropriate documentation of patients' requests.

NPP is vital: Any covered entity "worth its salt would have a statement in its notice of privacy practices stating that any request to exercise the individual rights has to be in writing," states David Ermer, an attorney with Gordon & Barnett in Washington, DC. To make sure that those requests come to you in writing, you should develop a form that patients will use specifically to request an accounting of disclosures (see the sample document in this issue).

Designate key players: Your organization then needs to figure out how your workforce is going to process these requests, advises Padnos. Who's going to receive these request forms? Will all accounting requests be sent to your privacy officer or to another individual or department? Will the person who receives the request also be the one to produce the accounting? You need to make sure that a patient's request form isn't going to languish at the bottom of some paper pile, especially when you have to respond to these requests within 60 days, she warns.

Staff training a must: And don't forget to educate and train all those staff members responsible for disclosing PHI within your facility, Padnos adds. Employees who are responsible for disclosing patients' identifiable information must know where and how all accountable disclosures are logged.

For example, laboratories routinely report information concerning infectious diseases to public health agencies, explains Padnos. Therefore, if your facility contains a laboratory, then you must make certain that the lab employee who is in charge of reporting such information also knows that these are accountable disclosures which must be noted in patients' logs, she says.

Keep In Mind Costs & Fees

HIPAA's privacy rule states that the first accounting you prepare for an individual in any 12-month period must be provided free of charge. However, the covered entity is permitted to charge "a reasonable, cost-based fee" for each subsequent request for an accounting within the 12-month period.

Use first year records as a guideline: You'll want to be able to justify whatever fee you impose for your accountings, says Dunn. To calculate a reasonable fee, she suggests performing a time study to determine the amount of time it takes to put together an accounting covering a 12-month period. "If you assess the amount of disclosures that you have on average for a patient and the time it would take to either hand-write them down onto a log or print a report out of a system or multiple systems, then you can anticipate the amount of effort and time it will take for a two-year, three-year, four-year, five-year and six-year" accounting, she explains.

Once you know how long it takes to assemble an accounting, you can factor in various labor expenses and other costs to arrive at a dollar amount for the fee, says Dunn. So whenever a patient submits a request, you can let them know up front how much it costs to receive a 12-month accounting of disclosures.

And if the patient wishes to obtain a two-year or six-year accounting, you can adjust your fee to reflect any extra time and effort on your part. Scaling your fee for each 12-month period covered by the accounting "lets the patient decide how much expense they want to incur for the accounting," she states.