Health Information Compliance Alert

4 steps to smooth your access request edges

The privacy rule lets patients view their protected health information. What it doesn't do is give you a strategy to make that happen. These steps will have you properly responding to patient requests in no time.

Any policy or procedure is going to fall apart at the seams without a trained professional to "shepherd the process," says Gina Cavalier, an attorney with Sonnenschein, Nath & Rosenthal in Washington, DC.

Your patient record point-person must be able to "look at the records and do an overview of them before deciding whether to approve or deny the request," asserts Deborah Larios, a partner in the Nashville, TN office of Miller & Martin. Patients have to know what they're looking at, she explains.

Whoever you assign to this task must also have a good working relationship with your business associates, Cavalier reminds; he or she "has to know how to contact the appropriate people at those entities in order to fully comply with the patient's request" in a timely manner, she asserts.

Your records manager must also train the entire department on how to process and fulfill requests, reminds Cindy Nixon, medical records director and privacy officer for Cookeville Regional Medical Center in Cookeville, TN. "Any problems must be immediately sent to the medical records person" to ensure that patients receive the best possible outcome, she asserts.

STEP 2:MAKE THE RECORD WORK FOR YOU

"You may always provide access, but you may choose to deny access in limited cases," Cavalier says. Example: You're not required to provide patients with their psychotherapy notes, she states. "You have to use your best judgment to make that decision," she adds.

Problem: "The record may contain information about other patients or the patient's family," Larios notes. You cannot give your patient that information. Remember: You should also leave out incident reports or any other information not part of the designated record set, she says.

Solution: Rather than waiting for patients to request their information, filter records as you create them. "The past practice was to lump all information about a patient together," but special information required for insurance purposes or for your attorneys doesn't need to be stored in the chart, Larios affirms. "It's too easy to forget and then give that information to the patient," she explains.

Caution: You cannot separate any information that has been used "for patient care or to make decisions about a patient," Larios reminds. "Train your staff to recognize what information a patient has a right to see," she suggests.

And be up-front with your patients about what information they are seeing, experts concur. If you are denying access, you must give patients a reason for it. Ablanket form is a quick, painless solution (see Access Denied?).

STEP 3:BUG YOUR BUSINESS ASSOCIATES

"If your billing company has patient records, you have to ask for all the PHI they hold," Cavalier counsels. "You must also go to your business associates and pull back any information they have," she adds.

Plan ahead: Set up your business associate agreement (BAA) to highlight this need, Cavalier recommends. The BAAmust require "the BAto promptly provide any PHI that you request in connection with an individual's request for access," she advises.

The privacy rule mandates that you supply information within 30 days, but "some states have laws that are more stringent," Cavalier reminds. Best practice: "Set a time limit in your BAAfor getting information from your associates" so that you meet both requirements, she recommends.

When patients are handling their original files, your staff must be observant. "There are many cases where a patient gets mad, tries to tear up their record or pulls out a pen to change it," Nixon warns. Staff presence can deter this behavior.

However, your staff should not attempt to explain to patients what is contained in their files. "Tell them to talk to their providers," Nixon suggests. "If they are concerned about quality of care, then we have them make an appointment with the risk manager," she relates.

Considering the limited space at most hospitals, you will want to develop a process for allowing walk-ins. Strategy: "Schedule a mutually convenient time for the patient to come in and look at the record," she recommends. You can also offer to send them a copy of the record for a small fee and guarantee a quick turn-around time, she suggests.