Health Information Compliance Alert

Question: This summer our practice has two interns from the local community college who are helping with front desk duties. The way our small office is set up, these interns are often within earshot when we are discussing patient billing and care issues. The problem is that the interns are not technically authorized to handle patient information. Does this situation fall under the Privacy Rule’s provisions allowing incidental uses and disclosures?

Answer: Yes, because the HIPAA Privacy Rule’s provisions apply universally to incidental uses and disclosures permitted under the Privacy Rule, according to the HHS Office for Civil Rights (OCR). These provisions don’t just apply to incidental uses and disclosures resulting from treatment communications or only to communications among healthcare providers and authorized medical staff.

Key: You do, however, need to make “reasonable efforts to avoid being overheard and reasonably limit the information shared” so that the incidental use or disclosure resulting from such conversations would be permissible under the Privacy Rule, OCR reminds. Consider the following examples that would fall under the incidental uses and disclosures provisions under the Privacy Rule:

• A provider may instruct an administrative staff member to bill a patient for a particular procedure, and may be overheard by one or more persons in the waiting room.
• A health plan employee discussing a patient’s health care claim on the phone may be overheard by another employee who is not authorized to handle patient information.