Health Information Compliance Alert

Use this sample to craft your own practice's script.

Has the cat got your staff's tongue when it comes to responding to patients' HIPAA queries?

If so, then you might want to consider the following sample scripting language created by Teri Ann Isacson, an attorney with Pingel & Templer in West Des Moines, IA.

While scripting can help your frontline staffers tackle general HIPAA questions, they shouldn't rely on it for handling specific or detailed inquiries regarding your privacy policies and procedures, Isacson cautions.

In general, "each employee should understand when they are qualified to answer a question and when that question should be referred to another individual employee," such as the privacy officer, directs Isacson.

She further reminds covered entities that "every office is unique and has it own practices."

Therefore, CEs interested in applying this sample language should consider their own policies and practices in order to tailor their scripts appropriately.

And of course, Isacson adds, any attempt to provide scripting is pointless if your employees haven't received adequate training on your privacy policies.

• When an individual is handed a notice of privacy practices, he or she may ask what the notice is and why it is being provided. A good answer would be: "This is a notice that is being provided pursuant to federal privacy law that requires us to tell you how we will use your health information and it also tells you what rights you have regarding your own health information."

• A patient may ask, "Why are we being required to get this material and sign off that we have received it?" A good answer would be: "Congress wanted to be sure that all patients understand how their health information is being used and wanted to make sure that you know that you have rights related to your own health information."

• A patient may then ask, "Well, so what are my rights?" A good answer would be: "Your rights are set forth clearly in the notice of privacy practices. After you review the notice, I would be happy to have our privacy officer discuss them with you."

• When leaving a phone message for an appointment reminder, the message should be generic and not contain any specific information about the individual's condition, such as:

"This is Doctor Smith's office calling to remind John Doe that he has an appointment at 2:00 tomorrow afternoon."

If further instructions need to be given: "Please return our call at 888-8888 for further information about what you must do to prepare for that appointment."

• When a patient asks about information with which the employee is not familiar -- for instance, a patient asks a lab technician questions regarding information that will be released for billing purposes -- a good answer would be: "I'm sorry, but I'll have to refer you to our billing department [or privacy officer, or front desk, etc.] for answers to those questions."

• A patient may ask, "Will you release this information to my family members?" A good script answer would be: "Our notice of privacy practices addresses to whom your information may be released. [Hand them copy and point to section.] If you have any further questions, I would be happy to get our privacy officer to answer them for you." [Unless staff is adequately trained on your policy and can answer these questions for the patient.]