Find out how the GAO plans to get things moving. Is the privacy rule taking up your precious time and resources? You're not alone.
As the Health Insurance Portability and Accountability Act finished its first year, provider organizations reported back to the Government Accountability Office about what's working - and what's not. The question is, will the Department of Health and Human Services heed new GAO advice about these key sticking points:
Reduced access. For many providers, the privacy rule of thumb amounts to "better safe than sorry." The recent GAO report (GAO-04-965) found that while providers and plans are often allowed to disclose protected health information without patient authorization, fear of non-compliance makes them reluctant to do so.
"There is a lot of confusion," notes William Dombi, vice president for law with the National Association for Home Care & Hospice's Center for Health Care Law. Home health agencies are often overly cautious in releasing information because they don't thoroughly understand the HIPAA rules. And referral sources are similarly reluctant to part with vital information home care providers need to best serve their patients.
The government and providers "need to iron out some of the details" surrounding HIPAA, Dombi tells Eli.
Accounting for disclosures. Establishing and maintaining systems to track disclosures is an unwelcome drain on time and resources with little return - particularly for hospitals that must set up electronic patient information links across departments.
Business associate agreements. Providers say overly broad language and lack of adequate guidance from the HHS Office for Civil Rights leaves many unsure of when and how to enter into a business associate agreement with downstream entities.
And despite the considerable legal expense of negotiating and customizing agreements, individual entities have little leverage to compel associates to use their agreements.
Lack of a consumer clue. According to consumer and provider reps, "patients do not understand the privacy notices they receive, or do not focus their attention on privacy issues when the notices are presented to them."
The GAO's advice: Providers should inform patients of mandatory disclosures to public health authorities - and such disclosures should be exempt from the accounting requirement.
In addition, a public information campaign needs to do better to get patients up to speed on their privacy rule rights. The GAO says.
Editor's Note: The report, "Health Informa-tion: First-Year Experiences Under the Federal Privacy Rules," is at
www.gao.gov/new.items/d04965.pdf.
