Long-Term Care Survey Alert

On April 14, HIPAA officially joined OBRA in the long-term care arena and facilities are no doubt already finding that the two health law giants don't always see eye to eye on privacy issues.

In some cases, OBRA preempts the Health Insurance Portability & Accountability Act's patient privacy rules. For example, a facility isn't required to obtain residents' written authorization before disclosing their protected health information (PHI) for purposes required by OBRA That includes posting the statement of deficiencies (CMS2567) in the facility for residents to review or allowing surveyors access to residents' records, according to Annaliese Impink, an attorney with Bianculli & Impink in Arlington,VA.

Tip: As a courtesy, the facility could provide a broad disclosure in writing informing residents or their representatives that state and federal statutes allow some agencies and inspectors access to the information, suggests Beth Klitch, principal of Survey Solutions in Columbus, OH.

There's a catch, however: The HIPAA privacy rule does require the facility to provide an accounting of disclosure of their PHI to the resident/ representative, if requested, says Martha Meng, an attorney with Murtha Cullina in Hartford, CT.

"Yet, practically speaking it'd be difficult for facilities to track that information," she adds.

A facility could, of course, ask surveyors to provide such an accounting after each survey, if they are willing to comply.

"However, state survey agencies have generally indicated that they do not have the resources to provide this large volume of detailed information for each survey," Meng tells Eli. (The Colorado survey agency does plan to provide such information via the form provided in article 11.)

Tip: If the surveyors won't cooperate, the facility can give residents an accounting that provides the dates of the surveys with a notice that the facility is unable to provide specific information about what might have been disclosed to surveyors, suggests attorney Heather Berchem, also with Murtha Cullina.

Disclosure of residents' PHI to family members gets sticky with both OBRA and HIPAA on the table. That's because OBRA requires a facility to inform a resident's family member of a significant change in status.

HIPAA, however, allows the resident to forbid the facility from sharing his PHI with certain or all of his family members.

Thus, it's easy to see how a facility might be caught in the middle of these two requirements if the resident refuses to allow staff to inform his family of a change in condition.

Tip: If such a scenario unfolds, Impink suggests staff obtain the resident's or his legal guardians' written statement to that effect and put it in the clinical record. "Then if surveyors say, 'You didn't inform the family of the change in the resident's status, you can point out that you recognize the conflict between HIPAA and OBRA and chose to honor the resident's wishes under HIPAA," Impink advises.

Real Problems, Real Solutions: But what if you don't know the resident's wishes in that regard? For example, say the resident became incapacitated before HIPAA went into effect and has no legal guardian. And the family members whom you know as being attentive and caring ask you not to disclose the resident's PHI to a relative who they claim has suspect motives for asking about the patient.

"In such a case, the HIPAA regulation allows a health provider to use professional judgment about disclosing the information," according to Impink. "But if you decide against doing so, document the reason leading to the decision not to disclose protected health information to the individual," she advises.

Tip:To identify a family membe r or person on the phone who is authorized to receive PHI, nursing homes must find a way to validate the person's identity, advises Matthew Rosenblum with CPI Directions Inc. in New York City. "One option is to ask the person for unique identification information such as financial institutions use," he advises. "But the facility must still use discretion about how much information staff provides" over the phone, he says.

The medical privacy rule allows residents or their representatives access to the resident's designated record set, which is HIPAA-speak for clinical record. But should your facility include incident reports as part of that record?

"Facilities are not required to do so and generally do not," Impink advises. However, if a resident or his representative requested an accounting of how you used the resident's PHI, the facility would have to indicate that staff used PHI to prepare the incident report.

Infact, incident reports should be treated as work documents compiled under the auspices of client-attorney privilege, advises Klitch.

"While incident reports are typically discoverable," Klitch observes, "you might as well not draw a yellow brick road for surveyors and ombudsmen."

Of course, the facility does chart an incident in the resident's medical record for example, if the resident fell, you'd describe the cause and extent of his injury,  what the facility did to treat it and the outcome, adds Kathy Hurst, an attorney and consultant with Hurst Consulting Group in Chino Hills, CA.