Long-Term Care Survey Alert

Here's one of those million-dollar questions: Can surveyors cite your facility for HIPAA violations under the medical privacy rules that went into effect April14? While no one yet knows how surveyors will behave in the Health Insurance Portability & Accountability Act era, the answer to that question is "yes and no," say experts.

Surveyors could cite medical privacy violations, not under HIPAA, but under the applicable part of OBRA, cautions Marilyn Mines, a nurse and survey consultant with FR&R Healthcare Consulting in Deerfield, IL.

Those particular F tags have to do with notice of residents' rights, as well as written agreements with agents not to disclose private information.Also covered: privacy and confidentiality requirements,i ncluding safe-guarding clinical records. For example, under F164, facilities must keep information in resident's clinical records confidential excep twhen it's required for specified reasons, such as transfer to another health care institution or for third-party payment, etc.

Attorney Martha Meng in Hartford, CT,says she's already seen a couple of instances where surveyors have "imported what they believe to be HIPAA concepts into citations " and HIPAA hadn't even officially gone into effect yet.

In addition, surveyors could cite a facility for failure to comply with other federal laws, which would include HIPAA, notes Gene Larrabee, principal of Primus Care in Valparaiso, IN. "The question is whether the state survey agency could enforce that citation with a civil monetary penalty or othe rremedy since surveyors don't have enforcement authority for non-OBRA issues, "Larrabee adds.

The good news is that surveyors thus far do not appear to be authorized to impose civil penalties directly under the HIPAA statute, confirms Boston attorney Alan Goldberg. "Even so, future surveys are likely to include a de facto HIPAA component," he predicts.

There's an even more likely scenario: Surveyors could share what they view to be a facility's HIPAA violations with the Health & Human Services Office for Civil Rights, which enforces HIPAA's privacy regs, although HIPAA compliance is expected to be complaint-driven.

Attorney Annaliese Impink, with Bianculli & Impink in Arlington, VA, predicts the ombudsman wil lalso be a source of HIPAA complaints because they tend to focus on resident rights. "And OCR would probably look seriously at a complaint from a surveyor or ombudsman, unless they saw a pattern where an individual or agency continued to allege violations that turned out to have little or no merit," Impink says.

To avoid breaches of resident confidentiality and related F tags, avoid these privacy bloopers:

Medication carts with residents' names on them or a medication administration record left open in view of visitors.This one gets tricky because the Joint Commission on Accreditation of Health care Organizations requires facilities to use two forms of patient verification when administering medications, neither of which can be a room number. Yet HIPAA would consider use of the resident's last name on a cart in public view as a breach of privacy.

One simple strategy to help resolve this privacy issue is for the nurse dispensing medications to cover the MAR when she steps away from the cart. "Staff should also know to turn the labeled part of the medication cart to the wall and to cover it with a tarp when not in use," suggests Matthew Rosenblum with CPI Directions Inc.in New York City. "Or you could keep the cart in a restricted area when not in use," he adds.

Fax machines in areas where visitors can see incoming lab or other reports about residents' conditions. "The facility either needs to move the fax machines to a secure location or, if that is not possible, assign a staff person to regularly pick up the lab reports and other faxes, "advises Impink.

Publicly posted or published lists of residents without residents' written consent. Ask residents or their representatives to give their written permission for the facility to use or post their name for an identified list of purposes, suggests Beth Klitch, principal of Survey Solutions in Columbus, OH. "Residents should also be aware that you have to use their protected health information for the pharmacy, vendors,etc.,"she adds.(Then make sure you have the HIPAA-required business associate agreements in place where all your vendors and consultants agree to safeguard residents' PHI.)

Beware of publishing directories that inadvertently disclose information about residents' health conditions, such as the person's location on an Alzheimer's, behavior or drug unit.

And don't post the transportation schedule listing residents' visits to physicians, as this could tell a passerby something about a resident's condition. Maintain such lists in the DON's office or in a special binder at the receptionist's desk out of public view, suggests Impink.

Staff over heard talking about residents/ families in a gossipy way, especially blatantly unflattering remarks said in anger. But if surveyors cite such disclosures, check out the circumstances. "What a surveyor might view as gossip may be a needed disclosure to a healthcare professional who understands what they are receiving," says Richard Butler, principal of Survey Management Services in Indianapolis.

Say surveyors overheard staff discussing a birthday party for a resident and how happy the resident was to see his sister and how that so improved his mood. "Is that gossip or sharing a happy time?" Butler asks. "We have to be reasonable."