Optometry Coding & Billing Alert

Can you and your staff spot the difference between a permitted incidental disclosure and a potential HIPAA privacy violation? Or better yet, can you and your staff hear the difference?
 
Incidental disclosure is defined as disclosure of protected health information to somebody who's not supposed to have it, but it's incidental to performing your day-to-day operations. An example is a patient overhearing staff discuss a patient's protected health information (PHI) in the office.
 
These usually don't constitute a punishable offense. A privacy violation is day-to-day carelessness or systemic indifference that results in people other than the patient obtaining a patient's PHI. These violations can result in fines and even jail time for serious violations.

 You can minimize most incidental uses and disclosures involving paper or electronic forms of PHI by moving medical charts or computer screens out of ready view, says consultant Gwen Hughes with Chicago-based Care Communications.
 
But more often than not, incidental PHI disclosures are likely to result from conversations patients overhear within your practice, she says.
 
"It's easier to overhear and harder to fix those overhearing problems than to move a physical piece of equipment or documentation," Hughes says.
 
Have a look at these three conversations Hughes describes and determine whether each is a permitted incidental disclosure under HIPAA or an impending privacy violation:
  
1. A patient waiting in an examination room overhears a nurse relaying another patient's test results to a physician in the next room.
 
2. A patient overhears a conversation between a staff member and an insurance company representative in which the staff member is attempting to secure preauthorization for another patient's surgery.
  
3. A bartender overhears one nurse telling another about the medications prescribed to a famous actor who just visited the practice.


ANSWERS:
1. This example constitutes an incidental disclosure because it's simply a by-product of a use or disclosure that the privacy rule otherwise permits, says consultant Gwen Hughes with Chicago-based Care Communications.
 
"Physicians and nurses having conversations in normal tones of voice is permissible because the rule doesn't expect us to remodel and put soundproofing in every wall or door," she says.
 
2. This is an incidental disclosure under the privacy rule, Hughes says, since seeking preapproval from an insurance company is a standard and appropriate procedure relating to medical billing.
 "It goes back to the fact that big capital expenditures are not expected" for constructing  private, soundproof rooms for permitted conversations, Hughes says.
 
"And as long as people aren't yelling it" and "they're having those conversations where they make sense for them to be," then any overheard PHI would simply be an incidental disclosure. 
 
3. This is most definitely not an incidental disclosure, Hughes says, because it has nothing to do with treatment, payment or healthcare operations.
 
"It was totally inappropriate to be discussing that at all, much less outside of the workplace," she says. "It's simply not acceptable."