Earn CEU credit Cathy Garrey, Connect with your - Health Care ...

HM-MDaudit_1_08.qxd 1/25/08 4:10 PM Page 1
several specific examples, including, for example, determinations
of coverage, billing, claims management, collection activities, and
utilization review. Finally, health care operations is a very broad
category of non-treatment and non-payment business activities
undertaken by a covered entity. The Privacy Rule sets forth several
specific examples of health care operations, including quality
assessment and improvement activities, credentialing activities,
arranging for legal services, medical review and auditing functions,
and business planning and development.
A covered entity may use or disclose PHI for its own TPO purposes.
It also may disclose PHI for the treatment purposes of
another health care provider or to another covered entity or health
care provider for the recipient’s payment purposes. Moreover,
albeit more limited in scope, a covered entity may disclose PHI for
another covered entity’s health care operations purposes if:
n The health care operations purposes are quality assessment,
credentialing, training activities, or fraud and abuse detection;
and
n Both entities have or have had a relationship with the person
to whom the PHI relates.
In addition to these more day-to-day uses and disclosures, the
Privacy Rule permits covered entities to use or disclose PHI for
the following purposes, provided that the covered entity meets
the applicable requirements for the particular use or disclosure
as specifically set forth in the Privacy Rule:
n To create or maintain a facility directory
n To individuals involved in a person’s care or payment for that care
n As required by law
n For public health activities
n For victims of abuse, neglect, or domestic violence
n For health oversight activities
n During the course of judicial and administrative proceedings
n To law enforcement officials
n For decedents
n For organ donation
n For research purposes
n To avert a serious threat to public health or safety
n For specialized government functions
n For workers’ compensation purposes
Manage
your risk.
Protect your revenue.
Seven of the top 15 healthcare organizations as ranked by
US News & World Report are using MDaudit to automate
the administrative tasks of compliance auditing. Using
strategic, risk-based audit methodology, they:
• Increase audit productivity: More providers are
audited in less time, allowing your staff to focus on
changing provider behavior.
• Quickly target risk areas: Risk-based audit scheduling
helps you easily target non-conforming providers.
• Improve reporting capabilities and consistency:
Professional reports quickly illustrate areas of concern.
• Monitor audit status across departments:
Audit status and productivity is assessed at a glance.
• Allow staff to focus on value-added activities:
With more time and actionable information, your staff can
focus on provider education to eliminate incorrect coding.
To find out more and to schedule a free ROI analysis, call
Hayes’ MDaudit team at 617-559-0404 or send an email to
mdaudit@hayesmanagement.com.
For all other uses and disclosures, that is, for all uses and
disclosures that the Privacy Rule does not specifically permit, a
Continued on page 65
www.HayesManagement.com
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org
63
October 2008