Earn CEU credit Cathy Garrey, Connect with your - Health Care ...

Complying with the HIPAA Privacy Rule – What you need to know
...continued from page 65
Confidential communications. Under the Privacy Rule, individuals have
the right to request that communications of PHI be made by alternative
means (e.g., by mail instead of by telephone) or at alternative locations
(e.g., at work instead of at home). Health care providers are required to
accommodate all reasonable requests. Health plans must accommodate
reasonable requests only if the individual clearly states that the disclosure
of PHI could endanger the individual.
Is your rehabilitation program ready
to face the auditor’s microscope
Inpatient and outpatient rehab providers are
experiencing increased scrutiny from their
fiscal intermediaries and others. The 75%
Rule, the Recovery Audit Contractor (RAC)
project, and focused reviews for medical
necessity have changed the way rehabilitation
providers operate.
Most rehab providers have not established
effective mechanisms to assure the integrity
of their operating and billing practices when
viewed by a third party. The full consequences
may only be apparent when it is too late.
Noblis provides solutions-focused services
across the post-acute care continuum and we
can help solve the IRF compliance puzzle and
help you face the future of rehab.
Contact Noblis’ Center for Health Innovation
Post-Acute Strategy experts (404.231.4422)
to discuss customized solutions to your
compliance needs. We will help you to climb
out from under the auditor’s microscope.
www.noblis.org/healthcare • 404.231.4422
Administrative requirements
The Privacy Rule requires covered entities to implement certain administrative
requirements. In effect, these requirements create an obligation for covered
entities to establish a privacy compliance program. That is, many of the
requirements are similar to the elements of a general health care compliance
program. For example, covered entities must:
n Designate a privacy officer.
n Develop and implement privacy policies and procedures.
n Provide training to all members of the workforce.
n Have a process in place for individuals to make complaints regarding
privacy issues, including issues related to the covered entity’s compliance
with the Privacy Rule and its own privacy policies and procedures.
n Have and apply appropriate sanctions against employees who violate
the Privacy Rule and/or the covered entity’s privacy policies and procedures.
n Refrain from intimidating or engaging in any retaliatory acts against
individuals who exercise their rights under the Privacy Rule or who file
a complaint against the covered entity.
n Mitigate any harmful effect that results because of an act of noncompliance
with the Privacy Rule or the covered entity’s privacy policies and
procedures.
n Implement appropriate administrative, technical, and physical safeguards
to protect the privacy of PHI.
n Maintain documentation as required by the Privacy Rule.
Enforcement
The HHS Office for Civil Rights (OCR) is responsible for enforcing the
Privacy Rule. OCR has the authority to impose civil monetary penalties
(CMPs) for violations of the Privacy Rule. CMPs are limited to $100 per
violation with a maximum of $25,000 per year for each identical Privacy
Rule requirement that is violated.
The United States Department of Justice (DoJ) has the authority to impose
criminal penalties for violations of the Privacy Rule. Specifically, if a person
or entity knowingly obtains or discloses PHI in violation of the Privacy
Rule, the person or entity may be liable for up to $50,000 and/or may be
imprisoned for up to one year. If a person or entity obtains or discloses the
October 2008
66
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org