Medical Records and the Law

430 CHAPTER 12: RISK MANAGEMENT AND QUALITY MANAGEMENTaccountability, coordination with management, content, and delegation.The NCQA attempts to answer the following in the course of itsreview:• Does the plan fully examine the quality of care given to its members?• How well does the plan coordinate all parts of its delivery system?• What steps does the plan take to make sure members have access tocare in a reasonable amount of time?• What improvements in care and service can the plan demonstrate? 9During the evaluation process, the NCQA focuses on the tracking ofissues uncovered by the MCO’s quality management process, includingwhether that process follows problems through to their resolution, andassesses quality management/quality improvement studies, projects, andmonitoring activities; quality management/quality improvement committees;and governing body reports and meeting minutes. 10HIPAA and Risk Management/Quality ManagementThe Health Insurance Portability and Accountability Act (HIPAA)and the privacy regulations issued pursuant to it (Privacy Rule) applyto “covered entities,” which include most healthcare providers and certainhealthcare organizations and health plans, and create a comprehensivescheme of protection for individually identifiable healthinformation (protected health information, or PHI). 11 (For a detaileddiscussion of the Privacy Rule, see Chapters 6, 7, and 8.) AlthoughHIPAA restricts the use and disclosure of PHI, the act expressly permitscovered entities to use and disclose PHI for their “health careoperations” without the patient’s authorization. 12 The definition ofhealthcare operations includes:9See S.Dasco and C. Dasco, Managed Care Answer Book (Gaithersburg, Md.: AspenPublishers, 1996), 8–14; National Committee for Quality Assurance (NCQA), Standardsfor Accreditation of Managed Care Organizations: Standards for Quality Management andImprovement (2004).10Ibid.1142 U.S.C. §§ 1320d et seq.1245 C.F.R. § 164.502(a)(1)(ii).