RE: Contract Between Anesthesia Group and Hospital

2003-03-26 Thread Clay, Roy III (NO)
Title: RE: Contract Between Anesthesia Group and Hospital





As persons involved directly in the treatment of the patient, you do not need a business associate agreement. However, you may wish to include some language in the contract which declares that the relationship between your group and the hospital is an organized health care arrangement (OHCA) and specify which Notice of Privacy Practices will be given to the patient (usually the hospital's). 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, March 26, 2003 8:13 AM
To: WEDI SNIP Privacy Workgroup List
Subject: Contract Between Anesthesia Group and Hospital



We are an Anesthesia Group Practice that has contracts with facilities 
(hospitals)
that we provide anesthesia services for.  Do we need to have a separate 
Privacy Notice Issued and Acknowledgment signed or can we just have a 
"Business Associates" by adding this language to our existing contract?


Surely this is something that is coming up a lot with outside Labs, 
Radiology, Physical Therapists that are not facility employees and that do 
their own billing based on information that they receive from the facility.


Thank in advance for any information or experience with this matter.


 


Daryl Ewing, CPC
RPK Anesthesia, P.A.
[EMAIL PROTECTED]


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: BA v Trading Partner Agreements

2003-03-20 Thread Clay, Roy III (NO)
Title: RE: BA v Trading Partner Agreements





Trading partner agreements are used between covered entities (usually a health care and an insurance plan or a clearinghouse) to govern the exchange of covered transactions. A business associate agreement is between a covered entity (like a health care provider) and a non-covered entity (like a computer services company) which is providing a service which requires that the non-covered entity receive protected health information in order to perform the service. 

Roy G. Clay, III
Interim Compliance Officer
Louisiana State University Health Sciences Center - New Orleans 
Phone: (504) 568-2350
Fax:  (504) 568-2346
Email: [EMAIL PROTECTED]
CONFIDENTIAL AND PRIVILEGED
This message and any attachments are privileged information. If you are not the intended recipient and have received this message in error, please inform the sender and delete the contents without opening, copying, distributing or forwarding.




-Original Message-
From: Jonathan May [mailto:[EMAIL PROTECTED]]
Sent: Thursday, March 20, 2003 12:44 PM
To: WEDI SNIP Privacy Workgroup List
Subject: BA v Trading Partner Agreements




Can anyone offer a simple clarification of the difference between and when 
to use a Business Associate Agreement and a Trading Partner Agreement?


Many thanks.





_
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: Internet Pagers & Privacy

2003-03-06 Thread Clay, Roy III (NO)
Title: RE: Internet Pagers & Privacy





If all that is sent is the patient's name and address, that should be fine. If there is additional information that would allow someone to infer some about the  patient's health status, something like:

To: HIV On Call Nurse.
Call patient John Doe at 555-.


That would be considered PHI. However, I am pretty sure the paging company would be considered a "pass-through"  similar in nature to the phone company one leases network lines from. 

-Original Message-
From: Paul Weber [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, March 05, 2003 1:51 PM
To: WEDI SNIP Privacy Workgroup List
Subject: Internet Pagers & Privacy



I'm looking for some input on a scenario that was recently presented. To wit...


What are the ramifications relative to HIPAA Privacy where communications containing PHI to alphanumeric pagers held by remote nursing staff are initiated via internet e-mail?

For example, a patient coordinator sends an e-mail containing PHI (say patient name & address) to a nurse's pager or cell phone screen through a third party such as AT&T, Skypage, Arch Wireless, etc.

Thoughts?


Thank you in advance,
Paul Weber
[EMAIL PROTECTED]
-- 
__
Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: JCAHO BAA

2003-03-05 Thread Clay, Roy III (NO)
Title: RE: JCAHO BAA





The JCAHO (as well as most of the other accreditation organizations) has taken the position that trying to field everyone's individual BAA would be too much of an administrative burden, therefore they will only accept their own. You are right but this is an exception to the rule.

-Original Message-
From: Teri Baskett [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, March 05, 2003 8:31 AM
To: WEDI SNIP Privacy Workgroup List
Subject: JCAHO BAA



On that BA thread, we just recieved a letter from JCAHO wanted us 
to complete their BAA form.  Following previous messages, 
shouldn't I (since I'm the CE) be sending them our form, and we 
shouldn't be signing their's?



Teri Baskett, CISO
LifeSpring
[EMAIL PROTECTED]


   


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: Another thread on Security/Privacy question

2003-03-04 Thread Clay, Roy III (NO)
ou are giving them 
  pertains to payment for health care services because you are a health care 
  provider and they are a collection agency.  You don't need much more 
  information than that to fill in the blanks.  And HIPAA does require that 
  the blanks be filled in!  HIPAA does say the PHI has to specify exactly 
  what procedure the payment was for, or when the payment was due.  
  Just that it pertains to payment for services.Noel 
  Chang--Open WebMail Project (http://openwebmail.org)-- Original Message ---From: 
  "Clay, Roy III (NO)" <[EMAIL PROTECTED]>To: "WEDI SNIP Privacy 
  Workgroup List" <[EMAIL PROTECTED]>Sent: Mon, 3 Mar 2003 
  08:42:10 -0600 Subject: RE: Another thread on Security/Privacy 
  question>The name and the credit card number are not PHI under 
  HIPAA. It does  not become PHI until some health information is added. If 
  the information contains CPT codes, for example,  then you would either 
  need to  include that information in the Notice of Privacy Practices or 
  obtain an authorization at the time of swiping the card. > > 
  One of the questions we had to answer was if the collection agency we 
  used to collect bad debt was a busness associate. We found that all 
  they needed was the guarantor's contact information and an amount. No 
  health information was needed for them to perform their task. 
  Therefore they were not a business associate. > Roy G. Clay 
  III> Interim Compliance Officer> Louisiana State University 
  Health Sciences Center> New Orleans Campus> 
  Phone:    (504) 568-4367> Fax:    
      (504) 568-6378> Email:    
  [EMAIL PROTECTED]> > -Original Message-> From: 
  Christine Hudnall [mailto:[EMAIL PROTECTED]> Sent: Friday, February 28, 2003 2:36 
  PM> To: WEDI SNIP Privacy Workgroup List> Subject: Another 
  thread on Security/Privacy question> > I'm sending this out 
  again, if someone could please help us.  Thanks.> > 
  Christine> > What about the card swipes that we use when a 
  patient makes a> payment on their account using their credit 
  card.  Yes, we only> swipe the card and put in the last four 
  digits of the number, but> the patient name (or whoever owns the card) 
  prints out on the> receipt.> > Is that considered PHI, 
  even though we are not sending them the> name, but they print it from 
  their records?> > If so, do we need to have an agreement with 
  the company that we use> the card swipe from?> > And as 
  for eligibility, i.e., Medicaid.  We use ROVR, which is> through 
  Consultec (if I remember correctly).  Is an agreement needed> with 
  them?> > And how would I check for security for their 
  program?  Is that> something they would need to do and put in 
  writing?> > Sorry for all the questions, just, my co-worker and 
  I are trying to> go down list of all possibilities that we need to 
  check on.> > Thanks,> > Christine> 
  > 
  
  
  
  This outbound message has been scanned for viruses. 
  ---The WEDI SNIP listserv to which you are subscribed is not 
  moderated. The discussions on this listserv therefore represent the views of 
  the individual participants, and do not necessarily represent the views of the 
  WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official 
  opinion, post your question to the WEDI SNIP Issues Database at 
  http://snip.wedi.org/tracking/. These listservs should not be used for 
  commercial marketing purposes or discussion of specific vendor products and 
  services. They also are not intended to be used as a forum for personal 
  disagreements or unprofessional communication at any time.You are 
  currently subscribed to wedi-privacy as: [EMAIL PROTECTED]To unsubscribe 
  from this list, go to the Subscribe/Unsubscribe form at 
  http://subscribe.wedi.org or send a blank email to 
  [EMAIL PROTECTED]If you need to unsubscribe but 
  your current email address is not the same as the address subscribed to the 
  list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org 

---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: Another thread on Security/Privacy question

2003-03-04 Thread Clay, Roy III (NO)
Title: RE: Another thread on Security/Privacy question





Noel,
Based upon that interpretation, health care providers (or their banks) need to add all the credit card companies and banks that issue credit cards to their BA agreement list if they are to accept credit card payment for copays. Providers (or their banks) would also need to have BAA's with all the banks whose checks they accept for "payment for the provision of health care to an individual". These checks must be presented to the bank it was written from in order to receive payment. Otherwise all providers must only accept cash for deductibles and copays. 

I don't think this impact on commerce was the intention of the regulation. Rather, the definition of individually identifiable health information refers to the itemized bill which references CPT codes that identify the procedures which, in turn, identify the health condition of the individual. This is the threat to privacy. 

Perhaps there will be a further amendment to the regs to address this in the same way the information about incidental disclosure was added to address fears that overhearing a doctor's conversation in the hall would result in a HIPAA violation. 

Whichever way you choose to interpret the regs, you will need to be consistent across all operations. If you require a BAA for you collection agency and don't require one for your other methods of managing accounts receivables, you will need to expain why those operations are different than the collection agency. I don't see how you can. 

Roy G. Clay III
Interim Compliance Officer
Louisiana State University Health Sciences Center 
New Orleans Campus
Phone: (504) 568-4367
Fax:   (504) 568-6378
Email: [EMAIL PROTECTED]


-Original Message-
From: Noel Chang [mailto:[EMAIL PROTECTED]]
Sent: Monday, March 03, 2003 11:24 PM
To: Clay,Roy III (NO); WEDI SNIP Privacy Workgroup List
Subject: RE: Another thread on Security/Privacy question



Roy,


I disagree with your conclusion that your collection agency is not a BA, even 
if all you give them is a name and an amount.


The definition of PHI draws on the definition of Individually Identifiable 
Health Information which is defined in section 160.103.  That definition says 
that IIHI is information that is "created or received by a health care 
provider" and relates to the "past, present, or future payment for the 
provision of health care to an individual" and that "identifies the 
individual".


Whether your collection agency realizes it or not, you (the covered entity) 
clearly know that you are releasing information that you 1) created or 
received, 2) pertains to the past payment for the provision of health care to 
an individual, and 3) it identifies the individual by giving their name.  
Thus YOU are releasing PHI to your BA, even if your BA doesn't realize it is 
PHI. Althoug one could reasonably argue that the BA ought to assume the data 
you are giving them pertains to payment for health care services because you 
are a health care provider and they are a collection agency.  You don't need 
much more information than that to fill in the blanks.  And HIPAA does 
require that the blanks be filled in!  HIPAA does say the PHI has to specify 
exactly what procedure the payment was for, or when the payment was due.  
Just that it pertains to payment for services.


Noel Chang


--
Open WebMail Project (http://openwebmail.org)



-- Original Message ---
From: "Clay, Roy III (NO)" <[EMAIL PROTECTED]>
To: "WEDI SNIP Privacy Workgroup List" <[EMAIL PROTECTED]>
Sent: Mon, 3 Mar 2003 08:42:10 -0600 
Subject: RE: Another thread on Security/Privacy question


> The name and the credit card number are not PHI under HIPAA. It does 
> not become PHI until some health information is added. If the information
> contains CPT codes, for example,  then you would either need to 
> include that information in the Notice of Privacy Practices or 
> obtain an authorization at the time of swiping the card. 
> 
> One of the questions we had to answer was if the collection agency 
> we used to collect bad debt was a busness associate. We found that 
> all they needed was the guarantor's contact information and an 
> amount. No health information was needed for them to perform their 
> task. Therefore they were not a business associate. 
> 
> Roy G. Clay III
> Interim Compliance Officer
> Louisiana State University Health Sciences Center
> New Orleans Campus
> Phone:    (504) 568-4367
> Fax:      (504) 568-6378
> Email:    [EMAIL PROTECTED]
> 
> -Original Message-
> From: Christine Hudnall [mailto:[EMAIL PROTECTED]]
> Sent: Friday, February 28, 2003 2:36 PM
> To: WEDI SNIP Privacy Workgroup List
> Subject: Another thread on Security/Privacy question
> 
> I'm sendin

RE: Another thread on Security/Privacy question

2003-03-03 Thread Clay, Roy III (NO)
Title: RE: Another thread on Security/Privacy question



With 
the population we serve, credit cards are not an issue. These are accounts that 
did not qualify as free care and were made self pay. The collection agency 
merely has contact information and an amount. But the issue was not a privacy 
agreement (the contract already includes non-disclosure language) but whether we 
needed specifically a business associate agreement under HIPAA because an 
exchange of PHI was involved for the collection agency to do its job. These are 
two separate and distinct species as are the privacy agreements under GLB. 


  -Original Message-From: David Frenkel 
  [mailto:[EMAIL PROTECTED]Sent: Monday, March 03, 2003 8:47 
  PMTo: WEDI SNIP Privacy Workgroup ListSubject: RE: 
  Another thread on Security/Privacy question
  
  Roy,
  I would agree with 
  your conclusions with regard to HIPAA but you will probably none the less need 
  a privacy agreement with the collections agency not to disclose or sell credit 
  card information.    The FTC does not look too 
  favorably on the disclosure of credit card 
  information.
   
  Regards,
   
  
  David 
  Frenkel
  Business 
  Development
  GEFEG 
  USA
  Global 
  Leader in Ecommerce Tools
  www.gefeg.com
  612-237-1966
  -Original 
  Message-From: Clay, Roy 
  III (NO) [mailto:[EMAIL PROTECTED]] Sent: Monday, March 03, 2003 8:42 
  AMTo: WEDI SNIP Privacy 
  Workgroup ListSubject: RE: 
  Another thread on Security/Privacy question
   
  The name and the credit card number are not PHI under 
  HIPAA. It does not become PHI until some health information is added. If the 
  information contains CPT codes, for example,  then you would either need 
  to include that information in the Notice of Privacy Practices or obtain an 
  authorization at the time of swiping the card. 
  One of the questions we had to answer was if the 
  collection agency we used to collect bad debt was a busness associate. We 
  found that all they needed was the guarantor's contact information and an 
  amount. No health information was needed for them to perform their task. 
  Therefore they were not a business associate. 
  Roy G. Clay III Interim Compliance Officer Louisiana State University Health 
  Sciences Center New Orleans Campus Phone:  (504) 568-4367 
  Fax:    
      (504) 568-6378 
  Email:  
  [EMAIL PROTECTED] 
   
  -Original Message- From: Christine Hudnall [mailto:[EMAIL PROTECTED]] 
  Sent: Friday, February 28, 2003 
  2:36 PM To: WEDI 
  SNIP Privacy Workgroup List Subject: Another thread on Security/Privacy 
  question 
   
  I'm sending this out again, if someone could please 
  help us.  Thanks. 
  Christine 
   
  What about the card swipes that we use when a patient 
  makes a payment 
  on their account using their credit card.  Yes, we only 
  swipe the card and put in the 
  last four digits of the number, but the patient name (or whoever owns the card) prints out 
  on the receipt. 
  Is that considered PHI, even though we are not sending 
  them the name, 
  but they print it from their records? 
  If so, do we need to have an agreement with the 
  company that we use the card swipe from? 
  And as for eligibility, i.e., Medicaid.  We use 
  ROVR, which is through Consultec (if I remember correctly).  Is 
  an agreement needed with them? 
  And how would I check for security for their 
  program?  Is that something they would need to do and put in 
  writing? 
  Sorry for all the questions, just, my co-worker and I 
  are trying to go 
  down list of all possibilities that we need to check on. 
  
  Thanks, 
  Christine 
   
  _ 
  Help STOP SPAM with the new MSN 
  8 and get 2 months FREE*  http://join.msn.com/?page=features/junkmail 
  
   
  --- The WEDI SNIP listserv to which you are subscribed is 
  not moderated. The discussions on this listserv therefore represent the views 
  of the individual participants, and do not necessarily represent the views of 
  the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official 
  opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs 
  should not be used for commercial marketing purposes or discussion of specific 
  vendor products and services.  They also are not intended to be used as a 
  forum for personal disagreements or unprofessional communication at any 
  time.
  You are currently subscribed to wedi-privacy as: 
  [EMAIL PROTECTED] To unsubscribe from this list, go to the 
  Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to 
  [EMAIL PROTECTED]
  If you need to unsubscribe but your current email 
  address is not the same as the address subscribed to the list, please use the 
  Subscribe/Unsubscribe form at http://subscribe.wedi.org
  ---The WEDI SNIP listserv to which 
  you are subscribed is not mode

RE: Another thread on Security/Privacy question

2003-03-03 Thread Clay, Roy III (NO)
Title: RE: Another thread on Security/Privacy question





The name and the credit card number are not PHI under HIPAA. It does not become PHI until some health information is added. If the information contains CPT codes, for example,  then you would either need to include that information in the Notice of Privacy Practices or obtain an authorization at the time of swiping the card. 

One of the questions we had to answer was if the collection agency we used to collect bad debt was a busness associate. We found that all they needed was the guarantor's contact information and an amount. No health information was needed for them to perform their task. Therefore they were not a business associate. 

Roy G. Clay III
Interim Compliance Officer
Louisiana State University Health Sciences Center
New Orleans Campus
Phone:  (504) 568-4367
Fax:        (504) 568-6378
Email:  [EMAIL PROTECTED]



-Original Message-
From: Christine Hudnall [mailto:[EMAIL PROTECTED]]
Sent: Friday, February 28, 2003 2:36 PM
To: WEDI SNIP Privacy Workgroup List
Subject: Another thread on Security/Privacy question



I'm sending this out again, if someone could please help us.  Thanks.


Christine




What about the card swipes that we use when a patient makes a
payment on their account using their credit card.  Yes, we only
swipe the card and put in the last four digits of the number, but
the patient name (or whoever owns the card) prints out on the
receipt.


Is that considered PHI, even though we are not sending them the
name, but they print it from their records?


If so, do we need to have an agreement with the company that we use
the card swipe from?


And as for eligibility, i.e., Medicaid.  We use ROVR, which is
through Consultec (if I remember correctly).  Is an agreement needed
with them?


And how would I check for security for their program?  Is that
something they would need to do and put in writing?


Sorry for all the questions, just, my co-worker and I are trying to
go down list of all possibilities that we need to check on.


Thanks,


Christine




_
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: NPP and accounting for disclosures - was Medicare audits: op erations?

2003-02-15 Thread Clay, Roy III (NO)
Title: Message



I 
think you may be confusing authorizations and notices. I think if the patient 
signed an authorization, say for a clinical trial, that said we will disclose 
your information to XYZ drug company and ABC University who are co-investigators 
on the project, those disclosures would not have to be tracked, since you have 
for all intents and purposes given the accounting up front. However, since a 
notice is more general in nature, (i.e. "your information may be used in a 
research project approved by a properly constituted IRB or privacy board") and 
accounting will still be necessary. 
 

Roy G. Clay III
Interim Compliance Officer
Louisiana State University Health Sciences 
Center
New Orleans Campus
Phone: (504) 568-4367
Fax: (504) 568-6378
Email: 
[EMAIL PROTECTED]

  -Original Message-From: Halterman, Anita 
  [mailto:[EMAIL PROTECTED]]Sent: Friday, February 
  14, 2003 12:28 PMTo: WEDI SNIP Privacy Workgroup 
  ListSubject: RE: NPP and accounting for disclosures - was Medicare 
  audits: op erations?
  Read 45 164.502 uses and disclosures of protected health 
  information: general rules:(i) "Standard: Uses and disclosures 
  consistent with notice. A covered entity that is required by 164.520 [the 
  section addressing the notice of privacy practices] to have a notice may not use or disclose protected health information in a manner 
  inconsistent with such notice. A covered entity that is required by 
  164.502(b)(a)(iii) [separate statements for certain uses or disclosures] to 
  include a specific statement in its notice if it intends to engage in an 
  activity listed in 164.502(b)(1)(iii)(A)-(C) may not use or disclose protected 
  health information for such activities, unless the required statement is 
  included in the notice."I am not an attorney and do not work for OCR 
  so can not say without doubt that what has been said by many (including 
  myself) regarding the fact that if you notice a disclosure that the law allows 
  you to make that you don't have to account for it. But I believe that this can 
  be concluded from reading the above section of the regulations. I believe if 
  you inform a patient in your notice that you may make a disclosure that is 
  allowed by the law and that does not require that you first receive an 
  authorization before you make the disclosure that you do not have to 
  account for it. I assume that none of us would make a disclosure that is not 
  specifically allowed without first receiving an authorization to do so and if 
  we inadvertently make a disclosure that is not allowed (for instance a 
  mis-sent fax) we would account for it.The way I have read the above 
  section leads me to believe that if you notice a patient regarding a 
  disclosure that is permissible means that you do not need to account for 
  it.Any one else out there that supports this?By posting my 
  email to the listserv, I had hoped to hear more from agencies involved in 
  auditing or that are subject to audits. Surly you folks have given this some 
  thought - anyone willing to state how they are viewing this particular 
  subject?Thanks,Anita-Original Message-From: 
  Noel Chang [mailto:[EMAIL PROTECTED]]Sent: 
  Thursday, February 13, 2003 10:20 PMTo: Halterman,Anita; WEDI SNIP Privacy 
  Workgroup ListSubject: NPP and accounting for disclosures - was Medicare 
  audits: operations?Changing the subject for a minute:I 
  have seen several emails from people, including the one below, that 
  havemade various statements all to the effect that if you mention a 
  particulartype of disclosure in your NPP, you will not have to account for 
  suchdisclosures.Anita wrote:"One way a covered entity 
  might get around having to account for disclosuresmade for auditing 
  purposes is to inform their patients through their noticeof privacy 
  practices that they may make a disclosure for this type 
  ofactivity."Could someone please cite for me where in the Rule 
  they believe this isauthorized?  When I read section 164.528(a)(1) it 
  says a CE must account forall disclosures except for the ones listed in 
  sub-paragraphs (i) through(ix).  No where in that list do I see 
  "disclosures that are mentioned in yourNotice of Privacy 
  Practices".Is the assumption that by mentioning a type of disclosure 
  in my NPP I canthen claim it is part of TPO?  I don't see any room to 
  make that argumentsince TPO is clearly defined in sections 164.501 and 
  164.506.Thanks,Noel Chang--Open WebMail 
  Project (http://openwebmail.org)-- 
  Original Message ---From: "Halterman, Anita" 
  <[EMAIL PROTECTED]>To: "WEDI SNIP Privacy Workgroup 
  List" <[EMAIL PROTECTED]>Sent: Thu, 13 Feb 2003 14:37:17 
  -0900Subject: RE: Medicare audits:  operations?> I have 
  been thinking about this issue for some time now and this is> my two 
  cents for what it is worth (I am not an attorney). Sorry> Chris I 
  don't agree with your take on this.>> In order for

RE: Any HIPAA Humor tools out there?

2003-01-30 Thread Clay, Roy III (NO)



Don't forget Alan Goldberg's 
HIPAA-ginity!
 
HIPAA-ginity - that exemption 
from HIPAA regulations that vanishes when a healthcare provider succumbs to the 
temptation of electronic billing. 

  -Original Message-From: Ron Moore 
  [mailto:[EMAIL PROTECTED]]Sent: Thursday, January 30, 2003 1:41 
  PMTo: WEDI SNIP Privacy Workgroup ListSubject: RE: Any 
  HIPAA Humor tools out there?
  HIPAA - ectomy - the removal of individually identifiable 
  health information from heatlh records
   
  HIPAA - glycemia - low level understanding of HIPAA 
  regulation
   
  HIPAA - phobia - morbid fear of HIPAA 
regulation
   
  HIPAA - thermia - the unexplained chill that is running down 
  the back of anyone associated with HIPAA
   
  HIPAA - thetical - Supposition that all covered entities 
  will be compliant by April 14, 2003
   
  HIPAA - notic - the "deer in the headlight" feeling privacy 
  officers experience / especially as April 14, 2003 
  approaches
  
  
  
  
  
  This outbound message has been scanned for viruses. 
  ---The WEDI SNIP listserv to which you are subscribed is not 
  moderated. The discussions on this listserv therefore represent the views of 
  the individual participants, and do not necessarily represent the views of the 
  WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official 
  opinion, post your question to the WEDI SNIP Issues Database at 
  http://snip.wedi.org/tracking/. These listservs should not be used for 
  commercial marketing purposes or discussion of specific vendor products and 
  services. They also are not intended to be used as a forum for personal 
  disagreements or unprofessional communication at any time.You are 
  currently subscribed to wedi-privacy as: [EMAIL PROTECTED]To unsubscribe 
  from this list, go to the Subscribe/Unsubscribe form at 
  http://subscribe.wedi.org or send a blank email to 
  [EMAIL PROTECTED]If you need to unsubscribe but 
  your current email address is not the same as the address subscribed to the 
  list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org 

---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: archive@mail-archive.com
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: HIPAA privacy and telephone

2003-01-17 Thread Clay, Roy III (NO)
Title: RE: HIPAA privacy and telephone





My feeling is that unless you have authorization from the patient, anything other than giving the results directly to the patient is not allowed. You wish you can have an opt-in question on the order of "Do we have your permission to leave medical information with your spouse?(Y/N) These responses would have to be tracked and adhered to. 

-Original Message-
From: Doug Webb [mailto:[EMAIL PROTECTED]]
Sent: Friday, January 17, 2003 8:51 AM
To: WEDI SNIP Privacy Workgroup List
Subject: Re: HIPAA privacy and telephone



An extension to this -- how do you handle answering machines?


My gut feeling is that either a no-no (the machine more questionable than a family member) -- the information could only be released to the patient or his/her representative designated in a written authorizaton.  Perhaps another signature on your main consent/authorization form to allow these types of communications is what's needed???

The opinions expressed here are my own and not necessarily the opinion of LCMH.


Douglas M. Webb
Computer System Engineer
Little Company of Mary Hospital & Health Care Centers
[EMAIL PROTECTED]


"This electronic message may contain information that is confidential and/or legally privileged. It is intended only for the use of the individual(s) and entity(s)  named as recipients in the message. If you are not an intended recipient of the message, please notify the sender immediately,  delete the material from any computer, do not deliver, distribute, or copy this message, and do not disclose its contents or take action in reliance on the information it contains. Thank you."



- Original Message - 
From: <[EMAIL PROTECTED]>
To: "WEDI SNIP Privacy Workgroup List" <[EMAIL PROTECTED]>
Sent: Thursday, January 16, 2003 04:04 PM
Subject: HIPAA privacy and telephone



> I would like the lists opinion on this topic.
> 
> Patient comes to the office to have their potassium checked because they are on a diuretic.  Later, the physician's nurse calls the patient at home with results but the patient is not home.  Spouse answers the phone.  Can you tell the spouse that the potassium was fine and that he/she should tell the spouse to continue the same dose of diuretic and potassium supplement?  If you say "no, this type of disclosure is not allowed", would it matter that we put a statment in our Notice of Privacy Practices that stated  (in the section on Payment, treatment and  health care operations) "On occasion, we call test results to your home and leave the results with a family member if you are not present".  Now, obviously, we would not do this with a HIV result but it seems like such a waste of everyone's time to play phone tag to accommodate the one patient in a million that is actually upset because you told the spouse what the potassium result was.  Thank you.

> 
> Rich Fairley, 
> Dubuque, IA



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: archive@mail-archive.com
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: Privacy: de-identification analysis (no safe harbor)

2003-01-16 Thread Clay, Roy III (NO)
Title: RE: Privacy: de-identification analysis (no safe harbor)





You may want to check with your local university if they have a school of public health. The biostatistics department should have the means to provide you with that analysis. 

-Original Message-
From: Tim Belcheck [mailto:[EMAIL PROTECTED]]
Sent: Thursday, January 16, 2003 8:32 AM
To: WEDI SNIP Privacy Workgroup List
Subject: Privacy: de-identification analysis (no safe harbor)



  There may be situations in which clients cannot comply with the safe 
harbor for determining whether information is de-identified.  In such a 
case, we would perform the analysis required by Section 164.514(b)(1).


  I would like to build a database of names of experts in the field of 
statistics and data confidentiality, who can provide such an analaysis.  I 
have been unable to find any such persons myself.  Can anyone recommend (OFF 
LIST) a person or persons who can perform this analysis?


Thanks in advance.


TB






_
Help STOP SPAM: Try the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org


---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.   These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services.  They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time.

You are currently subscribed to wedi-privacy as: archive@mail-archive.com
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org




RE: Here is a good Privacy Issue that will cause problems

2003-01-16 Thread Clay, Roy III (NO)
Title: RE: Here is a good Privacy Issue that will cause problems





I would argue that releasing information that a patient has been restricted to one pharmacy is not a disclosure under HIPAA. A disclosure must contain a person's identifying information and information on their health status. I don't see how a pharmacy restriction would be considered information about health status other than such a restriction would imply abuse of some sort. But that would be like the information that you are in the hospital would imply that you were sick. 

-Original Message-
From: Drexler, Deborah (EHS) [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 15, 2003 3:58 PM
To: WEDI SNIP Privacy Workgroup List
Subject: RE: Here is a good Privacy Issue that will cause problems



The issue here is whether a covered entity which has information that an individual is "drug seeking" can disclose it to someone else, in an effort to curb the abuse.  Depending on who is disclosing the PHI to whom, you can probably argue that the disclosure is authorized because it is either T, or P, or O.  

Here is an example of one way it could work.  A payer realizes it has paid for several prescriptions for the same narcotic in a week, each written by a different prescriber.  This is an indication of drug abuse.   The payer deals with this problem by putting the individual on a restricted pharmacy list -- the individual can now get his prescriptions filled at only one particular pharmacy (pharmacy A).   Pharmacy A is instructed by the payer that if they are asked to fill duplicate prescriptions, they they are to contact the prescriber to validate the prescription.  Otherwise the pharmacist won't get paid.  In this case, you could argue that the disclosure from pharmacist to provider is either for the individual's treatment, or the pharmacists' payment.  

In the same hypothetical situation, when the same individual goes to Pharmacy B in an attempt to get her illicit prescription, the Pharmacist B looks up the person's eligibility and sees that the individual has been restricted to Pharmacy A.  Pharmacist B now knows that he won't get paid if he fills this prescription, and so he doesn't.   There is a dislcosure here -- the payer disclosed to Pharmacy B the fact that the individual has been restricted to Pharmacy A (and implicitly a drug seeker) -- but this is a disclosure that will likely be deemed to be part of the payer's operations.  

In the situation you describe, Rebekah, it seems that the pharmacy (somehow) got information that the individual is a drug seeker, and is disclosing that fact to providers.  I'd argue here that the disclosure from pharmacist to providers is part of the treatment of the individual. 

As you can see, none of these arguments is completely obvious.  So is there a HIPAA problem?  Maybe. 


There's another problem, as well.  A drug seeker can easily evade detection by going to different pharmacies, different doctors, and not seeking insurance reimbursement.  But there's a way to fix both the detection proglem and the HIPAA problem -- and I think I read that more than one state is either doing this or planning to do this:  the state can *require* pharmacists to report all prescritpions to a central database, and the state can monitor that database to identify drug seekers.  

A bit Big Brother-ish?  You might think so.  But doing it this way solves not only the detection problem but the HIPAA problem as well -- as long as the state promulgates a regulation *requiring* pharmacists to disclose to a central database, and another *requiring* the state to disclose suspected drug seekers to providers.  As we all know, HIPAA has no effect on state laws or regulations requiring disclosure of PHI.  


Deborah L. Drexler, Esq.
HIPAA Program Consultant
Executive Office Health Human Services
One Ashburton Place
Boston MA 02108
617-727-7600
[EMAIL PROTECTED]



-Original Message-
From: Mimi Hart [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 15, 2003 4:17 PM
To: WEDI SNIP Privacy Workgroup List
Subject: Re: Here is a good Privacy Issue that will cause problems



My gut feeling tells me "huge issue"...I don't know if there is
something in public health law that would state that it is being done in
the best interests of the patient and is therefore okay.hopefully
one of the lawyers on the group will weigh in. MIMI


Mimi Hart Ó¿Õ*
Research Analyst, HIPAA
Iowa Health System
319-369-7767 (phone)
319-369-8365 (fax)
319-490-0637 (pager)
[EMAIL PROTECTED]


>>> "Rebekah Savoie" <[EMAIL PROTECTED]> 01/15/03 02:53PM >>>
Today, a clinic that I work with received a letter from a local
pharmacy
about a patient that was a "Drug Seeker" as we call them.  Over the
course of 30 days he had been to several doctors and several
pharmacies
and received over 350 total pills all a controlled substance.


What happens to the pharmacy's ability to do these types of things
unde

RE: Here is a good Privacy Issue that will cause problems

2003-01-15 Thread Clay, Roy III (NO)
Title: RE: Here is a good Privacy Issue that will cause problems





I don't think you could justify a broadcast like "If this guy shows up in your office, don't let him have Percocet!" The pharmacist can communicate with the doctors that have written prescriptions for the patient but I don't think it can go any further than that unless there is some state law to support your actions. One would have to wait for the patient to go to another doctor and get a prescription and bring it to the pharmacy before the pharmacist could then notify the new doctor. This could be done before the prescription was filled in order to prevent the abuse. However it does not solve the problem of going to a new doctor and a new pharmacy. 

Roy G. Clay, III
Interim Compliance Officer
Louisiana State University Health Sciences Center New Orleans Campus
Phone: (504) 568-6130
Fax:   (504) 568-6378
Email: [EMAIL PROTECTED]



-Original Message-
From: Leah Hole-Curry [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 15, 2003 4:24 PM
To: WEDI SNIP Privacy Workgroup List
Subject: Re: Here is a good Privacy Issue that will cause problems



As with many things HIPAA, I suspect that it will depend on the
circumstances and to whom the disclosures are made.  I see three ways in
which the information may be disclosable.


1.  It seems pretty clear that a covered entity can disclose PHI to
fulfill an obligation under a reporting law (e.g. certain wounds like
gun shot wounds must be reported, and there may be mandatory reporting
for suspected perscription drug abuse)but it would have to be reported
to the entity required under the law or covered under the public health
authority or perhaps health oversight provisions. 164.512(a)(b)(d).


2.  As was noted, covered entities are allowed to respond to judicial or
administrative proceedings (e.g. subpoena) and, with limitations to law
enforcement, so the same information could be given to such entities in
response to the appropriate request or perhaps, if the activity is
criminal, under the reporting of a crime on premises provision. 
164.512(c)(f).


3. Finally, under the treatment provisions, the information can probably
be disclosed to other providers.  Treatment includes provision,
coordination, or management of health care and related services by one
or more health care providers, including coordination or management of
health care by a health care provider with a third party; consultation
between health care providers relating to a patient; or
referral...164.501.   Covered Entities may use or disclose PHI for its
own treatment; or for treatment activities of a health care provider. 
164.506(c).  Further,  minimum necessary rules don't apply to
disclosures by a health care provider for treatment.


So in the case below, I think a pharmacy could notify appropriate
authorities if there are mandatory reporting requirements or public
health procedures to do so, and may be able to report it law enforcement
under the "crime on premises" provision if the covered entity thinks the
information constitutes evidence of a crime.



I also think under the pharmacy can communicate with physicians and
other pharmacists that are involved in the persons care to ensure it is
providing appropriate treatment services before dispensing or refilling
medication (in this case appropriate drug amounts, no interactions,
etc).  The pharmacist could also probably contact a public agency that
maintains information on "drug seekers" and see if this person has any
history prior to dispensing medication under the provision related to
its own treatment.  Finally, the pharmacist could also respond to an
inquiry from another provider about the individual under the treatment
provision.


The questions start to come in about whether the pharmacy can disclose
PHI, basically unsolicited, to an entire group of providers in a
community that may or may not have any treatment relationship with the
individual.  When you read the treatment definition (provision,
coordination or management of care), and the permissible disclosure
(either for the CE's own treatment purposes of for another provider's
treatment purposes) it appears that this could be justified, and since
minimum necessary doesn't apply, any information could be included.  


On this last issue though, from a personal standpoint, it seems to run
counter to protecting health information, if any provider can simply
decide that in their opinion someone is receiving too much medication or
is trying to buy drugs for illicit purposes, etc. and because of that,
they can broadcast any PHI to any or all providers in a given community
(or state, or?).


Regards, lhc



Leah Hole-Curry, JD
FOX Systems, Inc.
602.708.1045 
Information transmitted is confidential and may be proprietary to FOX
Systems, Inc.  It is intended only for the person or entity to which it
is addressed.   Anyone else is prohibited from disclosing, copying, or
disseminating the contents or attachment

RE: Here is a good Privacy Issue that will cause problems

2003-01-15 Thread Clay, Roy III (NO)
Title: RE: Here is a good Privacy Issue that will cause problems





It seems to me that the act of issuing and filling a prescription is a treatment process therefore the minimum necessary standard would not apply. I don't think that the privacy rule prohibits such communications. The pharmacist is in a treatment relationship with the patient and the physician. Remember that the patient's action in presenting a prescription to a pharmacist implies a consent to communicate with the physician to insure that the prescription is filled in a way that is most beneficial to the patient. 

Let me give you another scenario to illustrate my point. 
A patient is being seen by an EENT for chronic sinus infections and by an internist for treatment of hypertension. One of the drugs the EENT prescribes has a serious interaction with the blood pressure medication the patient is on. The error occurs because the patient failed to note the fact that he was hypertensive on the history form he filled out at the EENT's office. Fortunately, the patient uses the same pharmacy for both prescriptions and the pharmacist runs and interaction check. Under these circumstances, the pharmacist would contact the EENT and make him aware that the patient was already taking the hypertension medicine so that the EENT could change the to a drug with more benign interactions. 

None of this violates the privacy rule. By the same token, I think that once the pharmacist realized that a patient had accumulated an inordinate supply of a controlled substance, he would be within his rights to bring that fact to the attention of at least one, and most probably all of the prescribing physicians.

-Original Message-
From: Mimi Hart [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 15, 2003 3:17 PM
To: WEDI SNIP Privacy Workgroup List
Subject: Re: Here is a good Privacy Issue that will cause problems



My gut feeling tells me "huge issue"...I don't know if there is
something in public health law that would state that it is being done in
the best interests of the patient and is therefore okay.hopefully
one of the lawyers on the group will weigh in. MIMI


Mimi Hart Ó¿Õ*
Research Analyst, HIPAA
Iowa Health System
319-369-7767 (phone)
319-369-8365 (fax)
319-490-0637 (pager)
[EMAIL PROTECTED]


>>> "Rebekah Savoie" <[EMAIL PROTECTED]> 01/15/03 02:53PM >>>
Today, a clinic that I work with received a letter from a local
pharmacy
about a patient that was a "Drug Seeker" as we call them.  Over the
course of 30 days he had been to several doctors and several
pharmacies
and received over 350 total pills all a controlled substance.


What happens to the pharmacy's ability to do these types of things
under Privacy?  


Clearly, pharmacist were communicated information back and forth to
each other and to physicians on this person.  They even sent letters
to
all physicians in the area.


Problem? yes or no


Rebekah Savoie, CCS-P
Healthcare Consultant


---
The WEDI SNIP listserv to which you are subscribed is not moderated.
The discussions on this listserv therefore represent the views of the
individual participants, and do not necessarily represent the views of
the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an
official opinion, post your question to the WEDI SNIP Issues Database at
http://snip.wedi.org/tracking/.   These listservs should not be used for
commercial marketing purposes or discussion of specific vendor products
and services.  They also are not intended to be used as a forum for
personal disagreements or unprofessional communication at any time.


You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] 
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at
http://subscribe.wedi.org or send a blank email to
[EMAIL PROTECTED] 
If you need to unsubscribe but your current email address is not the
same as the address subscribed to the list, please use the
Subscribe/Unsubscribe form at http://subscribe.wedi.org
    *


This message and accompanying documents are covered by the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510-2521, and contain information intended for the specified individual(s) only. This information is confidential. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, copying, or the taking of any action based on the contents of this information is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message.

    *



---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Bo