In February 2009, President Obama signed into law the American Recovery and Investment Act (ARRA). Part of the ARRA brought about major changes in the Health Insurance Portability and Accountability Act (HIPAA). Certain provisions of the ARRA have impacted the insurance world and how you practice.
The HIPAA compliance enforcement got its teeth to deliver a bite with the Health Information Technology for Economic and Clinical Health (HITECH) Act. If you have not updated your HIPAA compliance manual to reflect these changes, you may now face significant fines.
Previously, fines up to $25,000 maximum could be levied. Now the fines are tiered and could be as much as $1.5 million for just a single HIPAA violation.
Your Notice of Privacy Practices (NPP), commonly known as your Privacy Policy, must reflect the required changes and associated policies in your office. Part of the NPP must address the patient’s rights pertaining to their protected health information (PHI). The patient has the right to obtain a copy and review their PHI. If the patient disagrees with the PHI, they have a right to request that the practice amend the PHI.
The patient also has the right to request that the practice restrict the use and/or disclosure of PHI for treatment, payment and health care operations.
On Feb. 18, 2010, the HITECH Act regulated that a health care provider is required to honor a patient’s request to restrict disclosure of PHI to a health plan for purposes other than carrying out treatment (specifically, payment or health care operations) if the patient pays the health care provider out of pocket in full. [Section 13405 of Subtitle D of the HITECH Act (42 USC 17935)].
This means that if a patient does not wish to use their health insurance or med-pay, they can request that the insurance not be billed. A PPO cannot require that you file a claim for the patient, although if you do not, then you may be required to a have a written attestation that the patient requested the restriction. Medicare is the exception for covered services.
As an example, if a patient has a $5,000 deductible and therefore chooses not to file a claim with their health insurance to obtain the benefit of a Discount Medical plan, as long as you have the statement from the patient on file directing not to file the claim, it is within the patient’s legal rights. In my opinion, this will yield a win-win situation for the provider and the patient. The provider can deliver health care as recommended and the patient can benefit from legally discounted fees.
Make sure that you become familiar with the changes in HIPAA and incorporate policies and procedures in your Notice of Privacy Practices. Any amendment to your policies must be posted in a prominent location and a good faith effort made to inform the patient of these changes. In addition, it is required that all staff (defined as full-time, part-time, temporary help and volunteers) be properly trained in the HIPAA and HITECH changes. Keep the training documentation in your HIPAA manual for six years.
A thorough understanding of the HITECH regulations may serve to grow your practice. In this age of increased regulations, it may well be that a regulation was finally passed that can benefit the doctor-patient relationship!