Newsletter archive

Cunningham Law · Newsletter

HIPAA Decision Tree and a Common Compliance Miss

Use the HIPAA decision tree first, then check how your practice handles patient records requests.

Welcome to the second installment of my bimonthly newsletter. If you opened the first email last week, thank you, the response genuinely surprised me in the best way.

As promised, let's get into that HIPAA decision tree (download here).

The tree exists to answer one question first, before anything else matters: are you actually a covered entity or a business associate under HIPAA at all? A lot of small practices assume the answer is obviously yes just because they handle patient information, but the real answer depends on things like whether you bill insurance electronically for certain transactions and how your practice is structured. Work through that question first, since everything downstream, your policies, your patient forms, your staff training, only matters once you know which rules actually apply to you.

Here is a compliance issue that comes up for most every practice once they get past that first question. It is the Right of Access rule, meaning a patient's right to get a copy of their own records within a set timeframe, and it trips up more practices than almost anything else in HIPAA. The common mistakes are simple ones. Taking longer than the required window to respond. Charging more than what is allowed for providing a copy. Requiring a patient to come in person or fill out an unnecessary form when the request could have been handled by email. None of these come from bad intent, they come from staff not knowing the specific rule, and this is exactly the kind of thing that draws complaints and, eventually, government attention if it happens repeatedly. Not to mention frustrated patients.

If you have not looked at your own process for handling a records request in a while, this is worth ten minutes of your time this week.

On a related note, I recently sat down for an episode of Physicians Hanging a Shingle, where Dr. Brittney Anderson of Anderson Family Care and I talked through HIPAA basics and the things I think providers should be considering before starting their own practice. If you want more of this in audio form, that episode is worth a listen. Check it out here.

Kim

Get the next edition

Kim's newsletter goes out every other Tuesday. Know someone who might want these updates? Share this page.

Request a free 30-minute consultation

This newsletter is for general information only and is not legal advice. It does not create an attorney-client relationship.