Focus on Forms American Medical Association Jacqueline M' Darrah, M'A', J'D' Mary Kuffner, J'D'

1
Focus on FormsAmerican Medical
AssociationJacqueline M. Darrah, M.A., J.D.
Mary Kuffner, J.D.
2
Preemption

• HIPAA trumps if state law is contrary
• State law trumps if it is more stringent
• Generally, state law wins if more restrictive
  or gives patients additional rights

3
Forms Are More Stringent

• With respect to form or substance
• Narrow the scope or duration
• Increase the privacy protections afforded
• Reduce coercive effect

4
Recordkeeping Is More Stringent

• Retention or reporting of more detailed
  information
• Retention or reporting for a longer duration

5
General Standard

• With respect to any other matter
• Provides greater privacy protection for the
  individual

6
Other Exceptions to HIPAA Preemption

• Determination by the Secretary of HHS in specific
  categories
• State law provides for reporting and public
  health activities
• State law requires health plan reporting,
  auditing, licensing

7
Use of the Consent Form

• Required for health care providers
• May condition treatment on provision of consent
• May not be combined with Notice of Privacy
  Practices
• May be combined with other types of legal
  permission

8
Use of the Consent Form

• Before uses or disclosures of protected health
  information for treatment, payment and/or health
  care operations
• Exceptions
• Emergency
• Indirect treatment relationship
• Inmates
• Required by law
• Communication barriers

9
Use of the Consent Form

• Documented policies and procedures
• Retain copy for six years
• Effective only for the covered entity that
  obtained the consent except for joint consent

10
Use of the Consent Form

• Defective consents
• Lacks a required element
• Revoked
• Conflicting legal permission
• Disclose in accordance with more restrictive
  consent or authorization
• May resolve conflicts

11
Consent Form

• Plain language
• Informs the patient that protected health
  information may be used or disclosed for
  treatment, payment and health care operations
• Refers to the Notice of Privacy Practices

12
Consent Form

• Patient rights
• Review the Notice of Privacy Practices before
  signing
• To request restrictions
• To revoke consent
• Signed and dated
• Reserve right to change Notice of Privacy
  Practices

13
Use of Authorization Forms

• When consent or another exception does not apply
• Type of authorizations form depends on purpose
• Use or disclosure of PHI by your practice
• Disclosure of PHI by another practice or entity
  to your practice
• Use or disclosure of PHI for research that
  includes treatment

14
Use of Authorization Forms

• May not condition treatment, payment or
  enrollment on provision of authorization except
• Research that includes treatment
• Purpose of treatment is to create information for
  others
• To determine payment of claims (not psych. notes)
• Eligibility/enrollment determinations (not psych.
  notes)
• Underwriting/risk rating (not psych. notes)

15
Use of Authorization Forms

• May not combine authorizations except
• May combine authorizations for use or disclosure
  of psychotherapy notes only with similar
  authorization
• May combine other authorizations (not
  psychotherapy notes) unless one conditions
  treatment on an authorization for research

16
Use of Authorization Forms

• May combine authorization for research that
  includes treatment with
• Consent to participate in the research,
• Consent to use or disclose PHI for related
  treatment, payment and health care operations,
• Notice of Privacy practices

17
Use of Authorization Forms

• Documented policies and procedures
• Retain copy for six years
• Effective only for the covered entity that
  obtained the authorization

18
Authorization Forms

• All forms must include the following
• Name of authorized persons or practices
• Description of information
• Expiration date or event
• Patients right to revoke, exceptions, and
  procedure
• Statement about potential for redisclosure
• Signed and dated
• Authority of personal representative (if applies)

19
Authorization Forms

• Must be valid
• Defective authorizations
• Expiration date or event has passed
• Form is not filled out completely
• The practice knows the patient has revoked
• Lacks a required element
• Is inappropriately combined with another consent
  or authorization
• Contains any material information known by the
  practice to be false

20
Authorization Form A

• For use or disclosure, or both
• Description of each purpose
• Informs patient of rights
• to inspect or copy the information to be used or
  disclosed
• to refuse to sign
• whether the information will result in
  remuneration to the physician from a third party

21
Authorization Form A (Cont.)

• Statement that the practice will not condition
  treatment, payment, enrollment or eligibility of
  benefits (if applies) on the provision of the
  authorization unless an exception applies
• The patient must receive a copy of the form

22
Authorization Form B

• For disclosure of PHI from another covered entity
  to the practice to carry out treatment, payment
  or health care operations
• Description of each purpose
• Informs patient of right to refuse to sign

23
Authorization Form B (Cont.)

• Statement that the practice will not condition
  treatment, payment, enrollment or eligibility of
  benefits (if applies) on the provision of the
  authorization unless an exception applies
• The patient must receive a copy of the form

24
Authorization Form C

• For uses/disclosures of PHI created for research
  that includes treatment (unless otherwise
  permitted under Privacy Rule)
• Description of each purpose, and
• How PHI will be used or disclosed for treatment,
  payment or operations
• Any PHI that will not be used as permitted under
  the Privacy Rule

25
Authorization Form C (Cont.)

• Informs patient of rights
• to inspect or copy the information to be used or
  disclosed
• to refuse to sign
• whether the information will result in
  remuneration to the physician from a third party
• Refers to consent or Notice of Privacy Practices
  (if not combined with authorization)

26
Authorization Form C (Cont.)

• Statement that the practice will not condition
  treatment, payment, enrollment or eligibility of
  benefits (if applies) on the provision of the
  authorization optional
• The patient must receive a copy of the form

27
Notice of Privacy Practices (NPP)

• Right to adequate notice
• Uses and disclosures of PHI
• Individuals rights
• Covered Entitys legal duties

28
Use of NPP

• Direct treatment relationship
• Available on request
• No later than the date of first service delivery

29
Use of NPP

• Available at office for patient to take with
  them
• Post in reasonable location in office
• Make revised notices readily available

30
Use of NPP

• If maintain web site with information about
  services
• Display notice on the website prominently
• Make available on the website

31
Use of NPP

• NPP may be provided by e-mail
• If the individual has agreed receive by e-mail
  and has not withdrawn
• If e-mail fails, paper copy must be provided

32
Use of NPP

• E-mail NPP must be delivered within same
  timeframe as paper
• If service is electronic, then must deliver NPP
  automatically and contemporaneously with first
  request for service
• Recipient may still receive paper copy of NPP

33
Content of NPP

• Plain language
• Specific header
• Uses and disclosures
• Separate statements - appointments and
  fundraising

34
Content of NPP

• Individuals rights
• Covered Entities duties
• Reserve right to change NPP

35
Content of NPP

• Complaint Process
• Identify Privacy Contact
• Effective Date

36
Content of NPP

• Optional elements - limited uses and disclosures
• Revisions to the NPP if material change in
  privacy practices
• Do not implement change until NPP is revised
  (unless required by law)

37
Joint Notice

• Participation in Organized Health Care
  Arrangement
• Previously discussed requirements apply
• Entities included, delivery sites, and statement
  about TPO
• Joint notice is effective for all

38
Documentation Requirements

• Maintain policies and procedures
• Maintain paper or electronic copy
• Maintain for 6 years