HIPAA Compliance for Small Groups

scottorr

We are considered a small group by HIPAA standards and are not required to be in compliance until 4/16/2004, however, most of our venders are considered large groups. They have all sent us business associate agreements to be signed stating that we are in compliance with their privacy standards as required by HIPAA as of 4/14/2003. We have not signed them at this point. We have given them to our legal department. I was wondering if anyone else has run into a similar situation and how have you handled it?

jimlegal

This will certainly become more of an issue. In order to comply and protect themselves the vendors have to have the Business Associate Agreements in place. These agreements should to some extent protect you as well. We took the position long ago to be in compliance or atleast give it our best shot by the first compliance date. Thus if we were considered early we had a year to practice and get it right!

scottorr

I have only been at this position since February 2003 and have been working on preparations for HIPAA since I started. Before coming here I worked n the HR department of a health care organization and we were prepared for the 4/14/2003 deadline.

At this point I have not turned away any employees' questions, however, I have asked them to address the issue first with the vender. I have been tracking employee questions but have not had them sign an authorization.

Our health and vision venders have not asked us for a signed business associate agreement. Our health plan vender is the largest in NY state and they have told us that their legal department told them they do not have to have the business associate agreement signed until 4/14/2004. Our legal department agreed. Our dental and disability venders asked us to change the dates on the business associate agreement to the 4/14/2004 date. Having said that I am trying be in compliance as soon as I can.

Thank you for your responses!

System

You can always sign the business associate agreements and attach an addendum stating your company's status - that you are in the process of implementing the HIPAA regulations and list the anticipated date of intent to be in total compliance (the timeline for your company). I am sure that you are already in compliance with some of the requirements, as the HIPAA standards are pretty much a given anyway. The legalize is pretty much stumping people about compliance. Our agency is a home health agency and we started working on HIPAA back in 2001. If you would like to have some of our info, I will be happy to share...might give you an idea of what to look at for your company. Please email me at [email]cjwinebarger@earthlink.net[/email] if you are interested.

crawfod

I had read that "The Secretary of Health and Human Services (HHS) has extended the deadline for complying with this provision (contracts between the employer and business associates) to April 14, 2004, for contracts that weren't renewed or modified before October 15, 2002." Also, I had misinterpreted the April 14, 2004, deadline for those whose group health plan has $5 million or less in receipts. I thought that meant if my employer's cost was less than $5 million, we had the longer deadline. Turns out the $5 million pertains to the carrier's overall receipts, so 2003 is the year.

Our insurance carriers have sent letters to our employees notifying them of HIPAA rules, but I am still at a loss as to any further obligations we have as the employer. My wife works for a very large corporation and all she received was a two page explanation of the plan, but she is not obligated to sign anything or attend any meetings, etc. So is the definition of "training and documentation" different for different employers?

Are you going to continue to help your employees who come in your office with a bill from a medical provider, and they want your help in resolving it? I suppose I will have them sign a form allowing me to represent them, or I could choose to longer offer that HR service, but I would prefer to help them.

Are any of you changing what I assume is a fairly universal policy of requiring a doctor's statement from employees who are absent for a certain number of days? Is this covered under HIPAA? My reaction is that since the employee is providing that document of their own choice, receiving it would not be a violation. Most doctors will be more sensitive now to only deal with work status and will not indicate what the diagnosis or treatment or prognosis was.

What a headache!

System

I can only address what our company is doing - CYA. We are having our employees sign a training statement because of the service which our agency provides. Our HIPAA policy is two-fold - covers patient PHI and employee PHI. That was sort of tricky, but it is addressed and staff are notified as well. The health, dental, disability and such have been addressed by the carrier, so if we aren't compliant, I give up. Yes, I will continue to assist employees with their issues as long as they ask for help. As for MD statement, after 24 hours, the sick time out rolls into FMLA which is not an issue with HIPAA, so yep, we will still require a statement, plus having all the lovely FMLA paperwork filled out. If it isn't one thing, it is 49. What is anyone else doing?

HRPeg

I have gone to a few HIPAA seminars (we do medical accts receivables so have been working on HIPAA from that standpoint for quite awhile, but not so much from the employee PHI standpoint). From the ones I have attended for our group plan, whether or not you can have employee health info all depends on what "hat" you happen to be wearing at the time. So if you, as HR Manager, have PHI for FMLA reasons which you have to legally administer, then you are allowed to have that info. You will need signed releases in order to have PHI to help an employee with an insurance claim. Of course, keep all medical information in a separate, locked cabinet that no one else has access to.

crawfod

As for FMLA, since the Feds encouraged employers to be more generous than the legal requirements, and since our employees have Sick Leave pay to cover their time off (counted as an Excused Absence) and therefore have no interest in FMLA, and since we have no real intentions of separating any employee for being disabled more than 12 weeks (assuming it is documented), then I don't start FMLA paperwork until I am aware of a disability that will last more than 2 weeks, unless the employee specifically requests FMLA approval. I do not start the FMLA time until the day I send the employee the paperwork and give them 12 weeks from that date. Our attorney felt allowing more time off than was required would be viewed favorably by courts, and it sure has reduced the time and effort spent on this, especially for those little short absences. But if you are doing FMLA for the potential of disciplining employees, then you should start the clock as soon as you are aware.

As for helping our employees with bills, our insurance carrier Customer Service Department is saying they will need the employee's written release before talking to me, unless the employee is in the room and will confirm they can talk to me. Our local hospital Patients' Accounts office said they are willing to talk to me about bills as long as we didn't discuss the patient's diagnosis, treatment plan, or prognosis. Some doctor's offices are taking the same stance, but I expect others will no longer say anything without releases. I have had a couple vendors send me their release forms and frankly I don't think they meet the HIPAA standards, because they are not specific to the immediate purpose. But I see that as their problem. It will be interesting to see how those offices handle calls from employee's spouses, since many households have one expert to deal with such matters. Boy, will they get some calls from angry employees having to authorize their spouse as a spokesperson! It's a new world.

Mentel

I recently attended a seminar on HIPAA Privacy and the attorney told us that you DO NOT need a signed release to help an employee get a bill paid. As long as the inquiry is regarding getting a bill paid and not an inquiry as to the diagnosis/prognosis, you do not need a release. Makes sense to me.

scottorr

That definately makes sense to me. I am glad we have this forum to share ideas and information.

System

Me too! Great bunch of people.