Rehab facilities will have a variety of challenges under new privacy regs
AHA says changes are needed in standards
With the rehabilitation prospective payment system (PPS) and work force hiring concerns at the top of rehab facilities’ priority lists, there may not be much time to prepare staff for the changes required by the final Standards for Privacy of Individually Identifiable Health Information from the U.S. Department of Health and Human Services (HHS).
However, rehab industry leaders say facilities will need to educate staff and become more sensitive to patient privacy issues if they are to follow federal regulations developed as a requirement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
"I think the oral communication aspect of the privacy rules will be the most challenging because we’re worried about possible breaches of that in hallways and cafeterias and elevators," says Pamela Rezac, EdD, FACHE, president and chief executive officer of Avera Sacred Heart Health Services of Yankton, SD. Rezac is the 2002 chair of the American Hospital Association’s Section for Long-Term Care and Rehabilitation.
Since the rehab industry typically has a longer length of stay and a more mobile patient population than do acute care hospitals, there’s an increased possibility of patient information getting into the wrong hands, says Robert Main, president and chief executive officer of Siskin Hospital for Physical Rehabilitation in Chattanooga, TN. Main also is chairman of the board of the American Medical Rehabilitation Providers Association (AMRPA) in Washington, DC.
"The hallmark of rehab is teamwork, and there are many different providers involved in treatment, and all of them need to be mindful of HIPAA regulations," Main says. "During conversations in departments, they need to be careful about saying anything in front of patients."
HIPAA is going to be an enormous issue for all providers, says Carolyn Zollar, JD, AMRPA vice president for government relations.
"We’re concerned about smaller providers and the extra burden that is involved with HIPAA," Zollar says. "So we’re very interested in seeing what proposals the administration has to simplify and alleviate some of this burden."
The American Hospital Association (AHA) and other health care industry organizations wrote a letter to HHS Secretary Tommy Thompson in the fall, asking Thompson to consider several areas of concern about the privacy regulations and to make changes before the April 2003 deadline. These areas of concern include consent, research, minimum necessary requirement for use of private health information, provisions concerning business associates and marketing, oral communications, unlimited access to records, and state law applicability.
Then, in December, AHA wrote directly to President George W. Bush, urging that HHS issue a notice of proposed rulemaking to fix those portions of HIPAA medical privacy rules that have the greatest potential to undermine patient care and hospital operations.
"HHS’ now nearly eight-month delay in issuing new rules to fix the privacy rules’ serious and unintended consequences has contributed substantially to hospitals’ mounting anxieties about the fast-approaching compliance deadline," AHA wrote in the letter to Bush.
In January 2002, HHS announced that the department would be publishing some changes to the privacy regulations, but provided no details.
Contracts required for sharing information
Rehab providers may be particularly concerned about the business provider provision.
"There are so many different entities involved in a patient’s care, and they need to have information about the patient," Rezac says. "In an effort to continue the continuum of care, we don’t want to hamper the flow of that information."
However, the regulations as written would appear to do exactly that. AHA claims in the letter to Bush that the business associate contract requirement is redundant and unnecessary.
"If we wanted to make arrangements with a vocational rehab facility so that the patient could then have the vocational training that can be provided by a state-sponsored rehab, then we have to have some particular specific business associate arrangement with them in order to share information," Rezac says.
"In the past you could call on the phone and maybe discuss the case situation without a business associate contract," she adds.
While it won’t hurt rehab facilities to have formal business associate contracts, it could hamper communication and leave providers bogged down in paperwork before they can have a discussion about a patient, Rezac explains. "It will slow the process down."
Besides vocational rehab, other potential business associates would be durable medical equipment suppliers, home care agencies, and long-term care facilities. Whenever a patient needs to use a company that is outside the rehab provider’s normal circle of referrals, it will require additional time-consuming paperwork.
The health care industry told Thompson in the letter, dated Oct. 23, 2001, that the contracting requirements of the business associate rule are unnecessarily burdensome.
Another major concern raised by the health care industry involves the effect the privacy rule might have on oral communications between staff and providers.
"We remain concerned that the rule could inhibit oral communications which are a part of TPO [treatment, payment, and health care operations]," the letter to Thompson states. "Covered entities should be able to freely engage in communications in the health care setting that are necessary for TPO."
At Avera Sacred Heart Health Services, there is a "Bee Alert" program that is designed to make staff more aware that there needs to be respect for patients’ privacy during oral communications, Rezac says.
"We’ve had it for five years, and we’ll promote it as we move into issues of oral communication," Rezac says. "Our worry is that there will be some type of interpretation in times to come that is different from our understanding now."
For instance, will HHS impose penalties for organizations found out of compliance, and how conservatively should rehab providers interpret these privacy regulations?
"We’re being very watchful and studying it very closely," Rezac says.
Main wonders whether rehab providers will need to take extra privacy precautions when patients are taken outside the facility for certain medical procedures or for community re-entry projects.
"Whenever the patient and medical record are taken outside of the hospital for procedures not performed here, we need to be sure they are protected," Main says.
Other situations where privacy might now become a concern involve group therapy sessions where patients and therapists discuss adjustment or a person’s particular disability, he notes.
"There are going to be situations we’re confronted with that typically won’t happen in an acute care hospital," Main says.
The health care industry also is greatly concerned about how the regulations require consent from patients and what type of impact the rules might have on research. Both issues will affect rehab providers, as well as acute care hospitals.
"We continue to urge that the department fix the underlying policy problem with the prior consent requirement through new rulemaking by returning to the regulatory consent approach taken in the proposed rule," the letter to Thompson says. "That is, covered entities should be able to use and disclose personally identifiable health information (PHI) for treatment, payment, and health care operations without obtaining prior consent."
As far as research is concerned, some rehab providers have shared their patient databases with researchers to permit follow-up of patient treatment outcomes. The AHA and others in the health care industry fear that there will be a chilling effect on this practice under the final rule.
"The rule’s authorization provisions are overly prescriptive, unworkable for many types of research, and unnecessary where a subject is already providing informed consent to participate in research," states the letter to Thompson. "The rule’s overly narrow exception for public health disclosures does not permit a workable system of voluntary post-marketing surveillance or voluntary health and exposure registries."
While the health care industry waits to see whether HHS will modify the final privacy rule and to see how the regulations will be interpreted, it’s still a good idea to begin to prepare for the necessary changes and staff education, Main says.
"We have an active committee working on this," he says.
Siskin Hospital has required staff to attend eight to 10 inservices a month through the fall and winter in an effort to prepare employees for PPS. Now the hospital will need to add additional inservices to cover HIPAA and the privacy requirements.
"Most definitely there will be many, many inservices," Main says.
Need More Information
- Robert Main, President, Chief Executive Officer, Siskin Hospital for Physical Rehabilitation, 1 Siskin Plaza, Chattanooga, TN 37403. Telephone: (423) 634-1200.
- Pamela Rezac, EdD, FACHE, President, Chief Executive Officer, Avera Sacred Heart Health Services, 501 Summit St., Yankton, SD 57078. Telephone: (605) 668-8000.
- Carolyn Zollar, JD, Vice President for Government Relations, American Medical Rehabilitation Providers Association, 1606 20th St. NW, Third Floor, Washington, DC 20009. Telephone: (888) 346-4624.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content