By Jay Masci The compliance date of April 14, 2003 for the HIPAA Privacy Rule is fast approaching O&P businesses. So the question you may ask is, "Why do I need to comply?" Why Comply? Risk of LitigationThe threat of litigation is a topic that covered entities need to be very aware of, according to Leigh-Ann Patterson, a litigation partner with Nixon Peabody LLP in Boston, Massachusetts, who presented a crash course at the summit in "preventive law" as it relates to the privacy rule.1 HIPAA is likely to be the standard: According to Patterson, plaintiffs' lawyers will likely use the HIPAA Privacy Rule as the standard of care in negligence cases brought under state law involving alleged misuse of medical information. Specifically, it's likely they will claim the defendant did not meet the "minimum necessary" (amount of information shared) standard set forth in the HIPAA regulations. 1 Penalties and Imprisonment It is federally mandated that all of the US states and controlled territories, such as Guam and the Virgin Islands, comply with HIPAA. Failure to comply with the Privacy Rule of HIPAA can lead to civil penalties up to $100 per person per violation and up to $25,000 per person for violations of a single standard for a calendar year and/or criminal penalties that can result in a $50,000 to $250,000 fine and one to ten years in jail for improper disclosure of individually identifiable health information. Patient Expectations Protecting patients' privacy shows that you care about them. Compliance will demonstrate a level of professionalism that patients will come to expect. Failure to demonstrate respect for patient privacy could lead to lost business. What Can Get An Organization Into Trouble Protected health information (PHI), if used improperly, could damage an individual's reputation or be used for discriminatory purposes in employment. Examples include AIDS, alcoholism or drug addiction, suicide attempts or a history of nervous breakdowns. Having such personal information disclosed is an emotionally charged topic, which could feed directly into high-stakes litigation. Some additional causes of action that might be expected to surface are: Negligent disclosure of PHI Any state statute giving rise to a right of action for breach of confidentiality Intentional revelation of PHI by an employee Inadequate policies and procedures Negligent supervision and training Negligent/intentional infliction of emotional distress Failure to follow your policies and procedures. Not only must covered entities develop policies and procedures under the Privacy Rule, but they also must follow them! In addition, you must give patients a notice that explains your PHI-related policies and their right to request restrictions of its use and disclosure 1 From MD Practice Alert, Dec. 4, 2002 Jay Masci is the Principal Consultant of Provaliant, a company providing IT consulting services including HIPAA compliance and customized training. For more information, call 480.952.0656 or visitwww.provaliant.com.
