By Jay MasciThe compliance date of April 14, 2003 for the HIPAA (Health Insurance Portability & Accountability Act of 1996) Privacy Rule is fast approaching O&P businesses. Are you ready to comply? What is Required of an O&P Organization? The following items would be required for an O&P organization that has been identified as a covered entity, to be in compliance with the Privacy Rule. Designate a Privacy Officer Designate a contact person Outline a sanction policy Document your complaint process Determine if any state laws preempt the HIPAA Privacy regulations Document your accounting of disclosure procedures Develop the following mandatory forms and documents: Notice of Privacy Practice, Authorization Form and Business Associate Contract. Provide training to all of your staff that come in contact with protected health information (PHI) on your policies and procedures To reasonably safeguard PHI from any intentional or unintentional use or disclosure How To Prepare Your Organization For Privacy Compliance There are numerous experts and sources that outline the steps for your organization to take in preparation for privacy compliance. The following steps seem to be a consistent theme with each source: Step 1 - Study the final Privacy Rule. Become familiar with the final Privacy Rule. Make sure that you have looked at any amendments that the Department of Health and Human Services (DHHS) or the Office of Civil Rights (OCR) has issued as well. For a copy of the Privacy Rule and latest updates visit http://aspe.hhs.gov/admnsimp/bannerps.htm Step 2 - Designate a Privacy Officer. The privacy officer will be responsible for creating a comprehensive compliance plan, developing policies and procedures, administering education and training programs, maintaining and documenting the policies and procedures for compliance with the HIPAA regulations, and monitoring ongoing compliance. This person will be responsible for all HIPAA initiatives within your organization. Step 3 - Start a HIPAA awareness program for top-level management. Your privacy officer should develop a program to help the top-level management get a better understanding of HIPAA Privacy and its importance within the organization. Step 4 - Organize a HIPAA compliance task force within your organization. Ideally, a HIPAA compliance task force should be created to include representatives from each component of your health care system such as hospitals, clinics, physician practices, and departments such as HR, administrative, IT, and health care professionals. The privacy officer should lead the HIPAA compliance task force in addition to their required duties defined by the Privacy rule. Step 5 - Perform a "gap analysis." Have each department assess where they currently are in respect to the final Privacy Rule regulations versus where they need to be. The difference between their current practices and what their practices should be is considered the gap. Examine how your organization uses and discloses protected health information, and then track and document existing flow of protected health information inside and outside the organization. Determine the inputs, roles, and outputs along with the type of information they have access to. Examine each database in the organization to determine what protected health information you maintain. And identify business associates as well. Step 6 - Develop a HIPAA Compliance Plan. Based from the gap assessment, create a HIPAA Compliance Plan detailing completion dates and responsible individuals. Your HIPAA task force should review the plan and endorse it before it is executed. The task force must also publicly express that the privacy officer has the authority to require individuals to complete their assigned tasks. Step 7 - Define a HIPAA budget. The privacy officer should define a budget for your HIPAA Privacy initiatives based off of the approved Compliance Plan. Create an estimated total budget and a 6-12 month detailed budget. The budget should be presented to the executive management for approval. Step 8 - Review state statutes. Work with your legal counsel to determine if any state laws supersede or conflict with the HIPAA regulations. You can visit http://cms.hhs.gov/hipaa/hipaa1/default.asp for a link to some state statute databases. Step 9 - Identify a contact person. Identify who your contact person is going to be. The contact person will answer patients' questions concerning forms, questions, and complaints. Step 10 - Identify all of your business associates. Identify who your business associates are. You will be required to have a Business Associate Contract in place for every current business associate by April 14, 2004. Step 11 - Develop your policies, procedures and forms. Develop your policies, procedures, and forms for each of the HIPAA initiatives. Sanctions for violations should be included. Present them to your legal counsel for their opinion. Ensure that your Standard of Conduct include the HIPAA Privacy Rule. Step 12 - Have vendors update your current IT software. If you use packaged software, the software vendors should provide you with updates that help meet the HIPAA Privacy standards. The Privacy Rule does not require updating your software. Step 13 - Ensure all of the Privacy Rule Administration requirements are implemented. Walk through all of the Privacy Rule requirements and check to ensure you have met the appropriate standards. Step 14 - Develop a customized training program for employees. The Privacy Rule requires all staff to be trained on their organization's policies and procedures. The privacy officer should work with human resources to develop a customized training program for the Privacy Rule. Make sure the training is documented and that every employee has taken the training. Step 15 - Monitor your policies, procedures, and staff. The privacy officer should monitor compliance to ensure that the HIPAA regulations are being followed and are working properly. Step 16 - Stay current on HIPAA Privacy rules and regulations. The privacy officer should regularly review the DHHS and Centers for Medicare & Medicaid Services (CMS) websites to stay current on HIPAA Privacy rules and regulations. The privacy officer should subscribe to the DHHS HIPAA update notification service at http://cms.hhs.gov/mailinglists. Jay Masci is the principal consultant of Provaliant, a company providing IT consulting services, including HIPAA compliance and customized training. For more information, visitwww.provaliant.com. Editor's note: Additional information about HIPAA can be obtained at a website provided by CMS:www.hipaa.org .
