HIPAA Final Rule implemented
On September 23, the Final Rule from the Health Insurance Portability and Accountability Act (HIPAA) took effect. This rule reflects changes to HIPAA from the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.
According to Eric Harris, Ed.D., J.D., consultant to The Trust and member of the APA/ASPPB/Trust Joint Task Force on the Development of Telepsychology Guidelines for Psychologists, any psychologist who, at some point since 2003 when HIPAA was first implemented, has engaged in at least one electronic transaction is responsible for complying with HIPAA regulations. He explains that this refers to any electronic communication, such as billing, with an insurance or insurance-like company. Furthermore, he makes a distinction between the Privacy Rule, which relates to confidentiality between the provider and the patient, and the Security Rule, which deals with electronically stored protected health information.
Under the Privacy Rule, psychologists must add some changes to their Notice of Privacy Practices (NPP), the forms all patients sign regarding release of protected health information. One of those changes involves the “minimum necessary disclosure.” Harris says, “In the past, insurance companies would require patient information from the provider, but the provider might only want to give a summary. The insurance company would want more than that. If the provider didn’t provide more, the insurer would deny the claim. Now the minimum necessary disclosure will be determined by the provider.”
Another change pertains to self-pay clients, who have the right to restrict the disclosure of certain protected health information to health plans and/or insurance companies.
Providers have also been advised to compare state laws regarding privacy with federal regulations to ensure that they are following the ones that offer the best protection. But Harris explains that the American Psychological Association Practice Organization (APAPO) and The Trust collaborated on a pre-emption analysis that compared every state’s laws to the federal HIPAA regulations to determine which set provided the most protection for the client. After an extensive amount of research, the APAPO created HIPAA For Psychologists, which contains all the necessary forms and offers a detailed tutorial regarding the changes for a fee.
Although some providers are concerned about revising their NPP forms, Harris notes that the process is not that complicated. “You don’t need a lawyer. You can find out the changes that should be on the form from the APAPO Web site,” he says.
Psychologists concerned about integrating electronic health records (EHRs) into their practice need not worry at this time, says Harris. “Physicians are being incentivized by Medicare and Medicaid to do this, but psychologists are not included,” he says. “However, for those who want to interface with a medical system, this will become an increasingly important part of being successful in your practice. It’ll be a long transition, but eventually psychologists may also be incentivized.”
Claims that EHR software is expensive are valid, according to Harris, who notes that physicians can have the cost subsidized, but this option is not currently available to psychologists. He points out though that many products on the market can be purchased at a reasonable price and do not require a lot of training. Harris also says that secure interfacing with medical systems will not pose a threat to patient information. “Their system will tell you how your material should be encrypted,” he says. “We suggest that all psychologists encrypt their documentation anyway. That way, if there’s a breach, you won’t have to notify your clients and the Department of Health and Human Services.”
Although the EHR initiative does not include psychologists at this time, Andy Finnegan (CMS/CFMFFSO), health insurance specialist in the Division of Medicare Financial Services, Fee For Service Operations, points out that pending legislation may change that. “There is a bill, the Behavioral Health Information Technology Act of 2013 (H.R. 2957), sponsored by Representatives Tim Murphy (R-PA) and Ron Barber (D-AZ), which would include psychologists,” he says.