AHIMA BoK: Search for

Publication Date: April 02, 2003

HIPAA laws have strengthened patients’ rights concerning access to their private medical information while at the same time making them more aware of their rights. Consequently, more patients are going to be requesting an accounting of disclosures (AOD) in the future.
According to secti....

Health Information Confidentiality: a Moving Target

Author: Carol, Ruth

Source: Journal of AHIMA

Publication Date: April 2003

Redisclosure of Patient Health Information (2003 update)

Author: Rhodes, Harry B.; Hughes, Gwen

Source: AHIMA practice brief | Journal of AHIMA

Publication Date: April 2003

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

Preemption Analysis Under HIPAA: Proceed with Caution

Author: Pritts, Joy

Publication Date: April 02, 2003

April 14, 2003, might mark the beginning of HIPAA compliance, but it does not signify the end of state health privacy laws. HIPAA does not preempt (supersede) state laws that either don’t conflict with HIPAA or are more stringent than the federal regulation. Figuring out which state laws rema....

Balancing Privacy and Control with Employees' Medical Records

Author: Dougherty, Michelle

Publication Date: April 02, 2003

Question: Our organization is struggling with how to handle employee access to medical records.We have an electronic medical record system and employees are accessing their own medical records during working hours. We are having a significant debate at our organization about the rights of emp....

Final Security Regulations Present Challenges, Opportunities for HIM

Author: Rode, Dan

Source: Journal of AHIMA

Publication Date: May 2003

With the release of the final HIPAA security regulations in February, HIM has taken yet another step toward the transition from paper to the electronic health record (EHR). This article discusses key areas of security compliance and how your organization can be prepared.

When PHI Go....

Accounting for Disclosure Cost Analysis Worksheet

Author: Dunn, Rose T

Source: External - used with permission

Publication Date: May 02, 2003

This worksheet has been developed to provide guidance on components to consider in developing the basis for a reasonable, cost-based charge for the Accounting for Disclosure (164.528). This worksheet is not intended to be all inclusive. Users are encouraged to discuss inclusions to this analysis with their facility’s cost accountant.

Calculating Costs for Accounting of Disclosures

Author: Dunn, Rose T

Source: Journal of AHIMA

Publication Date: May 2003

The privacy rule allows a covered entity to charge a cost-based fee for providing an accounting of disclosure (AOD). Has your organization determined these costs? Calculating the actual costs may be more involved than you think. This article will discuss the requirements for setting the fee an....

Adoption and Reproductive Technology: Determining Appropriate Access to Information

Author: Harman, Laurinda B.

Publication Date: May 02, 2003

There was a time when the decision regarding access to information generated about adopted children was relatively easy and the HIM professional could refer to the state statutes for guidance. This article suggests that the legal aspect is a necessary but insufficient basis for making decisio....

Catching Up with HIPAA: Managing Noncompliance

Author: Weintraub, Abner E.

Source: Journal of AHIMA

Publication Date: May 2003

With the April 14 HIPAA privacy deadline behind us, many covered entities are still struggling to become compliant. Limited budgets and staff, conflicting advice, and unforeseen delays have all conspired to keep many covered entities from meeting the deadline.

What do you tell....

Using Network Audits to Monitor Privacy and Security

Author: Shanley, Suzanne

Publication Date: May 02, 2003

Under the security rule, covered entities must ensure that some process is put in place to record and review system access and activity. Audit controls are required to record any alterations to confidential patient information, including changes to content and the addition or deletion of info....

Cost Items for Release of Information Services (ROI)

Author: Dunn, Rose T

Source: External - used with permission

Publication Date: May 02, 2003

Reprinted with permission from Rose T. Dunn, CPA, RHIA, FACHE, First Class Solutions, Inc., 2003.

Journal Q&A (6/03)

Author: AHIMA Professional Practice Team

Source: AHIMA Q and A

Publication Date: June 02, 2003

Q: Under the privacy rule, how should a physician’s office handle a request from parents for a written statement recommending limitation of their child’s activities at school?

A: Most covered entities have policies requiring written requests or authorizations for disclosure of....

Oral Privacy and HIPAA: We Really Need to Talk

Author: Jacobs, Jodi

Publication Date: June 02, 2003

Oral privacy is not a new need or requirement in healthcare. However, because it is now backed by a federal mandate, it is receiving newfound attention. With the passing of the April 14, 2003, deadline for HIPAA compliance, hospitals, pharmacies, clearinghouses, physician’s offices, military....

Cryptography and HIPAA: Breaking the Code

Author: Ruano, Michael

Publication Date: June 02, 2003

Part four in a 10-part series.
This article is the fourth of a 10-part series that introduces the domains of information security and relates them to federal HIPAA regulations. The information security domain of cryptography is probably the most complex and mathematical of all the domai....

Obtaining Satisfactory Assurance for PHI Disclosure

Author: Quinsey, Carol Ann

Source: Journal of AHIMA

Publication Date: June 2003

Obtaining “satisfactory assurance” in the privacy rule may sound like something new, but the concept has been around for a long time. Do you know what it means and how it affects your HIM department? This article will explain what obtaining satisfactory assurance means and how it can....

Understanding HIPAA Enforcement: Trust, but Verify

Author: Apple, Gordon J.

Publication Date: June 02, 2003

Former President Ronald Reagan coined a phrase during the Cold War, “trust, but verify,” regarding treaties with the former Soviet Union. Today, as we ponder the enforcement environment likely to emerge over HIPAA, a more apt phrase may be “trust, don’t do much, and react to public pressure.”....

Journal Q&A (6/03)

Author: AHIMA Professional Practice Team

Source: AHIMA Q and A

Publication Date: June 02, 2003

Q: What are a covered entity’s legal responsibilities when a former employee breaches confidentiality of information gained during his or her employment period?

A: Individual state laws would affect the outcome of litigation if charges were pressed through civil action. If the organ....

Sorting Out Employee Sanctions

Source: Journal of AHIMA

Publication Date: June 2003

Has your organization addressed sanctions related to privacy and security issues? Both the final privacy rule and final security rule address this issue. The privacy rule states that the covered entity must “have and apply appropriate sanctions against members of its workforce who fail to....

Preparing for Suspension of Disclosure Accounting

Author: Quinsey, Carol Ann

Source: Journal of AHIMA

Publication Date: July 2003

Are the rules for the suspension of disclosure accounting keeping your organization in suspense?

Section 164.528 of the privacy rule outlines the requirements for accounting of disclosures for individuals. Section 164.528 (a)(2)(i) calls for suspension of disclosure accounting....

Web-based Applications Offer Data Processing Solutions

Author: Salem, Didier

Publication Date: July 02, 2003

While adherence to most of the HIPAA privacy rule clauses requires establishment of policies, procedures, and training of appropriate personnel, some of the clauses require establishing permanent record-keeping processes. Accounting of disclosures, minimum necessary, complaints, sanctions, an....

Preparing Information for Specialty Board Examinations

Author: Quinsey, Carol Ann

Publication Date: July 02, 2003

Question: Occasionally HIM departments are asked to prepare a list of cases for physicians or surgeons preparing to take their specialty board exams. The physicians are required to submit such a list to the professional board (such as OB/GYN, general surgery, plastic surgery, etc.) conducting....

Developing a Plan of Action: How to Conduct an Accounting of Disclosures

Author: Stuard, Susan

Publication Date: July 02, 2003

The accounting of disclosures requirement is one of the most difficult aspects of the HIPAA privacy rule to implement. Initially the rule’s complexity was obscured by the more pressing concerns presented by the requirement to obtain consent and the confusing research and marketing standard. A....

Building Privacy: Security Architecture, Models Under HIPAA

Author: Ruano, Michael

Publication Date: July 02, 2003

Part five in a 10-part series.
This article is the fifth of a 10-part series that introduces the domains of information security and relates them to federal HIPAA regulations. The information security domain of security architecture and models speaks to computer architectures, security....

Patient Education: Developing a Hidden HIPAA Opportunity

Author: Weintraub, Abner E.

Publication Date: July 02, 2003

HIPAA is strong medicine for healthcare and for patients. But who’s telling patients what they need to know about protecting their privacy? What benefits would healthcare providers enjoy if patients were clearly informed about HIPAA?
Educating patients about HIPAA offers a number of pot....

Handling Patient Privacy Complaints

Publication Date: August 02, 2003

Question: When patients have privacy complaints, should we require them to put it in writing and sign it? Also, how should we handle telephone complaints?
Answer: The privacy rule does not define the process for complaints within covered entities. The covered entity (CE) must provide a....

Establishing Security Safeguards to Meet the Privacy Rule: What You Need to Know

Author: Gallagher, Lisa; Yale, Ken

Publication Date: August 02, 2003

The HIPAA privacy rule requires that a covered entity (CE) institute appropriate administrative, technical, and physical measures to reasonably safeguard the privacy of protected health information (PHI). In order to keep information “private,” it must be kept safe or secure. Therefore, logic....

Handling Security Breaches Under HIPAA: a Legal Perspective

Author: Gradle, Brian D.

Publication Date: August 02, 2003

If you were to ask health information managers for a one-word response to HIPAA, the majority of the replies would likely be “privacy.”However, simply because the compliance date for the final security rule (which was published by the government in February and applies to electronic informati....

New Tool Streamlines HIPAA Assessment Process

Author: Cohen, Kathleen

Publication Date: August 02, 2003

How are you making sure that your organization is complying with the HIPAA privacy regulations? Many hospitals are doing HIPAA rounds with privacy officers, going from unit to unit to assess and document HIPAA compliance. But trying to make sense of the data collected during HIPAA rounds can....

Determining Personal Representatives

Author: Dougherty, Michelle

Publication Date: September 02, 2003

Question: I have had attorneys complain about being charged the state-allowed copy fee rather than the reduced rate charged to patients under HIPAA. Is an attorney considered the individual’s personal representative?
Answer: Your organization may charge the state-defined copy fee and a....

Journal Q&A (9/03)

Author: AHIMA Professional Practice Team

Source: AHIMA Q and A

Publication Date: September 02, 2003

Q: Under HIPAA, how should covered entities respond to requests from public health officials who state that they need protected health information (PHI) to carry out their duties?

A: The privacy rule recognizes that PHI may be needed to respond to threats to public health, including the....

Uncovering the Enemy Within: Utilizing Incident Response, Forensics

Author: Derhak, Mike

Publication Date: September 02, 2003

Inappropriate sharing of protected health information. Sending intimidating e-mails. Browsing inappropriate Web sites. Downloading unauthorized Web content. Software, music, or video piracy. These are just a few examples of internal security breaches companies may face. According to the 2003....

HIPAA Reins in Shadow Charts, Independent Databases (HIPAA on the Job)

Author: Amatayakul, Margret

Source: Journal of AHIMA

Publication Date: October 2003

Shadow charts, independent databases, or “orphan systems,” as they are sometimes called, are among the most controversial and difficult to manage forms of protected health information (PHI) that exist. Yet some providers are having success using HIPAA’s privacy and security stan....

Handling PHI Received by Other Methods, Unauthorized Disclosures

Publication Date: October 02, 2003

Question: How should we handle protected health information (PHI) we receive either in error or for a patient that never shows up for their appointment?
Answer: When you receive PHI in the mail, by fax, or by any other method, you should treat it as carefully as if it were PHI generated....

On the Line: Professional Practice Solutions (10/03)

Source: AHIMA Q and A | Journal of AHIMA

Publication Date: October 2003

Q: Does the privacy rule allow us to release patient information over the telephone without authorization? How do I decide when I should ask for verification of a treatment relationship with the patient?

A: In the past, HIM professionals have carefully guarded the releasing of patient i....

Complete Medical Record in a Hybrid EHR Environment

Author: AHIMA Task Force

Source: AHIMA Task Force

Publication Date: October 20, 2003

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

Complete Medical Record in a Hybrid EHR Environment. Part III: Authorship of and Printing the Health Record

Author: AHIMA Task Force

Source: AHIMA practice brief

Publication Date: October 2003

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

Complete Medical Record in a Hybrid EHR Environment. Part II: Managing Access and Disclosure

Author: AHIMA Task Force

Source: AHIMA practice brief

Publication Date: October 2003

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

How Law, Investigation, Ethics Connect to HIPAA

Author: Ruano, Michael

Publication Date: November 02, 2003

Part nine in a 10-part series.
This article is the ninth of a 10-part series that introduces the domains of information security and relates them to federal HIPAA regulations. The information security domain of law, investigation, and ethics covers these topics in depth and provides a p....

Handling Release of Information Over the Phone

Author: Hjort, Beth M.