Health Information Compliance Alert

Published on Sat Sep 25, 2010 PDF

5 tips to keep the bull's-eye off your back.

The bad news: You're going to run into a HIPAA complaint. The good news: It doesn't have to be a disaster. With a little finesse you can turn a potentially disastrous situation into a positive experience -- without a single phone call to the HHS Office for Civil Rights. Here's how.

You don't have to train your entire staff on how to deal with a HIPAA complaint.

Strategy: Designate one staff member to handle HIPAA complaints, suggests Kerry Kearney, a partner with Reed Smith in Pittsburgh, PA. This person could make or break potential OCR involvement, so "you don't want to pick your snarliest employee for this role," she advises.

Remember: You've got to keep in mind how your office is set up, says Sharon Budman, privacy ombudsman for the University of Miami. If you have more than one privacy officer or if you're part of a larger network, you'll want to set up a process that works for you, she reminds.

Don't wait for patients who've expressed some discontent to file an official complaint, advises attorney Kelly Pickens of the Health Law Center in Greenville, SC. Rather, you need to "cultivate a personality where patients come directly to you," she says.

And it's not hard to do. Instead of giving patients forms to fill out, you might schedule an interview with them where they could talk at length about the issue, Pickens recommends.

Tip: "Ask open-ended questions that allow patients to tailor their responses," she suggests.

You've got to make sure patients know "they have a place to go with their complaints," Kearney asserts. "Patients don't want to turn their doctor in to the government, they just want someone to recognize that their rights have been violated," she explains.

You have to set a standard for what you'll consider a HIPAA complaint, Budman asserts. Potential complaints could be anything from "'You need to do a better job at this' to 'My privacy was violated,'" she explains.

"Patients tend to think things are HIPAA complaints when they're not," Kearney concurs.

Best practice: Explain to the patient why the issue is not a HIPAA violation, she suggests. Let them know that you're sorry they were inconvenienced.

Keep in mind that even if there is no HIPAA concern, any patient complaint should be taken seriously, experts remind.

Tip: Follow your standard procedure for dealing with complaints once you determine that HIPAA is not a factor, Pickens advises.

As with other aspects of the privacy rule, it's crucial that you document each step in the complaint procedure, Pickens says. While you don't have to build an entire policy around how you'll handle complaints, you do need to write down what your investigation process will look like -- and how you'll apply sanctions, she says.

And, if you decide to address HIPAA complaints verbally, you've got to document "exactly what the patient said, the disposition of the complaint and whether there is an identifiable HIPAA violation," Pickens advises.