Eli's Hospice Insider

Published on Sun May 24, 2009 PDF

Hint: Get ready to revisit your business associate agreements.

Brace yourself for a couple of new HIPAA requirements on the horizon, where unwitting noncompliance can put your hospice at risk for serious consequences.

For one, new requirements that go into effect on Feb. 17, 2010 mandate business associates comply with the HIPAA privacy and security rules and make sure they have appropriate contracts in place with their clients, says Jim Sheldon-Dean, principal of Lewis Creek Systems LLC in Charlotte, Vt. "So hospices may be hearing from some of their vendors ...

about whether they should have a BA agreement," he predicts.

Review your existing agreements: "Business associate agreements may need revision depending on their wording," says Chicago attorney Michael Roach. That would be the case, he adds, "if the agreement doesn't specifically require the business associate to comply with the HIPAA privacy and security regulations. Some agreements in place don't specifically include that language," he cautions.

Got Electronic Health Records? Read On

Under new requirements, covered entities will have to make an accounting for disclosures of patients' protected health information (PHI) for treatment, payment or healthcare operations, if the disclosure comes from an electronic health record, says Roach. If  the covered entity "has a paper system, it doesn't have to track those disclosures." Lawmakers probably knew "it'd be too cumbersome to track that information" using paper systems, he adds.

Currently, a covered entity with a paper or EHR system only has to track when it discloses PHI for a reason that isn't related to treatment, payment or healthcare operations. The accounting of disclosure requirements go into effect depending on when the covered entity began using its EHR, says Sheldon-Dean. If that was after Jan. 1, 2009, then the entity must comply on Jan. 1, 2011. If the entity started using its EHR before Jan. 1, 2009, then it must comply by Jan. 1, 2014, he says. The Health & Human Services Secretary can delay the deadlines for two years, he adds.