Practice Management Alert

Reader Question:

Erase PHI Before You Click 'Send'

Question: I sometimes e-mail patient records to consultants or other coders for help on how to bill. How can I make sure I-m not committing a HIPAA violation?


Oregon Subscriber
Answer: A simple request for help can land you in plenty of trouble with HIPAA. The key is to remove all identifying information from the report before you send it.

Here's how: Under HIPAA's Privacy Rule, you can make sure you don't send protected health information (PHI) by removing all individually identifiable health information, including health information that reasonably allows individual identification. In general, HIPAA is based on reasonableness.

Best bet: Only send the portions of the report that describe the clinical procedure and findings and include a confidentiality notice at the end of your e-mail. This guideline applies whether you send the e-mail from an office or from home.

Example: You need help billing an abdominal CT. Before you send out the report by e-mail, you remove the patient's name and social security number. You also remove geographic identifiers, dates, phone, fax, and e-mail information, and medical record and device serial numbers. Then you read through the report before you send it to be sure you can reasonably assume the patient is no longer identifiable.

Option: For extra security, you can send an encrypted e-mail to keep information safe. The answers to the Reader Questions were provided and/or reviewed by Barbara J. Cobuzzi, MBA, CPC, CPC-H, CPC-P, CHCC, director of outreach programs for the American Academy of Professional Coders, the coding organization in Salt Lake City.
You’ve reached your limit of free articles. Already a subscriber? Log in.
Not a subscriber? Subscribe today to continue reading this article. Plus, you’ll get:
  • Simple explanations of current healthcare regulations and payer programs
  • Real-world reporting scenarios solved by our expert coders
  • Industry news, such as MAC and RAC activities, the OIG Work Plan, and CERT reports
  • Instant access to every article ever published in your eNewsletter
  • 6 annual AAPC-approved CEUs*
  • The latest updates for CPT®, ICD-10-CM, HCPCS Level II, NCCI edits, modifiers, compliance, technology, practice management, and more
*CEUs available with select eNewsletters.