The Compliance Divas Podcast
Our podcast covers current topics such as infection prevention and control, OSHA and HIPAA compliance for dentistry. We discuss the latest regulatory information, answer frequently asked questions and give suggestions for dental practices to make compliance easy and sustainable. The Compliance Divas are a trusted source for consistent, accurate information based upon current guidelines, standards, science, and recommendations.
The Compliance Divas Podcast
#149 HIPAA: The How, What, and When of 3rd Party Disclosures
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Have you ever received a request for patient information from a third party and wondered if it was valid? When and what patient information to share with third parties who request records can be confusing. In this episode, the Divas simplify release of information under the HIPAA Privacy Rule.
- Treatment/Payment/Healthcare operations: https://bit.ly/3Ieb73U
- Public Health Activities: https://bit.ly/3V3Lydkhttps://bit.ly/3V3Lydk
- Disclosures to Law Enforcement: https://bit.ly/3SXqbI1https://bit.ly/3SXqbI1
- Court Orders and Subpoenas: https://bit.ly/3Tg0Qe0https://bit.ly/3Tg0Qe0
Welcome. I'm Leslie Cannon. I'm Mary Gavoni.
SPEAKER_01I'm Linda Harvey. I'm Olivia Wan, and together we are the Compliance Divas.
SPEAKER_02Welcome to the Compliance Divas Podcast. This is Linda Harvey, and I will be your moderator today. Today, the topic of conversation among the Divas is HIPAA and release of information to third parties. As the Compliance Divas, we bring clarity and simplicity to compliance by navigating the regulatory world to keep you on course. We invite you to subscribe to the Compliance Divas podcast through your favorite podcast channel or on our website, thecomplicedivas.com. All the resources that we mentioned during today's podcast will also be found on our website. And we invite your questions at support at thecompliancedivas.com. And we would love it if you could scroll down to the end of your podcast app and give us a review. So understanding the who, what, when, and where of all the HIPAA requirements can be confusing at times. We've all been following the HIPAA privacy rule since 2003. Yet sometimes who we can disclose patient information to is not as clear-cut as we would like. So in this episode, the divas will talk about when and how you can release information to third parties. In particular, we'll discuss times that you don't need the patient's authorization to share their protected health information or PHI. Our diva Leslie Cannon was not able to join us today, and she wanted to be sure that we discussed the basics of disclosing a patient's PHI for what's known as treatment, payment, and health care operations, sometimes also referred to as TPO. So treatment, payment, and healthcare operations are the core health care activities of all healthcare facilities, including dental practices. So when we look at the privacy rule as a covered entity, you may disclose patients' information without their authorization for treatment, payment, and healthcare operations. Let's take a moment and talk about what each one of those means specifically as sort of a review to set the framework for what Divas, Mary, and Olivia will talk about next. So treatment generally refers to the provision and the coordination and the management of someone's health care. And this, as we know, can also be consultations between healthcare providers. It can be a dentist with a specialist, it can be a specialist talking to the patient's general dentist, or any dentist speaking to the patient's health care provider and medical provider, such as their cardiologist, for clearance. So it can be the referral of patients from one health care provider to another, in other words. And no authorization from the patient is needed for that care. Now, payment encompasses those variety of activities that are conducted in your office to obtain payment or to be a reimbursed for care. And in addition to this, think about it includes things like billing and collection activities. It includes reviewing healthcare services for medical necessity, like chart reviews, justification and charges or utilization review activities. So those are things that many times we think of being related to participating in different insurance plans. Now, lastly, healthcare operations is a bit broad, so it does encompass a little bit more, but let's look at just some simple aspects of this component. Healthcare operations include certain administrative, financial, legal, and quality improvement activities that you might perform in your practice to support the core functions of treatment and payment. This might be conducting quality assessments or quality improvement activities. It might be reviewing the competence or qualifications of the healthcare professionals. It might be conducting or arranging for dental reviews of records or legal and chart auditing services, particularly related to fraud and abuse detection and compliance programs. So healthcare operations is pretty broad, but still encompasses one-third of the core operations when it comes to treatment, payment, health care operations for when we can release patient information without their authorization. So where we'd like to go next in our conversation today is talking about what happens when unusual things come up. These are the usual things, treatment, payment, healthcare operations. But Mary, could you please help us in talking about unusual circumstances when it comes to public health activities?
SPEAKER_00Absolutely, Linda. And we can kind of look back, although we don't like to, on the COVID pandemic as one of those types of examples. The HIPAA privacy rule recognizes that there can be a legitimate need for public health authorities, and public health authorities are defined as local or state health department, the Food and Drug Administration, the Centers for Disease Control and Prevention, and also OSHA. So they could be included as the public health authority. And those authorities have the ability or the need at times to access protected health information in order to carry out their mission. So during the COVID pandemic, especially in the early days when we were really trying to track cases, if you tested positive, your local health department would contact you and ask you the names and contact information for people you may have been in contact with. And that may have included patients. And so then they would call to see if they had symptoms or how many people those people had had contact with. And it was, it was just a whole bunch of craziness because so many people had so much contact. And some patients pushed back on that, not understanding that that is a legal requirement that you must comply with those requests from public health authorities. But what you do is you disclose what's called the minimum necessary. So all that really needed in that example to be disclosed was the patient's name and a phone number or maybe an email address. You didn't have to give out any other information from the patient record, none of their like social security numbers or insurance information, none of that. It was just for the health departments to be able to contact them in case of that type of a public health emergency like we were experiencing. Linda, anything you would add to that?
SPEAKER_02I think you explained it very nicely because it's important that we all recognize the scope of these public health authorities. And we don't always think about Food and Drug Administration or CDC because we think more locally or maybe statewide. So there's other agencies that are involved. And then also just thinking about contact tracing. Those two words pop back into my mind as you were describing that, Mary. And I remember during the peak of the pandemic taking a webinar on contact tracing, because I didn't know what that meant. How do you trace? How far, how many far, how far back do you go? Yes, I was around two people, um, two relatives the other day, and who were they with? And it was sort of like this, it could go on and on and on. So how that was going to work was really curious at the time. We didn't really understand it. But thankfully we're all past that, as you said. And then just reminding everyone that you're responding to these legal requests for these public health authorities to carry out their duties and keeping it though within the information they request, the minimum necessary. So you're not going above and beyond, you're following what the request is, and that's how you know you can you're doing the right thing. And then, of course, documenting the patient's record. And they may send you official notifications. So there may be a letter that you can scan into the patient record as well. So thanks, Mary, on that. Olivia, as our legal expert among the Divas here, I know we're not giving legal advice during our podcast, but I know that you have some experience in the area of law enforcement. So can you help us understand what kind of disclosures can be made for law enforcement that we don't need the patient's permission for?
SPEAKER_01Linda, I think it's important to understand that, first of all, the HIPAA privacy rule does not apply to law enforcement, it applies to the covered entity. So that's where the obligation is in protecting the information and knowing when we can disclose that information. So, for example, a dental office may disclose protected health information to law enforcement if the patient signed an authorization. So just like any other request, we may fulfill it. The tricky part is, Linda, is when a dental office is asked to disclose protected health information to law enforcement without the individual's knowledge. And there are some built-in exceptions or I should say circumstances that would allow us to disclose information to law enforcement without the patient's consent. And I'll roll through some of these scenarios. One is to report PHI to law enforcement when we reasonable, it's reasonably believed that this would prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. Also includes reporting protected health information in good faith when you believe that there could be evidence of a crime that occurred on the property of your dental office, to alert law enforcement to the death of an individual when there is suspicion that death resulted from criminal conduct, when responding to an off-site medical emergency as necessary to alert law enforcement to criminal activity, and to report protected health information to law enforcement when required by law, such as let's say somebody came into an emergency room with gunshot wounds or they were stabbed. Obviously, this is something that's going to be reported to law enforcement. Also to comply with a court order to respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness, or missing person. But the information has to be limited to the basic demographic and health information about the person, and to respond to a request for PHI about an adult victim of a crime when the victim agrees, or in very limited circumstances, if the individual is unable to agree. And then also to report child abuse or neglect without the parents agreeing to law enforcement. And I was thinking about an older episode that we did about sex trafficking in this scenario where you have a minor that comes into the dental office for a cleaning, and maybe you notice signs, maybe broken anterior teeth, the person is not being allowed to speak. Well, if it's a minor in the chair, we don't have to worry about having their consent, you know, to report it. Now, the scenario could be different if, let's say, there's an adult in the chair that may be a victim of domestic abuse. You know, does that person agree to get law enforcement involved? Because they may not agree to that. And Linda, the tricky part is the difference between court orders and a subpoena. Because that can certainly cause some confusions when you receive this type of paperwork. So a subpoena is issued by someone other than a judge. And I was looking back at a subpoena that my office issued recently, and sure enough, it has my signature as the issuing party's attorney, and then it has the signature of the deputy clerk at the court, but it does not have a judge's signature on it. So recently, when using this type of subpoena, I subpoenaed medical records because my opponent does not want uh one of their people to testify, saying they're legally incompetent. Well, I don't have medical records to prove that, so I subpoenaed the medical records, and I also asked for the records through the discovery process, which is the request uh for documents, and they didn't comply. And they were they sought a protective order on this information. I didn't give up. I requested it again with a motion in the court, and the judge gave a court order to get that information. Well, they still didn't respond. So I made another motion 30 days later, and not only did I get my motion granted by the judge to get the medical file, I also was able to successfully get the attorney's fees for making three visits to the court that the opposing party has to pay. So we have to be careful in responding to subpoenas or uh knowing the difference, not just giving information up. We want to comply, but it's definitely a balancing act, especially if we are talking with law enforcement. I know that comes up quite a bit in my office, where maybe um recently we had a case that was uh being studied and evaluated by the Tennessee Bureau of Investigation. And you know, they come in with their paperwork to get records, and some of my records included medical records. And so we want to walk this fine line in making sure we're in compliance, we're not making unlawful disclosures, because although HIPAA doesn't apply to law enforcement, it sure does apply to dental offices. And there may be someone that's getting upset with the release of this information. So I think this is a great topic that we're hitting on, Linda.
SPEAKER_02Olivia, you really hit some high points here that really resonated with me, and I'd like to just follow up for a minute. Um, one is I think for our listeners, just to be reminded, like you said, HIPAA does not apply to the law enforcement agencies, only to a covered entity. And so it's very important that our listeners understand, especially office administrators, doctors, office managers, practice administrators, that you respond to legal requests within the required timeframe. So when you receive a letter, don't just push it aside and not think about it or throw it away or pretend it doesn't exist, because that could create more headache and more problems for your boss, if that's for the dentist, right? If that's not responded to in the correct time. So if you're not sure what to do, seek legal advice on your end or call the party issuing the court order or the subpoena to find out what it means if you're not familiar with what that is. And then you talked about a couple of specific things related to law enforcement, Olivia, that I that really jumped out at me. And that was the imminent threat to public health and public safety and the threat of violence. Thinking about um, there's been a lot of violence, you know, in dull offices and that's escalated. I just read some very sad stories just this week that's in things that happen in different areas of the country. So if a practice is concerned about a patient who is um threatening um actions against the practice, you know, threatening, you know, um harm, then by all means, call the authorities, and that's something that you'd be permitted to do. You would not be disclosing their PHI related related to any treatment that was rendered, but you're disclosing maybe um, you know, they that they're threatening you and whatever details you need for the law enforcement. And likewise with child abuse, um, many, many states require that you report that. So we don't have an option there with domestic violence and child abuse when it comes to those situations, as sad as they are and as difficult as they can be, because maybe you've never reported a case of child abuse and you're, you know, you feel very uneasy about it. I can think about when I had to do that as a risk manager for a medical group I worked for. It was not a comfortable place to be, but we have to do the right thing, and that's so very important. Um, divas, any other thoughts or questions that you have, Olivia?
SPEAKER_01I just wanted to share with our group that recently I had a support question to come up where there was a restraining order against one parent, and the other parent, the responsible parent, is bringing the children into the dental office, and the other parent wanted a copy of their records. Well, providing their rights are not terminated, they have a right to the information, but the one parent where there was risk asked to know when the next appointments were. And so I gave them dialogue that the dentist had the discretion to withhold certain information when he felt that this would cause danger to his patient. So even though the record was provided showing the services that had been rendered, the treatment plan, we withheld the next appointment dates because there was fear that he may try to pick up these children and run off with them. So that's certainly the discretion allowed for the provider. So I like what you mentioned, Linda, that if if someone is not sure, they need to reach out to the people they're comfortable, whether that's their consultant or their legal counsel that's familiar with HIPAA, and there's so much resources on the HHS.gov website to familiarize yourself with this.
SPEAKER_02Thank you, Olivia. Mary, what can you add?
SPEAKER_00Olivia, thank you for that example because it's such a really um graphic example, if you will, of the minimum necessary. So it it wasn't necessary to disclose when the next appointments are, if that person wanted, truly wanted to know what the treatment was that were done. And in our um orthodontic and pediatric practices run into those kinds of things all the time. And just keep that in mind, minimum necessary. And if a parent is legal, um, whether it's a biological child or an adopted child, unless there's some kind of a court order that says they can't have that information, they are legally allowed to have it. But then we have to step back and say, okay, what is the minimum necessary to disclose? So thanks for bringing that up. That was a great example.
SPEAKER_02Yes, I think it was a perfect example as well, Mary. And it makes me think about the verbiage that our team members need to feel comfortable with their phone skills, especially if someone's new to dentistry and not used to handling an unusual situation that comes up like this, or even someone who's a veteran in dentistry who hasn't had this kind of situation come up. And certainly they don't come up every day to have that script and have that comfort level to be able to, like we do, discussing treatment and making appointments and so forth. So it's really important to be prepared in these areas. So I would encourage our listeners today to share this podcast with the rest of your team because this is such an important topic and it touches everybody in the practice. An innocent uh piece of information could be disclosed in the back by the dull assistant or dull hygienist just during a conversation when someone innocently asks information and you haven't checked whether or not the patient has given you permission to speak to other people, whether they're relatives or friends or whomever they may be. So this was such an important topic today. We appreciate you all joining us. And as the compliance divas, we bring clarity and simplicity to compliance by navigating the regulatory world to keep you on course. We invite you to subscribe to our podcast through your favorite podcast channel or on our website, thecompliancedivas.com. All the resources that we mentioned today, we will have some great links to the HHS website for you, can be found on the Compliance Divas website. And we invite you to submit any questions to support at thecompliancedivas.com. And lastly, we would be honored if you could scroll down to the bottom of your podcast app and leave us a review today. And we look forward to seeing you at our next podcast.