As you open your new practice, you will need to be aware of and comply with requirements of the Health Insurance Portability and Accountability Act (HIPAA). HIPAA has two sections, Privacy and Security.

The Privacy section relates to keeping patient information private, so that only the patient and those to whom the patient has given access can view the patient’s information.

The Security section relates to data transmission of patient information and your requirement to keep the data secure.

The first question you probably have is whether you’re considered a “covered entity.” If you plan to provide healthcare (i.e., chiropractic care) to patients in the normal course of your business AND you plan to transmit “covered transactions” (billing for Medicare patients, for example), then you’re considered a covered healthcare provider and you must comply with HIPAA regulations.

Even if you are not now planning to transmit electronically, it is a good idea to act as if you were a covered entity, so that you will have all of the systems in place. For the average healthcare provider, here is what the U.S. Department of Health and Human Services says about the minimum requirements:

For the average healthcare provider or health plan, the Privacy Rule requires activities, such as:

• Notifying patients about their privacy rights and how their information can be used;
• Adopting and implementing privacy procedures for its practice, hospital, or plan;
• Training employees so that they understand the privacy procedures;
• Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed;
• Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.

Here are the policies, procedures, and forms you must implement in order to comply with HIPAA:

• You must create a Notice of Privacy Practices to advise your patients of how your practice is complying with the HIPAA privacy policies.
• You must create agreements with “business associates” (e.g., billing companies, consultants, lawyers, accountants) that may have access to protected health information of your patients. A business associate agreement specifies what the associate can and can’t do with protected information, his obligation to safeguard data and report unauthorized uses and disclosures, and the like. For sample agreements, see “National Standards to Protect the Privacy of Personal Health Information,” www.hhs.gov/ocr/hipaa/contractprov.html.
• You must set up and maintain a way to keep track of who can see and use patient information, so you can provide patients with this information if they request it.
• You must allow patients access to their records and let them dispute information they believe is incorrect.
• You must train your staff in these procedures and make sure they are vigilant in their efforts to keep patient information safe.

Back