HIPAA Compliance Services

This is more a question of consent, than HIPAA. Practices should always ensure that they have consulted with their Risk Department on what type of consent forms may be necessary for individuals other than parents to bring minor children for medical and/or dental appointments. The Health Insurance Portability and Accountability Act does permit covered entities to share information that is directly relevant to the involvement of the grandparent (or other friend or family member) in the patient’s care or payment for healthcare services.

The Health Insurance Portability & Accountability Act requires that Covered Entities and Business Associates maintain HIPAA documentation for a period of six years. For example, if a dental practice updates it’s Notice of Privacy Practices, it would need to retain the old Notice for a period of 6 years from the date of the newest revision.

The retention of medical and dental records is driven by state law. You should refer to your specific state regulations for guidance on how long to retain records for inactive patients.

The Health Insurance Portability & Accountability Act offers many protections for patients, including their right to receive copies of their records at a cost based, reasonable fee. The Privacy Rule permits fees that include the cost of certain labor, supplies and postage related to creating and providing copies of records. This includes the labor for creating and delivering the records, the cost of supplies such as paper, ink or electronic media, and the cost of postage for delivery.

No. Covered entities are not permitted to require the patient to pay their balance in full prior to receiving a copy of their records, but may charge them a cost-based reasonable fee that includes the actual cost of labor, paper, ink and postage.

The Privacy Rule permits (but does not require) a covered entity to disclose protected health information about a decedent to a family member, or other person who was involved in the individual’s health care or payment for care prior to the individual’s death, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity. This may include disclosures to spouses, parents, children, domestic partners, other relatives, or friends of the decedent, provided the information disclosed is limited to that which is relevant to the person’s involvement in the decedent’s care or payment for care.

No. The Security Rule requires covered entities to secure unattended sessions. The purpose of securing the device when unattended is to prevent unauthorized persons from gaining access to not just the Protected Health Information (PHI) that may be visible on the screen, but that also could be accessed if an unauthorized individual had access to the device itself.

Yes. Covered entities must have a process (and corresponding policy) to allow individuals to make Restriction Requests. Once the request is received, the Privacy Officer must evaluate the request, and determine whether it can be reasonably accommodated or not. In small practices, where employees are cross-trained and may perform multiple functions, this may not be a reasonable request, while a larger practice with more departments and employees might be able to reasonably limit or restrict an employee's access to certain records. If the covered entity does agree to a restriction request, the covered entity must comply with the agreed restriction, except for in medical emergencies or other circumstances as defined in the Privacy Rule. Restriction requests accepted or denied in writing.

Yes. The Privacy Rule allows covered entities to communicate with their patients through electronic means such as email if reasonable safeguards are used. Encryption is a good example of a safeguard used during the transmission of Protected Health Information (PHI) through email. If encryption is not available for email communications between the provider and patient, the provider should make the patient aware of the risks associated with using unencrypted email, and let the patient decide whether to proceed with the transmission of PHI via unencrypted email.