Q: My facility no longer registers patients under aliases, but will allow them to opt out of the patient directory. However, opting out of the registry will not exclude our patients from the operating room (OR) list. At one time, the facility's CEO received the daily OR list with full patient names so he could visit board members, donors, or others whom he knows at our facility. HIM changed this practice so that patients' names would not be on the OR schedule provided to the CEO. The CEO took this matter to the hospital attorney, who said the names could be included because the use of PHI by the CEO to determine whether and when a patient visit is appropriate is permitted by HIPAA as it is part of healthcare operations. Is it a violation of HIPAA for the CEO to use PHI to track patients in this manner?
In September 2014, CMS and the Office for the National Coordinator (ONC) released a final rule that offers enhanced flexibility for eligible professionals, eligible hospitals, and critical access hospitals using certified EHR technology (CEHRT) and working toward meaningful use attestation (https://s3.amazonaws.com/public-inspection.federalregister.gov/2014-21021.pdf). The final rule regulations became effective October 1, 2014.
Q: I was recently hired for a position at a long-term care facility. Upon getting acclimated, I learned that the facility has completed handwritten logs for every fax that was sent out since 2003. This document is referred to as the HIPAA fax log and contains the date the fax was sent, to whom it was sent, by whom it was sent, the number of pages, and whether a cover sheet with confidentiality statement was included. I would like to do away with this form since fax machines can generate their own logs. However, if this is a necessary process then I would like to follow official guidelines and update the facility's policies and procedures accordingly. Does the HIPAA Privacy or Security Rule require these logs? If so, what information must we include?
Case managers rejoice. CMS recently sounded what is being called the death knell of the 2-midnight rule certification in a final rule published in the November 10, 2014, Federal Register.
Do observation patients belong in their own unit? The answer is debated at many organizations. Some say establishing a separate unit brings numerous advantages, from improved ED throughput to shorter lengths of stay. Others say some facilities may not need one.
MRB asked HIM and release of information (ROI) professionals about their ROI practices for its first quarterly benchmarking survey of 2015. (The survey was completed in October 2014.) Half of survey respondents are HIM directors or managers (52%). Other respondents identified themselves as non-managerial HIM staff members (18%) or ROI directors or managers (4%). The majority of respondents (65%) work in hospitals.
