Be especially diligent about e-mail, which is often where the trouble lies, says Willard. “People use it like a conversation so the comments made can be misconstrued, taken out of context, and very damaging,” he says. “E-mail generally should have a shorter retention period, but still comply with state mandates and statute of limitations.”
Record requests
By far, however, the biggest threat to practices involves the transfer or disclosure of patient records. Practices receive requests for medical charts all the time from specialists, patients, attorneys, and even insurance companies which review records for audit and pay-for-performance purposes. Not all requests should be treated equally. “This is a very litigious area,” warns Iwrey.
Let’s start with the big one. HIPAA allows the disclosure of patient records without specific patient permission only for the purposes of treatment, payment, and operations, also known as the “TPO exclusion.” That said, you’re generally covered when you share records with payers and other providers for the purposes of patient care, particularly if you have your patients sign a HIPAA privacy notice when they join your practice, says Lance LoRusso, an Atlanta litigation attorney who specializes in medical malpractice.
Keep in mind that under most insurance contracts, you are obligated to provide medical charts to third-party payers upon request, but you can only provide records from patients who are members of their plan. Providing records for nonmembers constitutes a HIPAA violation. Remember, too, that insurance carriers often ask to see the patient’s entire chart, but legally they’re only entitled to view the services provided during the months and years that patient has been covered by their plan. Those processing such requests in your office should check the effective dates of that patient’s coverage and provide only those records that fall within that time frame. It may be an added burden on your staff, but it’s a HIPAA violation if you don’t.
As far as disclosure to a third party is concerned, you are also generally covered if you obtain the patient’s signed consent form. “You can release anything to anyone with the patient’s permission,” says LoRusso, noting that physicians should put a copy of the signed release into the patient’s chart and make sure the staff is aware of the parameters such as the date and the person to whom information may be released. “If anyone ever has a question about releasing information to a third party, the safest way to go is to always get the patient’s permission and make sure the document used to obtain the information meets federal and state guidelines.”
If you are contacted by a malpractice attorney who is requesting documents as part of a pretrial discovery or before a lawsuit is filed, and the patient has signed a consent form, you must legally provide those records within 30 days in most states. If they don’t have a consent form, do not comply. “Just tell them you’re not providing anything unless they have the signed authorization from the patient and let them know that whatever is being requested better fall squarely within the scope of that authorization,” says Iwrey. “You might get an aggressive attorney making all types of arguments that they’re entitled to the documents, but it’s important to stand your ground. Tell them that you need either a court order requiring you to produce it, or a signed authorization from the patient.”
And don’t forget to contact your insurance company immediately if you even think a lawsuit may be filed. Failure to notify them in a timely fashion could result in a denial of coverage if you get sued.
Copy charges
As patients are becoming more proactive about their own healthcare, individual requests for medical records are on the rise, creating an added cost burden for cash-strapped practices. There’s the labor hours involved in pulling and processing the chart, the time it takes to prepare an explanation or summary, and the expense of materials (postage, paper, computer disk, etc.).
While some practices chalk it up to business costs, others are now charging patients to reproduce their record. That decision is up to you, but how much you’re able to charge is anything but. According to HIPAA, practices may impose a “reasonable” cost-based fee for copying, including the labor costs of copying. The fee can also include the cost of any material used, including paper, computer disk, or postage, but practices may not charge for retrieving or handling the information or for processing the request.
HIPAA stopped short of setting per-page copy fees, leaving that up to the states. It varies, of course, but most states allow practices to charge anywhere from 25 cents to $1 per page. Check with your state medical society for copy fee limits in your state. Lastly, bear in mind that it’s neither legal nor ethical, according to the AMA, to withhold a patient’s medical record because of an unpaid bill.
Rules regulating patient records are in a constant state of flux, making it tough for smaller practices to comply. Yet, failure to do so can result in serious repercussions for providers. The best way to protect your office is to review your policies for record retention, document disclosure, and copy fees annually, with guidance from your state medical society or malpractice carrier. “Some practices are very good at this and others are sloppy,” says Dunn. “It’s up to the manager or CEO to set the guidelines for your employees. State laws are very clear and you need to define what they are for your practice.”
Shelly K. Schwartz, a freelance writer in Maplewood, N.J., has covered personal finance, technology, and healthcare for more than 12 years. Her work has appeared on CNNMoney.com, Bankrate.com, and Healthy Family magazine. She can be reached via physicianspractice@cmpmedica.com.
This article originally appeared in the May 2010 issue of Physicians Practice.
