P.J. Cloud-Moulds

At some point, all healthcare providers need to engage third parties to perform activities or functions on their behalf. In so doing, providers need to ensure those third parties maintain confidentiality of information learned in the course of their services. Providers must be even more vigilant when those third parties have access to certain patient information.

Providers who are considered covered entities under the 

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

 are required to properly protect an individual’s health information in compliance with the requirements set forth in the 

HIPAA Privacy, Security, Breach Notification and Enforcement Rules

Specifically, the Privacy Rule allows such access to and disclosure of protected health information (PHI) by third parties, defined as business associates, only if the provider obtains satisfactory assurances in writing from the business associate that it will:

use the PHI only for the purpose for which it was engaged by the provider,

safeguard the information from misuse and

help the provider comply with some of its duties under the Privacy Rule.

The provider, and in certain situations its business associate, have direct liability under HIPAA, meaning that should either party breach certain aspects of the HIPAA Rules, the HHS 

 (OCR) may bring an enforcement action directly against that party. Recently, the 

 that specifically identifies the only situations where a business associate has direct liability under HIPAA.

HIPAA Breaches: Times you can be held liable for a business associate’s HIPAA breach

The fact sheet is important because it reminds us there are situations in which a business associate could cause a breach of HIPAA but not be directly liable to OCR. In those situations, it is the provider who would likely be directly liable to OCR for the business associate’s actions.

As an example, the HIPAA Rules prohibit a provider from charging fees to their patients in excess of a specified limitation for copies of or access to their PHI. In the event the business associate agreement authorizes the business associate to fulfill a request by an individual for access to his or her PHI, and the business associate charges a fee that exceeds the amount permitted under HIPAA, then the provider would be directly liable to OCR for those actions.

To address these situations, providers should incorporate language into the indemnification provision of their business associate agreements requiring the business associate indemnify the provider “for any actions or omissions of the business associate that cause the provider to fail to satisfy its obligations under the HIPAA Rules.” Additionally, to the extent a provider has insurance covering HIPAA-related liability, the provider should seek to ensure it includes liability caused by actions or omissions of its business associates.

. She focuses her practice on healthcare regulatory, transactional and corporate law in her representation of healthcare providers and suppliers and other participants in the healthcare industry. Rose regularly counsels healthcare industry clients on matters involving mergers and acquisitions, software agreements, physician referral rules, certificates of need, privacy and security of health information, corporate documents and compliance program elements.

Articles

Recent clarifications on HIPAA liability underscore the importance of maintaining protected health information and taking precautions when working with third parties.

We've all been there: That awkward annual meeting with your medical practice staff members. The opportunity for these meetings to go well is just a few measurements away. Whether it is front-desk, back-office, or healthcare staff, making sure that you have measurable goals and metrics will ensure these meetings are successful.

For front-desk staff, consider looking at these areas:

Measurable metrics too review medical practice staff

When annual reviews for practice employees come around, having measurable metrics in place will make the meeting go more smoothly. Here are some ideas.

Measurable metrics to review medical practice staff

Managing Cash-Handling at Your Medical Practice

When it comes to money handling you can never have too many fail-safe protocols in place. The most important thing to remember is to never allow cash to be too accessible to staff. What I mean is that you need to have protocols in place that tell your staff, "this is not yours, and it is off limits." Never provide an opportunity for a decision to be made by a staff member that could jeopardize your bank account. I'm talking about transparency in your process and procedure.

If you suspect a staff member may be taking liberties that are not his to take, a four- or five-step process to tighten up your money-management processes would serve you best. This is such a difficult situation to be faced with, in lieu of actually videotaping someone taking money that is not his to take, you only have suspicion. That could get you into some real trouble.

Here are some ways you can protect your cash by creating solid accounting processes:

Making a few simple changes to your cash-handling procedures can potentially save your practice thousands of dollars


Manage Cash-Handling at Your Medical Practice

Often major decisions are made based upon knee-jerk reactions to data generated by well-meaning employees.  But if you are only looking at data on a monthly basis, not a quarterly or annually, you could be hurting your business more than you think.

Each month has a different number of working days and this is something you need to take into consideration.  For example for this year, here are the number of working days:

January: 22 working days
February: 20 working days
March: 22 working days
April: 21 working days
May: 22 working days
June: 21 working days
July: 21 working days
August: 23 working days
September: 19 working days
October: 23 working days
November: 19-20 working days (some companies shut down for both Thursday and Friday for Thanksgiving)
December: 20 working days

These can obviously change if your company shuts down for more than just the major holidays, or no holidays at all.

So looking at March, August and October your monthly data will look like you are performing much better than if you made decisions based upon data generated on September, February and December.  This is particularly important for projecting your inflow, paying out bonuses and payroll, and making sure you have enough to make ends meet. 

Of course review your monthly data, but keep in mind that some months will look bette. Looking at your information quarterly or even comparing to this time last year is your best bet.  It also much easier to plan capital equipment, raises, or even hiring more employees based upon your ability to project out based upon working days.   

I think this is an area that often get overlooked, as several practices often complain about how volatile the market is from month to month.  Sure based upon your practice type, you could have seasonal business.  If your are an orthopedic surgeon, summer and fall are most likely your busiest times of the year since people are more active and kids are back in school and playing more sports. 

Depending upon location can also be a contributing factor.  Perhaps you rely on tourism or the weather plays a factor.  All of these areas are things to keep in mind, and know that you will have ebb and flow within your business.  Just taking a step back and finding perspective when reviewing your information can provide you a less stressful review knowing that your business is not failing or employees are not performing.

It’s so important to step back, get off the emotional rollercoaster, and find perspective when it comes to monthly data.