First, we need to be reminded of the definition of a RHC encounter.  CMS Chapter 13 of the Rural Health Clinic Benefit Manual, Section 40, defines a RHC encounter this way: "A RHC or FQHC visit is defined as a medically-necessary medical or mental health visit, or a qualified preventive health visit. The visit must be a face-to-face (one-on-one) encounter between the patient and a physician, NP, PA, CNM, CP, or a CSW during which time one or more RHC or FQHC services are rendered." Section 120.3 further explains: "Services that are covered by Medicare but do not meet the requirements for a medically necessary or qualified preventive health visit with a RHC or FQHC practitioner (e.g., blood pressure checks, allergy injections, prescriptions, nursing services, etc.) are considered incident to services. The cost of providing these services may be included on the cost report, but the provision of these services does not generate a billable visit.   Read More

No; this is not a novel about tommy gun wielding gangsters being chased down by heroic police and detectives.  Instead, it is a short story about impermissible disclosures. You see, individuals often use the term "breach" instead of using the proper verbiage to describe an incident or event that may lead to a breach.  Breach seems to have become the fall back word for anything that may violate the HIPAA rule. Additionally, staff often do not understand what are the precursors to a breach, or what the indicators are.  Having a sound understanding of what an impermissible is and is not, will help your staff identify an incident, respond to the incident, and hopefully avoid a breach or respond to a potential breach.

 

We begin by identifying the four types of impermissibles; they are access, acquisition, use, and disclosure.  Each of these four impermissibles represent incidents or events where PHI was seen or obtained by someone without proper authorization, whether inside or outside your organization.   Read More

Although the fate of the Affordable Care Act remains undecided, enforcement of the HIPAA privacy & security regulations by the Office for Civil Rights (OCR) of the US Dept of Health & Human Services is ongoing, with three settlements & one assessment of penalties already in 2017. The settlements & penalties so far total over $11 million, with one of the settlements equaling the largest ever, at $5.5 million. These four cases provide helpful lessons for covered entities & business associates, as well as warnings that HIPAA compliance might be less expensive than noncompliance.

 

The smallest settlement so far in 2017 was for $475,000 for paper Protected Health Information (PHI) of over 800 individuals that was "missing" from a health care provider, and for failure to provide breach notices within the regulatory time limits. This is not the first time breach notices were late, but it is the first time OCR has specifically identified late notices as an alleged violation.   Read More

Most states have very specific regulations pertaining to concealed/open carry license options in medical facilities.  Some states allow posting of signage reflecting the state law and/or the hospital's policy.  Other states will allow hospitals to post this information at their entrance but do not allow such posting in any clinics operated by the hospital.  Clinic managers should find out what their state requires and allows (possibly with state law enforcement agencies or the State Medical Association or Office of Rural Health).

 

In addition to knowing what your state regulations are, you should compile your policy and procedure in regards to how to deal with anyone coming into the clinic with a firearm, either visible or concealed.  How should the receptionist react?  What are you allowed to do under your state law?  What is the policy of the hospital/owners of the clinic?  What signage (if any) will you post?  How quick is your law enforcement response when you call?

 

This type of situation could also be closely tied to your "security threat" policy & procedure, & could be incorporated into that policy & training. Read More