Issue link: http://cp.revolio.com/i/142672
living the law—HIPAA HIPAA Resources "The privacy of every client's PHI is mandatory. When you maintain client records, gather information from a client, engage in oral communication, or transmit records (whether electronic or not), you are considered a covered entity." I suggest following HIPAA guidelines; they actually make good business sense and are fairly easy to implement. Consumers are now accustomed to getting privacy policy statements from other healthcare providers as well as from a myriad of other businesses, such as insurance carriers and credit card companies. Your clients might find it disconcerting if you don't follow suit. Note that even if you do not need to be HIPAA compliant for your own practice, you still need to be compliant if you work with other covered entities. The term for this is a chain of trust. If you are a business associate, you must meet the same requirements for privacy and security as if you were a covered entity. According to HIPAA regulations, a business associate is defined as persons, companies, or entities hired by the practitioner to perform duties that require access, the use of, or disclosure of a client's PHI. Thus, if a primary care provider refers a client to you or you send a client's progress report to her doctor, then you are considered a business associate. There is a form that business associates must sign. If you are currently working with other providers and haven't received one of these forms, you will soon. Also, be aware that your state regulations might be more stringent than the federal requirements. Myths Myths abound regarding client paperwork, such as sign-in sheets and files. You can still have client sign-in sheets as long as they don't disclose any PHI. You can put clients' charts on the treatment room doors as long as the clients' names aren't visible and unauthorized people don't have access to the charts. For instance, if people must walk past a treatment room on the way to the bathroom, then it might not be wise to put a chart on that treatment room door. One of the more recent myths I encountered was that your client database is no longer an asset that may be sold for any reason. This would make it extremely difficult to sell a practice. Carrie Allen, a business broker from Kiernan and Associates, Inc. in Tucson, Arizona, clarified that the concern with the database and records will not affect the sale of a practice very much: "According to the American Medical Association guidelines, patients have the right to know if the doctor is leaving or the practice is moving, but do not have to be notified until it happens, after the close. At that point, the patients have to be notified that their records will be staying with the new doctor." • S Department of Health U and Human Services. www.hhs.gov/ocr/hipaa • enters for Medicare C & Medicaid Services. www.cms.hhs.gov/HIPAAGenInfo • ealth Privacy Project. H www.cdt.org/issue/health-privacy Thus, if you act in good faith to provide a qualified guardian of the records (and hopefully the care of the clients as well), then legally, the records stay with the practice. Of course, the clients could request their records after they have been notified. This standard should equate to massage practitioners. Hopefully, by now the majority of the myths have been debunked, although as witnessed by the examples above, I'm sure more will proliferate. Visit the websites listed above for more common myths, as well as the HIPAA regulation guidelines. SPH Cherie Sohnen-Moe has been an author, business coach, international workshop leader, and business owner since 1978. She is the author of Business Mastery and coauthor of The Ethics of Touch.