Health Insurance Portability and Accountability Act Final Rule Compliance 6 Months Later
It has been more than a year now, since the Department of Health and Human Services released the Health Insurance Portability and Accountability Act (HIPAA) Final Rule on January 25, 2013. The Final Rule went into effect on March 26, 2013, requiring covered entities (CEs) and business associates (BAs) to comply with the requirements, essentially in the same manner as their CE "big brothers." Compliance with all of the elements of the HIPAA Final Rule was required by September 23, 2013. So the question remains; Are we there yet?
The reality is that compliance is a work in progress and should remain just that. Anyone who still believes that HIPAA compliance is a finite, stagnant, "fill in the blanks" annoyance is living in fantasy land or at least 1998. Today's HIPAA compliance is all about ongoing risk assessment, reassessment, education and continued education, and making the regulations fit the individual practice size and setting. There are no exceptions contained in the Final Rule. It is no excuse to say, "I'm a solo practitioner" or "We are too small for that." It is true, however, as it has been since 1996, that one size does not fit all. It is the obligation of the HIPAA compliance officer or his or her designee to comb through old policies, draft new ones, and have meaningful and compliant procedures to bring the CE and BA up to date. As soon as you think you are done, it is time to start all over again. That is not to say that you start from scratch, but risk assessment, trainings and documentation must occur, at a minimum, once each year.
It is unfortunate, but so many practitioners still don not get it. I actually came upon a CE that was making all its regular salaried employees sign Business Associate Agreements (BAAs). One only need look at the statutory definition of a BA to know that employees of a CE should not be asked to and should not sign BAAs. So once more, for those who don not know or thought they knew, here is the definition of a BA right from the official source:
"What Is a "Business Associate?" A "business associate" is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a CE. A member of the CE's workforce is not a BA. A covered health care provider, health plan, or health care clearinghouse can be a BA of another CE. The privacy rule lists some of the functions or activities, as well as the particular services that make a person or entity a BA, if the activity or service involves the use or disclosure of protected health information. The types of functions or activities that may make a person or entity a BA include payment or health care operations activities, as well as other functions or activities regulated by the Administrative Simplification Rules.
Business associate functions and activities include claims processing or administration; data analysis, processing, or administration; utilization review; quality assurance; billing; benefit management; practice management; and repricing. Business associate services are legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, and financial. See the definition of "business associate" at 45 CFR 160.103" (Department of Health and Human Services HHS, 2003, p. 1). So if your organization has not started, start now. If your organization conducted a foundational risk assessment last year or with the advent of the Health Information Technology for Economic and Clinical Health Act, I regret to inform you, that was 4 years ago. If you are a small business owner, who is a BA, be sure that the BAA that you are using or one that has been presented to you for signature meets the September 23, 2013, requirements. If you already had a BAA with a particular CE, the deadline for updated compliance was extended to September 23, 2014, but as with all things HIPAA compliance, do not wait. The responsibility for compliance is shared equally between the CE and BA, which translates into equally shared liability.
Questions regarding HIPAA compliance for case managers are welcome.
Case Managers in the Midst of Change
In these times of change and some days overwhelming chaos and confusion, the case manager is best served by confident knowledge that the times may change but the essence and standards of case management are constant. It is also important to step back from the pandemonium and continue to self-assess, asking: Does this news sound bite change anything? What does my state(s) say about this? And how do I find a reliable source of information?
Whenever there is change, there is good, bad, and something useful in the middle. The federal government's central information website, https://www.healthcare.gov, has been wrought with functionality problems, much of which were resolved, but the more important problem is the variations between state-managed insurance exchanges. Like many case managers, I am a small business owner. Although new laws do not require me to provide health insurance for the low number of employees that I have, my moral compass dictates differently.
Although the homepage for individuals and small businesses appears welcoming, when you "click" on an individual state, the stories become very different. New York State, as an example, has had a fully functional and useful site since October 2013. In addition, television public service announcements began running on local free-access television around the same time, rationally explaining choices and options.
Just across the river in New Jersey, one is forced to deal directly with the federal government, without the aid of the state. For Florida residents, one is directed to the county of residence, asked for additional information (without having to disclose any personal information), including age and family status, and with just one more click are shown dozens of plan options, with varying types of coverage, copays, benefits, and perks (Health Plans, 2013). One of the higher end options is the Platinum Point of Service Plan, which costs approximately $405.00 per month for an employee younger than 50 years (Health Plans, 2013, p. 4). The question remains, will employers opt for a quality choice or minimal coverage just to satisfy legal obligations. The final chapter is yet to be written on making health care affordable for all (or at least) most Americans.
The demand for workers in health care is one of the fastest growing industries in America today. In 2008, health care was the "fastest growing sector and provided 14.3 million jobs for wage and salary workers" (Nickitas, 2011, p. 104). From coast to coast, the demand for case managers seems to be on the rise, but that necessity varies greatly from state to state. New opportunities in areas such as independent and assisted living seek to provide seniors with seamless living and access to health care. Case managers are only limited by their own initiative and creativity.
In case management, thinking outside the box is encouraged and makes for effective, streamlined, and often cost-effective treatment. Changes in health care coverage makes it more difficult than ever before to have an arsenal of effective options for clients. Nearly gone are the days of total case management independence and grateful carriers who praised case managers for cost-savings based on creative case plans grounded in cost-benefit analysis. Using this method still has value, but the parameters and options available have and continue to change.
There is, however, a difference between thinking outside the box and practicing outside the box. The Standards of Practice for Case Management state that within the roles and functions of the case manager is the function of "educating the client, the family or caregiver, and members of the health care delivery team about treatment options, community resources, insurance benefits, psychosocial concerns, case management, etc., so that timely and informed decisions can be made" (Case Management Society of America [CMSA], 2010, p. 12). It is that purpose of facilitating the client's informed decision making that is the essential function. When concerned about liability exposure, this is an area where less is more. Perhaps it would be wiser, in some cases, to direct the client to the source of the information rather than risking accuracy being lost in interpretation.
Interpreting laws, regulations, and contracts are what lawyers do. Providing factual information to aid a client in decision making is what case managers do. Within the ethics standard, there is an acknowledgement of the innate conflict. "Recognition that laws, rules, policies, insurance benefits, and regulations are sometimes in conflict with ethical principles. In such situations, case managers are bound to address such conflicts to the best of their abilities and/or seek appropriate consultation" (CMSA, 2010, p. 20). The solution is part of the stated problem; consultation is the answer. Case managers are viewed as knowledgeable professionals, which is an accurate testimonial to the hard work and extensive education and training that goes into not only becoming a case manager but also maintaining one's expertise. At the same time, case managers, like many others, are struggling to understand and navigate all the changes in today's health care. Frustration is great, because there is no singular right answer.
What you are seeking to avoid is a client proclaiming, "My case manager told me ...," a situation where you find yourself across a table from an attorney (at deposition in advance of trial) or your licensing board, having to defend why your client relied on specific contract or legal interpretation that you provided and is now suing you.
The legal standard of the Standards of Practice require that "the case manager should adhere to applicable local, state, and federal laws" (CMSA, 2010, p. 19). Such adherence includes staying within the confines of scope of practice, which is defined by the State Practice Act of your particular underlying profession, the professional tract that enables you to work as a case manager. One can go back to the antiquities to be reminded that it is the wise man who knows he does not know (Socrates, circa 354 BC). There is no shame is not being able to answer a question immediately or completely. Perhaps a better answer in some cases is, "I don't know; let's find out together." Working with your client and making them part of the investigation and selection process to a necessary choice faced with a difficult question not only satisfies your advocacy duty, "The case manager should advocate for the client at the service-delivery, benefits-administration, and policy-making levels," (CMSA, 2010, p. 20) but also empowers and encourages that client's autonomy for future decision making.
Assisting a client to find his or her own answers helps you meet your obligations to adhere to both the laws affecting your professional practice and the standards and scope of practice under which you are bound as a case manager. More importantly, you are advocating for your client together with your client and at the same time teaching that client how to better circumnavigate the complexities of a very confusing scheme of laws, rules, and regulations, along with contract intricacies that make health care decisions more difficult than they should be. As case managers, we cannot always fix our client's problems, but we can give them tools and confidence along the way, empowering them to recover, return to work, and improve their quality of life to the best it can be under all the circumstances with which they are confronted. What makes case management unique and so critically important, now more than ever, is that "big picture view" that fuels our ability to advance the client through transitions of care and ultimately to independence and health.
References