As the QA Director, Therap Administrator, and one of the few that can spell HIPAA (no it isn’t spelled HIPPA), I was assigned the additional duties of HIPAA Privacy Officer, HIPAA Security Officer, HIPAA Compliance Officer, and HIPAA Training Officer. So I went to HIPAA School and got educated. With my suitable for framing HIPAA certificate in hand, I started building procedures for various HIPAA issues. One of the first I tackled was release of information (ROI).
This blog isn’t going to be about HIPAA, but rather some thoughts on how to release Protected Health Information stored in Therap. In my agency we serve primarily minor children so most of the discussion is going to be based on the parent requesting information or filling out an ROI. Whether it is a parent, guardian, or individual served (client) submitting the ROI the idea is the same. So here goes:
In my mind I separate the information we store on the individuals we serve into two categories. The first category is what I think of as relatively static, it doesn’t get updated frequently, and doesn’t change day to day. In Alaska we have a Plan of Care as the primary document determining the kind and amount of services an individual will receive at our agency. And there are other documents containing diagnosis, family contact information, application for Medicaid waiver, Care Coordination/Case Management assignment, and acknowledgement statements for HIPAA, agency policies, and a host of other paperwork required to get services at our agency. Despite my continuing efforts most of this information continues to be stored on paper files vice in Therap. However, whether it is stored in Therap or on paper it is a finite amount of data, usually not requiring too space. Since it is information parents usually provide us or sign for us, rarely is it the object for a ROI. If it is requested this information is easily copied, printed and provided.
However, once an individual has been receiving services with us for six months or so, the amount of information stored in Therap is HUGE! For example, we have individuals who get four detailed ISP Data inputs daily, including weekends. To provide all of this information for an ROI can be a major undertaking. That is going to be my focus.
My first step is try to figure out the who, what, and why of the ROI. In my short term as the agency HIPAA guru these are the broad categories of ROIs I’ve addressed:
- Involved Parent. The involved parent is just trying to keep abreast of the services their child or dependent is receiving. At my agency we are very much in favor of enabling the parent to have access to daily records to read the daily events. Pre-Therap our agency had the parents sign the individual paper note prior to turning them in. During the transition from paper notes to Therap one of the key points raised by the parents was visibility to the daily notes. To give the same visibility to the daily notes the parents had with paper notes, we gave Therap access to each parent/guardian. There was some significant work giving every parent/guardian (mother, father, step parent and guardian in some cases) access as we transitioned to Therap but it was what the parents asked for. Each involved parent was given a Therap User account, read only, to view their child’s Therap entries. In practice, most parents (97%) lost interest after a brief period and quit checking notes. Now we only give that level of access to parents/guardians if they requested it. Giving a parent a Therap account, Therap training, and access to their child’s information is our preferred solution to answer a ROI by a parent/guardian. There is no cost to the agency or parent/guardian for this ROI.
- Parent Requesting Bulk Data. For a variety of reasons occasionally we have parents submitting a ROI for data covering a long period. This is where a little detective work is needed to figure out what the parent/guardian is really looking for. Sometimes the parent/guardian just want to know that the agency is responsive to their needs. With a little hand holding and training, giving the parent Therap access will work. Sometimes it isn’t the daily notes that are the concern but rather a trend of improvement is more what the parent is looking for. In that case the answer is an easy report to generate from Therap and it usually will meet their needs. In addition we are happy to teach parents how to print individual notes from Therap or export bulk data to Excel. We are also happy to export the data at the office and burn it to a CD/DVD or copy it to a thumb drive they provide. However, the real challenge is the parent with little or no computer skills. For parents without confident computer skills giving them Therap access (or reports) is not going to work. They want paper! Now what format should we provide the data? The parent’s typical expectation is something that looks like the paper notes they received prior to our move to Therap and electronic notes. Therap will let you print out individual notes that the parent is looking for. But when the parent wants all the notes from the start of the fiscal year, printing out individual notes is going to be very time consuming. Again I ask what is the information going to be used for, the answer helps me better provide what they want. If all they want is the basics of what type service and when, we provide them ISP data exported to Excel. But if they want the information to justify additional or different services they will need detailed data exported to Excel. A typical example is a family wanting to justify broadening their home and community based services to include nursing. In this case the family asked for paper copies of all the Therap notes for the current fiscal year, about 5 months worth of data. Their child receives a variety of services with us and usually has three to four Therap notes per day. We determined the most efficient means of providing the information they wanted was ISP Data with a detailed export to Excel, then that spreadsheet was organized, sized, and printed for the parent. A five minute discussion with the parent of how the data was displayed usually ensured they were happy with what they received. HIPAA regulations state that parents have an absolute right to the information, and that we cannot charge for the man-hours required gather or print the information, but we can charge for the cost of the copies. So, while the agency could bill the parent for the cost of copies, we don’t. Our copier/printer company charges us 1.4¢ a page for black and white copies and we buy many cases of paper reams. So, in this case, a 300 page report would cost us approximately $6 and is not worth the time and effort to try to collect. And for our computer challenged parents, who have been with us for a long time and remembered paper notes, billing them any amount for computer generated information would be an insult and a potential reason to move to another agency.
- Parent Requesting Release to Third Party. Again for a variety of reasons we have parents who want their child’s information to be released to a third party. If a parent wants to provide information to another agency, or their physician, or another type of medical agency, they rarely really want each and every day habilitation note for the last three years, for example. I usually start with a phone call to the third party to try and find out what type of information they want and in what format. Most other agencies and physicians are happy with basic data or a report that shows a trend of data, rather than each and every note. And, thankfully, they usually want it in some type of electronic format. After the phone call it is a no brainer to provide the data. However, since we provide services to children, occasionally we get a ROI during a custody battle. Again, I call the third party to try to figure out what type information they are looking for and in what format. But some of those phone calls have taken an ugly turn. One particular law office seemed to think I was trying to hide something and forcibly insisted they had a right to have a copy of “each and every sheet of paper.” …So I oblige them… You want all the ISP data for the last two and half years, with a detail export to Excel? You got it. For the parents in the above paragraph I spend time working on making sure it is readable, the unused columns are deleted, and I show them how to read it. For the law office I just put all the columns on one page and hit print. As for billing, for other agencies and physicians we provide it for free as a professional courtesy. For that difficult law office… HIPAA allows me to charge them for our actual cost. Now how much is my time and effort worth? Not only cost of each piece of paper, but wear and tear on the printer, cost of electricity for the machine and the lights, heat in the building, part of our rent, small piece of our annual Therap bill… Oh my, I had an enormous bill for them… But cooler heads prevailed, and pointed out that the law office would just pass the cost off to the parent, with a hefty percentage added. We charged them for our employee’s wages and the cost of paper and printing.
My bottom line is that with a phone call ahead of time, most ROIs are more accurately and easily handled.