The Compliance Divas Podcast
Our podcast covers current topics such as infection prevention and control, OSHA and HIPAA compliance for dentistry. We discuss the latest regulatory information, answer frequently asked questions and give suggestions for dental practices to make compliance easy and sustainable. The Compliance Divas are a trusted source for consistent, accurate information based upon current guidelines, standards, science, and recommendations.
The Compliance Divas Podcast
#79 HIPAA have you stumped? Common support questions addressed by the Compliance Divas
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Protecting your patients' privacy may sound straightforward, yet many times confusing circumstances arise and you are not sure of the best course of action. In this episode, the Divas answer some of the common HIPAA compliance questions that arise.
Resources:
Welcome. I'm Leslie Cannon. I'm Mary Gavoni.
SPEAKER_01I'm Linda Harvey. I'm Olivia Juan, and together we are the Compliance Divas.
SPEAKER_02Welcome to the Compliance Divas Podcast. My name is Olivia Juan, and I'll be your moderator today. Day to day, week to week, we get questions about HIPAA. It may be relevant to the security rule, it may be relevant to the privacy rule. But today, during this podcast, we wanted to discuss a few common support calls that we receive. As the compliance divas, we bring clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. Please subscribe to the compliance divas podcast through your favorite podcast channel or on our website, thecompliancedevas.com. Resources we mentioned during the podcast can be found on the Compliance Divas website. Please submit your questions to support at the compliance divas.com. Today it would just be myself and Leslie Cannum. We appreciate that Mary Gavoni and Linda Harvey are on assignments. So Leslie, I'm so anxious to talk to you about some support questions that you get at your office as you're working with clients. And I know one of them has to do with pediatric patients when they turn 18 and they achieve adulthood. So Leslie, can you speak to us about any special paperwork or concerns?
SPEAKER_00Well, you know, Olivia, it's oftentimes surprising to dental office teams that they need to have a new HIPAA form signed by a patient who reaches the age of majority, a new health history form, and a new registration form that is filled out by the 18-year-old. So in addition to wishing them a happy birthday, they've got some paperwork to take care of. Because once they reach 18 years old, their privacy of their personal health information is protected under HIPAA. So dental health care providers are not actually legally permitted to disclose a patient's medical history or even discuss their health status or treatment recommendations with anyone, including the parent of a young adult who is still even on their health insurance plan. And that oftentimes astounds people that I talk to that they would not be able to talk to the parent after all the parents paying for the visit, the parent uh feels like they should be in charge and the child is still on the health insurance. So what I tell people is that parents can make a general request and receive limited information about their child's treatment and tests through their health insurance company if their child is still on their health insurance plan. However, that information would only be available after the child received treatment or tests, not before, when a discussion of options might be most appropriate. So to grant their parents or another trusted adult access to their records and permission to speak with a healthcare provider, an adult child must sign a HIPAA medical release form and name the individuals to whom they have uh want to grant access. So this could be especially important if a child is uh going to college out of state or moving away. Uh it's important that the parent uh, if the child chooses the parent uh to be have information released too, that the parent has that access to that information. So there's also something else that is called uh a power of attorney. But Olivia, I'd like you to share with our listeners a little bit more about that. And I just want to recap the three things that need to take place when a child becomes 18 years old, the age of majority, according to HIPAA. One, they need their own HIPAA notice of privacy practices. Number two, a new medical history, and number three, a new patient registration form with a dental practice. So, Olivia, tell us more about power of attorney.
SPEAKER_02Sure, Leslie. So, from a legal perspective, I think you explained it very well, Leslie, that the HIPAA release form needs to be entered into when the child turns 18, because now they're recognized as a legal adult. But I also would like our listeners to keep in mind that there are two other documents that are recommended when a child turns 18. Keep this in mind if you're a parent. And that is a healthcare power of attorney and a general durable power of attorney. So if you have a child going off to college, these are important decisions so that the parent can continue making decisions for a child's health care, providing that I shouldn't say they're a child, but 18 to me still still seems like a child, especially Leslie, if they can be on their parents' insurance till they're 26 years old. But also the general durable power of attorney to make financial decisions. So those are some good things to keep in mind. Also, Leslie, I think our listeners need to keep in mind about special needs adults. Usually there is legal paperwork, such as a conservatorship or guardianship paperwork to show that the adult tending to the special needs person has the legal authority to make their decisions. So I would say this is something really important to ask for, if it, especially if the caregiver is not the parent, which even the parent in our state would have to have this paperwork in order. So these are some good things to keep in mind. And Leslie, I want to point out to our listeners that, you know, as an attorney, I run into these situations where, you know, the 18-year-old could now restrict or be more honest. Uh, have you ever thought, Leslie, that maybe when the parent filled out the medical history, they indicated that their child did not use tobacco, their child did not use drugs or alcohol or certain medications. And now that we're dealing with an adult and we have the medical history that's being completed confidentially, they might disclose important medical information, such as have they used cocaine? We need to know that if we're using anesthetics or you know other drugs that could put the person at risk in different scenarios in a dental office. Also, uh, for uh a female patient, are they using oral contraceptives so that the person could be educated uh on any risk there? So I think these are important things for us to think about. But you know what, Leslie, I was thinking of another question that I thought you could help us with, and that is on chargebacks. And have you ever run into that situation where, you know, maybe the dental office or medical office for that matter, they go under one practice name, and then the patient gets this credit card charge on their statement, and then they refute the charges. What happens there, Leslie? I mean, how do you avoid HIPAA violation in this type of situation? Can you talk to us about that?
SPEAKER_00You know, something that occurs in all for all businesses, if you accept credit cards, there's the word chargeback, and you hope that never happens. But uh customers and patients of dental and medical practices can dispute a charge. Now, again, one way they might dispute it is just erroneously by thinking that the company that charged them is not the provider that they went to. And I think for most dental practices, uh their practice name will uh be indicated on a bill that's received for a billing statement. But sometimes patients uh have the dispute. Maybe they uh question the care or the outcome of care, or they're dissatisfied with the outcome, and they might uh do what's called a chargeback, where they ask their credit card company to refund the charges because they're disputing the legitimacy of the charge. It's a major challenge in healthcare because healthcare providers like hospitals and uh clinics and of course dental offices will usually do one of two things when dealing with a chargeback. They'll usually write off the amount because it's difficult, they think, in their mind to uh dispute it, or they'll uh they'll send that uh patient to collections. And uh, you know, neither one is really a good option, but there's a third option where they can dispute the chargeback. And it's recommended to do that just as soon as possible if the charge was legitimate. Uh according to a company called Chargeback Gurus, they found that many healthcare providers are either unaware of their rights or they don't have an experienced team with the right tools to dispute chargebacks. So clinics and small institutions like dental practices write off anywhere from $20,000 to $250,000 per year as bad debt. And for many healthcare providers, it's a significant percentage of uh lost revenue from chargebacks. The credit card networks do allow healthcare providers to dispute chargebacks without violating HIPAA compliance. And uh much of that information that would be revealed to a collection agency is also what could be used for chargebacks. The uh exception would be that the dental office has to be very careful to redact certain information so they don't violate uh HIPAA privacy rules. And they should redact or not submit information about the date of birth of the patient, the social security number of the patient, or certain types of tests that might have been administered that the charge would be for. So uh, you know, something like a pathology test might be something that is uh the protected information. So bottom line, uh chargebacks can be disputed by the healthcare provider, but they have to take action on it. And we are going to put the uh in our resources the website of the chargeback gurus that gives a very uh simple explanation, step-by-step explanation on how to fight these chargebacks.
SPEAKER_02Olivia? Leslie, I'd love for you to elaborate on again about what kind of information should we redact? So if we're sending a copy of the transactions that the dentist performed, is there anything that we should redact if it appears on that form, Leslie?
SPEAKER_00Well, again, what the service was, of course, we don't want to reveal health information. The charge was for this amount for a service that was provided, the date of birth, social security number, and then certain types of tests that might have been uh administered to the patient. For example, a pathology test. And in a medical world, it might be uh an HIV test.
SPEAKER_02Right, great. So I appreciate you reiterating that. So in in fighting these chargebacks, it's important to provide evidence that the transaction was authorized by the patient. So it might even be helpful to have a copy submitted of the patient's signature authorizing treatment. But another question we get, Leslie, is you know, do you need an authorization if you're sending your patient from a general dental practice to a specialty practice? And the answer to that question is no, because HIPAA allows healthcare providers to share information with other treating providers. And that's the basic premise of HIPAA is that protected health information can be disclosed for three things, and that is treatment, payment, which I think you summarize beautifully, Leslie, and also health care operations. And then the question comes up well, what does health care operations mean? And it actually has to do with basically certain administrative and financial and even the uh quality improvement activities associated with running a dental practice or conducting quality assessments. Um, for example, let's say that a dental practice is having a staff meeting and they are discussing a particular patient on how they can handle that type of patient or service better. You know, that's just basic healthcare operations. So when you are referring to another practice, whether it's an orthodontist or prosodontist or periodonist or whatever that case may be, there's no need to get extra paperwork from the patient. And you want to think about it, Leslie, in terms of the continuity of care. So in the medical world, it may be the primary care practice referring to a cardiologist. It's the same type of scenario. So the HIPAA privacy rule permits a healthcare provider to disclose the protected health information about the individual without the individual's authorization to another healthcare provider for the provider's treatment of that person. And so uh that's that's good information for us to keep in mind. And Leslie, I know you had asked me a question earlier about we were talking about what kind of documentation is required when a dental practice is referred or rather being sold. And so uh in my mind, I was trying to revisit what we do when we have worked with transitions, and one is entering into a business associate agreement so that that individual has access to the records because they may be looking at valuation information. Um, but also I think that our listeners need to realize that when a dentist buys a dental office, they buy the records. Uh, it's part of the goodwill that is listed on an asset purchase agreement. But in reality, the the dentist, the new owner dentist is becoming the custodian of the dental records. So when the patient comes in to the dental practice, whether that's the six-month appointment or whatever the case may be, when they revisit that dental practice, they have to fill out new paperwork. So it's just like what you had referred to, Leslie, when the child turns 18, they have to fill out a new consent form, new medical history, new patient registration information. So the same thing happens when a dental practice is sold, because the new dentist is really just the custodian until the patient has selected them to be their dentist. Now, the states have different rules. I know in the state of Tennessee, when a dental practice is sold, the dentist, the seller dentist, um, must notify patients that date back 36 months. And in that patient notification, they have to let the patients know who the new owner is and also offer if they want their records transferred to another practice, they can fill out an authorization and the records are sent to someone else. So there's multiple moving parts, Leslie, when we're working with a transition, and we want to make sure that we're not violating any of the provisions of HIPAA. I think there's probably many other support situations that arise from time to time that is important for office managers and privacy officers not to just respond to your team members off the cuff, but to take some time to research it and make sure that we're providing a response for our dental practice with knowledge with reference to uh HIPAA rule or some added guidance that we find from reputable sources. So this will bring our podcast to a close. I really appreciate that Leslie was willing to share her knowledge in working with dental clients, as well as we want to make sure we mention that Mary Gavoni and Linda Harvey are out on assignments. But as the Compliance Divas, we bring clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. Please submit your questions to support at thecompliancedivas.com. Resources that we mentioned during this podcast will be available on the website. So thanks again, Leslie. It's been so much fun talking with you about common HIPAA support questions.