3 ms·
IANAL but I'm responsible for HIPAA compliance in my startup: Assuming this is a standard private practice, this office has several violations of 45 CFR §164.5
by haldujai 13y ago
IANAL but I'm responsible for HIPAA compliance in my startup:
Assuming this is a standard private practice, this office has several violations of 45 CFR §164.520(a)(b)(c), assuming that he was also not provided this privacy statement within 30 days with a reason for why it was not provided on the first visit.
This makes them liable for $50,000 in fines per failure to a max of $1.5 mm (this would be a clear cut case of reckless indifference.) The DHHS OCR is always looking for some head to serve on a platter to justify themselves as well.
His amendment to the form is damning evidence and that receptionist should be fired, there is no excuse for basic HIPAA noncompliance in 2011 (8 years after the fact).
Edit: What some people don't seem to understand is that signing the privacy practices notice (the form in question here) does not mean you agree to the terms and conditions outlined. You only sign that you have received them. Additionally, whether you sign the form or not it applies to you, and whatever that form states HIPAA clearly outlines what powers the covered entity (the doctor in this case) has over your information.
- shmageggy 13y agoSo are you saying that in order to comply, the office needs to furnish every patient with a 3000 page binder of privacy practices and that systematic failure to do so should mean over a million dollars in fines? I really hope I'm misunderstanding something because this seems insane.
- smacktoward 13y agoThe only reason to believe the privacy statement is 3,000 pages long is because the receptionist said it was, and given the rest of her statements there's little reason to believe she knew what she was talking about. She may have just made up a large number to try and scare him off from inquiring further. I've been given privacy statements from my doctors' offices in the past, and they've never been more than a couple of pages.
- haldujai 13y agoNotices of privacy practices for practices are a boilerplate form that shouldn't be more than 10 pages long. Whatever they write is meaningless if it gives them more power than the law does, most places just use the AMA or state agency recommended forms. The law actually states what needs/should be written. Here is an example [doc file]: www.ama-assn.org/resources/doc/hipaa/privacy-practices.doc That said, places with their own websites need only upload the form and tell patients it is able to be viewed at at whatever link and have the binder accessible in the office for viewing. Uploading to dropbox/filesharing without a website is not a valid option.
- ohazi 13y agoa) there's absolutely no reasonable reason for that binder to be 3000 pages. b) pdf
- polemic 13y agoIt's insane that a privacy policy is 3000 pages, yes. It's not insane that they should comply.
- kbar13 13y ago> says the receptionist
- cmiles74 13y agoI've worked in healthcare for many years and I am extremely confident that this is not true, that the document is likely a more manageable three-to-five pages and at worst ten-or-so. I'm sure the receptionist said this in order to deter him from wanting to see the actual document that she clearly didn't have.
- TruthElixirX 13y agoYou aren't misunderstanding anything. Hospital care in the U.S. is fucking ridiculous for several reasons on a multitude of fronts, this is just one of them. And the parent comment thinks its reasonable because their livelihood depends on this insane bureaucracy. LETS TAKE ALL THE WORST PARTS OF FREE MARKET MEDICINE AND THE WORST PARTS OF SOCIALIZED MEDICINE AND PUT IT TOGETHER AND CALL IT THE U.S. HEALTHCARE SYSTEM.
- deleted 13y ago[deleted]
- ceejayoz 13y agoI doubt it's actually 3,000 pages, but even if it were, it should at least be available in the office if someone wants to review it.
- sixothree 13y agoI'm guessing the binder she is speaking of is the HIPAA policy itself, not what they are responsible for giving to the patient.
- hayksaakian 13y agoif it was a PDF, she would have no problem sending it to him in an email.
- jessaustin 13y agoHas anyone ever seen a binder that could encompass 3,000 pages? The Staples website seems to imply that 1,300 is the max for binders they carry: do physicians have to buy office products from specialty vendors? (I guess if sheets were printed on both sides Staples could get to 2,600 but have you ever seen double-sided materials at a physician's office?) I do hope that secretaries are donning the appropriate back support garments before attempting to bring this binder out to an interested patient.
- Spooky23 13y agoNo. They need to hire professional staff who can handle a routine customer request. A HIPPA privacy practices document is 4-5 pages at maximum. Perhaps all of the compliance materials for the practice would fill a binder, but not this particular document. See the AMA's sample form here: http://www.ama-assn.org//ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-compliance-resources.page http://www.ama-assn.org//ama/pub/physician-resources/solutio...