I thought I had missed my opportunity to comment on the HIPAA RFI, but saw a tweet about someone posting comments today, so I break from comments on other stuff to put together my thoughts in HIPAA.
0. HIPAA is seen as a barrier rather than promoting sharing of information to support care. It needs revamping and probably renaming to change the perception.
1. Most covered entities with a certified EHR can provide data immediately and certainly within 24 hours through a portal or other means of access based on my own personal experience across more than a dozen institutions. Payers also provide for online access with nearly immediate results. Paper records, or full records that are part of the entire designated record set that are needed for more detailed review (usually to address issues in adjudication or eligibility of benefits) take for **** ever. Payers are worse on requests that providers in my own experience. Plans that are causing challenges (from the patient perspective) are more difficult to get data from than those that aren't. There are variances across providers that is generally based on technical and infrastructure capacity.
2. In general, it is quite feasible to get the most important data within 24 hours. The entire designated records set is harder to acquire, because that can include diagnostic reports in paper form, xrays and other imaging requiring storage of external media instead of download.
3. Digital media and electronically available data should be available within 2 business days, paper or film original formats perhaps a bit longer but no more than a week, and any data in the Common clinical data set by a provider with a certified EHR should generally be available within 24 hours.
4. Ask instead what burdens would a shortened time frame relieve for patients, and the associated costs, and you will get a much more enlightened an appropriate answer.
5. I cannot speak to clearinghouses.
6. Yes, providers have challenges getting data for treatment, generally from other providers, often with the excuse "because HIPAA", although some also claim 42 CFR 2 preventes exchange due to over cautious risk tagging of data that MAY be covered by that regulation.
7. Yes, generally covered entities should be required to disclose PHI for verifiable treatment (without making "verifiable" hard, perhaps slightly more challenging than simple attestation, but not so challenging as to make this too difficult). Verifiable proofs might be as simple as proofs based on existing treatment relationship (e.g. claims) or attempts to establish one (e.g., via prior auth tx) or facsimile copy of patient signature authorizing treatment, or established provider relationships. I won't address P and O.
7a, this would improve care coordination and case management, it would create some burdens to implement new requirements, but not insurmountable ones. New administrative costs would eventually reduce burdens after implementation.
8. not addressed.
9. Doctors should be required to disclose information to other doctors in a treatment relationship for the purposes of treatment, regardless of electronic billing status. This would challenge some implementations in that they would have to have a process to identify providers not using electronic billing (e.g., due to lack of NPI). That could readily be addressed by requiring NPI be obtained by all providers regardless of whether or not they engage in electronic billing.
10. A verbal request would be acceptable from a known entity, but an unknown entity should be verified in some way, along with the existence of a treatment relationship. Signed patient authorization of treatment (or facsimile copy) would be sufficient evidence, but other documentation or proofs of a treatment relationship might also be accepted. Appropriate policies would be needed.
11-13. Not addressed.
14. Interaction with other laws such as 42 CFR part 2 should be addressed. It will be a problem.
15. Appropriate policies should be created, with known entities possible getting easier treatment than unknown entities. The providers should have a policy, and a means to document and enforce it.
18. Yes, this should be made more feasible and easier, and required. I've seen requests sit for 30 days for these kinds of services.
19- end: Ran out of time.
0. HIPAA is seen as a barrier rather than promoting sharing of information to support care. It needs revamping and probably renaming to change the perception.
1. Most covered entities with a certified EHR can provide data immediately and certainly within 24 hours through a portal or other means of access based on my own personal experience across more than a dozen institutions. Payers also provide for online access with nearly immediate results. Paper records, or full records that are part of the entire designated record set that are needed for more detailed review (usually to address issues in adjudication or eligibility of benefits) take for **** ever. Payers are worse on requests that providers in my own experience. Plans that are causing challenges (from the patient perspective) are more difficult to get data from than those that aren't. There are variances across providers that is generally based on technical and infrastructure capacity.
2. In general, it is quite feasible to get the most important data within 24 hours. The entire designated records set is harder to acquire, because that can include diagnostic reports in paper form, xrays and other imaging requiring storage of external media instead of download.
3. Digital media and electronically available data should be available within 2 business days, paper or film original formats perhaps a bit longer but no more than a week, and any data in the Common clinical data set by a provider with a certified EHR should generally be available within 24 hours.
4. Ask instead what burdens would a shortened time frame relieve for patients, and the associated costs, and you will get a much more enlightened an appropriate answer.
5. I cannot speak to clearinghouses.
6. Yes, providers have challenges getting data for treatment, generally from other providers, often with the excuse "because HIPAA", although some also claim 42 CFR 2 preventes exchange due to over cautious risk tagging of data that MAY be covered by that regulation.
7. Yes, generally covered entities should be required to disclose PHI for verifiable treatment (without making "verifiable" hard, perhaps slightly more challenging than simple attestation, but not so challenging as to make this too difficult). Verifiable proofs might be as simple as proofs based on existing treatment relationship (e.g. claims) or attempts to establish one (e.g., via prior auth tx) or facsimile copy of patient signature authorizing treatment, or established provider relationships. I won't address P and O.
7a, this would improve care coordination and case management, it would create some burdens to implement new requirements, but not insurmountable ones. New administrative costs would eventually reduce burdens after implementation.
8. not addressed.
9. Doctors should be required to disclose information to other doctors in a treatment relationship for the purposes of treatment, regardless of electronic billing status. This would challenge some implementations in that they would have to have a process to identify providers not using electronic billing (e.g., due to lack of NPI). That could readily be addressed by requiring NPI be obtained by all providers regardless of whether or not they engage in electronic billing.
10. A verbal request would be acceptable from a known entity, but an unknown entity should be verified in some way, along with the existence of a treatment relationship. Signed patient authorization of treatment (or facsimile copy) would be sufficient evidence, but other documentation or proofs of a treatment relationship might also be accepted. Appropriate policies would be needed.
11-13. Not addressed.
14. Interaction with other laws such as 42 CFR part 2 should be addressed. It will be a problem.
15. Appropriate policies should be created, with known entities possible getting easier treatment than unknown entities. The providers should have a policy, and a means to document and enforce it.
18. Yes, this should be made more feasible and easier, and required. I've seen requests sit for 30 days for these kinds of services.
19- end: Ran out of time.
No comments:
Post a Comment