National Committee on Vital and Health Statistics

Subcommittee On Privacy and Confidentiality

November 19, 2003

Comments provided by Donna Maassen on behalf of The American Health Care Association (AHCA) and the National Center for Assisted Living (NCAL).

Together, AHCA and NCAL represent the majority of the 16,000 nursing homes, assisted living residences and other long term care providers nationwide who care for about 1.5 million residents on a daily basis.  I want to thank you on behalf of the Associations and its members for including us in this important analysis of the HIPAA Privacy Rule.

The following comments are prepared based on the questions received from NCVHS and as succinct as possible.  Thank you for the opportunity to provide this feedback.

Best Practices for Implementation of the Regulation:

AHCA/NCAL is a proud member of the HIPAA Long Term Care Consortium (LTCC).  This Consortium is a group of long term care providers who have collaborated over the last two years to implement all components of HIPAA.  The group was formed initially to try to reduce the burden of implementation of the privacy rule but has stayed together as we implemented the transaction standards and code set regulation and is now collaborating on the security rule.

  1. Multiple subcommittees were formed within the Consortium and tools have been developed to assist the providers not involved in the Consortium.  All tools have been placed on the AHCA/NCAL Web site and are available at no cost to members of AHCA/NCAL.
    1. The Consortium has developed a privacy policy and procedure manual which includes a sample form for all areas requiring documentation.  We have also included a sample notice of privacy practices.
    2. The Consortium developed a sample business associate addendum and contract as well as a decision tree to help determine what business associate documentation if any was required.
    3. The Consortium developed sample family and business associate brochures to try to help others understand the privacy rule.
    4. The Consortium developed a training video unique to our profession which is available to purchase through AHCA/NCAL.
    5. Similar documentation will be created by the security subcommittee.
  2. The Consortium has spent many hours analyzing and debating the privacy rule to ensure that as we propose best practices and professional standards we did so with all types of long term care facilities in mind.  This group has been able to define best practices thanks to the diverse group of providers and the openness on each company’s part to share resources.

Barriers to Compliance:

One of the greatest barriers identified is the lack of guidance and direction received by our profession as it relates to implementing the privacy rule.  The following table outlines two examples of confusing information we have received from OCR and CMS:

ISSUE

OCR Response

CMS Response

Are disclosures to surveyors trackable for purposes of accounting of disclosures?

State surveys are considered to be health oversight.  Therefore disclosures are trackable.

(CMS Roundtable March 26 and April 30, 2003 – Answer provided by OCR)

Memorandum directed to state survey agencies indicates state surveys are health oversight.

(June 12, 2003)

FAQ ID #2448 states that state surveys are health care operation – therefore disclosures are not trackable.

(November 4, 2003)

How do you address the concern of disclosure of PHI when CMS takes the position that survey results must be posted in nursing facilities?

Not addressed

CMS interprets requirement that survey agencies make results available to public as requiring nursing facilities to post survey results.  CMS states this disclosure is required by law.

CMS considers these disclosures rare and inadvertent however, under HIPAA there is no distinction based on a “rare” disclosure.

(June 12, 2003 Memorandum)

Experience shows that survey results are replete with health information much of which is individually identifiable.

The foregoing examples illustrate the need for collaborative approach between OCR and CMS regarding the interpretation of the privacy rule as it relates to issues that are significant to long term care providers.

AHCA/NCAL feel strongly that it is imperative that OCR and CMS work together with our experts to help resolve some of the ongoing confusion with the privacy rule.  We offer any of our experts within the Consortium to partner with OCR and CMS to find solutions to the implementation barriers.

Thank you for the opportunity to bring these issues to the attention of the Subcommittee.