Comments provided by Donna Maassen on behalf of The American Health Care Association (AHCA) and the National Center for Assisted Living (NCAL).
Together, AHCA and NCAL represent the majority of the 16,000 nursing homes, assisted living residences and other long term care providers nationwide who care for about 1.5 million residents on a daily basis. I want to thank you on behalf of the Associations and its members for including us in this important analysis of the HIPAA Privacy Rule.
The following comments are prepared based on the questions received from NCVHS and as succinct as possible. Thank you for the opportunity to provide this feedback.
Best Practices for Implementation of the Regulation:
AHCA/NCAL is a proud member of the HIPAA Long Term Care Consortium (LTCC). This Consortium is a group of long term care providers who have collaborated over the last two years to implement all components of HIPAA. The group was formed initially to try to reduce the burden of implementation of the privacy rule but has stayed together as we implemented the transaction standards and code set regulation and is now collaborating on the security rule.
Barriers to Compliance:
One of the greatest barriers identified is the lack of guidance and direction received by our profession as it relates to implementing the privacy rule. The following table outlines two examples of confusing information we have received from OCR and CMS:
ISSUE |
OCR Response |
CMS Response |
Are disclosures to surveyors trackable for purposes of accounting of disclosures? |
State surveys are considered to be health oversight. Therefore disclosures are trackable. (CMS Roundtable March 26 and April 30, 2003 Answer provided by OCR) |
Memorandum directed to state survey agencies indicates state surveys are health oversight. (June 12, 2003) FAQ ID #2448 states that state surveys are health care operation therefore disclosures are not trackable. (November 4, 2003) |
How do you address the concern of disclosure of PHI when CMS takes the position that survey results must be posted in nursing facilities? |
Not addressed |
CMS interprets requirement that survey agencies make results available to public as requiring nursing facilities to post survey results. CMS states this disclosure is required by law. CMS considers these disclosures rare and inadvertent however, under HIPAA there is no distinction based on a rare disclosure. (June 12, 2003 Memorandum) Experience shows that survey results are replete with health information much of which is individually identifiable. |
The foregoing examples illustrate the need for collaborative approach between OCR and CMS regarding the interpretation of the privacy rule as it relates to issues that are significant to long term care providers.
AHCA/NCAL feel strongly that it is imperative that OCR and CMS work together with our experts to help resolve some of the ongoing confusion with the privacy rule. We offer any of our experts within the Consortium to partner with OCR and CMS to find solutions to the implementation barriers.
Thank you for the opportunity to bring these issues to the attention of the Subcommittee.