Thank you for the opportunity to testify before the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics. The National Association for Home Care & Hospice, Inc. (NAHC) is a trade association representing the interests of home care and hospice providers nationwide. NAHC is the largest trade association representing these interests with our membership comprised of all types and sizes of home care and hospice providers from throughout the United States.
Compliance with the “Standards for Privacy of Individually Identifiable Health Information” as promulgated under the Health Insurance Portability and Privacy and Accountability Act of 1996 (“Privacy Rule”) has been a difficult, time consuming, expensive, but ultimately manageable task for home care and hospice providers. Across the board, our constituents recognize the crucial importance of privacy and confidentiality in the delivery of health care services. Likewise, they value the development of a national, uniform standard on privacy. Finally, they have embraced the efforts of the Office of Civil Rights of the U.S. Department of Health & Human Services to make the privacy rule work reasonably well by striving to eliminate any needless barriers to effective communications between and among health care providers and their patients.
Overall, the home care and hospice community reports a high degree of compliance with the Privacy Rule, including the use of internal processes to quickly institute corrective action when deficiencies are found. Noncompliance has occurred to the degree that the homecare and hospice providers have misunderstood an aspect of the rule or implemented an interpretation that is inconsistent with the intent of the rule.
Operational Benefits of the HIPAA Privacy Rule
Home care and hospice providers report that the most valuable benefit gained through the HIPAA Privacy Rule is a more finely tuned awareness of patient privacy rights. While they note that federal Medicare rules and many state medical records laws establish standards for privacy and confidentiality, the HIPAA Privacy Rule gave them the opportunity to reinforce an operational culture that protects patients’ privacy rights. This is particularly evident in rural locations where many providers reported that prior to the Privacy Rule, “everybody knew everything about everyone.”
As a result of the improved privacy culture, home care and hospice providers indicate that the level of privacy and confidentiality of protected health information has increased, particularly by reducing those casual conversations that had the potential for revealing protected health information inadvertently.
Areas of Concern with the HIPAA Privacy Rule
The Subcommittee has requested information that might help to identify and resolve barriers to compliance. NAHC appreciates this opportunity to provide suggestions, based upon the experiences of its membership since the implementation and compliance deadlines of the HIPAA Privacy Rule. In particular, NAHC greatly appreciates the willingness of the U.S. Department of Health & Human Services to address concerns, issue clarifying information, and seriously consider appropriate modifications to the rule.
Our concerns and recommendations fall into the following categories:
A. Business Associate Agreement
With near anonymity, the home care and hospice community states that there is a serious need to address standards relating to the Business Associate Agreements. The greatest confusion lies in identifying entities with which the provider must have a business associate agreement. Despite the flexibility in the Privacy Rule, home care and hospice providers have been deluged with demands to sign business associate agreements by other health care providers where the sole information disclosure relates to treatment of a mutual patient.
In addition, while HHS developed a model business associate agreement, entities often insist on using their uniquely tailored agreement thereby placing the home care and hospice provider in the difficult role of having to evaluate and negotiate an endless number of business associate agreements. They report a sincere belief that this approach was taken solely to create a lucrative business for HIPAA consultants and attorneys.
Recommendation:
HHS needs to further clarify the standards under which an entity can be evaluated as to whether it is a business associate. In the event that confusion still exists, HHS should establish an expedited advisory opinion process. HHS should also establish a single, uniform business associate agreement that can be modified only with respect to fact specific issues related to protected health information.
B. Communications Between Health Care Providers
In the early stages of implementation of the Privacy Rule, home care and hospice providers reported significant occurrences of barriers to patient care communication between health care providers. While those communication difficulties have been reduced, they still remain. For example, hospitals will often refuse to disclose information to the post-hospital home health agency. This poses great difficulty with respect to the delivery of the post-hospital home health services.
Providers of services also report similar communication barriers between their offices and physicians attending to the patient. Overall, home care and hospice providers indicate that communications between themselves and other health care providers have weakened concurrent with the implementation of the HIPAA Privacy Rule.
Recommendation:
In recognition that the communication barriers are primarily related to misunderstandings of Privacy Rule requirements, it is recommended that HHS issue a bulletin, both electronically and in writing, setting out the rights and responsibilities of health care providers regarding inter-entity communications relative to the treatment of a mutual patient. That bulletin should be issued on paper, as well as in electronic form, since many of the small health care providers, particularly physicians’ offices, do not have access to the excellent OCR web site on HIPAA.
C. Patient Confusion and Apathy
The admission of a new patient to home health services or hospice care involves an intensive process of patient evaluation that covers a wide range of areas such as the patients’ clinical condition, payor source, preadmission health care services, patients bill of rights, and contractual service agreements. For example, with most home health patients, the patient will be confronted with dozens of forms involving potentially hundreds of pages in the context of a clinical assessment visit that may take between two and three hours. As a result, patients often complain about how long it takes rather than what it all means. Overall, home care and hospice providers indicate that most patients’ awareness of privacy rights have not been increased since the implementation of the HIPAA Privacy Rule.
Recommendation:
HHS should consider whether the Notice of Privacy Practices can be reasonably abbreviated or whether the delivery of the notice can take place at an alternative time.
D. Implementation Administrative Burdens and Cost
Homecare and hospice providers indicate that the implementation of the Privacy Rule was extraordinarily time-consuming and expensive. That implementation included processes development, material development, staff training, and oversight. With all of these requirements, payor sources for home health and hospice, primarily Medicare and Medicaid, have failed to respond with any increase of reimbursement.
The lead time for implementation of all of the HIPAA rules in greatly appreciated. Nevertheless, home health agencies report significant implementation difficulties because the Privacy Rule, along with the Electronic Transaction Rule, competed for implementation resources with the transition of home health agencies under Medicare from a cost-based reimbursement system to a prospective payment system. Trying to achieve compliance with all of these changes at the same time proved to be a daunting task.
Recommendation:
Any future changes to the HIPAA Privacy Rule should provide for an extended implementation period. Further, HHS should work with its other divisions, namely Medicare and Medicaid, to communicate anticipated implementation costs for providers of services with recommendations as to reasonable rate increases to accommodate those costs.
Conclusion
Thank you again for the opportunity to present this testimony. We are available at any time to work with the Subcommittee on Privacy and Confidentiality to address any of our concerns with the HIPAA Privacy Rule.