Practices should avoid asking the patient to put their reason for visit or contact information on the sign-in sheet, since this information can be captured in another, more confidential manner. For example, a sign-in sheet with the patient’s name, appointment time and the physician being seen would meet the minimum necessary standard. Using a sign-in sheet is not a HIPAA violation as long as the information on the sign-in sheet is kept to the minimum necessary. Is using a sign-in sheet or calling a patient by their first and last name a HIPAA violation? This process may be done over the phone, in person or electronically through secure email or the patient portal. This can be done in a number of ways such as verifying the patient’s date of birth, last four digits of their social security number and/or current mailing address. HIPAA does require that the patient’s identity be verified to ensure that the correct individual receives the information. HIPAA does not require anything in writing from the patient when disclosing PHI for treatment, payment or healthcare operations. Is it a requirement for the patient to sign an authorization or consent when releasing information to another healthcare provider for the purpose of treatment, payment or healthcare operations?

The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity…Individuals have a right to access this PHI for as long as the information is maintained by a covered entity…regardless of the date the information was created whether the information is maintained in paper or electronic systems onsite, remotely, or is archived or where the PHI originated (e.g., whether the covered entity, another provider, the patient, etc.). The following information is from the guidance provided by HHS on the topic of patient access to their protected health information:

The PCP may release all of this information to the patient. The PCP has records from the patient’s cardiologist and gastroenterologist included in their medical record. For example, a primary care practice receives a request from a patient for copies of all of their medical records. Excluding records with special protections by state or other federal law, such as psychotherapy notes and notes related to substance abuse treatment, practices are permitted to release other healthcare providers’ records. When a patient requests a copy of their medical record, may a practice release records that were received from another healthcare provider? In an effort to clear up this confusion and bust some of these HIPAA “myths”, a few of the most commonly asked questions are provided below with answers backed by the Department of Health and Human Services (HHS), the entity responsible for enforcement of HIPAA Rules. In fielding those calls and emails, some commonalities have been identified. On almost a daily basis, policyholders contact SVMIC for assistance with HIPAA-related issues. ADA disclaims any responsibility for content errors, omissions, or infringing material and disclaims any responsibility associated with relying on the information provided on this website.Trying to comply with HIPAA can be a challenge for healthcare providers, especially when there is so much confusion about specific aspects of the Rules. ADA, its staff and consultants will not modify or customize any of these forms and documents once purchased.Īll materials, content and forms contained on this website are the intellectual property of ADA and may not be copied, reproduced, or distributed beyond the use of your practice without ADA's express written permission.ĪDA does not warrant, either expressly or implied, the accuracy, timeliness, or appropriateness of the information contained in the documents or on its website. Prior to purchasing a form or document from ADA, please note that any modifications, adjustments, or changes to a specific form or document are the responsibility of the purchaser. These changes will be the responsibility of the purchaser and not the responsibility of ADA. Some forms and documents, including but not limited to, superbills, hearing aid purchase receipts, and HIPAA materials, may require modification at a later date due to compliance and regulatory changes. These formats will allow for customization and editing by you and your practice.

Many of the forms and documents that are available for purchase through ADA have been created in either Microsoft Word or Microsoft Excel format.

Hipaa compliance forms spreadsheet