Healthcare Information Security

HIPAA and Compliance News

Staying HIPAA Compliant in Patient Health Data Access Process

A new patient health data access form from AHIMA aims to help providers stay HIPAA compliant while still aiding patients in accessing their own information.

Organizations can stay HIPAA compliant while still giving patients access to their own health data.

Source: Thinkstock

By Elizabeth Snell

- Last month, AHIMA released a new form designed to help both healthcare providers and patients better understand and utilize the patient health data access process. Patients have the right to their own information, but providers need to maintain data security to remain fully HIPAA compliant.

Healthcare professionals and patients can both be confused or even misinformed about the patient data request process. The recently released form from AHIMA is designed to streamline that process while maintaining HIPAA compliance, AHIMA Director of HIM Practice Excellence Lesley Kadlec told HealthITSecurity.com.

Kadlec is a registered health information administrator and is also a certified health data analyst. She explained that she works a lot with the AHIMA health data analytics program and teaches exam prep for health data analytics.

A key 2017 strategy for AHIMA is aligning consumers with their health information, Kadlec recalled.

“Consumer engagement and making sure that consumers understand their right to access their health information is really something that we've been focusing on,” she said. “We wanted to enable our members and health care organizations at large to be able to have a tool that would help them make sure that their patients are having easy access to their medical records.”

READ MORE: Ensuring Security, Access to Protected Health Information (PHI)

The HIPAA Privacy Rule aims to find the right balance between maintaining patient PHI security and allowing information to flow freely. HHS stresses on its website that this will “provide and promote high quality health care and to protect the public's health and well being.”

“The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing,” the Privacy Rule summary states. “Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.”

While not necessarily a misconception with the new form, Kadlec said that patients might not always have a proper understanding of all of their rights under HIPAA regulations. AHIMA wanted to make sure that patients were aware of their rights to have access to their own information.

Patients also need to know they have the right to give access to their health information to another person.

“We wanted to make sure that we had an easy tool that anyone could use to allow the patient to have that access or to give that access to their designated personal representative,” she stated.

READ MORE: ONC Stresses Improved Patient Data Access Measures

“This is just a suggested model form,” Kadlec continued. “We know that some organizations may have their own forms, and we certainly support that. But we wanted this form to be made available to those organizations who did not have an easy plain language form for patients to use to get that access to their information.”

Healthcare organizations can edit the form as well, and it is in a PDF format. The form is not copywritten, and the AHIMA logo is not on the form, Kadlec added. Entities are free to add their own logo, download the form and then print it off at will so patients can have access to the form and use it as necessary.

Patients might need to allow access to their own health data by another individual for numerous reasons, such as if the other individual is a caretaker, or if the patient herself has become incapacitated, Kadlec said.

“For example, maybe your 19-year-old child is off to college and she wants her parents to still have access to her medical records while she’s away at school,” Kadlec suggested. “Maybe she is covered by the parents' insurance or she may be looking to the parents to help her make decisions about her care. It may be important for the young adult to make sure that her parents have those records so that they can help her, assist her with the care, assist her with getting payment for her care, those kind of things.”

ONC also stressed the importance of improved patient care through increased data access in a 2016 report. Overall patient care will improve when individuals understand the scope of their rights and are able to access their own information, the agency said.

READ MORE: Senators, AHIMA Voice HIT Security, Interoperability Concerns

“When individuals get, review, use and share copies of their health information, they are better able to monitor chronic conditions, make sure that their health information is accurate, and share their information with others ensuring that their health information is available at the right place and at the right time,” ONC maintained.

One potential issue with patients requesting their data is that the information may be given to them in antiquated forms, such as on a CD or in paper documents. This patient form option gives providers a model to use for a more streamlined process.

“If providers want to replicate this in one of their electronic systems, they at least have a start available to them that they can use to help create whatever type of electronic form that they are hoping to use within their own systems,” Kadlec stated. “This form is only available on paper. It's not in electronic form. But, again, it is a model form, so it can certainly be modified to the use of any of organization in the format that they would choose to place it in their own systems.”

Overall, AHIMA wants people to know why the form exists, and how it can be utilized properly.

“It is our key strategy to empower consumers to have access to their health information, and so we hope that people will make use of it,” she said. “We hope that they find it to be beneficial to them.”

“It is designed to be written at the eighth grade reading level, so it is in consumer friendly language to help make it a little bit easier for patients to understand,” Kadlec continued. “We wanted to provide a plain language tool and a standard mechanism that healthcare organizations can replicate and use at will. We've already had thousands of downloads of the form, so we know that it is being utilized, and some organizations have already placed a copy of the form on their website so patients can start using it.”

X

SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
BYOD
Cybersecurity
Data Breaches
Ransomware

Our privacy policy

no, thanks