HIPAA: Deadlines impact Mohs labs

Key Points

Williamsburg, Va. - The latest and final Health Insurance Portability and Accountability Act (HIPAA) deadlines mean that all healthcare facilities and organizations must be in compliance at all levels, including data handlers and Mohs technicians, an expert says.

"Everybody has to be in compliance now at all levels, including not only doctors' offices and pharmacies, but also hospitals, HMOs, insurers and data-warehousing entities," says Mickie Johnson, B.S., H.T.L.(A.S.C.P.), a consultant and owner of Mohs Histology Consulting Services, L.L.C., Spokane, Wash.

Passed in 1996 and amended in 2002 with a set of administrative simplification provisions issued by the U.S. Department of Health and Human Services, HIPAA was designed and passed to prevent misuse of individuals' medical information, he says.

Accordingly, HIPAA primarily sets standards for electronic transmission, storage and use of health information, he says.

"But HIPAA's goals also include protecting people's medical information from prying eyes or ears," Mr. Johnson tells Dermatology Times.

As such, HIPAA seeks to guard both printed and spoken information used in doctors' offices and throughout the healthcare system.

HIPAA also provides for a central electronic compilation of each patient's medical history that can be easily accessed, with patients usually identified by their Social Security numbers, he says.

Additionally, the act includes built-in protections that allow people to get copies of their own medical records at a reasonable price, as well as make any needed corrections easily.

2008 deadlines

The newest HIPAA deadlines - mandating use of National Provider

Identifier numbers for small health plans - took effect May 23, 2008.

"The latest deadline requires that even data handlers must have their unique identification numbers in place," he says.

For a Mohs practice, HIPAA requires staff members to be cautious with dry-erase boards frequently used to track the progress of patients' procedures.

Here, Mr. Johnson says, "An example of complying with HIPAA regulations would be to use patients' initials, not their names."

Similarly, he says Mohs laboratories often are located right next to - and sometimes in the same room as - Mohs surgery facilities.

"Often," Mr. Johnson says, "the door to the lab is open, or the walls are very thin, and patients can hear personnel talking about the results of a stage."

Therefore, he says Mohs staff members must speak quietly when discussing slides and specimens. By the same token, he advises using caution with Mohs slides and maps if there's any chance patients can see them.

Other steps not necessarily specific to Mohs surgery facilities include keeping paperwork covered so that patients or others in the office can't see it, Mr. Johnson says.

As for accessing medical records, he says, HIPAA allows for use and disclosure without authorization - as long as the information user and patient agree on any necessary restrictions - for the following purposes: treatment; payment; and healthcare operations, including quality assurance, utilization review, credentialing, or any activity to ensure appropriate treatment and payment