"Standards of Privacy for Individually Identifiable Health Information" is the name of new regulations promulgated by the U.S. Department of Health and Human Services (HHS). These regulations were mandated by Congress in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and have been grinding their way through the federal regulatory process ever since.

The Privacy Rule, as it's called, reaches into almost every chiropractor's office and will cause additional training and paperwork burdens for doctors and staffs, though perhaps not all the dire consequences that some have been predicting.

Your first question must be, does the privacy rule apply to you at all? Are you, in the terminology of the regulations, a "covered entity."

According to the HHS A "covered entity" is a "health care provider who transmits any health information in electronic form" for almost any purpose regarding a patient. If you're 100% pencil, paper and snail-mail, then read no more. Contrary to some articles that have appeared elsewhere, there is no exemption for offices with fewer than "x" employees.

If you are covered, then whenever you are using protected health information (PHI), you "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose ... " There are a few exceptions, including disclosures made pursuant to the patient's authorization.

Also, "a covered health care provider must obtain the individual's consent ... prior to using or disclosing protected health information to carry out treatment, payment, or health care operations." Again there are a few exceptions, such as emergencies.

The World Chiropractic Alliance will be exploring issues raised by these regulations in the future and doctors will be provided ample opportunities to attend state association sponsored seminars.

Sign-in sheets

Two of the most pressing questions of particular interest to D.C.s:

May I still use sign-in sheets? The following advisory is found on the HHS web site:

"Incidental Use and Disclosure -- The final Rule acknowledges that uses or disclosures that are incidental to an otherwise permitted use or disclosure may occur. Such incidental uses or disclosures are not considered a violation of the Rule provided that the covered entity has met the reasonable safeguards and minimum necessary requirements. For example, if these requirements are met, doctors' offices may use waiting room sign-in sheets, hospitals may keep patient charts at bedside, doctors can talk to patients in semi-private rooms, and doctors can confer at nurse's stations without fear of violating the rule if overheard by a passerby."

Obviously your sign-in sheets ought to ask for only name, time and other essential data and should not have a column for Presenting Complaint or any other unnecessary information.

Q. May I still use an open adjusting room?

A. Likewise the regulations don't specifically address this concern. Here are two quotations from the FAQ section of the HHS web site:

"Q: In limiting access, are covered entities required to completely restructure existing workflow systems, including redesigns of office space and upgrades of computer systems, in order to comply with the minimum necessary requirements?

"A: No ... The Department generally does not consider facility redesigns as necessary to meet the reasonableness standard for minimum necessary uses ...

"Q: Does the Privacy Rule require hospitals and doctors' offices to be retrofitted, to provide private rooms, and soundproof walls to avoid any possibility that a conversation is overheard?

"A: No, the Privacy Rule does not require these types of structural changes to be made to facilities ... The Department does not consider facility restructuring to be a requirement under this standard."

The context of these excerpts from this informal advisory, however, has to do largely with semi-private hospital rooms and places where files are stored. It cannot be taken as a guarantee that open adjusting rooms will automatically meet the "minimum necessary" standard.

There are ways to help reduce exposure to liability, including such common-sense approaches as installing privacy curtains or screens, keeping one's voice at a low volume, and making a private room available for conversations (and ideally available for adjusting, at the patient's option).

The final form of the rule eliminates the requirement to obtain a written consent from every patient before using PHI "to carry out treatment, payment, or health care operations" (with certain exceptions, including emergencies).

There are many reasons for all practitioners to have every patient sign a consent form, however. Those using open adjusting rooms should consider reciting the possibility that one's adjustment may incidentally be observed and that conversations may incidentally be overheard, as among the terms and conditions that the patient is agreeing to.

In addition, the regulations provide that "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by" you. The content and format of the notice are spelled out in the regulations.

Those using open adjusting rooms should likewise mention that fact, and the possibility of observation and overhearing, on the privacy notice as well.

The Privacy Rule will take effect on 14 April 2003. The text of the rule, along with explanatory notes, can be found at http://www.hhs.gov/ocr/hipaa.