November 2003

D.C.s misled about HIPAA compliance

by Drs. Arlen and Jonathan Rubin

Did you know that you have a legitimate option to be exempt from HIPAA regulation? Many chiropractic leaders and much of the chiropractic media have misrepresented the HIPAA compliance requirements. Any mention of an option to be legitimately exempt from HIPAA regulation is quickly dismissed by many authorities in our profession, many of whom happen to be directly involved with organizations who sell HIPAA compliance seminars for up to $1,000 a seat.

Our profession appears singularly determined to convince itself that there is no option other than full HIPAA implementation. Would it surprise you to know, for example, that the American Academy of Physicians and Surgeons is strongly urging its member doctors to be exempt from HIPAA whenever possible? [1] Even the Center for Medicaid/Medicare Services website tell doctors how to exempt themselves from HIPAA. [2]

One chiropractic publication is regularly printing articles, by an unidentified author, that say there is no exemption to the HIPAA privacy rules. We checked the four references listed on this article. One was a CMS website reference which printed the HIPAA regulations. The other three references were articles in the same publication, similarly anonymous, containing nearly identical assertions with no referenced proof that the statements are true.

Spinning the facts

A web of misinformation has ensnared our profession, and limited its real choices regarding HIPAA. Teasing this web apart, one strand at a time, gives us a glimpse at how effectively we have been misled into a false understanding of HIPAA regulations:

***  Coverage vs. Compliance. We have been told by many sources that "All healthcare providers must comply with the new HIPAA regulations." This is absolutely true.

However, while everyone must comply with the HIPAA laws, not everyone is covered in the same way. Under HIPAA, according to HHS, there is a status known as the Non‑Covered Entity.

This status was created by HHS to allow certain providers to escape HIPAA regulations and rules, provided they meet certain criteria. Non‑Covered Entity status allows a provider to continue business exactly as it had prior to HIPAA, with no fear of audits or fines, no need to convert your office, no need to appoint a 'point‑person' on your staff to monitor patient privacy, and no need to pay for continuing HIPAA seminars.

The (somewhat simplified) criteria to be a Non‑Covered Entity are that you must not:

1) send any patient health information over the internet, and

2) be in any contractual arrangement in which you agree to be a Covered Entity.

For many doctors, it is far easier and substantially more cost effective to choose Non‑Covered Entity status.

***  Seminars: Cost‑Effective or Just Costly? Implicit in the message of the various HIPAA seminars is that you must be a Covered Entity. Before spending a dollar on a seminar, you must decide independently if you truly need or want to be a HIPAA Covered Entity. Asking these seminar advocates if you need to be a Covered Entity is like asking an MD if you need an antibiotic to treat an infection.

***  Insurance Companies to Mandate Electronic Billing? One chiropractic publication has been spreading this misinformation with almost every issue.

To understand how this is misleading, you need only ask yourself how an insurance company is going to mandate electronic billing for a practice that accepts only cash, but gives the patient a completed HCFA form to submit themselves to their insurance company.

Will the insurance company refuse to pay the patient unless the claim is submitted electronically? Patients would be outraged at any insurance company that refused to send payment unless the patients bought computers and submitted their claims over the Internet.

Remember, insurance companies have no power over non‑participating providers, except that they submit their claims on HCFA forms. As a provider, you could be denied entry into their HMO, or even denied 'participating‑provider' status. But they are not about to refuse to pay a non‑participating provider because they submit on paper.

***  Some States now requirement practitioners be covered entities? This one is almost true. At least one state, Texas, has added to its required standards for all healthcare providers the HIPAA rules for a Covered Entity.

This would seem to mandate that all Texas chiropractors be Covered Entities. We checked with both HHS and an attorney representing the Texas Chiropractic Association. Both gave consistent answers, which we interpret as follows: A state may obligate you to follow certain Federal guidelines, but that does not subject you to Federal enforcement.

In the case of Texas, the state may require its practitioners to follow the HIPAA privacy rules, but practitioners could still declare themselves a Non‑Covered Entity under Federal law. The benefit of this is primarily one of exposure. Non‑Covered Entities are not subject to Federal audits or fines for HIPAA violations.

Given the magnitude of the fines, this aspect alone may be the single most compelling reason to consider Non‑Covered Entity status, even if your state requires that you follow the Covered Entity privacy rules.

***  The Power of Position D.C.s are exceptionally well‑positioned to take advantage of Non‑Covered Entity status. Unlike most M.D.s, most D.C.s are not tied to large clinics, and our offices typically have fewer than 10 full‑time employees (a Medicare requirement says that offices with more than 10 FTE's must file claims electronically, which will obligate them to be Covered Entities).

Also, most of us have not yet become dependent on HMOs, which may insist on Covered Entity status for participation. In that case, the D.C. must decide if the actual benefit from remaining in the HMO relationship is worth it.

The American Academy of Physicians and Surgeons recommends that M.D.s consider Non‑Covered Entity status. Since most M.D.s are contractually connected to hospitals, own laboratories with more than 10 FTEs, or have extensive paperwork requirements, electronic filing is often their only option.

It is ironic that medical organizations are urging M.D.s to consider Non‑Covered Entity status even though few will be able to quality; while most chiropractic organizations are pushing D.C.s ‑ most of whom can easily qualify for Non‑Covered Entity status ‑‑ into the costly and exposed position of being a Covered Entity.

Choices

Although widely debated in the medical media, the chiropractic press has for the most part ignored a discussion of the threat to patient privacy that HIPAA may represent. To our knowledge, no other act has ever granted the government such broad control over private health information.

HIPAA granted HHS/CMS the power of oversight for all Covered Entities. This means the right to inspect not only how the Covered Entity uses private health information, but also the right to inspect the very details of that information itself.

If you are a Covered Entity, you have granted the government the right to read about your patient's injuries, psychological problems, sexual problems, personal activities...whatever you kept in their record.

More importantly, HHS/CMS gains the right, through HIPAA, to share patient information (e.g. during an audit) with affiliated agencies, the purposes of which will not be under the control of the patient!

Covered Entities are required by law to subject their patients to a massive privacy invasion by the government, in exchange for the right to send information electronically over the internet (whether you choose to exercise that right or not).

Although we recognize that, for some doctors, Covered Entity status may be best or only choice, we felt strongly that gaining Non‑Covered Entity status was the most ethical thing to do to protect our patients.

We urge you to learn about the Non‑Covered Entity status for your sake and for the sake of your patients. The best place to start is with the Center for Medicaid/Medicare Services website, cms.gov.

References:

1. www.aapsonline.org/confiden/escape.htm

2. www.cms.hhs.gov/hipaa/hipaa2/smallp2.doc

(Drs. Arlen and Jonathan Rubin practice in Kalamazoo, MI, and provide a low‑cost educational program on HIPAA. For more information, call 269‑343‑3575.)