By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CDH-L, CRIS, CC
Director of Compliance and Government Affairs
Verisma
February 8, 2025

Unfortunately, unauthorized disclosures (UAD) are a reality for today’s healthcare organizations. We’ve all been there – a staff member accidentally mistypes a fax number, or a patient ends up with one page of another patient’s protected health information (PHI) in their mailed medical records. What happens next determines if you have a Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reportable breach on your hands. When notified that PHI may not have been delivered as directed, your compliance team needs to spring into action to mitigate any risk to PHI.

Don’t have a compliance team? Not sure what steps and procedures define your processes for HIPAA unauthorized disclosures? Read on for recommendations and best practices for mitigating compliance risk.

Develop Investigation Protocol

When you are aware of a possible UAD, mitigate the possible risk as quickly as possible. Because we oversee hundreds of millions of record requests annually, our volume is substantially higher than most – and we have a designated Compliance Officer and support team. Therefore, we have developed our UAD Investigation Protocol based on years of experience and countless processed records.
The moment a release of information specialist (ROIS) is aware of a possible incident, he or she has a short amount of time to initiate an incident report and submit it to the Compliance team. In many organizations, employees fear admitting mistakes. Creating a culture of compliance includes reassuring your team, “to err is human and to report is divine.” If your staff isn’t reporting errors to you, it is not because they are not making them, they are not admitting it. Not knowing about an incident is far worse for your organization than being aware and taking measures to mitigate the damage of compromised PHI.

When an incident occurs, we rely on our team to notify us immediately. The Compliance team then begins working the risk assessment right away to research how the situation occurred. It is important to quickly contact the unauthorized recipient and collaborate with them to securely destroy, or return, the PHI. Additionally, to assert a low probability of PHI compromise or harm, a confidentiality statement must be obtained from the unauthorized recipient, outlining the secure destruction and assuring no further disclosure of the information occurs.

It is critical that you take steps to mitigate the possibilities of future UADs. Supervisors need to re-train the ROIS on best practices and auditing procedures based upon the mistake the ROIS made. If an ROIS working at a front desk were to hand one patient another patient’s medical records, you would want to spend time discussing best practices about double checking discharge paperwork off the printer before handed over the counter.

After re-training, the Compliance Officer completes the risk assessment. On the Health Insurance Portability and Accountability Act (HIPAA) Risk Assessment, the Compliance Officer reports whether the PHI has been acquired or viewed, and determines the extent of PHI risk, following federal HIPAA guidelines and state laws. After you are aware there is a possible breach, you have 60 days to complete your investigation, unless your state requires a shorter amount of time.

Violation vs. Breach

UADs typically fall into two categories, violation or breach.

A violation is a UAD with low probability of PHI compromise. If low risk is determined and supported by the assessment, reporting the incident to the OCR and patient is not necessary. For instance, if unauthorized PHI is disclosed to a covered entity, they have a legal responsibility to protect that information. Once the covered entity has destroyed the PHI, there is a low probability of compromise and it is classified as a violation.

If there isn’t low probability of PHI compromise, the UAD is a breach. For example, if you are not able to obtain a confidentiality statement from an unauthorized recipient, there is not a proven low probability of compromise. The breach needs to be reported to the OCR and the patient must be notified, explaining how their PHI was compromised.

According to the OCR, between 2019-2023 there was a substantial 89 percent increase in hacking and a massive 102 percent increase in ransomware. Realizing the agency can issue up to a $50,000 fine per incident with an annual cap of $1.5 million is how healthcare nightmares are made.

ROI Partner

Healthcare providers often face the challenge of managing a high volume of medical record requests, which can be time-consuming and prone to manual errors. Collaborating with a trusted ROI partner transfers the workload to a team of specialists who are dedicated to handling these requests accurately, securely and efficiently – freeing up valuable time for your staff to focus on patient satisfaction.
Verisma’s team of healthcare data experts is equipped to simplify workflows with advanced technology to manage the complexities of HIPAA compliance and mitigate risks associated with UADs. We understand the importance of policies and procedures and have processes in place to protect PHI. Our compliance team can quickly assess the situation, contact unauthorized recipients, and take necessary steps to secure the information.

Ready to reduce workloads and improve patient experience? Contact us today to discuss how we can help.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
December 9, 2024

When a patient moves between healthcare providers, their medical information and records often need to follow. Records necessary for care of the patient fall under the treatment provision on the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and (generally) don’t require an authorization from the patient or their personal representative. But when sharing records with another facility for treatment purposes, what and how much should you disclose?

What’s Transfer of Care?

While a Continuity of Care request is often a patient travelling between providers, the patient remains actively involved with both organizations. Consider a patient moving between a primary care physician and a cardiologist. It’s important for both providers to know what the other facility’s treatment of the patient entailed. So, they may submit a Continuity of Care request to obtain the records from the other provider.

A Transfer of Care request is different. In a Transfer of Care, the patient is transferring who’ll provide his or her care from one provider to another, and there’s no intent for the patient to return to the originating organization. Transfer of Care requests happen most often when the patient has moved and established care with a new provider.

Minimum Necessary Standard

The minimum necessary standard of the HIPAA Privacy Rule requires a provider to disclose the minimum amount of information be disclosed to accomplish the intended purpose. However, the minimum necessary standard isn’t required to apply to provider-to-provider requests for treatment purposes. Providers are permitted to request and disclose the amount of PHI necessary to treat a patient. The releasing provider is permitted to rely on the requesting provider’s judgment about what’s the minimum amount of information needed. Even though minimum necessary may not be required for Continuity of Care or Transfer of Care requests, the framework can serve as a best practice to get the most meaningful information to another provider.

When a provider receives hundreds of pages of medical records, it’s burdensome for them to sort through the information and determine what’s needed. The electronic health record (EHR) can be filled with “note bloat” and templated, duplicative information. For Continuity of Care purposes, most providers only need the most recent records of a patient. Sending all records for Continuity of Care requests can be a waste of time and resources. Applying the minimum necessary standard to Continuity of Care and Transfer of Care requests allows providers to receive the most pertinent information often on the first request. Of course, if the requesting provider needs more records, a second release of information (ROI) can occur with the transfer of the additional records.

Creating a Continuity of Care Policy

It’s important healthcare organizations create policies and procedures remaining consistent when applying standards like the minimum necessary. This can be done through a general ROI policy or within linked procedures and workflows. In either case, when your organization implements the minimum necessary standard for Continuity of Care or Transfer of Care requests, you should outline what factors are considered to limit the number of pages or information initially disclosed.

These factors could include, but aren’t limited to:

• An understanding with the receiving practice on what they want to receive
• Patient age
• Patient condition
• Size of the medical record
• Organization’s EHR solution
• The specialty of the provider

If your organization decides to limit the information initially sent to the requesting provider, it’s critical you make the receiving facility aware not all the information has been sent. This can be incorporated through a cover letter indicating the most recent records have been sent and include instructions on how the provider may request additional records if needed.

Release Record Requests to a Partner

If you find Continuity of Care, Transfer of Care, and all other record requests take too much of your staff’s valuable time, consider releasing this administrative burden to a partner. Verisma processes hundreds of millions of record requests annually and is an industry-leader with the highest accuracy rate. If you need to focus more on patient care, request a demo today to see how we can help.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
September 30, 2024

Annoyed and confrontational requestors may challenge the content provided in response to a request for medical records because they don’t think they received the precise information requested. These complaints can happen when requestors are unfamiliar with the minimum necessary standard.

If your organization adheres to its policies, it’s likely you’re compliant with HIPAA provisions despite pushback from requestors. Your organization isn’t required to spend hours sifting through the medical records and parsing out information to spare a requestor spending time to locate the information they deem relevant.

What’s HIPAA minimum necessary standard?

Covered entities and business associates are required by the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule)[1] to take reasonable efforts to limit the release of protected health information (PHI) to the minimum necessary to accomplish the intended purpose of the request,[2] often referred to as the minimum necessary standard. It’s designed to be flexible and places the authority with the covered entity to determine implementation.[3]

How does the minimum necessary requirement rule work?

A healthcare organization must develop and implement policies and procedures appropriate for its organization and reflect the business practices and workforce. The organization’s policies and procedures must identify who needs access to PHI to fulfill job responsibilities, categories of PHI needed, and conditions where access is appropriate. For instance, a hospital can permit doctors, nurses or others involved in treatment to have access to the full medical record. When the entire medical record is necessary, the organization’s policies and procedures must state so and include a justification.

When does the minimum necessary standard not apply?

• Healthcare providers making a request for treatment purposes
• Patients when they request for their records
• Requests with valid authorization
• Requests required for compliance with HIPAA Administrative Simplifications Rules
• U.S. Department of Health and Human Services (HHS) requests for disclosure of information required under the Privacy Rule for enforcement purposes
• When the request is required by law

Who decides what’s minimum necessary?

A covered entity may rely on its business associate re: the minimum amount of information needed for a reasonable request to disclose PHI. Covered entities can defer to Verisma and let us handle the burden. As a trusted business associate, we provide requestors with the right information. Covered entities entrust us with PHI, and we have an obligation to disclose information correctly. We’ve developed policies and procedures for implementing the minimum necessary standard so our fulfillment of applicable requests is compliant with the Privacy Rule.

Verisma and your minimum necessary policy

We do what’s in the best interest of our clients. During the implementation process, we’ll work together to make sure we have a clear understanding of what minimum necessary means for your organization.

Learn more by contacting our team of healthcare data experts.

[1] 45 CFR Part 160 and Part 164, Subparts A and E
[2] 45 CFR 164.502(b)
[3] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
August 30, 2024

In most electronic health record (EHR) systems, patients have one chart all providers within that organization share. Additionally, providers may receive and make treatment decisions based on records from providers outside of the organization. When a practice receives a record request for a provider to fulfill, should they only limit the records generated by that provider? Or include all records in the patient chart, even if from other providers?

What is the designated record set?

To know what to include, you’ll need to start with the designated record set. The HIPAA Privacy Rule indicates when a patient or requestor asks for a medical record, the information in the designated record set may be disclosed. The Privacy Rule defines the designated record set as:

• Medical and billing records about individuals maintained by, or for a, covered healthcare provider
• The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan
• Other records used, in whole or in part, by or for the covered entity to make decisions about individuals

Any record a provider uses for treatment decisions, generated by him or her, is part of the designated record set. If a provider references outside notes or labs from another provider, they become part of the designated record set. Multiple providers in an organization may use the same patient chart and have the same designated record set for the patient.

What do I release?

There’s often confusion over what to release when a designated record set includes records from multiple providers. An authorization, or Right to Access, request often indicates where the records should come from, but it’s the what that’s often most important.

If the request is directed at a specific doctor or organization and states “any and all records,” this indicates the designated record set utilized in caring for the patient. The designated record set could include labs and office visit notes from an outside provider if those records were used for treatment purposes. It’s rare for a provider to utilize only records created in the care of a patient.

However, if the request says “any and all records created by or limited to” a specific doctor or organization, this limits the authorization or access request to only those specified records – the what in this scenario has changed. So, the designated record set would be limited to the what specified in the request.

For most release of information (ROI) requests, it’s important to receive the appropriate records referenced in caring for the patient. This typically includes the entire designated record set and isn’t a restriction on what provider created the information. Occasionally requestors claim this scenario constitutes a HIPAA violation because the records provided have more than one provider name included. Requests for a provider’s records are for his or her designated record set. Because the designated record set may contain information from other providers, and requests for the provider’s records are asking for his or her designated record set, providing records from other providers doesn’t constitute a HIPAA violation or breach.

Release record requests to a partner

If record requests and compliance concerns take too much of your staff’s valuable time, consider releasing this administrative burden to a partner. Verisma processes hundreds of millions of requests annually with the industry’s highest accuracy rate. If you need to focus more on patient care and leave record requests and compliance questions to a partner, request a demo today to see how we can help.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
July 12, 2024

Combine the words HIPAA, protected health information (PHI) and email, and you’ve just found a topic that’ll leave many healthcare professionals uneasy. Nevertheless, email is frequently used for sharing PHI with patients and their caregivers. All healthcare organizations should develop policies and procedures to comply with HIPAA while delivering PHI via email.

It’s not as simple as citing a policy forbids emailing PHI. One of the key initiatives of the Office of Civil Rights (OCR) is to increase access for patients to their health information, including unencrypted email. So, while it may seem counterintuitive to email patients medical records and health information, providers and healthcare organizations may need to do exactly that to meet a patient’s requested format.

Why use email to send PHI?

As our world becomes more reliant on technology to communicate and manage our daily lives, the healthcare industry has seen their own technological revolution with electronic health records (EHR), e-prescribing, patient portals, wearable tech, and many other advancements. With email a main means of communication, it’s only natural patients would like to communicate in a way they’re familiar with.

Many healthcare organizations have their own email systems needed to function for business. But when it comes to communicating with patients, practices are often confused over what they can, and cannot, do. The U.S. Department of Health and Human Services (HHS) provides guidance on emails used in healthcare. They note the HIPAA Privacy and Security Rules don’t prohibit the use of email but do require proper policies and procedures to protect PHI. Guidance on a patient’s right to access their PHI underscored the ability for patients to request this information via email. And they consider email to be readily producible by nearly all covered entities, with exceptions if a file is too large to transmit via email.

While practices should defer to utilizing secure, encrypted email while transmitting PHI, the guidance from the OCR indicates if a patient wants their PHI to be delivered via unencrypted email, covered entities and business associates must comply.

How can I send an unencrypted email with PHI? Isn’t that against HIPAA?

Sending PHI via unencrypted email doesn’t violate HIPAA, but covered entities and business associates must take reasonable steps to ensure patients understand and acknowledge the risk of unsecured email transmission. The OCR provided this guidance because they want patients to easily receive their PHI in accordance with their right to access PHI.

In an interview with Report on Patient Privacy, Deven McGraw, Deputy Director of the HHS OCR, said, “We are trying to make it as easy as possible [for people] to exercise their HIPAA rights in a way that works best for them. But it is not meant to be a sort of blanket, ‘Get Out of Jail Free’ card on security.”

Meaning, if a patient requests their records be delivered via unencrypted email, the covered entity or business associate must comply with the request after assurance from the patient they understand the risk of unsecured email. Denying a patient their access request be sent via unsecured email could mean an OCR complaint.

But isn’t email a breach waiting to happen?

Email can be difficult to protect at rest and in transit. It’s important healthcare organizations follow industry best practices for utilizing email, which typically include dual authentication and encryption, to prevent a PHI breach.

Unsecure email is much more difficult to protect. If a patient acknowledges, verbally or in writing, the risks of their PHI being sent via unsecure or unencrypted means, the patient accepts the risk of potential disclosures occurring in transit, or upon arrival, to the intended email address.

Considerations for delivering PHI via email

With email a frequent transmission method for PHI, healthcare practices need to consider the risks and best practices for utilizing email in their own organization.

Some initial suggestions for appropriately transmitting email include:

• Servers containing email should be encrypted.
• When communicating PHI externally, utilize encrypted email technology.
• Ensure all staff are trained on email best practices.
• Develop a policy and procedure for working with patients when the PHI file size is too large to be delivered via email.
• Develop a policy and procedure to alert patients to the risks of delivering PHI via unencrypted or unsecure email.
• Create your duty to warn statement and receive written or verbal confirmation.
• If the email address is received verbally, confirm the address using the NATO Phonetic Alphabet.

Rely on a partner to navigate the changing regulatory landscape

With the rapid evolution of technology, it can be difficult to keep up with the regulatory landscape of what is, and isn’t, allowed – all while trying to avoid an unauthorized disclosure (UAD). Luckily, covered entities can work with business associate partners like Verisma to handle PHI disclosures – transferring the work burden and duty to warn.

And, while many patients can access data via portals, Verisma Request App® (VRA) opens up secure electronic delivery to third-party requestors, such as commercial health plans and attorneys – offering the same record-ordering convenience enjoyed by patients – and avoids the risks associated with email all together.

Does emailing PHI (encrypted or unencrypted) seem like more work than it’s worth? Our healthcare data experts are extensively trained in PHI delivery best practices including utilizing encrypted and unencrypted email, as well as responding to complicated right to access requests. We’ll take on these tricky situations for you. Find out how we relieve the burden of PHI email exchange by requesting a demo today.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
June 20, 2024

Under Health Insurance Portability and Accountability Act (HIPAA) Privacy Law, there’s a distinction between mental health records, part of a patient’s overall medical record, and psychotherapy notes, which are provided special consideration to be separate pieces of information. Healthcare professionals shouldn’t consider extra privacy protections afforded to psychotherapy notes as applicable to general mental health records, or the overall care and treatment of a patient could be impacted. We discuss how clients wish to label mental/behavioral records within their patients’ medical records. As with any HIPAA regulations, circumstances occur in which state laws supersede regulations set by federal law, so it is imperative health organizations understand their state laws. Our documentation and process adjusts to state when extra patient authorization is required for such information to be released. This information isn’t meant to be legal counsel, rather it’s a general guide to understanding the intricacies of HIPAA regulation.

Mental Health Records vs. Psychotherapy Notes

The U.S. Department of Health and Human Services (HHS) distinguishes between mental (which includes behavioral) health records compared with psychotherapy notes. HHS states, “Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment or health care operations purposes other than by the mental health professional who created the notes.”

HHS uses the HIPAA Privacy Rule to define psychotherapy notes “as notes recorded by a healthcare provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session and that are separate from the rest of the patient’s medical record.”

Mental health records, on the other hand, are considered to fall within general protected health information (PHI) and be part of the general health record. HHS outlines psychotherapy notes aren’t inclusive of medical prescriptions, session start and stop times, frequency of treatment, clinical tests, summaries of diagnosis, symptoms, prognosis, etc. These pieces of information are considered mental health records, thus part of the patient’s general medical record. It’s important to always consider individual states may have their own definition of mental or behavioral health. In these cases, you’ll want to know and understand any differences between state and federal definitions so you can determine if you need to apply additional privacy protections. As patients move between different healthcare providers, its critical health information be appropriately documented and shared for proper continuity of care of the patient. Diagnosis and medication information is imperative for any healthcare provider to properly and confidently provide care to a patient. Because mental health records and psychotherapy notes differ, HHS outlines they’ve different protections under the Privacy Rule: “Generally, the Privacy Rule applies uniformly to all PHI, without regard to the type of information. One exception to this general rule is for psychotherapy notes, which receive special protections.” Records related to mental health don’t receive these extra protections because they’re considered part of the general record. This distinction means thought and care should be put into how this information is stored and possibly shared, as most are not privy to the sensitive information contained in psychotherapy notes.

As organizations continue to implement protocols for managing medical records, they must consider how mental health records and psychotherapy notes differ in content and storage. Best practices state mental health records be stored within the patient’s general medical chart, while psychotherapy notes should be stored separately from the patient’s general medical record. If an organization wishes to store the psychotherapy notes within their electronic health record (EHR) system, special naming and filing standards should be documented and communicated. Staff members should be trained on the differences between psychotherapy notes and mental health records. Mental health records should be coded as such and included in the patient’s general electronic record. The psychotherapy notes should then receive an individualized designation which communicates the relevant patient while not being added to that patient’s general medical record.

Professional Discretion and Extenuating Circumstances

The term “professional discretion” is used throughout medical records regulatory law, pertaining to the rules surrounding psychotherapy notes. Healthcare providers maintain professional discretion on when and what information should, or shouldn’t, be released. Circumstances pertaining to family access to psychotherapy notes, law enforcement inquiries, and third-party requestors are especially dependent on this caveat to determine compliance.

The importance of professional discretion serves to indicate how critical it is organizations maintain a well-articulated system for the storage of psychotherapy notes. An example of professional discretion playing a part in the release of psychotherapy notes would be if a provider felt there was an imminent threat of a patient causing harm to themselves or others. A provider must use their professional discretion to determine if the situation meets the requirements for disclosure of psychotherapy notes to law enforcement for the purpose of prevention.

Patient Access to Psychotherapy Notes

As dictated by the HIPAA “Right to Access” provision, a patient must be allowed to gain access to their current medical records as defined by an organization’s “designated record set” in a timely manner, without undue burden. If the maintenance and contents of mental health professional’s notes fall within the definition of psychotherapy notes as defined in the Privacy Rule, they aren’t to be considered part of an organization’s designated record set, or the patient’s medical record. Since psychotherapy notes fall under this Privacy Rule exception, covered entities aren’t obligated to release a patient’s psychotherapy notes pertaining to their treatment. It’s of great importance the psychotherapy notes are maintained separately, or clearly noted as separate, from the patient’s medical record. If this step isn’t taken, the Privacy Rule exception doesn’t apply and a records custodian must include the notes when releasing information.

Third-party Requestors

If a third-party requestor is seeking to obtain medical records from the healthcare organization, the records custodian should follow normal protocol seeking required authorization. If psychotherapy notes relating to the requested records are also present at the organization, it must seek separate patient authorization – which states psychotherapy notes may be included – before releasing the notes to the third-party requestor. This is of paramount importance as inappropriate release of psychotherapy notes is noncompliant and may have undesirable effects for the related patient.