RE: "Appropriate" physical safeguards

Deborah Campbell Thu, 17 Oct 2002 11:23:41 -0700

Title: RE: "Appropriate" physical safeguards

---
You are currently subscribed to wedi-privacy as: archive@jab.org
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
---

Christy,
I would think, that since the bin is for allergy shots, you are telling them that this person not only is a patient, but what their condition is.

-----Original Message-----
From: SCHEEL, CHRISTY [mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 17, 2002 1:43 PM
To: WEDI SNIP Privacy Workgroup List
Subject: RE: "Appropriate" physical safeguards

If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org

---
I would think the names would be okay as an "incidental disclosure". You
are not revealing anything other that what would be revealed as "directory
information". It would be the same as a name on a door or like you said, on
the sign-in list.

Christy Scheel, RHIA
Corporate Compliance Specialist/Auditor
Warm Springs Rehabilitation System
Phone: (210) 832-2349
Fax: (210) 829-8741
Pager: (210) 203-4008
[EMAIL PROTECTED]

-----Original Message-----
From: Pat Bale [mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 17, 2002 12:33 PM
To: WEDI SNIP Privacy Workgroup List
Subject: RE: "Appropriate" physical safeguards

---
You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at
http://subscribe.wedi.org or send a blank email to
[EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as
the address subscribed to the list, please use the Subscribe/Unsubscribe
form at http://subscribe.wedi.org
---
Re: the issue of "incidental disclosure", my pediatric office has a
nurse who gives allergy shots several hours a day. She keeps them in a
plastic bin with each child's name on the drawer holding his serum. To
involve and distract the child, she allows them to find their drawer,
she checks to be sure it is correct, and then administers the shot.
Technically, the child may see other children's names when he is
searching for his. But isn't that an "incidental disclosure" similar to
hearing a name in the waiting room or seeing a name on a sign in sheet?

I really don't want to discontinue this practice, as the children really
enjoy it and it makes getting a shot palatable. Any thoughts?

Pat Bale, MHA
466 West Third Street
Lexington, KY 40508
tel. & fax: 859.254.0183
email: [EMAIL PROTECTED]

-----Original Message-----
From: Sparma, Deborah, nashccon
[mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 17, 2002 1:05 PM
To: WEDI SNIP Privacy Workgroup List
Subject: RE: "Appropriate" physical safeguards

·Can physician offices use patient sign-in sheets or call out the names
of
patients in their waiting rooms?

Response: Yes, covered entities such as physician offices may
use
patient sign-in sheets or call out patient names in waiting rooms, so
long
as the information disclosed is appropriately limited. The Privacy
Rule
explicitly permits certain "incidental disclosures" that occur as a
by-product of an otherwise permitted disclosure - for example, the
disclosure to other patients in a waiting room of the identity of the
person
whose name is called. However, these "incidental" disclosures are
permitted
only to the extent that the covered entity has applied reasonable and
appropriate safeguards (45 C.F.R. § 164.530(c)), and implemented the
minimum
necessary standard, where appropriate (45 C.F.R. §§ 164.502(b) and
164.514(d)). For example, the sign-in sheet may not display medical
information that is not necessary for the purpose of signing in (e.g.,
the
medical problem). For more information, see the preamble to the final
modifications to the Privacy Rule (67 Fed. Reg. 53182, 53193-95 (August
14,
2002)).

·A clinic customarily places patient charts in the plastic box outside
an
exam room. It does not want the record left unattended with the patient,
and
physicians want the record close by for fast review right before they
walk
into the exam room. Will the Privacy Rule allow the clinic to continue
this
practice?

Response: Yes, the HIPAA Privacy Rule permits this practice as
long
as the clinic takes reasonable and appropriate measures to protect the
patient's privacy. The physician or other health care professionals use
the
patient charts for treatment purposes. Incidental disclosures to others
that might occur as a result of the charts being left in the box are
permitted, if the minimum necessary and reasonable safeguards
requirements
are met. As the purpose of leaving the chart in the box is to provide
the
physician with access to the medical information relevant to the
examination, the minimum necessary requirement would be satisfied.
Examples
of measures that could be reasonable and appropriate to safeguard the
patient chart in such a situation would be limiting access to certain
areas,
ensuring that the area is supervised, escorting non-employees in the
area,
or placing the patient chart in the box with the front cover facing the
wall
rather than having protected health information about the patient
visible to
anyone who walks by. Each covered entity must evaluate what measures
are
reasonable and appropriate in its environment. Covered entities may
tailor
measures to their particular circumstances. See 45 C.F.R. §164.530(c).

·A hospital customarily displays patients' names next to the door of the
hospital rooms that they occupy. Will the Privacy Rule allow the
hospital
to continue this practice?

Response: The Privacy Rule explicitly permits certain
incidental
disclosures that occur as a by-product of an otherwise permitted
disclosure-for example, the disclosure to other patients in a waiting
room
of the identity of the person whose name is called. In this case,
disclosure of patient names by posting on the wall is permitted by the
Privacy Rule, if the use or disclosure is for treatment (for example, to
ensure that patient care is provided to the correct individual) or
health
care operations purposes (for example, as a service for patients and
their
families). The disclosure of such information to other persons (such as
other visitors) that will likely also occur due to the posting is an
"incidental" disclosure. Incidental disclosures are permitted only to
the
extent that the covered entity has applied reasonable and appropriate
safeguards (45 C.F.R.§164.530(c)), and implemented the minimum necessary
standard (45 C.F.R. §§164.502(b) and 164.514(d)). In this case, it
would
appear that the disclosure of names is the minimum necessary for the
purposes of the permitted uses or disclosures described above, and there
do
not appear to be additional safeguards that would be reasonable to take
in
these circumstances. However, each covered entity must evaluate what
measures are reasonable and appropriate in its environment. Covered
entities may tailor measures to their particular circumstances. For
more
information, see the preamble to the final modifications to the Privacy
Rule
(67 Fed. Reg. 53182, 53193- 95 (August 14, 2002))

Deborah Sparma
Datatek Consulting Group
[EMAIL PROTECTED]

-----Original Message-----
From: Noel Chang [mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 17, 2002 9:41 AM
To: WEDI SNIP Privacy Workgroup List
Subject: "Appropriate" physical safeguards

---
You are currently subscribed to wedi-privacy as:
[EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at
http://subscribe.wedi.org or send a blank email to
[EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the
same as
the address subscribed to the list, please use the Subscribe/Unsubscribe
form at http://subscribe.wedi.org
---
I would be interested in hearing from people who deal with solo
practitioners
or small group practices, what are some of the issues you are having to
address in the doctor's office to ensure that "appropriate" physical
safeguards are provided (section 164.530(c)). Let's ignore the
administrative and technical safeguards for now.

For example:

At the check in window, is a sliding, frosted glass, window always
necessary? As long as computer terminals are not visible, nor any other
PHI,
I say no.

Are lockable doors necessary at every point that you do not intend
non-office
personnel to access? Many offices I have seen have a door that separate
the

waiting room from the rest of the office. Once you are in the exam
area,
however, you can move freely (without any keys or combinations) from the
exam
room to the insurance desk, to medical records area, to the referrals
area,
etc. I would say it is pretty obvious that these areas are not intended
for

patients to access but what is appropriate? Do I have to have locking
doors

to separate these areas from the exam rooms? Can I just post signs that

notify patients that an area is restricted and they are not supposed to
enter? This is a gray area to me and without seeing the work area being

considered I would argue it is impossible to make blanket statements
about
what is appropriate. Do people agree or do they feel there are some
hard
and
fast rules concerning how the physical work space should be layed out?

Noel Chang

--
Open WebMail Project (http://openwebmail.org)

---
The WEDI SNIP listserv to which you are subscribed is not moderated. The
discussions on this listserv therefore represent the views of the individual
participants, and do not necessarily represent the views of the WEDI Board
of Directors nor WEDI SNIP. If you wish to receive an official opinion, post
your question to the WEDI SNIP Issues Database at
http://snip.wedi.org/tracking/. These listservs should not be used for
commercial marketing purposes or discussion of specific vendor products and
services. They also are not intended to be used as a forum for personal
disagreements or unprofessional communication at any time.
**** CONFIDENTIALITY NOTICE ****
The information in this email may be confidential and/or privileged. This
email is intended to be reviewed by only the individual or organization
named above. If you are not the intended recipient or an authorized
representative of the intended recipient, you are hereby notified that any
review, dissemination or copying of this email and its attachments, if any,
or the information contained herein is prohibited. If you have received this
email in error, please immediately notify the sender by return email and
delete from your system. Thank You

RE: "Appropriate" physical safeguards

Reply via email to