Pharmacy Visits & Your Rx Info

In case you like to read the ending first,  

Click HERE to see what it costs to leak folk's prescription information.


            Back in 2003, the healthcare industry experienced another change.  Patient privacy was moved to the forefront, and subsequently, business as usual became not so usual.  The Privacy Rule under Health Insurance Portability & Accountability Act of 1996 (HIPAA) was in full force.  HIPAA is a federal law that was originally implemented with the ability of employees to take their health insurance packages with them, as they change employers.  Today, HIPAA is cover much more; it now allows patients many more rights within the healthcare system.  Some of them include the right to request actions such as amendment to their own medical records, accountings of disclosure of their medical records, and alternative communications.

In response to abuse of PHI in the past, new policies and procedures also had to be implemented and enforced, in order to increase protection of patient privacy.  The Privacy Rule is responsible for new policies and procedures that specifically address the way PHI can be used and transmitted, criteria for release of PHI, as well as accountings of disclosure; except for the purpose of Treatment, Payment, or Other healthcare operations (TPO), every disclosure is required to be logged.

Under the Privacy Rule, identifiable information, also referred to as Protected Health Information (PHI) includes any information that can be used to identify a person.  Examples of PHI include elements such as a telephone number, insurance plan number, name, and address/email address, just to name a few. 

Other terms that have become commonly used and necessary to maintain patient privacy, while performing day-to-day duties, include:

CMS: Centers for Medicare & Medicaid Services;

HHS: Health and Human Services;

Covered Entity: Healthcare providers, health plans, and clearinghouses;

Clearinghouse: An entity that processes or facilitates the processing of nonstandard data elements of health information into standard data elements;

Code Sets: Any set of codes used for encoding data elements, i.e. ICD (diagnostic/procedure) codes;

Authorization: Written consent that is signed by a patient, which gives permission to disclose PHI; and

Disclosure: The release, transfer, provision of, access to any information outside of the entity where PHI is stored.

In outpatient pharmacy settings, opportunities for privacy breeches are countless.  For example, staff should take extra care to keep patient names and their medication labels from plain view, as customers and patients approach the pharmacy counter.  Likewise, pharmacists and pharmacy technicians should be conscious of patient privacy, as various steps of the drug utilization review process are performed, exercising caution in communicating patient information.  For example, phone calls to other covered entities or patients about refills, drug-drug interactions, or action to be taken after missing a dose can be easily overheard by unauthorized individuals; in instances where patients do not answer, a voice mail message may be left, but diagnosis details and medical record numbers should never be mentioned.  Conversations of this kind should take place in a more intimate setting, as opposed to the pharmacy counter, where other customers and patients are present.  On-site patient counseling should also occur in a private space, whenever possible; patients with communicable diseases such as Herpes Simplex II and HIV-AIDS may be extremely sensitive to privacy issues, and may be likely to decline counseling, unless privacy is reassured. 

Patients are more informed nowadays than in the past, meaning they tend to be familiar with common indications for many fast-moving drugs.  Hence, an unprecedented demand for the “Minimum Necessary Rule;” by definition, employees should have limited access to PHI, according to their job functions, and should only share such information on a need-to-know basis.  This allows staff to focus on their individual roles and decreases opportunities to erroneously disclose PHI.  However, staff should be aware of organizations that require more feasible access to PHI, namely worker’s compensation carriers, law enforcement agencies, child protective services, and municipal offices.

In the event that patients identify breaches of their privacy, they now have points of contact, to whom they may express their concerns.  Every healthcare Covered Entity is required to have a Facility Privacy Officer (FPO) on staff.  Patients can report breaches of privacy in writing to the appropriate FPO or to HHS’s Office of Civil Rights, directly; each Covered Entity is required to provide this information within their Notice of Privacy Practices to all patients.  Penalties for HIPAA Privacy violations and non-compliance could include fines as low as $250 and as high as $1.5 million, PLUS a maximum of 10 years’ imprisonment.

Ultimately, whose business is your medical record?  It is the business of healthcare providers, health plans, and clearinghouses, but on a need-to-know basis.

Contact information for the Office of Civil Rights:

OCRMail@hhs.gov

http://www.hhs.gov/OCR/Privacy

Just trying to keep your awareness current & relevant ;-)

Thanks for stopping by!!!