Articles on Topics You Need
The Convoluted Maze of HIPAA-Compliant Email and How to Navigate It
Email could arguably be one of THE most misunderstood aspects of HIPAA. Part of the confusion stems from the fact that there is no ONE place in HIPAA that says "Do email like this." However, email is referenced - directly or indirectly - in a variety of places throughout the vast HIPAA documentation. What causes some of the misunderstanding is that people will find a guideline that pertains to email from ONE place in HIPAA and assume if they do that one thing, they're good. Unfortunately, that conclusion is not unlike what you get when several people with visual impairments are put in front of an elephant and asked to describe it. We may get a beautiful description of an elephant's trunk but to assume that's ALL an elephant is would be incorrect.
Good Faith Estimates and the “No Surprises Act”
Were you surprised when you first heard about the "No Surprises Act"? We were. I'd like to be able to tell you that we had been actively tracking and planning for this legislation since it was first issued on October 7, 2021. Unfortunately, that's not the case. However, we got lucky because we were already working on a new tool called Custom Forms which, when it launches (est. Feb 2022), will work beautifully in helping you comply with this bill in ways that are easy, HIPAA compliant, and give you a significant amount of automatic documentation and tracking.
Am I Required to Comply with HIPAA? ALL of It???
Not too long ago, I conducted a workshop on telehealth. During the Q & A period at the end, a woman said that she had been told she was exempt from HIPAA and wanted to check with me to see if that was true. I was caught off guard. I used to get that question a lot, but I hadn’t heard it for a while, so it took me a moment to gather my wits. Finally I said, “Do you only use landlines when talking with your patients?” She replied that she did. I continued, “And are they always only on landlines as well?” She assured me that they were. “And you’re not doing any video sessions, only in person?” That was true, too. My last question was, “And I assume you don’t take insurance at all, that you’re only private pay?” She was. I replied, “Ok, then yes, I guess you’re fine. No need to worry about HIPAA.”
She left relieved. I left unsure of my answer.
Integrated Products for Mental Health: Save Time, Money, Errors
Mental health therapists are beginning to talk about wanting “integrated products” to help manage their practice tasks. But what do they mean by “integrated product?” More importantly, if you wanted to look at some, how would you go about finding them? Googling “integrated product” isn’t likely to produce the results you want.
One of the problems is that these types of products go by more than one name, which may be why people have begun referring to them as “integrated products.” Common names are Electronic Health Record (EHR), Electronic Medical Record (EMR) or Practice Management System. To complicate matters, just being called one of those titles doesn’t automatically mean the product is well-integrated.
All Patient Notes in ONE Place – You Don’t Have to Go Looking
Recently, a top journal in the field of Electronic Health Record (EHR) development posted this quote from an anonymous doctor who was dissatisfied with his EHR:
“I firmly believe this EHR makes important information difficult to find and interpret, and it is very inefficient.” He went on to say, “It creates superfluous and difficult-to-navigate notes and information that are not centralized. That makes it easy for care providers to disregard notes, and they often do. That affects patient safety. . . . It is difficult and arduous to document in the EHR, and providers’ efforts to do so still yield subpar results with erroneous, irrelevant information.”
This doctor is pointing out a very real problem inherent in some EHRs. However, he was referring to one of the "ONC Certified" EHRs which we've discussed previously. Those types of EHRS are inherently much more difficult to use than most EHRs that have been specifically created for the mental health professions, such as PSYBooks.
Does the Open Notes Rule Apply to Me?
The term "Open Notes Rule" is a popular term coined to depict the legislation enacted by the 21st Century Cures Act that is more accurately referred to as the ONC's final program rule on Interoperability, Information Blocking, and ONC Health IT Certification (OpenNotes, 2020). It is a continuation of the legislation originally enacted as part of the HITECH act of 2009 to promote EHR interoperability (with the ultimate goal being a national database for healthcare information on all U.S. Citizens) and open access to records. The Open Notes Rule does NOT apply to PSYBooks users but there are some important things to understand about the current iteration of this legislation, partly in an attempt to help prepare us for what might be coming in the future.
Why Get an Integrated Product?
As a therapist, you can amass your digital tools one at a time or you can invest in a well-integrated bundled product. For example, let's say right now you're mostly looking for a video platform so you can do telehealth. There are companies that ONLY offer subscriptions to video platforms. But is that the best choice?
Depends.
For example, what happens if, after you sign up for your standalone video product, you realize that you also need a way to collect your fees from your telehealth clients. And maybe you need encrypted email so you can contact people in a way that's secure. Or maybe now you need HIPAA-compliant file storage, as your clients begin to send you documents via their new encrypted email. Or perhaps a way to schedule clients online. Or maybe a way to efile and also to send statements and receipts digitally. That's a LOT of tools and we're just getting started!
What Will Happen to Your Clients?
Most of us have documents like a will, power of attorney and other estate planning instruments either already in place or at least on our “I’ll get to that eventually” list. Far fewer have given much thought to how we would want our clients to be taken care of in the case of our demise or anything else that would cause a sudden interruption in our ability to provide services.
Encrypted Email:
Your Role in Keeping it Safe
Some people like to point out that encrypted email isn’t all it’s cracked up to be. “After all,” they warn, “as soon as someone has access to your username and password, it no longer matters whether your email is encrypted or not.” Well . . . yes. That’s an accurate statement. However, to use that line of reasoning would be like telling us not to bother locking our homes or cars. After all, as soon as someone gets access to your keys, those locks become useless.
Encrypted Email – Just How Safe Is It?
PSYBooks’ email not only meets but actually surpasses the HIPAA specifications for encrypted email. HIPAA’s rules for email encryption are broad, giving developers the maximum amount of freedom. This is as it should be. Those who are responsible for writing and maintaining HIPAA/HITECH laws cannot also be expected to keep up with rapid changes in the world of technology the way developers do. Therefore, although HIPAA wisely states that email containing client PHI (Protected Health Information) should be encrypted, it doesn’t specify exactly how that should be done.
Are Digital Records Better Than Paper?
At it’s simplest, digital record-keeping could simply mean a Word doc, Excel sheet or PDF that you’ve saved on your computer, tablet, phone, thumb drive or other type of digital storage device. There are advantages to digital record-keeping even at this elementary level. For example, with digital records, you no longer have to contend with bulging filing cabinets, finding adequate long-term storage, or shredding – all of which are factors with paper health records. Additionally, it’s relatively easy to make backup copies of digital files to guard against some type of disaster, whereas making copies of paper records is costly, both in terms of time and money and also, effectively doubles the number of filing cabinets or other physical storage space you need.
Types of EHRs: The Shared Chart Model
At it’s simplest, digital record-keeping could simply mean a Word doc, Excel sheet or PDF that you’ve saved on your computer, tablet, phone, thumb drive or other type of digital storage device. There are advantages to digital record-keeping even at this elementary level. For example, with digital records, you no longer have to contend with bulging filing cabinets, finding adequate long-term storage, or shredding – all of which are factors with paper health records. Additionally, it’s relatively easy to make backup copies of digital files to guard against some type of disaster, whereas making copies of paper records is costly, both in terms of time and money and also, effectively doubles the number of filing cabinets or other physical storage space you need.
Doing Telehealth? You Need a Portal.
Think you're not doing telehealth? Think again. Although there's no one-size-fits-all definition that cuts across state and/or discipline lines, most agree that telehealth basically involves any electronic method you use to communicate with or about your clients. This can include common things like phones, email and electronic file storage, in addition to video sessions, which is what we typically think of with the term telehealth.
Business Associate Agreements:
Do We Really Need Them?
I sometimes hear therapists mention specific software programs they’re using in their practices for tasks like notes, calendar/schedulers, online file storage, billing, video sessions or email and then add something like, “They’re HIPAA compliant. They just don’t – you know – have Business Associate Agreements.”
HIPAA/HITECH
There are no HIPAA compliant products or services, because by definition, only HIPAA covered entities (e.g., you) and business associates (e.g., PSYBooks) can be compliant. In other words, it’s not a product or service that’s compliant, it’s how you, as a covered entity, or we, as a business associate, write and implement our policies and procedures to utilize those products.
Your Personal File Storage
In addition to being able to store files for each client, you can also upload and store your own digital records in an area set aside just for you. It’s important to note that files are maintained separately. Client files are stored in their charts – separate from all other clients and also separate from your personal files. This is one of the ways PSYBooks adheres to HIPAA/HITECH guidelines.
File Storage for Each Client
Each of your charts in PSYBooks has a Files tab where you can upload files specifically to that client’s chart. For example, initially you might want to upload scanned copies of their intake forms, insurance cards and/or driver’s license. Later on, you may want to upload copies of releases and consents, EOBs, reports or testing results. If you want, you can also keep copies of routine things you generate such as statements, insurance claims or receipts. Should your client request a PHI report, you can also upload that to their chart so you’ll have a record of what you gave them. There are several advantage to storing these kinds of documents in PSYBooks:
User Accounts
User Accounts can be established for anyone you need to grant access to some or all of your PSYBooks records. For example, you might want to create User Accounts for billing personnel, scheduling personnel, supervisees or a colleague who is covering for you. You can allow the user to access the records of all of your clients or just certain ones.
Business Associate Agreements:
Do We Really Need Them?
I sometimes hear therapists mention specific software programs they’re using in their practices for tasks like notes, calendar/schedulers, online file storage, billing, video sessions or email and then add something like, “They’re HIPAA compliant. They just don’t – you know – have Business Associate Agreements.”
Behavioral Health Portal
The portal is the web-based interface between you and your clients. In a sense, it allows your clients (or anyone else you designate) to have their own “mini” version of PSYBooks that contains just their own data – no one else’s. You can view data they enter on your side and interact with the client about their data, all through the portal.
Types of EHRs: Introduction
Let’s face it. There are LOTS of EHRs on the market and most of us simply don’t have the time, energy, or frankly – interest – to put a lot of effort into researching them. Some therapists have told me that although they’d sort of like to explore EHRs, they begin looking at all the options, get overwhelmed, and decide to put the whole thing off. Although it doesn’t have to be overwhelming, it IS an important decision. An EHR that’s designed well, with attention paid to usability issues so it’s easy to use, can simplify your life enormously and save you a lot of time and money. On the other hand, an EHR that’s poorly designed will have you pulling your hair out and cursing EHRs in general – possibly not realizing that not all EHRs are the same and that there might be better options.
What is an EHR Anyway?
The acronym EHR stands for Electronic Health Record. Originally the term EHR was supposed to mean a very specific thing. It was to be a type of digital (i.e., computerized) practice management system for health care professionals that could “talk to” (i.e., share data with) EHRs of other health care providers and organizations, such as laboratories, specialists, school and workplace clinics, medical imaging facilities, pharmacies, emergency facilities – essentially anyone that might be involved in a patient’s care. Similar products that did NOT automatically have the “talk to everyone” feature were to be referred to by other names, such as EMR (Electronic Medical Record) or simply, practice management system.
Types of EHRs: Scope
To begin this series of posts, let’s look at a concept I’m calling “scope”. In reference to EHRs, scope doesn’t refer to the number of users a particular EHR has, but rather, to the number of different roles for which it’s designed. For example, a large scale medical EHR needs different roles or tracks for each of the various personnel that might need to add something to a patient’s chart. That could mean, for example, different tracks for scheduling, billing, intake, nurses and other mid-levels, doctors, lab technicians, social workers, etc. Additionally, such EHRs are designed primarily for hospital settings. Doctors who are affiliated with the hospital can typically access the EHR from their office, but the EHR itself was developed with hospitals in mind.
Types of EHRs: The Shared Chart Model
At it’s simplest, digital record-keeping could simply mean a Word doc, Excel sheet or PDF that you’ve saved on your computer, tablet, phone, thumb drive or other type of digital storage device. There are advantages to digital record-keeping even at this elementary level. For example, with digital records, you no longer have to contend with bulging filing cabinets, finding adequate long-term storage, or shredding – all of which are factors with paper health records. Additionally, it’s relatively easy to make backup copies of digital files to guard against some type of disaster, whereas making copies of paper records is costly, both in terms of time and money and also, effectively doubles the number of filing cabinets or other physical storage space you need.
Medical Record Notes
Almost all forms in PSYBooks have a section where you can enter notes. Most of these notes automatically become part of the client’s medical record, although a few allow you to designate the note as a personal psychotherapy note (i.e., not part of the medical record). PSYBooks breaks medical record notes into two categories: clinical medical record notes and admin medical record notes. This is done to allow you to give permission for a User to see one type of note but not others. For example, you might want your front office staff to be able to see your admin medical record notes (e.g., a note you might have attached to a client payment), but not your clinical medical record notes or your personal psychotherapy notes.