HIPAA compliance deadline is fast approaching

Since the summer, the U.S. Department of Health and Human Services (DHHS) has made two important changes to the Health Insurance Portability and Accountability Act (HIPAA) that affect psychology practitioners:

• Changes were made to the final privacy rule, which governs how patient records and information should be protected--most notably in the patient consent requirement.

• Psychology practitioners were given an extension until 2003 on the compliance due date for the transactions rule--if they filed an extension form in October--which seeks to create a uniform and standardized electronic claims process.

The Practice Directorate advises psychologists to comply with the privacy rule before the April 14 deadline. Early this fall, several modifications, proposed largely by the Bush administration, were made to the privacy rule. Those of particular interest to psychologists include:

• Consent. Health-care providers are no longer required by the privacy rule to obtain patient consent for treatment, payment and health-care operations purposes. The administration said the consent requirement could delay health care for patients. APA took an opposing stance, arguing that this requirement specifically gave patients the right to give or refuse consent for the use of their medical information. Though the provision was stricken from the rule, it is noteworthy that privacy is still protected by the rule's requirement that patient authorization be obtained for disclosure of information for purposes other than treatment, payment or administrative activities. The rule also maintains specific patient authorization for the use or disclosure of psychotherapy notes, despite other changes. And, according to Russ Newman, PhD, JD, APA's executive director for practice, most state laws require patient consent for release of mental health information, and that takes precedence over the federal rule. "Psychologists will secure consent in every state anyway. And, there's no law against doing it, even if a health professional isn't required by law to do so," he says.

• Notice. To counteract the removal of consent, the notice requirement was beefed up a bit. Rather than obtaining generalized consent at the start of treatment, providers must now give patients notice of how their records might be used and give them an opportunity to object. They must also make a good faith effort to obtain written patient acknowledgement of receipt of that notice. "In effect, this rule acts like the consent rule," Newman notes.

The April compliance deadline for the HIPAA privacy rule is fast approaching. Some practitioners who don't file electronic claims and don't take third-party payment may question whether they need to comply. Technically, compliance wouldn't be required in those cases. But, if these practitioners decide to change their practices in the future, there will be no grace period for compliance. And sometimes compliance can be triggered by factors outside the psychologist's control. For example, if a psychologist uses a billing service and that service switches to electronic billing, the psychologist must comply with the privacy rule to continue using the service. So in a world increasingly dominated by technology, it just makes sense to comply, says Newman.

On a related note, a separate HIPAA rule compliance date has come and gone for many psychologists. APA's Practice Organization, in conjunction with the APA Insurance Trust, mailed out 60,000 letters to inform practitioners about the transactions rule compliance date--it was in October--and how to file an extension with DHHS. "Essentially all large payers will require standardized electronic claims as required by this rule. Psychologists will probably be required to follow suit," says Doug Walter, legislative and regulatory counsel in APA's Practice Directorate.

In fact, says Newman, Medicare will most likely require electronic claims in the future, though small or solo practices may be exempt. For now, practitioners who didn't file the extension form and who sub-mit electronic claims before October 2003 must comply with the transactions rule now. Once one claim is e-mailed, for example, then all claims must be filed in the standardized format.

Even so, the Practice Organization believes that practitioners are unlikely to be penalized for not complying with the transactions rule at this time. DHHS has said that its priority at this point is to promote education about compliance.