HIPAA

HIPAA Q & A

Listed below are samples of frequently asked questions that we have received from APA members regarding HIPAA for Psychologists. This Q&A format may be included in an article or posted on your web page. If you receive more detailed questions from your members, please refer them to www.apapractice.org at the APA Practice Directorate. Specifically, any questions regarding the specifics of HIPAA for Psychologists should be referred to either the APA Practice Organization or the APA Insurance Trust.

What is HIPAA for Psychologists?

HIPAA for Psychologists is a compliance tool that has been developed specifically for practicing psychologists. In addition to providing four hours of CE credit from an APA-approved CE sponsor, HIPAA for Psychologists includes:

The necessary state-specific forms that comply with both the Privacy Rule and relevant state law;

The essential policies, procedures, and other documents needed to comply with the Privacy Rule;

A 5% premium discount on Trust-sponsored Professional Liability Insurance for practitioners who pass the CE test.

What is the purpose of the HIPAA Privacy Rule?

The HIPAA Privacy Rule, a regulation promulgated by the U.S. Department of Health and Human Services, establishes a minimum level of privacy protection for health care information. The Privacy Rule establishes a patient's rights regarding the use and disclosure of his/her health care information. It focuses on the application of effective policies, procedures and business service agreements to control the access and use of patient information. The Privacy Rule applies to health care providers, health plans, and health care clearinghouses.

Will the HIPAA Privacy Rule apply to my practice?

We have received a number of inquiries from psychologists who want to know if the HIPAA Privacy Rule will apply to them. In the long run we believe that all psychologists providing health care services will be subject to the Rule. We also believe that it is both wise and prudent to prepare to become HIPAA compliant before the April 14, 2003 deadline for the following reasons:

Insurance and managed care companies are rapidly moving from paper to electronic online transactions for payment and all health care operations.

Circumstances could arise where the need for compliance is triggered by actions over which you may have no control (e.g., a billing service that you use may electronically transmit information about your patient to a third party payer). If this occurs, your entire practice must become HIPAA compliant immediately. After April 14, 2003, there will be no grace period for compliance.

If you bill any third-party source (e.g., HMO, PPO, Medicare) you will undoubtedly fall under the HIPAA regulations.

The only possible exception to this advice would be the very few psychologists who are on a total cash basis, have no interface at any time, now or in the future, with any insurance carrier, hospital, managed care company, state or federal program, billing service, or other third-party payer that currently or in the future may require some form of electronic transaction.

Am I exempt if I do not use electronic transmissions?

You may be exempt currently if you do not submit claims electronically or participate in any third-part payment plans. However, it is unlikely you will be able to avoid all electronic transactions in the future and remain exempt, especially if you or a business associate working on your behalf transacts any health care business electronically (e.g. billing or payment for services, authorization for treatment, utilization review, and verification of coverage, etc.). That is why we recommend that psychologists who provide health care services become HIPAA ready prior to the April 14, 2003 deadline.

How does the HIPAA Privacy Rule impact current laws in my state?

This is one of the most important issues that must be addressed in order to comply with HIPAA regulations and your state's laws. The HIPAA Privacy Rule establishes minimum provisions for the use and disclosure of health care information. If your state laws are more protective than the minimum required by the Privacy Rule, then the state law will apply. If the state law is less protective, the Privacy Rule provision will apply. To comply with HIPAA, it is necessary to compare all laws related to health care delivery and confidentiality in your state with the HIPAA regulations. A decision must then be made regarding which regulation, statute, or court decision provides the greatest level of protection of health care information from the patient's perspective. The completed analysis is then made part of the required "Notice of Privacy Practices Form" to be given to patients. This analysis is performed on a provision-by-provision basis instead of a law-by-law basis. Therefore, this process is very complicated.

Will psychologists in each state be required to provide their own state-specific Notice Form?

The HIPAA Privacy Rule requires that covered health care providers provide their patients with a "Notice Form." The Notice Form describes patients' rights related to the use and disclosure of their health care information. The information in the form must comply with either the HIPAA Privacy Rule requirements or the state statutes, depending on which regulation or statute provides patients with the greatest level of protection of their health care information. Given that the HIPAA regulations are highly technical and voluminous, and there are hundreds of health care provisions in each state, this will be a daunting task for psychologists. It would be very difficult for anyone without legal training or extensive knowledge of the law to develop the required Notice Form.

How can I obtain the information and state-specific forms needed to comply with the HIPAA Privacy Rule?

You basically have four alternatives: (1) review and compare the HIPAA Privacy Rule regulations and your state laws and create your own forms; (2) hire an attorney to do the same work; (3) purchase HIPAA for Psychologists, which has been developed by the APA Practice Organization and the APA Insurance Trust; or (4) purchase another of the products on the market that may not have been tailored specifically for psychologists and may not contain state-specific information.

How will practitioners access HIPAA for Psychologists?

HIPAA for Psychologists is available online or as a CD ROM product. Practitioners who purchase the CD ROM will also be provided with a username and password and have full access to the online version of the product.

All practitioners who access HIPAA for Psychologists through the online product will be able to utilize the following functionalities; (1) note taking screens; (2) progress tracking; and (3) take the CE test. The CD ROM does not have these online interactivities. On the other hand, the CD ROM version may be more beneficial to those practitioners who have slow Internet connections (e.g., 56k modems or less) or those who wish to view the contents of the product where an Internet connection is not available (e.g., on a laptop at an airport). Practitioners will have to be connected to the Internet if they want to take the CE test or receive updates should HIPAA information change.

How can I purchase HIPAA for Psychologists?

HIPAA for Psychologists can be purchased online at the Practice Organization's new practitioner portal: www.apapractice.org.

How much does HIPAA for Psychologists cost?

HIPAA for Psychologists is being offered at prices well below most HIPAA resources in the marketplace. Please note that the additional charge for the CD ROM version covers the cost of materials, handling, packaging, and shipping. The prices are listed below:

	Before April 14, 2003	After April 14, 2003	CD ROM
APA Special Assessment Payers or psychologists insured in the Trust Professional Liability Program	$175	$225	Add $25
Other APA members	$325	$375	Add $25
Non-APA members	$550	$550	Add $25

What if I don't want to purchase HIPAA for Psychologists

HIPAA for Psychologists is entirely voluntary. Practitioners may choose to purchase available products or to conduct their own state preemption analyses and create their own forms, policies, and procedures. Whatever option practitioners choose to take, the most important thing is that they become compliant by the April 14, 2003 deadline.