|
Fundraising Under HIPAA —The Privacy Rule— From Stuart R. Smith, FAHP - Chair Definitions - Notice of Privacy Practice and Opt Out Notice of Privacy Practices: According to the final Privacy Rule, health care institutions that have a direct treatment relationship with an individual must provide the Notice by the date of the first service encounter on or after April 14, 2003; and make a good faith effort to obtain the patients' written acknowledgement of having received a Notice of Privacy Practices. The Notice must be written in plain language and include a sentence about contacting individuals to raise funds for the institution. In the absence of a direct encounter, the patient's signed acknowledgement is not necessary. Your institution's Notice of Privacy Practices is a statement that outlines how medical record information will be used and the limitations upon its use. A covered entity may not use or disclose PHI in a way that is not mentioned in the Notice. Relative to philanthropy, the Notice of Privacy Practices must contain a sentence about contacting individuals to raise funds. The regulations impose many specific requirements, and care must be taken in drafting the Notice. The Notice of Privacy Practices must be made available to patients. Your institution must post the Notice of Privacy Practices on its Web site and make it available electronically, and post it in prominent places inside the institution. You can also include it in newsletters or other communication vehicles. You do not have to mail the Notice of Privacy Practices to patients prior to sending a fundraising soliciting to them, although the Notice must be in place and available prior to April 14, 2003. This is a common misunderstanding. While many of your compliance officers or others in this position may suggest or even recommend that you mail the Notice of Privacy Practices before soliciting patients, this is not required or necessary. You must post the Notice and make it available and provide a paper copy on request. You should anticipate an increase in media attention to the Privacy Rule as the effective date comes closer, and you should participate in your institution's Privacy Rule roll out to ensure that fundraising efforts are not harmed through oversight or inadvertence. Additionally, grateful patients who are listed on a provider's donor database prior to the compliance date need not receive individual copies of the Notice of Privacy Practices until their next encounter with the provider as a patient. At such time, the Notice of Privacy Practices must be a part of the admissions process. You must include a fundraising sentence in the Notice of Privacy Practices, which may read:
It is not necessary nor should an opt-out reference be included in the Notice of Privacy Practices. The Opt-out Requirement: An opt-out clause relating to fundraising materials must be included in all solicitations to satisfy the regulations, and must be included in all of your solicitations. The sample version that AHP'suggests, and our legal counsel reviewed, states:
This is a direct and simple statement that satisfies the “opt-out” requirement in the regulations. You must also institute a system that will track opt-outs and follow up to ensure that any individual that has opted out is in fact removed from fundraising mailing lists.
|