HIPAA Requirements

Transaction and Code Sets

1. Determine if the Transaction and Code Sets Rule applies to your office. An audiology practice must comply with this Rule if any of these tasks are performed electronically (via a computer):

   • Submitting claims or managed care encounter information
   • Checking claim status inquiry and response
   • Checking eligibility and receiving a response
   • Checking referral certifications and authorizations
   • Enrolling and disenrolling in a health plan
   • Receiving health care payments and remittance advice
   • Providing coordination of benefits

2. If none of the above tasks are performed electronically then the practice does not have to comply with this Rule. Note, however, that audiology practices will have to comply with the Code Set portion (mentioned below) as carriers will no longer recognize local codes (codes created for use only by that locality or carrier).
3. Do you bill Medicare and are you a small provider with fewer than 10 full-time equivalent employees?

Effective October 16, 2003, Medicare may not pay claims submitted on paper, with certain exceptions. One of the major exceptions is for claims submitted by “a small provider of services or supplier.” The term “small provider of services or supplier” is defined to mean:

A provider of services with fewer than 25 full-time equivalent employees, and

A physician, practitioner, facility, or supplier (other than provider of services) with fewer than 10 full-time equivalent employees.

The term “provider of services” is defined for Medicare by § 1861(u) of the Social Security Act to include seven specific types of institutional or special purpose providers. This term generally describes hospitals, nursing facilities and other institutional providers that are paid through Medicare fiscal intermediaries. The terms found in the phrase “physician, practitioner, facility or supplier” are used to describe entities that furnish Medicare services described in § 1861(s) of the Act, and are generally paid through Medicare carriers.

If you do not meet the small provider exception, you will be required to submit your Medicare claims electronically effective October 16, 2003. Once you begin submitting your claims electronically you will become a covered entity under HIPAA. (Print the CMS summary: Are Small Providers Covered Entities under HIPAA? 6-23-03)

4. Assign a staff member to implement the HIPAA changes into the practice and to educate others on its importance.
5. Use only Current Procedural Terminology (CPT), HealthCare Common Procedure Coding System (HCPCS), and International Classification of Diseases, Ninth Revision (ICD9) to represent all services performed and goods provided. All local codes typically used by Medicare, Medicaid, and other State agencies, will be eliminated.
6. Contact your software vendor, billing companies and clearinghouses to determine if they are HIPAA compliant. Ask what needs to be completed within the audiology practice to ensure compliance.
7. Contact your contracted health plans to determine if they have specific guidelines for transmitting information once HIPAA goes into effect.

Privacy

1. The Privacy Rule applies to all audiologists.
2. Appoint a Privacy Officer for the practice. This person is responsible for implementing the policy into the practice, training all employees, and being the point person with patients who wish to access, amend, request an accounting, or authorize use and disclosure of their protected health information.
3. Create the following forms & documents:

Notice of Privacy Practices
Notice of Privacy Practices must be posted within the practice and provided to patients in its comprehensive form.

Business Associate Agreement (BAA)

Use and Disclosure Form

Signature Form Stating Patient Has Read and Received the Notice of Privacy Practices
Ideally, this signature line should be added to the Patient Registration Form. (» view sample signature form)

Marketing Release
The Rule defines marketing as “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” This is typically the type of marketing completed by audiology practices.

The Rule requires an authorization for use and disclosures of protected health information (i.e. name, address, phone number, e-mail address, hearing aid serial numbers) for all marketing communications, except in two circumstances: 1) When the communication occurs in a face to face encounter between the audiologist and the individual or 2) when communication involves a promotional gift of nominal value.

Also, if the marketing communication involves “direct or indirect remuneration to the audiologist from a third party," the authorization must state that such remuneration is involved. This type of marketing is typical in audiology practices. For example, indirect remuneration occurs when the practice offers an open house sponsored by a hearing aid manufacturer. The practice sends an invitation to its database and co-ops the cost of the mailing, refreshments, etc. with the manufacturer.

4. Implement policies and procedures:

Policies for Protected Health Information
Create office policies and procedures regarding the use and disclosure of protected health information. Also have policies relating to patient request for access, amendment, denial and accounting of disclosures of protected health information. Document those policies and procedures.

Training
Train all employees on the policies and procedures and document that training.

Disposing of Health Information
Create a policy for disposing of protected health information. Shred all unused hearing aid manufacturer invoices, audiogram and report drafts, etc.

Transporting Health Records
Create a policy for transportation of patient records Transport patient files in a locked case.

National Provider Identifier (NPI)

1. The National Provider Identifier applies to all audiologists submitting claims to third-party carriers, including Medicare, Medicaid, and private insurance companies.
2. Audiologists have until May 23, 2007 to obtain their National Provider Identifier. This can be obtained by submitting either a paper application or via the internet.

» Download paper application or apply online

3. For more information about the National Provider Identifier, read the following documents:

» Overview of the National Provider Number (Final Rule) January, 2004 (CMS)
» NPI Fact Sheets (CMS website)

Employer Identifier

Obtain an Employer Identification Number from the Internal Revenue Service. Use this number on all claims where an employer identification number is requested.

Security

1. Develop internal, office procedures for the creation and use of measures to protect patient data
2. Develop procedures to protect the network or individual computer systems from environmental hazards and outside access.
3. Develop procedures for protecting, controlling, and monitoring access to patient information.
4. Develop procedures for preventing unauthorized access to data transmitted over or housed within a computer system.

Still have questions about the HIPAA requirements? Use the contact form to E-mail the ADA Help Desk.

DISCLAIMER: The foregoing information is provided as a resource for our members. It is not intended and should not be construed as an endorsement of any of the vendors or their products or services; as such, ADA makes no warranty whatsoever, either express or implied, including the warranties of merchantability and fitness for a particular purpose regarding any of the products listed above and makes no recommendation as to the accuracy or suitability of the information for your particular situation. ADA members are encouraged to seek legal counsel to ensure compliance and are responsible for their own knowledge of both federal and state policies as it pertains to HIPAA. Neither ADA, nor any of its officers, directors, agents, employees, committee members or other representatives shall have any liability for any claim, whether founded or unfounded, of any kind whatsoever, including, but not limited to, any claim for costs and legal fees, arising from the use of these opinions.