Bottom Line
It is paramount that organizations understand that they’re in no way obligated to restrict any patient records without the proper procedures for such a restriction having been followed by the patient. The restricted access rule is not self-disclosing and it should not be anticipated that it will become a consistent topic to be covered in a large percentage of patient interactions. It is important to view this rule as having implications for workflows that reach beyond individual patient records and the case-by-case reasoning which motivates a patient to request a record restriction.
Below you will find the ScanSTAT interpretation of the Restricted Access Rule contained in the HITECH Act, along with some recommended policy considerations as it pertains to ScanSTAT service offerings to our clients. This information is offered as educational material only and is not intended to serve as legal counsel.
Minimum Workflow Adjustments and Patient Education
Experts recommend taking an approach of minimum workflow adjustment as it applies to the education of patients regarding their right to restrict certain medical records. This is not to imply that patients should in anyway be deprived of their right to restrict records, rather it is to make clear that an organization will continue to operate in good legal standing by including a description of the process for requesting record restriction in their Notice of Privacy Practices to be distributed to all patients. The reasoning behind this approach is twofold.
Firstly, it is unlikely that patients will fully comprehend the required effort related to maintaining a record as restricted when it is necessary for information to be passed between Covered Entities (CE). A patient must contact each CE that is to interact with the record and set in motion each CE’s process for requesting a record restriction. In the event a patient wants to restrict from a third party payer a certain procedure which was included in a bundle of services, the individual is not likely to comprehend that said third party will likely be able to determine what type of procedure was omitted based on the context provided by accompanying documentation.
Experts recommend that an organization educate the patient of these variables in relation to the burden of payment which will be levied on the requesting individual for the processing of the restriction. Furthermore, the Department of Health and Human Services (HHS) expects that if a situation arises in which the item the patient is seeking to restrict is part of a bundle of services which cannot be unbundled, the provider will inform the patient that in order to restrict the desired record, the patient will be required to pay the full cost of the bundled services.
Consideration of cost and loss of convenience to the individual requesting the restriction is the second driver of the recommendation to maintain a minimum patient education approach. If a patient requests a record restriction, they may not understand that they are required to pay out of pocket for the entire cost of the procedure or services provided.
Should a situation arise in which an individual has requested the restriction of a record and is unable to pay in a manner which is satisfactory to the provider, the provider is under no obligation to do more than make a “reasonable effort” to seek payment. If the provider can show that minimally satisfactory effort was made to collect the amount owed, they’re within their legal right to file the designated record with a third party for reimbursement. Even if a patient would be receiving a discount for services they wish to keep restricted (EXAMPLE: If they fall under Medicare), it’s possible that the individual may not be fully aware of total cost before committing to the restriction process, in this case an organization should be very clear as to what payment is expected at the time of restriction. An example of loss of convenience pertains to the transfer of prescription details from entity to entity. The only sure way for a record to remain restricted may be for the provider to remove the prescription from the EHR and return to paper processing. This can lead to numerous issues as it relates to getting the prescription processed, an aspect which should be communicated to the requesting patient.
It’s important to state once again that these suggestions for patient education regarding the ability to restrict access to certain records are in no way geared toward denying a patient their legal right. Rather our focus is to remove any unneeded burden from both provider and patient.
Burdens on the CE can range from management cost for the flagging of restricted records to the revision or renegotiation of managed care contracts to ensure compliance with this policy. Patients will be forced to pay out of pocket for otherwise covered procedures and subtle exceptions in the restricted access policy may result in patient disillusionment related to personal privacy despite the best effort of the CE to educate their patients.
Best Practices if a Record is Restricted
Should a patient decide to exercise their right to restrict a medical record then a CE must have predetermined policies for keeping the designated record secure and compliant. CEs must rewrite record management protocol to designate a controlled number of staff members to be appropriately trained and educated for the exclusive duty of processing and handling restricted records. In order to ensure the stability of internal controls, it is highly recommended that only senior staff members with intimate organizational knowledge be assigned to an “exclusive workgroup” that handles restricted access records.
The anticipated volume of such records may be low and the cost of assigning comparatively senior personnel is an easily justifiable one as it would significantly decrease the risk of HIPAA violations. With these stakes in mind, an organization can, with efficiently executed secure workflows in place relating to restricted access records, process/handle the records in a low risk, well monitored, restricted environment.
Restricted Access Service Options for ScanSTAT Clients
As a trusted Business Associate, ScanSTAT has the ability to handle client records in nearly any situation. Based on a recent ScanSTAT client survey, many of our clients expressed an interest in granting ScanSTAT access to Restricted Access Records, thereby enrolling ScanSTAT in the previously mentioned “exclusive workgroup” described above. ScanSTAT has developed, documented and trained a task force group to handle Restricted Access Patients. Fees will be customized per client based on EHR and other parameters surrounding the restriction.