November 29, 2020
Back to Basics: A Series Presented by your PAHCOM National Advisory Board
There has never been a better time than the present to look closely at our practice operations to see where we need to focus our efforts for system process improvements. When the onset of the communicable virus COVID-19 became the focus of all our lives, our need to return to basics with OSHA requirements has never been more necessary. Since HIPAA Privacy and Security became our focus twenty years ago, OSHA has taken a back seat in many private medical practices.
In most medical practices today, you would be hard-pressed to find a needle stick policy posted anywhere. This is due, in part, because needle sticks are rare given the use of Safety Glide needles. It's important to know that you are still responsible for having a policy and for educating your staff on what to do if one occurs, who to report it to, what their rights are, and knowing your responsibilities as an employer for their safety.
It may surprise you to know that there are many medical practices that do not provide OSHA training and they do not know that it is an annual requirement. Many people think it is only required when someone is hired. In many circumstances the practice may have purchased an OSHA manual twenty years ago and handed it down from practice manager to practice manager knowing that it was required and believing this satisfied the requirement. Therefore, it may not contain current OSHA policy requirements. In most cases, it was never customized with the practice's name. They may never have looked at the policies, implemented them, reviewed them with staff, incorporated them into the operations of the practice and, therefore, may not realize they are out of compliance with federal law. Do you know that an important part of OSHA is the Manufactures Material Safety Data Sheets (MSDS)? Are you aware that effective as of June 2015 the standard is now Hazardous Communication Safety? It requires much more of employers than simple access to a manufacturer data sheet.
Covid-19 has brought about many discussions involving healthcare workers need for personal protective equipment (PPE). The lack of PPE available brings into question our compliance with the occupational safety of our providers and staff. This is a basic right granted to every employee in the United States of America...to be safe in the workplace. When was the last time you viewed your office suite through the eyes of a new patient? Every business day we walk into our suite and may overlook the small things such as a stain or mark on a chair, a chip on a counter, or a loose doorknob. These small issues are all safety hazards. When we see them every day it becomes a small part of our greater landscape.
Once a month, walk through your office like you have never been there before. Open the door, pause, and look around. Is your emergency exit sign lit? Is there a clear path to the exit door? Are there electrical outlets that do not work or are displaced from the wall? Rather than making a mental note, use a safety walk through checklist such as the sample in the PAHCOM member library. Appoint a team member to be your Practice Safety Officer and require that they submit a quarterly report that denotes each monthly walk through to include safety issues found and how those issues were resolved. When you ensure that a safe workplace is a top priority for your staff, patients, and visitors, everyone benefits.
Now is the perfect time for every practice manager to go back to OSHA basics. Pull out the OSHA requirements for healthcare workers and read them. Start by making certain your policies and procedures are complete, and that you have incorporated them into your daily operations. Make sure you do annual OSHA trainings and look for opportunities to educate and train your staff. Try incorporating one safety tip in every monthly staff meeting. Another great way to ensure your practice is following safety regulations is to perform a HIPAA review with your staff every quarter. Now, more than ever, changes to regulations stemming from COVID-19 is the perfect time to make sure everyone has a solid, working understanding of HIPAA and their responsibility in keeping our patient information safe.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) falls under the PAHCOM second Domain-Risk Management. The Privacy Rule grants federal rights for PHI (Protected Health Information) otherwise known as individually identifiable health information. Patients have the right to access their medical record, to inspect it, and to copy it. This does not mean the patient has the right to take their record or make their own copies. They may inspect the original and request copies with a specific written authorization, written in specific terms, i.e. plain language, containing specific information on the PHI to be disclosed, the person or entity disclosing the PHI, the person or entity receiving the PHI, the expiration of the authorization, and the right to revoke. The authorization must also address the disclosure of sensitive PHI including AIDS/HIV, mental health, substance abuse, reportable sexually transmitted infections (STI) and pregnant minors.
Patients have the right to request that their PHI be amended. That, of course, is at the discretion of the healthcare provider and may be denied. Patients have the right to restrict access to PHI and request confidential communications. They may also request an accounting of disclosures.
Under certain circumstances, there are permitted uses and disclosures of PHI without authorization. These may include the treatment, payment (determining eligibility, risk adjustments, billing and collection, etc.), or healthcare operations. Additional reasons involve emergency events or while assisting in a disaster. National priority purposes do not require authorization and include those required by law, public health activities, victims of abuse, neglect, or domestic violence, health oversight activities, judicial and administrative proceedings, law enforcement, decedents, cadaveric organ, eye or tissue donation, research, and worker's compensation.
As a medical practice you are required to inform patients of their rights. You are required to disclose to them your Notice of Privacy Practices before the first in-person encounter with a patient. You are required to display your Notice of Privacy Practices in a clear and prominent location. A summary of the Notice of Privacy Practices may be posted as long as the full document is immediately available to the patient. Patient rights are protected by law and investigated and enforced by the Office of Civil Rights. The best way to protect PHI and your practice are by knowing your patients' rights better than they know them.
PAHCOM offers many great resources including learning and educational opportunities which help keep you compliant with OSHA and HIPAA standards. Check the member library, sign up for lunch time learning, and partner with experts. Collaborating with other professionals helps you take advantage of an opportunity to examine these standards. Additionally, it ensures that you are doing everything you can to educate and protect the safety of your staff, patients and visitors.
Thank you to your National Advisory Board for this great information.
Coley Bennett, CMM, CHA
PAHCOM Member Since 2016
Crystal Bruning, CMM
PAHCOM Member Since 2010
Kathryn Eiler, CMM, HITCM-PP
PAHCOM Member Since 1995
Kim Krause, CMM
PAHCOM Member Since 2004
Look for more "Back to Basics" in the next issue of The PAHCOM Journal