Course Articles

Editor's note: This text-based course is an edited transcript of the webinar, Documentation in Social Work for Private Practitioners, presented by Gabrielle Juliano-Villani, MSW, LCSW.

Learning Outcomes

After this course, participants will be able to:

• Create clear and concise progress and chart notes that accurately incorporate the contents of the mental health assessment.
• Create effective and efficient treatment plans with clients.
• Develop progress notes and treatment plans that meet insurers' standards.
• Consider the role of ethics in social work documentation.

Introduction

I am excited to be back again doing another presentation on a much-needed topic we do not discuss too often. Documentation is a huge part of social work, especially in private practice. I train folks on how to write progress notes and treatment plans. I have worked in child protection, where documentation was essential because they were court-ordered. I also have had to document very specifically to meet Medicare standards at a previous job. Now, I am in private practice, and we have been audited by Medicaid and other insurers several times. I gathered much of what I am discussing today from that audit and information learned over the years. Thus, I feel like I am well-versed in this topic.

Cultural Competence

For additional information regarding standards and indicators for cultural competence, please review the NASW resource: Standards and Indicators for Cultural Competence in Social Work Practice https://www.socialworkers.org/LinkClick.aspx?fileticket=7dVckZAYUmk=&portalid=0

Why Document?

• How is it used?
• How long does it need to be kept
• Who will read it
  • Audit
  • Disability
  • Workman's comp
  • Subpoenas
  • DHS
  • Clients
  • Grievances
  • Us

I often hear, "I'm in private practice and don't take insurance or keep notes." It is not just about insurance. Ethically, we are required as social workers, as are all other disciplines, to keep notes. Our documentation can be used for a lot of different things. Especially in private practice, nobody will read your notes unless you get audited, or you get grieved against, but we still need to document as if somebody were going to read it. I think about what I would say if an attorney were reading over my shoulder. I learned from child protection because that does happen. You also want to be vague, but not too vague, and we will cover that today. 

Documentation is also critical if an insurance company audits you. They will read it and check it for medical necessity to ensure that no fraud occurs. They also want to ensure you are seeing the client because many issues are seen in Medicare and Medicaid billing, although not usually by social workers. You also give your notes to SSDI if someone is applying for disability. We have been getting many requests throughout the pandemic. I did one yesterday. Disability will want to see all of the notes on the client. Occasionally, they will accept a summary, but usually, they want progress notes and treatment plans. Workman's comp and short-term disability are other areas where they will want to see those notes. Documentation will need to support that an individual is struggling and how that affects their ability to work. If you have a client with an open case with DHS or any court case, your documentation might be subpoenaed for that case. Documentation is also needed for medical necessity to understand your client and their issues better. Clients own the record, and sometimes people forget that. A client may also request your notes. Of course, a grievance or a complaint requires your documentation. Lastly, we also document for us so we can remember week by week what our clients are working on and what they are saying and show the progress that clients have made.

Documentation needs to be kept for usually seven years and can vary state by state and board by board, but in Colorado, it is seven years that we have to keep those records. Even if clients are no longer active on our caseload, we will keep their records. You do that through an electronic health record or paper notes in a filing cabinet. 

NASW Code of Ethics

• Section 3.04 Social Workers' Ethical Responsibilities in Practice Settings
  • (a) Social workers should take reasonable steps to ensure that documentation in electronic and paper records is accurate and reflects the services provided.
  • (b) Social workers should include sufficient and timely documentation in records to facilitate the delivery of services and to ensure continuity of services provided to clients in the future. (NASW, 2021)
  • (c) Social workers' documentation should protect clients' privacy to the extent that is possible and appropriate and should include only information that is directly relevant to the delivery of services.

Our code of ethics requires us to document. We need to take reasonable steps to ensure that documentation in electronic and paper records is accurate and reflects the services provided. Again, this does not just protect our clients and their privacy, but it also protects us. If something were to happen, we want to show that we were seeing this person, and this was our intervention. I am not trying to scare everybody with these scenarios, as they rarely happen. But, if we do it on the front end and take thorough and timely notes, we do not have to worry about it later.

Our documentation should be timely and sufficient to facilitate delivery and ensure client service continuity. So we also have an obligation to future providers as well. "Here's where we left off, what we did and didn't do."

We should also protect clients' privacy to the extent possible and include only information directly relevant to the delivery of services. We want to be somewhat vague. For example, we do not need to say that our client told us their best friend Marsha was selling drugs on this corner. We do not need to document all of these specifics. We could say instead that our client is feeling anxious in her relationship with her best friend. We do not need to put every detail in there as the insurance company does not need to know that information. For example, they only need to know that the client is dealing with anxiety and relationships and how we responded.

Another helpful thing that I learned through my Medicaid audit is to use assessments because that backs up the evidence for medical necessity. For example, you can use the GAD7 (General Anxiety Disorder-7), the PHQ9 (Patient Health Questionnaire-9), et cetera to show the work you did up front to identify their diagnosis. 

You also want to ensure that your practice policies and form consents are signed. This practice may vary depending upon insurance and state, but Medicaid and Colorado want the treatment plan and the initial mental health assessment intake signed by the client. I would suggest you do that for everybody to cover yourself and make sure clients are informed about the services they are getting and how we got to their diagnosis.

Assessments

• Use GAD7, PHQ9, PCL5, etc.
• Make sure all policies and consents signed
• Medicaid typically wants treatment plans, and the initial assessment signed. 

People call an assessment a couple of different things. I usually call it an intake, and Medicaid calls it a mental health assessment. An intake is the first time you meet somebody; it is usually the longest session. 

Each insurer, including Medicaid and Medicare, has different assessment timeliness and update guidelines. Medicaid in Colorado wants us to schedule clients within a week of when they contact us, and you need to sign notes within 48 hours. Completion of a treatment plan is 30 days, so that is what I follow. Medicaid guidelines are the most stringent, so we should be fine if we base everything on their rules. I am sure everybody watching this has been behind on their notes before. I try to get my documentation done as soon as possible, so they do not pile up.

Components of Assessment

• Assessment timeliness, updates
  • Barriers to tx
  • Chief complaint/ problem statement
  • Complete MSE
  • Dx- meets DSM criteria
  • Date/POS/Modality/Clinician Name/Signature
  • Complete biopsychosocial (can be gathered from other sources) 

I want to go through the assessment components because this is what insurers want. If you check all these boxes from the list above, you should be okay with an audit or any other reason somebody might want to look at your notes. You usually get this information when you first meet with them.

If this client returns, you will want to update your assessment with any new information. First, we start with the question, "Why are you here?" or, "What's going on?" Their answer will be their chief complaint or problem statement.

You will also want to note any barriers to treatment. There may be cognitive deficits or logistics like they do not have a computer or a bus pass. You will want to document those as well.

Each insurer, including Medicaid and Medicare, has different guidelines on assessment timeliness and updates. Medicaid in Colorado wants us to schedule clients within a week of when they contact us, and our notes need signing within 48 hours. A treatment plan needs to be completed within 30 days, so that is what I base my timelines on, as Medicaid guidelines are the most stringent. If we base everything on their rules, we should be fine.

I am sure everybody watching this has been behind on their notes before. I try to get my documentation done as soon as possible, so they do not pile up.

An MSE (Mental State Examination) should always be completed. You also want to talk about their mood, affect, how they were dressed, if everything was within normal limits, and their diagnosis. You can do some of that before you meet with them. I like sending clients the assessments, like the PHQ-9 and the GAD-7, ahead of time. If I think they are coming to me for PTSD, I will also send them the PCL-5 (Posttraumatic Stress Disorder Checklist for DSM-5).

Usually, from their chief complaint, you can start to understand what their diagnosis might be, but you want to make sure it meets the DSM criteria. I copy and paste the symptoms they are telling me from the DSM. That way, it is all right there and using the DSM-specific language.

You will want to have the assessment's date and place of service. You must document if it was telehealth or if you met with somebody in the community, at their home, or in your office. You also want to include any modalities that you used. However, intervention is not typically done in an assessment, so you do not need to say that you did CBT (cognitive behavioral therapy) or anything like that. Make sure that it is signed with your name and credentials.

A biopsychosocial summary should include the clients' work, legal, military, and family histories. You can gather this information from other sources if needed. Medicare puts this in its guidelines. One example would be collecting a child's history from their doctor, referral source, or parents. I document, "Parents are reporting this," or "The referral came from a social worker in home healthcare, and they are saying this."

• Risk assessment - HI/SI ◂ Safety plan
  • Medical and psychiatric hx
  • Psychiatric/MH hospitalization hx
  • Readiness for admission
  • Substance abuse
  • Duration and start/end time
  • Plan for next contact and any follow-up
  • Legible! 

During a risk assessment, you must determine if there is any homicidal or suicidal ideation and make sure you document that. I am very blunt about this question. Sometimes people ask me about how I assess for that. I usually frame it as me getting to know the client. "I need to know if you have any homicidal or suicidal ideation." They might initially say no, but make some concerning statements during the conversation. I will then need to reassess that. If they report anything, you want to document a safety plan and put it into their chart.

You also want to ensure you are documenting if they have had any psych hospitalizations. I may ask, "Have you been in therapy before? Were you diagnosed with anything at that time? What did that look like?" If you are working with mandated clients and looking at readiness for admission, they might never be ready. However, we should document the stage of change and if they are appropriate or not appropriate for treatment. We then need to note if we are referring them out and why.

If there is any substance abuse, we need to document that. We need to know if we are a good fit for them. In my practice, we do not have many people with substance abuse experience, so we refer cases out. 

You must document the start and the end time as all insurances want to know the duration. This is also how we bill and where a lot of fraud happens. We want to bill appropriately for that time. They are very picky in Colorado and want to know the precise times. If you did not start your session until 2:03 PM, you put 2:03 PM and exactly when you ended. 

Are you going to be seeing this client weekly? Are you seeing them next week? Are you seeing them on March 14th, 2022? Put those dates and any other follow-up with third parties they may need. If you need to get a release of information signed or if you already have one signed for their case worker, you need to follow up with the caseworker about them.

All documentation needs to be legible. Poor handwriting is not an excuse if you do not use an electronic health record. Your notes need to be able to be read. Again, this not only protects the client, but it also protects you. It shows that you met with them and your interventions so that you can get paid for your time.

• Support with medical necessity
  • Medication
  • Client's name on pages/record
  • Document their ability/willingness to adhere to tx plan
  • How and why do they meet criteria for this level of care?
  • Impact on functioning

Insurances want to know that everything you are doing is medically necessary or that they will not pay for it. I always ask clients to give me their med list so that we have that, especially for Medicare and Medicaid.

Other tips to help you pass an audit include ensuring the client's name and date of birth are on their record or any pages. If you use an electronic health record, it will do this for you. You also want to document their ability and willingness to adhere to the treatment plan. I will talk about that a little bit more later. We do not want to give clients unrealistic treatment plan goals they will never meet because their treatment will not be covered. You also want to document how they meet this level of care criteria. Are they meeting you for outpatient therapy once a week, or is this somebody in crisis and struggling with suicidal ideation and self-harm? If so, this might be more appropriate for intensive outpatient or even hospitalization, depending on the situation. The impact on functioning is crucial to document. How does depression, anxiety, anger, or whatever impact their functioning? Are they not able to go to work or school?

How do we get to a diagnosis and treatment plan when 800 different things happen in their lives? We want to string all these components nicely together. It is called the golden thread. First, I ask about any previous diagnoses because that can be helpful. For example, they may have five different issues that they are having. I am going to look for themes and patterns. I might also ask the client to give me a problem list. Where are the problems in your life and the precipitants to this current episode?

I will often hear, "It came out of nowhere. I just started feeling this way." We all know that is not always true. I may ask, "What was going on when you started feeling this depression? What was the catalyst for that?" I hear things as my mom died or we moved. I ask about any current behaviors related to that so that I can understand it a little bit better.

How does hopelessness look? Does that mean you are sad or want to die? Or does that mean you are not getting out of bed? Beliefs, thoughts, and behaviors tie all of this together so we have a better understanding of how we can build their treatment plan.

We also want to know their goals. "What do you want to work on together? What will it look like when our work is done?" This can be a tricky question for people to answer. It was a hard question for me to respond to with my therapist. They may want to get on meds or get out of bed in the morning and not feel so sad. Knowing this information is a good starting place.

Case Conceptualization

• Make sure you are asking of any previous dx
  • Look for themes and patterns
    • Problem list
    • Precipitants to current episode or to problem
    • Current beliefs/thoughts
    • Current behaviors
    • What are their goals?
    • How will we know when our work is done? 

This information helps us to conceptualize the case, especially with current events. An issue at work or conflict with their mom or boyfriend may cause anger or anxiety. I write these down because that helps me visualize everything and make a treatment plan. In my experience, that is not how it always works, but whatever their goal is ("get out of bed"), I will write that up in their language.

Treatment Plans

• Client participation
  • Timeliness - usually within 30 days of first contact
• Treatment plans are:
  • Measurable
  • Specific, objective, realistic
  • Culturally sensitive
  • Individualized
  • Strengths-based

Again, the treatment plan should be completed within 30 days of first contact. Goals need to be measurable, specific, objective, and realistic. If someone says, "I'm depressed, and I can't get out of bed and brush my teeth." We will not say, "Okay, your goal is to run a half marathon in the next six months." We need it to be realistic. Again, it might be something minimal, and that is fine.

Goals also need to be culturally sensitive. We can always be better as social workers. We want to examine the client's culture and how it relates to their diagnosis or goals.

They also need to be individualized as every person is unique. We will not have the same treatment plan for every client. Some clients are into meditating and using some mindfulness to manage their anxiety, and other clients do not. They may want to do something else like go for a run.

Goals should be strength-based. This type of treatment is ingrained in us as social workers, but we want to document it in a strength-based way. I learned a good lesson a long time ago working in child protection. I had written some things in a client's treatment plan that were not strength-based, as I was on autopilot and did not think about it. It was court-ordered, read in front of the client, and did not go over well. It was a good learning experience to slow down and make sure I use culturally sensitive and strength-based language.

SMART Goals

• S - Specific
• M - Measurable
• A - Attainable/Achievable
• R - Realistic
• T - Timely

**Wiley

It is vital to make your goals SMART. They must be specific, measurable, attainable, realistic, and timely. This helps us and others know when they have met them. How will they take steps to meet those goals if they are not specific, or how will they know if goals are satisfied if not measurable? If they cannot meet them, they are not achievable. Most will not be in treatment for 20 years, so the goals need to be timely.

I have a little note down here for Wiley. If you are in private practice, community mental health, or working with clients in therapy in some way, I highly recommend that you buy this book. It is $20 on Amazon and has a PDF version that comes on a CD-ROM (if you still have one of those). This is where I start the foundation for my treatment plan. Figure 1 is an example of a treatment plan that is not smart.

Figure 1. An example of a treatment plan with goals that are not smart.

This is a screenshot from my EHR (electronic medical record); obviously, Johnny Appleseed is a fake client. Every EHR is different; particularly in simple practice, you can easily make treatment plans. They have uploaded "Wiley" in there, which is fantastic. You can go from the diagnosis, and then you can click a bunch of checkboxes. However, they are not smart goals. Figure 2 is the same treatment plan with a smart goal.

Figure 2. An example of a treatment goal that is smart.

The objectives are always more specific than the goals. The goal is bigger, the objective is smaller, and the interventions are how you will meet those. Let's take the example of Johnny Appleseed. He is seven years old and has a generalized anxiety disorder. The presenting problem is anxiety. He has excessive or unrealistic worry that is difficult to control, occurring more days than not for at least six months about several events or activities. It is written like this as it is part of the criteria for generalized anxiety disorder.

His goal is to stabilize his anxiety level while increasing his ability to function daily. But how, when, where, how often is he going to do that? We want to explore the client's schema and self-talk that mediate his fear response, assist him in challenging the biases, and replace the distorted messages with reality-based alternatives. Positive, realistic self-talk will increase his self-confidence in coping with irrational fears. To improve this, I can put in a scale to either increase or decrease the anxiety level.

Again, we want our treatment plans to be appropriate, individualized, and culturally sensitive for our clients. You do not need to spend hours upon hours writing unique treatment plans for each client. You can easily add in different language to make it individualized and smart. You can see that both EMRs have the same diagnoses, presenting problems, and behavioral definitions. The smart goal in the second one is to stabilize his anxiety level to a five out of 10 from a reported eight out of 10 while increasing his ability to function daily over the next six months. Previously, we did not have any of that in there as we were just going to stabilize his anxiety level. I also added that he reports his anxiety as an eight out of 10 daily. We want to get it down to a five out of 10, and we will do that every day for the next six months while we work together.

In the objective, I used the same language of "identify, challenge, and replace bias, fearful self-talk with positive, realistic, and empowering self-talk, but I added that he would do that at least once a day, every day for the next six months. That might be too much for someone, and I could downgrade it to three times a week, and he is going to report that to you.

I also added more specific language to the intervention. Previously, the client was going to increase his self-confidence when coping with irrational fears without documentation of how to do that. I added that we would do CBT (cognitive behavioral therapy) and weekly therapy sessions. These changes took me about four minutes to change on the EMR. I added different language to make it a smart goal.

As I mentioned earlier, I like to use a scale. For example, ask your client, "How bad is your anxiety on a day to day? What is the average?" They may say it is 20 out of 10. I may say, "Do you think you can get it to an 18 out of 10 when working with me? Use that with your clients, and then add the words increase and decrease.

Medical Necessity

• Healthcare services that a provider, using clinical judgment, would provide to a patient for the purpose of evaluating, diagnosing or treating an illness/disease
• In accordance with the generally accepted standards of medical practice
• Clinically appropriate, in terms of type, frequency, extent, site and duration, and considered effective for the patient's illness, injury, or disease; and,
• Not primarily for the convenience of the patient or physician, and not more costly than an alternative service or sequence of services at least as likely to produce equivalent therapeutic or diagnostic results as to the diagnosis or treatment of that patient's illness, injury, or disease. (Cigna)

I will switch gears to medical necessity, which is the basis for insurance, Medicaid, and Medicare. They need to see that something is medically necessary to cover it. As a social worker, I think medical necessity can be complicated and layered. We can certainly use our clinical judgment to best help our clients and show that services are medically necessary, just like MDs. Physicians will not automatically approve different meds or procedures because it would not be appropriate. The same thing happens to us, unfortunately. Medical necessity are services that a healthcare provider using clinical judgment would provide to a patient to evaluate, diagnose, or treat an illness or disease. In all our assessments, we use our clinical judgment to treat or diagnose our clients' mental concerns.

We also treat following accepted standards of medical practice. We probably would not see somebody coming to us for a moderate depressive episode or see them five times a week. That is, as far as I know, a type of treatment not generally accepted. If it was in an intensive outpatient facility and something deeper going on, then that may be an accepted standard of medical practice, and we would document that. Again, we would need to use our clinical judgment. This is the evidence the client is showing me, which is why it meets that level of care.

We also must ensure our treatment is clinically appropriate in terms of type, frequency, extent, site, duration, and considered effective for the patient's illness, injury, or disease. I had a client who was in crisis, and I had to see them twice a week. I ended up doing three sessions because we also had to do a family session. It was clinically appropriate with what was happening with that client, and we needed the family there. I made sure to document all of that. I do not do that level of treatment with other clients or every week. Still, it was appropriate when that client was specifically in crisis and needed that additional support to prevent a higher level of care. 

You may not have your license at first, but you have your judgment. I do not want people to be afraid about everything I just said and feel empowered that you know what you are doing. I have been there many times with an insurance company pushing back on me. However, I am in control as I know what is happening with my client, and they are experts in what they need.

Your services cannot be for the convenience of the patient or the physician, nor can they be more costly than an alternative service. Insurance companies always want to pay for the least invasive level of care. They will ask why somebody has to go to an intensive outpatient or a  partial hospitalization program. 

• Evidence-based
• Views of healthcare providers practicing in clinical areas
• Specialty Society Recommendations 

We must back up medical necessity using evidence-based practice, as we should in all treatments. CBT, DBT (dialectical behavioral therapy), and EMDR (eye movement desensitization and reprocessing) are all evidence-based and can be helpful. You can consult with other social workers, use a consulting group, collaborate with the client's primary care doctor, or see if NASW has some recommendations to back up medical necessity. I talk about medical necessity in every progress note that I write. We have a little check box that we use to deem why it is medically necessary. For example, "We need to see this client for a more extended session because we are doing internal family systems work, or "We're doing EMDR, and it's medically necessary because of new emerging symptoms to stabilize the client.

Expectations of Outpatient Treatment

• The therapist and individual will collaborate to establish clearly defined treatment objectives and to identify ways to measure improvement.
• From time to time, individuals may occasionally have other unresolved problems, but their level of functioning has been restored to baseline. The presence of unresolved issues does not necessarily indicate that continued outpatient therapy is medically necessary. 
• The type and degree of functional impairment will be reflected in the treatment plan. 

I also put in some expectations of outpatient treatment. I got these from United Healthcare. You and the individual collaborate to establish clearly defined treatment objectives and to identify ways to measure improvements. Hopefully, you can do that in the treatment plan with the client. If not, you are considering what they have told you and putting that into some clinical language.

Individuals might have unresolved problems, but their level of functioning has been restored to baseline. Or their baseline is a lot higher than you or the client would like, but that is their baseline. Unresolved issues do not necessarily indicate that continued outpatient therapy is medically necessary. You may have a lot of things to say about this, but they say something not resolved is not a reason to continue treatment. These scenarios happen all the time. Things might not get fixed, but they may now have better coping skills, so they do not need to see you anymore.

You also want to document the type, and degree of functional impairment as this will impact the client, so you want to put that in your treatment plan. We are hopefully reducing or alleviating the individual symptoms. For example, we may see their anxiety going from an eight to 10 to a five to 10, or we are getting them to their baseline or improving their level of functioning. You always want to get them to a higher level of care. "We need to meet with this client twice weekly to prevent them from a more intensive level of care."

I want to mention family therapy as I see this a lot. People ask, "How do you bill?" or "How do you work with a family if you are doing couples therapy?" If you want to bill insurance, that family unit is seen as the patient, but to play the game, you need to have an identified patient if you are doing family therapy.

Purpose of Outpatient

• Reduce or alleviate the individual's symptoms,
• Return individual to baseline or improve the level of functioning; and/or
• Prevent imminent deterioration that would lead to a need for admission to a more intensive level of care.
• Family- need identified patient

We are hopefully reducing or alleviating the individual symptoms. We may see their anxiety is going from an eight to 10 to a five to 10, or we are getting them to their baseline or improving their level of functioning. You always want to get them to a higher level of care. "We need to meet with this client twice weekly to prevent them from a more intensive level of care."

I want to mention family therapy as I see this a lot. People ask, "How do you bill?" or "How do you work with a family if you are doing couples therapy?" If you want to bill insurance, that family unit is seen as the patient, but to play the game, you need to have an identified patient with a diagnosis if you are doing family therapy. The work you are doing together needs to alleviate the client's issues.

Components of Progress Notes

• Nature and Frequency of services correspond to those ordered on the tx plan (document if a change is needed)
  • DOS
  • Place
  • Time
  • Duration
  • Who is present
  • CPT
  • Signed with credentials 

Progress notes have specific components to cover yourself and meet insurance standards for medical necessity. First, you need to have the nature and the frequency of services. These services need to correspond to what is on the treatment plan. This was a big one with my Medicaid audit. If we say that we are going to meet the client weekly in that treatment plan, and then we decide we will meet them every other week, we need to document that.

The date of service (DOS) is crucial. When did you see them and where? You also want to document the time and the duration. Again, if you started at 2:03 PM, put that on there. If you have an EHR, this does all that stuff for you. But if you are writing paper notes, you want to ensure that you are writing those timestamps down. Who was there? Was it just your client? Or did they have their mom or caregiver there? Who else is involved? The CPT code is the billing code. The EHR will do this for you as well. If you do not have one, you will have to write it on there. CPT billing could be a whole other training. Finally, it needs to be signed with your credentials, which is a specific requirement of Medicaid. If you get audited, they can easily see what you are working on, when, and how.

Each note refers to the goals and objectives from the current treatment plan being addressed in that session. When I type my note, we have check boxes and a narrative section where I say what we worked on and how the client responded. I also assign it to a particular goal like, "Per goal one, objective two of the treatment plan." I say that in every single note, and then I just leave it every week, or if we are working on something else, I change it.

Clinical interventions and techniques also need to be in your progress note. I also have check boxes for these and a note template I made. I include psychoeducation EMDR, CBT thought record, DBT distress tolerance skills, IFS work, ACT, and Gottman on those boxes. You can add whatever you do to the record along with the client's response to that. They may be into it and want to add some meditation, or they may resist and say, "I don't want to do that." I document all of that.

If you need an interpreter, you also want to document that. I mentioned earlier that you must always document suicidal or homicidal ideation ethically and for liability. If somebody talks about suicidal ideation the prior week, and then you do not document the next week, that will be a problem. You want to ensure you are addressing that issue until it resolves. If they are feeling better this week, you need to document that and note if this is resolved or if you are still working on it.

A referral is needed if they discuss medical, dental, or substance abuse issues. We do not want to cross the line by giving medical advice. However, we need to document and refer or empower the client to do that independently.

If somebody does not show up or drops out of services, you want to document that you reached out to them because there is a liability if something happens. "This client no-showed last Tuesday. I called them on Tuesday and left a message but didn't hear back. I called them again on Wednesday and sent them a text, but I didn't hear back. Thursday, the client texted and apologized and said that they were in the hospital." It is essential to cover yourself.

Summary

You want to make sure that you have all of that stuff documented. And that is it. Thanks for attending.

Questions and Answers

What typically prompts an audit?

It can be a lot of different things. Some people never get audited, and some people get audited more often. Usually, they just randomly select people like every quarter. I know Anthem does this. Some things can be a red flag. If you are billing a lot and seeing a client two or three times a week for months, this might initiate an audit. Another reason could be the types of billing codes that you use. There are normal billing codes, and then there are a bunch of add-ons that you can do to get some extra money if there is a crisis or you need a longer assessment. Using those add-on codes may also trigger an audit.

What are some common mistakes you see in the documentation that social workers can avoid?

A common mistake is not putting the exact duration. This is the number one issue in fraud cases, specifically with Medicare billing. I cannot emphasize enough to document the start and end times. Social workers also need to ensure that the codes match. Each note also needs to refer to the goal and objectives of the current treatment plan. Many do not do that every single time, but it will cover you if an issue arises.

Should there be a two-factor authentication if we use an electronic medical system? And do paper records need to be behind a lock? 

If you are keeping paper records in Colorado, it needs to be behind two locks. My documentation is in a locked filing cabinet and a locked office. Electronic documentation should be encrypted. I also back up data in case something ever happens. 

You spoke about case conceptualization. What is the best practice for conceptualizing a case or articulating that in writing? We want to ensure we are not giving too much but clearly articulating what is happening with our client.

I do not document every detail, but I will write down what they report to me. I always think about the impact on functioning and focus on behaviors, patterns, symptomology, and how that impacts their functioning.

References

Boylan, M. Teays, W. (eds.) (2022). Ethics in the AI, technology, and information age. Rowman & Littlefield Publishers.

Cigna Standards and Guidelines for Medical Necessity. (2020, April). Cigna for Health Care Providers. https://www.cigna.com/static/www-cigna-com/docs/health-care-providers/medicalnecessitycriteria.pdf

Kivistö, M. & Hautala, S. (2020). Structuration processes of client-oriented and system-oriented social work practice: The viewpoint of client documentation. Nordic Social Work Research. DOI:10.1080/2156857X.2020.1848907

Merrill, C. A., Maheu, M. M., Drude, K. P., Groshong, L. W., Coleman, M., & Hilty, D. M. (2022). CTiBS and clinical social work: Telebehavioral health competencies for LCSWs in the age of COVID-19. Clin Soc Work Journal. https://doi.org/10.1007/s10615-021-00827-7

Miller, C. A. (2021). Social work documentation: A guide to strengthening your case recording, 2nd edition. Nancy L. Sidell. Social Work, 66(1), 84. https://doi.org/10.1093/sw/swaa044

Nadler, L. E., Ogden, S. N., Scheffey, K. L., Cronholm, P. F., & Dichter, M. E. (2021). Provider practices and perspectives regarding collection and documentation of gender identity. Journal of Homosexuality, 68(6), 901–913. https://doi.org/10.1080/00918369.2019.1667162

National Association of Social Workers (NASW). (2021). NASW - National Association of Social Workers. https://www.socialworkers.org/About/Ethics/Code-of-Ethics/Code-of-Ethics-English

Reamer, F. G. (2005). Documentation in social work: Evolving ethical and risk-management standards. Social Work, 50(4), 325–334. https://doi.org/10.1093/sw/50.4.325

Savaya, R. (2010). Enhancing student awareness of the importance of full and accurate documentation in social work practice. Social Work Education, 29(6), 660-669. DOI: 10.1080/02615470903552006

Schwartz, A. L., Chen, Y., Jagmin, C. L., Verbrugge, D. J., Brennan, T. A., Groeneveld, P. W., & Newhouse, J. R. (2022). Coverage denials: Government and private insurer policies for medical necessity In Medicare. Health Affairs, 41(1), 120–128. https://doi.org/10.1377/hlthaff.2021.01054

Singh, S., Kolinski, J., Alme, C., & Sinson, G. (2022). The growing epidemic of insurance denials: A frontline perspective. Journal of Hospital Medicine, https://doi.org/10.1002/jhm.2775

Zerden, L. de S., Lombardi, B. M., Richman, E. L., Fraher, E. P., & Shoenbill, K. A. (2021). Harnessing the electronic health record to advance integrated care. Families, Systems & Health: The Journal of Collaborative Family HealthCare, 39(1), 77–88. https://doi.org/10.1037/fsh0000584

Citation

Juliano-Villani, G. (2022). Documentation in social work for private practitioners. Continued Social Work, Article 160. Available from www.continued.com/social-work

Editor’s note: This text-based course is an edited transcript of the webinar, HIPAA for Allied Health Professionals, presented by Kim Cavitt, AuD.

Learning Outcomes

After this course, participants will be able to:

• List the main components of HIPAA.
• List the 18 pieces of protected health information.
• Identify specifics of the Privacy Rule and explain how it applies to texting, email, and marketing in a healthcare setting.

Components of HIPAA

HIPAA was a bipartisan piece of legislation in the Clinton administration. HIPAA stands for the Health Insurance Accountability and Portability Act of 1996. The main website for HIPAA information is https://www.hhs.gov/hipaa/, but you will see specific links in this presentation (copy and paste them into your browser) that will direct you to additional information typically from Health and Human Services in the Office of Civil Rights, specifically related to the government and HIPAA. As links often change, please search from the main website previously listed if the link doesn't work.

After 2013, HIPAA has civil and criminal penalties and addresses the following:

• Standard Transaction and Code Sets
• National Provider Identifier
• National Employer Identifier
• HIPAA 5010
• Security
• HITECH (Breach Notification)
• Privacy
  • Marketing
  • Business Associates

The first thing to think about regarding HIPAA is, are you a covered entity under HIPAA? A general rule of thumb is if you transmit any information electronically, then you are subject to HIPAA rules. You are a covered entity anytime you're submitting a claim to a third-party entity or submitting health information or medical records to a third party.

Standard Transaction and Code Sets

Let's start with standard transaction code sets. HIPAA requires that all covered entities use standard transaction and code sets such as CPT (Current Procedural Terminology), ICD 10 (International Classification of Diseases, 10th revision), or HCPCS (Healthcare Common Procedure Coding System), which are the codes for hardware and the services surrounding the hardware or the pharmaceutical (or that type of entity). These are the code sets that you're supposed to follow. 

National Provider Identifier (NPI)

Your national provider identifier (NPI) is your unique personal identification number that is now going to follow you for your entire career. That is given out by the national plan and provider enumeration system, or NPPES. You can go to their website at https://nppes.cms.hhs.gov/#/ to get an NPI or look up an NPI, especially if you need it to go out on a claim. Just like the NPI, this number moves with a provider from employer to employer throughout their career. If you submit the information correctly the first time, a new NPI number is usually generated in one to three hours. 

National Employer Identifier

The next item is the national employer identifier (EIN). The EIN is a unique number that's assigned to your business by the Internal Revenue Service. It's oftentimes also known as your tax identification number. Every business has an EIN except for businesses that are sole proprietors, where the business is operating under the social security number of the owner. Your practice or organization needs an organizational NPI. Remember, the NPI is going to be given out by the NPPES system and the EIN is going to be given out by the IRS.

HIPAA 5010

HIPAA 5010 was a systems update that went into effect in 2012. This change allowed for the additional characters of ICD 10 and really affected office management systems, electronic health record systems, electronic medical record systems, software vendors, and clearinghouses. Also, this is where they made the switch from working in a CMS 1500 format, where the electronic format mirrored the form, to working in a format now that's called an 837P format.

The 837 claims submission format was set forth by HIPAA 5010. You should ask your office management vendor or electronic health system (EMR) vendor how your system operates. Many systems, except for certified EHRs, still operate in a 1500 format. Your clearinghouse is doing the conversion to the 837 format. The CMS 1500 format is everything around the paper form that's read, including its electronic version. If your system operates in the 1500 format, or you're still using paper, everything is going to be converted to an 837, either at your clearinghouse or the payer. 

Protected Health Information (PHI)

Let's talk about the 18 pieces of protected health information. All 18 pieces are equally protected. That means that they cannot be shared without the patient's authorization except for three exceptions, which we'll talk about in a moment.

• Names
• Street number and name, city, and last two digits of the zip code
• Dates directly related to the individual (birthdate)
• Phone number
• Fax number
• Email address
• Social security number
• Medical record number
• Health insurance member number
• Account numbers
• Certificate or license numbers
• Vehicle identifiers and serial numbers
• Device identifiers and serial numbers
• URLs
• IP addresses
• Biometric indicators
  • Finger, retinal, and voiceprints
• Photos
• Any unique identifying number, characteristic or code

Someone's first and last names are protected. In my case, Kimberly Cavitt is a piece of protected health information. Your street number, name, city, and last two digits of your zip code are protected. For example, 2480 State St., Chicago, 60 is protected. Any dates directly related to the individual, such as a birthday, are protected. Your phone number, whether cell or landline, and your fax number are protected. Your email address and social security number are also PHI. I want to really reiterate here that someone's name is equally protected as their social security number. Your medical record number, health insurance member number, account number, certificate or license number, and vehicle identifiers or serial numbers are protected as well.

Any device identifiers or serial numbers are included as PHI. If your patient has hardware, such as a hearing aid or an augmentative communication device, that has a serial number and that number is uniquely assigned to that patient, that serial number is protected. In addition, URLs, IP addresses, and biomedical indicators including finger, retinal, and voiceprints are protected. I cannot stress enough that a patient's image is protected. Before you put a video with a patient on social media, you really need to make sure that you get the patient's authorization to use their image. Again, any unique identifier number, characteristic, or code is also protected.

HIPAA Security Rule

The Security Rule is an extension of the Privacy Policy and went into effect on April 20, 2005. HIPAA security is about protecting the electronic formats that are controlling patient information. Electronic patient health information is called ePHI. HIPAA security is around ePHI and everything that you store. When it comes to security, you have to think about everything in your office that stores or transmits patient information. Providers need to have administrative safeguards, physical safeguards, and technical safeguards. You also need written policies and procedures related to these security provisions. In addition, you need to document how people have been trained and what your audit and sanction processes are in your security policies. We're going to break this down a little bit.

Risk Assessment

The first thing you need to do is a risk assessment. What do allied health professionals need to think about when they're thinking about HIPAA? You need to think about computers, phones, tablets, fax machines, and answering machines. Remember, a patient's voice and any protected health information they've shared on an answering machine are protected and you need to go through a risk assessment on it. Also think about any test equipment that stores or transmits ePHI as well as your EHR, EMR, and OMS vendors because they have access to your information. While NOAH is unique to audiology, it would also be included in this list. You need policies around anything that is storing or transmitting information and how that information is being protected.

Administrative Safeguards

The first step is administrative safeguards. What do you have in place to reduce the risk of breaches of protected health information that is stored electronically? What policies and procedures do you have? Every practice needs a security officer. You need to know who is responsible for the securitization of this ePHI. If we are talking about a hospital or large clinic, you probably have a security officer that is the head of IT or the CIO at your entity or facility. Those of you in private practice or nonprofit, you are going to need to assign someone as your security officer. If you have a practice manager in a bigger entity, they or the executive director of a nonprofit would be your security officer. If it's an ownership of a private practice, it's typically the owner that is the security officer.

All the security officers and every facility need to regulate who has access to protected health information and by what means. For example, what equipment can they access PHI on? Can they use personal devices or access the PHI at home? Can every employee access it or do some folks have more access than others? It's all about minimally necessary access. You need to look at each one of your staff members and determine for that position, how, where, and when can they access electronic protected health information. You need training and accountability. You should authorize and document either by individual name or by position who has access to ePHI including where, when, and how. You need to train staff on these policies and procedures once they're created. Audit your staff to make sure you're following the policies and sanction staff who do not comply. That sanction has to be documented. I strongly recommend that you have a process of sanctioning that's outlined in your HR materials including employee manuals. It can include firing or termination.

Physical Safeguards

Physical safeguards are about the actual hardware that is storing and transmitting things. You have to limit access and control to that hardware. Think about who can have access to the equipment, when, and how. Are laptops and other hardware locked down? How can people move laptops or personal devices from location to location? Can they take them home? You need to have facility access and control over any hardware that stores and transmits EHR. You should have workstation and device security, including proper use of electronic devices and workstations. Ensure that you have policies and procedures related to the transfer, removal, disposal, and reuse of both ePHI and the hardware that is storing ePHI. How do you get rid of a laptop? How do you get rid of a personal device that has access to ePHI? You have to have this all documented for your practice.

Technical Safeguards

Technical safeguards include how we control access to the software. That is typically through password protection or authentication. How are you gaining access from a software perspective to systems that hold ePHI? One thing that a lot of entities are looking into is two-step authentication so information is not just password protected. There's a second step of authentication. You're going to need to audit and determine how you are going to take your policies and make sure your staff is following them. You have to audit how your policies are being followed. Be sure that whatever electronic system you are using to store or transmit ePHI does not allow things to be improperly altered or destroyed.

If you are using a notation system for your notes, you need to have a system that doesn't allow those notes to be permanently deleted. Certified type systems, like if you had a certified EHR, will let you hide things that you've amended, appended, or modified, but they never can be deleted. They can never permanently go away. It's something that you can always see and pull up if need be. You should never be operating in any form of an electronic patient management system that lets you delete information. I know I'm saying this repetitively in a lot of different ways, but it's really important. You should never be working in a system where you're just putting notes, for example, in Notes on an Apple device or in Word or in Excel and then you can just delete it and wipe it. You have to be able to be in a system that cannot be altered. Then you need to put in place all of the software around transmission security so that you can reduce the risk of being hacked.

Mobile Devices and HIPAA Security

HIPAA has a lot of implications and things you have to consider around using mobile devices. I'm going to consider mobile devices for us today to be a laptop, a tablet, a phone, or a smartwatch. We have to be very cognizant of all of the rules around these mobile devices.

Every practice needs to consider if they want to allow, by policy, their staff to access ePHI on mobile devices that the facility or practice does not own? That's your first decision. If you do allow that, then you need to make policies around those two separate pathways. Many entities that work in large medical facilities would never allow people to access ePHI on a personal device. They have a lot of rules around that and you have to log into a portal to be able to do anything using multi-step authentication. You have to determine what the rules are for your practice. Let's say you are allowing access to ePHI on a mobile device. You need to make sure that you use a password or user authentication. There have to be steps to be able to open the device itself before getting into the software. The first step is having to use a password to get into the laptop or other device.

You need to enable and install encryption. We should not be communicating any ePHI to any entity, including the patient, without going through an encrypted service. You can communicate with the patient about an appointment. You can communicate with the patient about services they need, such as a COVID test, what your policies are, or reminders. But you cannot communicate any ePHI, any test results, or anything specific to that patient without going through an encrypted service.

Install and activate remote wiping and/or remote disabling. I am an Apple person, so that's what I'm going to give an example of. Essentially,  that's where you find your iPhone and you kill your iPhone remotely. At any point in time, you can go to a third-party site and literally make that device a brick so that it doesn't actually function anymore. That's what you need to be able to do. If you have a device that is transmitting or storing ePHI, you need to be able to remotely shut that device down and remotely wipe it.

Disable and do not install or use file-sharing applications, such as Dropbox that multiple people, including people outside your facility, can access or utilize. This is especially important in your home or other location. You don't want to use file sharing when you're communicating about ePHI. The entity that might be file sharing with you may not be allowed access to that ePHI. The rule of thumb is to turn off all file sharing unless you're keeping everything internal-only in your practice. 

Install and enable a firewall as well as security software, such as Norton or another protection software. Keep your software up to date. When your service vendor provides a software update, whether that's Microsoft, Android, or Apple with an iOS update, make sure you download it and keep your software updated. Many times the iOS updates are around bugs and security fixes. That's why you always want to keep that up-to-date and current.

Maintain physical control. If you have a device that you're traveling with that stores or transmits ePHI, you want to make sure you keep that device on your person as much as possible. If you are doing work and accessing ePHI, you should not be on a public Wi-Fi network, whether that's at the library, Starbucks, or in your own hospital. You should never be doing report writing or communicating with your patients or anything that involves protected health information on a public unsecured network. Make sure that before you recycle a laptop, a tablet, your watch, or a phone you have completely wiped that device. Delete everything off the device before it's either recycled or destroyed. 

Telehealth and HIPAA Security

Medicare defines telehealth as "the use of electronic information and telecommunications technologies to support and promote long-distance clinical health care, patient and professional health-related education, public health and health administration. Technologies include videoconferencing, the internet, store-and-forward imaging, streaming media, and terrestrial and wireless communications.” Store-and-forward means that it is recorded and stored, and then it is forwarded to another entity. Store-and-forward is asynchronous because it's not happening in real-time. That's an important distinction because many health insurers don't pay for asynchronous telehealth. Telehealth can include streaming media and terrestrial and wireless communications such as online, telephone, and video. Synchronous is real-time telehealth. Asynchronous is typically store-and-forward where it's not happening in unison.

Before they begin providing telehealth, allied health professionals have to ensure that their transition systems meet all the HIPAA security requirements and that they are able to maintain the confidentiality, integrity, and availability of ePHI that they create, retain, maintain, or transmit. You are responsible for making sure that the transmission from your end is secure. You cannot control the patient end. If it is with your facility, whether from you to the patient, a technician that might be with a patient, or a student, or somebody at another location that works for you, you are responsible for controlling the security of those transmissions. The only transmission you are not responsible for is if the patient is doing telehealth in their home or office and the transmission back to you.

As a general rule of thumb, we cannot use FaceTime, TikTok, Facebook Live, Messenger, Google Hangouts, Twitch, SMS, Skype, Zoom, or unencrypted email (to store or forward) for telehealth. When I say all of these things, I'm talking about software that is free, such as the free versions of Skype and Zoom. Skype and Zoom also have healthcare versions. I'm talking about their free versions of things or any unencrypted email for telehealth. That is the general non-COVID rule of thumb. As I mentioned before, you can buy paid services through Skype and Zoom that are HIPAA compliant. Those free versions, as a rule of thumb, are not allowed for telehealth because of HIPAA security provisions. There have been COVID allowances that will expire when the public health emergency expires. So if in your state your public health emergency has already expired, a lot of those provisions have already expired.

At the time this course was created, the federal government, which is the main controller of HIPAA, has not gotten rid of the public health emergency yet. When they do, those HIPAA allowances will go away. The HIPAA allowances for COVID included allowing FaceTime, Messenger, Google Hangouts, Zoom, and Skype. As a general rule of thumb, those are not allowed under the HIPAA compliance provisions. I recommend to people before they get into telehealth that they hire an IT consultant to make sure that their transmissions are secured. Have someone help you set up a program at the outset to make sure you're going to meet all these HIPAA security provisions.

Business Associates

A business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involves the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.

To break this down, a business associate is someone that you are sharing protected health information with during the processing of your business. For example, you might share PHI with a vendor if you are ordering a product for the patient. The patient gave you their information as a covered entity and now you are giving it to a third party. That third party is a business associate. You as a provider are responsible for your business associates securing your patients' health information. Every practice needs to have a business associate agreement between themselves, one that you and your practice generate, and the business associate, the entity that you are sending protected health information to.

This needs to be supplied by you, not the vendor. Many vendors may want you to sign their business associate agreement, but that means that they're the covered entity, and it's going to all be adjudicated in their state. You are the covered entity who has gotten the information from the patient. They should be completing your business associate agreement. Some common business associates include medical device manufacturers and vendors, such as those who manufacture or sell hearing aids, augmentative communication systems, or compression equipment for patients. Other business associates are your accountant if they have access to ePHI through your QuickBooks or your attorney because you're transmitting information to them. Your EHR, EMR, or OMS (office management system) vendors are also business associates.

Your clearinghouse, the entity between your computer and the computer of the payer, also needs a business associate agreement since you're giving them ePHI. So does your cloud services provider, because they again are storing your information, and any IT consultants you may hire that you're bringing in and giving access to your systems. If you were in a buying or management or cooperative group where you're sharing information with a business development team, they need to sign a business associate agreement, because they're typically able to access your systems. You can see a sample business associate agreement when you go to the HHS.gov website that can be customized to a degree.

Hitech-Breach Notification

The HITECH-Breach notification applies to both paper medical records and electronic medical records. It addresses how to handle a breach, which is an impermissible or unauthorized use or disclosure of PHI. This is a good time to give you my general rule of thumb about HIPAA. You want to do unto others as you want to be done unto you. We are all HIPAA consumers and we are all someone's patient. Before you do an action, you want to think about what you would want someone to do for you. I really want to bring this up as we talk about a breach. If someone lost your medical record or sent your information to the wrong person, what would you want to be done for you? The government requires you to do a risk assessment if you believe that there is a breach. The risk assessment is taking a look at what the risk is of this ePHI or PHI being used for illicit or nefarious purposes.

I'm going to give you a few examples. Let's say you were going to fax or email a report to a physician and you sent the report or patient information to the wrong physician's office, either by email, mail, or fax. In this case, I would consider it low risk. You are sending information to another entity, which is also a HIPAA compliant entity. I would think the risk of that information being used for illicit or nefarious purposes would be very low. In this case, you would contact the physician's office that you sent it to incorrectly and request that they destroy it by whatever means, either deleting the email or shredding the fax or mailed copy. Then you would go into the affected patient's medical record and document that breach. Next, you need to go to the portal at this link. Here you will document the breach including what occurred and that it was a low-risk breach. You have to document all of your breaches.

Now let's look at another situation. You emailed or mailed a report to the wrong patient. You sent information or documents from a patient's medical records and put them in the wrong envelope or sent it to the wrong email address. In this case, you don't know the end entity and what they could use that information for. In that case, I would consider it a moderate to high risk and you should notify the patient. You have 60 days from the date of a breach to notify a patient of that breach and you have the burden of proof to show that you notified them. You want to notify them in a way that you can prove receipt. If you can do that by email and you have systems that you feel like you can prove receipt, you could do it by that mechanism. Lots of folks do it by certified mail because they can prove that the person signed for it and received it. If business associates have a breach, they have the burden of proof to tell you, but you have to notify the individual within 60 days of the breach. You also then need to give them identity theft protection. The standard in the industry is for you to give them a year of identity theft protection.

Let me give you another example. Let's say you are still working with paper charts and records and you lose a paper chart. I can tell you from my experience of being in this industry for a while, that's actually where I've seen some of the biggest HIPAA problems and things being used illicitly. Someone stole a paper chart and then tried to take on that person's identity. I've seen that more with paper records, but I've also seen that with electronic records on small, singular breaches. I recommend that you try to find the lost chart. If you don't, consider that a high or moderate breach and notify that patient accordingly.

Let's say someone hacks into your system. Many of you may have gotten a letter in the mail from a health system saying that someone breached their systems. If someone hacks into your system, and it's a large breach of over 500 people, you have to notify your local media and health and human services. That large breach is absolutely something you have to report in the portal. Any breach, no matter the size or if it's at low risk, needs to be reported in the portal at the link I provided earlier. Big breaches must immediately be reported to your local media, to health and human services, and then all the affected patients need to be contacted. Again, think about how you would want someone to treat you.

Privacy Rule

The privacy rule is really the hallmark of HIPAA. This was the first thing created, and it is the meat and bones of HIPAA. All of the other things are equally important, but this is the one that really affects us the most in daily practice. It protects both electronic and paper formats and was first set forth in 2003 and later updated in 2013. We should expect an update to HIPAA in 2023 from the government. Every time the government makes an update, we typically have to make updates to our notice of privacy practices in all our forms, documents, processes, and procedures. Everyone needs to be prepared that there could be an update in 2023.

HIPAA privacy protects "individually identifiable health information" including demographic data. In a nutshell, it's everything that's in your medical record. Everything that's stored either by paper or electronically in a patient's medical record is subject to HIPAA privacy. Everything that's there, even things from other providers is still covered under the HIPAA privacy umbrella. This includes an individual's past, present, and future physical and mental health or conditions, the provision of their healthcare, their past or future payments, all payment information, and any of those 18 pieces of individually identifiable health information. All of that is protected under HIPAA privacy. It's the 18 pieces plus all of their records, chart notes, test results, inventories, inquiries, and invoices that the patient has access to and is protected under privacy.

Notice of Privacy Practices

Every practice needs to have a notice of privacy practices. These are your practice's rules and policies around the privacy policy and protecting health information. You can find a template on the health and human services website. You have to have the patient sign an acknowledgment of the receipt of your privacy policy. Most patients will never read it, but you have to be able to give them the opportunity to read it if they so choose. Most big healthcare systems are constantly changing their privacy policies and updating privacy officers so they typically have people sign it every visit. There is no requirement to have people sign at every visit. The requirement is that any time you make any change at all, whether it's a word, letter, or you make something plural, you have to have the patient sign a new acknowledgment and all changes need to be dated. You always need to have the date on your privacy policy reflect the last time it was changed. Acknowledgments need to be replaced every time you change your privacy policy, even if all you did was change your privacy officer, all your privacy policies need to be updated.

If your privacy policy is dated prior to 2013, it isn't valid. That should have been updated with 2013 information. If your acknowledgment was signed prior to 2013, it's not valid. You need a new, signed acknowledgment. The notice must be readily available to your patients so you must prominently post it in your office and you must have copies available if the patient wants a copy of your privacy policy. In the practice I used to run, we had a supply of printed copies for patients who requested a copy of the policy. We could just hand it to them. Some people have posters in their offices and others have a brochure of it that is in a brochure holder. Some people have it bound in a booklet that sits in their lobbies and exam rooms. You just have to make it prominently available. The biggest way you make it prominent is to put it on your website. Everyone's website needs to have their notice of privacy practices on the site. You have to make a good-faith effort to get the acknowledgment of the notice of privacy practices signed. If that cannot be obtained or the patient refuses, you need to document that in the patient's medical record. You have to document what happened and why you didn't get it signed. It's very important that that documentation exists.

Transfer From Paper to Electronic Records

Some people ask me all the time, what happens when I transfer records from paper to electronic? The first thing you have to do is always consult your state's medical record retention laws. HIPAA's requirements are to retain records for six years. But many states have rules that exceed that. You need to know what your individual state or territory's medical record retention policies are. My next question is, was it a one-to-one transfer? What that means is, was every piece of paper in the paper file transferred over and scanned in electronically? If the answer is yes, you can properly destroy the paper file. If the answer is no, you need to retain the paper record through the state medical record retention policies.

Disclosures that Do Not Require Authorization

There are three times that you can disclose protected health information without the patient's written authorization. They are for treatment, payment, or health care operations. Let's take a closer look at each of these.

You can disclose PHI without the patient's written authorization if you are communicating with the ordering and referring physician or the physician or healthcare practitioner you're referring to because that's all-around coordination of care. I am always going to tell you to err on the side of being conservative. Here's an example. A physician referred a patient to your practice. You could send results back to that physician and not need the patient's authorization to do so. But let's say a different physician reaches out to you and wants a copy of the patient's records. You should get authorization from the patient to send to that new entity or to transfer your records to another provider. You should get authorization from the patient. Let's say a school system reaches out to you. I would not send results to a school without the patient's authorization.

You do not need a patient's authorization to send claims to their insurance company. It's important to note that patients can restrict disclosures to their insurance company and waive their insurance benefits if they want. Health care operations generally include anything around your business. This could be administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business. Remember, you're going to have business associates' agreements with your accountant and your attorney, things regarding accreditation, and insurance or other audits and you do not need the patient's authorization. You can disclose information that's in your medical record that was provided by another provider because it's now part of your record.

Privacy Rule Specifics

Regarding the privacy rule, there are several specific things you need to do. You need to keep disclosures to the minimum necessary. You need to have a privacy officer. I would have that privacy officer be consistent with what I had spoken of about the security officer. It could be the practice administrator, executive director, owner, or manager. All your staff needs to be trained on privacy. This includes all new hires within 90 days of hiring and all of your staff that should be trained annually on privacy. This course can be used for that purpose. You must have a complaint process that is clearly documented on your notice of privacy practices. That is complaining both to you, the practice, through your privacy officer, and directly through health and human services or the office of civil rights.

You must have record safeguards for the storage, disposal, and access of protected health information. You can think back to some of the security provisions, but think about how would you secure things for paper? How is your paper stored? It doesn't have to be locked if it's got a staff member in front of it all the time. If not, is it locked up? Is it somewhere behind a secure door when your business is closed? Think about how those things are stored and secured. How are you going to destroy them? HIPAA records have to be kept for six years from the last encounter with the patient. Remember, state record retention policies really vary and they vary a lot around children so you want to be very aware of what those are.

I'll give a disposal example. I was always taught that if you're going to dispose of medical records, you pulverize them. When I had medical records in my office here in Chicago, I hired someone to come destroy them. I can account for what records I was having destroyed. They were scanned into a secured system. Mine was batched by dates and not by individual names, so I wouldn't have ePHI held in my system, but you could have it by individual records. Once the information was scanned in, I literally had it pulverized into dust and then that vendor gave me a receipt to show what had happened on which date. Then I scanned that in with the documents that I had destroyed. You should always keep a record of what was destroyed, when, why, and how.

Texting and Email

Again, ePHI should only be submitted through encrypted email service providers and text providers. Your practice needs a written policy and email and text need to be mentioned in your notice of privacy practices. Again, you need to have an email and text consent from your patients that you can communicate ePHI via text and email. Some patients may not want that. That's why you need to give them the opportunity to opt-in. I'm going to tell you the same for telehealth. You need to have a telehealth informed consent policy that states patients want to participate in telehealth systems.

Use and Disclosure

Use and disclosure is the HIPAA version of a medical release. Again, this includes who information can be disclosed to and what can be disclosed. It's a very specific HIPAA form. It allows the patient to list what they want to be disclosed and to whom. They can also restrict disclosures here if they don't want some information disclosed to certain parties.

Marketing

The Privacy Rule defines marketing as making a communication about a product or service that encourages the recipients of the communication to purchase or use the product or service. The HIPAA marketing provision only applies to a communication sent to your database. HIPAA is very clear that if a third party is paying in whole or in part for communication, then that becomes marketing, even if it's merely educational. It's really important that if you are going to communicate to your database, you pay for your own communications.

Testimonials

It's also important that you have the patient's acknowledgment if you are going to use testimonials in your marketing. You can't share ePHI in a testimonial, published review, or response review. You really shouldn't respond to negative reviews online without consulting your attorney and having them give you guidance on how you should best respond. You need a patient's authorization to use their image, their review, or their name. Your notice of privacy practices needs to outline your use of testimonials and reviews and all your staff needs to be trained on these policies and that training must be documented. One physical therapy practice had a pretty hefty HIPAA fine of about $25,000 over the inappropriate use of testimonials in their communications.

Marketing Versus Education

Let's talk about the difference between marketing and education. Marketing requires authorization. It is always going to be marketing if a third party is paying in whole or in part for the communication, if you're trying to get a patient to purchase an item or service, or if you're marketing a specific price, product, or promotion. That is marketing, and it requires authorization. Education is when you're just training people. That's when it's informational only. You don't talk about a specific product, price, brand name, or anything of that nature. You are talking about general healthcare topics or general information about your practice locations and staff. That's educational. That's allowed without authorization. But the minute you're trying to drive a purchase, whether it's the purchase of your services or purchase of a product, it becomes marketing. Again, HIPAA marketing provisions only apply when you're communicating to your database. 

Marketing Authorization

There are two different types of marketing authorization. Let's say you want to market to your database. There are two different requirements based upon who's paying for the communication and if money is exchanging hands. You can have a short authorization that you get at intake. See the example of a short form below. The short form is used when there is no remuneration, in cash or in kind, and no money is exchanging hands in any form for products you market. If you are marketing something and paying for it yourself or marketing another product and they aren't giving you anything back in return, such as free training, a lease, a loan, or a trip, you can use the short form. Once you receive anything of that nature you need to disclose it on a long form marketing authorization.

Example of short form:

By initialing this section and signing below, I authorize Clinic A to send me educational and/or marketing information on the products and services offered by Clinic A. No remuneration is involved in this communication. I understand that I may revoke this authorization, in writing, at any time.  

You need a long form the minute any money, in cash or in kind exchanges hands. You have to disclose to your patient what you got in return, and who paid for what. It is a very long form that you're going to need your attorney to help you create. I will tell you from experience that patients are not going to be excited to sign that form. It has a lot of perceptions of your practice. A great rule of thumb that I really want you to take away is if you want to market to your database, get a short form marketing authorization. You cannot market to them without authorization.  Pay for every one of those communications and pay for everything around your business yourself. Don't let vendors pay for them.

Omnibus Rule

The Omnibus Rule was a change to HIPAA that became effective in 2013. It meant that business associates are responsible for notifying you of breaches. That includes business associates and their contractors and subcontractors. If you store protected health information electronically, the patient has the right to access it and receive it electronically. They have the right to request that you send a copy of their electronic medical record, often as a PDF, to them through secured encrypted systems. They have the right to restrict disclosures to their insurance company and waive their insurance benefits so that you are not sending any information to them. You will need a specific insurance waiver form.

Marketing has been redefined as any patient communication where a third party is paying for that communication in whole or in part. Even if it's educational it's deemed marketing and you have to go through the marketing provisions. You can't sell protected health information. There must be a defined breach notification process where any breach, even a minor one, has to go through a risk assessment process and be documented, both in the patient's record and to the government.

Omnibus allows for broader uses of ePHI for fundraising and research. Again, in those situations, I would have your attorney involved to help define it for you and your situation because sometimes state laws can come into play. Finally, the penalties for HIPAA got bigger because people were just saying, well, I'll just pay the fine. Now they've made the fine up to $1.5 million per calendar year, and now you can go to jail because they have criminalized HIPAA provisions.

HIPAA and Social Media

Remember, don't disclose any ePHI on any form of social media format. This includes sites such as Facebook, Twitter, LinkedIn, Instagram, Yelp, Google, etc. This includes, but isn't limited to, responding to reviews. Responding to a review confirms the patient was seen in your practice and could be deemed a privacy violation. Always start by contacting that patient who gave you the review directly and not in a public forum. If you've worked it out, ask them if they'll remove their review. Before you post anything on social media around a patient, ask your attorney because this is a complaint-driven process. You want to make sure that you know how this should legally be handled before you start responding online, posting testimonials, patient pictures, or patients' test results for feedback. Remember, patients' test results are protected. You can't just post it on social media to get feedback from your colleagues without the authorization of the patient.

Examples of HIPAA Violations

Here are some examples of HIPAA violations within healthcare.

Physical Therapy:

Complete P.T., Pool & Land Physical Therapy, Inc. has agreed to settle violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rules with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Complete P.T. is a physical therapy practice located in the Los Angeles area.  The settlement agreement is an admission of civil liability by Complete P.T., requiring payment of $25,000, adoption and implementation of a corrective action plan, and annual reporting of compliance efforts for a one-year period. On August 8, 2012, OCR received a complaint alleging that Complete P.T. had impermissibly disclosed numerous individuals’ protected health information (PHI), when it posted patient testimonials, including full names and full-face photographic images, to its website without obtaining valid, HIPAA-compliant authorizations.  OCR’s investigation revealed that Complete P.T.:

▪Failed to reasonably safeguard PHI;

▪Impermissibly disclosed PHI without authorization; and

▪Failed to implement policies and procedures with respect to PHI that were designed to comply with HIPAA’s requirements with regard to authorization”.

▪https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/complete-pt/index.html

Respiratory Therapy:

"A former respiratory therapist has been convicted on criminal HIPAA violations by a federal jury in Ohio. The jury agreed with prosecutors that the protected health information of patients was wrongly obtained and that PHI was used to seek and obtain intravenous prescription drugs. Jamie Knapp was employed as a respiratory therapist at the ProMedica Bay Park Hospital in Oregon, Ohio. Over a period of 10 months, Knapp improperly accessed the medical records of 596 patients. Knapp was permitted access to patient records in order to conduct her work duties; however, she was only permitted access to the records of patients she was treating. Knapp abused her access rights and viewed the PHI of other patients without authorization, according to the prosecution.”

▪https://www.hipaajournal.com/respiratory-therapist-convicted-criminal-hipaa-violations-3486/

Additional examples:

• https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
• https://etactics.com/blog/social-media-hipaa-violations
• https://www.hipaajournal.com/hipaa-violation-cases/
• https://healthitsecurity.com/news/ocr-settles-with-dental-provider-for-potential-hipaa-violation-on-yelp
• https://assets.hcca-info.org/Portals/0/PDFs/Resources/Rpt_Privacy/2016/rpp0716.pdf

Resources

Here are some professional resources from your associations. If your profession isn't listed here, it's because they don't have specific HIPAA guidelines or those HIPAA guidelines were behind a member-only firewall that I could not access. If you are a member of a national association in your profession, see if that association has HIPAA provisions that can help guide you specifically to your profession.

• American Physical Therapy Association: https://www.apta.org/your-practice/compliance/hipaa
• American Speech-Language-Hearing Association: https://www.asha.org/practice/reimbursement/hipaa/privacy/
• National Association of Social Workers: https://www.socialworkers.org/About/Legal/HIPAA-Help 

Citation

Cavitt, K. (2022). HIPAA for allied health professionals. AudiologyOnline, Article 28262. Available at https://www.audiologyonline.com