HIPAA Exempt Offices (Paper)

January 23rd, 2017 - Wyn Staheli

Categories: HIPAA|PHI

It is a common misconception that every doctor’s office is (or must become) a HIPAA covered entity; however, the list of those who still qualify for exemption from HIPAA is rapidly shrinking. There are exceptions to the HIPAA requirements; if a practice sends or receives no transactions electronically, it is not a covered entity. Offices must be careful to ensure they truly are not performing electronic transactions. While a provider may not submit claims electronically, the provider’s staff could be using the internet to query patient information from a plan or payer source or a third party may submit payments electronically. Consequently, accessing this information electronically automatically makes the practice a covered entity.

If you employ more than ten full-time employees (or full-time equivalents), you are required to submit Medicare claims electronically; therefore, you automatically become a HIPAA Covered Entity. Considering all these situations, it is almost easier to become a covered entity than not to.

To be a HIPAA exempt entity, you must, at a minimum, meet all of the following conditions:

Keep records in your office on paper. Information in computers must only be output to paper and then mailed. No Protected Health Information (PHI) may be transmitted electronically to or from your office.
Do not use a billing service, clearinghouse or other third party to conduct electronic transactions such as submitting electronic claims for you.
Do not use any internet applications, direct data entry, or point of service application containing PHI from your computer.
Do not become a HIPAA covered entity by function, contract, agreement, or certification.
Do not have any contracts or business agreements that require HIPAA compliance. Many health plans are now including a requirement for electronic claim submission in their agreements. Read your contract renewals carefully.
Do not fax (or scan and email) PHI transactions from your computer (conventional, free-standing fax machines may be used).
Your practice is not located in a state that requires all claims to be electronically submitted.

Alert — HIPAA is Only the Federal Minimum Standard: If you are one of the few practices that can be considered a HIPAA exempt office, you must still abide by any state regulations applicable to healthcare providers and all healthcare matters, including confidentiality of patient information. It is good business practice to always maintain policies and procedures aimed at protecting patient information.

###

Questions, comments?

If you have questions or comments about this article please contact us. Comments that provide additional related information may be added here by our Editors.

Latest articles: (any category)

Artificial Intelligence in Healthcare - A Medical Coder's Perspective
December 26th, 2023 - Aimee Wilcox

We constantly hear how AI is creeping into every aspect of healthcare but what does that mean for medical coders and how can we better understand the language used in the codeset? Will AI take my place or will I learn with it and become an integral part of the process that uses AI to enhance my abilities?

Specialization: Your Advantage as a Medical Coding Contractor
December 22nd, 2023 - Find-A-Code

Medical coding contractors offer a valuable service to healthcare providers who would rather outsource coding and billing rather than handling things in-house. Some contractors are better than others, but there is one thing they all have in common: the need to present some sort of value proposition in order to land new clients. As a contractor, your value proposition is the advantage you offer. And that advantage is specialization.

ICD-10-CM Coding of Chronic Obstructive Pulmonary Disease (COPD)
December 19th, 2023 - Aimee Wilcox

Chronic respiratory disease is on the top 10 chronic disease list published by the National Institutes of Health (NIH). Although it is a chronic condition, it may be stable for some time and then suddenly become exacerbated and even impacted by another acute respiratory illness, such as bronchitis, RSV, or COVID-19. Understanding the nuances associated with the condition and how to properly assign ICD-10-CM codes is beneficial.

Changes to COVID-19 Vaccines Strike Again
December 12th, 2023 - Aimee Wilcox

According to the FDA, CDC, and other alphabet soup entities, the old COVID-19 vaccines are no longer able to treat the variants experienced today so new vaccines have been given the emergency use authorization to take the place of the old vaccines. No sooner was the updated 2024 CPT codebook published when 50 of the codes in it were deleted, some of which were being newly added for 2024.

Updated ICD-10-CM Codes for Appendicitis
November 14th, 2023 - Aimee Wilcox

With approximately 250,000 cases of acute appendicitis diagnosed annually in the United States, coding updates were made to ensure high-specificity coding could be achieved when reporting these diagnoses. While appendicitis almost equally affects both men and women, the type of appendicitis varies, as dose the risk of infection, sepsis, and perforation.

COVID Vaccine Coding Changes as of November 1, 2023
October 26th, 2023 - Wyn Staheli

COVID vaccine changes due to the end of the PHE as of November 1, 2023 are addressed in this article.

Medicare Guidance Changes for E/M Services
October 11th, 2023 - Wyn Staheli

2023 brought quite a few changes to Evaluation and management (E/M) services. The significant revisions as noted in the CPT codebook were welcome changes to bring other E/M services more in line with the changes that took place with Office or Other Outpatient Services a few years ago. As part of CMS’ Medicare Learning Network, the “Evaluation and Management Services Guide” publication was finally updated as of August 2023 to include the changes that took place in 2023. If you take a look at the new publication (see references below),....