Sep 18, 2012

HIPAA Disclosure Question

Recently, we have received many HIPAA questions surrounding appropriate disclosures. The following Q and A should assist those with similar situations.

Q: Can we disclose patient information to a collection agency so we can receive overdue payments?

A: Yes. HIPAA allows a covered entity to disclose patient information to a collection agency, without prior patient authorization, for Payment Purposes. Remember to disclose only the minimum information necessary to accomplish the task.

Q: If an individual calls in and wants to know how a family member is doing, what kind of things can we, or should we disclose?

A: This is a good question that requires an expanded answer. In order to appropriately answer this question, you will need to obtain some additional information.

1) What is the relationship of the caller to the patient?
2) Is the caller the living with the patient and responsible for the patient's care?
3) What are the patient's wishes surrounding disclosure of information to family members?

First, if the patient is a minor and the individual calling is a parent, or the patient's designated representative, then you may disclose the patient's information. However, if the patient has requested that you without information, then it is left up to the best judgement of the covered entity to decide whether such a disclosure could place the patient at risk.

Second, HIPAA allows covered entities to release information that is directly related to the patient's care, to the individual who is directly responsible for the patient's care.

Example: "The patient will require plenty of rest. Covered entities should ONLY disclose information directly related to the patient's care.

Acceptable: The patient should drink plenty of liquid as they take their medication.
Not Acceptable: The patient has a history of back pain, which may or may not be related to their current condition.

Finally, if the patient has requested that information be withheld from family and friends, then you may not disclose the information. Additionally, in your best judgement you may determine that disclosing information would simply be inappropriate, then you may withhold the information.

If you have additional disclosure questions, or other general HIPAA questions, please feel free to contact us at:

Compliance PhD provides its members with up-to-date Online Compliance Training. Our members enjoy that all of the HIPAA, OSHA, and other Compliance related trainings can be found in one place. Join Compliance PhD today!

Sep 12, 2012

Exposure Incident

Q: HELP! We recently had an incident in the office where one of our nurses was stuck with a needle that had previously been used to administer a vaccine to a patient. What do we do now?


If an employee is involved in an exposure incident, they should immediately report the incident to the OSHA Compliance Officer who will document in detail on the Bloodborne Exposure Incident Report Form and, if appropriate to the situation the Sharps Injury Report and Sharps Injury Log.

·         Patients involved with the employee exposure incident should have the situation explained to them, and, if possible, obtain authorization to draw and test their blood. A Consent to Draw and Test Blood form should be completed.

·         The exposed employee should assist in completing the Bloodborne Exposure Incident Report, and Sharps Injury Report.  Management should evaluate the information to determine the cause of the incident and how to take appropriate steps to ensure it cannot happen again.

·         Employees have the right to decline Medical Evaluation and future follow-up evaluations. If the employee declines medical evaluations, have the employee complete and sign the Informed Refusal of Medical Evaluation form. This form should be maintained in the employee’s confidential medical records. Never encourage an employee to refuse receiving medical evaluations. Once the employee has signed the refusal form, however, no other action is necessary. 

·         If the injury is classified as a Sharps Injury, record the information on the Sharps Injury Log. This injury log contains no identifiable information, but can be used to evaluate patterns and areas of possible risk. OSHA Compliance Officers and other Management can use this information to determine whether to change equipment or office procedures to minimize future risk.


After an exposure incident has occurred:
  1. If consent is given, obtain a blood sample and test for HIV, HBV, and HCV. If the individual refuses to have blood drawn and tested, the original contaminate sample must be maintained for 90 days in case the individual later decides to have testing occur.
  2. The individual involved in the exposure incident must be informed of their rights to medical testing AND evaluation.
  3. The individual involved in the exposure incident must be informed of their right to counseling.
  4. The individual involved in the exposure incident must be instructed to report all illness, or fever for the following 12 week period. They should be instructed to receive medical care for any instance.
  5. If test results return negative for HIV, the test must again be offered at 6 weeks, 12 weeks, and 6 months after the exposure incident occurred.
All of the Forms outlined in Red are available and easy to download for all Compliance PhD members. 

If you have additional OSHA Questions, or need help with OSHA Compliance, contact Compliance PhD today.