HIPAA Compliance – DSP 330

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. This means that most medical information recorded by healthcare providers has to be stored based on a certain standard of security.

This is only just now becoming an issue in the float industry as centers are starting to accept insurance and medical referrals. However, this is still extremely rare. If this is something that may affect you personally, definitely research additional resources to make sure you’re in compliance.

HHS Health Information Privacy Site

HHS HIPAA Summary

HealthIT.gov

HIPAA Training

Listen to Just the Audio

Transcription of this episode… (in case you prefer reading)

Graham: Alright, hello everybody.

Ashkahn: Welcome.

Graham: I’m Graham.

Ashkahn: I’m Ashkahn and let slam it up. That’s what we say, that’s our new catch phrase.

Graham: Today’s question is …

Ashkahn: That’s our old catch phrase, “today’s question is”, so we’re replacing that now.

Graham: We’re just combining-

Ashkahn: Slam it up.

Graham: Both of them yes.

Ashkahn: Slam that question up, Graham.

Graham: Today’s question is, “how would you recommend working or complying with hippos?” Sorry, “HIPAA”. HIPAA. H-I-P-A-A.

Ashkahn: Interesting.

Graham: Yeah.

Ashkahn: I know a lot less about HIPAA than I do about hippos.

Graham: Oh yeah? Do you want to give us some hippo facts?

Ashkahn: They’re very dangerous.

Graham: That’s true.

Ashkahn: And very hungry from what I learned as a child.

Graham: For marbles. They just can’t get enough.

Ashkahn: Yeah. They’re hungry, hungry.

Graham: So if you have any more questions you’d like to hear answered.

Cool, so HIPAA, if you’re in the medical world or have patients in the medical kind of sense, then HIPAA compliance is something that you’re probably very familiar with. Maybe you could come on the show and answer this question for us.

Ashkahn: Because we don’t really know.

Graham: So for our float tank business, we don’t take insurance as many float tank places do not right now. It’s not really covered by a distinct code in the healthcare industry. So we’re not billing insurance for our floats. We don’t have big intake forms where we’re collecting personal information from people. We don’t have session notes where we’re tracking progress on the course of issues that they have over time. So, we don’t keep medical files and as a result, we’re not really worried about HIPAA compliance.

I guess let’s start with what the heck HIPAA even means before we get into this for those who aren’t familiar. It stands for the Health Insurance Portability and Accountability Act. It’s basically just designed to make sure that people who are forced to give, or not forced, who are asked to give personal or private medical information can trust that and not feel like their information is going to end out there in the general public or be abused by someone. So kind of patient provider confidentiality.

As a result, they came up with all these guidelines for what that means and what levels are applicable and correct for medical files. This can even apply to people like massage therapists or practitioners who are in even lower scale, I guess, of general health providers than for instance medical doctors, or something. It just sort of depends on what information you’re asking from people, what you’re collecting.

Any thoughts on that, Ashkahn?

Ashkahn: I mean, so here’s the main thing I know about HIPAA is it seems really intense.

Graham: It’s very hungry.

Ashkahn: You hear it has birds on its heads.

I seems like when I encounter it or when I’ve seen a facility that’s like meeting HIPAA standards or something like that, it’s pretty hardcore. There’s just a lot that goes into it, from if you have physical documents, like how you’re storing them. There’s even like, I’m pretty sure there’s like a HIPAA compliant way of shredding things. Like you can’t just shred, you have to shred your documents to a certain level.

Graham: For sure. Yeah, ripping them in half is not good enough, right? Like there’s a specific number of rips you need to do before-

Ashkahn: Cross dimensional rips. Not like it’s going to go to a different dimension, but you know.

Graham: Yeah, trans dimensional ripping. Yeah. I understand.

Ashkahn: Cross directional. That’s what I was trying to say.

Graham: That’s also, I mean, I think it’s just a big checklist and it’s a robust checklist, but it’s not necessarily the hardest things to meet once you do it. You just have to make sure that you’re actually going through this. I mean single provider massage therapists do this all the time, so obviously, this isn’t something where you need a whole designated office and a secretary in order to accomplish it. It’s just being really careful with people’s information in again, a very detailed documented way.

Ashkahn: Do you think, are there like different levels? We probably should have looked this up. Are there like different levels of HIPAA? What’s your guess.

Graham: Sure, I mean, there definitely are depending on what you’re doing, right? You can be a software company who’s providing HIPAA compliant document storage for your clients and then you have to meet kind of higher levels of what you’re doing to ensure that hackers aren’t getting in and getting access to hundreds of thousands of medical files as opposed to something that you just have maybe on paper in a filing cabinets somewhere that’s locked.

And I don’t even know if that’s enough. It could be a locked filing cabinet inside a locked room. These are all details that because we don’t have to comply with this, we don’t specifically know. But it is really important and I do know also that you can stumble into this inadvertently, right?

Like you might think that on your intake form that you have at your float center, you want to find out why people are coming in and what kinds of preexisting medical conditions they’re coming in to treat with the act of floating. That can inadvertently put you into a place where you need to make sure that you’re meeting HIPAA compliance for those intake forms because now all of the sudden you have this history of medical data that people are providing you. Just keeping it in a filing cabinet along with you know a waiver or something like that is not going to cut it anymore. Maybe, right?

Again, we’re not lawyers, so definitely consult with people who are trained in this before you start asking anyone any medical related question or certainly anything about conditions that they’re going through. Stuff that feels like they would normally tell their doctor is probably stuff that you shouldn’t be handling without some care.

There’s some training that you can go through, too. Just doing a quick search online, there’s a lot of private programs that will train you up on what HIPAA compliance is and what you’re likely to have to do to meet it as either a float center or if you’re incorporating massage therapy into your practice. Things like that.

There’s also just great government resources. One is just going to healthit.gov and that has a lot of templates and kind of beginners guides that’ll get you started with understanding what HIPAA is. I think the most basic guide they link over to is like 60 pages long, so it give you some sense of how not simple a lot of this stuff is, but education and again, making sure you do more than listen to like a 10 minute podcast by float tank guys on this is probably the best way to actually educate yourself and make sure that this is something that you want to delve into with your practice.

Ashkahn: Why are you? Like you should ask that question first. If you’re just running a float center and you’re getting people into float tanks, I’m not sure if it’s worth the trouble to what, get a little bit of data on your intake form about maybe some health reasons people are coming in or something?

Graham: Or if you want to track progress over time, I guess, and kind of move on to more of this you know health practitioner kind of status.

Ashkahn: I feel like if you were doing that, it’s not just like being HIPAA compliant. You probably want some sort of training in dealing with people’s health in a more serious way. I wouldn’t feel comfortable like having our customers come in, tell us medical conditions and then see if they’re improving or talking to the about it.

Graham: No, I mean certainly that would be something to figure out exactly what we’re stumbling into from a bureaucratic, red tape standpoint, you know?

Ashkahn: Some of those float centers are not, I mean the reason why this is not a big thing in the float industry is there’s like not a great reason or an easy low level reason for gathering this type of information in the first place.

Graham: So, I guess, be careful. Take the time to educate yourself kind of for anything new that you’re going into like this, especially where the ramifications can be really serious where you’re not in compliance for federal law. They will have the potential to be able to slam a huge fee into you if you’re actually collecting this medical information and not meeting HIPAA standards. So educate yourself. Again, take some free online courses. Go check out some resources and consider actually enrolling in even a local HIPAA compliance class where you can go in person and have an instructor to actually ask questions to.

From my understanding, that can be as simple as a two day course, something like that, and really give you the ins and outs, again, in a way that kind of stumbling through this question on our podcast is not nearly enough for you to go forward with.

Ashkahn: If you feel overwhelmed, you can just look at some pictures of hippos and that will calm you down.

Graham: Alright, if you have other questions, especially ones that we know nothing about-

Ashkahn: And very unqualified to answer.

Graham: Go over to floattanksolutions.com.

Ashkahn: Slash.

Graham: Podcast.

Ashkahn: And yeah, that’s the spot.

Graham: Alright. Bye, everyone.

Latest Blog Posts