By Jerri Lynn Ward, J.D., Garlo Ward P.C. and Rose Ireland, Director of Clinical Services, Texas Association of Homes and Services for the Aging
Posted July 1, 2003
You may have recently received a copy of a June 12, 2003 letter from the Director of the Survey and Certification Group of CMS to the State Survey Agency Directors regarding HIPAA compliance and survey information. The letter accompanies a letter template that CMS suggests Survey Agencies such as TDHS send to facility administrators. Unfortunately the letter template reads in such a way as to perpetuate the myth that nursing facilities are required to post statements of deficiencies where anyone who comes to the facility can read them, including “Joe the Janitor” or “Larry the Lawyer”. This has never been the law. The law says that facilities must make survey results “readily accessible” to residents, their family members and legal representatives. The law says nothing about posting statements of deficiencies in your lobbies.
The word “lobby” is mentioned only in the interpretative guidelines to surveyors where posting results of surveys in lobbies is suggested in order to make the results “readily accessible to residents.” This leads me to believe that whoever wrote the interpretative guidelines was a Feng Shui consultant specializing in the subject of placement of physical objects in the environment instead of someone who actually read the law on the subject. I’m sure it is far more interesting to utilize Feng Shui techniques when writing interpretive guidelines or letter templates about HIPAA than to actually read the United States Code or the Code of Federal Regulations. After all, Feng Shui consultants believe very interesting things such as the importance of locating the “love corner” in your house so that you can paint it red and bring romance into your life; but don’t you agree that it is really important that bureaucrats actually read the law before telling anyone else what said law requires? I do.
The fact is, under the law, statements of deficiencies contain protected health information. Posting statements of deficiencies in your lobby where people other than the resident, the resident’s family members and the resident’s legal representative have access is a violation of HIPAA if done without proper authorization. Since the folks at CMS apparently didn’t read the law, let’s do it for them and tell them the results. To that end, I have prepared my own suggested letter “template” for you to send to CMS.
Here’s the letter:
Mr. Steven A. Pelovitz
Director, Survey and Certification Group
CMS
7600 Security Boulevard, Mail Stop S2-26-12
Baltimore, Maryland 21244-1850
Dear Mr. Pelovitz,
I am a health provider of long term care. I have recently read the letter template you prepared for State Survey Agency Directors to send to facility administrators regarding the Survey and Certification Group’s interpretation of HIPAA and its impact on posting of survey results. The template is in need of a few clarifications that I would like to discuss with you in this letter.
Let us look at the pertinent parts of your letter together. First you say:
While the residents selected as part of the survey sample are referred to by code (rather than by name, social security number, or some other easily identified identifier), it may be possible in rare circumstances (Emphasis added) to determine the identity of a resident through the documentation of a deficient practice if one had enough specific information about a cited facility and its resident population.
I searched and searched the HIPAA Privacy Rule and never saw the words “possible in rare circumstances”. What I did see is that protected health information includes individually identifiable health information, which also includes health information, or demographic information where there is a reasonable basis to believe the information can be used to identify the individual. 45 CFR §160.103.
You may not realize this, but people who work in the facility such as “Joe the Janitor” or those who visit the facility such as “Fred the Friend”, probably actually know the residents so I’d say that the possibility of determining the identity of a resident from protected health information in a statement of deficiencies is greater in more than “rare circumstances”. Joe and Fred aren’t entitled to get protected health information pertaining to “Reggie the Resident” from the facility. Please hold that thought as we continue.
Your letter also states:
For example, the HIPAA Privacy Rule provides that protected health information may be used and disclosed without the authorization of the subject of that information to the extent a law mandates such use or disclosure.
Now let’s go to the relevant section of HIPAA (45 CFR 164.512(a)):
a. Standard: uses and disclosures required by law. (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure complies with and is limited to the relevant requirements of such law. (Emphasis added)
The next part of your letter says:
Survey results must be posted and made available to the general public under the statutory provisions of the Social Security Act (SSA). See §§1819(g)(5) and
1919(c)(8)
In case you didn’t notice, this sentence was written in such a way as to suggest that nursing homes have to make survey results available to the general public by posting them. I believe that this is what is called a “fallacy of composition” which occurs when the parts of a whole have a certain property and it is therefore argued that the whole has that property. Whoever helped you write this template probably vaguely remembered that the general public is entitled to see survey results and that facilities are supposed to disclose results in a certain manner and the next thing you know – it’s all thrown in together into an error of composition which seems to conclude that nursing homes have to disclose surveys to the “general public”. Could the person who helped you write this letter possibly have been the same Feng Shui consultant who wrote the interpretative guidelines suggesting posting of surveys in facility lobbies where anybody can see them? More about that later…
First, let’s see what the law actually says by starting with §1819(g)(5)
5) DISCLOSURE OF RESULTS OF INSPECTIONS AND ACTIVITIES. —
(A) PUBLIC INFORMATION. –Each State, and the Secretary, shall make available to the public–
information respecting all surveys and certifications made respecting skilled nursing facilities, including statements of deficiencies, within 14 calendar days after such information is made available to those facilities, and approved plans of correction,
Now look at §1919(c)(8)
(8) POSTING OF SURVEY RESULTS.–A nursing facility must post in a place readily accessible to residents, and family members and legal representatives of residents, the results of the most recent survey of the facility conducted under subsection (g). (Emphasis added)
Ahah!! Who has the duty to make information respecting all surveys..including statements of deficiencies available to the public? Let’s say it together: Each State and the Secretary! Notice that it doesn’t say the word “facilities” anywhere in §1819(g)(5). And, it doesn’t say the words “general public” anywhere in §1919(c)(8).
You might also want to take note that survey results are to be readily accessible to residents, and family members and legal representatives of residents. And you should also notice from the above HIPAA excerpt, (45 CFR 164.512(a)), that HIPAA allows disclosures required by law when the disclosures are limited to the relevant requirements of such law. What this means is that facilities aren’t allowed under HIPAA to show protected health information contained in statements of deficiencies to anyone other than residents, and family members and legal representatives of residents!! Therefore, if a facility posts a statement of deficiencies containing protected health information in its lobby and “Joe the Janitor” or the “general public” sees it, the facility is in violation of HIPAA.
Your letter next says:
Furthermore, the HIPAA Privacy Rule provides that protected health information may be used and disclosed without the authorization of the subject of that information for health oversight activities.
Yes, that is true. Facilities are permitted under HIPAA to disclose protected health information to public health authorities or other appropriate government authorities – but not to the “general public!” 45 CFR §164.512 (b)
It would be extremely helpful if you would rewrite this template before continuing to encourage TDHS to send it out to facility administrators. We’d prefer not to get fined for violating HIPAA.
No need to thank me for reading the law for you – but, if you don’t mind, I’d really like to borrow that Feng Shui consultant who wrote the interpretative guidelines regarding posting of surveys. I’ve been having a little trouble locating the “love corner” in my house.
Very truly yours,
Your Name
All information in this article is informational only and is not legal advice. Should you have any questions or a situation requiring advice, please contact an attorney.
Copyright 2004 by Garlo Ward, P.C., all rights reserved
Austin, Texas 78752-3714 USA
Telephone: 512-302-1103
Facsimilie: 512-302-3256
Email: Info@Garloward.com
