HIPAA regulates much more in a healthcare business than most would think. Did you know that HIPAA dictates specific guidelines on how protected health information may be used in a healthcare provider’s reception area? So that you can avoid HIPAA violations by accidental unauthorized disclosure of PHI, HIPAA guidelines for reception areas are discussed.
HIPAA Guidelines for Reception Areas
There are several ways in which a patient’s PHI could be accidentally viewed or overheard in an office’s reception area.
Common ways PHI can be accidentally exposed include:
- A patient sign-in sheet left on a reception desk
- Verifying patient information in a way that can be easily overheard
- A computer monitor left unlocked, unattended, and visible for unauthorized view
- Patient files left unattended on a reception desk
- Patient’s treatment information discussed in the reception area
HIPAA guidelines for reception area privacy:
1. Keep patient information on a sign-in sheet limited to only necessary information such as the patient name, date, and time of arrival. A patient’s reason for visit, or insurance information should never be included on a sign-in sheet. To improve patient privacy, it is also a good idea to cover the names of patients that have signed in. You may also blackout patient’s names with a marker after they have been seen by the provider.
2. When verifying sensitive information with a patient, such as their insurance information, do so discreetly. You can simply ask them to provide their insurance card, or turn your computer monitor so that they can confirm the information on the screen.
3. Implement automatic logoff procedures on computers containing, or with the potential to access, electronic PHI. This way, after a predetermined period of activity, computers will automatically lock, requiring a password to gain access. Reception area computers should never be left visible to patients, so monitors should also be turned to prevent them from unauthorized view.
4. Patient files should never be left in a public area. If the reception area cannot be locked when leaving the desk unattended, patient files should be returned to locked filing cabinets before leaving the desk.
5. Patient information should never be discussed in public areas including reception areas or hallways. For instance, when booking patient follow up appointments in the reception area, there is no need to mention what the appointment is for.
6. Conduct an annual site audit to determine physical vulnerabilities to patient PHI. Site audits assess the safeguards your office has in place to secure your physical office location. Determining your risk areas is the best way to ensure the privacy and security of PHI.
How Implement These Guidelines
- Conduct annual self-audits to assess your areas of risk.
- Implement HIPAA policies and procedures to provide employees with guidance on the proper use and disclosure of PHI, how to keep PHI private and secure, and how to report breaches affecting PHI.
- Train employees on your policies and procedures and HIPAA best practices.
