Spring 2023

Renovating Your Release of Information Program
By Jennifer McCann, RHIA, CHPS, CTR
For The Record
Vol. 35 No. 2 P. 22

A Detailed, Strategic Approach to Project Planning

For any do-it-yourself (DIY) homeowners, the term “renovation” is all too familiar. The Merriam-Webster Dictionary defines the word renovate as “to restore to a former, better state.” Home renovations can often take on a life of their own; a small project unearths larger, perhaps structural issues. Homeowners may choose to tackle a renovation only to find out it would have been more cost-effective to simply sell and buy new.

So, what does this have to do with HIM and release of information (ROI)? Well, much like the best laid home renovation plans, renovating your ROI program may uncover larger, more systemic issues. Renovations of any kind often fail because people don’t set realistic parameters, and projects quickly grow out of control.

Processing ROI requests in today’s electronic landscape can involve accessing multiple primary and secondary systems to retrieve the requested information. ROI specialists require extensive training and expertise to navigate the multiple systems and ensure they release what was requested—no more, no less.

Add to that the mounting number of federal and state regulatory requirements that inform the releasing of protected health information (PHI). From HIPAA to the 21st Century Cures Act, the ROI staff of today must also have the expertise required to navigate an ever-expanding and complex regulatory landscape.

And let’s not forget the hiring challenges facing all industries, health care among them. HIM managers and directors continue to struggle with hiring and offering competitive wages.

Let’s say you successfully weathered these hiring highs and lows, and your ROI department is fully staffed. Nice work! But how successful are you at retaining staff? Have you found yourself in the never-ending cycle of training new staff only to see them resign, and you’re right back to where you started?

What once felt like a simple renovation project starts to uncover a challenge at every turn. The key to a successful renovation is planning. A detailed, strategic approach to project planning is crucial. But before planning can even begin, take a moment and assess the foundation.

A Strong Foundation
Any successful renovation begins with a thorough investigation of the foundation. A foundation assessment will help identify any structural issues that might derail the project before it’s even underway. An ROI program is no different. A strong ROI program is built upon a solid framework. Compare an ROI program to a house with a stone foundation. Homes built upon stone foundations, when built with care and craftsmanship, can last 100 years and beyond. But the craftsmanship and the quality of the stone make a big difference. For the ROI program, think of those high-quality stones as the key terms and definitions that inform the ROI process.

The Building Blocks of ROI

PHI
The term “protected health information” was first defined in HIPAA and remains a foundation of today’s ROI process. PHI is a set of 18 identifiers relating to a patient’s health status, care received, or payment for services rendered that can be used to identify an individual. The purpose of the HIPAA Privacy and Security Rules is to protect PHI while ensuring individuals have access to this information. ROI staff must be fluent in the elements of PHI. In the 20-plus years since HIPAA went into effect, PHI remains a foundational piece of the entire ROI process.

The HIPAA Final Security Rule, published in 2003, further expanded PHI with the introduction of the term “electronic protected health information” (ePHI) for any PHI created, received, maintained, or transmitted in electronic form. And again, in 2018, new legislation established yet another term that has quickly become part of the everyday ROI vernacular. The 20th Century Cures Act (referred to as The Cures Act) introduced the term “electronic health information” (EHI). The Office of the National Coordinator for Health Information Technology has provided guidance on where the terms PHI, ePHI, and EHI intersect. But the different terms often cause confusion, and it’s pivotal for ROI staff to have a foundational understanding of each and their impact on the ROI process.

Treatment, Payment, and Health Care Operations
Treatment, payment, and health care operations (TPO) is another integral building block of the ROI foundation.

Simply put, record requests to support activities that involve TPO do not require a patient’s authorization to process. These three categories are carefully crafted exemptions established by the HIPAA Privacy Rule to strike a balance between protecting PHI and minimalizing operational barriers within the health care delivery system. The establishment of TPO was seen as a way for organizations to use PHI during the normal course of business without having to seek patient authorization to do so.

A thorough understanding of the types of ROI requests that fall under TPO, and those that do not, is essential. And as the types of requests and the number of requestors continue to change and expand, it’s more important than ever to revisit these definitions often to ensure ongoing competency.

Accounting of Disclosures
HIPAA provides patients with several rights that health care organizations must assure, one of which is the creation of an accounting of disclosures when requested. An accounting of disclosures is a listing of the disclosures made during the six years prior to the date of request. And while ROI staff may never be required to produce an accounting of disclosures, appropriately tracking and logging applicable requests in order to prepare a thorough accounting is essential.

Information Blocking
While many of the foundational terms discussed so far have been in place since the early days of HIPAA, information blocking is a relatively new term and one that continues to be a hot topic in the health information community. The Cures Act established this term to identify prohibited practices that interfere with, prevent, or otherwise discourage an individual to access, exchange, or use EHI. More simply stated, entities that engage in information blocking (and prevent individuals from accessing, exchanging, or using their EHI) can be accused of such and face monetary consequences. And while the health care community continues to wait for finalized civil penalty amounts, which have yet to be established by the Office of Inspector General, the Office of the National Coordinator for Health Information Technology’s information blocking reporting portal is open, and hundreds of claims have already been submitted. If your organization has been putting off assessing current ROI processes to identify any potential information blocking practices, renovations are long overdue.

Minimum Necessary
A final aspect of the foundational discussion concerns the minimum necessary standard, which was established by HIPAA and requires covered entities to limit the amount of information used and disclosed to avoid unnecessary or inappropriate access to PHI. The standard states that entities must make “reasonable efforts” to limit the PHI released and only provide the information required to fulfill the intent of the request. And while HIPAA establishes a subset of uses and disclosures that are exempted from the minimum necessary standard, this standard is often misinterpreted and misapplied. Misapplying this standard can have significant impacts on the structural foundation of an ROI program.

With a sound foundation, renovation planning can move forward.

If any of these foundational components gave you pause during inspection, be sure to keep them in mind as you begin the planning phase. Any cracks in the foundation will have a significant impact on the scope of a renovation. There are far too many cautionary tales of home renovations going dreadfully wrong, and that should be a lesson to us all.

Time to Start Planning

Step 1—Identify Your “Wish List”
This step involves identifying your “must have” items and separating them from the “nice to have” category. Remember, renovation is all about restoring something to its “former, better state,” so it’s important to focus on those identifiable gaps in your existing training program.

Some questions to ask yourself as you prepare your ROI program’s wish list include the following:

• Does the ROI program include a formal, standardized training program today?

• Is the ROI training process thoroughly documented and updated annually?

• Do all ROI staff receive the same standardized education?

• Does your onboarding process for new ROI staff include an applicable competency evaluation at 30/60/90 days?

• Has your ROI training program kept up with ongoing changes to regulatory requirements?

• Does your training program include a standardized method of measuring competency?

• Is annual training and competency built into the annual performance discussion with the ROI staff?

• Do you have the time and resources to dedicate to renovating your existing training program?

Step 2—Establish a Renovation Budget
Health information professionals are continually asked to do more with less, and the ROI budget is no exception. And as with any good renovation project, establishing the budget early can also help inform the creation of your wish list as well. As with any DIY renovation, there may be less expensive options or shortcuts, but that doesn’t mean cutting corners in the budget is always the best approach. Conversely, the latest technology (hello, talking refrigerators), while shiny and new, isn’t necessary to accomplish a successful renovation.

Some questions to ask yourself when determining the budget include the following:

• Do I have the appropriate internal resources to renovate my current ROI program?

• Has my organization experienced costly fines because of the mishandling of an ROI request?

• Should I consider purchasing outside education to supplement my internal processes?

• Should I look at outsourcing options? Or if you’re currently outsourcing: should I consider bringing ROI back in house?

Be mindful of the budget and make every dollar count.

Step 3—Identify Permitting and Other Ordinances
For a home renovation project, this step involves identifying any permitting requirements, homeowner association approvals, and other local ordinances that must be followed before beginning a project. Failure to meet these requirements can have significant impacts on the overall scope and the timeline of the renovation.

Relating this back to an ROI program, this vital step requires a thorough inspection of all the federal and state regulatory requirements as well as any internal practices established by your organization.

• Does your existing training program comprehensively identify all the regulatory requirements your ROI team must follow?

• Does your state have significant state laws that govern the ROI process? State laws often govern turnaround times for completing requests and the release of sensitive information, including but not limited to HIV status and related documentation, genetic testing, behavioral health treatment, substance abuse treatment, and confidential visits for minors.

• Do you appropriately and consistently apply the minimum necessary standard set forth by HIPAA?

• Does your EHR system have a mechanism to flag any sensitive or restricted information to ensure it’s not released inappropriately?

Step 4—Do Your Research
Renovation projects are exciting, but that excitement often leads to making rash decisions without properly doing the required research. And research can mean many things to an ROI program overhaul. As you tick through these planning steps and begin to build your renovation plans, it might have become evident that your existing training plan is a bit beyond repair, and you need to research vendors to outsource your ROI process. While evaluating your existing training program, you may have discovered that the statutory requirements in your state are too extensive or changing rapidly, and it’s better to trust an expert to build a thorough training program. Or perhaps your program is nearly where you want it to be, and you’re simply looking to supplement your existing training program with some additional external training.

Step 5—Decide Whether to Hire an Outside Contractor
The time spent researching educational offerings or vendor partners will help inform your decision on whether to engage an outside contractor or go it alone, DIY style. But at this point in the planning process, you’ve done your due diligence and are making educated, informed decisions. You’ve spent the time researching options, so now you can confidently put your project out for bids.

Step 6—Establish a Timeline
Establishing a timeline for your renovation can also help finalize your plans or help you make some difficult decisions. If your ROI program is in significant disrepair, time is of the essence. If your program is relatively stable, perhaps a larger renovation might be an option, but plan accordingly (and always estimate a little extra time, particularly for any bumps along the way).

Step 7—Renovations Don’t Have to Be Trendy
Don’t be distracted by the latest trend or high-tech advancements. Talking refrigerators, I’m talking about you again. We can often get distracted by the next big thing, the latest technology, but those shiny objects are not always the most practical. Be sensible and make decisions based on your ROI program and what’s best for your organization. A no-frills approach can be just as effective as the next best thing.

Step 8—Set up a Maintenance Schedule
While you can move forward with a renovation plan without establishing a maintenance schedule, fight the urge to skip the step. Go back over your renovation plans and determine what steps will be needed to maintain this new process. If keeping up with regulatory changes has been a thorn in your side, make sure it’s part of your annual review of the ROI program. If ongoing competency measurement has been a challenge, ensure it’s a priority.

Now roll up those sleeves and get to work!

— Jennifer McCann, RHIA, CHPS, CTR, is the director of client relations and strategy at Haugen Consulting Group. She has more than 20 years’ experience in the HIM profession. As an active member of the Colorado Health Information Management Association, she’s held several offices and chair positions and is president-elect for the 2022–2023 term.