My name is Michael Fine. I am the Managing Partner of the largest Family Practice in Rhode Island, and Past-President of the Rhode Island Academy of Family Physicians, but I am also a Family Physician in practice in Pawtucket, Rhode Island, and in Scituate Rhode Island, the former, a busy urban practice that serves a very diverse, economically stressed population, and the latter, a rural practice that serves a exurban, still farming, country town, so that my days are sometimes split between caring for recent Columbian immigrants, Brown professors, and dairy farmers. I am speaking today both for myself and for the Rhode Island Academy of Family Physicians, whose executive board I conferred with in preparing these remarks.
Before I focus on HIPAA itself, I want to talk for a moment about Family Practice, and Primary Care in Rhode Island, so that there is a context in which I can set my remarks about HIPAA itself.
First, it is important you understand that Primary Care in Rhode Island is still largely a retail, Mom-and-Pop operation. Rhode Island reimbursement is 10 to 20 percent less than Massachusetts or Connecticut, which means there is less cash flow for capital development. We practice in groups of one and two, and make it up as we go along. When I said I work in the largest Family Practice in Rhode Island, that’s six full time equivalents. There are a few large primary care groups of 30 to sixty physicians, but all of those are struggling to justify their size in terms of economies of scale, which may not exist in the primary care world, or if they exist, probably occur in fairly small (3-8) single specialty primary care physician groups. Most primary care physicians don’t have an office manager, a controller, or a compliance officer. Some don’t have a practice attorney or accountant. Most of us think our main function is patient care, and some of us think that patient care alone will get us through the day.
In this way, primary care physicians are acrobats of the particular. That is, we focus on one person at a time, and try to sort their health challenges for them, one health challenge at a time, in a world that requires constant juggling. We juggle patients needs, hospitals needs, health plan needs, nursing home needs, visiting nurse needs, government needs, vendor of medical equipment needs, information from the internet, drug company advertisements and detail people. You haven’t seen anything until you’ve seen, and tried to make sense of, a form called the Home Health Certification and Plan of Care, a form I get to complete 4 or 5 times a week.
For us, the HIPAA problem is one of a long list of problems that have acronyms –OSHA, CLIA, Stark I, Stark II, , ,E&M Coding, PHOs, PSOs, IPAs and HMOs -- that don’t really seem to have anything to do with patient care, but which we perceive as one more bean bag to juggle, one more plate to spin. Each of the Acronym problems was accompanied by its own set for, mysterious rules, threats and profiteers.
The rules are always not quite certain yet, but the final rule will be out in a few months, and someone is always saying how important it is to prepare to comply with the final rule, though we have never seen a final rule that isn’t constantly changing, so we have learned to assume that there really are no rules, just today’s version.
The threats are always vague but ominous. We will go to jail, we will loose our licenses, someone will fine us more money then we make in a decade, someone else is going to take way our market-share, a curious notion to people who often work 14 hours a day and want nothing more than to go home and get some sleep.
The profiteers are always people who appear from no where to help us solve a problem we didn’t know we had. They make recommendations. They charge $99 for a book, $199 for a seminar, and $999 to $9999 for a private evaluation of our policies and procedures, and they provide many disclaimers that protect them in case they are wrong.
Our acronym problems get attention after all the other fires are put out. Remember, we are the folks who look at the sore throats and listen to the hearts of the 2500 people we each care for, and there is no acronym that is as compelling as someone you know and care about who is sick.
Those of us who worry about confidentially worry about it in the context of running into the people who are our patients in the grocery store, and do that at the level of trying to decide whether its okay whether to greet a patient before they greet us. We have all developed listening skills, so when a concerned, or nosy, neighbor who is a patient wants to know something about someone else who may or may not be a patient, we listen attentively but then give nothing away, not even acknowledge that the inquired-about person is even a patient of ours.
But in fact, confidentially is a two-edged sword. In order to be best at patient care, we rely on breaches of confidentiality provided for us by family members or neighbors. Who is drinking? Who isn’t coming out of the house? Who is loosing weight but won’t come to the doctor? Good primary care is a high wire act that causes us to be open to all the sources we can gather about the people we care for, while not falling into the abyss of violations of trust.
That said, here is what small primary care practices know about HIPAA. First, we know there is a rule out there, and one of these days they will figure out what the actual regulations are and tell us what the rule is and what we are supposed to do to comply with it. Some of us know that everyone is supposed to file for an extension, because no one really knows how to comply as things stand, and we all hope that during the next year, someone will tells us clearly what it is we are supposed to do.
We get letters from our professional organizations tell us what to do, but those letters are usually confusing. I’ve reprinted a paragraph from one of those letters here, a letter to all Rhode Island Health Professionals from the Rhode Island Medical Society, RI MGMA, and all Rhode Island Health Plans, which we received August 22, 2002. Perhaps smarter people than I can understand it. I can’t . We get these letters all the time, and communications like this make the eyes of primary care physicians glaze over.
“Please note the original date for compliance with the transaction and code sets is October 2002. In December 2001, the Administration Simplification Compliancee Act (ASCA, Public Law 107-105) gave covered entities not compliant by October 16, 2002 the opportunity to extend their compliance deadline by one year to October 16, 2003. This extension opportunity is applicable to all HIPAA-covered entities other than small health plans, those with less than five million in annual receipts do not have to file an extension and have until October 16, 2003 to become complaint. In order to qualify for this extension, covered entities must submit a compliance plan before October 16, 2002.”
We also get letters from health plans, telling us what they are doing, but those letters don’t mean much to us. Those letters all look the same and say the same thing, and many of us get invited to meetings at which, it appears, the same information is to be repeated, and mostly is about what standards the health plans are using for billing information, standards that don’t seem to apply to us directly, since we have to submit claims on systems the plans control and we don’t. It looks the plans feel they need to invite us to meetings so they can be in compliance, but it doesn’t look like we need to come to the meetings for us to be in compliance, so we don’t go.
But then, its not really clear what small practices need to do to be in compliance, so most of us aren’t doing anything much at the moment.
I’d like to tell you what we are doing to support the privacy rule training mandate, but I’m afraid I don’t know what the privacy rule training mandate is
There are consultants and courses from a host of professional organizations, but it looks like, even those all cost time and money, they are not going to say much beyond “file for an extension, and see what happens.”
Some of us have spend the time and money, and have noted, with sadness, that it is time and money that could have been spent learning about diabetes management or congestive heart failure. This turns those of us who have not yet become cynical, cynical about the role of government in health care.
As I said before, my practice is the largest Family Practice in Rhode Island, and is probably a little more adept at dealing with the regulatory environment then most. We have a Practice Administrator, and we even have a compliance officer. That person has spent about 50 hours trying to sort out what it is we are supposed to do, wading through websites and instruction manuals, and so we have applied for an extension. In truth, we are probably reasonably compliant, even though we don’t really know what compliance means: we use all HIPAA compliant billing software and HIPAA compliant EMR, and maintain appropriate firewalls so our electronic database is not accessible from the Internet. Over a year ago, we developed a confidentiality policy that all our employees and all our vendors are required to sign.
But few smaller practices have the resources, time or energy to do this work.
How could we make this all easier? Please don’t ask us to do anything until you are sure what it is you need us to do. Please understand that our only job is patient care, and understand that resources we commit to anything other than patient care diminishes that. Please understand that confidentially is what we want to achieve, but that sometimes it’s a two edged sword – as we have a role in the communities where we practice, and that role does not always allow confidentiality to be air tight. Please don’t ask us to do things for health plans so health plans can be in compliance. Society has given health plans inappropriate power over us by refusing to regulate the market power of those plans. If you make us devote time and attention us to satisfy them, patient care will suffer again.
Instead, understand who small practices are, the role they play in the health care system, and what they do every day. Lets design some templates so practices can use follow the directions, templates that are written in English, so we can continue doing what we are here for, which is putting patient care first.
Respectfully submitted,
Michael Fine, M.D.