HIPAA Tip:
FAQ About OHCAs
[Posted 03/20/03]
|
|
|
|
NEED MORE HIPAA
HELP? |
CMA members, if you can't find the
information you need here, call CMA's HIPAA Hotline
at 415/882-3311 or contact CMA's legal information specialists by
email at legalinfo@cmanet.org.
| |
My hospital says I am in its "OHCA." What does that mean?
An OHCA, or organized health care arrangement, is an administrative
construct under HIPAA that allows information sharing between a hospital and its
medical staff, between a health plan and its contracted providers,
and between an IPA and its contracted providers. According to
the U.S. Office of Civil Rights, members of an
OHCA can share protected health information (referred
to as PHI) with other members of the OHCA on matters
of common concern (at least to the extent those members are
also covered by HIPAA), without a separate business-associate agreement. An OHCA member can
also share the protected information with another member’s business associates. If you are
on staff at several hospitals, you will be a member of several
OHCAs.
My hospital wants me to use Its "Notice of Privacy Practices." Is
this okay?
Generally speaking, it will be a convenience for you. In
an OHCA, the hospital and medical staff members can have a joint "notice of
privacy practices" for all inpatients. In the absence of such a joint notice, a
physician who is covered by HIPAA would have to give each new patient, or an
existing patient who has not yet received the physician’s notice, an individual
notice of privacy practices. This would not be very convenient. Hospitals are
not required to offer a joint notice, but many will do so. Please be sure to
review the hospital’s notice of privacy practices to be sure it does not present
any problems for you as it applies to your hospital practice and records.
My hospital wants me to sign an agreement about my being in the OHCA.
Do I have to Sign it? Technically, no agreement is required to
establish an OHCA. By definition under HIPAA, a hospital and its medical staff
are an OHCA. But an agreement is necessary if physicians wish to use the OHCA’s
privacy notice. CMA suggests that the medical staff officers review the proposed
agreement to make sure it benefits the entire medical staff, and does not create
unnecessary burdens for those physicians who are not covered by HIPAA. Moreover,
since issues concerning the confidentiality of medical information are central
to "the professional work performed in the hospital," any such agreement should
be included in the medical staff rules and regulations.
Do you have other questions about HIPAA compliance? Buy the CMA/ PrivaPlan HIPAA Compliance Toolkit on CD-ROM or sign
up for CMA’s Total HIPAA
Compliance Workshop today and get the answers you need.
Contact: CMA’s HIPAA Hotline, 415/882-3311 or legalinfo@cmanet.org.
Previous HIPAA Tips:
HIPAA Tip: April 14 IS the Compliance Deadline
HIPAA Tip: Chart
Cabinets
How Sharp are Your HIPAA
Tools?
HIPAA Tip: Security Rule
Delay
HIPAA Tip: Sign-In
Sheets
HIPAA Tip: Using Patient
Names
HIPAA Tip: Using Reminder
Postcards
HIPAA Tip: Extension Does Not
Apply to Privacy Rule
HIPAA Tip: Inpatient/Outpatient Privacy
Notice Requirements Differ
HIPAA Tip: The Extension Deadline Has
Passed—Now
What?