HIPAA Compliance for Counselors: Documenting Known Issues

PHI, or protected health information, refers to any individually identifiable health information that is created, received, maintained, or transmitted by a HIPAA covered entity or its business associates. PHI includes a broad range of personal health information that is linked to an individual, which can be used to identify them.

Here are some examples of PHI:

1. Personal details such as name, address, date of birth, phone number, and email address
2. Information related to an individual's medical condition, diagnosis, treatment, and medication falls under PHI. This includes laboratory test results, doctors' notes, progress reports, and treatment plans
3. Any information related to the payment for healthcare services including insurance details, billing records, and financial information
4. Any information regarding an individual's health insurance coverage, policy numbers, and claims information
5. Therapy session notes, psychological evaluations, and any other information related to mental healthcare
6. Genetic test results or family medical history that can be used to identify an individual

FYI: Healthcare providers, staff, and business associates are equally responsible and equally liable.

As a therapist, there are several steps you must take to ensure HIPAA compliance and maintain the confidentiality of your clients' information. Here are a few (for a complete list you can refer to the Kate Walker Training HIPAA training for licensed professionals and the HIPAA training for unlicensed staff):

• Regularly assess potential risks to the security and privacy of PHI within your practice.
• Identify vulnerabilities and take steps to mitigate them.
• Educate your staff about HIPAA requirements and establish clear privacy policies and procedures for handling PHI.
• Inform your clients about their rights, how their information will be used, and the circumstances under which it may be disclosed.
• Obtain written consent from clients for any necessary disclosures.
• Use Business Associate Agreements if you work with any third-party vendors or service providers who handle PHI on your behalf.
• Regularly review HIPAA regulations and guidelines to stay informed about any changes or updates.
• Document known issues.

A known issue is anything in your practice that you can control (like you are not going to purchase the $$$ HIPAA compliant email software) and can't control (the individual actions of your staff members).

Documenting known issues is the first step. Explaining how you mitigate risk related to that known issue is the second step.

For example, you might not be able to purchase expensive HIPAA-compliant email software right now. In response to that ‘known issue,' you train staff to never use the current email software with clients. You document this in your yearly self-audit.

Will you still face consequences if one of your hired therapists goes rogue and does it anyway and there is a breach?

Absolutely BUT, you can at least show that you were aware of the issues you could control (email) and you took steps to mitigate the issues you could not (training employees).

Understanding some key elements can help practice owners enhance their adherence to HIPAA regulations and better protect client privacy. When you own a small or medium-sized practice, HIPAA compliance for counselors is an ongoing process. By being diligent and proactive, you can create a secure and confidential environment for your clients while adhering to the necessary legal and ethical standards.