How Do I Hand Off Patient Scheduling and Intake Without Violating HIPAA?
HIPAA allows healthcare providers and clinics to outsource certain tasks, including scheduling and intake. Outsourcing partners in these relationships are referred to as business associates and are required to:
- Sign a Business Associate Agreement (BAA)
- Only access the minimum amount of protected health information (PHI) necessary to do their job, and
- Follow HIPAA’s Security Rule safeguards.
Through all of this, the clinic remains responsible for the patient’s PHI, and must choose a partner that can clearly demonstrate and certify that they meet all three requirements.
What HIPAA actually requires when you outsource
HIPAA does not prohibit outsourcing front-desk work. It only dictates the proper way to structure that handoff. Clinics are able to partner with healthcare BPOs as long as both parties are able to ensure that PHI is kept secure through every step of the process.
The Business Associate Agreement
If a vendor handles PHI on behalf of your clinic, the vendor is required to sign a BAA before the work can start. A HIPAA-compliant BAA helps to define all of the permitted uses, safeguards, and breach-reporting duties inherent in the partnership.
Subcontractors are covered too
Partners are also allowed to use their own vendors under HIPAA. If your vendor subcontracts with another vendor (for instance, a phone or messaging platform), your vendor will also need to sign a BAA with their subcontractors.
What safeguards should I confirm before signing?
Before you sign a BAA with a patient scheduling vendor, verify the following:
Access limited to what the job needs
Schedulers and intake staff may only access the minimum amount of PHI necessary to carry out their assigned tasks, compliant with HIPAA’s “minimum necessary” standard.
Secure systems and audit trails
Confirm that all systems are secure and documented by ensuring that vendors have role-based logins, encrypted communication, and that logs are kept showing who accessed which records and at which times.
Trained, accountable staff
Confirm that your vendor’s staff is kept accountable and competent. Ask your vendor for documented HIPAA training, signed confidentiality agreements, and named compliance contracts to verify that you and your vendor’s team are on the same page, both legally and in terms of your mission.
Where do handoffs typically go wrong?
Problems tend to arise from the everyday shortcuts that vendors take, as opposed to full-on negligence or malice. Risks like sharing logins, sending PHI through unsecured text or email channels, the use of personal devices, or neglecting a clear process for when things go wrong can all lead to breaches and HIPAA violations.
Breach response gaps
BAAs should spell out explicitly what needs to happen in the event of a suspected breach, including how quickly the vendor is required to inform the clinic of the incident. Vague language around the timeframe leaves too much room for guesswork and loopholes, so it’s imperative to be explicit and deliberate here.
What questions should I ask a scheduling partner?
Will they sign a BAA? Do they have BAAs with their own subcontractors?
A medical scheduling partner must sign a BAA with you and with any subcontractors they plan on working with.
Who on their team can see patient records? How is that access restricted and logged?
Access to PHI must be role-based, available only to those for whom the information is necessary for doing their job, and only the minimum amount of information necessary to carry out the work should be accessed at any time. Patient records must be stored or moved only through secure systems, and audit trails must show who has accessed what information and when.
How do they report expected breaches?
BAAs should plainly state the actions a vendor plans to take in the event of a breach and how quickly they will notify you. The timeframe of breach disclosure should be explicitly stated and not left to guesswork with words like “quickly” or “promptly”.
How to get started safely?
The initial step is to understand your current compliance measures and workflow through a thorough review, before sharing any PHI with a potential vendor.
Are you ready to get started with a HIPAA-compliant vendor for your patient scheduling? Schedule a conversation with our team.
