Marie Livingston

Marie Livingston, associate general counsel for Savannah-based Southcoast Medical Group, said it has appointed a compliance officer and has begun informal training.

"We began informal staff and physician education in December to teach what HIPAA is about," Livingston said, noting that a formal training session won't take place until April."The biggest burden of this is getting the word out."

Livingston said Southcoast has also surveyed the physical building to determine what needs additional security features such as locks or extra doors.

Chamblee, who recently published an article on HIPAA, explained the law has three primary areas of compliance that impact health care practices: transactions and code sets, privacy and security.

She said "transaction standardization" requires that all covered electronic transactions must be transmitted with standard codes and in standard formats.

Chamblee said the "privacy rule" defines the rights of patients and how medical providers must respond to these rights, and the administrative requirements of each practice to document policies and procedures to secure "protected health information" from intentional or unintentional access.

Chamblee added that most "security regulations" have a compliance deadline of April 2005, so these provisions are not as significant.However, she said some parts of the "security regulations" would be needed to achieve compliance with the "privacy rule."

...
Livingston of Southcoast Medical agreed: "I certainly want medical information being protected, but the amount of time, dollars and manpower to implement this is immense."

Livingston also pointed out that regulations require anyone doing business with a medical group to sign a "business associate agreement."This contract essentially makes non-healthcare businesses responsible for complying with HIPAA during their healthcare industry dealings.

"It is very complex," she said.

Others medical providers add that since HIPAA requires entities to keep a detailed list of all individuals who view medical records, the law burdens offices with a tremendous undertaking of paperwork.