Sabrina Ragland, a medical assistant with 12 years’ experience.docx

Sabrina Ragland, a medical assistant with 12 years’ experience,
works for a gastroenterologist,
Dr. Tim Taylor. She comes from a family heavily involved in
the medical fi eld. Her father was a
surgeon and her mother was his offi ce assistant. Two of
Sabrina’s sisters are nurses, and her
brother is a respiratory therapist. Her husband, Joe, is a
biomedical technician, and his mother,
Elsa Ragland, has been an RN for 40 years. For more than half
of her career, Elsa has worked
for a local internist, Dr. Royce Berry. A casual comment at the
Ragland family picnic resulted in
a medical professional liability lawsuit based on violation of
patient privacy. Sabrina and Elsa’s
careers were jeopardized by a simple exchange of what seemed
to be innocent information.
Vivian Adams, a 42-year-old hospital insurance biller, saw Dr.
Berry in his offi ce for pain
located in her lower left quadrant. Ms. Adams was not a new
patient but had not visited the
offi ce in approximately 2 years. When she arrived for her visit,
she was presented with the
offi ce privacy policy and was asked to sign the document.
Vivian glanced through it, signed it,
and saw the doctor. He performed an examination and found
that Vivian was likely suffering from
irritable bowel syndrome and prescribed medication. Ms. Adams
called the physician 1 week later complaining that she was no
better. Dr. Berry
changed her medication without seeing her and did not hear
from her again, other than her requests for refi lls of the

medication. After 6 months with
no improvement, Ms. Adams went to Dr. Taylor; after several
diagnostic tests, she was told that she had colon cancer and was
given a bleak prog-
nosis. She told Dr. Taylor that she blamed Dr. Berry for not
being more thorough in his testing. Sabrina was in the room and
heard the comment.
That weekend at the picnic, Sabrina mentioned Ms. Adams to
her mother-in-law and stated that the patient might sue Dr.
Berry, although the pa-
tient never said those words. Elsa defended Dr. Berry and
proclaimed that he was a good doctor, then expressed her hope
that Ms. Adams would not
sue her employer. One week later, Elsa was in a grocery store
and saw Ms. Adams. Elsa immediately expressed her sympathy
about her diagnosis,
and then asked if there was anything she could do. Her intent
was to be kind and try to avert litigation against Dr. Berry. Her
gesture might have been
well received had Ms. Adams’ daughter, Terri, not been
standing with her. Terri was not yet aware that her mother had
been diagnosed with cancer.
Ms. Adams had told no one about her illness at that point. After
the incident at the grocery store the fi rst person Ms. Adams
told was her attorney.
While studying this chapter, think about the following
questions:
291
16
SCENARIO
Privacy in the Physician’s Offi ce

• When can the medical assistant discuss a patient, and with
whom,
and under what circumstances?
• What has HIPAA done for the medical industry and the
patients it
serves?
• When new policies and procedures are implemented, how can
the
staff embrace the changes and make the transitions easier?
• What happens if the patient refuses to sign the privacy policy?
1. Defi ne, spell, and pronounce the terms listed in the
vocabulary.
2. Explain how the HIPAA Privacy Rule benefi ts the
healthcare
industry and patients.
3. List what must be included on a Notice of Privacy Practices.
4. Explain the difference between Title I and Title II of the
HIPAA
Privacy Rule.
5. List the rights that patients have under the Privacy Rule.
6. Briefl y explain what is expected of healthcare providers in
relation to the Privacy Rule.
7. Describe an incidental disclosure.
8. List the three instances when a parent is not considered the
child’s representative.
9. Explain why a provider can discuss protected health

information
with a patient’s friends and family.
10. Discuss the role of the Notice of Privacy Practices in
emergencies.
UNIT THREE HEALTH INFORMATION IN THE MEDICAL
OFFICE292
O
ne of the most valuable character traits that the medi-
cal assistant develops is the ability to adjust to change
and be fl exible. The medical profession evolves rapidly,
and advances in technology allow medicine to progress. Think
of how few computers were found in physician’s offices 40
years
ago. Today, computers adorn almost every desk. Change is a
concept that many individuals resist.
The creation of privacy and security laws was a huge step
toward more efficient healthcare and faster reimbursements.
Technology often forces organizations to move forward
somewhat quickly. Healthcare facilities with already strapped
budgets sometimes view such innovations as a hindrance.
Compliance officers at larger facilities may wonder if additional
federal regulations are necessary.
business associates Individuals or organizations that perform
or assist a covered entity in the performance of a function
or activity that involves the use or disclosure of individually
identifiable health information.

complainant (kuhm-pla -nuhnt) Person making a complaint
against a person or organization.
covered entity An organization that transmits information in an
electronic form during a transaction, as defined by HIPAA.
divulge (duh-vuhlj ) To make known, as a confidence or secret.
due diligence Also known as due care; the effort made by an
ordinarily prudent or reasonable party to avoid harm to
another party or himself; doing everything possible to prevent
something from happening.
electronic media Means of electronic transmission, including
the Internet, private networks, dial-up phone lines, and fax
modems; includes information moved from one place to
another while stored on an electronic device.
healthcare providers Providers of medical or health services,
individually or as organizations, that furnish, bill for, or are
paid for services or products.
individually identifiable health information Any part of a
patient’s health record that is created or received by a covered
entity.
infer To derive as a conclusion from facts and premises.
Office for Civil Rights (OCR) The division of the federal
government that enforces privacy standards.
Office of Inspector General (OIG) Established to protect the
integrity of the Department of Health and Human Services
(HHS), the office conducts audits, investigations, and
inspections involving the laws that pertain to HHS.

personal health information The patient’s own information
that pertains to his or her health.
preclude To rule out in advance.
prevalent Generally or widely accepted, practiced, or favored.
privacy officer A person designated to ensure compliance with
privacy standards for a covered entity.
protected health information (PHI) Any individually
identifiable health information that is transmitted and/or
maintained in electronic form.
transactions As defined by HIPAA, transmissions of informa-
tion between two parties to carry out financial or administra-
tive activities related to healthcare.
verbiage A manner of expressing oneself in words.
Many healthcare workers feel that they can say nothing
to anyone, about any patient, at any time. By understanding
the compliance that HIPAA requires, the employees of the
physician’s office can feel secure about their dealings with the
patients and other individuals who frequent the facility.
THE HEALTH INSURANCE PORTABILITY AND
ACCOUNTABILITY ACT
The Health Insurance Portability and Accountability Act
(HIPAA) was introduced in Chapter 7. HIPAA, enacted in 1996,
is a group of laws that affect both employees of a healthcare
facility, insurance company, or other covered entity and the
patients the organizations serve. The federal government
National Accreditation Competencies and Content
CAAHEP COMPETENCIES ABHES COMPETENCIES

General Professionalism
3.c.(2)(a). Identify and respond to issues of confi dentiality 1.b.
Maintain confi dentiality at all times
3.c.(2)(b). Perform within legal and ethical boundaries 1.d. Be
cognizant of ethical boundaries
3.c.(2)(d). Document accurately
Legal Concepts
5.a. Determine needs for documentation and reporting
5.b. Document accurately
5.c. Use appropriate guidelines when releasing records or
information
5.g. Monitor legislation related to current healthcare issues
and practices
5.h. Perform risk management procedures
293CHAPTER 16 Privacy in the Physician’s Offi ce
conditions that in the past prevented or limited an employee
from obtaining health insurance coverage. If an individual left
a job with insurance coverage and attempted to secure new
coverage, a preexisting health condition would often preclude
that person from obtaining coverage for that illness. Many
individuals were refused any coverage at all, especially if the
condition was a serious one, such as a heart condition or high
blood pressure. Today, because of HIPAA laws, discrimination
against individuals who are in poor health now or were in the
past is prohibited. The regulations limit the use of preexisting
condition exclusions and guarantee that certain individuals can
purchase healthcare insurance after leaving or losing a job.
The goal of Title II is to reduce administrative costs in the

healthcare industry. Often goals sound simple, but to reach a
goal, many actions are necessary. The medical assistant who
enters school sets graduation as his or her goal. However, in
order to graduate, he or she must study, pass tests, arrange for
childcare, sacrifice sleep, adjust working hours, readjust to the
school environment, and make any number of other adjustments
to reach the goal. Likewise, to simplify the administrative costs
involved in patient care, many different objectives must be
met.
Provisions of Administrative Simplification
If given a choice to use a computer or an electric typewriter
to write a report, most individuals would likely choose the
computer. Because computers can perform so many duties
much more rapidly than those that were performed manually,
they have become indispensable to the healthcare profession.
Electronic media is used daily in modern physician offi ces
and healthcare facilities. However, as computers have become
prevalent, patients have begun to express concerns about who
sees protected health information (PHI) and what is done with
that information. Title II contains two parts:
• Development and implementation of standardized
electronic transactions using Standard Code Sets
• Implementation of privacy and security procedures to
prevent the misuse of health information by ensuring
confidentiality
The second part of the administrative simplification provision
deals with privacy, confidentiality, and security of PHI and is
the focus of this chapter.
Patient Rights
Separate from the Patients’ Bill of Rights, HIPAA provides for
several patient rights. These include the following:

• The right to notice of a facility’s privacy practices
• The right to have access to, view, and obtain a copy of
their PHI
• The right to restrict certain parts or uses of their PHI
• The right to request that communications from the
facility be kept confidential
• The right to request the facility to amend the PHI
• The right to receive notice of all disclosures of their PHI
These patient rights are the heart of the HIPAA Privacy
Rule. These rights must be protected by those involved in the
required all covered entities to be in compliance with HIPAA
by April 14, 2003 (small healthcare plans received an extra year
to comply, extending their deadline to April 14, 2004).
Effect of the HIPAA Privacy Rule
The HIPAA Privacy Rule creates national standards to protect
individuals’ medical records and other personal health
information. This is the first time that such a group of laws has
been enacted to protect patient privacy. The creation of the
HIPAA Privacy Rule provides benefits to both patients and their
healthcare providers:
• Patients have more control over their medical records.
• Patients are able to make informed choices regarding how
their personal health information is used.
• Boundaries are set on the use and release of health
records.
• Safeguards are established that healthcare providers must

achieve to protect the privacy of health information.
• Violators are held accountable and face both civil
and criminal penalties if patient privacy rights are
compromised.
• The Privacy Rule protects public health by striking a
balance when public responsibility supports disclosure of
personal health information.
Under the few laws that existed before the HIPAA Privacy
Rule, personal health information could be distributed to others
without either notice or authorization from the patient, even if
the reason for the exchange of information had nothing to do
with
the patient’s medical treatment or healthcare reimbursement. A
health plan could pass patient information to a financial lender,
who might then deny the patient a home mortgage or credit
card based on his or her health history. Employers could obtain
health information and use it in personnel decisions. Because
computers make information exchange so much easier, laws had
to be enacted to protect patient privacy (Figure 16-1).
Title I and Title II Provisions
HIPAA contains two provisions, Title I and Title II. Title I
regulates insurance reform, and Title II deals with
administrative
simplification. Title I limits the use of preexisting health
FIGURE 16-1 The HIPAA Privacy Rule was created in part to
give patients more
control over their personal health information.

OFFICE294
healthcare profession and are explained in more detail in the
following section.
Right to Notice of Privacy Practices
Patients have the right to a copy of the Notice of Privacy
Practices used in the physician’s office (Figure 16-2). A copy
of the Notice of Privacy Practices must also be prominently
displayed in the office. This policy is developed by the
individual facility and must be written in terminology that the
patient will understand. Patients should be given a copy of
the Notice of Privacy Practices and sign an acknowledgement
that they received the copy. If a patient refuses to sign the
acknowledgement, the medical assistant can note that the
document was offered to the patient and he or she refused to
sign. This proves due diligence on the part of the office and that
a good faith effort was made to provide the patient with privacy
information. Most patients will sign the document. Be prepared
to explain the Notice of Privacy Practices to the patients.
The Notice of Privacy Practices must include the following:
• How PHI is used and disclosed by the facility
• The duties of the provider to protect health information
• Patient rights regarding PHI
• How complaints can be filed if patients believe their
privacy has been violated
• Whom to contact at the facility for more information
• The effective date of the Notice of Privacy Practices
Right to Access Protected Health Information
Patients must be allowed access to their personal health
information. The maker, not the patient, owns the record;
however, the HIPAA Privacy Rule grants patients the right to
access, inspect, and obtain a copy of their health information.

Most physicians’ offices require patients to request access in
writing and act on that request within 30 days (Figure 16-3).
HIPAA does restrict access to psychotherapy notes, information
compiled for use in legal proceedings, and information
exempted
from disclosure by the Clinical Laboratory Improvement
Amendment (CLIA).
Right to Request Restrictions on Certain Uses and
Disclosures of Protected Health Information
Patients can request restrictions on the use of their PHI. For
instance, if a patient had an abortion many years ago and does
not want that information released, she has the right to ask a
provider not to divulge that information. The provider does not
have to agree to the request but must review it and give a good
reason for the restriction not to be honored. An appeal process
should be in place for instances when the provider does not
agree with the restriction.
Right to Request Confidential Communications
Patients have the right to express where they wish to receive
communications from the provider. The patient may prefer
to be contacted on a cell phone instead of a home phone,
or through email. Providers must accommodate reasonable
requests. Suppose a married female patient comes to the clinic
for a pregnancy test. Further suppose that her husband has had
a vasectomy. Clearly, a call to her home phone number with
test results could initiate personal and private difficulties for
the patient. Make certain that the preferred method of com mu-
nication is used when contacting any patient (Procedure 16-1).
Right to Request Amendment of Protected Health
Information
Patients can request that changes be made to their medical

record, if they inspect it and find an error. This request should
be made in writing. Providers must review the request and act
on it in a timely manner, generally within 60 days. The request
may be denied if the provider was not the creator of the record,
as in the case of records provided by a consulting physician.
Or, the provider may believe that the information is correct
and complete. A review process must be in place by which such
requests can be considered.
Right to Receive an Accounting of Disclosures of Protected
Health Information
Patients may request that the physician provide an accounting
of all disclosures of the patient’s PHI that are nonroutine (as
defined in the facility’s Notice of Privacy Practices). Patients
are
entitled to receive this accounting annually without charge, but
the provider can charge patients for additional accountings.
Responsibilities of Providers or Health Plans
The responsibilities placed on providers and health plans seems
extensive when one reads the actual verbiage of the law. Do
not be intimidated when reading a publication written by the
federal government. These documents are rarely written for ease
of understanding and may need to be reread several times before
the reader grasps the meaning of a regulation.
In general, the HIPAA Privacy Rule requires activities such
as the following.
• Notifying patients of their privacy rights
• Explaining how their health information might be used
• Development of privacy procedures in the facility
• Implementation of those privacy procedures
• Training employees so that they understand the procedures
in place

Seven Components of HIPAA Compliance
Offered by the Office of Inspector General
To simplify compliance with HIPAA regulations, the Office of
Inspector
General (OIG) has developed seven components of an effective
compliance program. These components are as follows:
• Conducting internal monitoring and auditing
• Implementing compliance and practice standards
• Designating a compliance officer or contact
• Conducting appropriate training and education
• Responding appropriately to detected offenses, and developing
corrective action
• Developing open lines of communication
• Enforcing disciplinary standards through well-publicized
guidelines
WALNUT HILL FAMILY AND PREVENTIVE MEDICINE
CLINIC, PA
1701 W. Walnut Hill Lane, Suite 200
Dallas, Texas 75229
214-549-1111 214-549-1222 (FAX)
[email protected]
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION
ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS

INFORMATION.
PLEASE REVIEW IT CAREFULLY.
YOUR MEDICAL RECORD (CHART) contains your symptoms,
examination, and test results, diagnoses, treatment, and
plan for follow-up. This is protected health information (PHI),
and is used for many reasons. Your medical record serves as a
• basis for planning your care and treatment (this includes
scheduling and appointment reminders)
• means of communication among the many health professionals
who contribute to your care
• legal document describing the care you received
• means by which you or a third-party payer can verify services
billed
• tool in educating health professionals
• source of data for quality control programs and medical
research
• source of information for public health officials (by law,
certain illnesses must be reported)
YOUR HEALTH INFORMATION RIGHTS
Although your medical record (chart) is the physical property of
the clinic, the information contained within the record
belongs to you. You have the right to:
• request a restriction on certain uses and disclosures of your
information
• obtain a paper copy of this notice
• inspect and obtain a copy of your medical record as provided
in our office policy manual
• amend your health record (requests must be made in writing)
• request communications of your health information by
alternative means or at alternative locations
• revoke your authorization to use or disclose health

information except to the extent that action has already been
taken
• obtain an accounting of any non-routine disclosures of your
health information
OUR RESPONSIBILITIES
The Walnut Hill Family and Preventative Medicine Clinic is
required to:
• maintain the privacy of your medical record (chart)
• abide by the terms of this notice
• notify you if we are unable to agree to a requested restriction
• accommodate reasonable requests you may have to
communicate health information by alternative means or at
alternative locations or phone numbers
We reserve the right to change our practices and to make new
provisions effective for all protected health information we
maintain. We will post a copy of our current notice in a visible
location at all times. We will not use or disclose your protected
health information without your authorization, except as
described in this notice.
FOR MORE INFORMATION OR TO REPORT A PROBLEM
Please contact Sue Singer or Ron Rachels during regular office
hours at 214-549-1111 or you can email or mail questions or
complaints to Dr. Robbie Speasak at the above address. If you
believe that your privacy rights have been violated, you can
file a complaint with the Secretary of the Department of Health
and Human Services. You will not be penalized in any way for
filing a complaint.
FIGURE 16-2 Notice of Privacy Practices.

OFFICE296
Phone
Address
_____________________________________________________
___________
_____________________________________________________
___________
_____________________________________________________
___________
_____________________________________________________
___________
City ____________________________ State ______________
Zip_________________
Email Address
_____________________________________________________
______
Date of Last Office Visit
___________________________________________________
Please note below what information should be copied or
provided:
_____________________________________________________
__________________
_____________________________________________________
__________________

_____________________________________________________
__________________
_____________________________________________________
__________________
_____________________________________________________
__________________
❒ Yes ❒ No
____________________________________________
_________________________
Patient Signature Date
__________________________ Date Mailed
_______________________
_____________________________________________________
_____
REQUEST TO ACCESS MEDICAL RECORD
Patients have the right to access their personal health
information. We will be happy to accommodate any patient who
wishes
to exercise this access to inspect or obtain a copy of the record.
Please provide the information requested on this form. This
request will be acted upon within thirty (30) days. Standard
copy charges will apply.
Patient Name
Date of Birth

Please note below the following change(s) that need to be
addressed:
I wish to receive a regular accounting of non-routine disclosures
of my protected I wish to receive a regular accounting of non-
routine disclosures of my protected health information.
FOR OFFICE USE ONLY
Date Copied
Certified Mail #
FIGURE 16-3 Request to access a medical record.
• Designating an individual to be responsible for
implementation
• Securing medical records so that they are not available to
those who do not need them
PERMISSION TO DISCLOSE PROTECTED HEALTH
INFORMATION
Once the patient has signed the Notice of Privacy Practices, the
physician may disclose PHI in the manner that is described on
the policy. Virtually all of the daily operations that involve PHI
are covered under the Notice of Privacy Practices.
Some offices ask patients to sign a receipt of privacy practices
annually. Others simply post the current policy prominently
in the office, and state where it can be found on the original

notice that the patient signs. Using either method, every current
medical record should contain a signed Notice of Privacy
Practices, an acknowledgement that the patient received the
Notice of Privacy Practices, or a statement that the patient
refused to sign the notice. Physicians also use separate release
of information forms that detail exactly where to call a patient,
whether the patient prefers email communications, and/or
specific releases for human immunodeficiency virus (HIV)–
related and psychotherapy information (Figures 16-4 and 16-5).
At times, confl icting permissions may be an issue when
disclosing PHI. Suppose that a patient requests that a copy of
his or her medical record be sent to a third party, such as an
attorney. The patient signs the release at an office visit. Before
the medical record is copied and sent, the attorney forwards
a signed release for just the progress notes. Call the patient
first and attempt to verify what he or she wishes sent. Another
option is to adhere to the most restrictive request; in this case,
send only the progress notes. Always document any form of
communication about the patient’s preference in writing. The
medical assistant may find it necessary to ask the patient to sign
a new permission form. Do not hesitate to contact the patient if
any question arises about what he or she wishes to be released.
Identifying the Patient
Providers see numerous patients each day and the medical
assistant may not know each one by sight. Always insist on
identification when releasing any type of health information to
anyone. A state-issued drivers license or identification card is
the
best method of identification, but alternates may be necessary
for those who do not have that particular document. The office
policy manual should list acceptable forms of identification.
When making any type of disclosure, make certain to note why
the person has the authority to request and receive the PHI.

Patient Names and Sign-In Sheets
A staff member in a physician’s office may call out a patient’s
name when it is time to see the physician. Sign-in sheets that
list
patient names may also be used. Covered entities are permitted
to make such incidental disclosures if they comply with the
PROCEDURE 16-1
Identify and Respond to Issues of Confi dentiality
CAAHEP COMPETENCY: 3.c(2)(a)
ABHES COMPETENCY: 1.b
GOAL: To become profi cient at identifying issues involving
confi dentiality and respond to them in the manner prescribed
by offi ce policy.
EQUIPMENT and SUPPLIES
• Offi ce policy manual
• Offi ce procedure manual, if separate
• Release of information forms
• Notice of Privacy Practices
• Clerical supplies
• Patient medical records
PROCEDURAL STEPS
1. Review offi ce policy regarding release of patient
information and
confi dentiality in the facility.
PURPOSE: To make certain that offi ce policy is stringently
followed and that the offi ce remains in HIPAA compliance.

2. Review the Notice of Privacy Practices for the facility.
PURPOSE: To be sure that the offi ce’s privacy policies are
followed.
3. Review the facility’s Authorization to Release Medical
Records
form.
4. Thoroughly read the request for information that is presented
to
the facility.
PURPOSE: To determine what information is being requested.
5. Determine if the document is valid.
PURPOSE: No information should be released if the requesting
documents are not valid.
6. Determine the exact information that is being requested.
PURPOSE: Only the exact information being requested should
be
released.
7. Make certain that the release of information form either is
one
designed by the facility or contains all of the same information.
8. Make the requestor complete one of the facility’s request
forms,
if necessary.
9. Forward only the information requested to the person or
organization that presented the authorization for release of
information.

PURPOSE: No information that has not been requested can be
released without additional consent by the patient.
10. Release the information by mail or to the agent of the
requestor.
OFFICE298
Patient Consent to the Use and Disclosure of Health Information
for Treatment, Payment, or Health Care Operations
I understand that as part of my health care, the practice
originates and maintains paper and/or electronic records
describing my
health history, symptoms, examination and test results,
diagnoses, treatment, and any plans for future care or treatment.
I
understand that this information serves as:
I request the following restrictions to the use or disclosure of
my health information:
May we leave a message on your answering machine at home [
] or at work [ ]. Do not leave a message [ ]
May we leave a message with someone at your home using the
doctor’s name or the practice name: Yes [ ] No [ ]
May we leave a message with someone at your work using the
doctor’s name or the practice name: Yes [ ] No [ ]
Messages will be of a nonsensitive nature, such as appointment
reminders.
May discuss treatment, payment, or health care operation with

the following persons:
I understand that as part of treatment, payment, or health care
operations, it may become necessary to disclose health
information to another entity, i.e., referrals to other health care
providers, labs, and/or other individuals or agencies as
permitted
or required by state or federal law.
*If other than patient is signing, are you the parent, legal
guardian, custodian, or have Power of Attorney for this patient
for
treatment, payment, or health care operations? Yes [ ] No [ ]
FOR OFFICE USE ONLY
[ ] Patient refused to sign the consent form.
[ ] Restrictions were added by the patient (see restrictions
listed above)
[ ] “Consent form” received and reviewed by
on (date)
[ ] “Consent form” placed in the patient's medical record on
(date)
Signature
(Please check all that apply) Spouse [ ] Your Children [
] Relatives [ ] Others [ ] Parents [ ]
Please list the names and relationship, if you checked
“Relatives” or “Others” above
I fully understand and accept the information provided by this
consent.
Restrictions:

• A basis for planning my care and treatment,
• A means of communication among professionals who
contribute to my care,
• A source of information for applying my diagnosis and
treatment information to my bill,
• A means by which a third-party payer can verify that
services billed were actually provided,
• A tool for routine health care operations, such as assessing
quality and reviewing the competence of staff.
Print name of person signing Date
Messages or Appointment Reminders: (Please check all that
apply)
I have been provided the opportunity to review the “Notice of
Patient Privacy Information Practices” that provides a
more complete description of information uses and disclosures.
I understand that I have the following rights:
• The right to review the “Notice” prior to acknowledging this
consent,
• The right to restrict or revoke the use or disclosure of my
health information for other uses or purposes, and
• The right to request restrictions as to how my health
information may be used or disclosed to carry out treatment,
payment,
or health care operations.
FIGURE 16-4 Example of HIPAA-compliant patient disclosure
form. (From Klieger DM: Saunders textbook of medical
assisting, St Louis, 2005, Saunders.)

GENERAL MEDICAL HEALTH CARE
AUTHORIZATION FOR RELEASE OF MEDICAL
INFORMATION
General Medical Health Care 1234 Riverview Road, Anytown,
FL 33333
I,
to release medical, including HIV Antibody Testing,
Psychiatric/Psychological, Alcohol and/or Drug Abuse,
information records to:
I understand that if I consent to the release of any of my
medical records, the results of any HIV
Antibody Testing, Psychiatric/Psychological, Alcohol and/or
Drug Abuse information will be released.
I understand this consent may be cancelled upon written notice
to the hospital, except that action by the
hospital has been taken in reliance on this authorization, and
that this authorization shall remain in force
for a 90-day period in order to effect the purpose for which it is
given. Alcohol and drug abuse information,
if present, has been disclosed from records whose
confidentiality is protected by Federal Law.
FEDERAL REGULATIONS (42CFR, part II) prohibit making
any further disclosure of records without the
specific written authorization of the undersigned, or as
otherwise permitted by such regulations.
The confidentiality of HIV antibody test results is protected by
Florida Law [Fla. Stat.ANN. 381.609 (2) (F)],
which prohibits any further disclosure by a person to whom this
information has been disclosed,

without specific written consent of the undersigned or as
otherwise permitted by state law.
Print Patient’s Name Date of Birth Social Security Number
hereby authorize/ /
(Street) (City) (State) (Zip)
To:
Address
Please Specify Reason for Disclosure
For the purpose of: 1. Drs. appointment on:
From:
(Date of Authorization) (Dates to be Released)
To:
Patient’s Signature
Parent, Legal Guardian, or Authorized
Representative Signature
Relationship to Patient
Witness
2. Other:
FIGURE 16-5 Example of HIPAA-compliant patient disclosure
form containing HIV and psychologic information release.
(From Klieger DM: Saunders textbook of medical
assisting, St Louis, 2005, Saunders.)

OFFICE300
minimum necessary requirements of HIPAA (Figure 16-6). An
incidental use or disclosure is a secondary use or disclosure that
cannot reasonably be prevented, is limited in nature, and occurs
as a result of another use or disclosure that is permitted. The
Privacy Rule is not intended to impede customary and necessary
healthcare communications or practices or to require that all
risk of incidental use or disclosure be eliminated to satisfy the
Privacy standards. Disclosures that could occur as a byproduct
of engaging in healthcare communications or practices may be
considered acceptable under the Privacy Rule.
Incidental disclosures could include the following:
• Confidential conversations between providers or with
patients, if a possibility exists that they may be heard (e.g.,
by hearing the patient and physician talking through the
wall when in an adjacent examination room)
• Seeing other patient names when signing in
• A person not authorized to see PHI walks by medical
equipment and sees material containing individually
identifiable health information (e.g., seeing a patient’s
name on an ultrasound screen)
• Physicians speaking with patients in semiprivate hospital
rooms
• Healthcare staff orally coordinating patient care services

at a nurse’s station or central location within an office
• A pharmacist discussing a patient with a physician on the
phone when another person is standing nearby
Most physician offices have implemented sign-in sheets that
ideally allow only one patient to sign in at a time and prevent
them from seeing other patient names. Sign-in sheets that use
pressure-sensitive stickers are a good example. The patient
signs
in on the form, then the sticker is removed and placed either
in the patient’s medical record or on a log sheet. Some offices
are more technologically advanced and have a computer sign-in
system. The patient arrives and goes to the computer screen,
sees
his or her name, and then presses “enter” to signify that he or
she has arrived for the appointment. The patient name appears
only for 15 minutes or so before the appointment and for 15
minutes after. If the name is not on the screen, the patient is
directed to see the office staff. This subtly teaches the patient to
be on time for appointments. These devices save time, although
the patient must receive brief training on how to use the system.
The short time that the patient’s name is viewable on the screen
is an incidental exposure but is acceptable through HIPAA
guidelines as explained previously.
FIGURE 16-7 In most cases the parent is considered the child’s
representative
and is allowed to view ’the child’s medical records.
HIPAA MINIMUM NECESSARY STANDARD
[45 CFR 164.502(b), 164.514(d)]
Background
The minimum necessary standard, a key protection of the

HIPAA
Privacy Rule, is derived from confidentiality codes and
practices in
common use today. It is based on sound current practice that
protect-
ed health information should not be used or disclosed when it is
not
necessary to satisfy a particular purpose or carry out a function.
The
minimum necessary standard requires covered entities to
evaluate
their practices and enhance safeguards as needed to limit
unnecessary
or inappropriate access to and disclosure of protected health
informa-
tion. The Privacy Rule’s requirements for minimum necessary
standards
are designed to be sufficiently flexible to accommodate the
various
circumstances of any covered entity.
How the Rule Works
The Privacy Rule generally requires covered entities to take
reasonable
steps to limit the use or disclosure of, and requests for,
protected health
information to the minimum necessary to accomplish the
intended pur-
pose. The minimum necessary standard does not apply to the
following:
• Disclosures to or requests by a health care provider for treat-
ment purposes.
• Disclosures to the individual who is the subject of the
information.

• Uses or disclosures made pursuant to an individual’s
authorization.
• Uses or disclosures required for compliance with the Health
Insurance Portability and Accountability Act (HIPAA)
Administrative Simplification Rules.
• Disclosures to the Department of Health and Human Services
(HHS) when disclosure of information is required under the
Privacy Rule for enforcement purposes.
• Uses or disclosures that are required by other law.
The implementation specifications for this provision require a
cov-
ered entity to develop and implement policies and procedures
appropriate for its own organization, reflecting the entity’s
business
practices and workforce. While guidance cannot anticipate
every
question or factual application of the minimum necessary
standard
to each specific industry context, where it would be generally
help-
ful we will seek to provide additional clarification on this issue
in the
future. In addition, the Department will continue to monitor the
workability of the minimum necessary standard and consider
pro-
posing revisions, where appropriate, to ensure that the Rule
does
not hinder timely access to quality health care.
http://www.hhs.gov/ocr/hipaa/
FIGURE 16-6 HIPAA’s Minimum Necessary Standard
Overview.

Placement of Patient Medical Records
Many physician offices place medical records inside a wall
folder just outside of the examination room. By turning the
record so that the name cannot be seen by someone passing
through the hallway, the facility meets the minimum necessary
requirement in protecting patient privacy. The hallway area
should be supervised, and nonemployees should be escorted
when in the clinical area of the office.
Children’s Health Records
The Privacy Rule does allow parents to see the medical records
of their children as long as this is not inconsistent with state
law.
In most cases the parent is the child’s personal representative
under the Privacy Rule (Figure 16-7). However, several
instances
exist in which the parent is not considered the child’s personal
representative. These instances include the following:
• When the minor is the one who consents to care and the
consent of the parent is not required under state or other
applicable law (for example, in the case of an emancipated
minor)
• When the minor obtains care at the direction of a court
or a person appointed by the court
• When the parent agrees that the minor and healthcare
provider can have a confidential relationship
Discussing Information with Friends and Family
The Privacy Rule specifically permits covered entities to share
information that is directly relevant to the patient’s care with

a spouse, family members, friends, or other persons identified
by a patient. The covered entity may also share relevant
information with the family and these other persons if it can
reasonably infer, based on professional judgment, that the
patient does not object or that the action is in the best interest
of the patient. Remember that if the patient has requested that
such information not be shared with others, the provider must
honor that request unless it is deemed unreasonable.
Both covered entities and business associates can discuss
a patient’s bill with a person other than the patient to obtain
reimbursement. No limit is placed on to whom such a disclosure
may be made. However, the Privacy Rule does require a covered
entity or business associate to reasonably limit the amount
of information disclosed for such purposes to the minimum
necessary and to abide by reasonable requests for confidential
communications and restrictions that the patient has
requested.
Telephone Messages and Faxes
Medical assistants must communicate with patients, and that
communication is often initiated with a telephone call (Figure
16-8). At times the patient is not at home or available and the
medical assistant must use professional judgment about leaving
a message, as well as about how much information to disclose to
the person who answers the telephone. Even leaving a message
on an answering machine can be questionable, because no one
is sure who will hear a message containing PHI.
If the patient has requested that the provider or provider’s
employees communicate only in a confidential manner, such as
by alternative means or at an alternative location, the provider
must honor that request if it is reasonable. For instance,
requests
to receive calls at work instead of at home are reasonable

requests, unless there are extenuating circumstances.
A fax can be sent containing PHI to another healthcare
provider for treatment purposes or to another individual as
requested by the patient. Use reasonable care in sending a fax,
such as verifying the correct numbers, directing the fax to a
certain person, and using cover sheets that stress
confidentiality.
All fax machines should be located in secure areas to prevent
unauthorized access to PHI. Information used for treatment
purposes can be shared by fax, email, or telephone with other
healthcare providers.
Emergencies
Healthcare providers and facilities, such as hospitals, with a
direct treatment relationship with individuals are not required
to provide their Notices of Privacy Practices to patients at the
time they are providing emergency treatment (Figure 16-9).
In such situations the HIPAA Privacy Rule requires only that
FIGURE 16-8 The telephone remains one of the most vital tools
for communication
with patients.
FIGURE 16-9 In emergencies the Notice of Privacy Practices
does not have to be
offered until it is practical to do so.
OFFICE302
providers give patients a notice when it is practical to do so
after the emergency situation has ended. In addition, the Privacy
Rule does not require that providers make a good faith effort

to obtain the patient’s written acknowledgement of receipt of
the notice.
Complaints about Privacy Violations
When a patient has a complaint regarding his or her privacy
information, the first person he or she should seek out is the
privacy officer at the facility where the incident took place. If
the complaint is not resolved, patients should be directed to
the office manager or physician. In the event that the patient’s
issue has still not been resolved, he or she has the option to file
a written complaint either on paper or electronically with the
Office for Civil Rights (OCR). The complaint must be filed
within 180 days of when the complainant knew or should have
known that the act had occurred (Figure 16-10). The OCR may
waive the 180-day time limit if good cause is shown.
Complaints must meet the following criteria:
• They must be filed in writing, either on paper or
electronically.
• They must name the entity that is the subject of the
complaint.
• They must describe the acts or omissions believed to be
in violation of the Privacy Rule.
• They must be filed within 180 days of the incident.
• They must apply to an incident that occurred after April
14, 2003 (2004 for small health plans).
OCR has 10 regional offices, and each one covers certain
states. Complaints must be filed with the correct regional
office that has jurisdiction over the state in which the incident
occurred. A complaint form is available on the OCR website.
The

Offi ce of the Inspector General (OIG) conducts investigations
and audits when there is a question regarding privacy laws.
CLOSING COMMENTS
Every employee of the physician’s office must read the policy
and procedure manual to make certain that he or she has a firm
understanding of the HIPAA Privacy Rule and how it relates
to the individual office (Figure 16-11). The medical assistant is
responsible for learning and following the guidelines set forth
by HIPAA. If uncertain about any situation, contact the privacy
officer in the organization for direction or research the question
on the HIPAA website. Never assume that a patient will not
mind if certain information is disclosed. Always check the
medical record to determine patient preferences. Keep current
on changes to HIPAA regulations and continue to function
in a state of constant learning. Embrace changes designed to
improve patient care and treatment.
FIGURE 16-10 The time may come when a patient files a
complaint against a
provider for a violation of privacy practices.
Guidelines for HIPAA Privacy Compliance
1. Consider that conversations occurring throughout the
office could be overheard. The reception area and waiting
room are often linked, and it is easy to hear the scheduling
of appointments and exchange of confidential information.
It is necessary to observe areas and maximize efforts to
avoid unauthorized disclosures. Simple and affordable
precautions include using privacy glass at the front desk

and having conversations away from settings where other
patients or visitors are present. Health care providers can
move their dictation stations away from patient areas or
wait until no patients are present before dictating. Phone
conversations by providers in front of patients, even in
emergency situations, should be avoided. Providers and
staff must use their best professional judgment.
2. Be sure to check in the patient medical record and in the
computer system to see if there are any special instructions
for contacting the patient regarding scheduling or reporting
test results. Follow these requests as agreed by the office.
3. Patient sign-in sheets are permissible, but limit the
information requested when a patient signs in, and change
it periodically during the day. A sign-in sheet must not
contain information such as reason for visit because some
providers specialize in treating patients with sensitive issues.
Showing that a particular individual has an appointment
with the physician may pose a breach of confidentiality.
4. Make sure patients sign a form acknowledging receipt of
the NPP. The NPP allows the physician to release the
patient’s confidential information for billing and other
purposes. If the practice has other confidentiality statements
and policies besides HIPAA mandates, these must be
reviewed to ensure they meet HIPAA requirements.
5. Format policies for transferring and accepting outside PHI
must address how the office keeps this information confi-
dential. When using courier services, billing services,
transcription services, or email, ensure that transferring PHI
is done in a secure and compliant manner.
6. Computers are used for a variety of administrative
functions, including scheduling, billing, and managing
medical records. Computers typically are present at the
reception area. Keep the computer screen turned so that
viewing is restricted to authorized staff. Screensavers should
be used to prevent unauthorized viewing or access. The

computer should automatically log off the user after
a period of being idle, requiring the staff member to
reenter their password.
7. Keep usernames and passwords confidential, and change
them often. Do not share this information. An authorized
staff member such as the PO will have administrative
access to reset passwords if they are lost or if someone dis-
covers the password. Also, practice management software
can track users and follow their activity. Do not ever give
out a password. Safeguards include password protection
for electronic data and storing paper records securely.
8. Safeguard the work area; do not place notes with
confidential information in areas that are easy to view by
nonstaff. Cleaningservices will access the building, usually
after business hours; ensure that PHI is protected.
9. Place medical record charts face down at reception areas
so the patient’s name is not exposed to other patients or
visitors to the office. Also, when placing medical records
on the door of an examination room, turn the chart so
that the identifying information faces the door. If medical
record are kept on countertops or in receptacles, ensure
that non-staff persons will not access the records.
Handling and storing medical records will certainly
change because of HIPAA guidelines.
10. Do not post the health care provider’s schedule in areas
viewable by non-staff individuals. The schedules are often
posted for professional staff convenience, but this may be
a breach in patient confidentiality.
11. Fax machines should not be placed in patient examina-
tion rooms or in any reception area where non-staff
persons may view incoming or sent documents. Only staff
members should have access to the faxes.
12. Direct mail and phone calls only to the appropriate staff
members.
13. Recognize, learn, and use HIPAA TCS if involved in
coding and billing.

14. Send all privacy-related questions or concerns to the
appropriate staff member.
15. Immediately report any suspected or known improper
behavior to supervisors or the PO so that the issue may
be documented and investigated.
16. Direct all questions to the supervisors or PO.
FIGURE 16-11 Guidelines for HIPAA Privacy Compliance.
(From Quick Guide to HIPAA for the physician’s office, St
Louis, 2004, Saunders.)
OFFICE304
Sabrina and Elsa will experience many challenges
as a result of the information exchange they shared
at the family picnic. Their conversation probably
began like any other, but once Sabrina told Elsa the details of
Ms. Adams’ visit, they violated patient privacy laws. Their
future
in the medical field is now uncertain.
Ms. Adams suffered emotionally after the breach of privacy.
Her daughter, Terri, does not understand why her mother did
not tell her about the illness. The relationship between the
mother and daughter is now stressful, an interference with their
normal bond during this critical time. The family questions
whether to pursue the matter legally or spend the time they
have left together in more productive ways. They have many
decisions to make.
Dr. Taylor placed Sabrina on probation for 3 months. Before
this incident, she had never received any type of disciplinary

action. Elsa was not formally disciplined, largely because of her
long-standing relationship with Dr. Berry. Still, there is sharp
tension between them in the office now, as he faces a possible
medical professional liability lawsuit, as well as complaints
SUMMARY OF SCENARIO
about the privacy of Ms. Adams’ PHI. Neither Sabrina nor Elsa
will look at their jobs the same way as before the incident—for
them, everything is different. They both feel that they have
disappointed their employers, their patients, and themselves.
The medical assistant must remember that patients should
be discussed only with others who are directly involved in
the patient’s medical care. The HIPAA Privacy Rule has made
great strides in protecting patient privacy and in simplifying
administrative processes. However, the rule is effective only if
office policies are established and practiced. New policies may
be difficult to implement, but gaining an understanding of the
reason for the policy and its major goals will help the medical
assistant embrace changes more readily.
Patients may not agree with the privacy practices or may not
understand them. Make an effort to help the patient see the
benefit in the policies that the office has established, reminding
the patient that such policies are designed for their protection.
The patient does not have to agree with the policy or sign it
as long as the staff members make a good faith effort toward
this end.
Continued
1. Define, spell, and pronounce the terms listed in the
vocabulary.
• Spelling and pronouncing medical terms correctly adds

credibility to the medical assistant. Knowing the definition
of these terms promotes confidence in communication with
patients and co-workers.
2. Explain how the HIPAA Privacy Rule benefits the healthcare
industry and patients.
• As a result of the HIPAA Privacy Rule, patients have more
control over their medical records. They are able to make
informed choices as to how their personal health information is
used, and boundaries are set on the use and release of health
records. Safeguards are established that healthcare providers
must achieve to protect the privacy of health information.
Violators are held accountable and face both civil and criminal
penalties if patient privacy rights are compromised. The HIPAA
Privacy Rule also protects public health by striking a balance
when public responsibility supports disclosure of personal
health information.
3. List what must be included on a Notice of Privacy Practices.
• A Notice of Privacy Practices must include details as to how
PHI is used and disclosed by the facility; the duties of the
provider to protect health information; patient rights regarding
PHI; how complaints can be filed if patients believe their
privacy has been violated; whom to contact at the facility
for more information; and the effective date of the Notice of
Privacy Practices.
4. Explain the difference between Title I and Title II of the
HIPAA
Privacy Rule.
• Title I of the HIPAA Privacy Rule regulates insurance reform.
It
limits the use of preexisting health conditions that in the past

would have prevented or limited an employee from obtaining
health insurance coverage. If an individual left a job with
insurance coverage and attempted to secure new coverage,
a preexisting health condition would often preclude that
person from obtaining coverage for that illness. Title II deals
with administrative simplification. This section is the source
of privacy and security laws that affect the patient. The goal
of Title II is to reduce administrative costs in the healthcare
industry.
5. List the rights that patients have under the Privacy Rule.
• Patients have several rights under the Privacy Rule, including
the right to notice of a facility’s privacy practices; the right to
have access to, view, and obtain a copy of their PHI; the right
to restrict certain parts or uses of their PHI; the right to request
that communications from the facility be kept confidential; the
right to request the facility to amend the PHI; and the right to
receive notice of all disclosures of their PHI.
6. Briefl y explain what is expected of healthcare providers in
relation
to the Privacy Rule.
• Healthcare providers are expected to notify patients of their
privacy rights; explain how their health information might be
used; develop privacy procedures in the facility; implement
Continued
Study Guide Connection: Go to Chapter 16 Study Guide. Read
the Case Study and Workplace Applications and

complete the assignments. Do online research for answers to the
questions in the
Internet Activities associated with privacy in the physician’s
offi ce.
CD Connection: Go to the Medical Assisting Competency
Challenge CD and do the training activities under Legal
Concepts.
Evolve Connection: For more information related to privacy in
the physician’s offi ce, go to http://evolve.elsevier.com/
kinn/admin and visit related weblinks for Chapter 16. Click on
the Medical Assisting Exam Review
and do the practice questions to sharpen your test-taking skills.
C O N N E C T I O N S
those privacy procedures; train employees so that they
understand the procedures in place; designate an individual to
be responsible for implementation; and secure medical records
so that they are not available to those who do not need them.
7. Describe an incidental disclosure.
• An incidental disclosure is a secondary use or disclosure
that cannot reasonably be prevented, is limited in nature,
and occurs as a result of another use or disclosure that is
permitted.
8. List the three instances when a parent is not considered the
child’s
representative.
• A parent is not considered the child’s representative in any of
three instances: when the minor is the one who consents to
care and the consent of the parent is not required under state

or other applicable law (e.g., in the case of an emancipated
minor); when the minor obtains care at the direction of a court
or a person appointed by the court; or when the parent agrees
that the minor and healthcare provider can have a confidential
relationship.
9. Explain why a provider can discuss protected health
information
with a patient’s friends and family.
• A provider can discuss PHI with a patient’s friends and family
unless the patient has limited disclosure and requested
that he or she receive only confidential communication with
the provider. Unless the patient makes this request, which
should be in writing, the provider is able to discuss the
patient with others as long as good judgment is used and the
communication is related to the patient’s treatment.
10. Discuss the role of the Notice of Privacy Practices in
emergencies.
• Healthcare providers and facilities, such as hospitals, with a
direct treatment relationship with individuals are not required to
provide their Notices of Privacy Practices to patients at the time
they are providing emergency treatment (Figure 16-9). In such
situations the HIPAA Privacy Rule requires only that providers
give patients a notice when it is practical to do so after the
emergency situation has ended.
SMH Introduction
Sakasegawa Memorial Hospital (SMH) is a 650-bed
metropolitan not-for-profit (NFP) hospital in a major city. The
hospital competes with other hospitals for its patient base.

Managed care is a significant part of its revenue stream and the
hospital is not receiving competitive rates. This puts the
hospital at a competitive disadvantage.
The hospital has been in existence for over 75 years and there is
only a small mortgage on the building. This is an advantage for
the hospital.
The hospital sold property and used the funds to build the
infrastructure of the organization. While the hospital needs
additional funding for major projects, it has no more property
available for sale.
In addition, while the hospital has enjoyed the benefits of
several significant contributors, these contributors are getting
"contributor fatigue." They are less interested in contributing
because the hospital has not turned the corner on operation
revenue and expenses. The hospital faces significant issues with
the current economic crisis. The issues include a drop in
Medicaid payments and a number of people in the community
losing their insurance coverage.
2007 revenue expense dataRevenue Source AmountNet Patient
revenue non-Medicare$260,183,000.00]Capitation
Revenue$36,829,320.00Patient Revenue - Medicare
Medicaid$188,408,800.00three items match line 1 Part
1Unrelated business revenueCapitation RevOther rev - sale of
asset$5,492,700.00Rent
revenue$450,000.00dividends$3,800,000.00Investment
Income$1,892,925.00Other rev - other$5,290,000.00Note - see
detailContributions$7,722,580.00Net assets released from
restrictionsTtl Unrestricted
Rev$510,069,325.00ExpensesSourceTotalClinical
Servicesmanagement & GeneralFundraisingSalaries Salaries
Officers25a Part
II$5,008,242.00$540,392.00$4,135,300.00$332,550.00Other
Salaries26 Part

II$176,481,232.00$158,833,127.00$16,765,700.00$882,405.00P
ension27 Part
II$17,942,172.00$16,147,964.00$1,704,508.00$89,700.00Fringe
Benefits28 Part
II$23,783,424.00$21,406,424.00$2,259,000.00$118,000.00Payr
oll Taxes29 Part
II$13,336,000.00$12,002,000.00$1,266,000.00$68,000.00Total
Salaries &
Benefitstotal$236,551,070.00$208,929,907.00$26,130,508.00$1
,490,655.00Fundraising fees30 Part II$0.00Accounting Fees31
Part II$340,900.00$340,900.00Legal fees32 Part
II$1,345,300.00$1,211,300.00$134,000.00Supplies & Other33
Part II$226,106,126.00$225,600,500.00
rwmayer: rwmayer:
See detail - Hospital costs$500,210.00$5,416.00Telephone34
Part II$1,049,247.00$944,400.00$99,600.00$5,247.00Postage
and shipping35 part
II$339,584.00$305,626.00$32,260.00$1,698.00Occupancy36
Part II$0.00Equipment rental and maintenance37 Part
II$8,967,852.00$8,071,152.00$896,700.00Printing and
publications38 Part
II$177,000.00$159,200.00$16,800.00$1,000.00Conference
conventions and meetings40 Part
II$78,500.00$70,000.00$8,000.00$500.00Interest exp (net)41
Part
II$9,601,800.00$8,551,800.00$1,000,000.00$50,000.00Deprecia
tion42 Part
II$31,083,552.00$27,975,052.00$3,108,500.00Provision for Bad
debt43a *$1,005,000.00$1,005,000.00Other expenses43b-*Ttl
exp$516,645,931.00$482,823,937.00$32,267,478.00$1,554,516.
00Excess of rev over exp($6,576,606.00)
2007 asset liab dataBeginning of yearEnd of
YearASSETSSource20052006Cashline 45 Part
IV$6,787,000.00$2,210,000.00Cash investmentsline 46 Part
IV$19,850,000.00$32,808,000.00Accounts ReceivableLine 47a

Part IV$117,500,000.00Less AllowanceLine 47b Part
IV$47,948,000.00Net Accounts ReceivableLine 47 Part
IV$63,330,160.00$69,552,000.00Pledges ReceivableLine 48a
Part IV$4,700,900.00Less AllowanceLine 48b Part
IV$576,000.00Net Pledges ReceivableLine 48 Part
IV$6,123,000.00$4,124,900.00Other Note receivablesLine
451cPart IV$13,378,061.00$22,606,100.00InventoryLine 52
Part IV$8,443,379.00$10,362,000.00Prepaid expenses line 53
Part IV$9,917,000.00$7,705,000.00Investments (FMV)line 54a
Part IV$74,180,000.00$78,800,000.00Landline 57a Part
IV$617,314,000.00Accoumulated Depreciationline 57b Part
IV$328,568,000.00Net Landline 57c Part
IV$290,824,900.00$288,746,000.00Other Assetsline 58 Part
IV$81,000,000.00$74,500,000.00Total
Assets$573,833,500.00$591,414,000.00LiabilitiesAccounts
Payableline 60 Part IV$83,829,885.00$87,118,742.00Tax
exempt bondline64a part
IV$139,233,400.00$136,451,800.00Mortgage and Note
Payableline 64b Part IV$17,210,000.00$17,900,000.00Other
Liabilitiesline 65 Part IV$122,683,500.00$133,556,958.00Total
Liabilbites$362,956,785.00$375,027,500.00Fund
BalancesUnrestrictedline 67 Part
IV$155,132,000.00$158,866,000.00Temporarily restrictedline
68 Part IV$38,523,000.00$40,208,000.00Permanently
restrictedline 69 Part IV$17,221,715.00$17,312,500.00Fund
balance$210,876,715.00$216,386,500.00Liabilities and Net
Assets$573,833,500.00$591,414,000.00
Detailed revenuePart III Form 990Patient days
Inpatient164,972Ambulatory service
visitsoutpatient148,617Patient days distribution%
distributiontotal
daysCardiology6%9,145Orthopedic10%15,959Medicine72%119,
246Other services13%20,622distribution of patient
daysMedicareMedicaidManaged care/InsurancePrivate
payColumn1totalCardiology365845744815499145Orthopedic59
05160909779815959Medicine417369540667781192119246Othe

r
services922349610401502206226052210653907563041164972
% distribution
Roger Mayer: Roger Mayer:
use this allocation basis to allocate expenses between payers in
Module 3 assignment 2.
37%6%55%2%100%Revenue DistributionPayerColumn2Total
RevenueInpatient RevenueOutpatient RevenueMedicare
Revenue$179,567,920.00$154,045,694.40$25,522,225.60Medica
id
Revenue$16,840,880.00$14,956,792.00$1,884,088.00Managed
Care$274,162,320.00$226,729,856.00$47,432,464.00Private
Pay$14,850,000.00$12,177,000.00$2,673,000.00$485,421,120.0
0$407,909,342.40$77,511,777.60Inpatient Revenue
DistributionCardiologyOrthopedicMedicineOtherTotalsInpatient
Revenue$39,612,365.72$41,460,795.08$284,847,513.80$41,988
,667.80$407,909,342.40
Detailed costsTable IPersonnel and othertotalsInpatient
allocated expensesAllocation basisOfficers Salaries&
Fringe$708,424.15$566,739.32patient daysClinical Salaries &
Fringes$208,221,482.85$197,810,408.70hours of
service41.6779152919Other clinical
expenses$20,318,478$16,254,782patient
daysDepreciation$27,975,052$22,380,042square feetPhysician
Fees$14,850,673.89$11,880,539.11patient daysOther
supplies$9,433,511.95$7,546,809.56patient
daysUtilities$17,289,172.12$13,831,337.69square feetTotal
Personnel and other$298,796,794.96$270,270,658.39Table
IIDirect Patient Care ExpensestotalsInpatient allocated
expensesAllocation basisCardiology
$12,506,205.80$10,004,964.64100% to cardiologyOrthopedic
$12,339,125.41$9,871,300.33100% to
Orthopedicpharmaceuticals$23,391,254.11$18,713,003.29Patien
t days$69,545,157.89Ancillary (lab x-
ray)$63,540,193.25$50,832,154.60Patient

daysTotal$111,776,778.57$89,421,422.85Table IIIIndirect
Patient Care expensesTotalsInpatient Allocated
expensesAllocation basisCardiology medical
supplies$2,659,459.72$2,127,567.78100% to
cardiologyOrthopedic medical
supplies$2,393,513.75$1,914,811.00100% to
Orthopedicpharmaceuticals$5,318,919.44$4,255,135.55Patient
days$31,913,516.65general medical
supplies$21,275,677.77$17,020,542.21Patient daysancillary
expenses$13,297,298.60$10,637,838.88Patient
daysTotal$44,944,869.28$35,955,895.43Table
IVMalpracticeTotalsInpatient Allocated ExpensesAllocation
basisCardiology$5,263,709.72$4,210,967.78100% to
cardiologyOrthopedic$6,908,619.01$5,526,895.21100% to
OrthopedicMedicine$14,804,183.60$11,843,346.88100%
medicineOther services$328,981.86$263,185.49Patient
daysTotal$27,305,494.19$21,844,395.35Table VClinical
Salaries & Fringes - Inpatient
AllocationtotalCardiology324,648Orthopedic478,770Medicine3,
458,134Other services484,6174,746,169average rate per hour -
$41.68Table VISquare feet allocation - Inpatient
servicesCardiology21%Orthopedic26%Medicine49%Other
services4%total100%
Module 3 Asgn 1 InstructionsThe SMH financial statement
contains additional data that will allow you to conduct an
analysis of revenue efficiency factors. In this assignment, you
will calculate direct expenses including labor, supply, and drug
costs. Assignment detailTabs to reference:"Detailed Revenue"
allocates revenue by inpatient and outpatient"Detailed
Expenses" allocated direct expenses by inpatient and
outpatient"2007 Revenue Expense Data" provides data on other
income sources and indirect expenses.1Create a table that shows
gross profit (patient revenue - direct expenses) for inpatient and
outpatient services.See example:Inpatient RevenueOutpatient
RevenueTotal RevenueInpatient direct expensesOutpatient
direct expensesTotal ExpensesIP Gross ProfitOP Gross

ProfitTotal Gross Profit2Calculate Gross Profit (GP) margin for
both services. 3Calculate GP per patient day and per operating
theater (OT) procedure.4Compare your expenses to your
benchmark data. (Because some of the comparative data doesnot
have sufficient detail this may be a high-level
review.)5Comment on the services from the perspective of
expense and revenue distribution and explain whythere are
differences between gross profit margins6Complete a table that
includes other expenses and other revenue. The table should
clearlydistinguish between direct and indirect
expenses7Comment on why other income and contributions are
critical to the survival of the organization.Does the reliance on
investment income mean that the organization will take a higher
risk in orderto increase income?
Module 3 Assgn 2 InstructionsYou will use the information
from M3: Assignment 1, develop a gross profit analysis for
managed care payers to develop a strategic plan for a managed
care contract negotiation.Assignment detailTabs to
reference:"Detailed Revenue" allocates revenue by inpatient and
outpatient"Detailed Expenses" allocated direct expenses by
inpatient and outpatient1Calculate inpatient gross profit for the
major payers at the hospital.gross profit (patient revenue-direct
expenses)Inpatient analysisMedicare RevenueMedicaid
RevenueManaged CarePrivate PayTotalsPatient Revenue
use revenue distribution table
$154,045,694.40$14,956,792.00$226,729,856.00$12,177,000.00
$407,909,342.40Expenses
Allocate expenses based upon patient day distribution %.
Personnel and other$270,270,658.39Direct Patient Care
Expenses$89,421,422.85Indirect Patient Care
expenses$35,955,895.43Malpractice$21,844,395.35Total Direct

Expenses$417,492,372.03Total Gross ProfitGross profit
percentage by Payer100%2Calculate gross profit and gross
profit percentage by payer.3Comment on the results of your GP
calculations.4In this example we assumed that patients from
each payer incurred costs at the same rate.Is this assumption
correct? What level of detail of cost identification should the
Hospital attempt to obtain?5Based on your understanding of
your costs, you will develop a plan for contract negotiations
with a managed care provider. In your plan,outline a strategy
for contract negotiation. 6Based upon your analysis of the other
organizations are you in a better or worse position when it
comes for contract negotiations?7Payers always want to move
procedures from the Inpatient setting to an Outpatient
setting.How does this affect the hospital strategy?
Module 4 Assgn 1 InstructionsYou will analyze the SMH Data
Set to identify costs associated with specific clinical product
lines and measure gross profit.You will compare results your
analysis and become familiar with activity based costing and
managed care contracting in this study.The "Detailed Cost" tab
provides inpatient costs and the allocation basis for each cost.
You will put this information into a modeland a model that
analyzes costs by product line. In this case we have for product
lines including Cardiology, Orthopedic Medicine, and
Other.Assignment detailTabs to reference:"Detailed Revenue"
allocates revenue by inpatient and outpatient"Detailed
Expenses" allocated direct expenses by inpatient and
outpatient1Calculate inpatient gross profit for each product line.
The template that students can use is as follows:Note: Allocate
revenue based upon patient day distribution between product
linesCardiologyOrthopedicMedicineOtherTotalsInpatient
RevenueExpensesOfficers Salaries& FringeClinical Salaries &
FringesOther clinical expensesDepreciationPhysician FeesOther
suppliesUtilitiesDirect Patient Care ExpensesIndirect Patient
Care expensesMalpracticeTotal Direct ExpensesGross profit by
Product Line2Comment on the results of your inpatient GP
calculations. What product line is most profitable by dollar

amounts and gross profit percentage?3Is there value in
separating product lines into more detail? What detail would
you recommend? For example, what is the value in separating
revenue and expenses by physician? Surgery type? And others?
Module 4 Assgn 2 InstructionsIn this assignment, students will
carry out a profit analysis for a specific product line. We are
using the example of Cardiology. However, students can use
another product lineStudents will develop a Cost-Volume-Profit
template to help measure costs and changes to variable and
indirect costs using SMH data. Assignment detailTabs to
reference:"Detailed Revenue" allocates revenue by inpatient and
outpatient"Detailed Expenses" allocated direct expenses by
inpatient and outpatient"Module 4 Assgn 1 Instructions" for
baseline cost information1Develop a template of costs.You
should separate expenses between variable and fixed
expenses.To assist, the template provides some
guidance:Inpatient CardiologyCardiology total Patient daysPer
patient dayRevenueExpensesVariableClinical Salaries &
FringesOther clinical expensesPhysician FeesOther
suppliesDirect Patient Care ExpensesIndirect Patient Care
expensesTotal Variable ExpensesFixedOfficers Salaries&
Fringe
do not calculate fixed costs on a per patient day basis.
DepreciationUtilitiesMalpracticeTotal Fixed ExpensesTotal
Direct ExpensesGross profit for Inpatient Cardiology2Calculate
the break even point in patient daysNote: Break even pointTotal
Fixed cost / (per patient day revenue - per patient day variable
expenses) 3Calculate the break even point assuming a 5 percent
increase in clinical salaries and a 4 percent increase in officer
salaries.4A physician wants to add a new procedure that will
increase direct patient care expense by $200 per day. What is
the impact on gross profit and the breakeven point?5The
hospital is considering hiring a physician. This will increase
annual costs by $250,000. However, with the addition of

thisphysician it is anticipated that patient days will increase by
6 percent. Is this a good move for the Hospital?6Many times it
is difficult to determine if a cost is variable or fixed. In
addition, costs may be variable, but only in a relevant range.
Do you agree with the categorization of costs as they are
presented on this template? Would you recommend changes?
What additional information would help you analyze the data?

Sabrina Ragland, a medical assistant with 12 years’ experience.docx

Recommended

Recommended

More Related Content

Similar to Sabrina Ragland, a medical assistant with 12 years’ experience.docx

Similar to Sabrina Ragland, a medical assistant with 12 years’ experience.docx (20)

More from agnesdcarey33086

More from agnesdcarey33086 (20)

Recently uploaded

Recently uploaded (20)

Sabrina Ragland, a medical assistant with 12 years’ experience.docx