Issue link: https://www.massageandbodyworkdigital.com/i/259468
C CINDY: So, Erin, you and I have been talking a lot about HIPA A and what it means to massage therapists. ERIN: Yes, we have! It started out as a pretty straightforward conversation about something that seemed obvious: massage therapists should maintain client confidentiality. CINDY: Simple enough, right? Of course, the more we talked, the more we realized there seems to be some confusion in the massage community about client confidentiality and HIPA A compliance. I see a lot of massage therapists using these terms interchangeably when they are actually two different things. First, we should talk about what HIPA A is exactly. HIPAA 101 ERIN: HIPA A, the Health Insurance Portability and Accountability Act, details how an individual's health information should be handled by health-care providers (or, as HIPA A calls them, "covered entities" and their "business associates"—more about that later). The law sets out administrative standards for certain transactions and it defines patients' rights with respect to their health information. There are two important parts of HIPA A: the Privacy Rule and the Security Rule. Privacy is the part everybody is familiar with, because it's the area that noticeably affects most people. However, there are other aspects to HIPA A people may not be aware of. CINDY: As massage professionals, it's important we maintain client confidentiality and adhere to our professional code of ethics. Yet, this is different from being HIPA A compliant, since confidentiality is just one part of HIPA A, and not all practitioners who should respect confidentiality are required to do so by law. HIPA A is not just a blanket term to use in all discussions relating to client privacy. ERIN: Yes, I think that's a really important distinction to make. As massage therapists, we're all ethically bound to adhere to the principle of confidentiality. We agree to do that as members of professional associations like Associated Bodywork & Massage Professionals. However, the obligations associated with HIPA A compliance are different. What we're talking about are legal definitions that apply only to certain professionals, with legal consequences for not being compliant. So this begs the question: how do we know if we are legally required to follow HIPA A standards? legally required? CINDY: Figuring out whether you are a "health-care provider," "covered entity," or "business associate," according to HIPA A's definitions of those terms, is really a question that should be discussed with an attorney familiar with HIPA A. Those terms have specific meanings under HIPA A, and they depend on the types of services provided, not professional titles. That said, generally speaking, if you are a service provider who receives or maintains certain health information, but does not submit claims electronically to a third party for billing purposes, then you are likely not legally required to be HIPA A compliant. However, it is possible that MTs may provide services to, or on behalf of, covered entities. If so, they could be deemed a business associate of the covered entity. Business associates need to comply with certain Privacy Rule requirements and all of the Security Rule requirements. These specific definitions make me wonder what it means to be HIPA A compliant in terms of client confidentiality. In your experience, Erin, what does it mean? what does it mean? ERIN: Being HIPA A compliant involves meeting numerous requirements under the law, and having policies and written procedures in place to ensure you meet those requirements. Confidentiality is just a small part of it. For example, client authorization needs to be obtained for certain uses or disclosures of health information. These practices need to be set forth in policy so staff members understand when an authorization is needed, and under what circumstances YOUR PRACTICE & HIPA A 84 m a s s a g e & b o d y w o r k m a r c h / a p r i l 2 0 1 4