The OCR: Friend not foe

Patients are now discerning consumers,and having health information rapidly available is paramount to deliveringthe best service However, there may be unintentional inconsistencies in policy or practice that can inadvertently create costly compliance issues for providers.

The Office of Civil Rights (OCR) helps providers stay compliant with health information requests and avoid hefty fines, but it's astounding how many providers dread receiving a phone call or technical assistance from an OCR investigator. Investigators should be seen as a resource who can provide you with the playbook for compliance to help you avoid astronomical civil monetary penalties and close the compliance gaps you might not even know exist.

The OCR playbook

Anyone can file a complaint against a provider if they feel their rights are in violation when it comes to a patient's right of access. The OCR has three ways to address a patient complaint – a phone call, technical assistance, or a data request.

Step 1: The phone call

OCR can conduct an informal, impromptu phone call to the provider to gather information about why the complaint was filed. The OCR will offer advice and training to help the provider get the patient information or records they need. If the provider follows OCR's direction, a formal document detailing the patient complaint will be sent, and the complaint will be closed.

Step 2: Technical assistance

OCR will issue technical assistance if they feel there should be a more formal method of communication. OCR will first review the complaint and documentation provided from the patient or their representative. If the documentation is adequate, they may issue technical assistance offering education.After providing education and direction, it will be noted in the technical assistance letter and show the case as closed.

However, a closed case is not a get-out-of-jail-free card. OCR offers the provider education and expects them to investigate the complaint further and implement the advice provided by OCR through updated policies and procedures to close the gaps that caused the situation in the first place. Receiving technical assistance is like receiving a written warning for speeding while behind the wheel; itdoesn't mean you can continue to speed, instead, it means you should be more aware.

Of all the fines I see in my position as Chief Privacy Officer, most of them receive technical assistance firstThen for reasons unknown, the provider did not implement these lessons and failed to update their policies and procedures and comply with the patient’s request. Honoring the patient complaint and getting the record requested – in the form it was requested – is critical and must be done quickly. The patient can file a second complaint if the provider drags their feet or ignores the original complaint. These duplicative complaints can cause hefty fines, sometimes in the hundreds of thousands of dollars.

Step 3: The data request

Finally, OCR may issue a data request if the issue appears to be a trend or is a severe violation of their policy. OCR will send a document outlining the patient's complaint, when it occurred, and the specific data details and items related to the event, along with a request of the provider’s policies. Data requests issued in the last 24 months are more detailed as OCR isasking for the financial information of the provider. In my opinion, OCR is using this additional request for information to evaluate the fine the provider will receive, should they not comply on time.

I recommend providers contact the patient directly to understand the complaint better, which potentially could avoid significant civil monetary penalties. The provider should then document the conversation to show due diligence to OCR in satisfying the patient's issues.

OCR investigators: Your friends, your compliance superheroes.

If you receive technical assistance from the OCR and either don't understand the complaint or feel you were right in the situation by not providing access, you can discuss this with your investigator. The investigator is there to assist you and provide education, answer questions, and help you to resolve the patient complaint promptly. Most importantly, the investigator helps the provider make sure the situation causing the patient complaint doesn't happen again.

Learning from successes other provider organizations have implemented can help your provider organization steer clear of penalties. Bottom line? When it comes to the Release of Information, rigorous compliance is critical.

Elizabeth A. Delahoussaye is the Chief Privacy Officer at Ciox Health. With more than 20 years of healthcare experience, she is responsible for all aspects of the company’s privacy functions, planning and directing of compliance functions, and ensuring the organization is compliant with all federal and state regulations.