HIPAA attorney Michelle Wilcox DeBarge quoted in McKnight's Long Term Care News on HIPAA compliance

August 23, 2002
"Experts: HIPAA compliance not as costly as many believe," McKnight's LongTerm Care News. By Julie Williamson, August 23, 2002.

Looming HIPPA compliance deadlines have many long-term care providers so overwhelmed they are spinning their wheels and wondering how they’ll ever get their policies and procedures aligned in time.

Fortunately, it’s not too late to meet the first deadline - April 14, 2003 for the privacy rule - and the other Health Insurance Portability and Accountability Act deadlines that will follow shortly thereafter.

But providers must approach the process soon, and systematically, experts cautioned. They also emphatically added that compliance can be reached with far few resources than many have been led to believe.

"Long-term care providers have consistently been faced with the challenge of doing more with less, which has made the HIPAA regulations that much more [daunting] and still has some providers paralyzed," explained HIPAA attorney Michelle Wilcox Debarge, of Wiggin & Dana, LLP, New Haven, CT. "What some may still not realize, though, is there are ways to come into compliance without breaking the bank or putting an enormous strain on [personnel]."

Beware the ‘experts’

In light of the extensive requirements, a multitude of vendors and consultants has cropped up to help tackle the task. Unfortunately, some self-proclaimed experts are cashing in on the confusion and further hamstringing providers with astronomical costs and bad advice, warned one advisor who has been actively involved with HIPAA since 1996.

Some providers have been led to believe they can’t satisfactorily meet HIPAA requirements without the assistance of consultants and compliance tools, noted Bill Bysinger, founder of WGB Advisory, a Poulsbo, WA-based firm that provides consulting and advisory services on HIPAA, eHealth, cost containment and healthcare technology. As a result, he added, many institutions have spent upwards of $100,000 in consulting fees - money that few, if any, could afford.

"HIPAA compliance is not all that difficult, but there are many out there who will say just the opposite. Providers should be careful so they don’t get gourged," Bysinger said. "HIPAA is a project like any other and should show a return. I believe complying with HIPAA should cost only 3%, at most, of a facility’s operating budget - not the tens of thousands of dollars that providers have been led to believe."

One corporate compliance director agreed that facilities can tackle HIPAA’s privacy requirement with relatively minimal expense - and minimal headaches - by following a few key steps. Andrew Joseph of Asbury Services, Gaithersburg, MD said he’s managed the process quite well by educating department heads, systematically gathering data and setting realistic goals for adapting policies and procedures. Asbury Services, the corporate parent of several long-term care providers in Maryland and Pennsylvania, began the process in January and plans to have HIPAA-compliant policies and procedures completed by October.

"I first met with management teams from other providers to brief them on the requirements. I then sent out a sheet to each department head asking them to detail how they use health information and whom they share it with. Once I had a clearer picture of who was doing what, it became easier to develop policies and procedures," Joseph explained. He added that devising a schedule and carving out times each week to tackle specific areas helped keep the company on track.

Although Asbury Services didn’t use a consultant to prepare for the privacy rule, Joseph said he did purchase a "reasonably priced" software tool to help guide policy and procedure development. He said he also frequently referred to The HIPAA Handbook: Implementing the Federal Privacy Rule in a Long-term Case Setting from the American Association of Homes and Services for the Aging, Washington.

Debarge, who co-wrote the handbook, said Asbury Services’ systematic compliance approach is one to emulate.

"Establishing a goal to complete five things per week, for example, is far more effective than saying you have 100 things to complete by April," Debarge said. "Break it into segments and you’ll be motivated by your progress."