Ensuring Compliance

The Health Insurance Portability and Accountability Act (HIPAA) has created a significant stir for the medical industry. The goal of the fairly new policy is heightened security for the patients of thousands of medical and health-related businesses in the U.S. In turn, HIPAA regulations are forcing document destruction firms to be more cautious when servicing the health care industry.

For companies looking to service this sector, some adjustments need to be made. These steps range from ensuring that their operations mesh with the customer’s own HIPAA requirements to the often more challenging way in which a program should be designed and maintained.

While servicing doctor’s offices and small, community-based hospitals may require only a minimal amount of set-up and maintenance, some larger, urban hospitals may require a multi-level approach to ensure adequate servicing of the account.

The first step in the process is to understand the ramifications of the HIPAA policy. Since being signed into law, the understanding of what is covered under this act has grown to include any health care or medical facility that transmits patient information electronically. This not only includes hospitals, but any office or facility that may contain patient records. This has brought doctors and dentists’ offices, urgent care centers and even pharmacies and drugstores under the scope of the legislation.

While it may appear that obvious steps need to be taken, in discussion with a host of document destruction firms, there appears to be a wide range of strategies to ensure that servicing health care facilities is a viable step for a document destruction firm.

One of the first steps that companies need to determine is the simple notion of when the document destruction firm takes ownership of the material. Far from being cut-and-dried, this determination could set the table for any potential liability the company may face.

Document destruction firms servicing medical facilities need to read and fully understand, as part of the signed contract, at what point ownership of the secure documents migrates from the health care organization to the document destruction firm.

Most often the determination of when the hand-off takes place should be brought out in the business agreement between the two parties.

While some companies stipulate that they will accept the material once they leave the actual physical building, other companies state that they take ownership of the documents when they are placed in on-site secure containers. Further, according to one document destruction firm, some companies may not accept ownership of the material until it has been shredded. Therefore, in the case of un-shredded documents, the health care company could be held liable for any fines that may be imposed in light HIPPA violations.

Ray Berry, with Shred First LLC, Spartanburg, S.C., says that his company will use its own business associate agreement if the client doesn’t yet have one.

While HIPAA policy has created some significant concerns, opinions are mixed concerning what being HIPAA compliant actually means. Berry says that a reading of the policies and standards could result in a wide difference of opinion on what would be acceptable.

Some customers say that to ensure that their health organization is HIPAA compliant, everything has to be shredded on site. Others say that it doesn’t matter whether the material is shredded at the physical location or at an alternative site.

In fact, Berry says that while many of the hospitals that have implemented document destruction operations in light of HIPPA requirements have material shredded on site, health organizations that have been working with Shred First for a much longer period of time often migrate the shredding to the company’s plant.

Mike Belz, with Shred-It’s Cleveland operations, says many hospitals perceive that only by destroying the material on-site can secure destruction be guaranteed.

As for setting up and servicing the program, Belz says there is no one way that a hospital can collect the material. Some collect the material internally and bring it to a central location for the document destruction company to retrive. Meanwhile, other health care organizations will have the outside vendor (shredder) collect the material to be shredded.

While a contract with a hospital can be an excellent source of revenue, creating an effective program also takes a fair amount of time. Because many larger hospitals are often sprawled over a number of acres and include a number of buildings, each with their own document sources, a shredding firm may be required to position dozens of secure containers to adequately service the client.

At the same time, different locations will generate varying volumes of confidential documents, requiring document destruction firms to stagger collection programs to both minimize their time and to ensure the client is being properly served.

David Culbertson, president of Culbertson Consulting LLC, Katy, Texas, remarks that HIPAA is "a minimum standard." Many hospitals are taking even greater steps to ensure the proper handling and destruction of patient files.

While a hospital may or may not want off-site shredding, some questions a health care facility should ask include determining if the shredding company has insurance and whether it provides certification for destruction. A key factor that shredding companies need to follow up with is ensuring that some type of business associate agreement is in place to protect both parties from liabilities.

While some tendencies are consistent with hospitals in general as to the location of the containers, it is recommended that the shredding company and the health care institution perform a joint walk-through.

One of the largest advantages to having the material shredded on site is the fact that a customer can view the material actually being shredded. This gives the customer an additional level of security. In the health care industry, as well as in many other industries, these noble intentions seem to diminish over time. Several document destruction firms say that while a client may pay more to have the material shredded on site, more often than not, no one witnesses the process after the first several times.

What many health care organizations become concerned about is the issue of a steady collection program that does not interfere with the core business operations of the hospitals.

While abiding by HIPAA requirements is forcing health care facilities to more aggressively establish policies to protect patient identity, several shredding companies note that despite running a very secure shredding operation, there is no such thing as a "HIPAA-compliant shredding company," because there are no clearly defined procedures for vendors. As Berry notes, "We are not HIPAA compliant. However, we can make sure a [customer] is."

Brad Schofield, president of Safeguard Shredding, Falls Church, Va., points out, "Medical service providers need to be wary of vendors representing themselves or their services as being HIPAA compliant. This means absolutely nothing, as there is no government entity that certifies companies or their services as being HIPAA complaint, he says.

"What they may mean," he continues, is "their handling methods and techniques are consistent with HIPAA requirements for secure disposal of patient health information materials."

While many offices and facilities may require a significant amount of attention to detail, hospitals and health care facilities, with their often far-flung buildings covering a wide campus area, offer many obstacles and difficulties in effective management. Schofield says that hospitals require a high degree of monitoring and tracking in order to bring value into play.

"Hospital shredding contracts often exceed $30,000, so economical solutions should be sought," Schofield says.

Adding to the overall issue, there could be more than 100 containers covering several buildings. And, depending on where the containers are located, there will often be different cycles for when the containers need to be picked up.

Containers outside records rooms may require collection every week, while a container outside some nurses’ stations may need to be pulled every few weeks.

Culbertson says that most hospitals want their facilities to be serviced at least once a week.

The time spent servicing a large hospital could take four hours or even longer, meaning that servicing health care facilities could dictate some changes in operations. One key, say several shredding companies, is to work with the staff of the hospitals to make the collection procedure as non-intrusive as possible.

A way to speed up the collection process is to develop a collection program in coordination with the maintenance staff at the hospitals. If this internal department can bring the containers to a central location before the shredding company arrives, it would cut down on the time the shredding company needs to spend at the hospital.

Hospitals may also prefer this procedure because it reduces the number of people moving though the hospital hallways.

In Berry’s opinion, the main issue for hospitals is to develop and stick to a certain program. "Hospitals’ main issue is service," he remarks. "You must be consistent. Hospitals want everything to run like clockwork. They will pay more for secure business. They want a seamless operation."

Doug Knisely, owner of Knisely Mobile Shredding, Bellefonte, Pa., says that he is seeing more hospitals move toward on-site shredding. "Three years ago 90 percent of the jobs were off site. Now, I am seeing 98 percent are on site.

While other shredding companies differ on their percentage between off-site and on-site shredding, what many note is that the fear of violating patient confidentiality has grown, especially for those companies that have not been as proactive in their material handling.

While hospitals generate a significant amount of paper, health care facilities also generate sizable amounts of other, non-fibrous materials. Materials such as computer disks, X-rays and packaging, as well as more potentially dangerous materials, such as blood-contaminated containers, syringes and other types of medical devices, can be commingled with the paper to be shredded.

Knisely says that while occasionally some of the material he is taking in contains X-rays, the majority of the time, the non-fibrous material is already being sourced and collected by other firms.

For shredding companies, some of the less hazardous materials can be handled in small doses; however, syringes and fluids are a major concern.

However, from conversations with a host of shredding companies, a rigorous educational program typically keeps the influx of some of these more dangerous materials to a very small percentage. n

The author is Internet and senior editor for SDB magazine and can be contacted at dsandoval@gie.net.