HIPAA rules impact many entities, including law offices. Paralegals in these offices can assist their attorneys and colleagues to comply with HIPAA regulations in the following ways.

Requesting Medical Records
When requesting medical records, there are ways to expedite receipt of the appropriate records in a timely manner. Many facilities are implementing a facility specific form addressing compliance with HIPAA concerns and requirements reviewed and approved by their corporate attorneys. Submitting the required form for the facility (usually found on the facility's website) and obtaining the patient's signature should facilitate the process. There are required elements for the release of medical records, and a facility can verify those elements are addressed in their forms. Approval to release records submitted on another release form requires an administrative or legal review or a rejection of the request. Medical records contain information that is private and confidential. An appropriate release form or a court order must be obtained for access to these records. These requirements help maintain privacy and prevent the possibility of an unauthorized information release. Releasing Protected Health Information (PHI) can result in legal and financial ramifications.

Obtaining Medical Records
Obtaining official and certified copies of medical records can occur in several ways. Copies of paper records may be provided, although this is becoming less frequent. Facility generated electronic medical records may be supplied in a paper format. The attorney or his representative may be required to physically view the records in a secure room at the facility while being monitored by a facility representative. The records might be scanned onto a CD and delivered to the attorney's office. Once scanned, the files can also be uploaded to a secure site for retrieval.
As the case proceeds, the paralegal or legal staff may be required to distribute medical records to other members of the legal team.

Transferring medical records to team members and expert witnesses still requires protection of the person's PHI. The records may be transferred to the experts and team members located in other locations using electronic transfers via a HIPAA protected application, sending a CD/flash drive, or providing limited login access to an internal software application.

Working with Medical Records
Working with electronic medical records requires special considerations for employees. Computer monitors should always be positioned so no unauthorized individuals can read them. The monitors should also be programmed so the screens time out and lock if not used within a very short period of time. Password required log-ons should be implemented and programmed to change every 60-90 days to ensure that privacy is maintained. Log-ons and passwords should not be shared for security reasons. Not only would that be a security breach, but could result in disciplinary action for the employee.

Protecting PHI when reviewing records can be challenging. If possible, it is best to open only one case record at a time, and have a way to hide the information in case of a visitor or interruption to your review. Planning for these types of occurrences facilitates maintaining privacy and confidentiality of the records. On occasion, working with a large volume of paper records requires physical space for organization. This should be done in a room where security and privacy can be maintained. If you need to leave the records unattended, you should cover them and close the door, preferably with the ability to lock it.

There are other facets of responsibilities related to HIPAA compliance and PHI protection. A compliance officer can assist with the above processes as well as establishing policies for retention, storage, and destruction of PHI.