In my office we have mental health professionals who have a bachelor's degree or above. My boss is thinking about letting our office manager read our plans, reviews, and notes for "typographical errors and accuracy." I believe that this is a violation of HIPPA as A. she does not have a degree in any mental health or social field (she is a high school graduate)
B. It allows her to have personal and private information regarding mental health clients and even though she is only "scanning" the documents it still give her privy to information. In all fairness, though, we do have to sign a confidentiality agreemet no matter what our position is in the company What do YOU think?

SpawnOfAzazel

Tough call. I don't allow anyone access to my client's files at all except for the clients themselves or state agencies and court systems when necessary, so I too would feel like that's invading the clients' privacy if someone else were reading them. However, the confidentiality agreement she signed is a binding contract and serious consequences would arise if she does not honor it, so the proofreading of documents is permissible and not a violation, even though I don't like the idea.

vingogly

I don't like it either, but I believe editorial review for typos is allowed under the HIPAA privacy rule which allows intra-agency usage on a "need to know" basis. Since your employees sign a confidentiality agreement, this should be OK. I do question the appropriateness of a non-professional reviewing notes and tx plans for "accuracy" - that seems to push the bounds of "need to know". What sort of "accuracy" are they referring to?

Vasily

ScottGem

HIPPA protects revelaing info to 3rd parties. It would be a violation if this employee did anything with the info she learned during these reviews but there would be no violation to allow her to review them.

vingogly

Assuming the organization documents that it's part of the job description for a non-mental health employee to review client case documentation for "accuracy", that "accuracy" is clearly defined, and that employee is HIPAA-trained and understands the Privacy Rule, then no, it wouldn't be a violation of the HIPAA Privacy Rule.

It could very well be a violation of the mental health codes in whatever state mbernice314 was working in, however, if "accuracy" means things like DSM-IV diagnoses.

Vasily