HIPAA deadline passes quietly with only minor procedural changes

Long lead time allowed facilities to prepare

When fully implemented, the Health Insurance Portability and Accountability Act (HIPAA) promises to have an enormous impact on the practice of medicine. It will establish comprehensive national standards for the protection of patients' health information. The first steps in that direction, however, have fallen softly on the landscape of medicine in the U.S.

On April 14, 2003, HIPAA privacy standards were implemented with little fanfare and, arguably, little new adverse effect. The radiology department at St. Luke's Imaging Center in Boise, ID, for example, was in full compliance by the April 14 deadline. Manager Julie Mellinger said the department had already adapted its computer system to meet privacy requirements and had implemented privacy guidelines.

"It took a lot of time, and there was definitely a financial commitment to complying," Mellinger said. "But much of what was required had already been done."

The more challenging aspects of the act are still coming. Components dealing with the electronic transmission of patient records, including images, will be implemented Oct. 16 for large healthcare providers, according to Kaleb Jamal, a spokesperson for the U.S. Department of Health and Human Services.

All health insurers, healthcare clearinghouses, and healthcare providers must comply with the new standards-but not all at the same time. Those with annual receipts totaling less than $5 million have until April 14, 2004, to comply.

HIPAA has been a long time coming. Passed by Congress in 1996, the act not only sets privacy standards but also includes "administrative simplification" provisions intended to improve the administrative efficiency and effectiveness of the healthcare system. These require that certain transactions electronically transmitted by health insurers, healthcare providers (including imaging centers), and others be completed using national, uniform standards.

"Most of this involves formalizing and documenting things that radiology departments already do," said Patricia Kroken, a consultant with Healthcare Resource Providers of Albuquerque, NM.

While HIPAA addresses both privacy issues and electronic transmission, she said the electronic transmission of patient images would not be substantially affected. But there will be important requirements.

"Staff will need to make sure their images are secure and that they're using caution in handling patient data," she said.

Many facilities in the U.S., especially those using lower tech solutions, will have a relatively easy time meeting these requirements. Most women's health centers will likely be among them. Sandy Lopez, manager of the Memorial Breast Evaluation Center in Long Beach, CA, said the law has had minimal effect on her facility so far.

"We're not using full-field digital, and we're not yet using a PACS," she said. "Regarding confidentiality, we've already been doing a lot of that."