Both medical offices and their answering services are required to comply with all applicable parts of the Health Insurance Portability and Accountability Act (HIPAA), a 1996 law designed to standardize how healthcare providers use personal information. The ‘Minimum Necessary’ rule is one way of helping to ensure compliance.
The rule applies to answering service scripts used both by medical offices and their answering services. It dictates a standard requiring that only the minimum amount of protected health information (PHI) needed to complete the intended task is utilized. It can apply both to phone calls and in-person contexts.
Minimum Necessary Rule Basics
A good way to understand the basics of the Minimum Necessary rule is to look at a practical example. Let us say an answering service agent places a call to confirm patient consent for an upcoming procedure. No one answers, so the agent leaves a voicemail. The voicemail message could be as simple as, “Please call the office back so we can address the matter.”
A simple message that does not reveal any medical details is more than adequate. No sensitive information is left in the message, thereby complying with HIPAA and meeting the minimum necessary standard.
Applying the Standard to Agents
Our example looked at an agent leaving a message on a patient’s voicemail. But what about incoming calls? Answering service policies and procedures can and should be guided by the Minimum Necessary rule. The rule can be applied to individual agents based on their particular roles. In addition, an agent’s scripts can be created based on the standard and how it applies to their normal tasks.
Best Practices for Implementation
Implementing the Minimum Necessary rule shouldn’t even be a matter of discussion among medical answering services. It is a critical tool for maintaining HIPAA compliance – both for the answering service and the practices it represents. There are a number of best practices for doing so:
1. Apply the Standard to Each Task
The Minimum Necessary rule standard works best when it is applied to each particular task an agent might be responsible for. Agents should only collect or divulge the PHI pertinent to what they are working on at the moment. The purpose of each call will determine tasks and PHI.
2. Always Verify Patient Identity
Before collecting or divulging PHI, answering service agents should always verify patient identity. There are multiple ways of doing so. However, that is another topic for another post.
3. Leave Limited Details in Voicemails
When agents must leave voicemail messages for patients, they should limit the details. Voicemail messages should be as generic as possible to convey necessary information without leaving details that might violate HIPAA.
4. Use Secure Communication Channels
Only secure communication channels should be used. This includes secure phone systems and encrypted text and email platforms.
5. Be Cautious With Appointment and Test Result Information
When sharing appointment and test result information over the phone, agents should be extremely cautious. Only provide the necessary details pertinent to the person being spoken with.
6. Provide Ongoing Staff Training
Medical answering services should provide ongoing staff training in both the Minimum Necessary rule and HIPAA regulations. Ongoing training ensures that all operators remain up to speed. It ensures they know what is expected of them.
The Minimum Necessary rule is a valuable tool in the effort to maintain HIPAA compliance in all communications between medical offices and their patients. It is a rule that medical answering services should adhere to. If your answering service is not, perhaps it’s time for you to give Apello a call.
