Resource of the month: HIPAA Final Rule compliance information and products

This collection of resources is the first installment in a regular series highlighting materials available to members.

By Legal & Regulatory Affairs staff 

Sept. 23, 2013, was the deadline for implementing changes required by the Health Insurance Portability and Accountability Act (HIPAA) Final Rule, which was released in Jan. 2013 by the U.S. Department of Health and Human Services. Psychologists who have not yet become compliant should act promptly to get into compliance. 

To aid the process of compliance with the HIPAA Privacy and Security Rules, the APA Practice Organization (APAPO) has developed and updated several resources which can be found in the HIPAA Compliance section of APAPO’s Practice Central website. 

Available HIPAA compliance materials include: 

  • The HIPAA Final Rule: What you need to do now (PDF, 551KB)
    This resource is free for APA Practice Organization members, and past and future purchasers of the HIPAA for Psychologists compliance product (see below). It includes inserts to update existing HIPAA forms (such as those from the HIPAA for Psychologists product discussed below), including the notice of privacy practices and the business associates contract. It also provides a detailed explanation of key changes for psychologists in the Final Rule.
  • Privacy Rule Primer, updated July 2013 (PDF, 1.52MB)
    Updates include brief explanation of how Final Rule changes fit into the broader context of Privacy Rule compliance. The primer, which is available to all APA members, also provides a refresher for those who started complying long ago, and an introduction for new practitioners just starting with HIPAA. The primer covers HIPAA basics such as important terminology and who needs to comply with the Privacy Rule.
  • HIPAA for Psychologists Compliance Product and CE Course
    Previously developed by APAPO and the APA Insurance Trust (Trust), this comprehensive resource includes a CE course covering the Privacy Rule. More importantly, it contains state-specific forms (notice of privacy practices, authorization for release of records) and detailed state-specific explanations of the rules on releasing patient information and giving patients access to their records. These state-specific resources are based on an extensive pre-emption analysis comparing your state’s law to Privacy Rule provisions.1 Some of these state-specific HIPAA forms will get updated by the Final Rule Resource as mentioned above. The product also contains HIPAA policies & procedures.
  • HIPAA Security Rule Online Compliance Workbook
    This step-by-step tool includes: A risk analysis for all aspects of a typical small psychology practice; compliance options for each Security Rule requirement; policies and procedures that are automatically customized according to the security options you choose; and documentation of your reasons for security choices. 
  • FAQs on HIPAA Final Rule Resources
    This new resource provides answers to frequently asked questions from members about accessing and using the HIPAA for Psychologists CE course and the HIPAA Final Rule: What you need to do now resource. 

1 We note, however, that the state law part of the analysis has not been updated since 2003. A check of the state law provisions in the summer of 2013 indicated that the vast majority of state law cited had not changed. The APA Practice Organization and the Trust do not currently have the substantial attorney resources available to completely update the state law provision, in part because this requires painstaking preemption analysis. Nonetheless, we are unaware of any Privacy Rule compliance resources for psychologists that are more comprehensive than HIPAA for Psychologists. There are other HIPAA compliance products available for purchase, but neither the APA Practice Organization nor the APA Insurance Trust can speak to their quality or legal accuracy.