Organized Health Care Arrangement
HIPAA Update -- OHCA and the Organized Medical Staff
Question: What is an OHCA?
Answer: An Organized Health Care Arrangement (OHCA) is an arrangement or relationship, recognized in the HIPAA privacy rules, that allows two or more Covered Entities (CE) who participate in joint activities to share protected health information (PHI) about their patients in order to manage and benefit their joint operations.
In order to qualify as an OHCA, the legally separate CE's must be clinically or operationally integrated and share PHI for the joint management and operation of the arrangement. Also, individuals must expect that these arrangements are integrated and share information to manage their operations.
Although an OHCA can apply to other entities such as group health plans or health systems, the most common example of an OHCA is the hospital setting where the hospital and the physician who has medical staff privileges at the hospital together provide treatment to a hospitalized patient and need to be able to share PHI to treat the patient and to improve hospital operations.
Question: Why have an OHCA?
Answer: The revised HIPAA privacy rules allow CE's to share PHI for treatment, payment and health care operations (TPO) but every CE with whom PHI is shared for health care operations must have a relationship with the patient. An OHCA allows physicians who have no relationship with a patient to access PHI of patients for TPO –including quality assurance, utilization review and peer review- without a business associate agreement (BA) and with a single Notice of Privacy Practices (NPP).
An OHCA benefits the physician and the hospital because it allows access to PHI by other CE's that are part of the OHCA for quality initiatives within the hospital with a single, common NPP given to the patient upon admission to the hospital. Access to PHI applies only to the participating entities of the OHCA and applies only to patient encounters at that hospital. Permitted access does not extend to the physician's office, other hospitals, clinics, labs or other sites that are not part of the clinically or operationally integrated OHCA.
A clinic, laboratory or practice that is not clinically or operationally integrated with the hospital will need to provide its own NPP.
Question: Does an OHCA have to be reflected in the medical staff bylaws?
Answer: Guidance issued by the HHS Office for Civil Rights in December, 2002 implies that an OHCA exists, without any affirmative action on the part of its participants, anytime a group of CE's participate in activities that are within the definition of an OHCA. There is no specific guidance regarding formation or documentation of an OHCA.
However, in order for the medical staff to understand the purpose, scope, responsibilities and limitations of an OHCA, it is prudent to document an OHCA in a manner that will notify and inform all medical staff members regarding how PHI will be shared, how this is communicated to patients and how the process is managed by the hospital. Some medical staffs have used a letter from the medical executive committee to the medical staff members to document an OHCA. Others have included OHCA information in medical staff policies or rules; and others have included a reference to OHCA in medical staff bylaws
Careful review of any NPP intended to cover all components of an OHCA is imperative prior to acceptance by the medical staff. The medical staff should also work with the hospital to ensure that operational and enforcement issues are addressed and communicated to the medical and hospital staff.
This update is provided for informational purposes and is not intended as legal advice nor as a substitute for personal consultation with an experienced attorney.