First phase of HIPAA gets underway; next compliance deadline is Oct. 16. (Front Page).

The first phase of the Health Insurance Portability and Accountability Act officially kicked off April 14. That's when all medical care facilities were required to implement and follow a series of guidelines concerning patient and employee privacy.

Now the long term care industry can circle Oct. 16 as the next big compliance deadline. That's when facilities must begin to use standardized codes for patient information and billing.

For Sandi Baker, an administrator for Valley West Care Center, a 99-bed, long term care facility in Williams, Calif., HIPAA may as well stand for "headache."

According to Baker, compliance with HIPAA regulations means most long term care facilities will need to go through all their policies and procedures with a fine tooth comb. "We already have very strict confidentiality regulations in California," she said. "But we've had to expand our privacy notices and distribute them to patients and get written verification from them or their representatives that they've received the notices."

Valley West Care Center has also made several other small changes, such as placing patients' charts behind a door on carts to prevent them from being seen by others, Baker said.

While some of these changes might seem relatively easy to make, the bigger challenge will come when phase two of the three-part act kicks in on Oct. 16, according to Jeff Short, an Indianapolis attorney who has studied HIPAA law for two years.

"This will hit (facilities) that have already been doing electronic billing the hardest if they have to rework their whole computer systems," Short said. "For the ones who have to start from scratch, it won't be so bad, because they'll have the chance to get the system right in the beginning."

Either way, it's going to mean long term care facilities nationwide will spend millions of dollars to literally get with the program, according to Short.

HIPAA consists of three phases: patient privacy provisions, which became effective April 14; data coding changes, which take effect Oct. 16; and enhanced security guidelines, which go into effect February 2005.

Under HIPAA, long term care facilities are now only allowed to disclose patient information under three circumstances: if it relates to patient treatment, bill collecting or for internal operations, such as a facility's accounting, legal or insurance departments.

Although these areas cover a lot of ground, there are still many cases in which facilities can't disclose information without patient permission, such as displaying the patient's name outside his or her door.

Long term care facilities must also prepare privacy notices for patients informing them what their rights are.

Violators face fines of $50,000 to $250,000, Short said.