Coding Standards for Privacy for At-Home Coders (107.014)

Coding Standards for Privacy for At-Home Coders (107.014) - Policies, Administrative, UWMF, UWMF-wide, HIPAA/Privacy


University of Wisconsin Medical Foundation
Policy & Procedure

Policy Name: Policy Number: Privacy 015

__X__ New ____ Revised

If Revised, Supersedes Policy Dated:

Effective Date:
Approved By (Name):


I. Purpose
To define a privacy standards of conduct for Coding Staff who have been authorized to work
from home, in compliance with federal and state law as well as other University of Wisconsin
Medical Foundation (“UWMF”) privacy policies. These standards shall ensure that all patient
Protected Health Information (“PHI”) is held and used by the Coder in a private, confidential,
and secure manner, and that PHI is not otherwise inappropriately disclosed.

II. Policy

All PHI shall be held and used by Coding personnel in a private and secure manner in
accordance with the procedures set forth below. PHI shall be used and accessed only to the
extent minimally necessary to complete the task at hand in accordance with the federal rules on
”Minimum Necessary Use” of PHI.

III. Procedure

A. General Procedures - All Coding staff abide by the following procedural requirements
relating to the confidentiality of patient PHI.

1. Access – Non Staff. Non UWMF individuals never, under any circumstances, are
allowed access to the Coder’s computer at any time.

2. Access – Non Staff. Non UWMF individuals never, under any circumstances, view
medical records and other documentation containing PHI.

3. Access – Staff. Staff does not access patient records, paper or electronic, unless such
access is absolutely necessary to carry out tasks related to coding services provided by a
UWMF provider. If such access must take place, staff accesses no more than is

reasonably and minimally necessary to carry out the tasks associated with coding the
particular service being reviewed by the coder at that time.

4. Discussion / Minimum Necessary. Staff does not discuss coding/medical record
information which does not directly apply to her/his job duties and current assignments.

5. Email. All e-mail regarding patient information is sent through Groupwise. PHI is
never sent outside the Groupwise system unless properly encrypted. In order to
determine if encryption is possible and for other assistance, staff contacts the IS Help

6. Passwords. Passwords are never shared.

7. Passwords. Passwords do not remain in use any longer than three (3) months, and must
be changed no less than every three (3) month period.

B. At-Home Coding – Coding staff who is authorized to work from home performs her/his job
duties in accordance with the general privacy obligations outlined in paragraph A, above, as well
as in accordance with the following requirements

1. Workstations (including computer, hard drive, screen, keyboard; desk/work area)

(i) Location. The work station is segregated or separated in some fashion from
common traffic areas in the home. [For example, if the work station is placed in a
family room, it should be placed off in a corner not regularly used by other family

(ii) Location. The computer monitor is always be situated so that the screen faces
away from or is otherwise shielded from the public areas of the home or from
plain view when others are present.

(iii) Log Out. Whenever staff is away from the work station, staff logs out of all
UWMF applications, access to UWMF applications is locked (“Windows Key +
L) and/or secured through use of keyboard combination plus password, and the
computer is secured to prevent inappropriate access by others.

(iv) Downloading. Coding staff never downloads PHI from a UWMF system to
the at-home work station or to any other location not within the UWMF
networked system.

2. Paper/PHI

(i) Any paperwork or notes including, but not limited to, medical record copies,
encounter forms, physician schedules, handwritten notes, “Post-It,” notes or any
other media containing PHI are always locked away when not in use.


(ii) All logs or other records containing PHI, which are not otherwise filed in the
central record, are retained for no more time than is necessary to complete the
task at hand or for three (3) months, whichever is the lesser period of time.
Following such retention period, all such documents are shredded or otherwise
disposed of in accordance with the UWMF “Disposal of PHI” policy. (e.g.,
shredding for paper, through Information Services for electronic media or disks).

(iii) At no time may any electronic records be downloaded or saved from UWMF
systems to a personal computer for any purpose. Electronic information of any
kind containing PHI may not be printed for any purpose other than to complete a
transcription assignment and must be shredded immediately after such use.

3. Home Visit

(i) Prior to conducting any coding work from home, the Coder’s supervisor or other
authorized UWMF representative conducts a home visit to ensure that the
standards set forth in subparagraph 2, above, are met.

IV. Attachments – None.

V. References

 Transcriptions Standards of Privacy Policy

Note – Do you want to include a authors / review / approval history?

VI. Author & Review

Author: Jody McClain Cathy Boelke


Committee Approval: