Cornerstone User Information

Cornerstone & HIPAA

The following information is extracted from a letter mailed to all Cornerstone sites on July 1, 2003 from Jo Anne Durkee, Chief of the Bureau of Performance Support Services, Division of Community Health and Prevention of the Department of Human Services. The actual letter can be viewed in PDF format.

The Department of Human Services (DHS) completed a review of its programs that use the Cornerstone system in their day to day business. This review determined that only the Early Intervention program is considered a covered entity under HIPAA. The Early Intervention program (under Part C of the Individuals with Disabilities Education Act) functions as a “health plan” under HIPAA, and, therefore, is covered by HIPAA requirements under the transactions, code sets rule, and the privacy rule. Other programs using Cornerstone are not covered entities under this rule including the Family Case Management program.

Cornerstone is not a covered entity and is not covered by the HIPAA transactions and code sets rule. However, because Cornerstone contains protected health information from the Early Intervention program (EI) Cornerstone will comply with the HIPAA privacy rule.

Please note that some agencies in which Cornerstone is used are covered entities in their own right, and are required to establish their own procedures for coming into compliance with HIPAA. To minimize the potential for confusion between local HIPAA procedures and those related to Cornerstone, the Cornerstone Notice of Privacy Practices and procedures are being released now.

Complying with the HIPAA privacy rule will require the following actions on the part of Cornerstone users.

1. “Notice of Privacy Practices”

A Notice of Privacy Practices must be provided to all Cornerstone enrollees. Accompanying this correspondence is the HIPAA Notice for Cornerstone users to distribute to all enrollees upon intake. The Notice describes the ways in which health information may be used and disclosed in Cornerstone, and will inform clients of their HIPAA rights. These rights include the right to access and request amendment of their health information, the right to be told where their health information has been sent, and the right to file a complaint about violations.

This Notice does not replace the Cornerstone consent form. Cornerstone users will continue to use the Cornerstone consent form supplied by DHS as it is currently used.

DOWNLOAD THE NOTICE OF PRIVACY PRACTICES IN ENGLISH AND SPANISH.

2. Privacy Procedures

Attached to this correspondence are procedures that when followed will insure compliance with the HIPAA privacy rule with regard to Cornerstone. These procedures will include those governing:

1. Responding to requests to access health information;
2. Responding to requests to amend health information;
3. Responding to requests for an accounting of disclosures;
4. Adherence to the “minimum necessary” standard; and
5. Filing a complaint regarding use of health information.

Local Cornerstone users will be responsible for responding to requests about Cornerstone information, unless it is information that only DHS can access. Of course, Cornerstone users remain responsible for health information they possess that is not in Cornerstone.

3. Training

An explanation of the HIPAA Privacy Rule and the required procedures must be reviewed by all Cornerstone users for purposes of compliance. DHS is preparing this explanation which is to be shared with all users of the Cornerstone system. This explanation and procedures for its distribution will be sent to each agency’s Cornerstone liaison within the month.

Compliance with the privacy standards of HIPAA, while not legally required for the majority of Cornerstone users (the exception being Early Intervention providers and users of the E.I. module of Cornerstone), is a sound principle. Adherence to HIPAA further protects the privacy of Cornerstone and human services recipients.

Please direct any questions you may have regarding this correspondence and the procedures to your agency’s DHS Community Support Services Consultant.