HIPAA Compliance Requirements for Ostomy and Catheter Mail-Order Companies

Mail-order ostomy and catheter suppliers may handle sensitive health information while processing orders, billing payers, and delivering supplies. Whether HIPAA applies depends on the company’s role and activities—not simply on the products it sells or the fact that it receives patient information.

Determine Whether HIPAA Applies to Your Supplier Business

Start by assessing whether your company is a HIPAA covered entity, a business associate, both in different relationships, or neither. A HIPAA covered entity definition includes health plans, health care clearinghouses, and certain health care providers. A supplier may qualify as a health care provider if it furnishes or bills for health care and conducts an electronic standard transaction, such as submitting claims or checking eligibility. Using a billing service to conduct that transaction does not necessarily change the provider’s status.

Simply using email or another electronic tool does not make a supplier a covered entity. The key question is whether the company transmits health information electronically in connection with a transaction for which HHS has adopted a standard. A supplier that does not meet the covered-entity or business-associate definition is not subject to the HIPAA Rules solely because it sells medical supplies.

Identify Covered Entity and Business Associate Roles

A HIPAA business associate definition generally covers a person or organization that performs certain functions or services on behalf of a covered entity and, as part of that work, creates, receives, maintains, or transmits protected health information (PHI). Examples can include billing, claims processing, or administrative services performed for a covered provider or health plan. Subcontractors handling PHI on behalf of a business associate may also be business associates.

A supplier’s role depends on the relationship and the work involved. A company may be a covered entity when it conducts standard transactions as a provider, and a business associate when it separately handles PHI for another covered entity. Merely selling supplies to a provider does not automatically establish a business-associate relationship; examine whether the supplier is acting on the provider’s behalf and handling PHI for that service.

Establish Business Associate Agreements

When a covered entity engages a business associate to perform work involving PHI, the parties generally need a written business associate agreement (BAA) or other permitted written arrangement. The agreement should define allowed and required uses and disclosures, require appropriate safeguards, and prohibit uses or disclosures beyond the agreement or as required by law.

A BAA should also address reporting security incidents and breaches, access to or amendment of records when applicable, subcontractors’ obligations, record availability for compliance review, and the return or destruction of PHI when the relationship ends if feasible. Confirm that subcontractors handling PHI agree to the applicable restrictions and safeguards as well. Business associates have direct obligations under certain HIPAA provisions in addition to their contractual duties.

Safeguard Protected Health Information

Order forms, prescriptions, claim records, delivery records, and customer-service communications may contain protected health information safeguards should cover. When information identifies an individual and relates to their health, care, or payment for care, protect it in every format—electronic, paper, and spoken.

Covered entities and business associates that handle electronic PHI must use administrative, physical, and technical safeguards appropriate to the Security Rule. Practical measures include assessing risks, limiting system access to authorized staff, securing devices and paper files, training the workforce, reviewing system activity, and maintaining procedures for responding to incidents. Consider encryption as part of risk management; the Security Rule’s encryption specification is addressable, so assess and document whether it is reasonable and appropriate for your circumstances. Business associates must report breaches of unsecured PHI to the covered entity as required.

Apply Minimum Necessary Use and Disclosure

The minimum necessary standard generally requires covered entities to make reasonable efforts to use, disclose, and request only the PHI needed for the intended purpose. For example, give customer-service staff access to the order details they need to resolve a delivery issue rather than unrestricted access to an entire patient record. Set role-based permissions and procedures that match each job’s duties.

The standard has exceptions, including disclosures to or requests by a health care provider for treatment. Apply the rule to the situations it covers, and ensure that business-associate agreements and work procedures support the covered entity’s limits on PHI use and disclosure.

Document Ostomy Supply Orders and Medicare Deliveries

HIPAA privacy and security duties are separate from Medicare payment documentation rules. For Medicare durable medical equipment documentation, suppliers generally need a standard written order, supporting medical-record information that establishes medical necessity when required, correct coding, and proof of delivery. A standard written order includes the beneficiary’s name or Medicare Beneficiary Identifier, order date, item description, quantity when applicable, treating practitioner’s name or National Provider Identifier, and practitioner signature. The order must be communicated before claim submission; some items require a written order before delivery.

Keep delivery records in the supplier’s files and make required records available to the Medicare contractor upon request. For recurring supplies, use prospective refill practices and document refill requests and relevant order details. For ostomy and catheter claims, verify that the medical record supports the supplies and quantities billed, and retain delivery evidence. Requirements can vary by item and applicable Medicare policy, so confirm the rules for the specific supplies and claim.

In short, determine your HIPAA role based on the transactions you conduct and the services you perform, put appropriate written agreements and safeguards in place when required, limit PHI use where the minimum necessary rule applies, and keep complete records to support Medicare claims and deliveries.

FAQs

Are ostomy and catheter mail-order companies always subject to HIPAA?

No. A company’s status depends on whether it meets the definition of a covered entity, business associate, or both. For example, a supplier may qualify as a covered health care provider if it conducts standard electronic transactions, or as a business associate if it performs services involving PHI on behalf of a covered entity.

When does a medical supply company qualify as a business associate?

A medical supply company generally qualifies when it performs a service for a covered entity, and that service involves creating, receiving, maintaining, or transmitting PHI. Selling supplies alone does not automatically make the company a business associate; the relevant question is whether it handles PHI while performing work on the covered entity’s behalf.

What must a business associate agreement cover?

A BAA should specify permitted and required PHI uses and disclosures, require safeguards, address incident and breach reporting, flow applicable restrictions to subcontractors, and cover access to or handling of records when required. It should also address return or destruction of PHI at termination when feasible and other obligations applicable to the services.

What documentation may Medicare require for ostomy supply claims?

Depending on the item and applicable policy, Medicare may require a standard written order, records supporting medical necessity, correct coding, and proof of delivery. Keep documentation of the items and quantities ordered, practitioner information, refill activity when applicable, and delivery. Confirm any item-specific requirements before billing.