HIPAA Training for Home Health OASIS Review Teams: Protecting Patient Privacy

What patient privacy notices must home health agencies provide for OASIS data?

For every patient whose information the agency collects for OASIS, regardless of payer, CMS says agencies should provide the Statement of Patient Privacy Rights and the Privacy Act Statement – Health Care Records. CMS identifies these as the OASIS privacy notices and makes them available in English and Spanish in its OASIS-E2 Guidance Manual.

These OASIS notices are separate from the agency’s HIPAA Notice of Privacy Practices. Most covered healthcare providers must also provide that notice, which explains how the provider may use and disclose protected health information (PHI), patient privacy rights, and the provider’s privacy duties. See HHS guidance on Notices of Privacy Practices for applicable requirements.

How should teams protect identifiable OASIS data in paper and electronic formats?

Treat patient-identifiable OASIS information as confidential PHI. For paper records, limit access to authorized staff, keep documents in secured storage when not in use, avoid leaving them unattended or visible to others, and use secure disposal methods. When transporting records, protect them from loss or viewing by unauthorized people.

For electronic OASIS data, use agency-approved systems and individual accounts; do not share passwords. Lock or log out of workstations when stepping away, restrict access according to each user’s role, and use approved secure methods to store or transmit information. HIPAA’s Security Rule requires appropriate administrative, physical, and technical safeguards for electronic PHI, with measures selected in light of the organization’s risks and circumstances. See the HHS Summary of the HIPAA Security Rule.

How can reviewers securely assess, correct, and submit OASIS data?

Review only the records needed for your assigned work, and use the agency’s approved system and correction process. Verify the patient and assessment before making changes, compare entries with the supporting clinical documentation, and follow current CMS item guidance. Do not guess, make unsupported changes, or use informal channels to share patient information.

When a correction is needed, document it according to agency policy so the record’s accuracy and change history remain clear. CMS guidance says to follow the item’s specified time period and report the patient’s status for the applicable assessment period; reviewers can consult the OASIS-E2 Guidance Manual and CMS OASIS Q&As when item guidance needs clarification. Submit data only through the authorized process and confirm that the submission was received.

How should teams interpret OASIS validation reports and correct submissions?

Read each report’s message, severity, and affected item values; a validation message signals a data or file issue to assess, not permission to alter the clinical record without support. CMS’s current iQIES OASIS Error Message Reference Guide explains that fatal record errors result in rejection and must be corrected and resubmitted. Review warnings and correct them when appropriate to ensure the data is accurate and complete.

After corrections, resubmit through the approved process and check the resulting report to confirm the status. If the agency report is unavailable because of severe file errors, the guide explains that the original submitter can request the Submitter Final Validation Report in iQIES.

What HIPAA safeguards help prevent breaches during OASIS review?

Effective safeguards combine clear policies, appropriate access, secure work practices, and staff training. Agencies should assign access based on job responsibilities, review system activity, protect devices and paper files, and make sure staff know how to report suspected security incidents. HHS identifies risk analysis, role-appropriate access, security training, and incident-response procedures among the Security Rule’s administrative safeguards and related requirements in its HIPAA Security Rule summary.

Training should explain the agency’s own privacy and security policies as they apply to OASIS review. HIPAA requires workforce training on applicable policies and procedures, but a training completion certificate documents an individual’s completion; it does not establish that an organization is HIPAA-compliant. Federal HIPAA rules do not create a universal annual certificate-renewal requirement.

What steps should staff take after a suspected security breach?

Report a suspected exposure, loss, misdirected transmission, or unauthorized access immediately through the agency’s breach response procedures. Notify the designated privacy or security contact, follow instructions to contain the incident, and preserve relevant records and messages. Share the facts you know—such as what information was involved, who may have received or accessed it, and when—without conducting an unauthorized investigation or notifying patients on your own.

The agency’s responsible officials must assess the incident, document their response, and determine whether it is a reportable breach. Under HHS’s Breach Notification Rule guidance, an impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. Required notices for a breach of unsecured PHI must be provided without unreasonable delay and no later than 60 days after discovery; staff should promptly escalate the event so the agency can meet applicable deadlines.

How should agencies limit contractors’ access to OASIS information?

Give contractors access only to the information and functions needed for their assigned work, use individual accounts where available, and end access when it is no longer needed. If a contractor performs services that make it a business associate and handles PHI on the agency’s behalf, the agency must have a written business associate agreement (BAA) before permitting that work. The agreement should define permitted uses and disclosures, require appropriate safeguards and incident reporting, address subcontractors, and provide for return or destruction of PHI when the relationship ends where feasible. HHS describes these requirements in its Business Associate Contract guidance.

Home health agencies and their agents must protect the confidentiality of patient-identifiable information in clinical records, including OASIS data, and may not release patient-identifiable OASIS information to the public under 42 CFR § 484.40. Keep OASIS access limited, follow secure review and correction practices, and escalate concerns promptly to protect patients and support accurate submissions.

FAQs

Which privacy notices must patients receive when OASIS data is collected?

CMS says agencies should provide all patients for whom OASIS is collected, regardless of payer, the Statement of Patient Privacy Rights and the Privacy Act Statement – Health Care Records. The agency must also provide its HIPAA Notice of Privacy Practices when applicable to its covered-provider responsibilities.

Can patient-identifiable OASIS information be released to the public?

No. Under 42 CFR § 484.40, a home health agency and its agent must protect patient-identifiable information in the clinical record, including OASIS data, and may not release patient-identifiable OASIS information to the public.

What should an OASIS reviewer do after discovering a possible breach?

Report it immediately through the agency’s breach response procedures to the designated privacy or security contact. Follow containment instructions, preserve relevant information, and share the known facts. Do not decide on your own whether the event is a reportable breach or contact patients; the agency’s responsible officials assess and manage notification requirements.

What written agreement is needed when a contractor handles OASIS reporting?

If the contractor is a business associate handling PHI on the agency’s behalf, the agency needs a written business associate agreement. It should define the contractor’s permitted uses and disclosures, require safeguards and incident reporting, address subcontractors, and cover return or destruction of PHI when the agreement ends where feasible.