You might think that after doing due diligence and selecting a strategic partner for HIPAA-compliant patient statement printing and mailing services, you can set it and forget it.
Unfortunately, no.
For one thing, compliance with the Health Insurance Portability and Accountability Act is a moving target. Since HIPAA went into effect in 1996, the federal government has made hundreds of updates and additions to regulations and mandates.
Equally important, security and privacy risks for healthcare keep morphing. Criminals are constantly looking for vulnerabilities, both online and IRL, that allow them to grab personally identifiable information (PII) and protected health information (PHI). Strict security measures to repel these attacks often need to go beyond HIPAA compliance and update frequently to keep up with new threats.
Healthcare organizations also regularly add technologies, processes, staff, and business partners, all of which must comply with the latest HIPAA rules. Among those business partners are print and mail outsourcers, which handle sensitive patient information as key players in the billing and payments process because 71% of providers still most often rely on paper and manual processes to collect patient payments, according to J.P.Morgan/InstaMed’s 2024 Trends in Healthcare Payments report.
Given the fast-changing security and regulatory landscape, it’s essential that providers, revenue cycle management companies and collection firms monitor the companies managing their patient statement printing and mailing. They need to ensure their print and mail partners are staying current with best practices for protecting PII and PHI and meeting HIPAA requirements.
Safeguarding patient statement printing and mailing
It takes an array of stringent policies and practices, plus advanced production technology, to provide the highest safeguards for patient data and maintain HIPAA-compliant printing and mailing services. Some steps should focus on controlling access to sensitive patient information while others are designed to make sure patients receive their own information and no one else’s.
Providers, RCM firms and collection companies should insist on these 9 best practices from their print and mail providers:
1. Pass regular HIPAA compliance and SOC 2 Type 2 audits.
This requirement should be non-negotiable. Printing companies should hire certified experts to conduct annual third-party audits to validate their HIPAA compliance. Similarly, they should be audited annually against SOC 2 Type 2 standards, which attest to not just the design of the controls (which is the SOC 2 Type 1 standard) but their operating effectiveness directly related to security, availability, processing integrity, confidentiality, and privacy at a service organization.
2. Protect patient data throughout.
Top print and mail providers use advanced encryption methods and secure servers and secure file transfer protocols (SFTP) to safeguard patient information at every stage of the patient statement printing and mailing process.
3. Limit access to areas handling sensitive data.
When managing patient statement printing and mailing jobs, only approved employees should access the production floor and mailing operations. To manage access, printing companies should install card access systems as well as require all team members to always wear identification badges.
4. Implement physical security measures in the printing and mailing facility.
Leading print and mail providers establish a variety of security practices to keep PII and PHI confidential:
- Place surveillance cameras throughout their locations, running 24/7, as both a deterrent and resource if there is ever a security incident.
- Require employees to leave their cell phones in their lockers and never bring them into the printing or mailing areas.
- Reinforce these policies with posted signs stating no cell phones or cameras in relevant locations in the building.
- Restrict technology from obtaining PII and PHI, such as blocking USB drives from the enterprise network to prevent downloads.
5. Apply tech-driven quality control.
State-of-the-art print systems and inserters use camera imaging to inspect and verify 100% of all pieces in real-time, spotting defects and misalignments and then alerting the production staff. With these systems, each piece is assigned a sequence number and a unique 2D barcode to track that each page matches so that the correct documents are inserted into the envelope.
If the documents are out of order, the inserting system automatically shuts down. A supervisor takes over, locating the missing piece or otherwise resolving the misalignment before restarting the inserter to finish the job.
Ongoing human oversight is critical, especially for bigger jobs. Operators should inspect and validate a job every 2,500 pieces, for example. They also should look at what is visible through the envelope window to ensure the window placement adheres to the strict guidelines set up during client onboarding or after a client modification to the printing and mailing program.
6. Maintain high security at every step.
Even after patient statements safely reside in their envelopes, it’s important to not let up on security. Some printers transport confidential healthcare communications in closed carts to a secure area and shrink-wrap the mailings before the U.S. Postal Service picks them up.
Some providers, RCM firms and collectors take advantage of commingling their mailings with others to achieve postage discounts. For HIPAA-compliant mailing services, commingling should be handled only by third parties vetted by the printing company and that adhere to HIPAA requirements.
7. Enforce strict methods for disposing of discarded documents with PHI and PII.
Paper jams, misprints and other misfires can produce paper documents that can’t be mailed but still contain patient data. In those cases, there should be a rigorous protocol for properly disposing of these materials, such as an in-house shredding team or HIPAA-compliant third-party that does onsite destruction which removes any risk of readable PHI or PII leaving the facility.
8. Follow strict procedures for return mail processing.
HIPAA requires that patient financial communications be mailed to the address on file, so print and mail providers do not run them through address verification and correction databases such as NCOA and CASS before mailing. This can lead to a higher-than-normal rate of return mail.
As part of their HIPAA-compliant mailing services, some printers offer return mail processing that uses their own trucks to pick up undelivered healthcare mail from the post office and then bring it to their secure facility to process it and properly dispose of it.
9. Train employees on HIPAA compliance.
Establishing stringent security and privacy policies for HIPAA-compliant printing and mailing services is one thing. But companies must make sure these standards are followed every day, for every healthcare client and job. Top print and mail providers invest in ongoing training on HIPAA and PHI for all employees and all new hires, not just print production and mailing services staff.
Incorporating omnichannel HIPAA-compliant solutions.
While other industries have shifted much, if not most, of their consumer billing and payments online, healthcare remains firmly grounded in traditional patient statement printing and mailing. But as in other parts of their lives, patients are increasingly interested in digital options for communications and payments.
Partnering with a HIPAA-compliant print and mail leader that also offers HIPAA-compliant digital communications and payment options gives providers, RCM firms and collection companies a proven and secure path to expanding beyond patient statement printing and mailing. Sooner or later, staying competitive and engaging patients in ways that encourage them to pay their medical bills on time means adding emails, text messaging and digital delivery of billing information to the consumer.
A cloud-based omnichannel customer communications management platform with HIPAA-compliant print and mail, email and text messaging is the perfect way to satisfy each patient’s preference for paper, digital or both. Leveraging a single system for developing patient statements and other financial communications for multiple channels simplifies the complex process. CCM platforms that integrate with print and mail and digital delivery help ensure healthcare organizations are meeting HIPAA rules from patient communications development to distribution.
To discuss HIPAA-compliant patient statement printing and mailing and HIPAA-compliant digital solutions, please contact us.
