That will no longer be possible. Recall that all medical records and other individually identified health information held or disclosed by a physician's office in any form, whether communicated electronically, on paper or orally, are covered by the regulations. A significant investment will have to be made in office infrastructure to achieve compliance. Neurosurgeons should note that they must receive patient consent before information is released. This means that consent must be obtained before sharing patient data for treatment, payment and health care operation purposes.
Patients have the right to request restrictions on the uses and disclosures of their information.
Practices must also adopt written privacy procedures. These must include who has access to protected information, how it will be used within the practice and when the information would or would not be disclosed to others. Steps must also be taken to ensure that a practice's business associates protect the privacy of health information. The upshot of this is that practicing neurosurgeons and their office staffs have another set of regulations with which they must comply. All concerned should take courses to become familiar with this complex system.