Face sheet: the patient summary facilities send with a ride request, and what a transport company keeps

What is a face sheet?

A face sheet is the identifying page at the front of a patient’s chart, and a facility may attach a copy to a ride request or a discharge packet. Each facility designs its own, but one usually carries the patient’s name, birth date, address, phone number, medical record number, insurance and Medicaid numbers, and an emergency contact. The nursing home pickups guide shows where it sits in the packet a resident takes to an appointment.

Those identity fields are all on HIPAA’s list of identifiers in 45 CFR 164.514(b)(2)(i): names, street addresses, birth dates, telephone numbers, medical record numbers, and health plan beneficiary numbers. That makes a face sheet protected health information while the facility holds it, and a ride company should handle a copy the same way. Whether HIPAA binds your company directly depends on whether you are a covered entity or a business associate, and HIPAA for NEMT providers explains how to tell.

What does a ride company need from a face sheet?

A ride needs the trip details, and the ride request already carries them. The manifest MTM Health sends for a Virginia trip shows what a ride needs. It gives dispatch a trip number to bill against, a way to reach the member and the provider, the pickup and appointment addresses and times, the authorized mode and level of assistance, whether an escort rides, the member’s weight including equipment, and any special instructions. The trip manifest glossary page covers the fields.

Nothing in the handbook’s list calls for a diagnosis, a medication, or a Social Security number. A face sheet shares only the member’s name and phone number with that list. The rest of it, including the insurance numbers, is not something a driver acts on. Ask the facility for the ride request, and keep the face sheet out of the dispatch process unless a program asks for it.

May a facility send you a face sheet, and may you ask for less?

A facility may share patient information to coordinate care, and the rules ask both sides to limit what moves. HIPAA defines treatment to include a provider’s coordination of care with a third party (45 CFR 164.501). A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations (164.506(c)(1)).

The minimum necessary standard in 164.502(b)(1) applies to uses, disclosures, and requests. It has exceptions, one of them for disclosures to or requests by a health care provider for treatment. Whether that exception reaches a given ride company is a question for your privacy officer. Asking for less is safe either way. Under 164.514(d)(4), a request for protected health information must be limited to what is reasonably necessary, and a routine request can follow a standard protocol. Write one: the ride request form is required, and a face sheet is not. The minimum necessary glossary page covers the exceptions.

How do you handle a face sheet you already have?

Handle it as protected health information, with these four habits:

1. Carry a packet sealed. When a facility sends a face sheet with the resident for the clinic, the driver carries it closed and hands it to clinic staff. The driver has no reason to open it. Section 164.530(c)(2)(ii) asks you to limit incidental disclosures.
2. Limit office copies to the staff who need them. Section 164.514(d)(2) asks an organization to name who needs access and which information each person needs. Intake and billing may need an insurance number. Drivers need the manifest.
3. Treat the fax machine and the copier as storage. In the 2013 Omnibus rule (78 FR 5566, at 5576), HHS said protected health information kept in photocopier and fax devices is covered by the Privacy and Security Rules. Restrict who can reach those machines, and have the stored data removed before a machine leaves, for example at the end of a lease.
4. Check who is asking before you send one back. Section 164.514(h)(1)(i) requires a covered entity to verify the identity and authority of a requester it does not know. For fax and phone requests, HHS’s 2000 rule preamble (65 FR 82462, at 82719) describes calling the requester back through the main organization switchboard, not a direct number.

The text of those sections speaks to covered entities. Whether your company is one or a business associate, the practices are worth writing into your policy.

Keeping rider details limited in HealthRide

In HealthRide, each person’s view is limited to what their role allows, rider details stay off phone lock screens in the driver app, and the platform is HIPAA compliant.