The Office of Compliance

Compliance FAQ

What is PHI and its 18 identifiers?

Protected Health Information (PHI) is any individually identifiable health information created or received by the University. Such information may relate to past, present, or future physical or mental health of a patient or research study participant. PHI is information that is used to identify the individual. PHI can be transmitted electronically, orally, or in writing.

  1. Patient Names
  2. Geographical Elements
  3. Dates
  4. Phone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security numbers
  8. Medical record numbers
  9. Health insurance beneficiary numbers
  10. Account numbers
  11. Certificate/license numbers
  12. Vehicle identifiers
  13. Device identifiers
  14. URLs
  15. IP address numbers
  16. Biometric identifiers
  17. Facial images
  18. Any other unique identifying number, characteristic, or code

What is HIPAA and its purpose?

HIPAA is an acronym for the Health Insurance Portability and Accountability Act of 1996. It is a federal law designed to help protect patient’s health information. HIPAA protects the privacy and security of patient medical information in written, verbal, and electronic form. 

Is WCM required to comply with HIPAA?

Yes. The University is a covered entity and HIPAA applies to all covered entities— Healthcare providers, Health plans, and healthcare clearinghouses. Often, contractors, subcontractors, third party service providers (vendors) and other outside persons that are not employees of the covered entity will need to have access to patients’ health information when providing services to the covered entity. These entities are called “Business Associates” and are required to comply with HIPAA.

Will the Audits Still Be Reported by Provider, or Will this Now Change to Department Based, Especially Where Departments Providers do not Code Their Own Claims?

The highest level of reporting will be on a particular risk area will be done at the institution level. Departments will receive an aggregated report on the results of their providers for that risk area and that will include information about the providers who were captured in the audit sample. The most important part of these reports will be the action steps that might be necessary if a risk is confirmed and needs to be mitigated. Individual provider feedback reports will continue to be sent to the providers, so they are aware of their individual audit findings.

Will There Be a Change to How New Providers are Handling Through the Audit Process?

The risk-based audit work plan will include baseline reviews of new providers and an in-person audit feedback meeting. The sample size for the new providers will be 10 cases. After this is performed, the providers will likely be captured in other risk areas on an ongoing basis and consistent with their billing patterns.

Submit Compliance Incident

Weill Cornell Medicine The Office of Compliance 575 Lexington Avenue, 9th Fl New York, NY 10022 Phone: (866)-293-3077