The Department of Social Services (DSS) has issued clarifying guidance on HIPAA and providing resident names when submitting incident reports to the regional licensing office. The clarification explains that HIPAA does not prohibit assisted living facilities (ALFs) from providing resident names to DSS in incident reports.

The guidance is provided in its entirety; the only change is to the last sentence.  

Situation:

An ALF has contacted a licensing inspector with a concern about HIPAA and the provision of resident names when making incident reports to the regional licensing office. The facility would like to use a resident ID number, instead of using the resident’s name.  The facility noted that per HIPPA, it can no longer send resident protected health information that identifies residents in incident reports.  

Question:

Would it be acceptable to only include resident ID numbers in incident reports instead of resident names? Would sending resident ID numbers instead of names be acceptable if the facility provides a list of resident names with the corresponding ID numbers? 

Recent Answer:

The names of residents must be included in incident reports, as required by 22 VAC 40-73-70. It would not be acceptable to only include resident ID numbers instead of resident names. It would also not be acceptable for the facility to provide a list of names with corresponding ID numbers, instead of including names in incident reports. In addition to the requirement for resident names specified in the ALF standards, § 63.2-1728 of the Code of Virginia supports the provision of resident names. Please note that ALFs are not identified as an entity that is covered by HIPAA.    

Revised Answer: 

The names of residents must be included in incident reports, as required by 22 VAC 40-73-70. It would not be acceptable to only include resident ID numbers instead of resident names. It would also not be acceptable for the facility to provide a list of names with corresponding ID numbers, instead of including names in incident reports. In addition to the requirement for resident names specified in the ALF standards, § 63.2-1728 of the Code of Virginia supports the provision of resident names. Please note that HIPAA does not prohibit ALFs from providing resident names to the Virginia Department of Social Services in incident reports. 

If you have questions about this, please contact Judy McGreal at 804-663-5535 or judith.mcgreal@dss.virginia.gov.