Disclosures

Health Web Site standard 4 provides:

The Web site discloses to users: (Primary)
(a) What information is collected about users after the user opts-in to the information collection
and how it is used (including the use of passive tracking mechanisms); (Primary)
(b) The use of passive tracking mechanisms to users and the purpose(s) for which the passive
tracking mechanism will be used; (Primary)
(c) To whom personally-identifiable information may be disclosed, and for what purpose;
(Primary)
(d) How long personally-identifiable information is retained; (Primary)
(e) The rights of users with respect to their personally-identifiable information, including all the
rights enumerated in section IV of these standards; (Primary)
(f) The entity that maintains personally-identifiable information; (Primary)
(g) How users can access, supplement, and amend user-provided personally-identifiable
information and personal health information; and (Primary)
(h) Any limitations on amendment, deletion, or removal of information. (Primary)

The standard, like all of URAC's privacy/confidentiality-related standards, is a mandatory standard.  

It's important to note that Personally Identifiable Information ("PII") is defined as "Any information that can be tied to an individual identifier."

This disclosure requirement is a prerequisite for WS 24, the opt-in requirement for personally-identifiable information PII).  The notion underlying this pair of standards, of course, is that full disclosure is required for true choice.

The disclosures required by this standard are usually on a page called "Privacy Policy," and must be obviously displayed.  We recommend that this be a persistent link in the overall template of the Web site.

Another important issue in connection with this standard has to do with the use of 3rd parties that might collect and use PII, such as a health risk assessment tool.  URAC provides guidance for this scenario in its "Points to Remember" section of the Program Guide.  The essence of that guidance is that the applicant Web site is held to a high standard regarding privacy disclosure, and does not get off the hook by delegating PII-collection to a contractor.

The submission for this standard has the same form as most: a P&P that clearly describes the PII policy, coupled with an easily-locatable link to a comprehensive disclosure page.  

This standard, with a single clause and a relatively low weight of 3, is quite straightforward and easy to meet.  It reads:

The Web site discloses its practices for uses and response times for e-mails, electronic messages, and other communications transmitted via the Web site. (Primary)

As is nearly always the case with Health Web Site standards, a combination of a compliant web page and a P&P that codifies the appropriate procedure is required by URAC.  For this standard, it also will be helpful to provide evidence that staff members charged with communications are trained in the P&P's requirements (e.g., training agendas).  In addition, URAC suggests submitting dated response emails to show that your organization complies with your own turnaround-time policies.   

One of the clearest examples of the way a contact page should look can be seen at A.D.A.M.'s "Contact Us" page.

Be forewarned --  The URAC reviewer might just send you an anonymous email to see if you comply.  Make sure you've implemented your P&Ps on turnaround times!

This standard, while easy to comply with, is not a slam dunk.  It provides:
The organization:

(a) Requires utilization management staff to identify themselves by name, title, and organization name; and

(b) Upon request, verbally informs patients; facility personnel; the attending physician and other ordering providers; and health professionals of specific utilization management requirements and procedures.

It carries a weight of only 3, and neither of its subsections is primary.  So, it is surely true to say that you can miss this all together and still have a great shot at accreditation.  However, since it is our theory as URAC consultants that we should leave no points on the table, is worth just a little extra staff training time to sweep up these readily available points.

The most common mistake that we have found relating to this standard happens when utilization management staff members identify themselves only by name and organization, omitting the job title.  This, obviously, is both easy to detect and easy to fix.

Less common, but perhaps slightly more difficult to address is the requirement of subsection (b).  A good way to diagnose problems with the standard is periodically to pose such requests to the members of your utilization management staff.  The question might sound like this: “imagine that I am a patient, and I want to know what the procedures are to get my procedure approved, and I want you to tell me in writing.  What are you going to send to me?” 

Obviously, this presumes that you have something easy to send to providers and patients that summarizes utilization management procedures and requirements.  If these procedures are embedded in a larger document that you do not want to send, I recommend that you have a ready supply of copies of that section of the document available for your staff members to send out to requesting providers and consumers.