Compliance Rules

by  Melissa Hall
Apr 14th, 2017 - Reviewed/Updated Feb 8th

Question

Our office would like to send a survey to our patients. Are there compliance rules for this? 

Answer

Under the HIPAA privacy regulations, health care facilities may conduct "quality assessment and improvement activities" as part of the facility's health care operations. A survey or questionnaire that determines whether patients were satisfied with the quality of care they received would be a quality assessment and improvement activity and, therefore, considered health care operations.

Before conducting these activities, however, the facility must state (if applicable) in its notice of information practices that it may use identifiable health information for the facility's health care operations (most chiro facilities don't do this). If a health care facility agrees to a restriction on its use of a patient's health information, any use of information for health care operations, including patient surveys, would be limited by that restriction. In addition, if a patient makes a request for "confidential communications," for example, specifying how or where the health care facility may contact the patient, the facility must accommodate any reasonable request.

Finally, state laws may limit the use of identifiable health information for these purposes.

A health care facility may hire a vendor to conduct the surveys on the hospital's behalf pursuant to a business associate agreement under HIPAA. Although there are other ways of conducting surveys, if a survey creation resource is needed, Survey Monkey is a survey software program that is HIPAA compliant.