Resources - FAQ - conducting surveys
AHA News Question
Under HIPAA, can a hospital conduct surveys or questionnaires of patients to learn whether they were satisfied with the care they received and, if so, what requirements or limitations are there on such activities? Can a hospital hire a vendor to conduct the surveys?
Under the HIPAA privacy regulations, hospitals may conduct "quality assessment and improvement activities" as part of the hospital's health care operations. A survey or questionnaire that determines whether patients were satisfied with the quality of care they received would be a quality assessment and improvement activity and, therefore, considered health care operations. Before conducting these activities, however, the hospital must state in its notice of information practices that it may use identifiable health information for the hospital's health care operations. If a hospital agrees to a restriction on its use of a patient's health information, any use of information for health care operations, including patient surveys, would be limited by that restriction. In addition, if a patient makes a request for "confidential communications," for example, specifying how or where the hospital may contact the patient, the hospital must accommodate any reasonable request. Finally, state laws may limit the use of identifiable health information for these purposes. A hospital may hire a vendor to conduct the surveys on the hospital's behalf pursuant to a business associate agreement under HIPAA.