Surcharge Eliminated for Cosmetic Procedures
Digest, Spring 2013
At its May meeting, the OMIC Board of Directors voted to eliminate the premium surcharge for ophthalmologists who perform facelift, rhinoplasty, and full body liposuction for policies effective on or after May 1, 2013. The decision was based upon favorable underwriting and claims data tracked by OMIC since the company first approved coverage for these procedures over 15 years ago.
During a recent retrospective review of OMIC-specific and industry-wide claims data, it became evident that the risk exposure for these cosmetic procedures was lower than expected and that OMIC’s experience outperformed that of the industry. Only one claim and two incidents involving facelift procedures have been reported to OMIC since 1997. All three were resolved without indemnity and total expenses paid were $698. Two claims involving liposuction were reported against OMIC-insured physicians. One closed without indemnity and the other settled for $150,000. Expenses for the two claims totaled $24,715. A third claim involving liposuction was brought against an OMIC-insured surgery center for a procedure performed by an open-access member. No rhinoplasty claims have been reported to OMIC to date.
Cosmetic surgery has become safer in the past decade thanks to new “minimally-invasive,” “non-invasive,” or “non-surgical” techniques that carry significantly less risk than more traditional techniques. Continuing medical education courses have given ophthalmologists desiring to add these procedures to their practice the skills and training necessary to do so successfully.
Elimination of the surcharge means that ophthalmologists who perform facelift, rhinoplasty, and total body liposuction will now pay the same rate for professional liability coverage through OMIC as their colleagues who limit their surgery to traditional ophthalmic procedures. This rate is far below what a plastic surgeon, otolaryngologist, or other specialist must pay for similar coverage.
Message from the Chairman addresses elimination of surcharge for facelift, rhinoplasty, and full body liposuction
Digest, Spring 2013
The story of how OMIC arrived at the decision to eliminate the surcharge for ophthalmologists who perform facelift, rhinoplasty, and full body liposuction (see Eye on OMIC) tells us much about how the company balances the risk of providing coverage for procedures ophthalmologists perform with rates the company must charge to cover that risk. The assessment is difficult for many reasons, the primary one being the need to determine the risk of a given procedure or group of procedures. In assessing risk, one must take into account underwriting guidelines the company uses to determine for whom it will provide coverage. If untrained or poorly trained physicians are allowed coverage, the risk—and therefore the rates—will be high. If the company underwrites physicians who are well trained and who meet acceptable standards of practice, the rates may be lower as long as claims remain at an acceptable level.
Fifteen years have passed since the OMIC Board responded to requests by ophthalmologists to provide coverage for total body liposuction and full facelifts for cosmetic reasons. Initially, OMIC had difficulty setting rates for these procedures because claims data was lacking, and there were no proven underwriting criteria that allowed staff to determine who should be insured. Accordingly, premiums were based on average rates charged by other carriers for cosmetic procedures. OMIC selected a 200% surcharge for coverage of full facelifts and a 160% surcharge for coverage of liposuction. Staff immediately developed underwriting criteria and simultaneously began monitoring claims and tracking incident reports for these procedures. This information was reviewed periodically. Over time, the data confirmed that OMIC’s experience was sufficiently favorable that a rate reduction to 150% of basic premium (i.e., a 50% surcharge) could be adopted. This rate went into effect in 2006. Coverage for rhinoplasty, subject to review and approval of a supplemental questionnaire, adherence to underwriting requirements, and payment of the 50% cosmetic surcharge, was added in late 2008.
OMIC’s conservative approach to underwriting and strong claims performance compared to its peer companies has allowed OMIC to provide coverage for members of the American Academy of Ophthalmology at competitive rates and to embrace new procedures as ophthalmologists begin to perform them. PRK, LASIK, refractive lens exchange, Intacs, facelifts, rhinoplasty, and total body liposuction are examples of procedures OMIC covers at standard rates without surcharge. Elimination of the surcharge means a significant rate reduction for ophthalmologists who perform these procedures. This is good news for those now insured by OMIC and those considering a switch to OMIC and demonstrates how OMIC works on behalf of Academy members to provide coverage at reasonable rates for the work ophthalmologists are doing.
John W. Shore, MD, Chairman of the Board
Breach Notification: How OMIC Can Help You
Kimberly Wynkoop, OMIC Legal Counsel
Digest, V23 N3 2013
As explained in the lead article (HIPAA Omnibus Final Rule What To Do), HIPAA requires that covered entities (“CEs”) notify individuals whose unsecured protected health information (“PHI”) has been impermissibly accessed, acquired, used, or disclosed, compromising the security or privacy of the PHI. Such notice must be given unless the CE can show there is a “low probability” that PHI has actually been compromised. If notification is required, HIPAA sets forth the manner and timing for doing so. This process can be daunting and expensive. To assist our insureds, OMIC’s policy includes an additional benefit: Security and Privacy Breach Response Costs, Notification Expense, and Support and Credit Monitoring Expense Coverage. This article will explain ophthalmologists’ breach response and notification responsibilities and the assistance OMIC’s benefit provides.
Notice to individuals
The CE should have a standard breach notification letter written in plain language that includes all of the HIPAA required elements (see OMIC’s sample at http://www.omic.com/hipaahitech-resources/). The CE must modify this letter and send it out to all affected individuals. This letter should be sent by first-class mail to the last known address of the individual or, if the individual has agreed to electronic notice, by email. If there is insufficient or out-of-date contact information that precludes mail or email notice, a substitute form of notice must be provided. For fewer than 10 individuals, the substitute notice may be provided by an alternative form of written notice, by telephone, or by other means. For 10 or more individuals, the substitute notice must be in the form of either a conspicuous posting for 90 days on the CE’s website, or a conspicuous notice in major print or broadcast media where the affected individuals likely reside. The notice must include a toll-free number that remains active for at least 90 days where an individual can learn whether his or her PHI was included in the breach. Notice to affected individuals must be made without unreasonable delay and in no case later than 60 calendar days after the discovery of the breach. If the CE determines that notification requires urgency because of possible imminent misuse of unsecured PHI, notification may be provided by telephone or other means, as appropriate, in addition to the methods outlined above. It is the responsibility of the CE to demonstrate that all notifications were made as required, including evidence demonstrating the necessity of any delay.
Notice to HHS
In the event a breach of unsecured PHI affects 500 or more individuals, HHS must be notified at the same time notice is made to the affected individuals, in the matter specified on the HHS website. If fewer than 500 of the CE’s patients are affected, the CE must maintain a log of the breaches to be submitted annually to the Secretary of HHS no later than 60 days after the end of each calendar year.
Notice to the media
In the event the breach affects more than 500 residents of a state, prominent media outlets serving the state and regional area must be notified without unreasonable delay and in no case later than 60 calendar days after the discovery of the breach. The notice must be provided in the form of a press release. If a law enforcement official states to the CE that notice would impede a criminal investigation or cause damage to national security, the CE must delay the notice for the time period specified by the official in writing, or, if not in writing, no longer than 30 days from the date of the oral statement. This applies to notices made to individuals, the media, and HHS.
OMIC’s coverage
In response to a security or privacy breach, OMIC will pay for the employment of a public relations consultant to avert damage to the reputation of an insured resulting from an unexpected report about the breach through any media channel if that report threatens to damage an insured’s reputation. OMIC will also pay the expense to comply with governmental privacy legislation mandating notification to affected individuals, including legal expenses, computer forensic fees, public relations expenses, postage expenses, and related advertising expenses. OMIC also pays the expenses for the provision of customer support in the event of a privacy breach, including credit file monitoring services and identity theft assistance for up to 12 months. OMIC must give prior written consent for any of these expenses to be paid. The maximum amount OMIC will pay is $50,000. If you have questions about these policy benefits, please call OMIC’s Underwriting Department at 800.562.6642, ext. 639. If you need to take advantage of this benefit, contact OMIC’s Claims Department at ext. 629.
Breach Letter: Required Components
• A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.
• A description of the types of unsecured PHI that were involved in the breach (e.g. full name, SSN, DOB, address, account number, diagnosis).
• Any steps the individuals should take to protect themselves from potential harm resulting from the breach.
• A brief description of what the CE is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches.
• Contact procedures for affected individuals, including a toll-free number, email address, website, or postal address.
Additional Benefits: Broad Regulatory and e-MD Protection
Kimberly Wynkoop, OMIC Legal Counsel
Digest, Spring 2013
OMIC is pleased to announce that the Broad Regulatory Protection and e-MD Protection coverages provided in OMIC’s Professional and Limited Office Premises Liability Insurance policy have been enhanced for 2013 at no additional charge. This article is a summary; for a complete review of your coverage, please refer to the OMIC policy.
Peer review coverage
OMIC’s Broad Regulatory Protection (BRP) reimburses insureds for legal expenses relating to regulatory proceedings, which include billing errors, DEA, EMTALA, HIPAA, covered licensing, and STARK proceedings. BRP also covers fines or penalties related to billing errors, EMTALA, HIPAA, and STARK proceedings. While OMIC’s policy already covered actions by regulatory agencies and state licensing authorities under its Disciplinary Proceeding Protection and BRP, in 2013, it added peer review bodies to the list. Under BRP, OMIC now reimburses legal expenses for professional review actions by the review body of a hospital or other health care facility that could adversely affect the insured’s clinical privileges there.
e-MD additions
As insureds continue to move more of their records, communications, and marketing online, coverage for cyber liability risks becomes more crucial. OMIC’s e-MD Protection now provides seven different coverages. One of the 2013 additions is Multimedia Liability Coverage. It covers claims made against the insured for the display of any electronic or print media by the insured that directly results in defamation, invasion of privacy, plagiarism, or copyright infringement.
Another new coverage is Network Asset Protection. It covers digital assets loss, that is, the expenses necessary to restore or replace the insured’s damaged or stolen data and computer programs, because of accidental damage, operational mistakes, or a computer crime that an insured failed to prevent. It also covers the insured’s income loss and interruption expenses incurred during the time it takes to restore these digital assets.
e-MD Protection now also includes Cyber Extortion and Cyber Terrorism Coverages. Under Cyber Extortion Coverage, OMIC pays money to stop the person responsible from executing a credible threat to release confidential information or corrupt the insured’s computer system. Cyber Terrorism Coverage pays income loss and interruption expenses during a period of restoration of the insured’s computer system required because of an act of terrorism.
e-MD enhancements
While the following provisions are not new, they have been enhanced. The e-MD Security and Privacy Liability Coverage covers claims made against the insured for security and privacy wrongful acts. The Security and Privacy Regulatory Defense and Penalties Coverage covers legal expenses and regulatory fines, penalties, or compensatory awards the insured must pay because of such acts. Many acts fall within the definition of security and privacy wrongful acts. For example, a security and privacy wrongful act occurs if an insured fails to prevent unauthorized access to or infection of the insured’s computer system (a “security breach”) that results in destruction of electronic data stored on the insured’s computer system, unauthorized disclosure of confidential information that is in the insured’s care, or unauthorized access to a computer system other than the insured’s. The insured’s failure to prevent the transmission of computer viruses from the insured’s to a third party’s computer system is also a security and privacy wrongful act. A privacy breach, i.e., a breach of confidence, a violation of rights to privacy, or a violation of laws associated with the control of personally identifiable financial or medical information, also constitutes a security and privacy wrongful act.
The Security and Privacy Breach Response Costs, Notification Expense, and Support and Credit Monitoring Expense Coverage now covers the cost of employing a public relations consultant to mitigate damage to the insured’s reputation due to a publicized report of a privacy or security breach. It also covers the expenses of notifying affected individuals in the event of such a breach. Finally, it pays for the provision of customer support in the event of a privacy breach, including credit file monitoring and identity theft assistance.
The BRP and e-MD per proceeding/claim and aggregate limit is $50,000. The BRP and e-MD Protection coverages also include a two year extended reporting period if the insured acquires tail coverage for the policy. If you have questions about these policy benefits, please call 800.562.6642, ext. 661. If you need to report a proceeding or claim, contact OMIC’s Claims Department at 800.562.6642, ext. 672.
Refused Care Coverage and Minor Refusal
Kimberly Wynkoop, OMIC Legal Counsel
Digest, Winter 2013
As the lead article addresses, there are situations where patients refuse care, their vision is adversely affected, and then they sue their ophthalmologist for failing to treat them. Rest assured that OMIC’s policy provides coverage for such allegations. OMIC promises to defend ophthalmologists and pay damages because of claims that result from injury to a patient because of a “professional services incident” arising from “direct patient treatment.” The policy defines direct patient treatment as the provision of health care services to a patient, including making diagnoses, providing medical or surgical treatment, prescribing or dispensing drugs or medical supplies or devices, rendering opinions to a patient, giving advice to a patient, or referring a patient to, or consulting about a patient with, another physician or health care provider. A professional services incident is any act, error, or omission, that is neither intended nor expected in the provision of, or the failure to provide, direct patient treatment. Coverage for omissions and failure to provide direct patient treatment is an important component of your professional liability coverage, as failure to treat can be the alleged breach of duty that triggers a negligence claim.
Minor refusal of care
Adult patients have the legal right to refuse recommended care as long as they have decision-making capacity. Minor patients, on the other hand, lacking the necessary experience, knowledge, and maturity, are generally considered incompetent to make their own decisions and are not granted the legal authority to consent to or refuse care. Legal decision-making authority is generally achieved only when an individual reaches the age of majority, 18 years of age (or after high school graduation if later) in all but four states. There are two traditional categories of exceptions to the age of majority requirement for consent: individual status and medical service. Minor patients whose status indicates that they function as adults are granted the right to consent to or refuse treatment. Such status exceptions, which vary by state, include marriage, being a parent of a child, active duty with the Armed Forces, and court ordered emancipation. Another status exception, recognized in California, is self-sufficiency: when a minor is 15 years of age or older, lives away from home, and manages his or her own financial affairs. Service exceptions occur when minors seek specific treatment for certain medical conditions, such as pregnancy, mental health problems, alcohol or drug dependency, or infectious diseases. The rationale for such exceptions is that minors will be more likely to seek treatment for sensitive health issues if they are not required to notify their parents.
Mature minor doctrine
While courts and legislators have struggled with the issue of when to permit minors to legally consent to medical treatment, they have had even more difficulty when the medical decision-making at issue is refused care. Cases often involving refused care have led to the development of the third exception to the majority requirement for consent, the “mature minor” doctrine. This doctrine recognizes that some minors are mature enough to evaluate treatment options and make their own decisions. Courts look at individual circumstances and factors including the minor’s age, behavior, education, competence, and knowledge. They must weigh the state’s rights and responsibilities to preserve the life of a minor and maintain the ethical integrity of the medical profession, the minor’s rights to autonomy and privacy (and, in some cases, religious freedom), and, if the parents’ wishes conflict with the child’s, the rights of the parents to make decisions for their children. The doctrine lacks clear principles for application, however, and varies from state to state (with many states having not addressed the issue yet and at least one state, Georgia, specifically refusing to apply the doctrine). For example, in Illinois, a mature minor can refuse medical treatment unless such refusal would threaten the child’s health or welfare, while Virginia (by legislation) permits a minor 14 years or older to refuse, with parental acquiescence, medical treatment even for a life-threatening disease. Not all state laws are clear on consent and refusal of care and physicians often have to make decisions before getting a court order or legal determination. Therefore, even if minors have the authority to consent to treatment, it is prudent, with the patient’s permission, to involve the parents in the discussion. Likewise, in cases where minors do not legally have decision-making authority (e.g., for most ophthalmic treatment), it is recommended that ophthalmologists obtain minor assent in addition to parental consent for or refusal of treatment. Insureds are encouraged to seek risk management advice on refusal of care through OMIC’s confidential risk management hotline at 800. 562.6642, option 4, or by email at riskmanagement@omic.com.
