Practical Application of HIPAA Privacy Rules (Part 2)
Kimberly Wittchow, JD, OMIC Staff Attorney
Digest, Spring 2003
The compliance deadline of April 14, 2003 is behind us, yet many OMIC insureds continue to grapple with certain provisions of the HIPAA Privacy Rules. For this reason, the Risk Management Hotline will again tackle a sampling of the latest HIPAA queries. Remember that if you are not a Covered Entity as defined under HIPAA, these federal mandates do not directly apply to you.
Q Can I release information to persons within a patient’s circle of care without a written authorization?
A Yes. You must, however, provide the patient with an opportunity to agree or object to this disclosure. If the patient is present, the easiest way to do this is to get the patient’s oral permission before sharing protected health information (PHI). If the patient is not present or communication with the patient is impossible, you may in the exercise of professional judgment determine whether the disclosure is in the best interest of the individual and if so, disclose only the information directly relevant to the person’s involvement with the patient’s care. It is advisable to document these oral agreements or professional judgments to disclose.
Q Can patients request restrictions on the use or disclosure of their protected health information?
A Yes. Patients have the right to ask for restrictions in the use or disclosure of their PHI, but you are under no obligation to agree. However, if you do agree with the restrictions, you must comply with them. You also must accommodate patients’ reasonable requests to receive communications of PHI by alternative means, such as sending all communications in a closed envelope rather than on a post card.
Q Is the Notice of Privacy Practices the only policy document my practice needs?
A No. The Rules additionally require that you have written privacy procedures addressing which staff has access to PHI, how PHI will be used, and when PHI may be disclosed. OMIC’s Sample Compliance Plan* is both a template and a guide for creating your own privacy plan. In addition, you must designate a Privacy Officer, train your employees, and take appropriate disciplinary action if you learn of a breach.
Q Are fellow health care providers my Business Associates?
A A Business Associate Agreement is not required when you disclose PHI to another health care provider for treatment of a patient. However, you and another health care provider may be business associates for some other purpose. For example, a hospital might hire you to help train medical students, in which case the hospital would have to obtain an Agreement from you before allowing you access to patient information.
Q Will the government actually enforce the HIPAA Privacy Rules?
A In an April 14, 2003 press release, HHS stated that enforcement will be primarily complaint driven. The Office of Civil Rights (OCR) intends to investigate complaints and ensure that the privacy rights of consumers are protected. OCR may impose civil monetary penalties of $100 per failure to comply. The Department of Justice may prosecute criminal violations with fines ranging from $50,000 to $250,000 and prison terms ranging from one to ten years.
Q Does HIPAA address eye banks?
A Yes. The Privacy Rules permit you to disclose PHI without authorization to eye banks for the purpose of facilitating cadaveric eye donation and transplantation. Furthermore, the procurement or banking of eyes is not considered health care under the Rules and the organizations that perform such activities are not considered health care providers or Covered Entities when conducting these functions.
Q Who are patients’ personal representatives and what information can I share with them?
A HIPAA requires that you treat an individual’s personal representative as the individual with respect to privacy rights. The scope of the personal representative’s authority to act for the individual derives from applicable (generally state) law. Parents have broad authority to act on behalf of their children and legal guardians generally have broad authority to act on behalf of mentally incompetent adults. Conversely, someone with a limited health care power of attorney is that individual’s personal representative only with respect to certain health care decisions.
Informing Patients About Your Surgical Experience
By Anne M. Menke, RN, PhD OMIC Risk Manager
Digest, Spring 2004
More than many specialties, ophthalmology evolves rapidly through the development of new procedures, techniques, and devices. While each innovation holds the promise of improved outcomes for the patient, it also introduces new areas of risk as ophthalmologists and their staff learn to incorporate the changes into their practice. OMIC policyholders often call the Risk Management Department to ask if and how they should talk to their patients about their training and experience.
Q The ambulatory surgery center (ASC) where I perform cataract surgery switched phacoemulsification machines over the objections of many ophthalmologists. While I have completed the training course offered by the manufacturer, I have not yet used the new machine on my own patients. Do I have a legal duty to tell my patients?
A Ophthalmologists are aware of their legal and ethical duty to obtain the patient’s informed consent for surgery. The surgeon discharges this duty by personally discussing the indications, risks, benefits, alternatives, and known complications with the patient, who orally agrees to proceed with the planned procedure. The discussion and agreement are then documented by noting the discussion in the medical record and by asking the patient to sign a consent form.
As we state in OMIC’s new online course, Informed Consent for Ophthal- mologists, there is a small body of emerging case law governing situations where a surgeon isn’t truthful about his or her training and experience, particularly as it relates to board certification and/or experience per- forming a particular procedure. If a patient is injured as a result of a surgical procedure, some courts have effectively “thrown out” the consent form if it is later proved that the surgeon, when asked, knowingly misstated his or her skill, training, certification, and/or experience. Thus, the ethical considerations of lying to the patient during the consent process could conceivably pose serious legal consequences. There is no clear consensus, from a legal standpoint, about whether or not the physician has a duty to offer this information.
Q What are the consequences of not telling the patient about my experience?
A Learning about a surgeon’s lim- ited experience after a poor outcome or complication could seriously compromise the physician-patient relationship. The ensuing lack of trust in the physician could also hinder the provision of care needed to treat the complication. Patients may feel betrayed or worry that the physi-cian was experimenting on them. The resultant anger could well prompt a lawsuit for malpractice and lack of informed consent. The patient would likely allege that the surgeon’s level of expertise would have made a difference in the decision to undergo surgery, and his or her attorney would argue that a “reasonable person” would have considered this information “a material fact” that should have been disclosed.
Q I believe I have an ethical duty to disclose my training and experience, but I am not sure how to proceed. What do you recommend?
A Simply provide the facts about your training and experience as they relate to the particular procedure. In the example given here, while explaining the role of the phacoemulsification machine in the lens extraction, inform the patient that the ASC has recently changed machines. Disclose your overall experience with cataract surgery as well as your recent training on this machine. If certain complications are more likely to occur with the new machine or during your learning curve, tell the patient what they are and how you will manage them if they do. If the patient is not comfortable proceeding, help him or her find alternative sources of care. Regardless of how you feel about the ASC’s decision, do not share your criticisms with the patient. Instead, address your concerns to the appropriate leader on the medical staff.
Q Should I tell a patient that I am using a newly approved IOL such as the Crystalens?
A It would be prudent to do so. As part of your discussion of the risks, benefits, and alternatives to this IOL, explain why in your professional judgment it is the best one for this particular patient. If you are relatively inexperienced in inserting it, consider explaining that as described above. Patients appreciate knowing the financial implications of your choices, so inform them of any known health insurance or payment issues. As with any new device or procedure, be sure to inform the patient if long-term outcomes are not yet known and explain that there may be unforeseen complications. If you are using the device in an off-label manner, the patient should be so informed.
For more information about informed consent, see OMIC’s online course or the following online articles, “Practicing Beyond One’s Expertise: The Road to a Lawsuit” and “New Surgical Advances Come with Liability Risks.”
Refunds, Fee Waivers and Payments
Anne M. Menke, RN, PhD, OMIC Risk Manager
Digest, Spring 2007
Patients who are not satisfied with their care outcome may refuse to pay their bill, request a refund, or ask for money for subsequent care. OMIC policyholders have many questions about the consequences of saying yes to these requests. Similarly, there are times when a physician would like to offer monetary support. This column gives a general overview of providing financial support to patients out of a physician’s corporate or personal funds. Prior to taking any action in this regard, please call OMIC’s Risk Management Hotline at (800) 562-6642, option 4, for individual assistance. Physicians who have received a written request for money or are notified of a lawsuit should call the Claims Department at ext. 629.
Q When I’m not able to help my patient understand and accept an outcome, I would like to have the option of refunding or waiving my own fees, or paying for a second opinion or care from another ophthalmologist. If I do any of these, am I admitting liability?
A Merely refunding or waiving fees or offering to pay for subsequent care is not an admission of liability unless you tell the patient that your care caused the outcome. If you feel you are responsible and would like to discuss this with the patient, please consult with OMIC first, both to comply with the cooperation clause of your policy and so that we can assist you in preparing for the discussion. Those providing support for other reasons are also encouraged to call us. After a thorough discussion of surrounding facts and circumstances, we may suggest using neutral language to explain the offer; for example, “I want all of my patients to be happy with their experience here. Since I haven’t met your expectations, I would like to offer to waive/reduce/refund fees, pay for a second opinion, etc.”
Q Will offering monetary support dissuade my patient from suing me?
A Not necessarily. Some patients accept such offers with gratitude, and continue to seek care from you. Others may conclude—regardless of what you say or do—that your generosity is “proof” that you did something wrong and proceed to consult with a medical malpractice attorney. You know your patients and are in the best position to decide how they might respond, and whether you would like to make such an offer.
Q Can I waive the patient’s co-payment or deductible?
A Contracts with third-party payers (including Medicare) usually require that you collect co-pays and deductibles at the time of service, and they may limit your ability to waive or refund fees. Some plans allow a physician to waive a co-pay or deductible only after a patient has demonstrated financial need and to refund such payments only if the physician also refunds any fees paid by the third-party payer. It is important to review contracts and follow their provisions since you may be subject to allegations of insurance fraud or abuse if you violate them.
Q What types of monetary support do I have to report?
A Some reporting requirements differentiate monetary support given on the physician’s own initiative or in response to an oral demand from money paid in response to a written request, claim, or lawsuit. Reporting to the National Practitioner Data Bank, for example, is only required if (1) there is “a written complaint or claim based on a physician’s … provision of or failure to provide health care services” and (2) the payment is made by a business or corporate entity, including a business entity comprised of a solo practitioner (45 C.F.R. § 60.3). Payments in response to oral requests, fee waivers (when no money has changed hands), or those paid for out of personal funds are not reportable. State laws vary, so it is important to check what is required by speaking with OMIC and contacting your state medical board.
Q Should I ask the patient to sign an indemnity release in exchange for a fee waiver, refund, or payment?
A The answer will depend upon the particular patient and situation. Some patients readily agree, while others may become angry or feel you wouldn’t ask if you hadn’t been negligent. You should contact OMIC’s Claims Department if you want the patient to sign a release, as these must comply with state law and require the assistance of an attorney. For additional information, please download the document “Responding to unanticipated Outcomes” from the Risk Management Recommendations section of our web site, order the CD of the same name, or take this course online.
Medical Record Requests
Hans Bruhn, MHS, OMIC Senior Risk Management Specialist
Digest, Fall 2007
Medical record requests (MRR) are made for various business reasons (e.g., billing matters) as well as for ongoing patient care (e.g., referral to another physician or specialist). These requests require written authorization from the patient. The only exceptions to this rule involve requests pursuant to subpoenas, search warrants, or court orders, and certain mandatory reporting obligations where the law expressly allows for disclosure within the physician’s discretion.
Sometimes, an MRR is the first indication that a patient is dissatisfied with the treatment rendered and intends to file a lawsuit. This issue’s Closed Claim Study demonstrates that the medical record is an important defense against allegations of improper consent or poor overall management of care and underscores the need to respond carefully to an MRR.
Q My practice regularly receives requests for medical records from various parties (patients, attorneys, etc.). Do I have to release the patient’s records to anyone he or she designates?
A Yes, but each request for medical information should be evaluated carefully. Federal and state laws and regulations clearly specify that patients have the right to decide who has access to their medical information. HIPAA is the primary source for federal regulations on access to medical information and your state medical society can provide you with state requirements. Physicians should only release a patient’s medical information upon receipt of written authorization from the patient or the patient’s legal representative. The written request should meet HIPAA standards. (see www.omic.com for a sample medical record authorization.)
Q Should I designate a specific person in my practice to respond to these requests?
A Yes, in order to ensure that an MRR is handled properly, only authorized staff members in a physician’s practice should handle these requests. A written procedure should be developed for the practice and reviewed regularly with staff so it is clear who is authorized to handle these information requests. Be sure that these designated staff members are familiar with access laws and regulations as well as what can or cannot be done in the process of preparing a file for release to another party. For example, no “clarifying” remarks or statements should be added to the records prior to release. While these comments may be well intentioned, they will invariably furnish plaintiff attorneys with an opportunity to question the motive, and potentially damage the defensibility of your care. Of course, alteration of records is illegal and should never be done. If you feel that clarifying statements are needed, a separate file should be created. This is the appropriate place for statements clarifying chart entries, elaborations on your customs and practices for treatment, and recollections of your decision-making process. If a formal claim is made, your defense attorney may find this information helpful.
Q Can I release the “original” medical record?
A While a patient is given authority to control access to his or her medical information, the physician or surgical facility retains ownership of the record. Therefore, a physician should never release original records to a patient, a patient’s representative, or any other third party. Copies or a summary of treatment should be provided instead. Original medical records should only be released in appropriate instances (e.g., valid search warrant, court order, or subpoena). Contact OMIC’s Risk Management Hotline at (800) 562-6642, ext. 651 or 662, if you are unsure whether original documents or copies should be released, or if you have other questions related to record releases.
Q Do I need to release records we have received from other physicians? How about letters from the patient and billing records?
A Yes, anything related to patient care and treatment is considered part of the medical record, and should be released unless the authorization specifies more limited information. For additional information on confidentiality, see “Confidentiality/Privacy issues and Malpractice Claims” in the Risk Management Recommendations section of www.omic.com.
What May I Safely Delegate?
Anne M. Menke, RN, PhD, OMIC Risk Manager
Digest, Spring 2009
The “practice of medicine” is defined in each state’s medical practice act and clarified in regulations. Sometimes, even after researching state laws and regulations, you may not be sure of what medical tasks you may delegate to non-physicians. The official curriculum provided at the school where the employee trained is a good indication of normal scope of services or practice of that employee. However, state law may preempt those qualifications or experience if the employee trained out of state. use the training, licensure/certification process, state law, and the principles discussed in this article to develop protocols that will keep you, your patients, and your staff safe, and improve the defensibility of care rendered under your supervision.
Q What distinguishes a cosmetic procedure from a medical procedure?
A Are estheticians (skin care therapists) trained to perform this procedure in esthetician schools? May they perform the procedure in a salon that has no affiliation with a physician? If the answer to both questions is yes, the treatment is probably a cosmetic one with few or minimal patient safety risks. On the other hand, if the device needed to perform the procedure may only be purchased by a medical doctor (MD) or doctor of osteopathy (DO), or if the product is labeled as a drug by the FDA, the treatment is a medical one with risks that must be disclosed, recognized, and mitigated. If not performed by a physician, it must be ordered, delegated, and supervised by a physician.
Q May I delegate prescriptive authority to my staff?
A Each state limits the ability to write prescriptions to certain licensed health care personnel and provides a “sliding scale” of authority. MDs and DOs are at the top of the scale; with the proper Drug Enforcement Agency (DEA) approval for controlled substances, they have unlimited prescriptive authority to order FDA-approved drugs and devices. All other licensed health care providers have restrictions. Others with prescriptive authority and likely to be in an ophthalmology practice include physician assistants and nurse practitioners. They may prescribe only medications normally used by their supervising physician that are also listed in the formulary that comprises part of the standardized protocols directing their actions. If the standardized protocol addresses drugs such as injectables, and the drugs are in the formulary, physician assistants and nurse practitioners may prescribe and administer them, as well as supervise staff who are qualified to administer them. In some states, optometrists with special training and licensure have limited prescriptive authority, but it would not include these drugs and devices. While registered nurses are licensed, they have no prescriptive authority. Like unlicensed ophthalmic personnel, their role is limited to implementing orders or transmitting them to a pharmacy or health care facility. In offices with no physician assistant or nurse practitioner, therefore, only an ophthalmologist may prescribe drugs such as injectables.
Q Who may determine if a patient is a candidate for a medical procedure?
A It takes considerable knowledge and judgment to determine the cause of presenting complaints, what if any treatment is indicated, and whether the findings from the patients’ history or examination signal increased risk or constitute contraindications. In other words, assessing patients to determine treatment is the practice of medicine. Registered nurses are trained in nursing school and then licensed to perform assessments of patient conditions, interpret orders and test results, implement treatment orders, and make ongoing decisions about how to modify procedures as needed based upon the patient’s condition. Nearly all states also have legal mechanisms for registered nurses to perform tasks that are considered the practice of medicine, such as Botox injections and some types of laser surgery. With sufficient training and the appropriate standardized protocols that delineate indications, contraindications, treatments, and consultation requirements, registered nurses may usually elicit the history, perform the initial examination, and discuss a proposed course of treatment with the patient as a prelude to presenting their recommendations to the supervising physician. If the physician approves the patient’s candidacy and orders the treatment or series of treatments, the registered nurse may implement the order.
Q What may I delegate to unlicensed ophthalmic personnel?
A Does the state’s medical practice act define laser procedures as the practice of medicine or surgery? Does performing the procedure require the staff member to assess the patient’s condition or make modifications from one patient to the next? If the answer to either of these questions is yes, the procedure is best performed by a licensed health care staff member. Did the school at which the staff member studied include the procedure in the official curriculum? Is the procedure included in the tasks for which the staff member can receive JCAHCO certification? If yes, then it is probably safe to delegate the task and supervise the unlicensed staff member if you or another ophthalmologist determines candidacy and orders the treatment for the specific patient each time it is administered.
