Minimize the Risks of Patient Co-Management in Managed Care Plans

[Digest, Fall, 1994]

The role of an ophthalmologist within the managed care system is usually that of a secondary provider. According to the managed care contract, the primary care physician (PCP) is the gatekeeper and is responsible for referring the patient to secondary providers. Utilization protocols of the plan may be in place limiting the ophthalmologist’s ability to directly refer patients to other providers. The following scenario is an example of how problems can develop within this type of system.

Retinal Detachment in a Referred Patient

It is Friday afternoon and an ophthalmologist sees a patient who has been referred for flashers, floaters, and an inferonasal veil O.D. The ophthalmologist contacts the patient’s PCP to request a referral to a particular retinal specialist. The PCP agrees; however, according to the plan contract, the PCP has to see the patient before the referral can be made. The patient is sent back to the PCP’s office. The ophthalmologist calls the retinal specialist at home and gives him a complete description of the patient’s partial detachment.

Meanwhile, the PCP’s secretary calls the retinal specialist’s office and is told that the doctor has left for the day and will return on Monday. Unaware of the urgency of the situation, the PCP’s secretary makes an appointment for the patient on Monday. The ophthalmologist is not informed of the delay in treatment, and the patient suffers a complete detachment the next day.

Referral Form Could Avert Treatment Delay

The referral policies of some managed care organizations create needless bottlenecks, which greatly increase the possibility that a patient will not be seen and effectively treated by the proper health care provider in a timely manner.

A referral note to the patient stating the urgency of the referral might have avoided the delay in treatment and subsequent retinal detachment suffered by the patient in this scenario. (See sample referral note on next page.) A referral note should be printed on NCR paper; the original should be given to the patient and a copy put in the patient’s chart. In addition to communicating information such as the name and phone number of the proper health care provider, the referral note should instruct the patient to contact the referring physician if the appointment is not made in a timely manner.

While it may be difficult in a managed care setting to ensure that patients are always seen and treated in a timely manner, using a referral note shows the secondary provider was concerned enough to take that extra step on behalf of the patient.

Referral Form for Managed Care Patients

Date _________________

Dr. ____________________ has referred you to Dr. ______________________

Phone ______________________________

This referral is:

___ Emergency

___ Urgent (24-48 hours)

___ Timely (1-2 weeks)

___ When convenient

This appointment will have to be made for you by your primary care physician, Dr. _____________________________, who has been notified. If there are any problems scheduling this appointment, please contact this office.

For office use only:

Outcome ___________________________________

(Original to patient. Copy to chart.)

Pressure for Early Discharge? Case History Points to Physician Liability

By Kimberly A. Neely, MD, PhD

[Argus, March, 1995]

Physicians treating patients who require IV medications may be pressured by hospital administrators to discharge patients at the earliest possible time and to continue IV therapy at home. Early discharge and home management expose the patient and the physician to new risks and responsibilities, as illustrated in the following case history.

Endophthalmitis Resulting From Foreign Body

A 20-year-old woman was mowing her lawn and suddenly felt a foreign body in her left eye. She saw an ophthalmologist the next morning because her left eyelid was swollen shut and the eye had become painful. Examination revealed visual acuity in the left eye of hand motions, a corneal ring infiltrate, no hypopyon, and dense vitritis preventing examination of the posterior segment. B-scan ultrasonography revealed the retina was flat. Computed tomographic studies of the orbits revealed a linear metallic foreign body approximately 11mm long in the left globe. The diagnosis was endophthalmitis secondary to intraocular foreign body.

The patient was referred to a university hospital the same day where a vitreous biopsy followed by intravitreal injection of antibiotics was performed immediately. Computed tomography was repeated to better localize the foreign body. Pars plana vitrectomy was performed utilizing a temporary keratoprosthesis with autograft. At vitrectomy, the retina was found to be white, necrotic, and indistinguishable from the purulent vitreous. The eye was retained, but no vision was salvaged. Vitreous cultures grew Bacillus cereus.

The patient remained in the hospital postoperatively for IV antibiotic therapy. The utilization review team raised the issue of outpatient therapy 24 hours later. The physician believed the patient did not have the intellectual capacity to administer the IV antibiotics at home and wrote this on the hospital chart.

The home IV therapy company that contracted with the hospital and the patient’s insurance company was asked to evaluate the patient. The nurse who did the evaluation concurred with the physician’s assessment but believed the patient’s mother and another family member could learn to safely administer the medications. The physician did not object and specified the dosages of medications and duration of therapy to be given at home. The patient was discharged approximately 36 hours after her vitrectomy. The family members were to administer the midnight doses, and a home IV therapy nurse was to see the patient the next morning.

Early the next morning, the company’s nurse called the physician, reporting that at midnight the family had given the patient four doses of each of three different antibiotics, one of which was gentamicin. The physician instructed the nurse to confiscate the remaining medications and to send the patient back to the hospital immediately. She was readmitted and continued to receive IV antibiotics except for gentamicin. Fortunately, the patient had sustained no renal toxicity or ototoxicity and was discharged several days later on oral antibiotics.

Risk Management Issues That May Arise

If pressured by hospital administrators to discharge the patient early, the physician should thoroughly document the conditions requiring continued hospitalization to help reassure the utilization review team that the patient should remain in the hospital for valid (and reimbursable) reasons. When faced with administrative pressures, the physician must exert his or her best medical judgment.

Inability to safely continue the patient’s treatments at home is a valid reason for continued hospitalization, at least until skilled home nursing assistance can be arranged. The physician may disagree with hospital administrators or the home IV therapy company regarding the ability of the patient or the family to administer home therapy. He or she should document the reasons in the chart and refuse to discharge the patient until alternative solutions such as skilled home nursing assistance can be arranged. The physician must consider what is best for the patient and not compromise the patient’s safety.

The physician should become familiar with the services offered by the home IV therapy company, its system of evaluating the patients’ and families’ abilities to safely administer IV medications, and the extent of patient support and surveillance offered.

In this case, the decision that family members could give the midnight doses of antibiotics on their own proved to be a mistake. The patient was exposed to possible hazards of renal toxicity or ototoxicity, and the physician, who bears ultimate legal responsibility for the treatment, was exposed to a significant malpractice risk.

Risk Management Issues in the New Managed Care Environment

By Jerome W. Bettman Sr., MD, Byron H. Demorest, MD, and E. Randy Craven, MD

[Digest, Spring, 1996]

If the goal of managed care is to keep health care costs as low as possible, it follows that referrals to “expensive” specialists and costly laboratory and diagnostic radiographic tests will be kept to a minimum. Unfortunately, it also follows that patients who receive a hasty examination will go away angry and confused because their physician no longer has time to talk to them. Both situations encourage patients to seek the advice of an attorney when response to treatment is suboptimal.

Under capitated care plans, which pay the same overall fee per patient regardless of the services rendered, and reduced fee-for-service plans, which encourage physicians to see high volumes of patients, there are greater opportunities for mis-diagnosis, denial of treatment, and loss of doctor-patient rapport, all of which increase a physician’s exposure to malpractice claims. The following scenarios point out some of the health and liability risks raised when cost cutting takes priority over patient welfare:

• Ancillary medical personnel assuming patient care responsibilities beyond the scope of their training. Improper screening can delay timely and effective treatment for patients with sight-threatening problems, while inappropriate treatment can result in a poor therapeutic response.
• Primary care optometrists or physicians diagnosing and treating complex ocular problems, which may delay the correct diagnosis and treatment beyond the optimal time for referral to an ophthalmologist.
• Sharing responsibility for patient care between primary physicians and ophthalmologists or between optometrists and ophthalmologists. Under some plans, only one visit to the ophthalmologist may be authorized. If a patient’s ocular condition deteriorates while being followed by a primary physician and there is a poor outcome, any ensuing malpractice action is likely to name the ophthalmologist as well as the primary physician. Shared responsibility translates into shared and increased risk.
• Denial of care by the managed care organization, particularly for perceived nonemergency problems, leading to serious complications and visual debility.

Courts Define Physician’s Duty

What should a physician do if the elements of proper care are denied, whether in the form of denial of hospitalization, a shorter than optimal confinement, or refusal to use consultants or order certain diagnostic tests? A physician’s first duty is to the patient, not to an insurance company, HMO, or PPO. At the same time, over-utilization may result in a physician being dropped from a plan’s provider list. While physicians find themselves caught in the middle of these conflicting obligations, a series of court decisions has redefined the scope of a physician’s duty to the patient, as noted below.

Wickline v. State of California¹ – A Medi-Cal (California Medicaid program) patient was approved for a 10-day hospital stay for vascular surgery. The patient, a diabetic, developed post-surgical complications necessitating additional surgery. The patient’s physician and two surgeons filed the appropriate paperwork to request an eight-day extension from Medi-Cal, but only a four-day extension was approved. Although they disagreed with Medi-Cal’s decision, the physicians discharged Mrs. Wickline after the approved four-day extension. The patient subsequently lost her leg and sued. Stressing that the ultimate responsibility for medical decisions belongs to the physician, the court stated: “While we recognize, realistically, that cost consciousness has become a permanent feature of the health care system, it is essential that cost limitation programs not be permitted to corrupt medical judgment.” Interestingly, the court also stated that third party payers are responsible for defects in cost containment mechanisms, but a physician who does not protest on behalf of a patient cannot avoid ultimate responsibility.

Wilson v. Blue Cross² – A physician recommended extended hospitalization for a depressed suicidal drug abuser. When the HMO reviewer certified only three days additional hospitalization, the psychiatrist protested and carefully documented his protest as the patient was being discharged. The patient committed suicide and the family sued the Blue Cross utilization review group and won on appeal when the court accused the group of bad faith benefit denial. Unlike the Wickline case, which placed the burden of responsibility on the physician, in Wilson, the court made it clear that liability is shared by the HMO.

Fox v. Health Net of California³ – A patient with breast cancer won a $90 million jury award after she was denied treatment with high dose chemotherapy and an autologous bone marrow transplant. This case reinforced the fact that cost containment will not be tolerated by juries when it is based solely on corporate economic interests, and it asserted that medical denials must be black and white, not gray.

Hughes v. Blue Cross⁴ – The court found in favor of the family of a 21-year-old hospitalized schizophrenic patient after Blue Cross authorized only $6,500 in coverage toward payment of a hospital bill exceeding $23,000. The court stated that the utilization review was not based upon the standard of care and that Blue Cross was responsible for seeking all relevant information before denying a claim.

Physicians Obligated to Appeal Denial of Care

As these cases indicate, the courts will not allow a defense based upon cost containment whether it is at the hands of a physician or managed care organization. Economic constraints must not determine what should be done for the patient. When an HMO, PPO, or capitated group denies care, it is the physician’s duty to protest and attempt to change the decision. Verbally and in writing, the physician should clearly state the reasons for the recommended therapy, the consequences of denial, and provide supporting literature to demonstrate the standard of care. A copy of the letter should be sent to the patient and all protestations documented in the chart.

Since the Wickline decision, physicians are required under California Law to appeal a plan’s decision to deny care. Such appeals must be made carefully, as many agreements between physicians and the HMO include a so-called “gag rule” where the physician agrees not to criticize the HMO to the patient. In California, physicians who advocate for their patients are now legally protected from retaliation by health care organizations, and if a physician is dropped from a plan because of patient advocacy, damages may be recovered. Gag clauses are banned in Massachusetts, and legislative efforts are under way to eliminate them in other states, including California.

Additionally, so-called “hold harmless” clauses, which attempt to shift responsibility for economic harm or liability from one party to another, are no longer permitted in health care contracts in California,⁵ where both the physician and medical plan are held equally responsible for damages.

Interestingly, the legal profession has allied itself with physicians on the issue of securing proper care under managed care contracts. There have been many more claims brought against managed care organizations than the ones cited in this article. In Texas alone, there are 17 medical negligence cases in the courts naming an HMO as a defendant. In some cases, insurance companies and health maintenance organizations are settling out of court to avoid precedent-setting court decisions that will open the door to other claims involving significant financial loss. Several recent cases suggest that a financial compensation scheme may violate the standard of care. The following case is illustrative of this trend:

Bush v. Dake⁶ – An HMO that had eliminated PAP testing to reduce costs was sued by a woman who had clinical signs of cervical carcinoma. The patient sued her primary care physician, her gynecologist, and the HMO alleging that the HMO’s capitated gatekeeper arrangement violated the standard of care when it deferred referral for consultations and procurement of indicated laboratory procedures. The cost control provisions at issue included: (1) that participants were required to see a primary care physician before referral to a specialist could be made and (2) that a financial incentive system encouraged HMO physicians not to refer patients to specialists. Prior to trial, the court determined that the plaintiff offered sufficient evidence supporting an allegation that the cost control system had contributed to a delayed diagnosis of cervical cancer and inadequate treatment. The case quickly settled out of court under a protective order.

Clearly, an HMO is exposed to the risk of potentially enormous damages when a jury is confronted with testimony and evidence that an HMO’s “cost control measures” contributed to or caused a patient’s injury. In the Bush v. Dake case, the HMO probably believed an appeal would have risked setting a bad precedent and decided to settle out of court before matters got worse.

Risk Management Recommendations

Always act in the patient’s best interest. A physician’s duty is to the patient, not to the HMO. Adverse decisions and denial of care should be protested vigorously but honestly. Such protests should involve the patient and be carefully documented. If proper care is denied, help the patient find other avenues to secure treatment. Do not abandon the patient! Cost containment should never reduce a physician to substandard practice. Remember that in the courts, the “dollar defense” is no defense.

Notes:

1. Wickline v. State of California. 192 Cal App 3d 1630 (1986).
2. Wilson v. Blue Cross. 222 Cal App 3d 660 (1990).
3. Fox v. Health Net of California. California Superior Court, Riverside County, No. 219692.
4. Hughes v. Blue Cross. 215 Cal. App. 3d 832.
5. Prohibition of “Hold Harmless” clauses in Health Plans. California AB 1840.
6. Bush v. Dake. Michigan Circuit Court, Saginaw County, No. 86:25767-NM
   (April 27, 1989)

New Liability Exposures and Insurance Needs for Managed Health Care Providers

By Paul Weber, JD

[Digest, Spring, 1997]

Payors’ dependence on managed care organizations (MCOs) has grown rapidly in the past five years as the search continues for ways to slow or reverse rising health care costs. MCOs have evolved into many different forms, including health maintenance organizations (HMOs), preferred provider organizations (PPOs), individual practice associations (IPAs), and physician hospital organizations (PHOs). Although they differ in ownership and services provided, these organizations all attempt to lower costs by managing utilization of health care services and selecting and contracting with providers.

To remain viable in this new health care environment, many ophthalmologists are rapidly forming more sophisticated corporate entities and partnerships to provide services under managed care contracts. The individuals who serve as directors and officers of these entities and the entities themselves face liability exposures when administering managed care activities that are not typically covered under a standard malpractice insurance policy. The staff and employees of these groups also face new potential liability as they carry out and administer managed health care activities within these entities.

In response to these new liability exposures, many professional liability carriers, including OMIC, are adding coverage for Directors and Officers (D&O) Liability, Managed Health Care Errors and Omissions (E&O) Liability and Vicarious Medical Professional Liability.

D&O Liability

D&O insurance provides coverage for claims and lawsuits against the directors and officers of a corporate entity for wrongful acts in their capacity as such. A “wrongful act” is any actual or alleged breach of duty, neglect, misstatement or misleading statement, or other act or omission committed by directors and officers in the discharge of their corporate duties.

Common liability exposures faced by directors and officers that are covered under a D&O liability policy are:

• Corporate mismanagement. Shareholders bring an action on behalf of the insured corporation and seek to hold the directors and officers liable for financial loss due to corporate mismanagement.
• Wrongful termination. A former employee alleges she was terminated because of mental disability.
• Breach of duty, of loyalty and care, or fraud.Shareholders allege that directors and officers are liable for financial loss due to failure to detect and prevent embezzlement or self-approval of bonuses and loans.
• Misrepresentation of financial condition. Insurance regulators allege that the directors and officers misrepresented the financial condition of the corporation to induce new members.
• Unfair exclusion from provider network. A physician alleges that directors and officers failed to renew his provider agreement because of his age.

E&O Liability and Vicarious Medical Professional Liability

Managed health care E&O liability insurance generally covers organizations and their employees for specific tort liabilities associated with the managed care activities conducted by providers in a managed care setting.

Common liability exposures faced by managed care organizations or providers that are typically covered by a managed health care E&O policy are:

• Performance of utilization review. An enrollee holds an MCO liable for bodily injury and/or emotional distress after the MCO withholds pre-authorization of benefits for a glaucoma procedure.
• Performance of peer review. A patient holds an MCO liable for bodily injury allegedly resulting from the MCO’s failure to adequately investigate its healthcare providers.
• Vicarious liability for conduct of affiliated providers. An MCO is held vicariously liable by an enrollee for an employed or network ophthalmologist’s alleged negligence.
• Misrepresentation, unfair competition. A plaintiff alleges that an HMO solicited members through intentional misrepresentations in advertising about the quality of its care or scope of its benefits (e.g., ABC provides the best ophthalmic care in the Southwest).

These are new liability exposures faced by ophthalmic organizations as they carry out and administer managed health care activities within their entities. Unlike D&O insurance, E&O liability insurance can protect the organization as well as its employees, committee members, and medical directors from alleged errors, omissions, and breach of duties made in managed health care administration.

Managed Care Liability Claims

Although D&O and E&O policies provide coverage for claims arising from a number of different activities and operations, the majority of new liability exposures created by MCOs are associated with three activities: (1) employing or contracting with health care providers; (2) selection of providers; and (3) utilization review.

Managed care D&O and E&O claims typically are complex and involve many parties. Pinpointing “pure” managed care related claims is difficult because many claims that name directors and officers and MCO employees include allegations of personal injury, libel/slander, or breach of contract. As such, these claims can be very expensive and time consuming.

Unfair Exclusion from Provider Network

The following is an example of an MCO claim related to unfair exclusion from a provider network:

A corneal specialist, Dr. Smith, sued an ophthalmic-specific IPA, claiming that the IPA was operating under pressure to reduce utilization and excluded him from the IPA because he ordered too many diagnostic tests and made too many referrals to subspecialists. Dr. Smith alleged that the IPA defamed him and interfered with his ability to make a living after his termination by spreading rumors that he was senile, dysfunctional, incompetent, and no longer practicing.

The lawsuit against the IPA, its directors, and CEO included causes of action for termination of contract in violation of public policy, age discrimination, breach of contract, defamation, tortious interference with prospective economic advantage, blacklisting, and intentional and negligent infliction of emotional distress. It sought unspecified economic and punitive damages.

The IPA, which staffs the ophthalmic departments of two prestigious hospitals, denied Dr. Smith’s claims. The CEO refuted Dr. Smith’s allegations and stated that “Dr. Smith, like all physicians in the IPA, worked on the basis of annual contracts, renewable each year.” In light of the lawsuit, the CEO could not discuss the reasons for not renewing Dr. Smith’s contract.

The above scenario is based on an actual claim brought by a California pediatric gastroenterologist against a medical group. Although the specialties and corporate form are different, it is not hard to imagine such a claim being brought against an ophthalmic-specific group.

A physician’s exclusion from a program may trigger claims that economic or other concerns prompted the exclusion or wrongful termination from the program, resulting in a reduction in the physician’s potential patient market and earnings. In these cases, the peer review process can offer grounds for anticompetitive allegations, particularly if the peer review panel includes a competitor who may benefit financially from the denial of member status or removal of the physician from the panel. Given the need to include physicians practicing in the same specialty who can consider the quality of a physician’s care adequately, peer review panels provide fertile ground for these allegations. The risk is increased if a physician’s professional activities need improvement but are not grossly negligent.

Risk management tip: If a physician is to be excluded or removed from a panel, the MCO may wish to have an independent credentialing agency review the case and approve the proposed action. Concurrence of an independent agency improves the MCO’s defense against claims of antitrust or wrongful termination.

Vicarious Liability and Negligent Selection of Provider Claims

The following is an example of a claim brought by a patient-enrollee for vicarious liability and alleged negligent selection of a provider by an MCO:

An individual ophthalmologist and IPA are sued by the husband and child of a deceased patient who participated in an employer-sponsored health plan that directly contracted with the IPA for ophthalmic services. The lawsuit alleges that the patient’s death resulted from the ophthalmologist’s failure to diagnose a pituitary tumor, and the IPA was vicariously liable for its agents’ medical negligence. The patient’s lawsuit also includes breach of warranty and misrepresentation claims against the IPA, specifically citing the marketing materials of the IPA that stated, “We guarantee the highest quality of care and provide the best ophthalmologists in the Northeast.” The facts in the lawsuit further allege that the ophthalmologist who allegedly misdiagnosed the patient had never passed the ophthalmology boards and had been sued five times for medical malpractice.

An IPA spokesperson states that the ophthalmologist was acting independently and that it (the IPA) had no control over and set no guidelines on how to treat patients. Furthermore, the IPA states that the ophthalmologist went through a thorough credentialing process and that the credentialing committee had determined that the five lawsuits brought against the ophthalmologist were vicarious liability claims arising from his former partner’s care.

When there is an unfavorable outcome associated with health care provided by a physician, a patient may allege that the MCO was either vicariously liable and/or negligent in its selection of health care providers. Regarding vicarious liability in the above example, if it is found that the patient reasonably believed that the ophthalmologist was acting as an agent of the IPA, the IPA could be held liable for the ophthalmologist’s actions regardless of whether the IPA actually controlled his actions.

Risk management tip: To minimize vicarious liability exposures arising from an agency relationship, the IPA should eliminate any situations that create the impression of an employer-employee relationship and inform all patients that providers act independently and are not employed or controlled by the managed care system. Advertising and marketing often can create the impression that the ophthalmologist “works for” the managed care organization.

Regarding claims of negligent selection of a health care provider, when a patient is under the “custody” of a health care system, the patient relies on the system to monitor and supervise the quality of care provided. Courts have considered the limitation of a patient’s choice of physicians in a managed care system to be a form of custody. Through its credentialing and recredentialing procedures, the managed care entity arguably assumes a duty to members to ensure that panel physicians are not likely to provide negligent care. The plaintiffs alleging negligent selection in the above scenario must prove that the IPA knew or should have known with reasonable effort that malpractice was likely and that this negligence resulted in injury.

In this case, the IPA may be able to successfully defend itself by demonstrating that it carried out a thorough screening of the defendant ophthalmologist and his past claims history.

Even though its credentialing procedures may be adequate, the advertising claim that the IPA provided the “best ophthalmologists in the Northeast” leaves it open to possible claims of misrepresentation. The fact that one of its member-ophthalmologists did not pass the boards could become a relevant issue for a jury deciding if representations in the IPA’s marketing materials are accurate.

The Health Care Litigation Environment

As the country’s health care industry has moved rapidly toward managed health care, consumer groups, physicians, and other providers have complained that profits, rather than quality of care, too often drive health care decisions. Increasingly, entities such as MCOs and large physician groups and networks are the target of lawsuits.

In April 1997, an Orange County, California, jury awarded a family $10.9 million in a case against Friendly Hills Medical Group of La Habra. Friendly Hills, a large multispecialty group, allegedly failed to perform a diagnostic test on a woman who later died of cervical cancer. Evidence from doctors at three medical centers supported defense arguments that the patient’s cancer was incurable months before she first visited Friendly Hills for tests and treatment. However, the plaintiffs were able to attack the group’s record keeping and to characterize the service the patient received as “depersonalized.” After the verdict, one juror was quoted in the newspaper, “People are being herded through HMOs rather than receiving personalized service.”

Interestingly, no individual physicians were sued in this case, only the medical group. Plaintiff attorneys are using the public’s current negative perception of managed care to inflame juries. Basic problems with record keeping was the real issue in this case, but juries are being hypervigilant about patient management issues and are painting all groups of health care providers (HMOs, IPAs, group practices, etc.) with the same broad brush whenever a plaintiff’s attorney characterizes treatment as “mismanaged.”

Conclusion

Ophthalmologists who are forming corporate entities and partnerships in response to managed care ought to consider carrying D&O and E&O insurance. OMIC and the American Academy of Ophthalmology have developed a comprehensive insurance package that can protect against many of the exposures associated with ophthalmic MCOs. These specially designed D&O and E&O liability coverages can be purchased together or separately. Each policy offers a $1 million limit per claim and in the aggregate (including defense costs) and a $5,000 deductible for each claim. All policies are written on OMIC paper and are reinsured through CNA International RE of London. Contact OMIC’s Underwriting Department for further information.

Practical Application of HIPAA Privacy Rules (Part 1)

Kimberly Wittchow, JD, OMIC Staff Attorney

Digest, Winter, 2003

The April 14, 2003 deadline to comply with the HIPAA Privacy Rules is fast approaching. OMIC enumerated the many components of compliance in its Guide to Implementation of the HIPAA Privacy Standards sent to insureds in November 2002. OMIC has since fielded many questions from insureds about the practical application of the Privacy Rules to their practices. The following are a sample of questions we continue to address.

Q  Can I avoid being a Covered Entity under HIPAA if I contract with a billing service to transmit all electronic claims submitted on my behalf?

A  No. Submitting even one electronic claim after April 14, 2003, whether directly or through a contracted service, will trigger application of the Privacy Standards to you.

Q  Do I have to comply with HIPAA if I am a physician in a small, rural practice?

A Your practice size and location generally do not affect your status under HIPAA. However, you are not a Covered Entity if you maintain either paper or electronic files but do not transmit PHI electronically and have not volunteered to be a Covered Entity by contract or certification. You should be aware though that as of October 16, 2003, Medicare will require practices with 10 or more employees to file claims electronically.

Q  Can I post a one page summary of my Notice of Privacy Practices in my office?

A  Yes. But in addition, you must post your entire Notice in a clear and prominent location in your office and make it available on your web site. If you make changes, you must post the amended Notice in your office and on your web site, but you do not need to redistribute it to your patients unless they ask for a copy.

Q  Can my office staff contact patients before we give them our Notice of Privacy Practices?

A  Yes. You must provide the Notice to each patient no later than the date of first service delivery or as soon as practicable in emergencies. Where you contact the patient by telephone to schedule an appointment or collect information in anticipation of a procedure, you can wait to provide the Notice until the patient comes into your office. When you do provide the Notice, you must make a good faith effort to obtain the individual’s written acknowledgment of receipt of the Notice or document your efforts to obtain the acknowledgment and the reason it was not obtained.

Q  Can I ask patients to sign a blanket HIPAA Authorization form for any use or disclosure of their PHI?

A  No. A HIPAA Authorization is required for certain specific, non-routine uses or disclosures of PHI. Its required use is best defined by the exceptions. You do not need Authorization to disclose PHI to the subject of the PHI, the Department of Health and Human Services, or to people in the patient’s “circle of care.” You also do not need Authorization to use or disclose PHI for payment, treatment, health care operations, as required by law, or for many public health-related activities. In most other situations, Authorization is required. For example, you need Authorization to disclose PHI if you want to sell cataract/IOL outcome data that includes patient identifiable information to IOL manufacturers. You also need Authorization to disclose PHI if the patient is applying for disability insurance and the insurer requests the patient’s medical record to make an underwriting decision.

Q  Do I have to enter into Business Associate Agreements with janitorial or other service providers?

A  No. Your Business Associates are persons or entities that perform certain functions or activities on your behalf or provide services to you that involve the use or disclosure of PHI. Certain service providers, such as janitors, electricians, and couriers of information, are not Business Associates because their services do not involve the use or disclosure of PHI.

Q  Are my patients’ health plan insurers my Business Associates?

A  No. When you submit a claim for payment to a health plan and it assesses and pays the claim, you are each acting on your own behalf as Covered Entities and not as Business Associates of one another.

Q  How do I find out if my state privacy laws are stricter than HIPAA’s?

A  Your state ophthalmic or medical society may have undertaken such an analysis for its members. You also may want to engage legal counsel to advise you on your specific responsibilities under both state and federal privacy laws.

The primary resource for this article was the OCR Guidance Explaining Significant Aspects of the Privacy Rule – Dec. 4, 2002.