Tag Archives: HITECH Act

Physician Communications: Considerations for Using Text Messages and Social Media

Posted on by

doctors textingBy: Jackie Bain

It is becoming easier and easier for physicians to communicate with each other and their patients.  And although open communication is generally thought of as positive, the medical profession should proceed with caution.  Patients and consulting physicians rely heavily on their communications with their treating physicians.  Thus, communications which do not require the thought of focus that a physician would otherwise give to a situation may result in disaster. While there are many potential ways a physician might use text messaging and social media both professionally and personally, we will focus generally on physician interactions with other physicians, and physician interactions with patients.

To start, physicians should be aware that, in 2011, the American Medical Association issued guidelines in its Code of Ethics for physicians who use social media: Continue reading →

HIPAA Omnibus Final Rules and Penalties

Posted on by

On Friday January 25, 2013, the Department of Health and Human Services published the Final Rule modifying the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the Genetic Information Non-Discrimination Act (“GINA”) as well as other modifications to the HIPAA rules. (See 45 CFR Parts 160 and 164, Federal Register Volume 78 Number 17.)

The omnibus rule actually contains four final rules. The first final modifications to HIPAA which were mandated by “HITECH” include modifications intended to improve the Rules which were issued as a proposed rule on July 14, 2010 include six modifications.

The first omnibus final rule includes direct liability modifications for business associates of covered entities for compliance with certain HIPAA privacy and security rule requirements. Strengthening of limitations on the use and disclosure of protected health information, expanded individuals’ rights to receive electronic copies of their health information, modification and redistribution of entities privacy practices protocols, modification of individual authorization forms and other requirements to facilitate research and disclosure of child immunization proof to schools as well as to enable access to decedent information and lastly the enforcement rules have been modified to address violations such as non-compliance with HIPAA rules due to willful neglect.

The second omnibus final rule adopts changes to the HIPAA enforcement rule that increase the civil monetary penalties in a tiered manner.

The third omnibus final rule involves the breach notification for unsecured protected health information under the “HITECH” act. This rule replaces the prior rules “harm” threshold with a more objective standard.

Finally, the fourth rule prohibits most health plans from using or disclosing genetic information for underwriting purposes.

These final rules take effect this month on March 26, 2013. Covered business entities and business associates must comply with the applicable requirements by September 23, 2013. The penalties for violating the final rules are now as follows:

TABLE 2 – CATEGORIES OF VIOLATIONS AND RESPECTIVE PENTALTY AMOUNTS AVAILABLE

Violation Category – Section 1176 (a)(1)

Each Violation

All such violations of an identical provision in a calendar year
(A)  Did Not Know(B)   Reasonable Cause

(C)   (i)Willful Neglect-Corrected

(C) (ii) Willful Neglect-Not Corrected

 $100-$50,0001,000-50,000

10,000-50,000

50,000

 $1,500,0001,500,000

1,500,000

1,500,000

Providers need to be aware of the penalties for violating the rules as we most recently reported to you the office of civil rights will not hesitate in sanctioning providers for violating the Act in amounts in excess of $1.5 million.

Portal not “Port-All”

Posted on by

doorBy: David Hirshfeld

Whether as a means of satisfying the Stage 2 “meaningful use” requirements of the HITECH Act, or in an effort simply to enhance the efficiency of their practices, many of our clients have been implementing electronic medical records software that includes patient portals.  A “patient portal” is an electronic doorway between patient and practice.  Portals often allow patients to check and download their own treatment records, and to use digital messages as a means of communicating with clinicians.  Portals can be awesome tools with which to enhance your practice, but they need to be implemented thoughtfully.

A portal is often an excellent way in which to add operational efficiencies that reduce costs, increase patient satisfaction, and increase positive outcomes; BUT, if not carefully monitored, they can become inadvertent points of entry for information, the meaning of which can only be appreciated when delivered in a face-to-face office visit, where other aspects of the patient’s condition would be evident (e.g. pallor, swelling, confusion).

Portals should be limited to more benign encounters, such as: patient registration, financial clearance, medical history, appointment scheduling / confirmation, specialty referrals, notification of test results, online bill payment, non-narcotic prescription renewals, follow-up of specific conditions for which there has been a course of in-person treatment that included an agreement as to the use of the portal for follow-up.

I recommend that practitioners train their patients how and to what extent they should use the portal by presenting patients with a “Terms of Use” agreement (that they must sign); and by reminding patients of the Terms of Use if and when they use the portal for an encounter that should have been handled by an in-office visit.

A good “Terms of Use” agreement ought to convey the following information to patients before they use the portal:

  • Identify the proper subject matter to be communicated through the portal and, just as important, the types of communications that should NOT be made through the portal.
  • In addition to communication, what other functions the portal will make available to the patient (e.g. what records can patients view, can they download, can they transmit to other providers, refill prescriptions, help practice to monitor an ongoing condition, etc.).
  • The portal is highly secure, more secure than conventional email, and should be the only way that patients should convey information to the practice other than in-person or, perhaps, on the telephone.
  • Everything conveyed to the practice through the portal will become part of the patient’s medical record.
  • Not only the physician, but other clinicians and practice staff may read communications made through the portal.
  • How quickly, and in what format, will the practice respond to patient communications made through the portal.
  • Whether and on what terms the practice will allow access to records of its minor patients.
  • How modifications to the “Terms of Use” and portal functionality will be conveyed to patients.
  • A primer, as simple as possible, on how to effectively use your practice’s portal.

Portals can be awesome tools with which to enhance your practice; but they need to be implemented thoughtfully, and in conjunction with patient training.

 

Final Privacy Rule Affects Clinical Research Organizations

Posted on by

The final HITECH Act rule was published on January 25th, and it includes revisions to HIPAA.  The two things affected by the new rule are (1) compound authorizations, and (2) authorizations for future research.

Compound authorizations are basically authorizations for two separate uses of protected health information (PHI).  The new rule allows combining an authorization for a research study with any other written permission for the same study, such as authorization to participate in the research.  The core elements of a valid authorization remain in place.  The intent is just to provide some flexibility in clinical research settings.

Traditionally, authorizations had to be study specific.  The new rule allows authorizations not to be study specific, but they have to describe future uses or disclosures in a way that patients will understand that their PHI could be used in future research.

Final Privacy Rule Affects Clinical Research Organizations

Posted on by

The final HITECH Act rule was published on January 25th, and it includes revisions to HIPAA.  The two things affected by the new rule are (1) compound authorizations, and (2) authorizations for future research.

Compound authorizations are basically authorizations for two separate uses of protected health information (PHI).  The new rule allows combining an authorization for a research study with any other written permission for the same study, such as authorization to participate in the research.  The core elements of a valid authorization remain in place.  The intent is just to provide some flexibility in clinical research settings.

Traditionally, authorizations had to be study specific.  The new rule allows authorizations not to be study specific, but they have to describe future uses or disclosures in a way that patients will understand that their PHI could be used in future research.

FTC Interim Final Red Flags Rule a Reprieve for Health Care Providers

Posted on by

By:  Rodger Hochman, Board Certified in Health Law

On November 30, 2012, the Federal Trade Commission (FTC) issued its interim final “Red Flags Rule” which narrowed the definition of “creditor” in such a way that essentially confirms that most health care service providers are not subject to its requirements.

The Red Flags Rule was originally promulgated in reaction to the perceived risk of identity theft in various transactions involving financial institutions and creditors, and it required them to develop and implement a written identify theft program to combat these risks, including internal processes for identifying “red flags” of identity theft.  The application of the Red Flags Rule to health care service providers was controversial since it advanced a counterintuitive notion that a provider who engaged in ordinary course business activities, such as rendering health care services where insurance or other payment would be received later, was a “creditor” by definition, thus was equated with the business of financial institutions and subject to standards more applicable to the relationship between commercial creditors or lenders and their customers.

Under the original rule, any “creditor” was required to establish an identity theft program.  The definition included “any person who regularly extends, renews, or continues credit…”  The FTC interpreted this expansively to include physicians and other providers who accept insurance as payment or who permit payment plans, where payment in full was not received at the time of service.  Thus, if a physician or hospital were to accept a patient’s insurance coverage or bill the balance not covered by insurance to the patient, that was viewed as an extension of credit to the patient which triggered regulatory compliance obligations by the provider.  Although the FTC later clarified its position in saying that it applied only to creditors that regularly and in the ordinary course of business advance funds, there was still some ambiguity.

The interim final rule now makes clear that advancing funds does not include what is routine health care services billing and collection activities (such as deferring payment of fees in connection with providing services) and that most service providers are not subject to the rule.  Nevertheless, while the interim final rule confirms that most providers are not subject to the Red Flags Rule, entities that collect consumer data should still carefully consider how they collect and use such data.   To the extent that they use or provide patient information in connection with credit reporting services, the Red Flags Rule would apply.  Further, health care providers remain subject to the HIPAA/HITECH privacy and security rules with respect to all patient identifying information regardless of whether they are subject to the Red Flags Rule.

ACOwatch: Kathleen Sebelius: Keynote Speech From 2nd Annual ACO Summit

Posted on by

6/28/2011: ACOwatch.com 
Remarks as prepared for delivery by Secretary Sebelius on June 27th, 2011, Washington, DC.

“Improving care is clearly the best approach to addressing rising costs – especially compared to recent proposals that would simply cut Medicare and Medicaid, without doing anything to address underlying growth in health care spending.  But it’s also clear that we are not improving fast enough.  So our challenge is to speed it up.”

Read more here: http://acowatch.com/

ACOs are S.T.U.P.I.D

Posted on by

We have probably never seen so much enthusiasm and spending on anything in our history as we are on healthcare reform. The point is to slow spending and improve quality by incentivizing cost-saving, quality-enhancing behavior. And the Accountable Care Organization is the new healthcare delivery model designed to save us from our greedy, over-utilizing selves. Here’s how it works:

First, you take a lot of primary care physicians and tell them they will get more money by (1) taking an expanded role in taking care of patients, and (2) reducing the expenses associated with that care. Then you tell them two really special things: first, you tell them “Uh, since we’re afraid that you will improperly reduce the amount of care the patients need, we won’t tell you which patients are in an ACO and which are not.” Second, you tell them “We really mean it when we tell you that we intend for you to make more money, but we won’t tell you exactly how we’re gonna do that. Trust us, ok?”

Second, you empower physicians to lead the charge. After all, they’re the only participants in ACOs that smart people think can control costs and quality. And you do this by telling them to (1) shell out about $26 Million to form an ACO, (2) go to Wharton and get an MBA, (3) educate themselves about all the intricacies of information technology and work out the kinks involved in implementing electronic medical records, and (4) keep taking care of those patients while you do all this. Finally, you keep the identity of patients secret from the physicians so there is no way to prepare care plans that take into account the diseases faced by the patients. No problem.

Third, you let patients run amok. They can go into an ACO…or not. They can go in and out of ACOs. They’re like kids that way, but they’re responsible for reading the 397 pages of ACO regs and then deciding whether they like the idea of not. Oh, and they have absolutely no incentive to sign up for ACO care. And why would they? “Hey, how about you go with this ACO, which will get more money if they spend less on you. How’s that sound?” How could this possibly be sold to Medicare patients? “This ACO will get paid for getting you well! Your primary care doctor that you’ve trusted for 20 years and who helps you get and stay healthy…that person doesn’t have the same incentive to get you well.” NOT.

Simplicity. There is none. Never before in our history have we seen something so simple (patient rationing) become so complicated (rationing = less expensive care). And so many acronyms and governmental departments and positions too! There are one sided models, two sided models and now a Pioneer model, for those who are especially adventurous. And did I mention that the basis for healthcare reform, the one that only the state of Washington has the courage to articulate, is really just rationing?

Troubling to pretty much everyone. Yes. Except for policy makers, there has yet to be any significant support for anything other than the IDEA that healthcare should cost less and be more outcome oriented. Even the Mayo, Geisinger and Cleveland systems have all politely declined at this point.

Unlimited flexibility. Yes, this is true, especially as it relates to patients. See, patients can be in a cost saving ACO or not. They can go in and out of them and the ACO will bear the cost. That’s right: patients can go in and out of them—ACO, non-ACO, and yet only the ACO will be penalized for cost increases. Let’s see, the ACO model is the cost saving model. And the plan is to allow patients to choose for society to save money or not. And the patients have zero incentives for participating in an ACO. And who is responsible for the behavior of these patients? Uh, well, we all are.

Patient accountability. This is completely lacking in the ACO model. There is absolutely nothing to incentivize patients for making healthy decisions and to punish them for making unhealthy ones. Also primary care driven. Not really. There aren’t enough to go around, but some guy who knows a doctor is free to see you now. Oh, also pro competitive, meaning everyone will wanna be an ACO, so that will create competition in the market and a tremendous drive to drive costs down and quality up. Ok, not really, but wouldn’t it be nice if that COULD happen. In fact, healthcare reform is functioning to do one sure thing—reduce competition, since only the biggest, strongest organizations can afford to compete or to be one.

Inexpensive. Nah. While the initial cost projections suggested about a $2 Million price tag for forming one, they are now up in the $12 to 26 Million range.

Direct and demonstrative. NOT. The entire healthcare reform delivery plan is like pushing a mouse through a maze by its tail.

Healthcare reform is like Alice in Wonderland at its best. It only makes sense on mind-altering drugs. Moreover, the shizo message from our policymakers on the whole issue is dumbfounding. “We are committed to lowering healthcare costs. ACOs will do this. Patients can be in them…or not.” Some legislators think they’ve created a panacea with ACOs, but then don’t want to compel them. It’s just political nonsense.

Look, slowing healthcare cost creep and quality enhancement are good things. We all (patients included) ought to be outcome driven and focused so that the end result is actually healthcare. ACOs just don’t and won’t do that, which may have something to do with the recent announcement by Mayo, Cleveland and Geisinger that they’re really not that interested in playing with them.


2010 Has Already Been a Huge Year in Healthcare

Posted on by

             Healthcare reform alone is enough of a Rubik’s Cube, but CMS and the OIG has been especially well-staffed these days, enough so that their offices are turning out new laws and interpretations at an alarming rate.  Though it may seem overwhelming, physicians need to work harder than ever to stay on top of the changes.

Health Information Technology (HIT)

            The physician incentive payments/penalty provisions that piggybacked their way onto the federal healthcare reform law have physicians concerned and scrambling.  IT vendors and advisors are drawn to the opportunities the new law has created; and physicians need to be educated and wise. 

             The so called “HITECH” provisions of the federal healthcare reform law create a pot of about $34 Billion worth of incentive payments for eligible professionals and hospitals that attain meaningful use of certified electronic healthcare records (EHR) technology.  To obtain any money, eligible parties will have to demonstrate full compliance no later than 2015, and earlier (2011!) if they want the full benefit.  Medicare has allocated roughly $44K worth of incentives for each compliant physician; and Medicaid offers another $20K roughly, but the real incentive is not the money; it’s the fact that financial penalties apply if you don’t comply by 2015.

             Financial incentives are available for eligible professionals who use certified HIT which satisfies the “meaningful use” regulations, which were issued August 2010. They are complex and limited by time lines which industry insiders claim to be unreachable. Vendors are, nevertheless, selling and physicians are buying software and solutions in hopes they will qualify for the incentive payments.  Physicians should make sure that their contracts with such vendors protect them by requiring the solutions to be certified and meet the meaningful use guidelines. 

Healthcare Reform

            Though everyone is scared about how healthcare reform will unfold, remembering the past may help.  The fact is the concepts in the Act are not new.  For instance, IPAs, PHOs, capitation and the like are the cornerstone of the reform.  Physicians have seen these before, though not on a government mandated basis.  Moreover, where those models were once purely financial, there is a heavy clinical outcome component woven into the regulations. 

            No matter how one views it, the Act creates huge opportunities for physicians and others.  Risk based compensated Accountable Care Organizations (ACOs) are slated to be the new platform for healthcare delivery.  Good news for PCPs:  regulators and think tankers think that physicians, especially primary care physicians, are the best positioned to lead the ACO development charge.  That said, the form the ACOs will take is completely unclear and is expected to unfold over a period of ten years.  Like technology vendors, physicians have to be wary of anyone who has something to sell at this time.  One size does not fit all!  IPAs might be a great vehicle to start.  Capitated models are familiar, but a bundled payment methodology may work better in some circumstances.  One thing that is certain:  whatever business model a physician explores ought to be able to bear financial risk (e.g. capitation or bundled payments) and measure clinical outcomes, because both elements will form the basis of payments of the future.  Though specifics about the future of healthcare are unavailable, the following is a fair list of what’s likely:

  1. Movement away from fee for service payment to risk based compensation;
  2. The prevalence of IT & EMR;
  3. The need to demonstrate clinical effectiveness;
  4. An expanded role of primary care physicians;
  5. Expansion of concierge type services;
  6. Employment of physicians by hospitals;
  7. The development of larger medical practices;
  8. More patients (through insurance mandates and expansion of Medicaid     eligibility);
  9. Expanded use of “physician extenders” (as the PCP shortage worsens); and
  10. Increased enforcement in the area of healthcare fraud (civil & criminal).

OIG and CMS Pronouncements

            May was a busy month for healthcare regulators.  SMS issues the Ambulatory Surgery Center Waiting Area Separation Requirements, which has had the effect of preventing creative business opportunities between ACSs and other healthcare businesses.

            Additionally, the OIG recently issued an Advisory Opinion which makes it very difficult for imaging centers to do prior authorizations for referring physicians.

Fraud and Abuse

            If the first 2/3 of 2010 are any indication of the future in healthcare law, healthcare business professionals have a lot to keep up with. Enforcement by the Justice Department and the Office of Inspector General is in full swing. Already, for instance, nearly $2 million has been repaid as the result of employing a person who has been excluded from a federal healthcare program. Examples include:

Read On at www.FloridaHealthcareLawFirm.com