Title: HIPAA and CINA Proceedings A Presentation to the Law and Community Health Section of the Alaska Bar Association February 24, 2004
1HIPAA and CINA ProceedingsA Presentation to the
Law and Community Health Section of the Alaska
Bar AssociationFebruary 24, 2004
- Joan M. Wilson, J.D.
- DAVIS WRIGHT TREMAINE
- Anchorage, Alaska
- joanwilson_at_dwt.com
- (907) 257-5337
2Overview of Presentation
- HIPAA Lay of the Land
- HIPAA Privacy Requirements
- Disclosures (With and Without Authorization)
- Individual Rights
- Recommendations
3Me
- Attorney, Anchorage
- Litigator
- Hired Gun
- Commercial Disputes
- Employment Litigation
- How Did I Get Into Health Care?
- Subpoenas
- Medicaid Fraud Trial
- HIPAA
4Whats New in HIPAARipped from the Headlines
5Whats New In HIPAA(Ripped from the Headlines)
- Reported (to me), Friday, February 13, 2004 from
the American Journal of Psychiatry - Mrs. A, a 79-year-old woman without a previous
psychiatric history, was found in a pool of blood
as a result of a self-inflicted gunshot wound - Mrs. As husband reported that she had recently
received a letter from her insurance company
regarding its new HIPAA policies - She misinterpreted the Notice to mean that her
insurance company was discontinuing her coverage
6HIPAA THE BIG PICTURE Not Just One Issue
Health Insurance Portability and Accountability
Act of 1996
7Privacy and Security
- Protects all individually
- identifiable health
- information
- Paper
- Electronic
- Oral
Privacy of electronic health information
8Covered Entities
- Health Plans (including many employee benefit
plans) - Plans that provide or pay for medical care
- Health Care Clearinghouses
- Entities that process or facilitate processing
non-standard data elements into standard data
elements, or vice versa - Providers who electronically transmit any health
information in a HIPAA covered transaction - Furnishes, bills or is paid for health care in
the normal course of business
9HIPAA Penalties and Enforcement
- Civil penalties
- 100 per violation
- 25,000 annual cap for violations of identical
requirement - Criminal penalties
- Wrongful disclosure up to 5,000 and/or 1 year
jail time - False pretenses ? 100,000 and/or 5 yrs
imprisonment - For profit/with malice up to 250,000 and/or 10
yrs in jail - Other penaltiesor liability
- Standard of care
- Reputation
10Potential Civil Liability Ratcheting Duty of
Care
- Tort Negligence
- Tort - Invasion of Privacy
- Tort - Breach of Confidence (Physician-Patient)
- Tort Defamation
- Tort- Fraud
- Statutory - Consumer Fraud
- Contract - Breach of Confidentiality
Clauses/Policies - Contract - Breach of Express or Implied Warranty
- Contract - Suits by Business Associates
- Employment -related suits (HIPAA sanctions issues)
11Privacy Overview
- The Privacy Rule covers
- Permitted uses and disclosures of protected
information - Individual rights
- Administrative requirements
12PrivacyProtected Health Information
- Information relating to
- Past, present or future physical or mental health
or condition provision of health care to an
individual - Provision of health care or
- Past, present or future payment for health care
- Created/received by provider, plan, employer or
clearinghouse - Individually identifiable or reasonable likely
to be identifiable - In any medium
- Written
- Verbal
- Electronic
13Preemption of State Law
- General Rule HIPAA preempts or supercedes all
contrary State laws - Exceptions
- HHS determination
- State law that is more stringent
- Public health reporting
- Insurance oversight
- HIPAA floor for privacy requirements
- Alaska law still will apply in many cases
14Use and Disclosure
- General rule A covered entity and its
workforce, may not use or disclose protected
health information, except - For treatment, payment and operations
- With individual permission
- After opportunity to agree or object
- With an authorization
- To the individual
- As otherwise permitted or required by HIPAA
15Required Disclosures
- To the individual, pursuant to access right
- To the Secretary of DHHS, to determine compliance
16Permitted Disclosures Absent Authorization
- As required by other laws
- Public health activities
- Victims of abuse, etc.
- Health oversight activities
- Workers compensation
- Law enforcement purposes
- Decedents - coroners and medical examiners
- Organ procurement
- Research purposes, under limited circumstances
- Imminent threat to health or safety (to the
individual or the public) - Specialized government function
- Judicial and administrative proceedings
17Individual Authorization
- If a use or disclosure is not otherwise
permitted, authorization required - Core elements
- Meaningful and specific description of
information - Persons or Class of Persons authorized to
disclose/receive disclosure - Purpose
- At the Request of the Individual
- Expiration date/ event
18Individual Authorization
- Required statements
- Right to revoke
- Whether authorization is a condition of treatment
- Potential for redisclosure
- Obtain appropriate signature copy to individual
19Individual Authorization
- Give a copy of authorization
- Make sure authorization is
- Completely filled in
- Signed by appropriate person
- Defective authorization is not valid
- Covered entity not required to disclose PHI
pursuant to authorization disclosure permissible - Duty of additional inquiry for excessive
authorizations? - Address policies/procedures
20Psychotherapy Notes
- A covered entity must obtain an authorization for
and use or disclosure of psychotherapy notes,
except - For treatment, payment, or operations
- Use by the originator for treatment
- Use by the covered entity for training of its
mental health professionals - Defense of the covered entity against action
brought by individual - Determining HIPAA compliance
- Required by law
- Oversight Activities (audit, investigation)
- Imminent threat
- Not listed as exception judicial proceedings
21Psychotherapy Notes
- Definition
- Notes of mental health professional documenting
or analyzing the contents of a conversation
during a counseling session (kept separate from
rest of record) - Excludes
- Medication prescription and monitoring
- Start and stop times
- Modalities and frequencies of treatment
- Clinical test results
- Summary of diagnosis, functional status,
treatment plan, prognosis, and progress to date - No Compound Authorization
- May only be combined with another authorization
for psychotherapy Notes
22Minors
- General rule Parents accorded rights to
childrens PHI - Except
- Where state or other law expressly identifies the
parents or childs rights - STD testing, pregnancy
- Minor Living Alone
- Agreement to the contrary
23Minors
- Where the law is silent and parent is personal
representative for child - Parent has access/control PHI
- Personal Representative state law question
- Where the law is silent and parent is not
personal representative - May deny access if permitted under state law and
decision made by a licensed health care provider - If law silent, no right to demand PHI
24Minors
- Exception
- Disclosure permitted or denied where necessary to
avert serious or imminent threat to the safety or
health of the child
25Minimum Necessary Information
- CE may rely on scope of information requested by
- A public official
- Another covered entity
- A professional providing services to the CE
- Researchers (as long as the research
requirements are satisfied) - A CE may not disclose the entire record, unless
it is justified - But this does not apply to disclosure to
providers for treatment
26Individual Rights
27Individual Rights Right to Notice of Privacy
Practices
- Provide notice to individuals by the first date
of service - Posted in prominent location
- Available upon request
- On website
- Acknowledgment
28Individual Rights Right to Access
- Right to request access own protected health
information - Reviewable and unreviewable grounds for denial
- Explanation of reasons for denial
- Allow review of denial if appropriate
29Individual Rights Right to Request Amendment
- Individual may request amendment of his/her
records - In response, covered entity may
- Accept amendment
- Deny of amendment
- Grounds include not created by
entityinformation is accurate and
completeinformation is not subject to access - Statement of disagreement (by individual)
- Rebuttal statement (by covered entity)
- Record-keeping/linking
30Individual Rights Accounting of Disclosures
- Right to receive an accounting of disclosures
- Accounting includes
- Date of disclosure
- Recipient name and address
- Description of information disclosed
- Purpose of disclosure
31Individual Rights Accounting of Disclosures
- Exceptions include
- Treatment, payment and health care operations
- Individual access
- Directories, persons involved in care
- Pursuant to authorizations
- National security or intelligence
- Incidental disclosures
- Limited date set
- Prior to April 14, 2003
32Individual Rights Right to Request Additional
Protections
- Right to request additional privacy protections
- Covered entity may refuse
- If agrees ? bound (except in emergency)
- Be careful in granting requests
- Right to request to receive communications in
alternative fashion - Must accommodate reasonablerequests
33Permitted Disclosures Government and Other
Purposes
- As required by other laws
- Public health activities
- Victims of abuse, etc.
- Health oversight activities
- Workers compensation
- Law enforcement purposes
- Decedents - coroners and medical examiners
- Organ procurement
- Research purposes, under limited circumstances
- Imminent threat to health or safety (to the
individual or the public) - Specialized government function
- Judicial and administrative proceedings
34As Required By Other Laws
- Where State Law Requires Providers or
Administrators to Report to Law Enforcement or
OCS, HIPAA permits such disclosures - Reports of Suspected Child Abuse or Neglect
- Reports of Vulnerable Adult Abuse, Neglect, or
Abandonment - Follow State Law
- Question for Providers How Much to Disclose
35Judicial or Administrative Proceedings
- A provider may Disclose PHI in the course of a
judicial or administrative proceeding, if - Court or administrative tribunal order
- some providers require
- Disclose only the PHI expressly requested by the
order - Absent court Order, by subpoena or discovery
request, if - Satisfactory assurance of notice to individual
whose PHI is at issue or - Reasonable efforts to secure a protective order
36Judicial or Administrative Proceedings
- Satisfactory assurance notice to Individual
- Writing and Documentation of
- good faith attempt to provide written notice to
patient - Notice contained sufficient information about the
litigation or proceeding to permit patient to
raise an objection - Time to raise objection lapsed and
- No objections filed
- Objections filed and resolved by court and
disclosure is consistent with resolution
37Judicial or Administrative Proceedings
- Reasonable Efforts to Secure a Protective Order
- Writing and Documentation evidence
- Parties have agreed to a qualified protective
order and presented it to the court - Party requesting information has sought the
protective order - Issue
- Is this operable when PHI is not the PHI of one
of the parties
38Judicial or Administrative Proceedings
- Qualified Protective Order
- Court or Tribunal Order or Stipulation by the
Parties - Prohibit use of PHI outside litigation or
proceeding - Requires return or destruction of PHI (original
and copies) at end of litigation or proceeding
39Judicial or Administrative Proceedings
- Absent Protective Order from the parties,
Provider may still disclose in response to lawful
process - It makes reasonable effort to provide notice to
the patient (as above) or - Seeks a qualified protective order on its own
40More Stringent Law
- If another law governing production of records in
judicial proceedings is more stringent than
HIPAA, it must be followed - Substance Abuse Treatment Regulations
- 42 C.F.R. Part Two
- Comply with both?
41Recommendations
- Much Can Be Accomplished With a Well-worded
Continuing Authorization - Recipient -- DHSS and Department of Law
- Purpose of Disclosure At Request of Individual
or For Adjudication Regarding Care of Minor Child - Expiration Date or Event
- How Long are Cases in the System
- Until Completion of Child in Need of Aid
Proceedings - Caution
- May be revoked at any time
- Psychotherapy Notes
42Recommendations
- If Court Proceedings
- Be Timely in Requests
- Legal Issues to Resolve
- HIPAA Permissive Disclosure
- Likely Legal Question with Protective or even
other Orders where PHI is of a non-party - Notice May be Best Route to go
- Substance Abuse Treatment regulations still
operable for Some Providers - Complaint
- Do Not Use Providers as Your Experts
43