HIPAA and CINA Proceedings A Presentation to the Law and Community Health Section of the Alaska Bar Association February 24, 2004 - PowerPoint PPT Presentation

1 / 43
About This Presentation
Title:

HIPAA and CINA Proceedings A Presentation to the Law and Community Health Section of the Alaska Bar Association February 24, 2004

Description:

Title: Administrative Simplification Provisions of HIPAA Author: Joan Wilson Last modified by: anc Created Date: 9/10/2002 3:15:34 PM Document presentation format – PowerPoint PPT presentation

Number of Views:166
Avg rating:3.0/5.0
Slides: 44
Provided by: JoanW158
Category:

less

Transcript and Presenter's Notes

Title: HIPAA and CINA Proceedings A Presentation to the Law and Community Health Section of the Alaska Bar Association February 24, 2004


1
HIPAA and CINA ProceedingsA Presentation to the
Law and Community Health Section of the Alaska
Bar AssociationFebruary 24, 2004
  • Joan M. Wilson, J.D.
  • DAVIS WRIGHT TREMAINE
  • Anchorage, Alaska
  • joanwilson_at_dwt.com
  • (907) 257-5337

2
Overview of Presentation
  • HIPAA Lay of the Land
  • HIPAA Privacy Requirements
  • Disclosures (With and Without Authorization)
  • Individual Rights
  • Recommendations

3
Me
  • Attorney, Anchorage
  • Litigator
  • Hired Gun
  • Commercial Disputes
  • Employment Litigation
  • How Did I Get Into Health Care?
  • Subpoenas
  • Medicaid Fraud Trial
  • HIPAA

4
Whats New in HIPAARipped from the Headlines
5
Whats New In HIPAA(Ripped from the Headlines)
  • Reported (to me), Friday, February 13, 2004 from
    the American Journal of Psychiatry
  • Mrs. A, a 79-year-old woman without a previous
    psychiatric history, was found in a pool of blood
    as a result of a self-inflicted gunshot wound
  • Mrs. As husband reported that she had recently
    received a letter from her insurance company
    regarding its new HIPAA policies
  • She misinterpreted the Notice to mean that her
    insurance company was discontinuing her coverage

6
HIPAA THE BIG PICTURE Not Just One Issue
Health Insurance Portability and Accountability
Act of 1996
7
Privacy and Security
  • Protects all individually
  • identifiable health
  • information
  • Paper
  • Electronic
  • Oral

Privacy of electronic health information
8
Covered Entities
  • Health Plans (including many employee benefit
    plans)
  • Plans that provide or pay for medical care
  • Health Care Clearinghouses
  • Entities that process or facilitate processing
    non-standard data elements into standard data
    elements, or vice versa
  • Providers who electronically transmit any health
    information in a HIPAA covered transaction
  • Furnishes, bills or is paid for health care in
    the normal course of business

9
HIPAA Penalties and Enforcement
  • Civil penalties
  • 100 per violation
  • 25,000 annual cap for violations of identical
    requirement
  • Criminal penalties
  • Wrongful disclosure up to 5,000 and/or 1 year
    jail time
  • False pretenses ? 100,000 and/or 5 yrs
    imprisonment
  • For profit/with malice up to 250,000 and/or 10
    yrs in jail
  • Other penaltiesor liability
  • Standard of care
  • Reputation

10
Potential Civil Liability Ratcheting Duty of
Care
  • Tort Negligence
  • Tort - Invasion of Privacy
  • Tort - Breach of Confidence (Physician-Patient)
  • Tort Defamation
  • Tort- Fraud
  • Statutory - Consumer Fraud
  • Contract - Breach of Confidentiality
    Clauses/Policies
  • Contract - Breach of Express or Implied Warranty
  • Contract - Suits by Business Associates
  • Employment -related suits (HIPAA sanctions issues)

11
Privacy Overview
  • The Privacy Rule covers
  • Permitted uses and disclosures of protected
    information
  • Individual rights
  • Administrative requirements

12
PrivacyProtected Health Information
  • Information relating to
  • Past, present or future physical or mental health
    or condition provision of health care to an
    individual
  • Provision of health care or
  • Past, present or future payment for health care
  • Created/received by provider, plan, employer or
    clearinghouse
  • Individually identifiable or reasonable likely
    to be identifiable
  • In any medium
  • Written
  • Verbal
  • Electronic

13
Preemption of State Law
  • General Rule HIPAA preempts or supercedes all
    contrary State laws
  • Exceptions
  • HHS determination
  • State law that is more stringent
  • Public health reporting
  • Insurance oversight
  • HIPAA floor for privacy requirements
  • Alaska law still will apply in many cases

14
Use and Disclosure
  • General rule A covered entity and its
    workforce, may not use or disclose protected
    health information, except
  • For treatment, payment and operations
  • With individual permission
  • After opportunity to agree or object
  • With an authorization
  • To the individual
  • As otherwise permitted or required by HIPAA

15
Required Disclosures
  • To the individual, pursuant to access right
  • To the Secretary of DHHS, to determine compliance

16
Permitted Disclosures Absent Authorization
  • As required by other laws
  • Public health activities
  • Victims of abuse, etc.
  • Health oversight activities
  • Workers compensation
  • Law enforcement purposes
  • Decedents - coroners and medical examiners
  • Organ procurement
  • Research purposes, under limited circumstances
  • Imminent threat to health or safety (to the
    individual or the public)
  • Specialized government function
  • Judicial and administrative proceedings

17
Individual Authorization
  • If a use or disclosure is not otherwise
    permitted, authorization required
  • Core elements
  • Meaningful and specific description of
    information
  • Persons or Class of Persons authorized to
    disclose/receive disclosure
  • Purpose
  • At the Request of the Individual
  • Expiration date/ event

18
Individual Authorization
  • Required statements
  • Right to revoke
  • Whether authorization is a condition of treatment
  • Potential for redisclosure
  • Obtain appropriate signature copy to individual

19
Individual Authorization
  • Give a copy of authorization
  • Make sure authorization is
  • Completely filled in
  • Signed by appropriate person
  • Defective authorization is not valid
  • Covered entity not required to disclose PHI
    pursuant to authorization disclosure permissible
  • Duty of additional inquiry for excessive
    authorizations?
  • Address policies/procedures

20
Psychotherapy Notes
  • A covered entity must obtain an authorization for
    and use or disclosure of psychotherapy notes,
    except
  • For treatment, payment, or operations
  • Use by the originator for treatment
  • Use by the covered entity for training of its
    mental health professionals
  • Defense of the covered entity against action
    brought by individual
  • Determining HIPAA compliance
  • Required by law
  • Oversight Activities (audit, investigation)
  • Imminent threat
  • Not listed as exception judicial proceedings

21
Psychotherapy Notes
  • Definition
  • Notes of mental health professional documenting
    or analyzing the contents of a conversation
    during a counseling session (kept separate from
    rest of record)
  • Excludes
  • Medication prescription and monitoring
  • Start and stop times
  • Modalities and frequencies of treatment
  • Clinical test results
  • Summary of diagnosis, functional status,
    treatment plan, prognosis, and progress to date
  • No Compound Authorization
  • May only be combined with another authorization
    for psychotherapy Notes

22
Minors
  • General rule Parents accorded rights to
    childrens PHI
  • Except
  • Where state or other law expressly identifies the
    parents or childs rights
  • STD testing, pregnancy
  • Minor Living Alone
  • Agreement to the contrary

23
Minors
  • Where the law is silent and parent is personal
    representative for child
  • Parent has access/control PHI
  • Personal Representative state law question
  • Where the law is silent and parent is not
    personal representative
  • May deny access if permitted under state law and
    decision made by a licensed health care provider
  • If law silent, no right to demand PHI

24
Minors
  • Exception
  • Disclosure permitted or denied where necessary to
    avert serious or imminent threat to the safety or
    health of the child

25
Minimum Necessary Information
  • CE may rely on scope of information requested by
  • A public official
  • Another covered entity
  • A professional providing services to the CE
  • Researchers (as long as the research
    requirements are satisfied)
  • A CE may not disclose the entire record, unless
    it is justified
  • But this does not apply to disclosure to
    providers for treatment

26
Individual Rights
27
Individual Rights Right to Notice of Privacy
Practices
  • Provide notice to individuals by the first date
    of service
  • Posted in prominent location
  • Available upon request
  • On website
  • Acknowledgment

28
Individual Rights Right to Access
  • Right to request access own protected health
    information
  • Reviewable and unreviewable grounds for denial
  • Explanation of reasons for denial
  • Allow review of denial if appropriate

29
Individual Rights Right to Request Amendment
  • Individual may request amendment of his/her
    records
  • In response, covered entity may
  • Accept amendment
  • Deny of amendment
  • Grounds include not created by
    entityinformation is accurate and
    completeinformation is not subject to access
  • Statement of disagreement (by individual)
  • Rebuttal statement (by covered entity)
  • Record-keeping/linking

30
Individual Rights Accounting of Disclosures
  • Right to receive an accounting of disclosures
  • Accounting includes
  • Date of disclosure
  • Recipient name and address
  • Description of information disclosed
  • Purpose of disclosure

31
Individual Rights Accounting of Disclosures
  • Exceptions include
  • Treatment, payment and health care operations
  • Individual access
  • Directories, persons involved in care
  • Pursuant to authorizations
  • National security or intelligence
  • Incidental disclosures
  • Limited date set
  • Prior to April 14, 2003

32
Individual Rights Right to Request Additional
Protections
  • Right to request additional privacy protections
  • Covered entity may refuse
  • If agrees ? bound (except in emergency)
  • Be careful in granting requests
  • Right to request to receive communications in
    alternative fashion
  • Must accommodate reasonablerequests

33
Permitted Disclosures Government and Other
Purposes
  • As required by other laws
  • Public health activities
  • Victims of abuse, etc.
  • Health oversight activities
  • Workers compensation
  • Law enforcement purposes
  • Decedents - coroners and medical examiners
  • Organ procurement
  • Research purposes, under limited circumstances
  • Imminent threat to health or safety (to the
    individual or the public)
  • Specialized government function
  • Judicial and administrative proceedings

34
As Required By Other Laws
  • Where State Law Requires Providers or
    Administrators to Report to Law Enforcement or
    OCS, HIPAA permits such disclosures
  • Reports of Suspected Child Abuse or Neglect
  • Reports of Vulnerable Adult Abuse, Neglect, or
    Abandonment
  • Follow State Law
  • Question for Providers How Much to Disclose

35
Judicial or Administrative Proceedings
  • A provider may Disclose PHI in the course of a
    judicial or administrative proceeding, if
  • Court or administrative tribunal order
  • some providers require
  • Disclose only the PHI expressly requested by the
    order
  • Absent court Order, by subpoena or discovery
    request, if
  • Satisfactory assurance of notice to individual
    whose PHI is at issue or
  • Reasonable efforts to secure a protective order

36
Judicial or Administrative Proceedings
  • Satisfactory assurance notice to Individual
  • Writing and Documentation of
  • good faith attempt to provide written notice to
    patient
  • Notice contained sufficient information about the
    litigation or proceeding to permit patient to
    raise an objection
  • Time to raise objection lapsed and
  • No objections filed
  • Objections filed and resolved by court and
    disclosure is consistent with resolution

37
Judicial or Administrative Proceedings
  • Reasonable Efforts to Secure a Protective Order
  • Writing and Documentation evidence
  • Parties have agreed to a qualified protective
    order and presented it to the court
  • Party requesting information has sought the
    protective order
  • Issue
  • Is this operable when PHI is not the PHI of one
    of the parties

38
Judicial or Administrative Proceedings
  • Qualified Protective Order
  • Court or Tribunal Order or Stipulation by the
    Parties
  • Prohibit use of PHI outside litigation or
    proceeding
  • Requires return or destruction of PHI (original
    and copies) at end of litigation or proceeding

39
Judicial or Administrative Proceedings
  • Absent Protective Order from the parties,
    Provider may still disclose in response to lawful
    process
  • It makes reasonable effort to provide notice to
    the patient (as above) or
  • Seeks a qualified protective order on its own

40
More Stringent Law
  • If another law governing production of records in
    judicial proceedings is more stringent than
    HIPAA, it must be followed
  • Substance Abuse Treatment Regulations
  • 42 C.F.R. Part Two
  • Comply with both?

41
Recommendations
  • Much Can Be Accomplished With a Well-worded
    Continuing Authorization
  • Recipient -- DHSS and Department of Law
  • Purpose of Disclosure At Request of Individual
    or For Adjudication Regarding Care of Minor Child
  • Expiration Date or Event
  • How Long are Cases in the System
  • Until Completion of Child in Need of Aid
    Proceedings
  • Caution
  • May be revoked at any time
  • Psychotherapy Notes

42
Recommendations
  • If Court Proceedings
  • Be Timely in Requests
  • Legal Issues to Resolve
  • HIPAA Permissive Disclosure
  • Likely Legal Question with Protective or even
    other Orders where PHI is of a non-party
  • Notice May be Best Route to go
  • Substance Abuse Treatment regulations still
    operable for Some Providers
  • Complaint
  • Do Not Use Providers as Your Experts

43
  • Questions?
Write a Comment
User Comments (0)
About PowerShow.com