[ Friday, January 14, 2005 ]
Lawyers and accounting for disclosures: About 15 months ago, Kristin Rosati, on behalf of the American Health Lawyers Association, sent a
letter to OCR asking for guidance on lawyers' obligations as business associates. Lawyers are specifically mentioned as examples of business associates when they receive PHI from covered entity clients. However, lawyers are unlike other BAs, since they have specific ethical obligations to their clients and their communications with their clients are entitled to specific legal protections that other BAs (such as vendors, billing companies, etc.) do not enjoy. How should lawyers deal with the ambiguities involved in applying HIPAA to the attorney-client relationship?
The OCR has published 9 FAQs addressing the questions raised by the AHLA letter. Basically, the accounting requirement doesn't apply to most disclosures in litigation if the covered entity that's making the disclosure (or on whose behalf the disclosure is made) is a party to the litigation, because the disclosure is for health care operations. Disclosures by CEs to their lawyers need not be accounted for. And in cases where a CE must give notice to an individual, the CE can rest assured that notice to the individual's lawyer is effectively notice to the individual.
Minimum use rules apply to disclosures by CEs to their lawyers, but CEs can rely on their lawyer's word that what the lawyer is asking for is minimum necessary (sure, you can rely on a lawyer's word, can't you?). CEs and their lawyers should consider deidentification where possible, though, and seek protective orders where it isn't.
For lawyers, a copy of the subpoena is sufficient to serve as "satisfactory assurance" that the individual has had an opportunity to object to the disclosure and the time has passed,
so long as the subpoena contains all the necessary information to show these facts to be true. Of course, where the notice and objection period commences from the delivery of the subpoena to the covered entity, the facts won't be there on face of the subpoena.
Finally, not only do lawyers need business associate agreements with their CE clients, they need sub-BAAs with others with whom they share PHI who are operating on the same side; they do not need sub-BAAs with opposing counsel, fact witnesses, and others who do not perform functions assisting the lawyer. I think that means that sub-BAAs would be needed for expert witnesses but not for court reporters.
The FAQs can be found
here, hopefully. If not, go
here and look for the link on the top left.
Jeff [5:14 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
