[ Monday, January 21, 2008 ]
More questions from the audience: What an odd weekend; I got 3 different questions from 3 different readers, all emailed to me directly instead of through the comments sections. I also got
another one right before the weekend. I do get questions somewhat regularly, but not usually clustered so closely together. Anyway, here we go:
[Standard disclaimer first: just because you're reading this, doesn't mean I'm your lawyer. Just because I'm answering your question, doesn't mean I'm your lawyer. This is general information, not legal advice. I'd have to know a lot more about your situation than just what you're writing in an email to actually give you legal advice. And, I'd charge you for it. A lot. So, unless you've signed an engagement letter with my firm and left a hefty retainer, I'm not your lawyer. Are we all clear on this? Thank you.]Question One:
Your blog on Friday, January 18 states the acts of an employee count
as the hospital's acts. So here's the problem. My ex gets someone
else to look up PHI on my wife. My ex (repeatedly) shares the PHI
with others or is using it to harass me and my wife and is also harassing us
about the complaint we filed with OCR. The hospital says it's not a
HIPAA violation because my ex is providing PHI and harassing us on her own
time, not the hospital's. We disagree.
We understand HIPAA to state there will be no PHI disclosures, so why
does it matter whether she is at work or on her own time? I know the
harassment issue is vague in HIPAA except for harassment about the
complaint. Other harassment doesn't seem to be addressed by
HIPAA. Your thoughts?
One last thing. The hospital refuses to provide a list of the people
who accessed the records, citing that all employees have the right to
privately check patient records and the employee has the right to keep
their name private. Hospital says its for the privacy of the care
provider. Our argument is the hospital requires the employees to wear
name badges daily with their first and last name on them and therefore there is
not expectation of privacy (with regard to name only). AND, on their
website and posted throughout the hospital
are policies which state all patients have the right to know the
name of their care providers... hence, if only care providers should be looking
up info, what's the problem? Your thoughts on this too,
please.
We think that the hospital is rolling the dice thinking that we won't go as
far as legal (subpoena) relief if they continue to state all above. We are
in process of injunctive relief right now.
Thank you for the BLOG. We use your site and follow it weekly.
Sincerely, Agitated in Atlanta
Response: A couple of clarifications. Just because a person is an employee of Company X, doesn't mean that every act they take is in their capacity as an employee of Company X. Take the Jolt Cola truck driver; if he runs over a kid in a crosswalk while driving his Jolt Cola truck to the QuickieMart to deliver a load of soda, he's acting as an employee of Jolt and the kid's parents can sue Jolt. However, if the same guy hits the same kid on his day off, driving his own car, running personal errands, then Jolt's not responsible for him.
The question her is whether the hospital's employee was acting in his/her official capacity as an employee of the hospital at the time of the action that's the basis of the complaint. It's really up to hospital, however, to raise this defense. And employers usually defend against employee actions by saying the employee was acting outside the scope of his/her employment because whatever they were doing at the time was against company policies (usually they fire the employee just to show how bad the breach was and how much they care about their policies).
Based on the way you presented the facts, it does look like the "someone else" was a hospital employee, did the looking-up while on the job, and probably disclosed the PHI while on the job. If the ex is also a hospital employee, it would be up to the hospital to show that she wasn't acting in her capacity as an employee when she used or disclosed the PHI, or that the use and/or disclosure were for a permitted purpose (treatment, payment, healthcare operations). Even if she's harrassing you on her own time, if she's using PHI that the obtained in a non-permitted manner, that in itself is problematic.
Furthermore, the hospital must account for all disclosures of PHI, unless they fit within a particular exception to the accounting requirement. Most disclosures fit within the treatment, payment, or healthcare operations exception, or within the disclosures pursuant to authorization exception. However, any improper disclosure must be accounted for. If the disclosure from the other person to the ex was an improper disclosure, the hospital must provide an accounting. If the other person accessed the information outside of his/her official employment, that would be a disclosure that must be accounted for. If the employee accessed the information for a purpose other than treatment/payment/operations, that might be an improper use but not necessarily an improper disclosure, since improper uses need not be accounted for.
The hospital might not have the ability to track every person who has accessed a medical record. This would be somewhat surprising. At least as far as electronic records go, it certainly is an industry standard that this information be captured, and the hospital would have to take the position that it was too expensive or cumbersome to have a system in place that allowed them to track access this specifically. If they're unable to track access, it may be a HIPAA violation. If they don't provide you with a complete accounting of disclosures (including any improper disclosures), that would be a HIPAA violation.
Of course, you don't have a private cause of action under HIPAA, but you can make sure the OIG investigator keeps up on the case. You might have a state-law claim for breach of confidentiality, invasion or privacy, or some other common-law or state statutory tort. And if the ex and "someone else" are licensed (e.g., nurses), their licensing board may have ethical or other obligations that may be grounds for a disciplinary action.
Question 2:
Hello,
I came across your website while researching a HIPAA
question and hope you can help. I was curious as to what the guidelines
were in regards to a staff physician leaving a medical group and wanting to
access medical records of patient surgical cases to submit for their surgical
boards. Is this a HIPAA violation, if it is required
for Board
Certification?
Thank you, and I await your
reply.
Boarding in Birmingham
Response: Disclosure by the practice and use by the physician for submission to a recognized agency for purposes of the physician receiving board certification would be a use/disclosure for healthcare operations. Minimum necessary rules apply. Check with the board in question to ensure that they will maintain confidentiality, and see if they will allow for disclosure to be partially or completely de-identified.
Question 3:
Just wanted to say how much I enjoy your blog, and it indeed DOES require
not just a college education but probably a law degree. Although as a
medical student, resident, and fellow, I have been to countless HIPAA trainings,
it still baffles me.
What seems clear, however, is that HIPAA
is a serious pain and of questionable benefit for patients, and now that I am
about to start my own practice, I am committed to becoming a non-covered entity.
The practice will be cash-only without transmission of electronic information.
We will have an EMR but it will be maintained on site.
I have a
question, though, that I have not been able to get an answer. It is likely that
as I begin the practice, I will work as a part-time employee at a local VA
hospital, which is clearly covered as a government health plan.
Based on this part-time work, would I become a covered entity at
my private practice just because I am an employee doing unrelated work at
another covered entity, e.g., the VA?
Any help on this or information on
where I could get an answer?
Thanks,
The Composer
Response: It is an interesting question whether one can have some "HIPAA absolution" to cease being a covered entity once you've been one. If you are a healthcare provider who transmit PHI in connection with a HIPAA transactions, you are a covered entity. However, does "transmit" only refer to the present tense, so that you are covered at the instant you are transmitting but not necessarily any other time? What if you transmit once, but never again? What if you operate your practice for a period of time as a HIPAA-covered physician, but then purposely change your practice so you will no longer be transmitting PHI electronically; can you cease to be a covered entity, or is the rule "once a covered entity, always a covered entity"? There isn't a clear answer to this. However, you certainly could make the argument that as a VA doctor,
you never engage in HIPAA transactions, only the VA does; and when you start up your own practice, there will be a clear demarcation of what's the VA stuff and what's the private practice stuff. Since there's no private cause of action under HIPAA, who's going to complain, anyway?
However, our musical physician overstates the burdens of HIPAA. As a physician, you have an ethical (and depending on location, probably a legal) requirement to maintain a certain level of confidentiality. HIPAA adds some paperwork, and requires that certain things be thought out to ensure that the required level of confidentiality is met. But it's really not all that hard, and there are a lot of physician office management programs that include almost all you really need from a HIPAA standpoint. And while I don't really get involved in the practicalities of my clients' medical practices, I would think that trying to operate a practice where you never do HIPAA-covered transactions (electronically obtaining percertifications or determining eligibility are covered transactions) would be pretty cumbersome. I know doctors who do so, but usually it's older, well-established practices where they've been operating exclusively on paper for years and don't want to go electronic anyway.
Jeff [10:23 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
