HIPAA, Subpoenas and Audits, Oh My! An Overview. Jonathan M. Joseph

Transcription

1 HIPAA, Subpoenas and Audits, Oh My! An Overview Jonathan M. Joseph

2 This is provided as an informational service and does not constitute legal counsel or advice, which can only be rendered in the context of specific factual situations. If a legal issue should arise, please retain the assistance of competent legal counsel.

3 Introduction to HIPAA and Virginia Privacy Law

4 Recent Enforcement OCR Press Release (March 16, 2016)

5 Home Care Enforcement Jan : ALJ rules in favor of OCR enforcement, requiring provider of respiratory care, infusion therapy and medical equipment to in-home patients to pay $239,800 in civil money penalties

6 Home Care Enforcement OCR s investigation began after an individual complained that one of the provider s employees left behind records containing the PHI of 278 patients at a private residence

7 HIPAA Privacy Rule What is the purpose? Provide strong federal protections for the privacy of the health care information of individuals Develop a federal floor for privacy standards (though state privacy laws may be more stringent) Promote quality health care information sharing

8 HIPAA Covered Entity Health care providers Doctors Clinics Hospitals Dentists Pharmacies Health plans Insurance companies HMOs Company health plans (self-insured plans)

9 Providers: Covered A health care provider who submits claims electronically On whose behalf claims are submitted electronically (a billing service)

10 Providers: Not Covered Providers who submit paper claims Providers who do not bill for services (i.e. paid by employer, school, prison, charity, etc.)

11 HIPAA Privacy Rule What is protected? Protected Health Information (PHI) is Information relating to past/present/future health condition, treatment or payment Information identifying an individual (such as name, address, SSN, etc.)

12 PHI Medical records Vaccination history List of patients names and service dates List of patients full dates of birth and dates of hospital visit List of patients addresses and chief health complaints List of employee numbers and primary care doctors Not PHI List of Social Security Numbers Health information without any personally identifiable information attached List of employee names List of patients dates of birth excluding the year and date of hospital visit List of employee addresses

13 General Privacy Rule How does it work? A covered entity may only use or disclose protected health information (PHI) for treatment, payment and health care operations (TPO) without obtaining an individual s authorization Written individual authorization is required for disclosures for other purposes Exception: Covered entity is still required to disclose PHI to the individual upon request and to HHS for compliance monitoring, regardless of authorization

14 Minimum Necessary Covered entities and business associates must make reasonable efforts to limit the use or disclosure of, and request for, PHI to minimum amount necessary to accomplish intended purpose

15 Minimum Necessary Exceptions Disclosures to or requests by providers for treatment Disclosures to individual Uses/disclosures with an authorization

16 Reasonable Reliance Covered entities may reasonably rely upon requester s determination as to minimum amount necessary if: Public official Another covered entity Business associate for provision of professional service Researcher with IRB/privacy board documentation or other appropriate representations

17 Authorization to Release PHI A valid authorization must contain: A specific and meaningful description of the information The name or other specific identification of the person(s) or class of persons authorized to make the requested use or disclosure The name or other specific identification of the person(s) or class of persons to whom the covered entity may make the requested use or disclosure

18 Authorization to Release PHI A description of each purpose of the requested use or disclosure the individual may simply state at the request of the individual An expiration date or expiration event that relates to the individual or the use or disclosure purpose A statement of the individual s right to revoke the authorization in writing, procedures for revoking authorization and exceptions to this right

19 Authorization to Release PHI A statement that the PHI used or disclosed based on the authorization may be subject to redisclosure by the recipient and may no longer be protected by HIPAA s privacy rules The individual s dated signature

20 Accounting for Disclosures Covered entity must maintain log of disclosures for six (6) years Any disclosures, other than for TPO or those authorized by individual, must be recorded Maintain record of to whom, date, description, purpose Any disclosures for or access to electronic health records (new HITECH Act)

21 Administrative Requirements for a Covered Entity Designate a Privacy Officer Provide training to employees as necessary and appropriate to their function

22 Privacy Notice Health care providers must receive written acknowledgement from the patient that the patient has received the written privacy rights notice

23 Privacy Notice Terms Written in plain language Include required Header on Notice Required provisions in 45 C.F.R (b) includes explanation of privacy practices of covered entity Material changes to areas covered in notice requires redissemination

24 Business Associates Those who utilize PHI in performing a function on behalf of a covered entity Repricing Quality assurance Benefit management Processing or administration Claims processing or administration Data analysis Utilization review Billing Practice management Any other activity regulated by HIPAA s administrative simplification rules

25 Business Associates Those who perform services for a covered entity and utilize PHI Legal Accounting Data aggregation Administrative Financial services Actuarial Consulting Management Accreditation

26 Business Associate Agreements Written agreements with business associates Under HITECH Act held to standards of covered entities

27 OCR Investigations and Civil Lawsuits Patient or employee may file a complaint with OCR OCR may conduct an investigation and compliance review based on a complaint or a breach notification report

28 OCR Investigations and Civil Lawsuits OCR s review may result in a settlement agreement or penalties (civil or criminal) Patient may file a lawsuit under state law for negligence, breach of privacy or wrongful disclosure

29 OCR Audit Program Press Release (March 21, 2016)

30 OCR Audit Program Mostly desk audits, with some onsite Begins with verification of contact information and pre-audit questionnaire Selected providers will be subject to a compliance review of HIPAA policies and procedures

31

32 Typical Auditor Requests HIPAA policies and procedures Notice of privacy practices Security risk assessments Business associate agreements Staff training documents Breach notification letters

33 OCR Audit Program Requested documentation must be provided to auditor within 10 business days of audit notification letter Response to draft audit findings must be submitted within 10 business days Final audit report is provided in 30 business days from the response

34 Virginia Health Records Privacy Law Code :03 Recognizes individual s right of privacy in content of health records Health records are property of health care entity that maintains them

35 Virginia Health Records Privacy Law No health care entity or other person working in the health care setting may disclose an individual s health records except when permitted by law Redisclosure only with an individual s specific authorization except as permitted by law, including HIPAA

36 Privacy Law Exceptions Compliance with a subpoena meeting the requirements specified in subsection H and subsection C of Section Disclosure of a patient s record where the patient has brought suit against the health care provider

37 Privacy Law Exceptions Public health reporting, such as child or adult abuse Third-party payors for purpose of reimbursement

38 Privacy Law Exceptions Law enforcement (limited information) to identify or locate suspect, fugitive, sex offender, material witness, missing person

39 Privacy Law: Subpoenas Subpoenas in civil, criminal or administrative action for health records must meet the following: Non-party witness must be notified of the subpoena for their records simultaneously with the filing request or issuance of the subpoena

40 Privacy Law: Subpoenas Return date no earlier than 15 days from the date of subpoena except by court order or administrative agency for good cause shown Party requesting subpoena must determine whether individual whose records are being sought is pro se or non-party

41 Privacy Law: Subpoenas Pro se or non-party witnesses shall receive statement informing them of their rights and remedies contained in the law Required notice to health care providers must accompany subpoena

42 Privacy Law: Subpoenas Must notify provider if after 15 days no motion to quash is filed If motion to quash is filed, party seeking the record by subpoena must certify in writing to the entity the outcome of the proceeding as required by the law

43 Privacy Law: Subpoenas A copy of the court s decision must accompany certified notice The health care provider that receives a subpoena must respond to: a subpoena issued in Virginia a federal subpoena

44 Privacy Law: Subpoenas If motion to quash is filed, records should be sent to clerk of court that issued subpoena, or where action is pending, in sealed envelope with cover letter that indicates records to be held under seal pending outcome of motion to quash Place both inside another envelope

45 Privacy Law: Subpoenas The health care provider may choose to file a motion to quash a subpoena when it deems it necessary, such as a subpoena that is overly broad, etc.

46 Out-of-state Subpoenas Not valid in Virginia Exception: federal subpoena However federal subpoena must still follow Virginia process

47 Recent Medicaid Audit Issues

48 Error Code 911 Criminal record checks must be documented and made available for review by DMAS

49 Error Code 911 Criminal record checks must be completed for employees by Virginia State Police within 30 days of employment and before the employee has begun working in direct contact position

50 Error Code 911 Requirement also applies to volunteers who do not work with the permission or under the direct supervision of an individual who has received a criminal record clearance

51 Error Code 911 Proof that the checks were completed (with satisfactory results) must be made available for review by DMAS staff or its designated agent DMAS will not reimburse services performed by anyone convicted of committing a barrier crime

52 Error Code 914 Individual records must be separated from those of other services, such as companion services or home health. If personal care and respite care services are received, one record may be maintained but separate sections must be reserved for documentation.

53 Error Code 928 Aide records must be written in English

54

55 Error Code 931 Aide records must contain weekly comments if the aide indicates that the individual s condition has changed or has an observation about the individual s response to services

56 Error Code 931 DMAS-90

57

58 Records must contain the DMAS-90, which shows the specific services delivered by the aide aide's actual daily arrival and departure times aide's weekly comments or observations any other information relevant to the individual's care signature and date of aide and individual/caregiver

59 Questions

60 This is provided as an informational service and does not constitute legal counsel or advice, which can only be rendered in the context of specific factual situations. If a legal issue should arise, please retain the assistance of competent legal counsel.

61 Thank You Jonathan M. Joseph Christian & Barton, LLP 909 East Main Street, Suite 1200 Richmond, Virginia