8/18/2014. Topics For Today s Program. Not All Data Initiatives Are Going As Planned TRANSITION TO ELECTRONIC RECORDS STATUS CHECK

Transcription

1 TRANSITION TO ELECTRONIC RECORDS STATUS CHECK August 24, 2014 Presentation by Jennifer L. Cox, J.D. Cox & Osowiecki, LLC Hartford, Connecticut Topics For Today s Program NEW lab access rule!! (just in case you missed it) EHR adoption across the continuum is slow E-access and portal development Hurdles for minors and sensitive records The future of copy fees More agencies jumping into the mix Meaningful Use continues to challenge Q&A 2 Not All Data Initiatives Are Going As Planned HITECH Meaningful Use Code sets (5010 & ICD-10) PPACA EHR/EMR HITECH HIPAA Changes Data Sharing IT Patient Safety 3 1

2 Rule Change on Lab Result Access CLIA no longer a bar on patient s direct access to lab results -- going forward, mandatory direct patient access similar to any other HIPAA record Effective April 7, 2014 Compliance deadline October 4, 2014 NOPPs must be updated to reflect the change in patient rights Labs must plan on how to achieve direct access Part of trend to eliminate paternalism, give patients greater role in their healthcare 4 EHR Adoption Statistics Good source (even if biased toward government planning) for quick stats on EHR data: CDC also has good and interesting materials Connecticut physicians adoption rate continues to be well below national average in ambulatory setting EHR adoption. Unclear why, or how to fix it. EHR use is growing but at what level? 5 EHR Use Statistics Can Be Deceiving The statistics are hard to take at face value (and feel desperate in some studies). Look at CDC published 2013 statistics: 80% of physicians have used some form of electronic record but only 48% surveyed could perform basic EHR functions The 80% number is useless (and manipulative) 60% of hospitals have at least basic EHR, but only 6% believe that they will be ready for Stage 2 MU By end of June 2014, just 4 hospitals had attested to MU Stage 2 Not 4%, just FOUR (4)!!! 6 2

3 EMR/EHR and Access Challenges HIPAA Privacy is both an access rule and a protection rule The purpose is to empower the patient to control his/her own records while ensuring a level of confidentiality and integrity There is typically over-emphasis on blocking access and insufficient recognition of the access rights portion of HIPAA This can interfere with access rights 7 Patient Access Important to avoid thinking of HIPAA as only a protection of data law it also grants many patient rights to access records One of the most common HIPAA failures is the improper denial of access to records Many providers have fallen into a pattern of only accepting their one, true authorization that approach will eventually cause problems because it does not recognize the powerful access rights granted by the HIPAA Privacy Rule Shorter version: tight release policies are not always consistent with HIPAA 8 Real Life Access Denial Error #1 A private practice denied an individual access to his records on the basis that a portion of the individual's record was created by a physician not associated with the practice. Among other steps to resolve the specific issue in this case, OCR required the private practice to revise its access policy and procedures to affirm that, consistent with the Privacy Rule standards, patients have access to their record regardless of whether another entity created information contained within it. There are still authorization rules for highly sensitive records 9 3

4 Real Life Access Denial Error #2 Patient signed valid authorization to release all of her chart to car insurance adjuster after an accident The provider (improperly) provided her records to her auto insurance company but refused to provide her with a copy of her medical records. OCR also determined that the Center denied the complainant's request for access because her therapists believed providing the records to her would likely cause her substantial harm. Failure: The Center did not provide the complainant with the opportunity to have the denial reviewed, as required by the Privacy Rule. Among other corrective action taken to resolve this issue, the Center provided the complainant with a copy of her records. 10 During Transition, Keep In Mind: Paper Records Still Contain PHI June 2014 $800,000 HIPAA Settlement in Medical Records Dumping Case Parkview Health System, Inc. agreed to settle potential Privacy Rule violation Hospital has delivery guys leave boxes of records in driveway of the practitioner (unattended and unlocked) 11 HIPAA Distinction You Might Have Missed You may have ignored it, because it didn t really matter before, but HIPAA has various release and access rules There is a specific difference between: Direct Patient Requests ( ) Third party requests accompanied by a signed authorization ( ) These are different. Here is when it matters: E-Access Copy Fees Documentation 12 4

5 Minors Records Create Operational Challenge - Particularly for Portals HIPAA says follow state or local law for determining rights of minors Generally, a minor (less than 18 y.o.) does not control his/her own health decisions or records, the minor s parents/guardians control. Common exceptions: HIV & STDs testing and care Abortion counseling Family planning/mature adolescent Inpatient psych care 16 & 17 years old Outpatient counseling under special circumstances Substance abuse treatment If emancipated (qualified as an adult) 13 Highly Sensitive Records Still Exist Other sources of law (state and federal) apply additional protections to sensitive records, including: HIV Mental health, psychiatric care (*different from HIPAA psychotherapy notes) Substance abuse treatment records These highly sensitive areas mean that you must be particularly careful when releasing this information These can frustrate flow of information tension of sharing versus protecting will continue until government changes these rules 14 Copy Fees EHR will cause copy fee compression 15 5

6 Copy Fees Must be Reasonable and Cost-Based for Access Copy fee, for direct patient access, may only include: Supplies and labor for copying PHI, postage, and cost for preparation of a summary (if individual agrees to take summary) Labor costs include compiling, extracting, scanning and burning to media Cost of electronic media (only if patient agrees) Copy fees for third party requests are not as confined stick to $.65 per page per state law 16 Copy Fees Must be Reasonable and Cost-Based Costs that may not be included in fee calculation for direct access: Costs of maintaining systems or capital costs for data access, storage, infrastructure Retrieval fees not permitted (proposed rule said maybe, but final rule says no) Effect: E-copies will be less cost than per page paper State rule overlay: state fee of $.65 per page is a maximum!!! You may not hold a copy request for failure to pay copy fees Do not charge when records are being requested in connection with a social security application DSS has been telling community providers not to charge for Medicaid patient copies 17 How Many Days, Maximum, to Fill Request For Connecticut Providers? 30 Days 18 6

7 Number of Oversight Agencies Grows For oversight of health records and data programs, we have many masters to serve: DPH DSS TJC OCR CMS OIG FDA DOJ CDC 19 FDA Role Debated FDA has been at the edges of EHR/EMR issues, and has expressed an interest in stepping in (but is also waiting for MU to play out) Disagreement among other agencies and experts on what role FDA should play FDA believes it already has an obligation to oversee health IT This belief in its oversight powers extends to health apps, social media etc. While the debate continues, FDA keeps giving its opinion on EMR/EHR issues Causes mostly confusion now, but could someday be a driver 20 Department of Justice and OIG September 2012, DOJ published a threatening letter about cloning medical records and how it would cause fraud and false payments The DOJ threat was heavily criticized for its lack of comprehension of how EHR/EMR works OIG is still on this issue, and continues to assert that cut & paste and cloning features will cause incorrect documentation that results in overpayment OIG report puts all auditors (including contractor auditor programs) on notice to look for EHR features that could cause over-documentation 21 7

8 AHIMA: Cut & Paste Risks Outlines Inaccurate or outdated information Redundant information, which makes it difficult to identify the current information Inability to identify the author or intent of documentation Inability to identify when the documentation was first created Propagation of false information Internally inconsistent progress notes Unnecessarily lengthy progress notes hima/bok1_ pdf 22 When Meaningful Use Started 23 Meaningful Use Challenges Continue Stage 2 attestations are coming in very low (government seems surprised and/or confused) EH and EP still hoping the proposed delay rule will provide more flexibility (rule still not out as of 8/18/14) Some delay is imminent but it is hard to tell if CMS/ONC actually see the problem The most common issues causing slow Stage 2 attestation are difficulty in objectives for patient engagement and HIE objectives OIG has determined that some CEHRT doesn t meet basic NIST security standards Hard to tell where this leads, but it fuels the fire for those who are opposed to MU incentives 24 8

9 Patient Engagement -- Access Provide patients ability to view online, download, and transmit their health information EH: within 36 hours after discharge EP: within 4 business days Available to >50% w/in timeframe 5% (down from proposed 10%) of all patients (or their authorized representatives) actually go online to view, download, or transmit their info This relies on the actions of patients, outside of provider s control, and sets a threshold above historical levels of patient requests for access 25 Three Years Into Meaningful Use 26 Unanswered Questions That Affect EHR s Future Can personal health records emerge as a realistic alternative? (E.g., Blue Button or similar) Are there ways to improve exchanges between providers? Can rules be made that allow more robust use of Opt Out planning Will federal government revise the rules for 42 CFR part 2 How to make patient consent for exchange more routine Is patient engagement a realistic path? 27 9

10 Q & A 10