Civil and Criminal Subpoenas Webinar November 13, 2012 CHA Webinar Welcome Mary Barker California Hospital Association 1
Continuing Education Offered for this Program Health Care Executives CHA is authorized to award 2 hours of pre-approved ACHE Qualified Education Credit (non-ache) for this program toward the advancement, or recertification in the American College of Healthcare Executives. Participants in this program wishing to have the continuing education hours applied toward ACHE Qualified Education credit should indicate their attendance when submitting application to the American College of Healthcare Executives for advancement or recertification. Health Information This program has been approved for 2 continuing education units for use in fulfilling the continuing education requirements of the American Health Information Management Association (AHIMA) in the following core content categories: External Forces: 1, Privacy and Security Hours: 1. Legal CHA is a State Bar of California approved MCLE provider. This activity has been approved for 2 hours of MCLE credit. Nursing Provider approved by the California Board of Registered Nursing, CEP #11924, for 2.4 Contact Hours. 3 Continuing Education Requirements Full attendance, completion of online survey, and attestation of attendance is required to receive continuing education credit for this seminar. Note: only registrant may receive complimentary CEs. If additional participants under the same registration would like to be awarded CEs, a fee of $20 per person, will apply. Post-event survey will be sent to registrant and provide information on how to apply online for additional CEs. 4 2
Program Overview Jana DuBois California Hospital Association Faculty: Edward Fabi, Esq. Edward Fabi, Esq., is registered in-house counsel for Sutter Health, the largest non-profit health care organization in Northern California. Mr. Fabi s primary areas of practice are bio-ethics, regulatory compliance, medical research, and patient consent issues. In addition to developing front-line defense strategies in medical malpractice suits and regulatory compliance complaints, he also educates health care executives, physicians, and nurses on best practices for patient safety and litigation. Prior to joining Sutter Health, Mr. Fabi was an associate at Campbell, Yost, Clare & Norell P.C., a law firm in Phoenix, Arizona, that specializes in health care law and medical malpractice defense of health systems, medical centers, and medical professionals. In addition, he also spent nearly ten years in active duty service with the United States Air Force Judge Advocate General Corps, specializing primarily in Federal civil and criminal litigation. 6 3
The Breaking Dawn: Emerging from the Fog Surrounding Civil and Criminal Subpoenas Edward S. Fabi, Esq. Sutter Health Recent Privacy Breaches Sony (101 million customers) April 2011 PlayStation Network and Sony Online Entertainment user accounts Hackers stole personal data, including credit and debit card information, in a complex attack that could cost Sony and credit card issuers $2 billion 8 4
Recent Privacy Breaches (cont.) Epsilon April 2011 One of the largest email marketing databases run online infiltrated by hackers to gain or compromise consumer email addresses 108 different corporate customers and their customers Chase Best Buy Walgreens Ann Taylor Citigroup Disney Destinations Crate & Barrel Marriot Rewards Target 9 What about Medical Records? Major university medical center (2004 2006) 127 workers peeked into celebrities' medical records without permission, leading to several firings, suspensions and warnings Michael Jackson Britney Spears Maria Shriver Southern California community hospital (2009) Nadya Suleman (March 2009) = $250,000 Undisclosed patients (July 2009) = $187,500 10 5
What about Medical Records? (cont.) Northern California University Hospital (20,000 patients) Sept 2011 The spreadsheet included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges for patients seen at the school s hospital s emergency room during a sixmonth period in 2009 was posted by a billing contractor, Multi-Specialty Collection Services, as a question about how to convert the data into a bar graph The information stayed online for nearly a year 11 What about Medical Records? (cont.) Since the HITECH Act became effective 2009 there have been: 165 reported breaches affecting more than 5,000 patients 104 reported breaches affecting more than 10,000 patients 25 reported breaches affecting more than 100,000 patients 6 reported breaches affecting more than 1,000,000 patients 12 6
What about Medical Records? (cont.) TRICARE (4.9 million patients) Sept 2011 Third-party technology contractor had misplaced backup tapes containing sensitive patient health information while transferring tapes between federal facilities and San Antonio, Texas 13 Medical Record Vulnerabilities September 17, 2012 Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates Inc. (collectively referred to as MEEI ) agreed to pay the U.S. Department of Health and Human Services $1.5 million for the theft of an unencrypted personal laptop containing the electronic protected health information of MEEI patients and research subjects. The information contained on the laptop included patient prescriptions and clinical information. 14 7
Medical Record Vulnerabilities (cont.) June 26, 2012 Alaska Department of Health and Human Services has agreed to pay the U.S. Department of Health and Human Services $1.7 million for the theft of a portable USB storage device possibly containing PHI stolen from the vehicle of an employee. 15 Medical Record Vulnerabilities (cont.) Unauthorized EHR viewings Negligent releases by third-party vendors Lost back-up tapes or computer equipment??? 16 8
Answer: Subpoenas As a system, health care organizations release hundreds of records and thousands of pages of documents on a recurrent daily basis, e.g., medical records, x-rays, billing records, etc. 17 Warning! Subpoenas must be taken very seriously, no matter how much of a disruption they may cause Failure to respond to a valid subpoena, or interfere in any way with compliance, may be subject to a contempt of court citation or arrest 18 9
Warning! However, negligently releasing medical or personal information due to an invalid or fraudulent subpoena can be extremely costly Releasing unnecessary information may bring the medical facility or its employees into the suit 19 What You Will Learn What kind is it? What is proper service? Who is requesting the information? What court is involved? What information do they want? Does the appropriate documentation accompany the subpoena? Can we charge them? How much time do we have? Do we have to appear? Who is required to attend? What if things are missing? How do we explain the change? What if we cannot find the records? 20 10
What Is It? 21 Types of Subpoenas Civil Actions Criminal Actions Workers Compensation Administrative State (California Government Code 11181) Federal (HHS 5 U.S.C. App. 3, 1 11, Public Law 95 452) Rarities Military Federal Out of State Authorization for Requested Information ONLY DISCUSSING STATE CIVIL AND CRIMINAL 22 11
Terminology Subpoena Trial or Hearing Phase Witness Testimony (Records Custodian) Subpoena Duces Tecum (Latin) Trial or Hearing Phase Records Production Deposition Subpoenas Discovery Phase and can be either Records Production or Witness Testimony 23 Terminology (cont.) Notice to Consumer/Notice to Employee Protective Order Objection Affidavit/Declaration Service 24 12
The $64,000 Question Is it valid? 25 What Kind is It? Civil Subpoena most common (e.g., Holmes v. Cruise) Criminal Subpoena (e.g., People v. Conrad Murray) Is it an out-of-state subpoena? The Interstate and International Depositions and Discovery Act (IIDDA) requires the requesting party to submit the subpoena to the local county superior court in order to receive a California ordered subpoena 26 13
What Kind is It? (cont.) Subpoena Subpoena Duces Tecum Deposition Subpoena 27 28 14
What Kind is It? (cont.) Subpoena Subpoena Duces Tecum Deposition Subpoena 29 30 15
What Kind is It? (cont.) Subpoena Subpoena Duces Tecum Deposition Subpoena 31 32 16
What is Proper Service? Service = Delivery Who received it? When was the subpoena received? How it was served (i.e., by mail or personal service)? 33 What is Proper Service? (cont.) Medical facility or individual? Who received it? Proper facility? Proper department? Proper person? When the subpoena was received? Was it served on the same date of the subpoena? Suggestion: Subpoena log or date stamp 34 17
What is Proper Service? (cont.) How it was served (i.e., by mail or personal service)? Personal service required for Subpoena or Deposition Subpoena Service by mail permitted for Subpoena Duces Tecum Criminal Subpoena mail, messenger, or personal service IMPROPER SERVICE = INVALID SUBPOENA! If it was personally served, was the employee authorized by the facility to accept it? (e.g., medical records receiving subpoena for billing records) Wage garnishments If it was mailed, to whom was it sent? 35 How About Fax? Email? 36 18
What is Proper Service? (cont.) Fax NO Tricks: Coversheet confirming acceptance No sending phone number Different dates Email NO IMPROPER SERVICE = INVALID SUBPOENA! 37 Who is Requesting the Information? Patient/Patient s Attorney Opposing Party s Attorney District Attorney/Public Defender Regulatory agency Law enforcement agency If the subpoena is part of an ongoing investigation, to whom is it directed, and what is the nature of that investigation? 38 19
What Court is Involved? California Out of state Federal Military None 39 Please download the entire document on this matter (follow this link) and print it for your records. 40 20
Fake Subpoenas? Attorneys 41 Fake Subpoenas? (cont.) Sheriff/Judge 42 21
What Information Do They Want? Scope Type Records Personal (medical, HR, etc.) Facility (business, policies, schedules, etc.) Items Pathology slides or blocks Surgical instruments 43 What Information Do They Want? (cont.) What is the scope of the information requested? (HIPAA Minimum Necessary Rule) Is the request for information ambiguous? Any and All Records of Britney Spears (DOB 12/02/1981) Is a timeframe for the records specified? Is the information requested within the authority of the requesting government agency? 44 22
What Information Do They Want? (cont.) Are personal records being requested? Is a Notice to Consumer/Employee provided with the subpoena? (Verbal assurances are insufficient.) Is the Notice filled out? Absent Notice to the Consumer/Employee, is an Authorization from the Patient included instead? Is there any documentation indicating a Protective Order? Has an Objection been made? Is the patient dead? MISSING DOCUMENTATION = INVALID SUBPOENA! 45 Are Personal Records Being Requested? (cont.) Apply to Criminal Subpoenas? DA? Public Defender? Badges? We don t need no stinkin badges! - Blazing Saddles (1974) Yes applies to criminal subpoenas via HIPAA Missing documentation = invalid subpoena IMPORTANT: Health and Human Services through OCR Website Is an Authorization provided? Is it still valid? 46 23
Court Orders Subpoena = Court Order? For HIPAA purposes State Subpoenas are not considered Court Orders in Federal Court unless signed by a Judge 47 What Information Do They Want? (cont.) WARNING: PRIVILEGED/RESTRICTED RELEASE INFORMATION Physician-Patient Substance Abuse Treatment Certain medical conditions, e.g., HIV and rhesus blood type, hepatitis B, and HIV pursuant to Health and Safety Code 125080/125085 required prenatal care Psychotherapist-Patient Notes Quality Assurance, e.g., RCA 48 24
What Information Do They Want? (cont.) Are medical facility or office foundation business records being requested? Request must be specific and narrowlytailored 49 Does the Appropriate Documentation Accompany the Subpoena? Did an Affidavit or Declaration accompany the subpoena? Subpoena Duces Tecum Affidavit or Declaration required Deposition Subpoena Affidavit or Declaration NOT required MISSING DOCUMENTATION = INVALID SUBPOENA! If it is for personal records, is a Notice to Consumer/Notice to Employee attached? 50 25
How Much Time Do We Have? Find the date on the subpoena requesting delivery of the documents (e.g., 2 days for criminal subpoena) It is not a race. In fact, you could be hurting the patient or the facility Business records = no earlier than 20 days after issuance or 15 days after service whichever is later Do NOT deliver prior to required date absent specific instructions 51 How Much Time Do We Have? (cont.) Personal records of a consumer (e.g., medical or employment records) = service on consumer must be 10 days before date of production Patient authorization for inspection/copying = minimum 5 days Notice required If more time is required, notify the requesting party as soon as the need is determined 52 26
Do We Have to Appear? Check for statement requiring attendance or appearance required Distance limitation except for Trial If attendance or appearance is not required, then an affidavit signed by the Custodian of Records is necessary Make records/items available for inspection or copying Must give AT LEAST 5 days notice Hospital may require more than 5 days notice Appointment of not less than 6 continuous hours In these specific requests, the facility CANNOT copy the records themselves 53 Who is Required to Attend? Named witness Trapper John, MD Gregory House, MD Doogie Houser, MD Facility employee able to explain the records e.g., person most knowledgeable (PMK) or person most qualified or custodian of records 54 27
What if things are missing? What if the subpoena doesn t have A court seal? A case number? A signature? Does subpoena count? 55 Signatures California Code of Civil Procedure 1985. (c) The clerk, or a judge, shall issue a subpoena or subpoena duces tecum signed and sealed, but otherwise in blank to a party requesting it, who shall fill it in before service. An attorney at law who is the attorney of record in an action or proceeding, may sign and issue a subpoena to require attendance before the court in which the action or proceeding is pending or at the trial of an issue therein, or upon the taking of a deposition in an action or proceeding pending therein; the subpoena in such a case need not be sealed. California Penal Code 1326(a) signed and issued California Civil Code 56.11. An authorization for the release of medical information by a provider of health care, health care service plan, pharmaceutical company, or contractor shall be valid if it: (c) Is signed and dated by one of the following: (1) The patient. 56 28
How Do We Explain the Change? We ve always done it this way You have accepted them in the past Everyone else accepts them like this Due to recent legislative and regulatory requirements under the Health Care Reform Act, HITECH, and HIPAA, proper maintenance and release of medical records are now receiving increased scrutiny from both government regulators and patients. 57 What if We Cannot Find the Records? Do the documents exist or is the witness still employed? Much Ado About Nothing - William Shakespeare 58 29
Can We Charge Them? Must specifically request costs Itemized bill required Reasonable Costs: Check fee schedule Nine different laws governing fees allowed Five federal laws Four California state laws Actual shipping or postage charges Payment due at time of delivery 59 Can We Charge Them? (cont.) Witness fees Civil subpoenas Payment for 1 day may be received 1 day in advance $35 per day unless a treating health care provider being asked for an opinion $.20 per mile both ways Grand Jury Subpoena (Court s Discretion) $12 per day $.20 per mile one way 60 30
Thank you Edward Fabi, JD (916) 286-6685 fabie@sutterhealth.org 61 Questions Online questions: Type your question in the Q & A box, hit enter Phone questions: To ask a question hit 14 To remove a question hit 13 31
2012 Publications California Health Information Privacy Manual EMTALA: A Guide to Patient Anti-Dumping Laws Mental Health Law Minors and Health Care Law Consent Law Principles of Consent and Advance Directives California Hospital Compliance Manual Learn more at www.calhospital.org/publications 63 Upcoming Programs Behavioral Health Care Symposium December 3 4, 2012, Huntington Beach Hospital Compliance Seminar February 5, 2013, Glendale February 13, 2013, Sacramento Post-Acute Care Conference January 31 February 1, 2013, Huntington Beach Health Policy Legislative Day March 12 13, 2013, Sacramento Rural Health Care Symposium March 14 15, 2013, Sacramento 64 32
Thank You and Evaluation Thank you for participating in today s program. An online evaluation will be sent to you shortly. Reminder: evaluation completion is required to receive continuing education credits. For education questions, contact Mary Barker at (916) 552-7514 or mbarker@calhospital.org. 65 33