The Federal Trade Commission (“FTC”) has again extended enforcement of the Red Flag Rules, now until June 1, 2010.

The latest delay comes at the request of Congress, which is considering a bill that amends the identity theft rule by eliminating entities with fewer than 20 employees from complying.  The House of Representatives passed that bill in late October 2009. The bill is now in the hands of the Senate.

The Red Flag Rules impact financial institutions and creditors subject to FTC jurisdiction. According to the Rules, created under the Fair and Accurate Credit Transactions Act, creditors of covered accounts must establish a program to detect, prevent and mitigate identity theft.

Originally, the Red Flag Rules would have taken effect on November 1, 2008, which was then extended to May 1, 2009, and then further extended to November 1, 2009.

For more information on the Red Flag Rules, visit: http://pvwlaw.wordpress.com/category/red-flag-rules/.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

The Centers for Medicare & Medicaid Services (“CMS”) has announced that most hospitals will receive an inflation update of 2.1 percent in their payment rates for services provided to Medicare beneficiaries in outpatient departments.  Due to a Medicare requirement, CMS will reduce the update by 2.0 percentage points for hospitals that did not participate in quality data reporting for outpatient services or that did not report the quality data successfully, resulting in only a 0.1 percent update for those hospitals. 

CMS also announced that ambulatory surgical centers (“ASCs”) will receive a 1.2 percent inflation update starting January 1, 2010.  CMS projects that the aggregate Medicare payments to more than 4,000 hospitals and community mental health centers in calendar year (“CY”) 2010 will be approximately $32.2 billion, while aggregate Medicare payments to approximately 5,000 ASCs will total $3.4 billion.

The payment updates are included in a final rule with comment period that revises payment policies and updates the payment rates for services provided to beneficiaries during CY 2010 in hospital outpatient departments under the Outpatient Prospective Payment System (“OPPS”) and in ASCs under a revised rate-setting methodology that was established January 1, 2008.

The updated payment rates are meant to ensure that Medicare beneficiaries continue to receive high quality and efficient care in the most appropriate setting.

The CY 2010 OPPS/ASC final rule with comment period will be included in the November 20, 2009 Federal Register.  Comments on designated provisions are due by 5:00 p.m. EST on December 29, 2009.  CMS will respond to comments in the CY 2011 OPPS/ASC final rule.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Employers with group health plans need to provide Medicare Part D notices of creditable or non-creditable coverage to Medicare-eligible individuals by November 15, 2009.  Employers can satisfy this requirement by including the notice in enrollment materials or in separate mailing during the fall. When preparing materials for distribution this fall, employers should be aware of revised model notices provided by the Centers for Medicare & Medicaid Services (“CMS)”.

Background

The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 requires group health plans that provide prescription drug coverage to disclose to individuals eligible for Medicare Part D whether their coverage is “creditable.”  Basically, prescription drug coverage is considered “creditable” if it is at least actuarially equivalent to (i.e., at least as good as) the Medicare Part D coverage. This disclosure is very important because individuals who do not enroll in Medicare Part D when first eligible and who have gone more than 63 days without creditable coverage generally will have to pay higher premiums permanently when they finally enroll. Thus, individuals need to know the status of their group health plan coverage in order to make an informed decision about enrolling in Part D.

Notices regarding whether prescription drug coverage is creditable or non-creditable must be provided –

• prior to the start of the annual Part D enrollment period (November 15 through December 31 of each year);
• prior to an individual’s initial enrollment period for Part D;
• prior to the effective date of coverage for a Part D-eligible individual who joins an employer plan;
• when an employer’s prescription drug coverage ends or changes status as creditable coverage; and
• upon a beneficiary’s request.

The deadline for providing annual creditable coverage notices this year is November 15.

Revised Notices Posted

Earlier this year, CMS posted revised model notices and updated guidance regarding creditable coverage disclosures. The changes to the model notices and guidance are minimal.  CMS recommends, but does not require, that personalized notices be provided upon request to enable individuals to show proof of prior creditable coverage when enrolling in a Part D plan.

What Information is Required in the Creditable Coverage Notification?

The information must explain whether the plan sponsor’s prescription drug coverage is creditable. If the coverage is not creditable, this information must also explain that there are limitations on the periods during the year in which the individual may enroll in a Medicare drug plan and that the individual may be subject to a late enrollment penalty.

What Should Employers Do to Comply with the CMS Rules?

It is important for employers to review their current notices and determine whether any changes or updates need to be made so that they are in compliance with the CMS requirements.  If you have any questions in regard to determining whether your group health plan is creditable or non-credible, or in regard to the notice process in general, you should consult your attorney.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Hayes V. Whiteside, M.D., is Chief Medical Officer and Senior Vice President of Risk Management for ProAssurance. Prior to joining ProAssurance in 2004, he practiced Urology for 18 years in Tuscaloosa, Alabama. He received his undergraduate degree from Louisiana State University and his medical degree from Louisiana State University School of Medicine in New Orleans. Dr. Whiteside completed a general surgery internship and residency at LSU in New Orleans and a urology residency at LSU as well. He was Associate Professor of Surgery at The University of Alabama College of Community Health Sciences Division of Surgery in Tuscaloosa. He also served as Chairman of the Tuscaloosa County Board of Health from 2002-2006. He remains active in numerous medical societies and professional organizations.

For more information on Dr. Whiteside and ProAssurance, visit www.proassurance.com.

Q. Nebraska passed “I’m Sorry” legislation a few years ago. The intent of the legislation is to provide physicians the opportunity to apologize to a patient for a negative result without having such apology used against the physician in a medical malpractice lawsuit. Do you think that physicians should take advantage of such legislation? If so, in what instances? What is the danger of writing such a letter?

Dr. Whiteside: One of the most challenging situations a physician faces is delivering bad news to patients and families.  To facilitate the process of delivering such news, many states, like Nebraska, have enacted “apology laws” to prevent expressions of sympathy from being introduced as evidence of wrongdoing in professional liability lawsuits. At the outset, physicians who face such a situation should contact their professional liability carrier and the facility’s risk manager to assist in disclosure and communication with the patient and family. If at all possible, physicians should have these conversations in-person, so that the patient and family can see the physician’s concern, ask questions, and explore options. When disclosing unexpected outcomes and delivering expressions of sympathy, whether in-person or in a letter, it is important to acknowledge that the event occurred.  Depending on the situation, an apology that the event happened may be desirable or appropriate, but physicians should refrain from accepting blame for the event. The conversation, including the names and relationships of those present, should be documented in the patient’s medical record.  Physicians know it is impossible to prepare for every difficult situation that may arise; however, general preparation for disclosure of adverse events is good risk management, just like a fire drill.  Furthermore, development and maintenance of an open and strong patient relationship may prevent deterioration of the relationship should an unexpected outcome occur.  

Q. If you were to review the office procedures for a medical practice, what three or four procedures would you want to see (1) in writing, and (2) actively followed?

Dr. Whiteside: As the face of medicine changes (practice trends, technological advancements, etc.), static written procedures are not always adequate.  Naturally, easy-to-understand-and-implement processes that are well-known to the office staff are more likely to be followed.  An important process is tracking and following up on diagnostic tests/imaging studies, lab results, and referrals. Follow-up with patients who have missed or cancelled appointments is a key process for physician practices.  Another important process is telephone triage, recognition of urgent/emergent complaints and provision of physician-approved responses to common questions or problems by the office staff.  As important as the actual processes is the staff’s knowledge and understanding of their important role in patient safety and risk management.

Q. It is often said that the physician/patient relationship is an important aspect of a successful treatment relationship. Do you agree with that statement? If yes, what would be important in the physician/patient relationship?

Dr. Whiteside: Without a doubt. Physicians and other medical professionals can tell you that patients who perceive that they have a good relationship with their physicians are less likely to sue, even in the face of an adverse outcome.  Effective risk management begins as soon as a professional relationship is established with a patient, and effective communication is the cornerstone of a successful physician/patient relationship, with understanding, compliance, and satisfaction ultimately depending on both verbal and written communication. Good communication improves actual care and the patient’s perception of the care that he or she receives: two key ingredients to deterring lawsuits. Patient education is important, as well, because patients who don’t understand what medicine can and cannot do for them may mistake a known complication, adverse event, or unanticipated outcome as “bad medicine.” Educating patients doesn’t have to be technical or lengthy, but efforts should be as thorough as possible. It’s a good idea to keep a patient’s fears in mind – we recommend physicians check a patient’s understanding by asking him or her to repeat any key points, as well as asking the patient to relay any questions or concerns. We also recommend encouraging the patient to take an active role in his or her course of treatment. Patient non-compliance, which often leads to adverse events, is frequently associated with a patient’s failure to understand his or her condition, the rationale for treatment, and the important role he or she play in achieving positive outcomes.

Q. What factors are particularly important in terms of quality documentation?

Dr. Whiteside:  The primary function of a medical record is to provide a complete and accurate description of a patient’s medical history, medical conditions, diagnoses, care and treatment, and response to such care and treatment. Proper documentation within the medical record can support a physician’s defense and illustrate his or her commitment to the patient’s care.  Whether to a jury, third party payor, or another physician, proper documentation gives physicians credit for the good care they are providing.  We recommend documentation be legible, timely, chronological, accurate, thorough, and objective. Documentation should include tests ordered, past medical histories, allergies, and medication lists. Discussions with patients, such as informed consent discussions or discussions regarding a patient’s noncompliance, should be documented and include the names and relationships of anyone present. Physicians or staff should document if printed educational materials are provided or if the patient watches an online program or video.  In order not to taint the documentation of the good care being provided, physicians should not alter the medical record.  Corrections and addenda should be transparent, and a physician’s professional liability carrier may be of assistance before documentation mistakes are made.  Again, physicians should receive credit for the good care they are providing, and proper documentation is the means to that end. 

Q. If you were to create a preventive law checklist for medical practices, what would be three or four of the most important things on that checklist?

Dr. Whiteside: The benefits of preventive practices include quality patient care, promotion of patient safety, open and strong patient relationships, compliance with laws and regulations, and protection from liability. A preventive checklist to achieve those benefits might incorporate the following:

1. Physician-approved telephone triage protocols for both office and after-hours calls that address what complaints require immediate attention, frequently asked questions and common problems, and parameters to determine if an office visit or other action is necessary.
2. Documentation of all patient telephone calls, during and after regular office hours, which includes the date/time of the call, subjective information provided by the patient/family, advice or instructions given, and prescriptions phoned in to a pharmacy (with medication name, dosage, frequency, amount, any refills, and the pharmacy utilized).
3. A system to track missed or cancelled appointments, referrals and consultations, and test and lab results, including documentation of all steps and efforts to reschedule patients or obtain information.
4. Documentation of informed consent discussions, which includes the physician’s discussion regarding the risks, benefits, and consequences of non-treatment; the patient’s agreement with the plan; and any state law documentation requirements.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Bill Lamson is a partner of Lamson, Dugan and Murray and Chairman of the Firm’s Litigation Department.  Bill is well recognized and highly sought in the area of medical malpractice defense. 

Mr. Lamson is a 1969 graduate of the University of Nebraska. He was inducted into the American College of Trial Lawyers in 1985 and the International Society of Barristers 1996. He is also a member of the Nebraska Defense Lawyers Association, and a member of the Defense Research Institute.

For more information on Bill Lamson and the well respected law firm of Lamson, Dugan and Murray, see www.ldmlaw.com

Below are Mr. Lamson’s responses to our series of questions on medical malpractice:

Q.  Nebraska passed “I’m sorry” legislation a few years ago.  The intention of the legislation is to provide physicians the opportunity to apologize to a patient for a negative result without having such apology used against the physician in a medical malpractice lawsuit.  Do you think that physicians should take advantage of such legislation?  If so, in what instances? What is the danger of writing such a letter?   

Mr. Lamson’s response:  States that have passed “I’m sorry” statutes have differed in the scope of protection provided.  The Nebraska statute, like most others, is narrowly drafted to protect only statements of sympathy or compassion, but not statements of fault in relation to an unanticipated outcome of medical care. 

Expressions of apology and sympathy are important in building relationships of trust with patients and families.  On the other hand, expressions of fault or other explanations regarding an unanticipated outcome often require speculation on the part of the physician and will be admissible as evidence should the physician be sued and the case proceed to trial.  Physicians should therefore provide apologies with caution, understanding the limitations of the protection afforded by the “I’m sorry” statute.  

The discussion of legal issues related to this legislation is not to be confused with requirements set forth in physicians’ codes of ethics, such as the AMA Code of Medical Ethics, which should always be observed.     

Q. If you were to review the office procedures for a medical practice, what three or four procedures would you want to see (1) in writing; and (2) actively followed?

Mr. Lamson’s response:

Responding to patient phone calls and documentation thereof

Follow-up on outside lab/test results

Updating patient’s recent history, especially re: other physicians seen, medications prescribed by other physicians

Documentation of Patient Education/Informed Consent

Q.  It is often said that the physician/patient relationship is an important aspect of a successful treatment relationship.  Do you agree with that statement? If yes, what would be important in the physician/patient relationship?

Mr. Lamson’s response:

Yes.

Patients who sue are often angry about perceived attitudes on the part of the physician.  They describe a lack of caring, or indifference, and lack of listening to the concerns of the patient or family.  This is often a misperception of which the physician is unaware.  Taking steps to avoid this will benefit the patient and lessen the risk of litigation for the physician. 

 Trust is important in a physician/patient relationship.  Trust can be established by communicating with the patient on a level that he/she understands and allowing the patient to be involved to a reasonable extent in medical decision-making.  It is also established by speaking frankly with the patient while remaining nonjudgmental regarding personal medical issues.  Taking time to listen to patient concerns and to answer questions goes far in demonstrating an attitude of caring.  All of these actions are likely to assist in the establishment of a successful physician/patient relationship.        

Q.  What factors are particularly important in terms of quality documentation?

Mr. Lamson’s response:

Documentation entries should be dated and timed, legible, and factual.  They should provide enough information to tell a story that allows the physician or other healthcare provider to understand what has been going on with the patient.  Interdisciplinary communications should be documented, as should communications with consulting physicians and with the patient or family.  Patient education/informed consent should always be documented in the medical record, the specificity of which depends on the circumstances.  Errors should be corrected by lining through; never obliterate or attempt to change a medical record after-the-fact.  With electronic charting, avoid the temptation to simply “choose from the menu.”  Individualize by entering annotations as necessary.   

Q. If you were to create a preventive law checklist for medical practices, what would be three or four of the most important things on that checklist?

Mr. Lamson’s response:

Perform an appropriate history/physical examination before prescribing any medication or treatment for a patient.

Formulate a (differential) diagnosis when a patient is seen for a medical complaint.

Follow-up after ordering any medication or treatment, or additional testing.

Communicate with the patient/family regarding diagnosis, treatment, and recommendations; allow time for patient questions and input; ensure patient understanding.

Document all of the above.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

John Marshall is currently head of the Healthcare Risk Services practice area for SilverStone Group.  Throughout his career, John has developed an expertise in medical malpractice insurance and risk management for the healthcare industry.  John is a regular speaker and writer on risk management. The Silverstone health care team works to develop strategies to reduce the total cost of risk for clients in the healthcare industry.

Tim Langdon has an undergraduate background in Health Administration & Policy and a post graduate degree in law. Tim’s role is to develop unique risk management strategies.  Tim is a frequent writer on speaker on health care risk management strategies.   

For more information on John Marshall and Tim Langdon, including more detailed bios, and the SilverStone Group, visit http://www.silverstonegroup.com/.

Below are Mr. Marshall’s and Mr. Langdon’s responses to our series of questions on medical malpractice:

Q.  Nebraska passed “I’m sorry” legislation a few years ago.  The intention of the legislation is to provide physicians the opportunity to apologize to a patient for a negative result without having such apology used against the physician in a medical malpractice lawsuit.  Do you think that physicians should take advantage of such legislation?  If so, in what instances? What is the danger of writing such a letter?

Mr. Marshall’s and Mr. Langdon’s Responses:

“I’m Sorry” legislation has gained much attention for promoting physician apologies to patients while seeking to shield them from liability, but there are some unintended consequences of doing so that are often overlooked.  Every physician, under the terms of their professional liability insurance, has a duty not to compromise the ability of the insurer to defend against a claim.  Therefore, it is important for a physician or health care facility to involve their insurance company as soon as possible when there is a potential claim.  This will allow the physician to work with the insurer to craft an appropriate “I’m Sorry” response.  Doing so will lessen the risk that an otherwise protected expression of sympathy or compassion will be construed as compromising the insurer’s position, thereby placing the physician’s malpractice insurance at risk.

Regarding “I’m Sorry” legislation in general, there is a scarcity of research on the ability of apologies to reduce litigation.  Insurance carriers have had success rates in defending and closing claims with no payment in excess of 90% and it will take a substantial amount of evidence to move the industry away from a “defend and deny” strategy.

Last, there remains an open and significant question regarding the programs in place with some insurance carriers that rely on apologies and small payments to claimants to avoid full blown lawsuits.  These “Early Resolution” claims programs may result in more claims reported to the National Practitioner Data Bank than would occur under a standard “defend and deny” strategy.  This includes claims without merit that would otherwise be defeated, but instead (and wrongly) are settled for a small amount and reflect negatively on a physician’s reputation.

Q. If you were to review the office procedures for a medical practice, what three or four procedures would you want to see (1) in writing; and (2) actively followed?

Mr. Marshall’s and Mr. Langdon’s Responses:

Policies and procedures for safeguarding PHI and other valuable patient data (e.g. financial information) to prevent identity theft.

The follow-up process for ALL test results.

Guidelines for staff on friendly and appropriate interactions with patients.  Happy patients will be life-long patients and are the ones least likely to sue you.

 Q.  It is often said that the physician/patient relationship is an important aspect of a successful treatment relationship.  Do you agree with that statement? If yes, what would be important in the physician/patient relationship?

Mr. Marshall’s and Mr. Langdon’s Responses:

Absolutely.  Mutual trust and respect are crucial to a successful physician/patient relationship because they form a foundation for open communication.  Both parties must be able to share information freely, discuss concerns, and ask questions to ensure an optimal treatment outcome.  Both parties to the relationship must not the let the gap in knowledge between patient and physician dictate how they interact.  This simply means patients and physicians must look at each as equals working toward a common goal of better health.  Additionally, physicians should challenge their patients’ understanding of treatment options and instructions.  Physicians should also adjust the content and style of their communications to meet the unique needs of each patient.

Q.  What factors are particularly important in terms of quality documentation?

Mr. Marshall’s and Mr. Langdon’s Responses:

Truthfulness, accuracy, timeliness, and legibility are vitally important to quality documentation.  Most importantly though is that that there is sufficient quality documentation in the first place.  A growing focus of Medicare and Medicaid fraud investigations, particularly audits by Recovery Audit Contractors, are services rendered without proper documentation.  Without the right documentation, physicians will have to forfeit payment received for these services and further, put themselves at risk for additional fines, penalties, and in extreme cases, exclusion. 

Q. If you were to create a preventive law checklist for medical practices, what would be three or four of the most important things on that checklist?

Mr. Marshall’s and Mr. Langdon’s Responses:

First, recognize where your best opportunities to transfer risk are.  Some risks are insurable, but the majority of risks can only be addressed through proactive measures.  Allocate your risk management dollars as best suits your needs and risk tolerance.  Second, ensure that a comprehensive set of policies and procedures are in place, but more importantly, that the staff actually follows them.  Last, recognize where you have had problems in the past and proactively address these areas first.  This may seem simple, but it’s far easier to ignore a mistake and its resolution then it is to take steps to prevent the mistake from happening again.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Major changes to the federal anti-self-referral rules known as the Stark law take effect October 1, 2009.  These changes were approved over a year ago, and could potentially cause many physician-hospital arrangements to fall out of compliance if doctors are not prepared. Lack of knowledge of the Stark law revisions or the structure of a particular agreement will not excuse physicians from liability.

The changes to the Stark law make it much more difficult for physicians and other entities providing designated health services to enter into joint ventures around hospital services. Stark is a strict-liability statute, so even if physicians have innocent intentions, they are still subject to penalties for violating the statute.

The Stark law generally prohibits physicians from referring patients to entities in which they have a financial stake, although there are several exceptions to the rule. In August 2008, the Centers for Medicare & Medicaid Services (“CMS”) issued a final rule making broad revisions to the Medicare hospital inpatient prospective payment system that will restrict:

• So-called “under arrangements,” where hospitals contract with physician-owned entities to provide a broad range of ancillary services, such as clinical labs or imaging services.
• Per-use or “per-click” payments for equipment and space leases.
• Compensation deals based on a percentage of revenue generated by space or equipment use.

The changes were delayed one year from the original October 1, 2008, implementation date.

In order to comply with the changes to the Stark law, physicians will need to restructure contracts to narrow the scope of services they perform for a hospital.  For example, a physician-owned entity may need to limit its clinical services but still could conduct billing and management activities.

How Should Physicians Prepare for the Stark Changes?

Here are some steps physicians can take to ensure compliance with the rules taking effect October 1, 2009:

• Consult an attorney to determine whether current hospital joint ventures or space and equipment leases will continue to be compliant with Stark.
• Review contracts for clauses that allow parties to amend or dissolve agreements as a result of changes in the law. Be sure to include such clauses in future contracts.
• Consider restructuring existing deals to limit the scope of services provided or to take advantage of other applicable safe harbors. In some instances, physicians may be forced to unwind the arrangements.
• Make sure any changes to compensation reflect fair market value.
• Review any state self-referral laws.
• Make any changes to agreements in writing.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Introduction

As many of you are aware, the American Recovery and Relief Act of 2009, better known as the “Bailout Bill”, did much more than funnel government spending in an effort to boost the economy.  Within the Bailout Bill package, Congress enacted a separate act known as the Health Information Technology for Economic and Clinical Health Act, known as the HITECH Act.  HITECH included several important changes to substantive law, and mandated the Department of Health and Human Services (HHS) to promulgate new regulations under HIPAA.  On August 24, 2009, HHS issued interim final regulations, effective September 23, 2009, implementing several of the changes mandated by HITECH.  Other changes will not take effect until February 2010.  Health Care providers and their Business Associates subject to HIPAA requirements should be aware of several fundamental reforms contained within the law. 

Breach Notification 

HITECH requires any Covered Entity (such as a health plan, health care clearinghouse, or health care provider) holding or using “unsecured” protected health information to notify the affected individuals in the even there is a breach of that individual’s protected health information (“Breach Notification”).  Any breach must also be reported to HHS and, under some circumstances, to the local media as well.  Essentially, covered entities and business associates are now required to act as their own whistleblowers.  This Breach Notification requirement was promulgated in an interim final rule on August 24, 2009 and takes effect September 23, 2009.

The Breach Notification rule requires that Covered Entities must notify affected individuals “without unreasonable delay” and in no case more than 60 days after the breach is “discovered”.  A breach is treated as discovered when it is known to the entity, employee, or agent of the entity.  An unknown breach will be treated as discovered if it would have been known had the entity exercised “reasonable diligence”.   This highlights the importance of having internal policies in place to ensure that any breach will be promptly discovered, reported, and dealt with.

As mentioned above, Covered Entities are also required to provide notice to the Secretary of HHS and, in some cases, local media outlets.  If the breach affects more than 500 residents of a state or jurisdiction, the entity must notify “prominent media outlets” “without unreasonable delay” and in no case more than 60 days after discovery of the breach.  In the case of such a large breach, the entity must notify HHS contemporaneously with the sending of individual notices, according to the procedure on the department’s website.   If the breach affects less than 500 residents, there is no requirement to notify the local media.  There is also no immediate requirement to notify HHS.  Instead, the entity is required to maintain a log of all breaches and notify HHS within 60 days of the end of the calendar year of all breaches during the prior year according to the procedure outlined on HHS’s website. 

The new regulations list specific guidance regarding the content of the required notice.  The notice must be in writing and sent via first-class mail, unless the individual has otherwise agreed to electronic notification.  Five topics are required to be addressed within the contents, all written in “plain language”.

Business Associates of Covered Entities (anyone handling protected health information on behalf of a Covered Entity) are required to notify the covered entity for which they are providing services of any breach discovered by the Business Associate.  Again, this notice must be given without unreasonable delay and in no case more than 60 days after the discovery of the breach.  Rules similar to those imposed on covered entities for the determination of when a breach is “discovered” also apply to Business Associates.    

Only those covered entities or business associates dealing in “unsecured” protected health information are subject to the Breach Notification requirements.  To avoid being deemed to be operating “unsecured”, the Covered Entity or Business Associate may conform to the guidance for technologies and methodologies issued by HHS on April 27 in order to qualify for a safe harbor from the definition of using “unsecured” protected health information.  To the extent feasible, Covered Entities and Business Associates should comply with this guidance to avoid being subject to the embarrassing requirements of the Breach Notification rule.

Expansion of HIPAA Coverage

In addition to the Breach Notification rule, HITECH imposes both the HIPAA Security Rule and the HIPAA Privacy Rule directly on Business Associates of Covered Entities.  Prior to this change, Business Associates were not directly subject to the security and privacy requirements of HIPAA.  Instead, Covered Entities were required to obtain “satisfactory assurance” that their Business Associates would safeguard protected health information.  These assurances are typically exchanged through a written Business Associate Agreement.  Only Covered Entities were subject to the civil and criminal penalties of HIPAA should there be a violation of the security or privacy rules, even if such breach was committed by the Business Associate.  The Covered Entity’s recourse against the Business Associate was limited to initiating a lawsuit based on a breach of the Business Associate Agreement.  HITECH changes all this.

Under HITECH, the security and privacy rules of HIPAA are made directly applicable to Business Associates effective February 17, 2010.  Business Associates will thereafter be subject to direct HIPAA enforcement, including the imposition of civil and criminal penalties, for a breach of either rule.  HITECH still contemplates the use of Business Associate Agreements and requires that they be updated to reflect the Breach Notification rule outlined above.

Summary

Several significant changes to HIPAA and its implementing regulations were made by the Bailout Bill.  Health care providers which are Covered Entities under HIPAA and their Business Associates should be prepared to meet the new legal and administrative requirements of such changes.  If you would like to discuss the matters discussed in this article, or any other matter regarding your health care practice, feel free to contact Parsonage Vandenack Williams LLC at your convenience.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Due to the presence of the Internet, patients unpleased with a visit to their physician now have the ability to go online with complaints and posting — often anonymously — critiques of physicians, in much the same way travelers rate hotels on such Web sites as TripAdvisor.

In the past five years more than 40 Web sites, such as RateMDs.com, Angie’s List, Yelp, DrScore and Vitals.com (motto: “where doctors are examined”), have begun reviewing physicians, providing information about one of the more difficult and important decisions consumers make routinely. As the number of these sites grows, questions about their usefulness, accuracy and fairness are also increasing. In some cases the anonymity of the Internet has collided with the rights of physicians who are constrained by laws that protect patient privacy.

As a defensive measure, some physicians are requiring patients to sign broad agreements that prohibit online postings or commentary in any media outlet “without prior written consent.” Although critics call the documents gag orders, claiming they are both unethical and unenforceable, many doctors view them as an appropriate response to websites that not only ask detailed questions about a doctor’s punctuality, availability, communication skills, office staff and the effectiveness of treatment, but also permit comments that may be untrue.

First Amendment Free Speech Implications

The First Amendment of the United States Constitution protects the right to freedom of religion and freedom of expression from government interference.  Freedom of expression consists of the rights to freedom of speech, press, assembly and to petition the government for a redress of grievances, and the implied rights of association and belief. The Supreme Court interprets the extent of the protection afforded to these rights. The First Amendment has been interpreted by the Court as applying to the entire federal government even though it is only expressly applicable to Congress. Additionally, the Court has interpreted the due process clause of the Fourteenth Amendment as protecting the rights in the First Amendment from interference by state governments.

It clear that the First Amendment freedom of speech only applies to the government, and not to private individuals.  Thus, physicians have the right to enter into private contracts with their patients to prevent patients from online postings or commentary in any media without prior written consent.

Benefits of No Complaint Contracts

No complaint contracts help physicians to safeguard their reputations in the era of the internet. Physicians are bound by privacy laws, making it extremely difficult to defend themselves against bogus online allegations. Requiring patients to sign a no complaint contract does not mean a physician is opposed to free speech, it is simply taking preventative action to guard against potential extremely damaging, false speech.

Physicians should consider whether the use of a patient no complaint contract would benefit their particular practice.  For more information on this issue, feel free to contact the health care law attorneys at PVW Law.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Bill Lamson is a partner of Lamson, Dugan and Murray and Chairman of the Firm’s Litigation Department.  Bill is well recognized and highly sought in the area of medical malpractice defense. 

Mr. Lamson is a 1969 graduate of the University of Nebraska. He was inducted into the American College of Trial Lawyers in 1985 and the International Society of Barristers 1996. He is also a member of the Nebraska Defense Lawyers Association, and a member of the Defense Research Institute.

For more information on Bill Lamson and the well respected law firm of Lamson, Dugan and Murray, see www.ldmlaw.com

 Below are Mr. Lamson’s responses to our series of questions on medical malpractice:

Q.  Nebraska passed “I’m sorry” legislation a few years ago.  The intention of the legislation is to provide physicians the opportunity to apologize to a patient for a negative result without having such apology used against the physician in a medical malpractice lawsuit.  Do you think that physicians should take advantage of such legislation?  If so, in what instances? What is the danger of writing such a letter?   

 Mr. Lamson’s response:  States that have passed “I’m sorry” statutes have differed in the scope of protection provided.  The Nebraska statute, like most others, is narrowly drafted to protect only statements of sympathy or compassion, but not statements of fault in relation to an unanticipated outcome of medical care. 

Expressions of apology and sympathy are important in building relationships of trust with patients and families.  On the other hand, expressions of fault or other explanations regarding an unanticipated outcome often require speculation on the part of the physician and will be admissible as evidence should the physician be sued and the case proceed to trial.  Physicians should therefore provide apologies with caution, understanding the limitations of the protection afforded by the “I’m sorry” statute.  

 The discussion of legal issues related to this legislation is not to be confused with requirements set forth in physicians’ codes of ethics, such as the AMA Code of Medical Ethics, which should always be observed.     

Q. If you were to review the office procedures for a medical practice, what three or four procedures would you want to see (1) in writing; and (2) actively followed?

Mr. Lamson’s response:

Responding to patient phone calls and documentation thereof

 Follow-up on outside lab/test results

 Updating patient’s recent history, especially re: other physicians seen, medications prescribed by other physicians

 Documentation of Patient Education/Informed Consent

 Q.  It is often said that the physician/patient relationship is an important aspect of a successful treatment relationship.  Do you agree with that statement? If yes, what would be important in the physician/patient relationship?

Mr. Lamson’s response:

Yes.

 Patients who sue are often angry about perceived attitudes on the part of the physician.  They describe a lack of caring, or indifference, and lack of listening to the concerns of the patient or family.  This is often a misperception of which the physician is unaware.  Taking steps to avoid this will benefit the patient and lessen the risk of litigation for the physician. 

  Trust is important in a physician/patient relationship.  Trust can be established by communicating with the patient on a level that he/she understands and allowing the patient to be involved to a reasonable extent in medical decision-making.  It is also established by speaking frankly with the patient while remaining nonjudgmental regarding personal medical issues.  Taking time to listen to patient concerns and to answer questions goes far in demonstrating an attitude of caring.  All of these actions are likely to assist in the establishment of a successful physician/patient relationship.        

Q.  What factors are particularly important in terms of quality documentation?

Mr. Lamson’s response:

Documentation entries should be dated and timed, legible, and factual.  They should provide enough information to tell a story that allows the physician or other healthcare provider to understand what has been going on with the patient.  Interdisciplinary communications should be documented, as should communications with consulting physicians and with the patient or family.  Patient education/informed consent should always be documented in the medical record, the specificity of which depends on the circumstances.  Errors should be corrected by lining through; never obliterate or attempt to change a medical record after-the-fact.  With electronic charting, avoid the temptation to simply “choose from the menu.”  Individualize by entering annotations as necessary.   

Q. If you were to create a preventive law checklist for medical practices, what would be three or four of the most important things on that checklist?

 Mr. Lamson’s response:

Perform an appropriate history/physical examination before prescribing any medication or treatment for a patient.

 Formulate a (differential) diagnosis when a patient is seen for a medical complaint.

 Follow-up after ordering any medication or treatment, or additional testing.

 Communicate with the patient/family regarding diagnosis, treatment, and recommendations; allow time for patient questions and input; ensure patient understanding.

 Document all of the above.

© 2009 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com