In the news: patient privacy edition

  • HHS's Office of Civil Rights (OCR) filed a notice in the Federal Register lifting a requirement preventing OCR from posting names of sole practitioners who suffer breaches of patient data without first obtaining consent from such practitioners.  Pursuant to the HITECH Act, any covered entity reporting a breach affecting over 500 individuals must report such breach to HHS, and HHS will post a notice of such breach on its web site.  At the same time, HHS did not post names of individual physician practices (e.g., sole practitioners) without such physicians' consent because they deemed the name of the physician to be protected under the Privacy Act of 1974. Instead, HHS listed such breaches under "private practice."  However, OCR announced on April 16, 2010, that "it will begin posting on its breach notification web site the names of entities they consider "individuals" regardless of whether or not those entities give consent." According to HealthLeaders Media, the rule will become effective after the comment period closes (about May 23, 2010).
  • Government Health IT reports that OCR will issue more privacy and security rules mandated by the HITECH Act in May 2010, including rules regarding business associate liability; new limitations on the sale of protected health information, marketing, and fundraising communications; and stronger individual rights to access electronic medical records and restrict the disclosure of certain information.  According to HHS, "OCR continues work on a Notice of Proposed Rulemaking (NPRM) regarding these provisions. Although the effective date (February 17, 2010) for many of these HITECH Act provisions has passed, the NPRM and the final rule that follows will provide specific information regarding the expected date of compliance and enforcement of these new requirements."
Continue Reading...

Definition of "hospital-based eligible professional" amended

Courtesy of the American Health Lawyers Association:

On April 15, 2010, President Barack Obama signed into law the "Continuing Extension Act of 2010" (Public Law 111-157). Section 5 of the Act contains "EHR Clarification" provisions which amend the definition of "hospital based eligible professional" that was created under the American Recovery and Reinvestment Act of 2009 (ARRA). As background, ARRA created incentives for the adoption and meaningful use of certified electronic health record (EHR) technology. However, the ARRA additions to the Social Security Act (42 U.S.C. 1395w-4) contained a limitation providing, in part, that no incentive payments would be made for these hospital-based eligible professionals.

This term was originally defined to include any professional who furnishes substantially all of the relevant services in a hospital "setting (whether inpatient or outpatient)."1 The new EHR Clarification provisions amend the ARRA definition/exclusion to only apply to a professional who furnishes substantially all of the relevant services in a hospital "in-patient or emergency room setting."2 The effect of this amended definition is that physicians practicing in an outpatient hospital setting are not excluded from and are now eligible to participate in the ARRA Medicare/Medicaid incentive programs.

 

Wall Street Journal on EMRs and HIEs

On April 13, 2010, the Wall Street Journal published two fascinating articles on health information technology issues.  In "Can Technology Cure Health Health Care?" author Jacob Goldstein examined the complexities and major risks of adopting electronic medical records.  Goldstein also suggested a few high-level policies necessary to combat such risks, including designing the software with patient care in mind (rather than focusing on billing and other administrative tasks); customizing the software to fit the unique needs of one's organization; and taking the time to implement the EMR in a carefully crafted, staged manner. 

The last recommendation seems to be indeed crucial to a successful EMR implementation, but it will likely put many healthcare providers trying to capitalize on HITECH incentive payments in a peculiar situation.  Such providers must carefully balance their need to achieve "meaningful use" in a short time frame, while preventing as many disruptions to patient care as possible.

In "Breaking Down the Barriers," Laura Landro examined the state of regional health organizations (RHIOs) and health information exchanges (HIEs). While RHIO/HIE's are still rare, the number of such electronic patient data exchanges grows every day.  In fact, according to the Journal, the number of RHIO/HIE's increased by 57% since last year.  Such exchanges are also likely to benefit from HITECH Act funding distributed by HHS. 

There is an interesting nexus between these two articles:  interoperability and exchange.  A successful widespread adoption of EMR technology seems to depend upon different EMRs talking to each other, and different - including competing - healthcare providers exchanging patient information.  While EMRs may only marginally improve patient care in each individual hospital, they are likely to have a far greater impact as part of a nationwide health information exchange.

"Can Technology Cure Health Care?" Wall Street Journal (April 13, 2010).

"Breaking Down the Barriers," Wall Street Journal (April 13, 2010).

CHIME comments on EHR certification NPRM

In a letter to Dr. David Blumenthal, the College of Healthcare Information Executives (CHIME), an organization which represents1,400 healthcare chief information officers, offered some criticism of ONC's recent notice of proposed rulemaking (NPRM) regarding the EHR certification program.  While CHIME expressed general support for a two-stage approach for creating the certifying bodies, the CIO's are worried about any destabilizing effects such rule may have on the health IT market.  Via Healthcare IT News:

We are very concerned that the introduction of a two-stage approach for certification will prolong the current instability in the health IT marketplace, which exists because of the un-finalized status of meaningful use and certification regulations," CHIME wrote. "The introduction of two separate certification schemes – one temporary and one permanent – carries a risk of continuing the uncertainty and promoting needless product replacement in the marketplace.

CHIME issued a few recommendations to combat such uncertainty, which you can find after the jump.

Continue Reading...

In the news: Senators request easing of meaningful use requirements; HHS releases over $267M for RECs; and more

  • A group of 37 U.S. Senators sent a letter to HHS Secretary Kathleen Sebelius expressing concern regarding the current definition of meaningful use.  The senators urged the Secretary to "allow providers to 'temporarily defer a limited set of IT goals' without otherwise changing the ultimate timeline or requirements of the program."  The senators also sought to change the eligibility determination based on Medicare provider numbers, considering many healthcare providers have multiple medical campuses under one such Medicare number.  According to Sen. Max Baucus (D-MT), such changes would "improve the guidelines HHS has set in way that will encourage widespread use of basic, functional IT tools and improve patient care.”
  • HHS released over $267 million from the stimulus funds to help 28 non-profit Regional Extension Centers (RECs).  This latest award brought the total of stimulus-funded RECs to 60, and is expected to support 100,000 primary care and hospitals within 2 years.  According to Secretary Sebelius, these 28 awards "represent [HHS's] ongoing commitment to make sure that health providers have the necessary support within their communities to maximize the use of health IT to improve the care they provide to their patients."  
Continue Reading...

Connecticut radiologist breaches privacy of hundreds

HealthImaging.com reported yesterday that a Connecticut radiologist, previously affiliated with the Griffin Hospital in Derby, Conn. "accessed patient radiology reports on the hospital's PACS using the passwords of other radiologists and an employee within the radiology department. The passwords were obtained and/or used without their knowledge." From HealthImaging.com:

From the investigation conducted by Griffin, it appears the radiologist who gained unauthorized access scanned the PACS directory listings of 957 patients who had radiology studies performed at Griffin during the period and selected and downloaded the image files of 339 of these patients.

On and after Feb. 26, Griffin received inquiries on behalf of patients regarding unsolicited contact by the physician who offered to perform professional services at another area hospital despite the patients' interest in having those services provided at Griffin. The inquiries prompted the investigation that revealed unauthorized intrusions into Griffin's PACS and, thereby, the breach of protected patient health information.

This should serve as a reminder for healthcare providers regarding maintaining the safeguards necessary to prevent wrongful access to patient data.  For example, and there is no indication that this is what occurred in this case, clinicians and other hospital staff should not keep their system passwords on sticky notes next to or on their monitors.  Even if you believe that everyone in your office is fully trustworthy, you never know who can get a hold of such restricted information as usernames and passwords.  The reputational and financial damage to your organization could be very substantial; and your contract with the PACS system vendor is unlikely to indemnify or protect you from such losses.

"Radiologist breaches data, images of nearly 1,000 patients via PACS," HealthImaging.com (March 31, 2010).

ONC publishes white paper on consent options

The Office of National Coordinator for Health IT (ONC) published on its web site a white paper analyzing the policies behind obtaining consent for the purposes of electronic health information exchange.  The paper examined the concept of patient control of their health information, focusing on "the issues, nuanced considerations, and possible tradeoffs associated with the various consent options to help facilitate informed decision making."  While the paper was written by researchers at the George Washington University, under contract with ONC, ONC clearly stated in the preamble that this white paper does not actually represent the views of the ONC or HHS.

You can find the full paper (and the attachments) by clicking here.  You can view the executive summary by clicking here.