Health IT Law Blog : Health IT Law Blog : Post & Schell: Law Firm : HIT & Electronic Health Records

On August 19, 2010, the "tiger team" advisory panel submitted a letter to the HIT Policy Committee, established pursuant to the HITECH Act, proposing new safeguards for personally identifiable information on health information exchanges.  Via Bloomberg Business Week:

The recommendations were developed in response to a specific set of privacy-related questions raised by the Office of the National Coordinator for Health Information Technology. They touch upon and clarify topics such as patient consent and the use of third-party service providers in the exchange of personally identifiable health information.

<...> One of the bigger recommendations relates to patient consent. The direct exchange of electronic patient data between health providers for treatment purposes does not require any additional patient consent, the panel noted. The same rules that apply to paper or faxed exchanges of health information should apply in the electronic realm as well.

HIT Policy Committee will have to review and approve the proposed safeguards.  You can read more about the proposed standards after the jump, and can read the letter in full by clicking here.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Lincoln Medical and Mental Health Center (LMMHC) in New York suffered a major breach affecting 130,495 of its patients, according to a notice provided to HHS.  The breach occurred when the hospital's contractor, Siemens Medical Solutions USA, shipped seven password-protected, but not encrypted, CDs containing patient information via FedEx; and these CDs were subsequently lost in transit.  Via Bloomberg Business Week:

The CDs were sent by the hospital's billing processor, Siemens Medical Solutions USA, around March 16, but never arrived at their intended destination. They included sensitive health and personal information including Social Security numbers, addresses, dates of birth, health plan numbers, driver's license numbers and even descriptions of medical procedures, the hospital said on a note posted to its Web site.

<...> Siemens is no longer FedExing CDs to Lincoln, the hospital said. It is not aware of any of the data being improperly accessed.

LMMHC's breach should serve as a reminder for all healthcare providers currently negotiating health IT contracts to include proper protections in the event its vendor causes a breach or loss of protected data.  This is particularly crucial in the post-HITECH Act era.  

We always include specific compliance with privacy laws warranties, indemnification clauses and limitation of liability carve-outs for vendor's own negligent acts or omissions which result in a data breach or loss.  LMMHC's example clearly illustrates that providers must insist on such protections -- often, over strenuous objections from vendors -- because, otherwise, providers may be exposed to a wide range of expenses and damages from third-party claims, fines, investigations and breach notification associated with a data breach or loss resulting from vendor's actions.

For more information, please listen to or view the slides from our Webinar on negotiating "must-have" provisions in HIT contracts.

"New York hospital loses data on 130,000 via FedEx," Bloomberg Business Week (June 29, 2010).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Last Thursday, March 18, 2010, from 1:00PM to 2:00PM (EDT), Post & Schell hosted the second webinar in a series examining the effects of meaningful use and other HITECH Act regulations on the healthcare industry. 

The webinar focused on identifying and negotiating the essential elements of HIT agreements, particularly in light of the HITECH Act and related HHS regulations regarding "meaningful use" of "certified EHR technology." Post & Schell's Steve Fox and Vadim Schick, along with Jim Oakes, Principal at Health Care Information Consultants, discussed:

• Warranty, limitation of liability and privacy and security provisions in HIT contracts
• Structuring payments to correspond with certain achievement milestones
• Acceptance testing procedures
• Provisions specific to vendor-financing transactions
• ASP / SaaS models of software licensing

If you missed the presentation, you can listen to the podcast here. You can also view the slides from our presentation here.

This webinar was the second in a series devoted to structuring vendor-provider agreements in the post-HITECH Act world. If you missed our first webinar, A Lawyer's Take on "Meaningful Use," you can still view the slides from that presentation here.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Following up on his letter to health IT companies last fall, Senator Chuck Grassley (R-IA) sent a letter to 31 hospitals in the United States to inquire about each hospital's experience with purchasing and implementing health information technology.  According to Healthcare IT News:

Grassley cites reports he’s heard about “difficulties and challenges associated with HIT implementation,” including “administrative complications,” “formatting and usability issues,” “computer errors stemming from the programs themselves,” and problems with “interoperability between programs.”

More specifically, he raises concerns that “when [providers] report such problems to their facilities and/or the product vendors, their concerns are sometimes ignored or dismissed.” Often, he writes, “this is attributed to alleged ‘gag orders’ or non-disclosure clauses in the HIT contract that prohibit health care providers and their facilities from sharing information outside of their facilities regarding product defects and other HIT product-related concerns."

You can find more about Sen. Grassley's letter to hospitals in his office's press release, which includes the full text of the letter.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A study conducted by the Commonwealth Fund, published in this month's issue of Health Affairs, found that physicians in the United States significantly lag behind their colleagues in Western Europe, Australia and New Zealand in several categories, including rates of adoptions of electronic medical records.  This study of more than 10,000 primary care physicians in 11 countries found that only 46% of U.S. doctors use electronic medical records, compared with almost universal EMR use among doctors in Australia (95%), Italy (94%), the Netherlands (99%), New Zealand (97%), Norway (97%), Sweden (94%), and the United Kingdom (96%).  Among other HIT-related findings, the study concluded that:

<...> among the seven countries with near-universal EMRs, the majority of physicians reported electronic access to lab results, yet fewer than half of Dutch, Norwegian, and U.K. doctors can order tests electronically. Across countries, most doctors with EMRs reported electronic clinical notes, routine electronic prescribing, and computerized alerts about potential problems with drug doses or interactions (except in Norway). Answers varied for other functions.

Decision support appears generally less well developed. Computerized reminders for treatment guidelines, tracking laboratory tests, and prompts to provide patients with test results were the least frequently reported, including in countries with multifunctional capacity. Notably, the seven countries with near-universal EMRs have succeeded in spreading multifunctional capacity to smaller as well as larger practices. Their national policies and standards have supported spread of multifunctional capacity. In contrast, U.S. multifunctional capacity remains concentrated in larger practices. Half of U.S. practices with high-function capacity were associated with integrated care systems such as Kaiser.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

According to the Wall Street Journal's Health Blog:

In letters sent earlier this month to 10 companies, [Senator Chuck] Grassley says that he’s “received complaints” about systems that allow doctors to enter medical orders by computer. (Here’s a copy of the letter.) This is a big deal these days because the stimulus bill provides billions of dollars in federal incentives to encourage doctors and hospitals to start using these sorts of systems.

Grassley asks the companies to send him copies of “complaints and/or concerns” that health-care providers have expressed about the systems. He wants to know whether the companies typically include legal provisions in their contracts that “shift responsibility for errors in the … systems to physicians, nurses, pharmacists, and other health care providers.”

And he cites reports that contracts sometimes “include ‘gag orders,’ which prohibit health care providers from disclosing system flaws and software defects.” He asks the companies how many settlement agreements they’ve executed in the last 18 months.

So far, representatives of Cerner, McKesson and Allscripts indicated that they plan to cooperate with Sen. Grassley's request. 

You can find more information on Grassley's letters via the Washington Post, here.

You can see a copy of Grassley's letter to 3M here.

"Chuck Grassley Has a Few Questions for the Health IT Industry," Health Blog (October 26, 2009).

"Electronic medical records not seen as a cure-all," Washington Post (October 25, 2009).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The last few weeks saw a tremendous amount of activity in the health IT market.  Dell and Xerox were among the companies trying to capitalize on opportunities created by the ARRA incentives and certain market trends, including high demand for HIT products due to the ongoing digitization of the industry and, more generally, the expanding healthcare needs of an aging population in the United States.

Dell is quickly establishing itself as a major player in health IT.  In April 2009, Dell aligned itself with Wal-Mart and eClinical Works to supply hardware for Wal-Mart's new EHR system.  Last month, Dell rolled out its own EHR system aimed at physicians affiliated with hospital practices, with Tufts Medical Center and Memorial Hermann Health Care System among the early adopters. 

Even more significantly, on September 21, 2009, Dell announced its plans to acquire the health IT vendor Perot Systems Corp. for $3.9 billion.  Perot is a major player in the healthcare industry:  about half of Perot's $2.8 billion in annual revenue comes from the healthcare market; and as much as half of the hospitals that outsource their IT are Perot clients.   Perot runs over 3,000 healthcare applications for its clients, though the company does not have a preferred provider arrangement with a specific application vendor.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On September 15, 2009, the HIT Standards Committee endorsed a set of privacy and security standards for electronic health record systems. 
These standards will be recommended to Dr. David Blumenthal, the National Coordinator for Health Information Technology, as a basis for establishing the privacy and security criteria for, inter alia, "certified EHR technology" as defined under the HITECH Act.  Eligible healthcare providers must meet the criteria for "meaningful use" of "certified EHR technology" in order to qualify for significant incentives available under the HITECH Act.

The committee’s Privacy and Security Workgroup included access control, authentication, authorization and transmission of health data among the requirements that electronic health record systems must include by 2011 in order to meet the definition of "certified EHR technology."   Specifically for 2011, the Standards Committee approved the Workgroup's recommendation to require certified products to provide the capabilities necessary to support the HIPAA and ARRA security and privacy requirements and best practices for “meaningful use.”  The endorsed privacy and security standards will become more rigorous in 2013 and 2015.

You can find the spreadsheet of endorsed privacy and security standards here.

You can also view the presentation from the Workgroup here.

"Federal panel okays EHR security, privacy standards," Government Health IT (September 15, 2009).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Via Government Health IT:

The federal Health IT Policy Committee today endorsed recommendations that would leave the Certification Commission for Health IT in the short term as the sole organization authorized to certify health IT systems that qualified for funding under the economic stimulus plan. More certifying organizations would be added later.

Certification of electronic health record systems that met federal criteria for “meaningful use” of health IT could start as early as October, members of the Department of Health and Human Services’ Health IT Policy Committee said at the August 14th meeting.

Under the plan, CCHIT would provide a preliminary stamp of approval that health IT systems were HHS-qualified or certified until a final meaningful use regulation is published at the end of the year, said Marc Probst, chief information office of Intermountain Healthcare and co-chairman of the Committee’s certification work group.

Preliminary certification is meant to give providers and vendors enough certainty to proceed with planning, designing and purchasing systems in 2010. The HHS certification-qualification would mean that a provider purchasing the systems would be eligible for Medicare and Medicaid incentive payments under the stimulus law beginning in 2011.

"CCHIT will be sole health IT certifier, for now," Government Health IT (August 14, 2009).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The State of Maryland awarded $10 million to support the Chesapeake Regional Information System for our Patients (CRISP), a newly created health information technology exchange organization.  Some of  the biggest players in Maryland's health care industry, including Johns Hopkins, MedStar and the University of Maryland Medical System are going to participate in CRISP. 

According to the Baltimore Business Journal:

Funding will come from the hospitals that will receive a slight increase in the prices they can charge patients and federal stimulus money.

The news comes as health care officials and lawmakers champion electronic medical records as a way of reducing health care costs. They argue that electronic medical records will reduce costs by hopefully eliminating unnecessary tests and reducing errors by allowing doctors to quickly access patients’ medical records.

State health insurers plan to provide incentives to hospitals, which include a lump sum payment or increased reimbursement, to adopt electronic health records.

"Maryland awards $10M for health IT exchange," Baltimore Business Journal (August 5, 2009).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Via Healthcare-Informatics:

By 2011, at least 10 percent of all orders processed in a hospital must be entered through CPOE to qualify that institution for CMS incentives under the HITECH Act, according to a proposed matrix of meaningful use released today by ONC’s HIT Policy Committee.

Other 2011 hospital requirement are:

• implementation of drug-drug, drug-allergy, and drug-formulary checks
• maintenance of up-to-date problem lists of current and active diagnoses based on ICD-9 or SNOMED
• incorporation of lab-test results into EHR as structured data
• reporting of hospital quality measures to CMS
• implementation of one clinical decision rule related to a high-priority hospital condition
• providing of patients with an e-copy of their health information
• capability to exchange key clinical information (eg. discharge summary, procedures, problem lists, medication lists, allergies, test results) among providers of care

In another major development, the committee recommended that incentives be paid according to an ‘adoption year’ timeframe rather than a calendar year timeframe. “Under this scenario, qualifying for the first-year incentive payment would be assessed using the 2011 Measures. The payment rate and phaseout of payments would follow the calendar dates in the statute, but qualifying for incentives would use the ‘adoption-year’ approach,” the committee stated.

Here is the link to the matrix.

Stay tuned for more on meaningful use definition.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

According to a study by UnitedHealth Group, America's largest health insurer by market value, widespread adoption and use of HIT may save the healthcare industry and the U.S. government up to $332 billion over 10 years.  According to Reuters, modernization of current practices is the report's main tool for achieving significant savings:

The report identifies ways that technology can be applied to save money by modernizing the administrative and transactional aspects of health care.

For example, use of automated cards swiped at the doctor's office or hospital to validate patient benefits could generate $18 billion in savings alone, according to the paper.

According to the Los Angeles Business Journal, the UnitedHealth report describes additional savings by eliminating paper records:

Much of the $332 billion in savings would come from getting rid of paper records of all types at providers. For example, UnitedHealth estimates more than $108 billion would be saved in printing, postage and administrative costs by shifting payments and remittances to an electronic format.

National information systems also could save money. UnitedHealth estimates more than $47 billion could be saved if their [sic] was a national system to monitor and flag questionable health claims.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Sen. Edward Kennedy (D-MA) revealed the first draft of the healthcare reform bill, the "Affordable Health Choices Act."  Competing versions of the healthcare reform legislation are expected shortly from senior House Democrats, including Energy and Commerce Committee Chairman Henry Waxman (D-CA), and Sen. Baucus (D-MT), chairman of the Senate Finance Committee.  According to the Los Angeles Times, while the various drafts will differ significantly, congressional Democrats agree on three broad goals for the new healthcare framework:

• Improving the quality of care for everyone by encouraging doctors, hospitals and others to adopt the best, most effective courses of treatment.
• Curbing the explosive growth in costs by prodding the medical system to make more cost-effective decisions and to increase efficiency by moving to computerized medical records.
• Expanding coverage to those who do not have health insurance.

Sen. Kennedy's bill does not provide additional funding for adoption of EHR systems, but, according to Piper Jaffrey senior research analyst Sean Wieland interviewed today by Healthcare IT News, "the use of the data generated from these yet-to-be-installed systems is a central theme throughout [Kennedy's] 615-page bill." 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On May 19, 2009, Governor O'Malley of Maryland signed into law a bill requiring private insurance companies to offer healthcare providers financial incentives to adopt healthcare information technology (HIT), while establishing penalties for those providers who do not bring an electronic medical records system on line by 2015.  According to the Baltimore Sun,

The stimulus money went to Medicare and Medicaid, which are to give it to doctors who adopt electronic medical records. But because Medicare and Medicaid account for less than half of payments to many providers, state Health Secretary John Colmers said, private insurers are now being enlisted to add incentive, beginning in 2011.

The bill allows insurers to choose among several forms of inducement - increased reimbursements, lump-sum payments or in-kind services - so long as it has a monetary value.

"The goal here in Maryland was to assure that all of the payers pull their oars in the same direction," Colmers said. "There is a great promise in electronic health records, but the greatest promise comes when it's done in a coordinated fashion, across all of the payers.

The new law also requires Maryland to develop "a health information exchange, a computer network that would link all of Maryland's physicians, hospitals, medical laboratories and pharmacies. It could be linked with those of other states to create [a] national network."

"Bill pushes doctors to computerize records", The Baltimore Sun, May 19, 2009.

Maryland General Assembly HB706 "Electronic Health Records - Regulation and Reimbursement"

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Deloitte published the results of its 2009 survey of more than 4,000 healthcare consumers, and the findings included some good news for the healthcare IT industry:

• 9% of consumers have an electronic personal health record (PHR), but 42% are interested in creating one connected online to their physicians.  This leaves much room for growth for companies like Microsoft and Google which offer a PHR product.
   
• 55% want the ability to communicate with their doctor via email to exchange health information and get answers to questions, and 57% would be interested in scheduling appointments, buying prescriptions and completing other transactions online if their information is protected.

• 4 in 10 favor increasing government funding and incentives to support adoption of electronic medical records by doctors, hospitals and health plans.

However, consumers remain worried about the privacy and security of their personal health information, with 38% of those surveyed being "very concerned" as opposed to 24% of those who are not concerned at all.  Sixty percent support government establishing standards "for how medical for how medical information is collected, stored, exchanged and protected." 

The full survey findings can be downloaded here.

"Deloitte Survey Finds Healthy Consumer Demand For Electronic Health Records, Online Tools and Services", PRNewswire.com, April 6, 2009.

"2009 Survey of Health Care Consumers: Key Findings, Strategic Implications", Deloitte Center for Health Solutions, released April 2009.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

• After what has become a rather typical breach of patient privacy for Southern California, Kaiser Permanente fired fifteen employees (and disciplined eight additional employees) for looking at the medical records of Nadya Suleman, the mother of octuplets commonly referred to as "Octomom".  Previously, similar breaches occurred at UCLA when that medical center's staff leaked celebrities' medical records to the tabloids.  (MercuryNews.com, via AP, March 30, 2009.)
• Wall Street Journal reported last week that HIT stocks, especially smaller companies, like eClinicalWorks (which provide the software component of Wal-Mart's new EHR package) will benefit greatly from the billions of dollars in HIT funding included in the stimulus bill.  Also, in another sure sign of a growing industry, Quality Systems, the maker of the NextGen EHR software, is "beefing up its sales force." ("Stimulus Funds for E-Records Augur Big Windfall for Small Health Firms", Wall Street Journal, March 24, 2009.)

• Email This
• Print
• Comments
• Trackbacks (1)
• Share Link

A battle royal rages on among various Harvard physicians about the effects of a widespread adoption of EHR technology.  In a Wall Street Journal op-ed, two Harvard doctors questioned President Obama's claim that nationwide adoption of EHR technology will save the taxpayers as much as $80 billion annually.   Drs. Groopman and Hartzband call on Mr. Obama to "apply real scientific rigor to fix our health-care system rather than rely on elegant exercises in wishful thinking."  

However, three other Harvard physicians, including Geek Doctor John Halamka, published a Letter to the Editor in response to the Groopman/Hartzband Op-Ed, claiming that the latter did not present a full or accurate picture of the positive effects of widespread adoption of EHR technology.  In part, Drs. Halamka, Bates and Middleton claim that:

The electronic health record represents a transformational change in healthcare, and will enable an array of improvements—although it will not necessarily result if implemented badly. The electronic record is to the paper record as the automobile was to the horse and buggy. No one will want to go back.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Dr. David Blumenthal was named as National Coordinator for Health Information Technology at the Department of Health and Human Services (HHS).  Dr. Blumenthal will "lead the effort for implementation of a nationwide interoperable, privacy-protected health information technology infrastructure" authorized by ARRA and the HITECH Act. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link