Five steps to improved HIPAA compliance

As hospitals, clinics and health care professionals know, their industry is among the most strictly regulated in the United States. Included in the complex set of health care laws is the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires health care organizations to adhere to national standards for electronic health care transactions, code sets, health identifiers and security. Additionally, Congress incorporated mandated provisions to HIPAA to ensure privacy protection for individually identifiable patient health information.

Given the importance placed on HIPAA, it is vital to ensure your health care organization is compliant. Below are five steps to help you achieve compliance with HIPAA regulations.

1) Develop privacy and security policies

Health care organizations need to develop, adopt and implement policies to ensure the privacy and security of patients' protected health information (PHI). Included in this documentation should be what actions should be taken when a breach occurs. Comprehensive policies also should include policies for email and mobile communications, with patients, between employees and with business partners. In most organizations, it may be beneficial to appoint an employee or group of employees and privacy and security officers. These people will serve as resources for the organization and should have extensive knowledge of HIPAA regulations.

2) Educate your employees

It is essential for health care organizations of any size to offer official training and ongoing communication to employees regarding HIPAA privacy standards and policies, particularly regarding permissible uses and disclosures of PHI. New employees need to be trained immediately, and training refresher courses should be offered to all employees on at least a yearly basis, or whenever policies are updated. Additionally, HIPAA requires ongoing awareness communications and activities be provided to all employees.

3) Work with compliant contractors

When you share PHI with vendors, business partners and contractors, you trust them to uphold HIPAA privacy standards. If they do not, your organization will likely share liability for their violations. Before working with third-party entities, make sure they are also HIPAA compliant regarding privacy and security, employee training and risk management.

4) Conduct regular risk management assessments

Through regular risk assessments, health care organizations can identify vulnerabilities to PHI and remediate identified issues or revise gaps in policy. If these measures are taken on a regular basis, it can help to ensure the confidentiality and integrity of your organization's PHI and avoid significant administrative, technical and physical breaches. Additionally, it is vital to conduct other activities to help manage risk, including tracking mobile devices and computers with access to PHI, monitoring big data analytics performed by your organization, keeping anti-malware updated and applying security patches when necessary.

5) Provide patient education and access to records

Health care organizations must correctly publish and distribute a Notice of Privacy Practices to all patients. Additionally, an acknowledgement of receipt should be obtained from every patient, and updated whenever policies are revised. The notice should also be published to your organization's website.

Patients also have the right to access their PHI within 30 days of making a request. Full records must be provided, rather than just a summary.

6) Work with an attorney

If your organization is in need of guidance in fulfilling your compliance with HIPAA or other health care laws, contact an experienced attorney. In addition to advising regarding policies and procedures, your legal representative can become vital if you or your organization is being investigated for a HIPAA violation.

The Enemy Within - "Homegrown" HIPAA vulnerabilities

Just yesterday I briefly discussed the electronic vulnerabilities facing hospitals and health practitioners. Much of that note focused on hackers attacking the systems and holding them for ransom.  It is a major problem confronting the healthcare sector, and will continue to be for long to come.

Other threats linger, and this week we learned about one of the potential hazards we must guard against – the hazard that we hire bring to the table ourselves. In short, we can be our own worst enemies.  Such is the case at the University of Mississippi Medical Center and the Oregon Health & Science University.

At the University of Mississippi Medical Center (UMMC), staff allowed a party to “borrow” a hospital laptop while in the ICU. The borrowed laptop was not returned. While that fact is curious enough, this is when it gets really interesting.

The Mississippi hospital had secured its network, but on the laptop there was patient data that was protected with only the minimum “generic” of security safeguards. Apparently, no access tracking software was in place.

One wonders if the laptop itself had location software in place.  In other words, the equivalent of the “find my phone” application we all use (I know I do) to locate phones and tablets may not have been there.  Most of these tracking applications allow a user to wipe all data from a lost device – quite handy in the event a piece of hardware is lost. 

The folks at UMMC compounded the issue when they failed to notify patients’ whose data was breached of the potential exposure. We must ask – if they had no access tracking software in place, how do they know whose data was purloined and whose was not?

The OCR summarized UMMC's failures in its press release:

• implement its policies and procedures to prevent, detect, contain, and correct security violations;
• implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
• assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI; and
• notify each individual whose unsecured ePHI was reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach.

The UMMC settled with the HHS Office of Civil Rights, paying a penalty of $2.75M while not admitting any liability.  UMMC is working to overhaul its security standards as well.  Read the entire HHS OCR press release here   You can read the actual text of the settlement here.  

Oregon Health & Science University also felt the ire of the HHS OCR, paying a similar fine for breaches involving unsecured laptops and stolen USB thumb drives.  While OHSU self-reported, the OCR lamented OHSU's failure to respond appropriately to these breaches. 

“This settlement underscores the importance of leadership engagement and why it is so critical for the C-suite to take HIPAA compliance seriously.”

— HHS OCR Director Jocelyn Samuels, discussing the OHSU settlement

The Oregon facility paid a fine of $2.7M and entered a three-year corrective action plan. Read the HHS OCR's press release here, and you can read the settlement text here.

These two actions underscore the aggressive stance of the OCR in the face of ever more common data breaches. They also demonstrate how we are often our own worst enemies.

And CEOs, Risk Managers, Compliance Officers, and IT professionals - please take these compliance matters seriously.  

For more on how to deal with these issues, contact the Spiers Group today. 

The Unintended Consequence of Your EHR

A secret agent slips into an office under the cover of night. Evading cleaning crews and the impressive security precautions, she identifies her target.  She cleverly hides her trap, then slips out the way she came. No one is the wiser until she triggers the trap later that week.

The stuff of Hollywood? No, the world of healthcare cyber espionage. The world that destroyed Iranian centrifuges with a piece of software surreptitiously slipped onto their network. The world where a seemingly innocuous email, or clinical photograph shared between colleagues, or even an email about an upcoming Continuing Medical Education event could harbor a tiny bit of code that will burrow its way into your electronic health record.

That is right – the electronic health record you are required to have leaves you open to cyber predators.  An article in Politico makes me ask "Aren’t you glad we have modernized?"  Today hospitals and medical practices loom as ripe targets for the same measures that governments use against each other, and that hackers use for their own enrichment.  And here is the scary bit of the equation – is your security as good as that of the Defense Department? The State Department? A major defense think tank?

I am just going to hazard a guess that the answer is no.

Cyber-attacks on medical facilities are increasing in frequency, and are ever more audacious.  The anonymity of the internet makes it possible for an attack to go unnoticed until the attacker wants it known. Often, records are mined for data, which can be sold on the black market. Believe it or not, health records often are sold on the dark net for more than are simple social security numbers. This is but one means of income for these offenders.

Even more audacious, and perhaps more devastating, are those attacks that threaten medical record systems through the use of ransom ware. Hackers shut down a medical record system, then the real payday comes for them.  “Pay us a certain amount of untraceable bitcoins by a certain date or we will erase your medical record. ALL OF THEM.” 

But you have backups. “I can just restore my backup, and the ransom ware will be gone, right?” Well, that might work, but chances are you don't have a back up from last year. Or the year before. And even of you did, you are losing years of data. The folks who use ransom ware are patient. They may wait months or years to trigger the code that will hold your previous records hostage. So that backup from last week? Infected. Last month? The same. Last year? Maybe.

This dark world is treacherous. There is no quick fix. And what is frustrating for so many is that we are forced by regulation into the very arena where we are most susceptible. EHRs are here to stay. And let us not forget all of the gadgets at work in our hospitals that are potential vulnerable to an attack.

The list of medical cyber susceptibilities does not begin nor does it end with electronic medical records. Ventilators, IV medication pumps, radiology equipment, and even implantable devices are all vulnerable to a cyber-attack. Ransoming a record could be devastating, but once in control of these other devices, the nefarious could ratchet up the stakes – “pay up or we kill someone…”

So how do we address this challenge? Some hospitals have already been attacked, and some admit paying the demanded ransom.  Of course, there may be little to protect against the hackers from taking a second bite at the apple, locking down the system ad demanding more money. We as a community are just not sure.

It is certain that the authorities and various regulators, from the DOJ to HHS, as well as segments of the cyber security industry are working to address the issue.  In an ironic twist, some have recognized that a good old-fashioned paper copy of their records is the best insurance they have.

Small practices should not stand idly by thinking this is a problem of scale. No one is too little. Indeed, the smaller the practice, arguably the more susceptible they are to an attack.

If you have an electronic health record, even if part of a closed system, you are vulnerable. 

Here you can read the HHS fact sheet regarding Ransomware. I suggest you download this and review its contents on a regular basis. 

Contact the Spiers Group to discuss measures you can take to protect yourself – or recover from an attack.  

Omniscience, End of Life Care, and the False Claim Act

That health care providers might disagree is not a novel concept. As the stakes increase, the potential for disagreement increases. Consider the many different treatment regimens for an illness, and the nature of medicine as an art comes sharply into focus.  The treatment for a sore throat, for example, may be as simple as salt water gargles and acetaminophen, or involve various antibiotics, depending on the particular patient or physician. Consider our nationwide epidemic of obesity; the number of appropriate surgical options for treatment alone is significant. Add in the numerous non-surgical treatment regimens and the number dramatically increases.

In medicine, we do not find this odd, as we have long recognized the practice of medicine as an amalgam of art and science, the interaction of the subjective to the objective. Treatment plans for patients are often highly individualized; individualized to the patient, the doctor, the health plan and so forth.  Within an accepted framework, variation is significant, expected, and accepted.

Despite this, there is an intense interest in making medicine more scientific and objective. While no one would argue the merits of exactness and predictability, the end of variation in clinical judgment remains a challenge to patients, providers, and the courts.

Perhaps nowhere is this more intense than in several recent false claim act cases. Fortunately, courts have recognized that variation in the practice of medicine is not proof of some underlying nefarious intent. In its early 2016 decision in US v. AseraCARE INC., the Northern District of Alabama rejected conflicting opinions of physicians as adequate to support an assertion of falsity. Experts can and do tend to have differing opinions, and the difference alone is insufficient to sustain a claim of fraud. The court required objective, not subjective, proof of falsehood in this context.

US v. Vista Hospice Care, Inc., decided in the Northern District of Texas in June 2016, represents yet another rejection of differences in clinical judgment as adequate to support a false claim.  Here the relator was dealt two significant blows. First, the relator in Vista Hospice relied on non-randomized statistical analysis and extrapolation, which the court deemed inadequate to sustain relator’s claims of fraud.  Second, the court acknowledged that the mere disagreement by relator’s expert with a certifying physician’s assessment was inadequate to sustain the claim.

From Chief Judge Barbara M. G. Lynn’s opinion in Vista Hospice:

… [A]n FCA claim about the exercise of that judgment must be predicated on the presence of an objectively verifiable fact at odds with the exercise of that judgment, not a matter of questioning subjective clinical analysis.

These two important decisions, which no doubt will be challenged repeatedly by the plaintiff’s bar, demonstrate the skepticism courts have for claims based on mere differences of opinion devoid of collateral, supporting objective evidence of misdeeds.

One Picture, One Thousand Words, and One Acronym

HIPAA and Your Privacy

I frequently receive calls from folks all upset about HIPAA (the Health Insurance Portability and Accountability Act) violations, and many of these are related to medical images. “I want to sue,” they announce. I respond “It is not quite that simple…”

While HIPAA offers protections, it does not provide the private cause of action many believe it does. Anyone suspecting a HIPAA violation should make a report to the US Department for Health & Human Services Office of Civil Rights. The OCR may sanction the violator, but HIPAA will not give a patient the right to sue their doctor or hospital.

Since HIPAA does not give a private right of action, we look to state law for a solution. State law privacy violations require a showing of certain types of harm. “Harm” generally requires more than simple embarrassment or hurt feelings. That is not as easy as all those folks calling me to represent them in their “sure-fire million dollar” cases realize. In truth, you can run up huge legal bills making these claims if you are not careful, and your attorney does not know when to say “No, but thanks for calling.”

The visual arts and medicine have had a long relationship. Since the written word cannot capture the subtleties of a condition or a disease, practitioners have been quick to adopt drawings, photographs and motion pictures to supplement their written descriptions. When I look back over my medical career, there were many times that I best learned about a particular syndrome when I found an image of a patient with that problem. 

While HIPAA offers protections, it does not provide the private cause of action many believe it does. Anyone suspecting a HIPAA violation should make a report to the US Department for Health & Human Services Office of Civil Rights. The OCR may sanction the violator, but HIPAA will not give a patient the right to sue their doctor or hospital. 

There is a compelling attraction of an image. Scientists easily relate this to the importance of our visual cortex. Seeing is part of believing. Medical amphitheaters flourished in the past, as students and laypersons watched surgeries or attended lectures featuring various patients with visually interesting conditions. Some hospitals even marketed these exhibitions, charging fees for attendance. Do you remember the Junior Mint episode from Seinfeld? (If not, I suggest a quick web search.) Throw in some open windows, don some street clothes, and grab some lunch; throw out anesthesia, forget antibiotics and never mind sterile technique or even air conditioning. Now you have an idea of the sideshow that grew along with medicine. 

Since HIPAA does not give a private right of action, we look to state law for a solution. State law privacy violations require a showing of certain types of harm. “Harm” generally requires more than simple embarrassment or hurt feelings. That is not as easy as all those folks calling me to represent them in their “sure-fire million dollar” cases realize. In truth, you can run up huge legal bills making these claims if you are not careful, and your attorney does not know when to say “No, but thanks for calling.”

Today we watch differently. Photography, and then motion pictures, allowed more viewers to enter our operating rooms at their leisure, and study over and again in minute detail the imagery of an operation. Items missed on first glance could be analyzed later, recorded forever in our new, auxiliary visual memory. While the drama may have been lessened, these were useful new tools for education. 

I know first-hand the visceral attraction of the surgical amphitheater. As a younger man, before an injury ended my operating days, I spent many hours operating beneath a gallery designed for medical spectators seeking to learn new techniques or master old ones. Sometimes, even were there to be no amphitheater, mid-operation a gentle tap on the shoulder would remind me to slide a bit to the left or right so a camera brought in to film the surgery could capture a better image. Viewers could watch from an adjacent room or even later in a lecture hall with the surgeon who had performed the procedure on-hand to narrate the procedure. 

Want to see for yourself?

For those out there who wish to watch surgery today, I suggest you peruse the website ORLive. There you can see a variety of procedures performed at many different locations. The images are often graphic, but have great educational value.

Today our cameras are so advanced and our internet so fast we can watch operations thousands of miles away. We transport the viewer to the operating room. This is not without risk. I recall just a few years ago watching a groundbreaking surgery, coffee and croissant in hand, when the patient experienced a significant complication mid-procedure. To a room full of heart surgeons and cardiologists, it was a known risk, and punctuated the lesson we had debated over several days at the meeting and in our literature for months. To the kind lady serving coffee, it was more than a little distressing when she realized what she had witnessed. 

Today most practitioners will have a library of x-rays, photographs, and videos collected over the years from many sources. We learn so much about new techniques, mastering concepts and procedures without shedding a drop of blood. Beyond the practitioner, patients themselves can learn about their diagnoses and proposed treatments by sampling the virtual world of medical images. A patient who needs a certain procedure can be shown certain elements of the operation to demonstrate what perhaps words cannot capture. Questions unformed in the patient’s mind are answered without ever being asked. 

Images can be an important part of the consenting process it is oft repeated that patients tend to “hear what they want.” Having been a patient myself, I know that is often the case. When we show a video or photographic presentation of what the patient should expect from a procedure, they understand the vital concepts better. 

Search the internet even casually and you will find a host of medical images and videos. Some are posted by patients, eager to share their maladies with family, friends, and strangers alike. Patients with unusual conditions may be diagnosed because someone notices they have a lesion that looked like one seen on the internet. I recall learning of a child with a rare ophthalmic disorder who would likely have perished were it not for a family member’s recollection of a photograph seen on the internet. Can anyone dispute the utility to that child, or that child’s family, of sharing medical imagery? 

Medical Imaging and Copyright Protection?

Medical advertising, once considered taboo, also presents challenges. Before and after images of patients, when used in a commercial manner, can be a powerful tool. But what about patients who have had tattoos? Practitioners must be cognizant that many tattoo artists consider the body their canvas, and this inserts considerations of copyright and fair use into the discussion.

A scientific paper about tattoo removal, for example, would probably only require the thorough consent of the patient for use of an image with a tattoo. Use the same image in an advertisement? That could violate the tattoo artist’s copyrights. A similar argument can be made for distinctive body piercing if it could be identifiable as a particular artist’s work. You may need to obtain an artist’s permission to use his or her work in some circumstances.

The advent of the Health Insurance Portability and Accountability Act of 1996 dramatically changed how medical professionals shared information. Because the internet was growing by leaps and bounds, this sometimes cumbersome law was timely in its arrival. How we deal with it remains awkward. Those images of a disease process shared so readily in the past would quickly conflict with privacy regulations today. This punctuates the uneasy tension between science and privacy. In the past, a patient’s privacy concerns were secondary to needs of science and society. With privacy laws, our scientific willingness to share and our drive to document have collided with our need to protect and respect our patient’s privacy. Consent forms for “Medical Photography and Videography” were added to the ever-growing stack of authorizations patients were asked to sign in order to receive care. While these precautions and protections might lead one to believe it rare for an image to be used without permission, too often we learn of practitioners who failed to obtain consent for the use of a patient’s image. 

Some patients expect to receive photographs or even a digital video of their operations. For physicians and surgeons, this can present a conundrum. Not only are there privacy concerns, but diagnoses and treatments can be subjected to scrutiny over and again. Hindsight, especially seen through the lens of a camera, from the comfort of an armchair, or over the internet, is always 20/20. 

Errors in diagnosis are not the only hazard. Lurking in the background of many images are bits of data that will land a practitioner in hot water. Images in clinical settings may inadvertently capture other patients in the background. A high-resolution photograph of a patient properly consented for a photograph may also record images from an electronic medical record not shielded from the camera’s eye. Moreover, the metadata attached to our digital images will immortalize more than just the perfect image of the patient with the strange new syndrome we just discovered! 

A new challenge is probably in your pocket right now – a cell phone, complete with camera. Patients, and staff, often take photographs without realizing that the images on their phones may represent HIPAA violations and potentially violate state privacy laws if shared. Publish that shot of yourself with some other patient in the background, and you may be in hot water. 

No matter the pitfalls, medical imagery is an important tool. We can use images to track disease progression, monitor health, improve care, and teach the next generation of providers. Medical voyeurism is just as alive today as it ever has been, and with the growth of the internet, we have an ever-expanding menu with which to sate our appetite. My teen children explained the phenomenon to me one day when they showed me a video someone had posted on YouTube demonstrating some malady. 

HIPAA: Medical Photography and Videography Checklist

1. HIPAA does not require perfection. You should have reasonable policies that are enforced, whether you are a solo practitioner or a giant health system. Remember to review and update the policies regularly. If you have questions, ask a professional.

2. If you think you have a HIPAA violation, seek guidance right away.

3. Always obtain patient consent for the image and clearly explain how the image will be used. Be prepared to give the patient a copy of the image and consent.

4. What is the purpose of the image? Why is it needed? Who will see it? Can a smaller field of view suffice? Is there another way to demonstrate the point? Can you adequately anonymize the image? If you do not have a good answer for each question, you may want to skip getting the image.

5. Control who accesses your medical imagery. This applies to your own staff as well as the world outside your practice. Do not forget your business associates.

6. If the image contains facial features, can it be anonymized? The ubiquitous black bar may not be enough – or a simple pair of sunglasses may do the trick.

7. Use a dedicated camera for medical imaging. Cellphones are not ideal for medical photography, and there is a potential for disastrous sharing.

8. Do not let staff take images in the office with their cellphones. You have to be firm.

9. Patients and their families will take photographs and videos – so make them aware that they must respect other patients and visitors’ privacy. Develop a policy and POST IT. Even if they do not mind having 10 million viewers see themselves in a hospital gown, someone else might.

10. Remember, having a policy is never enough – you must enforce it, revise it periodically, and address new threats as they arise.

Implied Certification and False Claims

Imagine this – you see a patient who needs some particular treatment. You have just the person in your office to provide the service, but there is a catch; they are not licensed. No big deal, you think, they can do the service, and you, the licensed provider, will bill for it. “I know they are qualified; I know it will be right.”

No problem, right?

Wrong.

In this month’s Supreme Court Decision in the matter Universal Health Services v. United States ex rel. Escobar, the court addressed this issue head on. If a contractor submits claims for a service provided by an individual for reimbursement, the claims are treated as an implied certification that these individuals are qualified. If they are not, as was the case in Escobar, the claim is a fraudulent claim.

Here the court made clear that, while stating something false is fraudulent, failing to state something important also can be fraudulent.  False statements must be material, and the falsehood must be so serious that the government, had it known of the falsity, would withhold payment.  A great discussion of this case can be found at SCOTUSblog. 

The long term implications of the decision remain to be seen, but think about what you are implying when you certify that claim you are about to submit.

Texas A&M in a partnership with the Houston Methodist Hospital, plans a hybrid Engineering-Medicine program.

Texas A&M Health Science Center, in a partnership with the Houston Methodist Hospital, plans a hybrid Engineering-Medicine program to launch in the fall of 2017.

This is a new take on what many have seen as stressing the role of biomedical engineering in healthcare, so these physician-engineers will work to devise technology that will transform medical delivery through telemedicine, limb regeneration, organ growth, and more.  This is a welcome evolution, as many incredibly bright physicians and brilliant engineers never learn how to actually shepherd their ideas from a sketch on a napkin to reality; this program aims to teach them how to do this.  Look for innovations from this new program.

Over 300 Individuals Charged; Feds Allege Over $900 Million in False Claims

For 35 Texans, Wednesday was a very bad day. In the Southern District of Texas, 24 individuals were charged with fraudulent billing of almost $150 million. In the Houston area, one physician responsible for falsely billing Medicare for almost $40 million. This physician, along with his cohorts, allegedly billed Medicare for unnecessary home health services – many of which were not even delivered. Others were charged with recruiting patients for unnecessary services, many of which were also not delivered, or, in the case of durable medical equipment and supplies, were bought back from the patients and resold. 

Not to be outdone, the Northern District of Texas yielded claims of almost $50 million, with 11 charged for their misdeeds. One case involved a physician allowing unlicensed persons to perform physician services, while billing Medicare for the services as if he had performed them himself. This should be a caution to Texas physicians who feel tempted to allow unlicensed personnel to perform certain services. Remember, it is not merely a question of whether or not they are capable of performing the service, it is also a matter of licensure and legal qualification.

Documents related to these Indictments and Complaints can be found here – they make for interesting reading for physicians and attorneys alike.

This wave of enforcement comes close on the heels of the Supreme Court’s ruling in Universal Health Services v. United States ex rel. Escobar, where the court made clear that the implied false certification theory can be a basis for False Claims Act liability.

It looks like it is going to be a long, hot, false claim enforcement summer.