Riverside Woman Convicted in Federal Court of Stealing Identities of Residents of Medical Facility in Long Beach. Reason Facilities Need Strong HIPAA and Privacy Procedures.

One of the reasons medical facilities should have strong HIPAA policies and procedures, as well as enforcement and training, is to prevent employees or third parties from taking medical information for other improper or illegal purposes.

Last week, Bridgette Jackson of Riverside, California was convicted in federal court after a jury trial on federal identity theft charges for possessing the identities of more than 50 patients of a residential medical facility in Long Beach formerly known as the Hillcrest Care Center. She was convicted of conspiring to possess more than 15 identities, possessing more than 15 identities, and aggravated identity theft.

Ms. Jackson’s aunt, who testified against her at the trial, was an employee at the Hillcrest Care Center and had access to all of the patient files. According to the testimony at trial, Ms. Jackson approached her aunt and asked for personal identifying information of patients. Ms. Jackson’s aunt copied or wrote down personal identifying information and provided it to Ms. Jackson on three separate occasions. 

Ms. Jackson then used that information to help others file false tax returns in the names of the patients and keep the refunds for themselves. When law enforcement executed a search warrant on Ms. Jackson’s residence, officers seized approximately 56 Hillcrest medical records, along with almost 70 other identity profiles, which included names, social security numbers, and dates of birth of individuals other than Ms. Jackson. Law enforcement also seized over 50 prepaid debit cards in names of people other than Jackson.

After the jury verdict was reached, United States District Judge Manuel L. Real scheduled a sentencing hearing for March 7. At that time, Jackson will face a mandatory minimum sentence of two years in federal prison and a statutory maximum sentence of 17 years.   In an unrelated case, Ms. Jackson pled guilty last year to conspiring to commit credit card fraud in the United States District Court in Riverside and faces up to five years when she is sentenced in that case on March 28.

Attorney Commentary:  The black market for patient identity exists. Low paid clerical or medical workers can be susceptible to third parties (here a family member) seeking information. In addition, health care facilities' computer systems are now being targeted. Having a HIPAA audit and compliance is key so the facility does not face civil liability by the patients or OIG fines for the HIPAA violations.

Posted by Tracy Green, Esq.
Work: 213-233-2260

Frequently Asked HIPAA Questions by Health Care Providers - Get Ready for HIPAA Compliance and Audits

While we are working with clients on HIPAA compliance and risk assessment issues, including the OCR pilot request list for potential audits, we see that some very common HIPAA questions arise for health care providers. There is a great deal of misunderstanding out there.

One of the reasons that staff often do not know the rules is that many small to medium-sized health care providers do not have HIPAA compliance manuals that make the rules clear. If the staff is not trained well, this can lead to patients not understanding the rules and making meritless complaints. Since most audits for HIPAA are initiated after patient complaints or disclosures by the providers, having a well-trained staff with a resource helps prevent meritless complaints.

Here are frequently misunderstood basic issues that get raised by staff. The HHS HIPAA website has lists of FAQ in different categories to assist providers. Here are ones relating to patient communications. 

1.  Question: Can health care providers engage in confidential conversations with other providers or with patients, even if there is a possibility that they could be overheard?

1. Answer: Yes. The HIPAA Privacy Rule is not intended to prohibit providers from talking to each other and to their patients. Provisions of this Rule requiring covered entities to implement reasonable safeguards that reflect their particular circumstances and exempting treatment disclosures from certain requirements are intended to ensure that providers’ primary consideration is the appropriate treatment of their patients.

The Privacy Rule recognizes that oral communications often must occur freely and quickly in treatment settings. Thus, covered entities are free to engage in communications as required for quick, effective, and high quality health care. The Privacy Rule also recognizes that overheard communications in these settings may be unavoidable and allows for these incidental disclosures.

HIPAA Audit - Learn From Recent $750,000 Settlement Between Medical Practice and HHS and OCR on Deficiencies in HIPAA Compliance After Data Breach

In our practice, we conduct HIPPA and HiTECH compliance audits for health care clients and business associates (companies that service health care companies). We also represent them when a HIPAA complaint has been filed or reported. 

We do this as a law firm since our communications are protected by the attorney-client privilege unlike regular consultants. 

Most small and mid-sized practices are not fully compliant and have not had audits. We go in, evaluate all existing policies and documents, create or revise a HIPAA compliance plan and employee handbook, document updated employee training, and peform a HIPAA HITECH initial audit which is confidential. 

We work on a flat fee that gets spread out over the year and includes phone calls, emails and meetings to avoid high hourly charges and encourages efficiencies. We help make sure that HIPAA is integrated into the culture.

Some companies or practices have staff to implement changes and other times we perform them. During our attorney-client privileged meetings, we have a master list and then implement a master action plan that will culminate in a final HIPAA audit to be documented. We bring in less expensive consultants as needed to save money for the company or practice as needed. 

Why is it important these audits be documented? If there is a HIPAA complaint by a patient or a data breach reported to OIG or Office for Civil Rights (who handles HIPAA complaints) or to the State of Californa DHCS Officeof HIPAA Compliance, they conduct audits. If there is a breach but it is found that there was prior compliance, proper policies and procedures, documented training, and a documented audit in place - the fines and punishment will be far less. It also helps avoid civil lawsuits by patients for state privacy breaches (since HIPAA does not give a private right of action). 

Tracy Green Speaking at Business Basics Webinar on "HIPAA for Naturopathic Doctors in a High Tech World"

I am speaking and presenting today for the California Naturopathic Doctors Association. You can register and participate live with questions and answer sessions or you can register and watch later.

This seminar is designed to outline the HIPAA rules for Naturopathic Doctors practicing in the real world. The real world includes office staff that need to be trained and understand these rules since you are responsible for their conduct. Naturopathic doctors also practice in a high tech world with email, cloud storage, flash drives, laptops, and smart phones all containing protected health information. Using actual experiences from the trenches, challenging compliance issues will be used as case examples for everyone to learn from. A list of agreements your practice requires along with sample draft agreements will also be provided.

Attend this presentation to confidently:

• Understand what information must be protected under the HIPAA privacy laws
• Understand the HIPAA patient rights
• Know when patient information can be disclosed (treatment, payment, subpoenas, etc.)
• Understand what agreements you need to establish with employees and business associates
• Understand your role as a healthcare provider in maintaining privacy of protected health information for: patient care, contacting patients,  marketing and social media
• Be aware of consequences for non-compliance
• Know what to do if there is a breach of patient protected health information

Posted by Tracy Green, Attorney at Law

Ex-UCLA Healthcare Employee Enters Conditional Guilty Plea to Four Misdemeanor Counts of Violating HIPAA By Reading Patient Records In Federal Court

On January 8, 2010, a former UCLA Healthcare System researcher, Huping Zhou, entered a conditional guilty plea to four misdemeanor counts of of violating the federal privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA) by reading private and confidential medical records. Mr. Zhou is one of the first people in the nation to be convicted of violating the privacy provisions of HIPAA.

Mr. Zhou's plea came just before trial was scheduled to begin this week. The plea was before United States Magistrate Judge Andrew J. Wistrich. In the plea, Mr. Zhou specifically admitted to knowingly obtaining individually identifiable health information without a valid reason, medical or otherwise. However, the plea was conditional because Mr. Zhou reserves the right to argue that his case should have been dismissed and that he can withdraw his guilty plea in appeals on the ground that he did not know this was a federal crime.

Mr. Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Mr. Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers.

For the next three weeks, Zhou’s continued his accessing of patient records including confidential health records belonging to various celebrities. According to court documents, Mr. Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities. There is no allegation that he disseminated these private records to any third party.

In a plea agreement filed in court, Mr. Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Mr. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information. Mr. Zhoa had a Mandarin interpreter at the hearing on the change of plea.

Mr. Zhou is scheduled to appear in federal court on March 22 to be sentenced by Judge Wistrich. At sentencing, Zhou faces a maximum statutory penalty of four years in federal prison.

Attorney Commentary: Protecting the privacy of patients is an excellent goal but whether or not an employee should be criminally prosecuted for reviewing medical records where there is no other illegal conduct is another matter. Most employees sign HIPAA agreements with employers but most of those do not inform the employees that it is a federal crime to view medical records for which they do not have a medical reason or permission to view. Employers should amend their HIPAA agreements to include such notification and health care employees should be careful to not review any such records or document why such records were reviewed (training, etc.). As a health care fraud attorney and HIPAA attorney, it is my opinion that only cases that have criminal intent should be prosecuted.

Posted by Tracy Green. Should you have any questions regarding your own situation or this post, you can email Tracy at tgreen@greenassoc.com. Green & Associates in Los Angeles, California focuses their practice on the representation of licensed professionals, individuals and businesses in civil, business, administrative and criminal proceedings. They have a specialty in representing licensed health care providers. Their website is: http://www.greenassoc.com/

Intro To HIPAA For Health Care Providers: Frequently Asked Questions

The first time that health care providers encounter the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the incredibly vast framework of privacy and security regulations may very well appear completely overwhelming. This is especially true when the question at issue – whether it is from a litigation or compliance perspective – is particularly narrow in scope. For the initiated and uninitiated alike, it is fairly easy to get lost in the morass of cross-referenced sub-parts that any given legal question implicates.

Through its privacy and security requirements, HIPAA impacts not only the medical community, but all individuals and industries that come into contact with the medical community. The implementation of HIPAA requires the development of new policies and procedures addressing the use and disclosure of medical information, as well as the appropriate utilization of available technology. Equally as important, as HIPAA has become more and more pervasive, compliance with the privacy and security regulations have necessarily involved attitudinal changes by everyone associated with the health care industry. HIPAA directly impacts the manner in which patients, providers, and payors interact with each other.

What Information is Protected by HIPAA?

The HIPAA Privacy Rule covers all uses or disclosures of "Protected Health Information" ("PHI") whether in paper, electronic, or oral form. PHI has many characteristics that make it somewhat easy to spot. Whether a malpractice attorney is attempting to acquire the medical records of a plaintiff, or a transactional attorney is assisting with due diligence in connection to the sale of a clinic, it is imperative that PHI is treated appropriately. Being able to recognize PHI is the first step. PHI has the following characteristics:

•It is created or received by a Covered Entity (as defined below);
•It relates to an individual's past, present, or future physical or mental health, or condition, or payment for health care. This includes "payment" information; and
•It identifies or can be used to identify a specific individual.
The following are illustrative examples of information that are considered "patient identifiers":

•Name, name of employer, names of relatives;
•Social security number, plan beneficiary number;
•Fax number, telephone number;
•Address, email address;
•Birth date, fingerprint, picture;
•Internet Protocol (IP) address, web site URL; and
•Vehicle license number.

Generally speaking, PHI may be used or disclosed without first acquiring the patient's consent in very limited circumstances. Other than allowing disclosure to the individual about whom the PHI describes, the Privacy Rule generally allows disclosure of PHI without the patient's consent for the purposes of treatment, payment, or health care operations. Additionally, there are certain situations, such as in response to an order of court, or subpoenas (so long as certain additional requirements are met), where PHI may be disclosed without the patient's consent. In most other situations, a patient must provide consent before his PHI can be used or disclosed.

To that end, each individual maintains six basic privacy rights. An individual has the right to:

•Receive a Covered Entity's Notice of Privacy Practices;
•Request restrictions of certain uses of PHI (although Covered Entities are not required to grant such restrictions);
•Be given access to the individual's own PHI;
•Request that an amendment or correction be made to his PHI;
•Request an accounting of PHI disclosures; and
•File complaints regarding PHI use or disclosure.

Additionally, a Covered Entity's use or disclosure (not including "treatment, payment, or operations," or with consent) of PHI must be only to the "minimum necessary" extent. This minimum necessary standard essentially requires a provider to consider what minimum amount of PHI will meet the purpose of the disclosure. Furthermore, once a Covered Entity agrees to a restriction regarding the use or disclosure of an individual's PHI, this restriction must be honored.

Likewise, use and disclosure of PHI must be consistent with a Covered Entity's Notice of Privacy Practices. When the exchange of health information is deemed necessary, but the value of the information is not the personally identifiable aspect of the information, PHI is often "de-identified." PHI can be freely used to create de-identified data, and no restrictions are placed on its use and disclosure.

To Whom does HIPAA Apply?

Although HIPAA appears to be extremely pervasive, it maintains authority over only certain types of entities. HIPAA specifically applies only to "Covered Entities." Generally, a Covered Entity is one of the following:

•Health care provider. This includes any person or entity that (a) furnishes, bills, or is paid for health care; (b) uses electronic means to transmit any of the following: health claims, remittance or payment advice, or any of the other electronic transactions included in HIPAA.

•Health plan. This includes any organization or entity that provides or pays the cost of medical care, including Medicare and Medicaid, HMOs, or PPOs.

•Health care clearinghouse. These are organizations that process data elements or transactions.

Most of the time, HIPAA questions will involve the activities of or information held by either a provider or plan. Because providers and plans must utilize the services of many different entities, it was necessary to find a way to extend the protections afforded by HIPAA when these essential non-Covered Entities are handling or creating PHI.

These non-Covered Entities that play such a critical role in the health care arena are termed "Business Associates." Examples of common Business Associates are billing firms, accreditation organizations, document destruction contractors, lawyers, and third-party administrators.

Importantly, a Business Associate relationship is formed contractually. When a Covered Entity engages another person or entity to perform a function on behalf of the Covered Entity that requires the disclosure of PHI or the creation of new PHI by that person or entity, it is imperative that the Covered Entity requires that person or entity to sign a contract called a "Business Associates Agreement" (often referred to as a BAA). The BAA extends the requirements of HIPAA to the Business Associate and requires the Business Associate to be aware of its responsibilities under HIPAA.. Furthermore, a Covered Entity that does not require Business Associates to sign a BAA is in violation of HIPAA itself.

Federal vs. State Law

Although the term "preemption" is typically thought of in terms of an ERISA analysis, many HIPAA issues require a preemption analysis. As a general rule, HIPAA should be thought of as a regulatory "floor" of provisions. In other words, HIPAA provides a baseline of privacy requirements that state law cannot abrogate. This is not to say, however, that state law will not provide the answer to a given privacy concern.

State privacy laws are preempted by HIPAA if the state law is contrary to HIPAA. In order to determine whether the state law is contrary, two questions should be asked:

1.Would a Covered Entity find it impossible to comply with both the state and federal requirements?

2.Does the state law stand as an obstacle to the accomplishment and execution of the full purposes and objectives of the Privacy Rule?

Generally, if the answer to either of these questions is "yes," then the state law requirement will be preempted by HIPAA. It is important to keep in mind, however, that stronger state laws that are not contrary to HIPAA will apply. Such laws typically further limit the use or disclosure of PHI, create greater rights of access to PHI to the individual, strengthen authorization protection, or impose greater record-keeping requirements.

For example, many states have more stringent state laws regarding the use and disclosure of HIV/AIDS records, drug and alcohol treatment records, DNA records, and sexual assault victim records. Additionally, some states (with California being a prime example) have extremely intricate and detailed bodies of law that provide more stringent requirements that parallel much of the Privacy Rule.

Privacy vs. Security

Although the HIPAA statute and regulations address much more than privacy and security (i.e. health care transaction standards fraud and abuse provisions, provisions regarding medical savings accounts), HIPAA has become synonymous with patient privacy. Furthermore, as electronic medical records have become more prevalent (i.e., the recently passed Stark law exception and Anti-kickback statute safe harbor dealing with e-prescribing), the security regulations will become implicated on a more regular basis.

To a large extent, the privacy and security requirements are distinct regulatory provisions. A quick review of the security regulations, however, reveals many provisions that appears to be equally related to privacy. Generally, the following distinction between HIPAA privacy and HIPAA security hold true: Privacy generally refers to the rights of an individual to limit the use and disclosure of PHI; Security generally refers to the obligations of Covered Entities to safeguard health information from improper use or disclosure. In other words, the Privacy Rule addresses the "what," and the Security Rule addresses the "how."

Importantly, and to further complicate matters, the Security Rule essentially provides Covered Entities with a list of security issues that must be addressed. At no point does the Security Rule instruct Covered Entities how to implement these security standards. Although what appears to be a lack of direction in the Security Rule may seem frustrating to a provider (or an attorney advising the provider), the various administrative, technical, and physical safeguards described in the Security Rule are specifically designed to be both flexible and scalable. Security "solutions" should be proportionate to an organization's risks, and be based on organizational circumstances such as size, complexity, and capabilities

Enforcement

Violating HIPAA can be very costly. Civil penalties range from $100 per incident to $25,000 per person per year per standard violated. On the criminal side of enforcement, illegally obtaining or disclosing PHI can result in a fine of up to $50,000 and one year in prison. Obtaining PHI under "false pretenses" can be punished with fines up to $100,000 and five years in prison. Obtaining or disclosing PHI with the intent to sell, transfer, or use the PHI for commercial gain, personal gain, or malicious harm can result in even stiffer penalties - up to $250,000 and ten years in prison.

Civil enforcement of HIPAA is handled by the Department of Health and Human Services' Office of Civil Rights ("OCR"), while criminal enforcement is overseen by the Department of Justice. The final Enforcement Rule was issued in February of 2006, and makes the HIPAA enforcement provisions applicable to all aspects of the Administrative Simplification Standards (not only the Privacy Rule). Importantly, the Enforcement Rule affirms that the OCR's enforcement philosophy is one of voluntary compliance.

That being said, and although enforcement measures have not been traditionally onerous, it seems that the tide is changing with regard to enforcement and the mindset of those investigating reported HIPAA violations.

Do Not be Fooled by the Myths

When discussing privacy and security issues with fellow health care providers, patients or friends, one of the first obstacles to overcome is their preconceived assumptions about what HIPAA does or does not permit. The following are a few of the many common myths regarding the Privacy Rule:

■ Myth - A hospital is prohibited from sharing information with the patient's family without the patient's express consent.
■ Fact - The Privacy Rule permits the disclosure to a patient's family members (not just immediate family) or close friends of medical information that is directly relevant to that person's involvement with the patient's care. If the patient is in the room when a provider is about to disclose such information and the patient does not object to such disclosure, the provider may freely disclose the information. On the other hand, if the patient is unable to provide consent (if, for example, the patient is unconscious or due to an emergency situation), the provider must determine whether such disclosure is in the best interest of the patient.

■ Myth -HIPAA does not permit providers to communicate with patients via email.
■ Fact - So long as the communication is made with reasonable and appropriate safeguards (such as encryption) to protect against any reasonably anticipated threats to the security of the information, email communication is permitted.

■ Myth - A patient's family member can no longer pick up prescriptions for the patient from a pharmacy.
■ Fact - This is simply not true. If a pharmacy does not allow this practice, the prohibition is one set forth in the pharmacy's policies and not one mandated by HIPAA.

In addition to addressing the many commonly circulated myths regarding the Privacy Rule, there are many provisions within the regulations to which health care providers and their attorneys should pay special attention.

The Privacy Rule specifically addresses the manner in which records should be released in response to a court order or subpoena. Additionally, there are provisions that address how Covered Entities should interact with a patient's personal representative. Although these provisions can appear somewhat intricate, a careful reading of the regulatory language, along with the published comments within the federal register, and diligent cross-referencing throughout the Privacy Rule will enable a thorough understanding of the concerns at issue.

Any questions or comments should be directed to: tgreen@greenassoc.com. Tracy Green is a principal at Green and Associates. They focus their practice on the representation of professionals, particularly health care professionals including individual physicians, corporate providers and group practices.
Their website is: http://www.greenassoc.com/

Physician And Two Hospital Employees Plead Guilty To Misdemeanor Violations Of HIPAA In Arkansas Federal Court

HIPAA is becoming an increased basis for criminal prosecutions of licensed health care professionals and health care workers. In Arkansas, there was one of the first federal criminal prosecutions for accessing patient records out of curiosity -- where there was no identity theft or related criminal conduct.

On July 20, 2009, a physician and two former employees of St. Vincent Infirmary Medical Center (SVIMC) in Little Rock, Arkansas, pleaded guilty to misdemeanor violations of the health information privacy provisions of the Health Insurance Portability and Accountability Act.

Each admitted he or she had accessed patient records out of curiosity. All three acknowledged they had participated in HIPAA training provided by SVIMC, and understood the prohibition on accessing records without a legitimate reason for doing so.

The records accessed related to the treatment of Anne Pressly, a local television personality who was brutally beaten by a home intruder on October 20, 2008. Ms. Pressly died at SVIMC on October 25.

Dr. Jay Holland, medical director for Select Specialty Hospital located on one floor within SVIMC, admitted that he logged into the medical center's electronic medical record system from home seeking to determine the accuracy of a television news report concerning Ms. Pressly. The medical center suspended Dr. Holland for two weeks and ordered him to complete additional HIPAA training. Sarah Elizabeth Miller, an account representative for SVIMC, admitted viewing Ms. Pressley's medical records twelve times, and Candida Griffin, an emergency room unit coordinator, accessed the file on three occasions. SVIMC terminated Miller's and Griffin's employment.

Each of the individuals faces up to a year in jail and a $ 50,000 fine for the violation they admitted. Sentencing should take place within the next two months. In determining the actual sentence, the federal judge will consult the advisory U.S. Sentencing Guidelines, which provide appropriate sentencing ranges that take into account the severity and characteristics of the offense, the defendant's criminal history, if any, and other factors. The judge, however, is not bound by those guidelines in determining a sentence. A probation sentence given these individual's lack of prior criminal history seems likely here.

Attorney Commentary: The misdemeanor conviction will be just the beginning of the individuals' legal issues. There are employment issues, the misdemeanor conviction will need to be reported to the licensing boards, potential national reporting, and other collateral consequences.

To understand how a HIPAA violation is reported, you can review the US Department of Health and Human Services Office for Civil Rights website: www.hhs.gov/ocr/privacyhowtofile.htm

As part of compliance plans and a professional's pattern and practice, HIPAA will become more important. This particular case probably obtained the government's attention due to the fact that the patient was a local news celebrity. As records become increasingly electronic and accessible, there are greater risks of unauthorized access.

Any questions or comments should be directed to: tgreen@greenassoc.com or 213-233-2260.

Tracy Green is a principal at Green and Associates in Los Angeles, California. They focus their practice on the representation of licensed professionals, individuals and businesses in civil, business, administrative and criminal proceedings. They have a specialty in representing licensed health care providers. Their website is: http://www.greenassoc.com/

Practice Management: Texting Patients Can Cut Costs And Increase Efficiency

Health care providers are looking for ways to cut the amount of time their practice spends in calling patients to confirm and remind them of appointments, lab calls and follow-ups. Text messages can also be used for "outreach" messages reminding patients of needed mammograms, Pap smears and cardiovascular disease lab tests. They can also be used for other reminders such as: "You have a physical at 9 a.m. tomorrow. Please do not eat or drink anything after 12 p.m. midnight."

They can also be used for billing reminders: "You have a balance of $55. Please remit." Daily reminders can also be set up for patients in reminding them to put on sunscreen or other reminders to help patients be compliant. They can also be used to develop patient relationships such as "happy birthday" greetings. Many providers report that patients like it and do not find it overly intrusive.

Although we have written this to address health care providers, many other professional practices can use the ideas in this article and adapt for their business. For example, in our own practice we are sending text messages to confirm the time and place of appointments and court or hearing appearances. This helps confirm that the person will receive and see the message without checking home answering machines, cellphone voicemails or emails. All professional practices that rely on appointments could benefit from the idea although it is usually medical practices that have the volume of patients to justify using a web-based text messaging program.

There are many Web-based text messaging options. Most are free to set up, with users billed a set fee for the month, generally in the $200 range. Also available are physician-specific systems that can mine data from a practice management or electronic medical records system, which means the messaging is all done automatically. For other systems, cell phone numbers would need to be entered manually each day. Some of the text messages can also be sent to a phone as a voicemail.

Since many people have cell phones with text-messaging capabilities, some health care providers (including test programs by Kaiser Permanente) have decided that texting is the way to go. These providers are saving numerous staff time hours per week by using a text-messaging system that automatically sends the reminders. Some practices are reducing staff time from one hour, per doctor, per day to less than 10 minutes by using text messaging systems for appointment reminders, lab calls and follow-ups. They are also able to better predict the number of "no shows" so that revenue can be increased by filling that time with additional patient visits. This can boost the bottom line of practices significantly.

Many providers have enthusiastically adopted texting. However, to make sure texting is effective for your practice, it takes some groundwork and preparation. to make sure texting is effective for your practice.

First, determine what the texting system will be used for which will help make it easier to decide which system to buy.

Second, the practice should draft the outgoing messages that will be sent and have them cleared by the practice's attorney for possible HIPAA security rule violations. Our opinion is that in general, the use of text messaging is permissible on the same basis that telephone messages have been permissible under current law. However, there should be guidelines to ensure HIPAA compliance.

Third, patients need to be given the option of whether to use the communication mode. The patients should also be given instructions on how to opt out of receiving text messages. Senior patients may need instruction on how to check their text messages. Some text messages allow you to opt out. For example, in Kaiser's case, each message ended with, "Txt STOP to end msgs."

Fourth, your practice should start collecting cell phone numbers if they have not already been collected. For physicians just getting started it might be a slow process before the system reaches its fullest potential, as it might take several months for the databases to be populated with cell numbers.

Fifth, practices need to be vigilant about making sure data fields are updated regularly to avoid invalid numbers or bounced-back messages.

Sixth, if your practice sets up a two-way system, the staff must be equipped to deal with the return messages. Some providers' systems allow patients to respond to the text message to confirm appointments, for example. The messages are sent back as an e-mail that the staff must receive. Then, the staff manually enters any schedule changes or confirmations into the practice management system.

Finally, determine in advance the format and content of the messages so the staff has little discretion in what they write. To further protect yourself, it may be that the less specific the messages, the better. Messages about test results, for example, could say something like, "Everything looks normal," or in the case of a positive result, "UR lab results are in. Call 2 discuss."

Any questions or comments should be directed to: tgreen@greenassoc.com. Tracy Green is a principal at Green and Associates in Los Angeles, California. They focus their practice on the representation of licensed professionals and businesses in civil, business, administrative and criminal proceedings, with a specialty in health care providers.

HIPAA Privacy Rule: What Does The Average Provider Have To Do?

Although HIPAA has been around for years, there are still questions and fears regarding HIPAA. Just this past week, nearly two dozen employees at Kaiser Permanante Medical Center in Bellflower, California were fired or disciplined for peering into the medical records of octuplet mom Nadya Suleman.

Fifteen employees were fired and eight were disciplined for snooping into Suleman’s records without authorization. Hospital officials discovered Suleman’s medical records had been inappropriately accessed on two different occasions beginning three weeks ago, while security personnel were monitoring Kaiser’s computer network. Kaiser officials notified Suleman about the matter on both occasions, shortly after the employees had either been fired or disciplined.

For the average health care provider , the HIPAA Privacy Rule requires activities, such as:

■ Notifying patients about their privacy rights and how their information can be used.

■ Adopting and implementing privacy procedures for its practice.

■ Training employees so that they understand the privacy procedures.

■ Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed.

■ Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.

Responsible health care providers and businesses already take many of the kinds of steps required by HIPAA to protect patients’ privacy. To ease the burden of complying with the new requirements, HIPAA's Privacy Rule gives needed flexibility for providers and plans to create their own privacy procedures, tailored to fit their size and needs. The scalability of the Privacy Rule provides a more efficient and appropriate means of safeguarding protected health information than would any single standard.

For example, the privacy official at a small physician practice may be the office manager, who will have other non-privacy related duties. However, even a small practice needs a designated privacy official. The privacy official at a large practice or health plan, in contrast, may be a full-time position, and may have the regular support and advice of a privacy staff or board.

The training requirement may be satisfied by a small physician practice’s providing each new member of the workforce with a copy of its privacy policies and documenting that new members have reviewed the policies. In addition, a small or large practice may provide training through live instruction, video presentations, or interactive software programs.

The policies and procedures of small providers can be more limited under the HIPAA Privacy Rule than those of a large hospital or health plan. This limitation is justified based on the volume of health information maintained and the number of interactions with those within and outside of the health care system. Nevertheless, there should be policies and procedures as part of a basic compliance plan. HIPAA training and compliance need not be expensive or time consuming but it must be set up. Once it is set up and implemented there is little left to do except ensure that new employees receive the training and sign documentation indicating that they have received the training.

As part of compliance plans, we encourage health care providers to have all employees attend a training overview of HIPAA (which can be conducted in-house), which will prepare them to:

(1) describe what HIPAA is and how it came to be;
(2) identify major components and implementation timeframes of HIPAA (privacy, security, code sets, due diligence, and transactions);
(3) be cognizant of the HIPAA privacy rules, current practice policies and California’s privacy laws regarding medical records;
(4) determine what is considered private vs public information;
(5) identify penalties associated with violations of HIPAA rules;
(6) report suspected violations of HIPAA rules;
(7) identify how to obtain additional assistance or information regarding HIPAA within the practice; and
(8) describe generally how HIPAA could affect them and their work unit.

Upon completion of HIPAA training, employees will sign a form acknowledging receipt of this training. One copy of the acknowledgement form will be given to the employee and another will be placed in their personnel file.

If your practice is not compliant with HIPAA training and having each employee sign a HIPAA form as part of their personnel file, it's not too late to become compliant. Most health care attorneys or other compliance providers can conduct in-office seminars or draft a training manual that can be reviewed at a reasonable cost. Don't wait for a patient to file a complaint or until an employee improperly discloses protected health information (PHI).

Any questions or comments should be directed to: tgreen@greenassoc.com. Tracy Green is a principal at Green and Associates in Los Angeles, Califonria. The firm focuses its practice on the representation of licensed professionals and businesses in civil, business, administrative and criminal proceedings, with a specialty in health care providers and HIPAA compliance.

.

Attorney Comments: HIPAA Extended To Business Associates

The American Recovery and Reinvestment Act (Recovery Act), signed into law on February 17, 2009, broadens the scope of the Health Insurance Portability and Accountability Act (HIPAA) to impact not only covered entities—including physicians, hospitals and health plans—but also those entities that support the healthcare industry as “business associates,” which include third-party administrators, consultants, service providers and attorneys. Additionally, organizations that provide data transmissions of protected health information (PHI) to covered entities or business associates now will be required to enter into business associate agreements with covered entities.

This means that if your entity is sharing protected health information with other entities, there should be written HIPAA agreements with them. Further, if they release a patient's PHI, they will be subjected to potential civil and criminal fines and penalties.

The Recovery Act extends specific HIPAA regulatory requirements to business associates. Beginning February 17, 2010, the administrative, physical and technical safeguard requirements of the security regulations, as well as the polices, procedures and documentation requirements will apply to business associates. Traditionally, business associates were required by contract to use certain precautions regarding the use and disclosure of PHI, and if a business associate unlawfully disclosed PHI, it only faced a breach of contract claim by the covered entity. Under the Recovery Act, business associates now face civil and criminal fines and penalties for HIPAA violations.

The U.S. Department of Health and Human Services (HHS) is now required to conduct periodic audits to make sure covered entities and business associates are complying with the new privacy and security requirements. Additionally, generally effective immediately, state attorneys general have been granted expanded authority to enforce violations of HIPAA on behalf of the citizens of their respective states.

In light of the HIPAA changes contained in the Recovery Act and the impending regulations, covered entities and business associates should prepare to reevaluate current HIPAA policies, assess levels of access to PHI and prepare to incorporate the required changes into business associate agreements.


Any questions or comments should be directed to: tgreen@greenassoc.com. Tracy Green is a principal at Green and Associates. They focus their practice on the representation of professionals, particularly health care professionals including individual physicians, corporate providers and group practices.