HIPAA: Medical-Legal Implications

1. HIPAA: Medical-Legal Implications Dorothy Sparks, MD Department of Surgery

2. HIPAA HEALTH INSURANCE PORTABILITY ACCOUNTABILITY ACT Established in 1996.

3. HIPAA: Principle “Patients or representatives should have access to all records except in the event the provider feels that it is not in the best interest of the patient’s health to have access or if the knowledge of the health care information could cause danger to the life or safety of any person.”

4. HIPAA: Three Parts • Privacy Rule: April 14, 2003: • Protects confidentiality when using and disclosing an individual’s protected health information in any form—paper, oral, electronic • Provides individuals with rights • Transaction and Codes Sets: October 2003 • Requires all payers and nearly all providers to adopt new standards for electronic transactions and code sets • Goal is to facilitate claims and payments • Security Rule: April 2005 • Support confidentiality, data integrity and availability Provides standards for administrative, physical and technical safeguards of only

5. Applies to: • PHYSICIANS • HEATLH CARE • HOSPITAL BILLING • INSURANCE

6. USDH Office for Civil rights Decided that it is illegal to release information to inappropriate parties or fail to protect information $100 individual fines OR Criminal Fines w/ Prison Time OR 1 year and $50,000 fine

7. Basic Tenets: Healthcare providers should be committed to giving patient privacy EX. 1) Close room doors 2) Privacy curtains 3) Do not leave medical records laying around

8. Protected Health Information • Name, all types of addresses including email, URL, home • Identifying numbers, including Social Security, medical records, insurance numbers, biomedical devices, vehicle identifiers, license numbers • Full facial photos and other biometric identifiers • Dates, including birthdate, dates of admission and discharge, death

9. HIPPA & Residency

10. HIPAA allowed uses of PHI: Treatment– The provision, coordination, or management of healthcare by one or more health care providers, including consultations and referrals Payment– Activities to obtain payment or be reimbursed for health care services; health plans to obtain premiums, fulfill coverage responsibilities, or provide reimbursement Health Care Operations (HCO)-- Administrative, financial, legal and quality improvement activities; business planning activities; training, teaching; accreditation, credentialing, licensing, competence, performance activities; fraud, abuse, compliance activities .

11. Causes of Legal Action • Approx 30% of all medical negligence claims are somehow related to surgical intervention. • Medical Negligence – failure to use such care as a reasonably prudent health care professional would use in similar circumstances.

12. Schloendorf vs. Society of New York Hospital • Basic principle of law. • Lays a foundation for the relation between patients and health care practitioners. “Every human being of adult years and sound mind has a right to determine what shall be done with his own body, and a surgeon who performs an operation without his patient’s consent commits an assault, for which he is liable in damages.”

13. Ruling Serves 6 Functions: • Protects individual autonomy • Protects pt status as a human being • Avoids fraud and duress • Encourages health care practitioners to consider their decisions carefully • Fosters rational decision making by the pt • Involves the public in medicine

14. A Patient Fall in RadiologyAn Example of Nelgigence Favalora v. Aetna Casualty & Surety Co. • Pt. admitted to hospital for general checkup & GI series. • Pt complaint: Stomach pains, general fatigue, and fainting. • While undergoing x-ray exam, pt fainted, fell, and fx’d her neck & femur – requiring surgery. • Surgery caused a pulmonary embolism • Radiologist was negligent for not securing medical hx prior to exam, pt won lawsuit.

15. Four Elements to Prove Negligence • Must establish a duty to the patient by the health care provider • Breach of this duty by an act or by failing to perform some act. • A compensable injury • A causal relation between the injury and the breach of duty.

16. Cause of Legal Action • Tort – Civil wrong committed by one individual against another. May be classified as either intentional or unintentional. This type of claim arises from a breach of duty. • Assault – Any willful attempt or threat to inflict injury on the person and any intentional display of force that would give the victim reason to fear or expect immediate bodily harm.

17. Cause of Legal Action • Battery – An unlawful touching of another that is without justification or excuse. • False Imprisonment – Conscious restraint of another without proper authorization, privilege, or consent. • Defamation – Holding up a person to ridicule, scorn, or contempt in a respectable & considerable part of the community.

18. Respondeat Superior • The master speaks for the servant; the master is liable in certain cases for the wrongful acts of his or her servants. “Deep Pockets” approach. • If a radiographer is sued, the hospital and physician would also be named as defendants. Well established theory that the physician or health care facility is responsible for the negligent acts of its employees.

19. Corporate Liability • Requires the hospital or health care entity to be responsible for the quality of care delivered to consumers. • Health care corp. must assess & evaluate the quality of care delivered & must be prepared to make changes as needed. • The corp. may be required to intervene if suboptimal care is being provided by one of its independent contractors.

20. Corperate Liability Spears vs. Cedar-Sinai • 13 hospital employees penalized for illegally accessing confidential EMS & psychiatric records. • Case pending legislation.

21. Informed Consent • A person’s agreement to allow something to happen (i.e surgery) that is based on full disclosure of the facts: knowledge of benefits, risks, and alternatives to the procedure. • Required when a patient is subjected to any type of invasive procedure. • If the pt consents to a procedure & then revokes the consent, the doctor must stop the procedure.

22. Documentation • In court, if you testify that you properly assessed the patients medical risk and obtained consent from the patient verbally prior to the examination you have NOT properly documented your interaction. Proper documentation needs to include a witness to verbal consent!

23. In the Future… • Physicians need to be proactive in meeting HIPAA standards to avoid legal implications. • Areas of future legislation: • Regulation of information technology Including electronic records & networking