HealthBlawg :: David Harlow's Health Care Law Blog

Health Care Social Media Legal Issues and Strategy Webinar

2009-11-18T14:18:07-05:00

Today's HIPAA and Your Social Media Strategy webinar, which I presented together with Jamie Verkamp of (e)Merge, was a success. We had a good turnout, interesting questions and engaging discussion. Here is a version of the slide deck I used today, complete with links to other useful resources here at HealthBlawg and elsewhere on the web.

Social Media In Health Care Legal Issues

View more presentations from DavidHarlow.

Jamie and I will be repeating this webinar in two weeks, on December 2 , at 1:00 p.m. Eastern, 12:00 Central. If you missed it the first time around, or would like to recommend it to a colleague, you can register here.

If you have any questions or comments on the subject, we'd like to hear from you.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

An ounce of prevention

2009-11-18T11:55:45-05:00

Today's Boston Globe reports on a feature of the Massachusetts universal health care law that may be replicated at the national level: MassHealth -- the Massachusetts Medicaid program -- has been covering the costs for smoking cessation counseling and medications for eligible enrollees.

Using the data available, researchers were able to associate the roll-out of these services with a significant drop in smoking rates -- a drop not seen among the small percentage of Bay Staters who remain uninsured.

Not only that, but there are cost savings involved. Fewer health care services are required by nonsmokers -- notably, less asthma and heart attack related services.

Thanks to aggressive promotion of the services through a variety of channels, 40% of eligible smokers enrolled, as opposed to the 5-10% that the program anticipated.

The success of this program had previously been announced by the Commonwealth in June.

Bottom line from the Globe:

Although the study being released today does not assess whether the stop-smoking campaign reduced health care costs overall, the findings led some advocates to call on the state to make all health plans - public and private - provide cessation programs with low co-pays and deductibles.

As health reform is further debated at the national level, we need to focus on the investments that may be made in the nation's health that will yield monetary as well as quality returns, and this initiative is certainly one that is worthy of closer examination.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Son of HIPAA Breach Notification Rules and Business Associate Requirements: Who's Ready?

2009-11-17T00:23:22-05:00

HIMMS Analytics surveyed about 250 hospital and business associate representatives, and came up with some figures to back up what we all knew in our hearts: Most hospitals are gearing up for compliance with the HITECH Act / Son of HIPAA data security and breach notification requirements, but many experience data breaches -- about half of hospitals surveyed in the past year -- and business associates lag behind hospital in awareness and preparedness for compliance with new business associate requirements.

Check out the full report on the HITECH Act's impact on privacy and security, and check out recent HealthBlawg posts on HITECH Act and Son of HIPAA issues here: HITECH Act security breach rules now effective; Comments on HITECH Act breach notification rule from Capitol Hill; and Son of HIPAA Breach Notification Rules.

Anyone who needs to be convinced that attention must be paid to this issue need only check out the cautionary tale of the Virginia prescription record security breach or any of the many breaches detailed here or here.

The survey provides a handful of key take-away points:

Risk assessments are common practice but alone do not mitigate breach risks.
Large hospitals experience the most data breaches and are at the greatest risk for future incidents.
Business associates are generally unprepared to meet the new data breach related obligations brought on by the HITECH Act.
Health care organizations are prepared to sanction business associates that don’t comply with the regulations outlined in the HITECH Act.
Inter-departmental disconnects between IT and Compliance on data breach policies and procedures leave hospitals at risk.

Bottom line: most health care provider organizations and most business associates (vendor organizations) have a great deal of work to do, not only in terms of conducting a through review of policies and procedures so as to come up with a gap analysis, but also in terms of implementing policies and procedures to fill the gaps identified, and to conduct appropriate trainings at all levels of the organization, including clear delineation of lines of communication regarding data security matters.

The Harlow Group network stands ready to assist provider and vendor organizations in preparing themselves for full compliance with the new HIPAA requirements promulgated in the HITECH Act and its regulations.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Social Media Session at Oklahoma Hospital Association Annual Meeting

2009-11-13T00:08:13-05:00

Yesterday I had the pleasure of sharing the podium -- at least virtually -- at the Oklahoma Hospital Association's annual meeting with two leaders in the health care social media sphere, Ed Bennett of the University of Maryland Medical System and Lee Aase of the Mayo Clinic, for a program on health care social media presented by the Public Relations and Marketing Society of the OHA. Our host, Brenda Finkle, and others, livetweeted the session. Here for your perusal are our presentations.

Presentation at the Oklahoma Hospital Association

View more presentations from Ed Bennett.

Oklahoma Hospital Association

View more documents from Lee Aase.

David Harlow on Social Media In Health Care Legal Issues - OHA

View more presentations from DavidHarlow.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Son of HIPAA Breach Notification Rules

2009-11-11T13:52:51-05:00

Health care providers: If your patient records aren't already stored digitally, they are likely to be digitized soon. There is a tremendous push by the federal government -- as well as by some private payors and self-insured employers -- to get all health care providers wired in the near future, in order to better coordinate patient care, improve outcomes, and "bend the cost curve" all at the same time. There are some financial incentives in play to achieving "meaningful use" of "certified" EHR systems; those terms are to be defined in federal regulations later this year, but the outlines of those definitions are already pretty clear.

Once all that patient data -- or as it is known in HIPAA-speak, protected health information (PHI) -- is stored electronically, it becomes exposed to potential data breaches. In late September, two sets of federal regulations took effect that address the way in which PHI should be maintained, and the steps that should be taken to prevent a data breach and to notify the government and affected individuals in the event there is a data breach. Compliance with these rules -- issued under authority of the HITECH Act by the US Department of Health and Human Services (HHS) with respect to health care providers, and by the Federal Trade Commission (FTC) with respect to EHR vendors and other similar third parties -- requires affected practices and businesses to assess and update their data privacy and security policies and procedures, as well as train all affected staff accordingly.

The exposure in case of violation is significant, both in terms of fines and penalties and in terms of bad publicity-certain data breaches require notice to potentially affected individuals via the general media in addition to notices required to be fled with the regulators. The new rules -- I call them Son of HIPAA -- are layered on top of existing HIPAA privacy and security rules, the FTC's Red Flags Rule regarding identity theft protections to be put in place by any "creditor" (which includes health care providers not paid in full at the time of service -- though the effective date of Red Flags Rule is now delayed yet again), and state privacy rules. While HHS and FTC took some pains to harmonize the new rules so that patients will not be bombarded with multiple data breach notifications about the same incident, for example, the other applicable rules out there have not been harmonized.

The key concept in the new breach notification rules is that encryption of patient data will eliminate the need to notify patients and the federal regulators in case of an inappropriate release of data. Such a release, if the data is encrypted (i.e., unusable, unreadable, or indecipherable), is not considered a breach. Encryption is not required, though, and each affected entity must engage in a cost-benefit analysis before deciding whether to encrypt all affected data.

Another important aspect of the rule is the concept of harm-the regulators decided that not every data breach should trigger all of the notice requirements, just breaches that "pose a significant risk of financial, reputational, or other harm to the individual." For example, if an employee of a health care provider accesses a patient record inappropriately, but immediately realizes his or her mistake, and exits the record quickly and does not retain any PHI, that is not a reportable data breach.

Finally, "business associates" under HIPAA are now required to implement policies and procedures to maintain privacy and security of PHI, parallel to those that have been required of "covered entities" under HIPAA since the beginning. All business associate agreements and notice of privacy practices (NPPs) will have to be updated to account for the new requirements before February. Health care providers that wish to distinguish themselves should consider revising their NPPs to highlight the ease with which they will make copies of records available to patients. This is a bone of contention for many patients, and ensuring that patients' rights to their records are easily exercised could be a way to build goodwill among patients and potential patients.

This is an extremely brief introduction to a very involved set of regulations. My hope is that you now have a sense of how important it is to be sure that your operations are fully compliant with the regulatory requirements before full enforcement and random field audits begin in February 2010.

A version of this post was published on HCPlive.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

David Harlow quoted in "Social Networking 101 for Physicians" piece in Mass Medical Law Report

2009-11-08T11:58:02-05:00

More and more physicians are exploring the use of social media in their practices, and the Massachusetts Medical Law report ran a piece on Social Networking 101 for Physicians recently, quoting Kevin Pho of KevinMD, Jim Tobin of Ignite Health (regards to Fabio aka @skypen!) and me, among others. As I posted recently, I will be giving a free webinar on the subject of regulatory issues around social media in health care on November 18, together with Jamie Verkamp of (e)Merge, who will speak to other aspects of planning a social media presence. In addition to working with Jamie, whose agency focuses on physician practices, I am also working with agencies focused on hospital social media planning. If this piques your interest, please register for the social media webinar and/or get in touch to discuss strategies for your organization and the regulatory hurdles you need to be aware of in the planning process. FYI, my slides will be posted after the webinar.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

HIPAA and your social media strategy - Webinar November 18, 2009

2009-11-05T15:28:17-05:00

Physicians, practice managers and other health care providers and managers considering a foray into social media, you are invited to join The Harlow Group and (e)Merge for a webinar discussing this timely and important topic. Here is the (e)Merge announcement:

HIPAA and Your Social Media Strategy

Health care has taken notice of social media as a way to connect and interact with patients. With the escalating use by physicians, medical professionals, hospitals and clinics, concerns are growing as to how HIPAA regulations affect your online presence. Join Jamie Verkamp of (e)Merge as we sort out the confusion with leading health care attorney David Harlow, Principal of The Harlow Group. We'll answer your questions and share valuable tips on how your practice can develop an effective social media and online strategy, while remaining compliant with HIPAA and other applicable rules.

Join us for a complimentary webinar sponsored by (e)Merge and The Harlow Group on Wednesday, November 18th at 1pm Eastern. Please feel free to share this invitation with others who you think may benefit from this webinar.

Please feel free to forward questions for Jamie or me in advance of the webinar so that we may be able to address them in our presentations. We look forward to being with you virtually on the 18th.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

FDA and social media: The regulated community's current obsession overlooks off-label promotions by the advocacy community

2009-11-02T14:56:55-05:00

This morning I received a tweet exhorting me to learn about Low Dose Naltrexone (LDN) for autoimmune diseases. (Naltrexone, by the way, is approved by the FDA only to treat alcoholism.) Within a few clicks, I found claims that LDN would be a good drug to take for dozens of conditions: everything from neuroblastoma to HIV to celiac disease, and learned of a network of tweeps promoting LDN.

The above tweet linked to a blog promoting LDN which is part of the Health Central community.

All this got me thinking about a bunch of issues; for instance:

Does the promotion of off-label uses by a member blog comply with the HON Code, which has been adopted by Health Central?
Since folks are already using social media to promote off-label uses of prescription medications, what are, and what should be, the obligations of pharma companies to address the information put out by such folks?
Should we expect any of those obligations to change post-#FDASM (i.e., after the much-anticipated public hearing at the FDA on the use of social media in pharma marketing and subsequent anticipated rulemaking)?

Well, marketing of drugs for off-label uses is supposed to follow certain FDA rules -- not very restrictive, and essentially self-policed, since the rules just say that only medical journal articles on off-label uses may be shared with docs. Of course, some drug reps cross the line, and one pharma company -- Allergan, the maker of Botox -- is seeking to have even these limits lifted as unconstitutional limits on free speech. These rules apply to the pharma companies' reps, not independent bloggers, of course, but the HON Code (which ought to apply, given the Health Central endorsement of the blog in question) ought to impose some relevant standards. Consider Principle 5 - Justification of claims:

All information about the benefits or performance of any treatment (medical and/or surgical), commercial product or service are considered as claims. All claims have to be backed up with scientific evidence (medical journals, reports or others).

Pharma's concern about content created by others but posted on a pharma company web site or blog or other social media site should perhaps be extended to a concern about content posted by others on other sites. Both may be found just as easily, given the plethora of web search and alert tools now available. I am not suggesting that pharma companies be called upon to monitor the entire internet; rather, perhaps the time has come to create firmer rules about promotion of off-label uses of prescription drugs, to be enforced by state and federal authorities.

Without waiting for the public hearing to be completed and rules to be written (which could take a year), many pharma companies have already established a social media presence. While the manner in which they use the medium is a topic for another day, we should expect at least some of them to become more actively engaged in social media in the future.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Health Law Basics Plus: Two-day seminar in Boston this week

2009-11-02T11:20:27-05:00

Massachusetts Continuing Legal Education puts on its annual two-day extravaganza introduction to health law this week (November 4-5). I'll be speaking on post-acute care, and there is an all-star panel of speakers filling out the entire two days. If you are -- as they used to say -- within the sound of my voice and have an interest, please come on down. Bring your friends and neighbors. You can find more information on topics, speakers and and registration on the MCLE Health Law Basics Plus page.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Connected Health Symposium 2009 Wrap-up

2009-10-26T08:48:25-04:00

I attended the Connected Health Symposium last week in Boston and got a healthy dose of the past, present and future in health care connectivity, connectedness and connections. As always, I enjoyed connecting in person with a whole host of folks I know online -- including those who know my twitter handle, @healthblawg, better than my name.

The conference was kicked off by Stuart Altman, who regaled us with tales of his days with the Nixon Administration, and made a couple of key points:

The health care spending crisis is cased by rising prices, not rising utilization
Any federal health insurance reform will cause cost-shifting to the privately insured, the states, the young
Therefore the key to successful reform lies in reforming the payment system as well as the delivery system; otherwise we're "trying to grow flowers in a toxic environment."
Value-based purchasing (P4P), gainsharing, global payments are reasonable options for payment reform
Incentives for providers to use home-based systems will help heal the system at large, and promote connected health, which in turn promotes quality and efficiency

(But n.b.: while remote monitoring and home care will improve quality and reduce cost overall, it is not necessarily cost-effective for every patient.)

The conference closed the next afternoon with the official launch of the Journal of Participatory Medicine, presented to the group by members of the editorial board, re-emphasizing the need expressed in the intervening two days of sessions for clinicians to include patients in all aspects of managing their own care. (On this theme, see the JOPM kickoff on-line conference from earlier in the week, including e-Patient Dave's webcast How Great EHRs Empower Participatory Medicine; free registration required).

In between these two sessions, we heard from a wide range of speakers, panelist and vendors. I offer here an idiosyncratic sampling of some of the many overlapping sessions. (Please see the archived tweetstream from the conference, a couple of audio recordings of panel discussions on EHRs and PHRs, and please post links to other blog posts about the conference in comments below.)

Ed Markey, via videolink from DC, preached to the converted that the health care system needs CPR - connectivity, privacy and research (as the Center for Connected Health's Director, Joe Kvedar, tweeted, Markey has a terrific speechwriter). Markey has been delivering, having had a hand in building the national broadband network from his seat on the telecom committee, and in beefing up HIT privacy and security in the HITECH Act.

Jim Mongan, CEO of Partners, made the poignant comment that liberty, on the one hand, and justice for all, on the other hand, may be at odds with each other, and the unsurprising comment (from his perch atop a large IDS) that large IDS's are the way to go.

"It's the Network." Verizon's Rajeem Kapoor pitched his company's big entry into health care connectivity, noting that of 100,000 preventable errors per year in the US, 20% are due to the lack of immediate access to patient data.

A recurring theme: health care plans are designed by negotiation between payors and providers ... they need to include patients.

Tom Lee, also from Partners, said that payors and providers are engaged in co-evolution, and that they need to work together or else chaos will result. Lee also said: Global payment isn't about bending the cost curve, it's about enhancing value -- a different perspective than Altman's, but not unexpected from a large delivery system representative. The "alternative contract" offered by Blue Cross Blue Shield of Massachusetts is a global payment contract with risk adjustments, quality bonuses, and other bells and whistles, per Andrew Dreyfus (from BCBSMA) designed to fairly compensate and avoid perverse incentives for providers. The global payment system to be rolled out in Massachusetts over the next five years (maybe) is intended to separate insurance risk (not to be passed onto providers as it was in capitation's bad old days) and performance risk, or quality risk, which lies appropriately with the providers.

Since the current health care system is straddling the past and future, fee for service reimbursement in an age where a more holistic approach to care is recognized as preferred, Partners is paying physicians participating in a medical-home-like program a management fee to replace some of the lost FFS income. A panel on patient incentives yielded the observations that silos within health insurance companies lead to irrational decisions: a cost to one division could yield a many-times-larger savings to another division, but the first has no incentive to incur that cost.

In a panel discussion called The Futurists, Jay Sanders of WellDoc said we need to bring the exam room to where the patient is, and to personalize medicine (i.e., normal for me is not normal for you). Roy Schoenberg of American Well described his company's next step, plans to allow PCPs to bring specialists into the in-person patient visit; he also cited a Gartner prediction: By 2013, 25% of all health care encounters that can happen virtually, will. We also heard about implantable wireless sensors that will be able to transmit a stream of data and household robots from Microsoft.

In an interesting back-to-the-future answer to the question: What's the killer app? we heard this answer from Paul Williamson of Cambridge Consultants: Family-provided, wireless-enabled care. This vision of the future was echoed later in the day by Joe Kvedar, who posited as an ideal a world in which the patient coordinates self-managed care with a clinician as coach and an employer as enabler. A related recurring theme: The need to move to more of a team approach to care.

Some of the toys in the exhibit hall (some called it vaporware) seemed more geared to the futurists (e.g., Intel's offering, a wired home hub for communication among providers, case managers, family members and patients, now being put through its paces in a few demos), but some are ready to go now, sporting tags signifying their compliance with Continua connectivity standards (the Continua Alliance is a standards organization jump-started by Joe Ternullo, assistant director of the Center for Connected Health, who, along with director Joe Kvedar and the Center's staff, put on a terrific conference) -- and some are positively old warhorses already in widespread use, like Honeywell's offering, with interfaces for automated home monitoring and communication of data directly into interoperable EHRs or standalone software.

The Myca/HelloHealth presentation highlighted the robustness of the Myca platform (employee health programs -- Qualcomm was featured at length; are there others?), medical home programs for small physician practices with "fractional use" of physician extenders -- a new twist on the Vermont and South Carolina medical home pilots), PHR integration already there or on the way, lab results integration coming soon (Quest); reiterated the slow rollout of HelloHealth (12 practices so far); and demonstrated (in part via BCBS Ventures' investment in the company) that Jay Parkinson & Co. may not be able to put as much space between themselves and third-party payors as they may like. (This issue is not limited to HelloHealth, of course; the retail clinic sector, also founded on the premise of dissociation from third-party payors, has had to retrench; and some of the speakers also pointed to insurance companies as players not to be overlooked, due to the Willie Sutton factor . . . that's where the money is.)

Linda Magno, head of demonstration projects at CMS highlighted experiences with some demos and shared the podium with a couple of physician demo sites. Key takeway from her presentation was that payors (beyond government payors) are just not willing to pay more for improved quality. (Putting the Medicare managed care program / fiasco in the best possible light, her comment is consistent with the dismantling of that program, which pays higher prices, theoretically in exchange for more comprehensive care, because it was costing more than traditional FFS Medicare.)

Mark Bard, of Manhattan Research, shared some of his data re: physician internet use (doubled on-line work hours in past five years, and 2/3 of docs use smartphones in their practices -- using apps 15-20 times a day), and patient use of "Health 2.0" tools (doubled to 80 million in past two years). This demonstrates that moving health care to the cloud will not leave all providers and patients behind.

More than one speaker concluded that we need to subsidize healthy choices as well as tax unhealthy ones (e.g., tax the Big Mac and subsidize the salad).

John Halamka and John Glaser presented interesting personal counterpoint on the issue of changing behavior, Halamka saying he easily chose diet and exercise over putting "poison" (Lipitor) into his body, Glaser saying he went for the stent and still enjoys his hamburgers.

Other keynoters:

Nicholas Christakis (looking at obesity as a social network epidemic, using Framingham Heart Study data - see NY Times magazine treatment), offered a couple of terrific analogies: First, carbon makes coal, graphite and diamonds - the difference depends on the interconnections between carbon atoms. Second, the form of the network yields its function: are you finding the mastodon, or killing the mastodon? As Christakis was winding down, I tweeted: "Unanswered Q: How do we design health care interventions to leverage IRL social networks?" The immediate, slightly tongue-in-cheek, response from @cascadia (Sherry Reynolds), tweeting from the Pacific Northwest: "Ask women with actual friends."

Jason Hwang (co-author of The Innovator's Prescription, applying principles of disruptive innovation to health care) spoke about technology as enabling decentralization in health care as in other industries, through commoditization of historically valuable and expensive expertise, and the need to replace the hospital-centric model with new types of networks. This shift is already under way, of course.

Bottom line: Given the crushing cost of hospital-based health care services, the current and growing primary care physician shortage, and the expectation of high-quality health care services accessible to all, the Center for Connected Health is letting us all know that the road to the future is the information superhighway, paved with intelligent payment reforms -- but that the nodes in the network will always be human beings.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting