Health Care Law Blog

HIPAA Privacy Action Filed Against University Health Associates

noreply@blogger.com (RCoffield@fsblaw.com) — Mon, 23 Jan 2012 11:40:21 PST

The West Virginia Record reports the filing of a medical record breach action against West Virginia University Medical Corporation dba University Health Associates (UHA) under the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The action filed in Monongalia Circuit Court was filed by Jennifer M. McGinley on behalf of Randy Friend (11-C-774).

The complaint asserts that Mr. Friend received a letter from UHA indicating that an employee had accessed his medical record without authorization. Mr. Friend claims that his medical record was accessed multiple times by a former UHA employee and that this former employee related the medical information to several other people living in Mr. Friend's community causing him emotional distress and embarrassment.

Also, Jeff Drummond at the HIPAA Blog reports on an interesting lawsuit filed by the Minnesota AG against Accretive Health in Minnesota. The action involves Fairview Health and North Memorial who hired Accretive Health as its debt collection company. Accretive Health lost an unencrypted laptop with medical and other personal information. As Jeff indicates this has some interesting aspects including the question of direct liability of a business associate under the HITECH amendments to HIPAA and also whether the covered entities only disclosed the "minimum necessary" information to its debt collection company. Interesting case to watch develop.

UPDATE: The complaint filed in the United States District Court District of Minnesota, State of Minnesota, by its Attorney General Lori Swanson v.Accretive Health, Inc.

WVHCA: 2012 CON Capital Expenditure Minimum

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 03 Jan 2012 07:31:25 PST

The West Virginia Health Care Authority has announced the 2012 certificate of need capital expenditure minimum threshold of $2,916,104. The new threshold is effective beginning January 1, 2012. The threshold is used as a part of the analysis by health care providers who must determine whether or not a certificate of need is required for a proposed project or health care acquisition.

Pursuant to W.Va. Code 16-2D-2(h) and (s), the Authority is required to adjust the expenditure minimum annually and publish an update of the amount on or before December 31 of each year. The expenditure minimum adjustment isbased on the DRI inflation index published in the Global Insight DRI/WEFA Health Care Cost Review. The DRI inflation index as of December 31, 2011 is 2.9%.

Health Care Law Blog: Have a Wonderful Holiday Season!

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 23 Dec 2011 05:40:28 PST

Happy Holidays to my clients, health care and lawyer colleagues, and other readers of the

Health Care Law Blog

I appreciate your continued support and hope that 2012

will be as exciting and wonderful as this past year.

See you in 2012!

In years past I have sent out our standard Flaherty Sensabaugh Bonasso PLLC holiday card to thank my clients for trusting our firm with their business and my colleagues for all they do for me throughout the year. Instead, this year I decided to go GREEN and red by sending out an e-greeting and
do a holiday blog post with our firm's holiday greeting card.
We all play an important role in maintaining the environment.Thanks!

Thanksgiving 2011: Occupy The Dinner Table and Engage With Grace

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 24 Nov 2011 06:41:05 PST

The Engage with Grace Project is an effort to raise awareness of the importance of end of life care planning and discussing your wishes with your family and friends.

Dr. Bryan Vartabedian captures the simplicity of the project in his post, "It began with a simple idea: Create a tool to get people talking. Their tool is a slide with five questions designed to initiate dialog about our end-of-life preferences." Take time during the Thanksgiving weekend to "occupy the dinner table" with your family and friends. Discuss the 5 questions below and share your thoughts and feelings.

This is my 4th year participating in the Engage With Grace Project. What prompted me to start participating? It was having the opportunity to watch Alexander Drane tell Za's story at the 2008 Health 2.0 Conference. Her story personally connected as I shared in my 2008 blog post.

West Virginia is often negatively portrayed nationally at the bottom or top in national health rankings. However, it is great to see West Virginia leading the way on end of life care planning. 49% of West Virginians have filled out at least one advance directive -- the highest among all states reporting these statistics. However, this statistic shows how few of us actually take the time and effort to document our wishes. More than 1/2 of the population have left these difficult decisions to be made by their family and health care providers. This statistic shows the importance of the Engage With Grace message.

For West Virginia readers who want to learn more about end of life care check out the resources provided by the West Virginia Center for End of Life Care. There is valuable information for health care professionals to "Why and how to have end-of-life discussions with your patients", "Accessing Decision Making Capacity", and POST (Physicians Order for Scope of Treatment) Forms. The website also provides FAQs, educational videos, and forms, including the standard West Virginia Advanced Directive Forms.

West Virginia is also creating the e-Directive Registry in conjunction with the West Virginia Health Information Network (WVHIN), West Virginia's health information exchange (HIE). The e-registry will store advance directive forms, Physicians Orders for Scope of Treatment forms, and do not resuscitate cards. The registry will allow treating health care providers to access the stored information 24/7 from around the state through the WVHIN. Most importantly, the registry will be accessible by you and I as health care consumers to verify the accuracy of our wishes.

Following is the 2011 blog post by the Engage With Grace Team -- Occupy With Grace. Help spread the word this Thanksgiving weekend by telling your end of life care story and posting the message below. You can get the HTML to post here.

Occupy With Grace

Once again, this Thanksgiving we are grateful to all the people who keep this mission alive day after day: to ensure that each and every one of us understands, communicates, and has honored their end of life wishes.
Seems almost more fitting than usual this year, the year of making change happen. 2011 gave us the Arab Spring, people on the ground using social media to organize a real political revolution. And now, love it or hate it - it's the Occupy Wall Street movement that's got people talking.
Smart people (like our good friend Susannah Fox) have made the point that unlike those political and economic movements, our mission isn't an issue we need to raise our fists about - it's an issue we have the luxury of being able to hold hands about.

It's a mission that's driven by all the personal stories we've heard of people who've seen their loved ones suffer unnecessarily at the end of their lives.

It's driven by that ripping-off-the-band-aid feeling of relief you get when you've finally broached the subject of end of life wishes with your family, free from the burden of just not knowing what they'd want for themselves, and knowing you could advocate for these wishes if your loved one weren't able to speak up for themselves.

And it's driven by knowing that this is a conversation that needs to happen early, and often. One of the greatest gifts you can give the ones you love is making sure you're all on the same page. In the words of the amazing Atul Gawande, you only die once! Die the way you want. Make sure your loved ones get that same gift. And there is a way to engage in this topic with grace!

Here are the five questions, read them, consider them, answer them (you can securely save your answers at the Engage with Grace site), share your answers with your loved ones. It doesn't matter what your answers are, it just matters that you know them for yourself, and for your loved ones. And they for you.

We all know the power of a group that decides to assemble. In fact, we recently spent an amazing couple days with the members of the Coalition to Transform Advanced Care, or C-TAC, working together to channel so much of the extraordinary work that organizations are already doing to improve the quality of care for our country's sickest and most vulnerable.

Noted journalist Eleanor Clift gave an amazing talk, finding a way to weave humor and joy into her telling of the story she shared in this Health Affairs article. She elegantly sums up (as only she can) the reason that we have this blog rally every year:

For too many physicians, that conversation is hard to have, and families, too, are reluctant to initiate a discussion about what Mom or Dad might want until they're in a crisis, which isn't the best time to make these kinds of decisions. Ideally, that conversation should begin at the kitchen table with family members, rather than in a doctor's office.

It's a conversation you need to have wherever and whenever you can, and the more people you can rope into it, the better! Make this conversation a part of your Thanksgiving weekend, there will be a right moment, you just might not realize how right it was until you begin the conversation.
This is a time to be inspired, informed - to tackle our challenges in real, substantive, and scalable ways. Participating in this blog rally is just one small, yet huge, way that we can each keep that fire burning in our bellies, long after the turkey dinner is gone.
Wishing you and yours a happy and healthy holiday season. Let's Engage with Grace together.

To learn more please go to www.engagewithgrace.org.This post was developed by Alexandra Drane and the Engage With Grace team.

HIPAA/HITECH Audits: OCR Program to Audit 150 Covered Entities

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 09 Nov 2011 03:39:01 PST

Today the Office for Civil Right (OCR) announced details of a pilot program to perform up to 150 audits of covered entities to assess privacy and security compliance under HIPAA. OCR will be conducting the audits between November 2011 and December 2012.

The days of waiting for HIPAA privacy and security enforcement activities are over. The announcement of these planned audits will get the attention of health care providers who have failed to focus on HIPAA privacy and security compliance efforts. The announcement will remind all health care providers to maintain an active, current HIPAA privacy and security compliance program.

OCR provides more detail on the audit program on the OCR HIPAA Audit Program page, including this description of the program objectives:

The audit program serves as a new part of OCR’s health information privacy and security compliance program. OCR will use the audit program to assess HIPAA compliance efforts by a range of covered entities, Audits present a new opportunity to examine mechanisms for compliance, identify best practices and discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews. OCR will broadly share best practices gleaned through the audit process and guidance targeted to observed compliance challenges via this web site and other outreach portals.

The OCR HIPAA Audit Program page also provides detail on when the audits will begin, who will be audited, how the audit process will work, and what will happen after the audit. The information indicates that they will select a broad range of covered entities for the first round of audits and that business associates will be included in future audits.

OCR provides the graphic below to help describe how the audits will be performed. Covered entities will be selected, notified, and asked to provide documentation of privacy and security compliance efforts within 10 business days. An onsite visit will occur and interviews will be performed. A draft report will be provided to the covered entity and there will be a procedure for the covered entity to discuss the areas of concern raised in the audit and describe any corrective action they may implement.

The HIPAA audits are a requirement under the American Recovery and Reinvestment Act of 2009 (Section 13411). HHS awarded to KPMG a $9 million dollar contract earlier this year to assist OCR with the audits.

University of California Settles Potential HIPAA Privacy and Security Violations with OCR for $865,500

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 08 Jul 2011 12:08:58 PDT

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced that the University of California at Los Angeles Health System which includes UCLA Ronald Reagan Medical Center, UCLA Santa Monica Medical Center, and Orthopedic Hospital, Resnick Neuropsychiatric Hospital, and the Faculty Practice Group of UCLA (UCLAHS) has agreed to settle potential violations under the HIPAA Privacy and Security Rules for $865,500. Read the OCR press release.

The settlement highlights that hospitals, physicians, and other covered entities must understand the importance of monitoring the level of access workforce members have to medical and health information. Covered entities must have policies and procedures in place and educate workforce members about only accessing records for necessary and permissible purposes. This settlement resulted from an investigation by OCR after certain celebrity/VIP patients at the UCLA facilities complained that hospital staff, including unauthorized physicians, had inappropriately accessed their health and medical information.

UCLAHS agreed to a Corrective Action Plan for a period of three years under the terms of the Resolution Agreement. The Corrective Action Plan requires UCLAHS to review/update its current HIPAA policies and procedures, conduct follow up workforce training, monitor compliance and submit a monitoring plan, and submit an implementation report and annual reports to OCR. of can be found attached to the Resolution Agreement.

The Resolution Agreement described the events that occurred that lead to the settlement as follows:

On June 5, 2009 and June 30, 2009, HHS began investigations of two separate complaints alleging that the Covered Entity was in violation of the Privacy and/or Security Rules. The investigations indicated that the following conduct occurred (“Covered Conduct”):

(i) During the period from August 31, 2005 to November 16, 2005, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of Covered Entity patients, and during the period from January 31, 2008 to February 2, 2008, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of a Covered Entity patient.

(ii) During the period 2005-2008, a workforce member of Covered Entity employed in the office of the Director of Nursing repeatedly and without a permissible reason examined the electronic protected health information of many patients.

(iii) During the period 2005-2008, Covered Entity did not provide and/or did not document the provision of necessary and appropriate Privacy and/or Security Rule training for all members of its workforce to carry out their function within the Covered Entity.

(iv) During the period 2005-2008, Covered Entity failed to apply appropriate sanctions and/or document sanctions on workforce members who impermissibly examined electronic protected health information.

(v) During the period from 2005-2009, Covered Entity failed to implement security measures sufficient to reduce the risks of impermissible access to electronic protected health information by unauthorized users to a reasonable and appropriate level.

More information and background can be found in the iHealthBeat article, UCLA Health System Agrees to Pay $865K over Privacy Breaches, including a link to a statement on the settlement issued by UCLH Health System.

4th Circuit Affirms Withholding of WV Medicaid Funds

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 06 Jul 2011 16:49:33 PDT

Today the United States Court of Appeals for the 4th Circuit affirmed a ruling by the district court in West Virginia which sustained a disallowance of federal funding by the Centers for Medicare & Medicaid Services (CMS) against the West Virginia Medicaid Program.

The 4th Circuit Decision in West Virginia Department of Health and Human Resources, Bureau for Medical Services vs. Kathleen Sebelius, et al. ruled that CMS acted within its authority when it withheld from the West Virginia Department of Health and Human Resources, Bureau of Medical Services, West Virginia'a Medicaid Program (DHHR) approximately $634,000 (which was reduced to approximately $446,000)in Medicaid funding, which represented it share of overpayment made to providers as a result of Dey, Inc., a pharmaceutical company, alleged fraud. CMS notified DHHR of the disallowance after Dey entered into an $850,000 settlement of claims brought by the West Virginia Attorney General on behalf of West Virginia under West Virginia's Consumer Credit and Protection Act.

The disallowance by CMS was calculated by multiplying the state's estimated damages allocable to Medicaid, approximately 67% by the settlement amount adn then multiplied this figure by West Virginia's FMAP rate of 78.14% to arrive at the $446,000 amount. The HHS Department of Appeals Board concluded that this allocation methodology was reasonable.

I have only done an initial review of the decision and won't go into the merits of the arguments at this time. Read the full decision for a more complete understanding of the decision and check out today's article in the Charleston Daily Mail.

2011 AHLA Annual Meeting: How to Use Social Media with @BobCoffield

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 28 Jun 2011 14:45:00 PDT

Welcome How to Use Social Media session students and others.

I hope you enjoyed my presentation during the afternoon health care social media sessions at the 2011 American Health Lawyers Association Annual Meeting in Boston. The health care social media sessions this afternoon were a great introduction to a variety of practical and legal issues surrounding the world of social media and its impact on the health care industry.

Now it is time for you to do your "out of the classroom" social media assignment using the SOCIAL MEDIA bucket list. Click on the linked Google Doc and get started. Good luck!

Below is a copy of the written materials from today's session which were posted here using Scribd. If you want to review my Prezi slides from my presentation watch it below and then go explore Prezi.

If you have any questions send me a Tweet at @BobCoffield. Follow along with the tweets from the AHLA Annual Meeting at #AHLABoston. David Harlow (@HealthBlawg) also set up a Cover It Live Twitter feed for the Annual Meeting tweets. Thanks for attending the session.

How to Use Social by @BobCoffield (AHLA Annual Mtg 2011) on Prezi

How to Use Social Media (AHLA Annual Mtg - Coffield)

AHLA Boston "TWEETup"

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 21 Jun 2011 10:26:19 PDT

Plans are set for a "TWEETup" during the American Health Lawyers Association 2011 Annual Meeting next week in Boston. All registered health lawyers are welcome along with other Boston area Twitter friends, Boston's Health 2.0 community, health care social media aficionados, and anyone else interested in the intersection of social media and the law.

Come join us at the #AHLABoston TWEETup on Tuesday, June 28 starting around 5:30pm at the BrasserieJO bar located across from the Prudential Center at The Colonnade Hotel, 120 Huntington Avenue. The BrasserieJO is located down Huntington Avenue near the Boston Marriott Copley Place, the location of the annual meeting.

Check out the TwtVite set up by David Harlow at HealthBlawg and RSVP that you will be attending. Help us spread the word.

The TWEETup follows an afternoon of health care social media and the law sessions held as a part of the AHLA Annual Meeting. For full details of the sessions and registration information check out the AHLA Annual Meeting schedule here (PDF version).The sessions run from 2pm - 5:30pm and will include:

A Legal Ethics Safety Line for Health Lawyers Online: How to Practice Safe Social Networking
Alan S. Goldberg (@GoldbergLawyer), Annie Hsu

E-Discovery Litigation
Gary L. Kaplan (@Gary_L_Kaplan), Joshua P. Kubicki (@JKubicki)

Cutting the PowerPoint Clutter: Using Zen-Like Visuals for more Compelling and Memorable Presentations
Susan Peterson

Should Health Lawyers Use Social Media?
David Harlow (@HealthBlawg)

HIPAA Privacy Issues in Social Media
Jodi Goldstein Daniel (@JodiDaniel), Daniel S. Goldman (@danielg280)

How to Use Social Media
Robert L. Coffield (@BobCoffield), David Harlow (@HealthBlawg), Gary L. Kaplan (@Gary_L_Kaplan)

Triaging Social Media in the Healthcare Workplace: Assessment, Analysis and Action
Mark W. Peters

A special thanks to @HealthBlawg for helping find the location for the TWEETup. Thanks to all the AHLA health lawyer and others spreading the word about the tweetup. Be sure to follow @HealthLawyers and use the AHLA Annual Meeting hashtag: #AHLABoston.

WVHCA: Notice of Public Comment Period on Proposed Amendments to CON Standards for Megavoltage Radiation Therapy Services/Units

noreply@blogger.com (RCoffield@fsblaw.com) — Mon, 20 Jun 2011 08:45:54 PDT

The West Virginia Health Care Authority has issued a Notice of Public Comment Period to obtain comments on proposed amendments to Certificate of Need Standards for Megavoltage Radiation Therapy Services/Units.

Here are the "proposed amendments" to the Megavoltage Radiation Therapy Services/Units. Here is a link to the current CON Standards for Megavoltage Radiation Therapy Services/Unit (Approved by Governor on October 9, 2002).

Written comments must be submitted to Tim Adkins, Director of Certificate of Need, at the West Virginia Health Care Authority, 100 Dee Drive, Charleston, West Virginia 25311, no later than July 15, 2011.

The Twitter Trap: Are we outsourcing our brains to the cloud?

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 17 Jun 2011 07:05:50 PDT

The Twitter Trap by Bill Keller (@NYTKeller), Executive Editor of The New York Times captures many of the thoughts I have been having lately about the impact social media and technology is having on our society. Where does it end? What will be the future? How will it change us as humans? As a society? Like Mr. Keller, I have had similar feelings as I watch the impact on my 7 and 10 year old children.

Recently I have been preparing a presentation for the AHLA Annual Meeting at the end of June on the practical ways health lawyers can and should use social media. As a result I have tried to step back from the social media explosion to examine some of these issues, including the parallels between Mark Zuckerberg and Johannes Gutenberg referenced in Mr. Keller's piece.

I love this quote from Mr. Keller's article that helps visualize the innovation/disruption/impact cycle:

"My father, who was trained in engineering at M.I.T. in the slide-rule era, often lamented the way the pocket calculator, for all its convenience, diminished my generation’s math skills. Many of us have discovered that navigating by G.P.S. has undermined our mastery of city streets and perhaps even impaired our innate sense of direction. Typing pretty much killed penmanship. Twitter and YouTube are nibbling away at our attention spans. And what little memory we had not already surrendered to Gutenberg we have relinquished to Google. Why remember what you can look up in seconds?"

I also like his explanation of Twitter as a tool, "So let me be clear that Twitter is a brilliant device — a megaphone for promotion, a seine for information, a helpful organizing tool for everything from dog-lover meet-ups to revolutions."

His question around whether these new social media instruments are genuinely social is a good one. It is hard to see the answer to this when you are sitting in the midst of the social media cloud. One question that he doesn't address is how the collection of all this "collective social media data" about you and me will be used in the future. Is Facebook just one big social experiment. It now knows more about my family and friends than I can probably remember.

Take time away from your Twitter and Facebook posts, go read the article, and then sit back and take some quiet time to reflect on his message. I will leave you with this quote from Mr. Keller's article:

"The things we may be unlearning, tweet by tweet — complexity, acuity, patience, wisdom, intimacy — are things that matter."

Thanks to Jason Keeling (@JasonKeeling) for pointing out this insightful piece that was published back in print on May 22, 2011.

JP Morgan Healthcare Conference HIT Panel Discussion with Schmidt, Chopra, and Park

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 12 Jun 2011 12:01:24 PDT

If you follow health information technology and are interested in the future of health care take time and listen to this panel discussion on Innovation Opportunities for the Health Information Technology Market with Eric Schmidt, Chairman of Google, Aneesh Chopra, Federal CTO for the United States, Todd Park, CTO of HHS, and moderated by John Doerr, venture capitalist at Kleiner Perkins.

The panel discussion was part of the Annual J.P. Morgan Healthcare Conference held in January 2011.

To start off moderator, John Doerr has the audience rattle off a bunch of great questions for the panel to address. Just listening to the questions will make you want to listen to the panel discussion.

Thanks to Susannah Fox and Claudia Williams for tweeting the link. Thanks to Brian Ahier (@Ahier) for posting the Vimeo link to the panel discussion.

OIG HEAT Provider Compliance Training Webcast

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 08 Jun 2011 11:58:57 PDT

The Office of Inspector General (OIG) has made available the Health Care Fraud Prevention and Enforcement Team (HEAT) Provider Compliance Training webcast. OIG is making the training information available to help highlight and educate providers on the the federal government's effort to fight health care fraud and abuse.

More information about HEAT Task Force and its mission and efforts can be found on the StopMedicareFraud website. The training information includes 16 modules:

Welcome Remarks 4:37
Overview of OIG 9:56
Navigating the Fraud and Abuse Laws 26:26
Compliance Program Basics 17:01
Operating an Effective Compliance Program 15:59
Understanding Program Exclusions 10:26
Navigating the Government 5:10
Overview of Centers for Medicare and Medicaid Services 34:24
Importance of Documentation 17:06
OIG Subpoenas Audits Surveys and Self Disclosure Protocol 17:42
Health Care Fraud Enforcement Panel 6:08
Health Care Fraud Enforcement Panel with CMS Deputy Admin 13:43
Health Care Fraud Enforcement Panel with Special Agent 15:10
Health Care Fraud Enforcement Panel with Asst. US Attorney 17:08
Health Care Fraud Enforcement Panel - Fraud Control Unit 11:15
Adjournment 0:59

HIPAA Privacy Rule Accounting of Disclosures under HITECH

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 31 May 2011 08:57:44 PDT

Today's Federal Register includes the Office of Civil Rights (OCR) Notice of Proposed Rulemaking (NPRM) modifying the HIPAA Privacy Rule's Accounting of Disclosure requirements for protected health information. OCR was required to make these modifications to the HIPAA Privacy Rule to implement the requirements under the Health Information Technology for Economic and Clinical Health Act (HITECH) section of the ARRA.

HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act, Office for Civil Rights, Notice of Proposed Rulemaking (76 FR 31426, May 31, 2011)

The regulations greatly expand the responsibility for health care covered entities and business associates to document and track the use and disclosure of health information held in an electronic health record (EHR). Health care providers and business associates should plan to thoroughly review these new regulations to understand the impact on their existing policies and procedures.

The regulations outline new procedures for accounting of disclosures of health information held in an electronic health record and disclosed for treatment, payment, and health care operations (as defined under HIPAA). The accounting period under the proposed regulations is three years. The proposed regulations focus on two rights for individuals -- a right to an accounting of disclosure and a "new" right to an access report. The new access report does not distinguish between a use (think internal use by a health care provider) and disclosure (providing the information to a third party). Instead the new right to an access report focuses on whether someone "accessed" the information in the EHR.

Previously under HIPAA, uses and disclosures for treatment, payment, and health care operations (commonly referred to as "TPO") were exempt from the accounting of disclosures requirements. The requirement for accounting for some limited uses and disclosures has always been a part of the HIPAA Privacy Rule.

The rule proposes separate compliance dates for the changes to the accounting of disclosures requirements (180 days after the effective date of the final rule - 240 days after publication of the final rule) and for the right to receive an access report (beginning January 1, 2013, for any EHR system acquired after January 1, 2009 and January 1, 2014, for any EHR system acquired on or before January 1, 2009).

My initial comments above are based upon a quick review of the proposed regulations. Official comments on the NPRM must be submitted on or before August 1, 2011.

Practical Guidance on Medicare Physician Signature Requirements

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 24 May 2011 06:40:59 PDT

I was recently researching the physician signature requirements under the Medicare program and found this resource outlining some of key questions and answers around the requirements.

The Centers for Medicare & Medicaid Services Medicare Learning Network has issued a fact sheet on Comprehensive Error Rate Testing (CERT) Signature Requirements with the Q and A. Also mentioned in the guidance as a resourceis the Medicare Learning Network's MLN Matters Article MM6698, "Signature Guidelines for Medical Review Purposes."

FSB Welcomes Tom Clark

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 22 May 2011 10:53:03 PDT

A warm welcome to J. Thomas "Tom" Clark who recently joined Flaherty Sensabaugh Bonasso PLLC as Senior Counsel. Tom is a welcomed addition to our corporate practice group and will help to expand the level of representation that we provide our health care, oil and gas, coal and banking industry clients.

Tom comes to FSB with over 10 years of experience in handling business organization and commercial transactions. Tom received his undergraduate degree from Virginia Tech in 1993 and his J.D. from the University of Pittsburgh in 1997.

HITECH Final Regulations Update: Coming Soon!

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 13 May 2011 13:31:11 PDT

Susan McAndrew, deputy director for health information privacy at the Office for Civil Rights (OCR) indicated this week that various final regulations modifying the HIPAA privacy and security rules required by the Health Information Technology for Economic and Clinical Health Act (HITECH) will be issued soon. Health lawyers have been waiting on these regulations to better understand the full impact of the HITECH changes to HIPAA, including whether the "harm standard" will remain a part of the Interim Final Rule on breach notification.

According to a Health Information Security News article, McAndrew made this announcement this week while speaking at the 2011 NIST HIPAA Conference, Safeguarding Health Information: Building Assurance through HIPAA Security, held in Washington.

The article also indicated that a separate NPRM will be issued announcing the approach OCR plans to take regarding the accounting for disclosure modifications under the HITECH Act. The HITECH Act modified the traditional rule regarding those types of uses and disclosures that must be accounted for by health care providers and covered entities. Under the traditional rule -- health care providers did not have to provide an accounting of disclosure for uses and disclosures for treatment, payment, and health care operations. However, the modification by the HITECH Act now requires health care providers who utilize an electronic health record system (EHR)to provide, upon request, an accounting of disclosure of all uses and disclosures including those for treatment, payment, and health care operations which occurred within the last three year period. Of further interest will be how the NPRM suggests how business associates who obtain PHI from health care providers must also track and maintain a list of uses and disclosures for accounting of disclosure requests.

WVCLE: Health Care Law 2011 Seminar

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 10 May 2011 12:30:56 PDT

The West Virginia Continuing Legal Education Section of WVU College of Law will be sponsoring Health Care Law 2011 Seminar on May 20, 2011, in Charleston, West Virginia at WVU Medical Center - CAMC.

The Health Care Law 2011 Seminar will cover a variety of topics of interest to West Virginia health care attorneys. Topics include: Medical Mapractice Update, Protecting Medicare's Interest Under Section 111 and Mandatory Reporting Requirments, Risk Management Topics for Hospitals, Development and Update on ACOs, HIPAA/HITECH Update and Anatomy of a Health Care Data Breach, Stark and Fraud Abuse Update, and Lawyers and Law Firms as Business Associates.

I will be speaking on the changes to HIPAA under HITECH. The title for my presentation is "Anatomy of a Breach: Practical Tools to Handle a Breach and HIPAA/HITECH Updates."

Learn more about the seminar and how to register here.

Leaves of 3 Let Them Be: Poison Ivy Advice from Dr. Coffield

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 10 Apr 2011 07:35:41 PDT

Last week I was looking through some old printed emails and I ran across advice about poison ivy from my dad, LeMoyne Coffield. Since Spring is on the way and the poison ivy is starting to grow I thought I would share this with everyone (including some good advice for the golfers).

My dad was not only my dad but he was my (our) family doctor. He was a lot of peoples family doctor. He had a wonderful way of providing advice and recommendations to his patients. His medical advice wasn't always the easiest and quickest solution - but it was usually the best long term practical advice.

I wrote him an email back in the Spring of 2000. I had been cleaning up an area behind our house and had gotten a bad case of poison ivy on my arms, neck, and face. I started the email by saying, "Thought I would let you know that spring has arrived -- I got my first bout of poison ivy. Some lessons you taught me as a child (and adult) have never gotten through." As children he was always pointing out poison ivy, showing us what it looked like, and hoping that we would learn how to spot it from a distance. My email went on to say that I had gone to see my primary care doctor and he had prescribed an oral steroid (prednisone) and I said, "What do you think?" Like I often did - I was emailing him for his second opinion. Below is his advice back to me. Good advice for anyone who is starting their spring yard cleaning.

By the way - if you don't know what poison ivy looks like look at this and remember, "Leaves of 3 let them be."

OCR Seeks FY2012 Budget Increase of $5.6M for HIPAA Compliance and Enforcement

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 17 Mar 2011 08:35:29 PDT

HealthLeaders reports that the Office of Civil Rights (OCR) is seeking an additional $5.6 million in its Fiscal Year 2012 budget proposal to fund its HIPAA compliance and enforcement activities.

The article also details the most current reported numbers on breaches reported to OCR. As of March 16 there have been 249 entities that have reported breaches affecting 500 or more individuals. To view the current data and details on reported breaches go to the OCR Breaches Affecting 500 or More Individuals.

OCR Imposes $4.3M Penalty for Violation of HIPAA/HITECH Privacy Rule

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 23 Feb 2011 09:33:08 PST

UNTIL TODAY, many health care providers questioned whether HHS and the Office of Civil Rights (OCR) would ever issue any significant penalties for violations of the HIPAA Privacy Rule. However, will OCR ever be able to collect the penalties.

Today, HHS Office of Civil Rights (OCR) announced a civil money penalty (CMP) of $4.3 million against Cignet Health of Prince George's County, MD for violating the HIPAA Privacy Rule. This is the first ever civil money penalty issued by OCR for a violation of the HIPAA Privacy Rule. It is significant not only because it is the first - but also because of the size of the penalty and the basis for the violation.

OCR issued a Notice of Final Determination on February 4, 2011, outlining the procedure for payment of the $4.3 million civil money penalty. The Notice of Final Determination also indicates that Cignet failed to request a hearing on the matter or reach settlement with OCR. Prior to the issuance of the final notice, OCR had issued a Notice of Proposed Determination on October 20, 2010, which details the basis for the penalty, details the findings of fact, grounds for violation of HIPAA, and calculation of the penalty amount.

The Notice of Proposed Determination indicates that Cignet violated HIPAA by failing to provide individuals access to their health information under 45 CFR 164.524 and failed to cooperate with an investigation under 45 CFR 160.310(b). The Notice states:

1. Failure to Provide Access (45 C.F.R. § 164.524). Cignet failed to provide 41 individuals listed in Attachment A timely access to obtain a copy of the protected health information about them in the designated record sets (medical records) maintained by Cignet. These failures constitute violations of 45 C.F.R. § 164.524. Cignet's failure to provide each individual with access constitutes a separate violation of 45 C.F.R. § 164.524, and each day that the violation continued (that is, from the date specified in column 5 of Attachment A until April 7,2010) counts as a separate violation of 45 C.F.R. § 164.524.

2. Failure to Cooperate with an Investigation (45 C.F.R. § I60.310(b)). Cignet failed to cooperate with OCR's investigation of 27 complaints regarding Cignet's noncompliance described in paragraph 1 above. These failures to cooperate with an investigation constitute violations of 45 C.F.R. § 160.310(b). Cignet's failure to cooperate with OCR's investigation of each complaint constitutes a separate violation of 45 C.F.R. § 160.310(b), and each day that the violation continued (that is, from the date specified in column 7 of Attachment A until April 7, 2010) counts as a separate violation of 45 C.F.R. § 160.310(b). Each violation of 45 C.F.R. § 160.310(b) was due to Cignet's willful neglect of its obligation to comply with 45 C.F.R. § 160.310(b). Willful neglect means the conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated. See 45 C.F.R. § 160.401.

The press release issued by HHS points out that the HIPAA Privacy Rule requires that health care providers must provide a patient with access and/or copy of their health information within 30 days (and no later than 60) days after the patient requests such information. Further, the press release indicates that covered entities and business associates must uphold their responsibility to provide patients with access to their own health information.

Read the HHS Press Release and OCR Press Release. More details via the OCR's Resolution Agreement page. For more background on Cignet Health check out David Harlow's post at HealthBlawg, HIPAA CMP's: What's the point?

WVDHHR Transfers OHFLAC Staff and Operations to OIG

noreply@blogger.com (RCoffield@fsblaw.com) — Mon, 31 Jan 2011 11:40:49 PST

According to the West Virginia Department of Health and Human Resources (DHHR), the West Virginia Office of Health Facility Licensure and Certification (OHFLAC) will be transferred to the West Virginia Office of Inspector General (OIG) effective February 1, 2010. OHFLAC oversees the state and federal licensure and certification process in West Virginia for hospitals, critical access hospitals, behavioral health facilities, home health agencies, hospice agencies, ESRD services, and other health care services.

All personnel and positions currently assigned to OHFLAC will be administratively transferred. DHHR has states that this action is to further enhance the integrity of the regulatory unit of the Department of Health and Human Resources.

Body Browser: Think Google Earth for the Human Body!

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 17 Dec 2010 08:04:44 PST

Yesterday Google released Body Browser. Think Google Earth for human anatomy.

Body Browser is described as a 3-dimensional multi-layered anatomical model of the human body that you can rotate, zoom in on, and search. More information about Body Browser is available in Google Labs.

Great to see Google developing this new tool that should be useful for educators, physicians, and others in the health care field. I can't wait to show this new tool to my kids.

Thanks to Brian Klepper over at Care and Cost for blogging about this new Google health tool.

Very cool!

West Virginia Connect

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 12 Dec 2010 06:13:00 PST

Today's Charleston Gazette features an article on a new health care demonstration project, West Virginia Connect, funded by a $36 million federal Health Resources and Services Administration (HRSA) grant.

The article indicates that the funding will be for eight West Virginia primary care clinics to provide preventative care services to eligible health consumers for a flat $35 per month. The services will include unlimited doctor visits, immunizations and screenings, chronic disease management, and minor surgical procedures.

To be eligible to particpate a person must have a job, be between 19 and 64, and make less than $43,320 for a single person or $88,200 for a family of four. In return, participants have to let the state fold their medical data - blood pressure, blood sugar, etc. - into an anonymous 10,000-person database the state plans to use to make more informed choices as health-care reform unfolds.

The article indicates that the primary care centers involved say the project is intended to:

generate useful information about uninsured West Virginians and cost-effective ways to treat chronic diseases;
demonstrate lowered emergency room usage, hospital stays, and times when people don't show up for appointments;
develop an electronic patient tracking system other centers can use;create a catalogue of best practices that help people take better care of their own health;
help the health system get ready for 2014, when hundreds of thousands will be newly insured through federal reform.

This is the first I have heard about this demonstration project. Other than this Grantee Project Abstract at HRSA website, I was unable to find any additional information or links about the demonstration project online. The article indicates that the project is currently governed by a steering committee of the DHHR secretary, insurance commissioner, and director of the GO HELP office.

West Virginia PEIA: Innovative Steps to Improve Long Term Health of West Virginia

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 05 Dec 2010 06:55:56 PST

This past week the West Virginia Public Employees Insurance Agency (PEIA) announced a creative and proactive health initiative to improve the health of West Virginians and move toward keeping future health care costs down for state and public school employees and ultimately for West Virginia taxpayer. Charleston Gazette's Phil Kabler reports on the initiative in "PEIA insurees can offset premiums increase."

The Improve Your Score initiative is a part of PEIA's Pathways to Wellness. PEIA announced that state and public school employees will have no health care premium increase this year if they comply with two requirements.The two requirements:

Undergo a four-step wellness screening to measure waist circumference, total cholesterol, blood pressure, and blood glucose. Completion of the screening provides a $10-a-month premium discount.
Submit an affidavit verifying they have filed an advanced directive for end-of-life care, sometimes called a "living will." That provides an additional $4-a-month discount.

Wonderful to see West Virginia, often more known nationally for unhealthy news, taking a proactive approach to improving West Virginians health by promoting a wellness activity and encouraging end of life care planning. Both initiatives will help to curb the long term impact on our state's health care cost problems and help West Virginia's become more active in understanding and managing their (un)healthy problems.