Health Care Law Blog

TWiL Episode 26: Health Care and VRM

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 14 Jul 2009 07:38:04 PDT

Tomorrow I have the pleasure of being a guest on This Week in Law (TWiL) hosted by Denise Howell (@dhowell) Denise is one of the pioneers of law bloggers (blawgers) who blogs over at Bag and Baggage.

TWiL Episode 26 will focus on Health Care, Technology and VRM. Joining me on the show will be Doc Searls (@dsearls) author of The Cluetrain Manifesto, Fellow with the Berkman Center for Internet and Society at Harvard, etc. and Susanna Fox (@SusannahFox), Associate Director, Digital Strategy at Pew Internet & American Life Project.

Catch the live version at 2pm EST tomorrow at TWiT (http://live.twit.tv). You can also listen to the rebroadcast as a podcast here or subscribe and listen to TWiL including the Episode 26 Podcast at iTunes.

Thanks to Audible.com for sponsoring the show.

WV Northern District Court: Attorney Filing Manual

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 07 Jul 2009 20:55:09 PDT

Brian Peterson highlights a great resource for lawyers who regularly practice in the United States District Court for the Northern District Court of West Virginia.

The Attorney Filing Manual is a 20 page manual that provides guidance to lawyers on how to e-file certain types of documents wth the Court. The manual explains when documents should be filed electronically and the exceptions to the mandatory electronic filing requirements. The manual contains specifics on the filing of all types of pleadings and provides sample certificate of services format for electronic filing.

The manual also discussed the use of "hyperlinks" in documents and allows electronically filed documents to contain hyperlinks to other portions of the document or to internet sites that contain source documkents for citations. However, the manual states that hyperlinks do not replace standard citations format and "neither the hyperlink, or any site to which it refers, shall be considered part of the record."

AHLA Annual Meeting 2009: PHRs, Health 2.0 and the Impact of Social Media on Health Care

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 30 Jun 2009 22:48:33 PDT

Today I am giving a presentation with Jud DeLoss on the topic of "PHRs, Health 2.0 and the Impact of Social Media on Health Care" at the American Health Lawyers Association 2009 Annual Meeting in Washington, DC.

As a part of the presentation we are sharing the slides from the presentation with the attendees via SlideShare. Below is a copy of the slide deck from the presentation.

PHRs, Health 2.0 and the Impact of Social Media on Health Care

View more documents from Bob Coffield.

Support the Declaration of Health Data Rights: #MyHealthData

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 26 Jun 2009 00:57:01 PDT

The Declaration of Health Data Rights collaborative effort was announced this week by setting forth a simple, straightforward framework for health consumers right to their personal health information.

The social media driven initiative has grown support throughout the week. The effort is being endorsed and supported by a variety of companies/organizations and bloggers. The traditional media has also covered the initiative, including the NYT, "A Push for the Wired Patient's Bill of Rights," Boston Globe, "Health data rights declaration gets push,"and the Huffington Post, "Release 0.9 HealthDataRights Beta Version."

This evening I formally endorsed the declaration and statement of rights (Endorser #793). Read more about the initiave and consider supporting the effort at HealthDataRights.org. You can also follow the discussion on the declaration via twitter at the tag #myhealthdata.

The rights set forth in the declaration are largely supported by existing state and federal law, including changes to be implemented under the new HITECH provisions of the American Recovery and Reinvestment Act of 2009. The declaration serves as a simplified and concise statement of rights that helps to alert and engage patients of the role they need to play as better health consumers. Engaged health consumers play a key role in creating the needed change and improvement in our health care delivery system.

A Declaration of Health Data Rights

In an era when technology allows personal health information to be more easily stored, updated, accessed and exchanged, the following rights should be self-evident and inalienable. We the people:

Have the right to our own health data
Have the right to know the source of each health data element
Have the right to take possession of a complete copy of our individual health data, without delay, at minimal or no cost; if data exist in computable form, they must be made available in that form
Have the right to share our health data with others as we see fit

These principles express basic human rights as well as essential elements of health care that is participatory, appropriate and in the interests of each patient. No law or policy should abridge these rights.

Proposed Certificate of Need Rule: Hospital Ambulatory Health Care Facility

noreply@blogger.com (RCoffield@fsblaw.com) — Sun, 21 Jun 2009 11:55:37 PDT

On June 8, 2009, the West Virginia Health Care Authority filed a proposed legislative rule with the Secretary of State and Legislative Rule-Making Review Committee titled Hospital Ambulatory Health Care Facilities. CSR 65-27. The official notice can be found in the June 12, 2009 issue of the West Virginia Register.

The proposed rule impacts the procedure used by West Virginia hospitals to obtain approval prior to developing an ambulatory health care facility. The proposed legislative rule establishes the circumstances and procedures by which a certificate of need may not be required for the construction, development, acquisition or other establishment by a hospital of an ambulatory health care facility. The proposed rule sets out exemption criteria and the exemption procedure.

The Authority established a comment period for interested parties to submit comments concerning the proposed rule. Written comments must be submitted to the Authority before July 8, 2009 at 5:00 p.m.

West Virginia Lawyer Disciplinary Board Issues Legal Ethics Opinion on Metadata

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 16 Jun 2009 20:41:49 PDT

On June 10, 2009, the West Virginia Lawyer Disciplinary Board issued Legal Ethics Opinion 2009-01 (What is Metadata and Why Should Lawyers Be Cautious?) to raise awareness among lawyers to be cautious when dealing with metadata. The opinion describes "metadata" as the data behind the data - including the location where the document is created, opened or saved, author's identity, number of revisions, comments and redlining.

The opinion concludes that lawyers have a duty on both ends. The lawyer sending electronic information has the burden of understanding what information may be contained in the electronic document and take reasonable steps to protect metadata in transmitted documents. Likewise, the receiving lawyer has the duty and burden when receiving inadvertently provided metadata to consult with the sender and abide by the senders instructions before reviewing such metadata.

The opinion also points out that different rules on removing metadata apply in the context of responding to discovery responses and subpoenas. In this case the electronic documents may be tangible evidence and the rules of professional conduct may prohibit the removal of metadata, subject to an assertion that the metadata is privileged.

More thoughts on the metadata opinion by Brian Peterson at West Virginia Legal Weblog.

The West Virginia Lawyer Disciplinary Board also issued Legal Ethics Opinion 2009-02 (Wholly-Owned Subsidiary Law Firms) on June 10, 2009. This opinion looks at the question of whether one law firm can organize a wholly-owned subsidiary law firm. The Board concluded that law firms are allowed to form wholly-owned subsidiary entities but cautioned that law firms should keep these entities transparent and fully disclose to the public and clients the relationship among the seperate entities.

were passed by the Lawyer Disciplinary Board at its June 5, 2009 meeting and entered on June 10, 2009. Click here 2009-01 and 2009-02 for the full Opinions.

Microsoft HealthVault: You put your right HIPAA in . . .

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 03 Jun 2009 10:33:51 PDT

In a post today, Sean Nolan, Chief Architect of Microsoft Health Solutions and blogger at Family Health Guy explains Microsoft's position regarding whether Microsoft HealthVault is required to comply with the privacy standards under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The blog post, "You put your right HIPAA in . . ." provides some background on the process that Microsoft has gone through to look at the question of whether they are directly required to comply with HIPAA as a "covered entity" or whether the must enter into "business associate agreement"with other covered entities. Although they don't reach a final definitive conclusion Microsoft does state that they are now prepared to sign a business associate agreement with any covered entity who concludes that it is important as a part of their compliance and responsibility under HIPAA.

The post by also includes a link to the standard Microsoft HealthVault Business Associate Agreement.

The conclusion reached by Microsoft seems like a practical one to this health care lawyer. Anyone who deals with health information has a responsibility to assess whether or not they are a covered entity under HIPAA. They further have a responsibility to be a part of the conversation with those other person that they deal with who are covered entities as to whether a business associate agreement must be in place. However, the final decision of whether a business associate agreement is required must be made by the covered entity who is responsible for complying with the privacy provisions.

The determination of whether a particular party is a business associate under HIPAA is one that largely depends on the unique facts of the relationship that they have with a covered entity under HIPAA. There is not a blanket determination of whether someone is or is not a business associate for purposes of HIPAA compliance. The questions that must be asked to assess whether a business associate relationship exists under 160.103 and 164.502 are:

Does the person/party "perform or assist" in the performance of a "function or activity" involving the use or dislcosure of individually identifiable health information" OR
Does the person/party provide certain "professional services to or for the covered entity" involving the disclosure of individually identifiable health information (as these terms are futher defined under the regulations).

As stated in the post there is still unclear areas as a result of the ARRA HITECH privacy provisions that will still need to be sorted out as we move forward. However, the important issue is to continue to move forward.

PHRs, The Model T, Meaningful Use and the Patient-Centric HIT Revolution

noreply@blogger.com (RCoffield@fsblaw.com) — Mon, 01 Jun 2009 08:47:25 PDT

There is a growing discussion on the health consumer-centric (patient-centric) meaning of "meaningful use" of EHRs and health information technology. Jane Sarasohn-Kahn summarizes this discussion in her recent post, "Meaningful USe - or, whose health is it, anyway?" at Health Populi where she reflects on Ted Eytan's post, "Is it Meaningful If Patients Can't Use It?"

Since Ted's post other health care thought leaders have offered their comments. A list of these individuals can be found in Jane's post. As Jane mentions, this topic was central to much of the discussion that occurred during the first two days of the testimony before the National Committee on Vital and Health Statistics (NCVHS) on the Future of Personal Health Records held on May 20 and 21. The discussion will continue at the NCVHS hearing on June 9 when there will be a panel focused on "Consumer Advocates and Attitudes" that will include Susannah Fox, Dave deBronkart, Deven McGraw, JD and Robert Gellman, JD.

Jane mentions in her post our testimony before the Subcommittee on Privacy, Confidentiality and Security of the National Committee on Vital and Health Statistics (NCVHS) on the future of PHRs. Our panel, including me, Jane and Daniel Weitzner, the W3C Technology and Society Policy Director, opened the hearings on PHRs. Our role as the opening panel was to try to set the stage for the context of the discussion on the future of PHRs and consumer facing health care information technology.

As the opening speaker at the hearing I decided to stay away from immediately diving into the legal issues and instead give the committee a landscape view of where I think we are in the history of health information. My goal was to provide a historic framework for PHR development by drawing some historic parallels to the history of the development of our transportation system. By analogy I compared today's PHRs to the Model T era of the automobile area and taking a page from Dave deBronkart told the committee my personal family e-health information story. Below is a complete copy of my written testimony submitted to the committee.

As the discussion continues on "meaningful use" the role that PHRs play is important. Focusing on health care consumers and their practical use of PHR tools is vital to the future of our health care system. As I said in my testimony there will be game changers but we need to see the potential of today's Model T PHRs and build toward the Prius Hybrid PHRs of the future.

Prepared Statement for Subcommittee on Privacy, Confidentiality, and Security National Committee on Vital and Health Statistics (NCVHS)

Discussion on the Future of Personal Health Records

Good morning. I want to thank the Co-Chairs, Subcommittee and Committee Staff for the opportunity to participate in today’s discussion on the current state of the personal health record (PHR) and the future use of this and other health care technology tools by the health care industry and the health care consumer.

My name is Bob Coffield. I am a health care attorney from Charleston, West Virginia, with the law firm of Flaherty, Sensabaugh & Bonasso, PLLC. I have a broad-based health care practice, providing legal and business services to a variety of health care clients. A large portion of my practice focuses around health information issues, regulatory compliance, privacy, security, and health technology. Over the past five years, I have become involved in the social media movement, and that involvement has changed the way I live, work, collaborate and communicate. My involvement and interest in the social media movement and its impact on our lives has led me to focus a portion of my practice on legal concepts and issues generated by the use of social media tools and technologies in health care, law and other industries.

Introduction: Today’s PHR is the Model T

As the opening speaker, I want to set the stage for today’s discussion on the questions raised by the committee. As the committee examines the issues, I recommend that you look toward a longer horizon of 20 to 50 years. In this age of information and accelerating technology, it is often easier to predict what may happen in 50 years than what will happen next year. As information technology advances and new technologies are developed, it has become more difficult to conduct short-term strategic planning in the three to five-year range. Over the past 10 years of the maturing information era, we have seen incredible advances and significant disruption in all business, including health care.

At its center, the information age is characterized by the ability to create and transfer information and knowledge freely and to have instant access to knowledge that would have been impossible, difficult or too expensive to find in the past. Jane Sarasohn-Kahn and others today will provide the Committee with an understanding of the current health care consumer marketplace and the major motivators driving health care consumer empowerment in the information age, and also will provide a perspective on the current state of consumer engagement in health care. It is my belief that this changing era is having a profound impact on today’s health care industry. The strategies, systems, approaches and governing rules used today and by past generations may not be successful in today’s and tomorrow’s changing information era.

A part of today’s process should be to consider what the long-term goals are for health information technology, including the PHR, and how it can be used to drive consumer-focused and controlled health care in the information age. Along with this discussion, we have a responsibility to talk about why involvement of the consumer matters and what impact it will have on improving care, reducing costs and creating efficiencies in the health care system.

As we discuss health information technology and PHRs today, we have a responsibility to stay focused on this question: “What will improve the quality of care for you and me, as consumers of health care?” This single question needs to remain at the center of today’s discussion and the continuing debate on consumer health information technology. As the health care industry becomes more and more specialized, complex and technologically advanced, we often lose sight of the purpose of the health care system. That purpose is human care and compassion. You and I, as health care consumers, must remain at the center. My hope is that the future of our health care system will use technology, including PHRs, to improve the human experience and interaction between the professional caregiver and health care consumer.

The questions I often struggle with and hope to hear discussion on today are: How will PHRs drive consumer empowerment, and how will this consumer empowerment lead to improving care? We can all sit around and discuss the best ways to build PHRs, but the questions remain whether or not the health care consumer will be attracted to use PHRs and whether providers will be willing to incorporate PHRs into the treatment and care process.

As I said at the opening of my remarks, I want to set the stage for the discussion and testimony today by sharing a story and painting a historical perspective. As I looked over the agenda of those speaking today, I was struck by the level of experience and diverse backgrounds that each of us brings to the discussion. However, because of the level of specialization represented in this gathering, there is the risk of remaining deep in the weeds, dealing with details, and failing to step back and take a wider view of the landscape. The story and analogy I want to share with you is my attempt to take you on a tour of that broader view.

I am a believer in the adage that history repeats itself. What we are trying to do today is to provide you with a perspective and prediction of the role that the PHR will (should) play in the health information technology infrastructure over the next 10 years. So a historical sketch of where we have been and where we are is valuable to the discussion of where we may go.

I want to start the story with a quote from the 1800s, by inventor Oliver Evans, as he spoke about the future of the transportation system in the United States.

"The time will come when people will travel in stages moved by steam engines from one city to another, almost as fast as birds can fly, 15 or 20 miles an hour . . .

A carriage will start from Washington in the morning, the passengers will breakfast at Baltimore, dine at Philadelphia and supper in New York the same day . . . .

The 1800’s saw the dawn of the railroad system in the United States, as a result of the development of the steam engine. These developments led to the widespread use of trains as a mode of transportation for a growing population that, until that time, had been relatively immobile. The growth of the railroad system started at the local level, grew to regional connections and ultimately led to a national network of railroad tracks from east to west and from north to south. Prior to this time, personal travel required one to travel on foot, by horse or by carriage.

My ancestors, who grew up in the hills of northern West Virginia, came to West Virginia (then Virginia) in the late 1700’s. As we say in West Virginia, “they lived out on the ridge.” A number of generations went by, and there was little mobility of my family. They lived out their lives on those same ridges for well over 150 years. They raised their families and farmed. They lived a relatively isolated and stationary life. Traveling beyond a few miles was difficult, impractical and largely unnecessary, at least from their perspective of the world.

However, by 1900, the landscape had changed, and the Industrial Revolution was having a profound impact on the world. My great-grandfather and grandmother had two sons who were teens in the 1890s. In the 1890s, my great-uncle went to college, came back and taught school for a few years and then went on to law school. Likewise, my grandfather went to college, came home like his brother to teach school for a few years, and then continued on to medical school in Cincinnati, Ohio – at that time a long distance from the northern part of West Virginia. He came back and practiced medicine in Wetzel County, West Virginia, from 1911 until his death in 1936. He saw home patients initially by horseback, and then in 1915, he traveled to Pittsburgh, Pennsylvania by train to pick up a brand new Ford Model T, which replaced his horse in his rural medical practice.

As the rail system in the United States matured, it grew into a more complex mass transportation system. Individuals who, prior to that time, had used their own modes of transportation, whether on foot, by horse or carriage, started to rely upon the system for transportation. They became passengers who didn’t own the train or the rails. As the railroad system developed, we saw issues related to standards, such as the gauge of tracks. Local, state and federal government become involved in furthering the growth and expansion of the railroad system by providing financial support, political influence and regulatory assistance to the growing railroad industry.

At that stage in history, no one in the powerful railroad industry would have predicted the disruptive influence by a young, different type of engineer - Henry Ford. With the advent of the automobile and the mass production of the Model T in 1908, our transportation system in the United States was forever changed. Over the next 20 years, the adoption of automobile travel was unprecedented. This revolution led to a demand for better roadways and improvement of the largely privately built turnpike roads. The Federal Highway Act of 1921 authorized the Bureau of Public Roads to provide public funding to help state highway agencies construct paved systems of highways, and this led to the Federal-Aid Highway Act of 1956, which authorized the creation of the Interstate Highway System.

By analogy, we can compare the development of the transportation system to the development of today’s health information system and draw many comparisons and parallels. The health information system, up through the 1950’s and 1960’s, was paper-based, centrally located and uncomplicated. The medical record system for my grandfather’s practice – to the extent that it was used – was simple. Likewise, the medical record system and documentation used by my father and uncle during their medical careers, roughly 1940-2000, was relatively non-complex. During this time, there was little specialization: Physicians were generalists in everything. In large part, physicians from this era cared for their patients from birth to death and, in the case of my grandfather, father, and uncle, cared for multiple generations of families. Providers during that time had a relatively comprehensive picture of the medical history of each individual, as well as that individual’s immediate and collateral family members. Prior to specialization in health care, we had a health system focused on the individual patient, and health information was centered on that individual and the individual’s family.

By the 1970’s, we saw the development of the first electronic health record – the problem-oriented medical record (POMR), predecessor of today’s current Electronic Health Records (EHR) and Electronic Medical Records (EMR). At this same time, we saw the expansion of medical litigation, which has played a significant role in the health information system over the past 30 years.

Prior to 2000, little had been written or heard about PHRs. Back in 2001, in a report called Strategy for Building a National Health Information Infrastructure, the National Committee on Vital and Health Statistics mentions PHRs and the growing consumer use of Internet-based health information services. This was important because it was the first time that a national health body acknowledged or officially recognized PHRs. In 2005, the American Health Information Management Association (AHIMA) formed a work group to examine the role of PHRs in relation to EHRs, and the pace and interest in PHRs has continued to increase since that time.

Over the last year, interest and activity in the development and use of PHRs has accelerated. This new-found interest has now culminated in the first law directly regulating PHRs and PHR vendors, under the Health Information Technology for Economic and Clinical Health Act (HITECH), which is a part of the American Recovery and Reinvestment Act of 2009, signed into law on February 17, 2009.

How is the history of our transportation system analogous to our health information system? On a basic level, both provide transportation – one transported humans, and the other, human information. Both started as uncomplicated systems that were not interconnected. I imagine you are already formulating other parallel points between these two systems.

To begin today’s discussion on PHRs, we need to examine where PHRs fit in this historical perspective and timeline. What is the equivalent of the PHR in the history of our transportation system? Today’s PHR is the equivalent of the Ford Model T. The PHR will be the vehicle to individually transport health information in the future, introduce the involvement of consumers in their own health information and wellness and inspire a time of innovation and creativeness over the next five to 10 years. If the age of the PHR takes off, it will bring about a wholesale change in the way that health information technology is structured and will radically disrupt traditional health care industry models.

There are various other analogies to be drawn between the two historical perspectives. For example, do the trains and the rail system represent the traditional health care providers and payors in the industry who are maintaining data in silos and segregated systems? Can we draw comparisons between the powerful railroad industry versus the nascent auto industry and the current health care and insurance industry and the emerging Health 2.0 technology movement? Are the disagreements that occurred in the railroad industry over the gauge of railroad tracks analogous to the debate occurring over the need and process to develop standards for health information technology? Can we draw parallels between our country’s development of a national network of railroads through local, state, and federal initiatives to those ongoing efforts by state health information exchanges (HIEs), regional health information organizations (RHIOs) and the national health informational network (NHIN)? Will there be similarities between the freedom that consumers felt the first time they bought an automobile and drove it down the road and the feeling of empowerment experienced when a health care consumer adopts and uses a PHR? In the coming years, will the connecting of EHR and EMR systems and the development of the NHIN be relegated to being used to transfer bulk health data, not unlike the role that the railroad system plays today?

As we look toward the future of PHRs, we have to understand that we are now looking at the Model T stage of PHRs: Call it PHR 1.0. The PHRs of the past 10 years and, in large part, the PHRs of today, are still relatively rudimentary and impractical, not unlike the first automobiles. I suspect my grandfather’s experience of traveling to Pittsburgh by train, having never owned a car before, to pick up his new Ford Model T and drive it back into the hills of West Virginia, was not unlike Dave deBronkart’s experience when he set up his Google Health account and imported his own health information from his providers. Prior to their experiences, neither knew how to drive the vehicle, but they learned in the parking lot. Once they both bought into the product, they didn’t have any good roads to drive on, and when the vehicle broke down they had to fix it themselves. However, through their efforts the world began to change, and their lives were and will be forever changed.

Over the next five to 10 years, and probably longer, we may see PHRs become the multi-colored, sleek-designed, more powerful automobiles, analogous to the golden era of the automobile industry from 1940 to 1950. Continuously over that time period, new personal options will be developed as add-ons to the PHR. As PHR adoption grows, we will have to develop larger, longer and more robust highway systems to allow for the transfer of health data by and between PHRs. Likewise, new standards will come into existence, not unlike those adopted by industry or those created by government. Safety features also will be developed continuously to protect and secure the health information maintained, stored and transferred through PHRs. Think of these as the modern-day innovation, adoption and enforcement of traffic signals, the use of seat belts and requirement for guard rails.

As we look toward the future, we also have to be aware that there will be game changers that we can’t envision at this time. Although PHRs might now be the industry solution to change the way we aggregate and store health information, new technology may be invented that disrupts this strategy and approach. For example, consider the impact that air travel had on the automobile industry. We must remain open to change in this new information era – change will be the norm and not the exception.

Using PHRs to Transform the Health Care Industry

The efforts by large technology companies and other Health 2.0 technology companies could transform the health care industry by triggering advancements in health information technology and laying the groundwork for overall health care delivery and payment reform. Although it is too early to say whether the PHR, in fact, will be the catalyst for health care reform, the Committee, government and the larger health care industry and community need to understand and explore PHRs and their role and consider how the consumer-focused PHR revolution will impact the health industry.

A convergence of factors could cause a comprehensive shift in the way health information is stored and used. Innovations in health information management technology are altering the way that patients, health care providers and payers maintain, use, control, and disclose health information. Through such technology, the current, decentralized system of records maintained by multiple providers and entities at multiple locations – often with conflicting and duplicative information – is being transformed into a centralized record maintenance system that may rely on personal health information networks (PHIN), where the PHR serves as the central repository for health information shared through a system of developing regional or national health information exchanges. Vince Kuraitis of the e-CareManagement Blog calls this change a “transformation from Industrial Age medicine to Information Age health care.”[1]

This transformation in the way information is maintained, stored, and exchanged empowers the health care consumer by offering a new level of control and responsibility over his or her care. It will directly impact the patient-provider relationship.

The traditional model for maintaining medical records, in which the provider of care stores, maintains, and updates the record, is based upon the need to provide continuity of care. The medical record reflects the plan of care, documents the care provided, and records communications among providers. Also, the medical record assists in protecting the legal rights and interests of both consumers and providers.

In the 21st century, our health care system simultaneously has become more fragmented and specialized, on one hand, and more coordinated and wellness-focused, on the other. Health care consumers have become mobile and now seek the services from a variety of providers engaging in numerous specialties. These same consumers change providers on a regular basis and take advantage of new models of care, like urgent care services, to complement traditional primary care services. The increasingly mobile population has caused breakdowns in continuity of care. As individuals move from city to city and state to state, they leave behind a trail of partial medical records – some on paper, some electronic – with various providers, insurers, and others.

The increasing popularity of EMRs, EHRs, RHIOs, and HIEs signals a need to address the increasing complexity of maintaining and sharing these different types and silos of health information. The PHR may be the disruptive technology that provides a simple alternative to ongoing efforts to create an interconnected network of interoperable health information systems with detailed querying functions, capable of making accessible in one place the health information and continuity of care record for individual consumers. In contrast, PHRs would travel with health care consumers and provide a central location for information regarding the consumers’ individualized needs.

Ownership of Health Information

The shift to a consumer-controlled PHR from a provider-based and controlled medical record raises traditional property law issues. As health information becomes increasingly networked and technology permits health information to be transferred more easily, the lines demarcating ownership of health information become further blurred.

Health information is often viewed under the traditional notion of property as a “bundle of rights,” including the right to use, dispose, and exclude others from using. This legal application of historic property law may not be well-suited to the information age, in which patient information is shared through a variety of formats, copied, duplicated, merged, and combined with other patient records into large scale databases of highly valuable information.

Who owns health information? The physician? The insurer? The health care consumer? Under the traditional theory, providers own the medical records they maintain, subject to the consumer’s rights of access in the information contained in the record.[2] This tradition stems from the era of paper records, where physical control meant control and ownership. Provider ownership of the record is not absolute, however; HIPAA and most state laws provide consumers with some right to access and receive a copy of the record. Health care consumers have received other rights out of the bundle of property rights, including the right to request corrections to their medical information and the assurance that such records are maintained confidentially.

The PHR model, where all records are centrally located and maintained by the consumer, flips and realigns the current provider-based ownership model of managing health information. Instead of provider-based control, where the provider furnishes access to and/or copies of the record and is required to seek patient authorization to release medical information, the PHR model puts the health care consumer in control of his or her medical and health information.

[1] Vince Kuraitis, E-CareManagement Blog, Birth Announcement: the Personal Health Information Network, March 8, 2008, http://e-caremanagement.com/birth-announcement-the-personal-health-information-network-phin/.

[2] Alcantara, Oscar L. and Waller, Adelle, Ownership of Health Information in the Information Age, originally published in Journal of the AHIMA, March 30, 1998; http://www.goldbergkohn.com/news-publications-57.html.

Ted Eytan, MD's Photo Friday

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 28 May 2009 15:11:44 PDT

Thanks to Ted Eytan, MD for featuring Jane Sarasohn-Kahn and me as the "Photo Friday" models of the week. The photo was taken at the start of our testimony before NCVHS on the future of PHRs.

NCVHS: Report of Hearing on "Meaningful Use" of Health Information Technology

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 28 May 2009 11:15:30 PDT

The National Committee on Vital and Health Statistics (NCVHS) has issued its initial Report of Hearing on "Meaningful Use" of Health Information Technology.

The May 18,2009 report is directed to David Blumenthal, MD, National Coordinator of Office of the National Coordinator for Health Information Technology. The cover letter indicates that NCVHS will be sending additional observations related to the hearing.

The Hearing on "Meaningful Use" of Health Information Technology was held on April 28-29, 2009. More information about the hearing can be found at the NCVHS website, including a copy of the hearing transcript and copies of the individual written testimony submitted by those individuals who testified at the hearing. You can also listen to a recorded version of the hearing in the NCVHS hearing archives.

ONC Developing Online Project To Educate Consumers About PHRs

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 26 May 2009 13:46:53 PDT

Government Health IT reports that the the Office of the National Coordinator (ONC) is developing an online model containing information for consumers about personal health records (PHRs) and the privacy policies related to their use. ONC's effort appears targeted at engaging consumer to make more informed decisions about the use of PHRs.

The Office of the Secretary for HHS issued a notice of Agency Information Collection Request and 30 day Comment Request, 74 Federal Register 24012 (May 22, 2009), providing details of the proposed project.

If others have additional information on this project -- please leave a comment.

The abstract in the Federal Register notice states:

A new health information technology, the personal health record (PHR), seeks to provide consumers with the capability to directly manage their own health information. Although PHRs can exist in different formats or media (i.e., paper or electronic), the term usually refers to an online record containing an individual’s personal health information. PHRs typically include information such as health history, vaccinations, allergies, test results, and prescription information. Given the newness of the electronic PHR concept, the different ways to establish PHRs, and the sensitivity of personal health information, ONC is taking steps to establish that useful facts about PHRs and PHR privacy policy information be made available to consumers so they can make informed decisions about selecting and using PHRs. Toward this end, ONC has a project to develop an online model for PHR providers.

The model will be developed to:

› Allow presentation of important PHR facts and policies to consumers,

› Allow consumers to understand and consistently compare PHR service provider policies with others, and

› Focus on the key information that may influence decisions and choices of PHR service provider.

The project includes iterative rounds of in-depth consumer testing during April–October 2009 to assess and analyze consumer understanding and input about the model. The model will be iteratively revised to design a final template that will allow PHR vendors to convey useful and understandable facts to consumers about their privacy, security, and information management policies. Testing will be conducted in six locations that cover the four geographic census regions and will include 90-minute, one-on-one, cognitive usability interviews with six to seven participants at each of six sites, for a total not to exceed 42 interviews. In addition, each participant will have been recruited through a 15-minute screening interview. The participants will be recruited according to U.S. census statistics for race/ethnicity, age, marital status, gender, and income. Also, the sample will include participants both familiar and unfamiliar with PHRs and participants who manage chronic health issues or a disease for themselves or others.

X PRIZE: $10M Incentive to Innovate In Health Care (Reform)

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 26 May 2009 07:37:33 PDT

Scott Shreeve, MD, Senior Health Advisor at the X PRIZE Foundation sent out a call last week to all health care bloggers to participate in a blog rally to promote the idea and effort behind the Healthcare X PRIZE competition. Below is a message from Dr. Sheeve being post around the blogosphere today. Please spread the word via your blog, Facebook, Twitter or the old fashion way -- telling someone face to face.

We are entering an unprecedented season of change for the United States health care system. Americans are united by their desire to fundamentally reform our current system into one that delivers on the promise of freedom, equity, and best outcomes for best value. In this season of reform, we will see all kinds of ideas presented from all across the political spectrum. Many of these ideas will be prescriptive, and don’t harness the power of innovation to create the dramatic breakthroughs required to create a next generation health system.

We believe there is a better way.

This belief is founded in the idea that aligned incentives can be a powerful way to spur innovation and seek breakthrough ideas from the most unlikely sources. Many of the reform ideas being put forward may not include some of the best thinking, the collective experience, and the most meaningful ways to truly implement change. To address this issue, the X PRIZE Foundation, along with WellPoint Inc. and WellPoint Foundation as sponsor, has introduced a $10M prize for health care innovators to implement a new model of health. The focus of the prize is to increase health care value by 50% in a 10,000 person community over a three year period.

The Healthcare X PRIZE team has released an Initial Prize Design and is actively seeking public comment. We are hoping, and encouraging everyone at every opportunity, to engage in this effort to help design a system of care that can produce dramatic breakthroughs at both an individual vitality and community health level.

Here is your opportunity to contribute:

Download the Initial Prize Design
Share you comments regarding the prize concept, the measurement framework, and the likelihood of this prize to impact health and health care reform.
Share the Initial Prize Design document with as many of your health, innovation, design, technology, academic, business, political, and patient friends as you can to provide an opportunity for their participation

We hope this blog rally amplifyies our efforts to solicit feedback from every source possible as we understand that innovation does not always have a corporate address. We hope your engagement starts a viral movement of interest driven by individual people who realize their voice can and must be included. Let’s ensure that all of us - and the people we love - can have a health system that aligns health finance, care delivery, and individual incentives in a way that optimizes individual vitality and community health. Together, we can ensure the best ideas are able to come forward in a transparent competition designed to accelerate health innovation. We look forward to your participation.

This post was written by Scott Shreeve, MD in behalf of the X PRIZE Foundation. Special thanks to Paul Levy for both demonstrating the value of collaborative effort and suggesting we utilize a blog rally for this crowdsourcing effort.

Modern Day Hatfield-McCoy: Google Health and Microsoft HealthVault

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 19 May 2009 09:59:00 PDT

The Hatfields and McCoys, a metaphor for a modern day high-tech industry rivalry centered on personal health records (PHRs) involving Google Health, Microsoft HealthVault and other PHR vendors. An image that a West Virginia health care lawyer can really appreciate.

Thanks to a tweet by @2healthguru for pointing out the CNET article, Microsoft, Google in healthy competition. The article provides a good overview of the developing PHR movement and some insight into the future. However, I'm a bit concerned by the accuracy of the article when I see two of the individuals mentioned in the article (Matthew Holt and Dave deBronkart) tweeting (here and here) that they weren't really interviewed for the article.

Later this week I will be in D.C.along with others testifying at the Hearing on Personal Health Records before the National Committee on Vital and Health Statistics (NCVHS), Subcommittee on Privacy, Confidentiality and Security . The Subcommittee is looking at the future of the PHR marketplace and consumer-facing health information technology.

The story of the Hatfield-McCoy feud is woven into the fabric of southern West Virginia lore along the Tug River and well known by all West Virginians. Above is a photo of the West Virginia Hatfield clan around 1897, led by Devil Anse Hatfield, second from the left. For more history and photos check out the West Virginia Division of Culture and History.

Note: If you are into off-road vehicle trails, come visit West Virginia and check out the modern day version -- the Hatfield-McCoy Trails.

ONC Releases HIT ARRA Implementation Plan

noreply@blogger.com (RCoffield@fsblaw.com) — Mon, 18 May 2009 14:36:50 PDT

The Office of the National Coordinator for Health Information Technology (ONC) has released an operating plan titled the Health Information Technology American Recovery and Reinvestment Act (ARRA) Implementation Plan.

The operating plan is included on the DHHS Agency Wide Plan page under the "List of Recovery Programs within HHS."

The operating plan outlines immediate actions to meet statutory requirements under the Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of the ARRA. The

The topic headings for the operating plan include:

A. Funding Table
B. Objectives
C-E. Activities, Characteristics and Delivery Schedules
F. Environmental Review Compliance
G. Measures
H. Monitoring/Evaluation
I. Transparency
J. Accountability
K. Barriers to Effective Implementation
L. Federal Infrascructure Investment

Thanks to Jim Tate (@jimtate) and John Chilmark (@john_chilmark) for pointing out the report.

Blog World New Media Expo 2009: Medical and Health Care Bloggers

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 13 May 2009 15:45:25 PDT

Today I received the speaker list for the MedBlogger Conference associated with Blog World New Media Expo 2009 from Kim McCallister of Emergiblog, co-organizer of the event along with Dr. Val of Better Health.

Blog World New Media Expo 2009 will be held October 15-17 in Las Vegas. The MedBlogger Sessions will be held on October 15. A special thanks to Johnson & Johnson and MedPage Today who are sponsors of the MedBlogger Sessions. More information along with how to register for the conference will be available on the Blog World website in the coming weeks.

I was honored to be invited to be a part of the event and look forward to participating in a great discussion at the conference. Below are the panels and speakers confirmed for the MedBlogger Sessions.

Panel #1 The State of the Health Blogosphere: We've Come A Long Way, Baby
Moderator: Kim McAllister, Emergiblog
Panelist: Kevin Pho, Kevin MD
Panelist: Nick Genes, Blogborygmi
Panelist: Kerri Sparling, SixUntilMe

Panel #2 Staying On The Good Side of HIPAA: Safe and Ethical Blogging Practices
Moderator: Mike Sevilla, Doctor Anonymous
Panelist: Rob Lamberts, Musings of a Distractible Mind
Panelist: Debra Farber, IBM
Panelist: Bob Coffield, Health Care Law Blog

Panel #3 Blogging For Change: How To Influence Healthcare Through Blogging
Moderator: Val Jones, Better Health
Panelist: Gary Schwitzer, Schwitzer Health News Blog
Panelist: Terri Polick, Nurse Ratched's Place
Panelist: Gene Ostrovsky, Medgadget

Panel #4 The Value of Blogs To Hospitals, Industry, and News Organizations
Moderator: Gary Schwitzer, Health News Review
Panelist: Marc Monseau, Johnson & Johnson 's JNJBTW Blog
Panelist: Bob Stern, MedPage Today
Panelist: Paul Levy, Running A Hospital

Virginia Department of Health Professions Issues Statement on Potential Breach of Security for Prescription Monitoring Program

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 13 May 2009 14:51:53 PDT

Virginia Department of Health Professions has issued a News Release regarding the potential breach of security for the Prescription Monitoring Program. The statement also indicates that there is an ongoing criminal investigation into the breach which occurred on April 30.

Also, the Virginia Department of Health Professions has issued a related Questions and Answers document.

I have been following the story the last couple of days and provide some analysis of the potential breach in this previous blog post.

UPDATE (5/13/09): iHealthBeat provides a good news update on the status of the data breach and investigation.The article references articles from the Richmond Times-Dispatch, "Inquiry continues into hacking of state computers," and "FBI expects Va. Hacker probel to take two more weeks."

Update On HIT Policy and Standards Committees

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 07 May 2009 07:19:40 PDT

Last week the Federal Register (April 29, 2009) contained a Notification of the Establishment of the HIT Policy Committee and HIT Standards Committee. I had previously posted about the creation of these committee and recommended suggested members.

More information will be made available via the "new" Health Information Technology website of the Office of the National Coordinator.

The summary of the notice on establishing the HIT Policy Committee states:

This notice announces the establishment of the HIT Policy Committee. The American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5), section 13101, directs the establishment of the HIT Policy Committee.

The HIT Policy Committee (also referred to as the "Committee'') is charged with recommending to the National Coordinator a policy framework for the development and adoption of a nationwide health information technology infrastructure that permits the electronic exchange and use of health information as is consistent with the Federal Health IT Strategic Plan and that includes recommendations on the areas in which standards, implementation specifications, and certification criteria are needed. The HIT Policy Committee is also charged with recommending to the National Coordinator an order of priority for the development, harmonization, and recognition of such standards, specifications, and certification criteria.

The notice outlines the criteria for members of the HIT Policy Commitee and states that the appointments shall be made in the following manner:

1 member shall be appointed by the majority leader of the Senate;
1 member shall be appointed by the minority leader of the Senate;
1 member shall be appointed by the Speaker of the House of Representatives;
1 member shall be appointed by the minority leader of the House of Representatives;
Such other members as shall be appointed by the President as representatives of other relevant Federal agencies;
13 members shall be appointed by the Comptroller General of the United States of whom-
3 members shall be advocates for patients or consumers;
2 members shall represent health care providers, one of which shall be a physician;
1 member shall be from a labor organization representing health care workers;
1 member shall have expertise in health information privacy and security;
1 member shall have expertise in improving the health of vulnerable populations;
1 member shall be from the research community;
1 member shall represent health plans or other third-party payers;
1 member shall represent information technology vendors;
1 member shall represent purchasers or employers; and
1 member shall have expertise in health care quality measurement and reporting.
Non-federal members of the Committee shall be Special Government
Employees, unless classified as representatives.

The summary of the notice on establishing the HIT Standards Committee states:

This notice announces the establishment of the HIT Standards Committee. The American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), section 13101, directs the establishment of the HIT Standards Committee. The HIT Standards Committee (also referred to as the "Committee'') is charged with making recommendations to the National Coordinator on standards, implementation specifications, and certification criteria for the electronic exchange and use of health information for purposes of adoption, consistent with the implementation of the Federal Health IT Strategic Plan, and in accordance with policies developed by the HIT Policy Committee.

The notice outlines the criteria for members of the HIT Standards Commitee and states that the appointments shall be made in the following manner:

The HIT Standards Committee shall not exceed thirty (30) voting members, including a Chair and Vice Chair, and members are appointed by the Secretary with input from the National Coordinator. Membership of the Committee shall at least reflect providers, ancillary healthcare workers, consumers, purchasers, health plans, technology vendors, researchers, relevant Federal agencies, and individuals with technical expertise on health care quality, privacy and security, and on the electronic exchange and use of health information and shall represent a balance among various sectors of the health care system so that no single sector unduly influences the recommendations of the Committee. Non-Federal members of the Committee shall be Special Government Employees, unless classified as representatives.

Thanks for the tip on the issuance of the notice to John Halamka at Life as a Healthcare CIO: Next Steps on the HIT Policy and Standards Committees.

UPDATE (5/7/09): Brian Ahier (@ahier) provides the latest update on with information on the first meetings of the HIT Policy Committee on May 11 and HIT Standards Committee meeting on May 15. Brian also provides links to the announcment by the GAO of 13 of the members of the HIT Policy Committee.

The announcment includes a list of the 13 members appointed by the Acting Comptroller General covering 10 different categories:

Advocates for Patients or Consumers

1. Christine Bechtel, Washington, D.C. (3 year term)
Vice President, National Partnership for Women & Families

2. Arthur Davidson, M.D., Denver Colorado (2 year term)
Denver Public Health Department; Director, Public Health Informatics; Director, Denver Center for Public Health Preparedness; Medical epidemiologist; Director, HIV/AIDS Surveillance, City and County of Denver

3. Adam Clark, Ph.D., Austin, Texas (1 year term)
Director of Research and Policy, Lance Armstrong Foundation

Representatives of Health Care Providers, including 1 physician

4. Marc Probst, Salt Lake City, Utah (3 year term)
Chief Information Officer, Intermountain Healthcare

5. Paul Tang, M.D., Mountain View, California (2 year term)
Vice President and Chief Medical Information Officer, Palo Alto Medical Foundation

Labor Organization Representing Health Care Workers

6. Scott White, New York City, New York (1 year term)
Assistant Director, Technology Project Director, 1199 SEIU Training and Employment Fund

Expert in Health Information Privacy & Security

7. LaTanya Sweeney, Ph.D., Pittsburgh, Pennsylvania (3 year term)
Director, Data Privacy Lab, Associate Professor of Computer Science, Technology and Policy, Carnegie Mellon University

Expert in Improving the Health of Vulnerable Populations

8. Neil Calman, M.D., New York City, New York (2 year term)
President and CEO, The Institute for Family Health, Inc.
Research Community

9. Connie Delaney, R.N., Ph.D., Minneapolis, Minnesota (1 year term)
Dean, School of Nursing, University of Minnesota

Representative of Health Plans or Other Third-Party Payers

10. Charles Kennedy, M.D., Camarillo, California (3 year term)
Vice President, Health Information Technology, Wellpoint, Inc.
Representative of Information Technology Vendors

11. Judith Faulkner, Verona, Wisconsin (2 year term)
Founder, CEO, President, Chairman of the Board, Epic Systems Corporation
Representative of Purchasers or Employers

12. David Lansky, Ph.D., San Francisco, California (1 year term)
President and CEO, Pacific Business Group on Health

Expert in Health Care Quality Measurement and Reporting

13. David Bates, M.D., Boston, Massachusetts (3 year term)
Medical Director for Clinical and Quality Analysis, Chief of General Internal Medicine, Partners HealthCare/Brigham & Women’s Hospital

More information on the upcoming meetings:

HIT Standards Commitee - Federal Register (May 6, 2009) announcement of meeting.
HIT Policy Committee - Federal Register (May 6, 2009) announcement of meeting.

Health 2.0 Boston: Tweet Stream Analysis

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 06 May 2009 06:40:34 PDT

Chris Hogg does a great job of capturing the metrics of the Twitter discussion that occurred during the recent Health 2.0 Boston conference. Check out his slide show analysis of the Tweet Stream from the conference.

Health 2.0 Tweet Stream Analysis

View more presentations from Chris Hogg.

As someone who tweets at conferences that I attend I found the analysis very interesting. Some of what interested me the most from the slides:

There were over 3,000 tweets from 344 people attending the conference. Don't know what the total attendance of the conference -- but I suspect the 344 number is a relatively large percentage of the total attending.
Loved the use of the Wordle clouds to visually represent the discussion that occurred via Twitter.
Great to see the word "patient" as the second most tweeted word.
Slide 10 shows a mapping of those in the Health 2.0 network. Would love to see a blown up version of this slide to see the connections in more detail.

Virginia Department of Health Professions Breach: Extortion Demand Regarding 8M Patient Records and 35M Prescriptions

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 06 May 2009 14:05:30 PDT

Information Week is covering a story involving an extortion letter sent last week to the Virginia Department of Health Professions seeking $10M to return more than 8M patient records and 35M prescriptions allegedly stolen from the Virginia Department of Health Professions.

The extortion demand was posted on WikiLeaks. The WikiLeaks website states:

May 3, 2009
Summary

On Thursday, April 30, the secure site for the Virginia Prescription Monitoring Program (PMP) was replaced with a $US10M ransom demand:

"I have your shit! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(For $10 million, I will gladly send along the password."

The site, https://www.pmp.dhp.virginia.gov/pmpwebcenter/login.aspx appears to have been entirely disabled and is presently unavailable.
The linked file provides the full ransom message.
The PMP is used by pharmacists and others to discover prescription drug abuse.
The PMP declined to comment, although when contacted, appeared to be aware of the issue, instantly referring inquiries to the director of the DHP, who is presently unavailable.

The Virginia Department of Health Professions website indicates that they are "currently experiencing technical difficulties which affet computerand email systems."

Sandra Whitely Ryals, Director of Virginia Department of Health Professionals, responded to the inquiry by Information Week stating that "a criminal investigation is under way by federal and state authorities."

The Washington Post Security Fix blog is also covering this story. Follow more news on this story via Google News.

UPDATE (5/5/09): At the bottom of his follow up post, John Chilmark asks the question: "Now the question is, under HIPAA, does the VDHP have to send out breach notifications to all consumers whose records have been compromised?

Here is my quick assessment. The HIPAA privacy rule (pre-ARRA HITECH) does not contain provisions that require a covered entity to notify individuals impacted by an alleged breach. However, when I have assisted clients with these types of data breach situations in the past I typically discuss with the client whether it is good practice to provide notification. The HIPAA privacy rule provisions do contain a requirement that a covered entity should mitigate potential harm to patients/individuals when there is a violation of the privacy rule. My interpretation is that this might, under certain circumstances, include providing notice to such individuals whose data has been compromised. Also, a question that factors into the equation is whether or not the Virginia Department of Health Professsions qualifies as either a covered entity or business associate under the HIPAA privacy rule. Handling these situations are very fact specific and depend upon a number of factors.

The new federal breach notification requirements contained in the HITECH section of the American Recovery and Reinvestment Act (ARRA) do not apply because the provisions do not go into effect until 30 days after the Department of Health and Human Services (HHS) publishes the interim final data breach notification regulations which has not yet occurred. The new federal breach notification law will be implemented in conjunction with the Federal Trade Commission's (FTC) proposed health breach notification rule that will apply to PHRs, PHR related vendors and other third party providers. The proposed rule is currently out for comment.

The regulations are currently in the works and HHS has now issued initial guidance on what data is classified as unsecured protected health information (not secured by technology that renders it "unusable, unreadable or indecipherable"). See the April 27, 2009 guidance for more on what this means. The guidance outlines the types of technologies that, if used, create a safe harbor for HIPAA privacy covered entities adn business associates to avoid having to provide notice in a situation where there has been a breach.

Also, the VDHP will likely have to assess the Virginia Data Breach Act (state-by-state survey of state breach laws by the National Conference of State Legislatures) to see whether notification or other action is required under state law.Over 40 states now have distinct state laws governing breach notification that extend to and cover everything from traditional personal information (name, social security number, etc.) to health related information. I've not dealt nor reviewed the Virginia Act but suspect a strong likelihood that notification will be required.

UPDATE (5/6/09): The Roanoke Times provides an update on the status of the pending investigation with comments from Governor Tim Kaine. The article states:

Gov. Tim Kaine said today that a hacker’s reported access to patient prescription records from a state database was “an intentional criminal act against the commonwealth by somebody who was trying to harm others” . . .

The FBI and the Virginia State Police are investigating the matter. Kaine said he could not discuss the probe.

“Right now our goal is to make sure that the investigation and criminal process works so that the person who is responsible is caught and prosecuted . . . and that we protect people whose data has been compromised,” Kaine said this morning.

The article also indicates that under Virginia law notification is required and that Virginia's breach notification law requires, like many state laws, that notice must be provided "without unreasonable delay."

The article also indicates that Virginia law requires notification of individuals whose personal information may have been accessed due to a computer security breach. The law states that notification must be provided “without unreasonable delay.”

Charleston FestivALL 2009: A City Becomes A Work Of Art

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 14 May 2009 10:12:42 PDT

The preliminary lineup of events for Charleston FestivALL 2009 was announced today. Ten days of music, art, theater, entertainment, creativity and fun bring the city of Charleston alive from June 19 - 27, 2009. Where the city become a work of art!

As many of my friends, colleagues and regular readers know I love the Charleston FestivALL (my past posts) and am already excited about this years expanded ten day event. The event highlights why I love West Virginia and its creative powers and people. To experience a visual understanding of this feeling check out FestivALL from 2006-2009 through the eye of Rick Lee.

The image above will be a part of the official FestivALL 2009 poster. This year's poster, conceived and designed by Alex Morgado, is a symbol of the FestivALL idea. Local artists have contributed designs for letters. At the opening ceremonies, each letter will be taken to a different part of the city where it will be displayed during the ten days of FestivALL. At the end, they will be gathered and displayed together.

Check out the schedule of events (and pre-festival events) by FestivALL Executive Director, Larry Groce. Also, the lineup was announced in today's Charleston Gazette. Last year there were 83 different events featuring 169 performances, exhibitions and presentations by 378 companies, troupes and individual artists.

UPDATE (5/12/2009): FestivALL has launched its new web site which includes a full 2009 schedule. The web site has a cool and creative roll over of the artwork, "A City Becomes A Work Of Art." Check it out.

Google Experimental Flu Trends for Mexico

noreply@blogger.com (RCoffield@fsblaw.com) — Wed, 29 Apr 2009 10:53:20 PDT

Google Flu Trends have launched an Experimental Flu Trends for Mexico as a result of the ongoing concern over the current swine flue outbreak. The experimental model for Mexico shows estimates on possible flu activity in the various states in Mexico. Google Flu Trends uses aggregated Google search data to estimate possible flu activity in near real-time.

Additional details on how the Experimental Flu Trends for Mexico works and FAQs. More information about Google Flu Trends in my prior post.

Thanks to @rzeiger for the Twitter tip on the launch of the experimental tracker.

AHLA Teleconference: HIPAA Privacy Fundamentals

noreply@blogger.com (RCoffield@fsblaw.com) — Fri, 24 Apr 2009 09:43:53 PDT

Next month I will be co-presenting on an American Health Lawyer Association Teleconference on the topic of HIPAA Privacy Regulation Fundamentals - An Introductory Course.

The teleconference is scheduled for May 13, 2009, 1:00 - 2:30 pm EST. My co-presenter is Rebecca L. Williams of Davis Wright Tremaine LLP and the moderator will be Phyllis Granade of Adorn & Yoss.

This teleconference is geared toward a gaining a basic understanding of HIPAA privacy law for health lawyers (think, HIPAA 101). We will also be discussing the impact of the changes unde rthe HITECH Act of 2009. Although geared toward health lawyers this teleconference would also be valuable for health care professionals and others in the industry interested in learning more about HIPAA.

You can find out more about the teleconference and how to register via the AHLA website.

WV Senator Rockefeller: The Health Information Technology Public Utility Act of 2009

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 28 Apr 2009 20:12:50 PDT

Yesterday West Virginia Senator Jay Rockefeller introduced "The Health Information Technology Public Utility Act of 2009"(Senate Bill 890) to facilitate the nationwide adoption of electronic health records (EHRs) though an "open source" public utility model.

A copy of Senate Bill 890 is available on Thomas (GPO PDF version). According to the press release the Act would:

Create a new federal Public Utility Board within the Office of the National Coordinator for Health IT to direct and oversee formation of this HIT Public Utility Model, its implementation, and its ongoing operation.
Implement and administer a new 21st Century Health IT Grant program for safety-net providers to cover the full cost of open source software implementation and maintenance for up to five years, with the possibility of renewal for up to five years if required benchmarks are met.
Facilitate ongoing communication with open source user groups to incorporate improvements and innovations from them into the core programs.
Ensure interoperability between these programs, including as innovations are incorporated, and develop mechanisms to integrate open source software with Medicaid and CHIP billing.
Create a child-specific Electronic Health Record (EHR) to be used in Medicaid, CHIP, and other federal children’s health programs.
Develop and integrate quality and performance measurement into open source software modules.

Microsoft and Mayo Clinic Collaboration: Mayo Clinic Health Manager

noreply@blogger.com (RCoffield@fsblaw.com) — Thu, 23 Apr 2009 07:36:10 PDT

Today Microsoft Corporation and Mayo Clinic announced a new consumer online health service called Mayo Clinic Health Manager, build on the HealthVault platform.

The press release states that Mayo Clinic Health Manager provides individuals "a place to store medical information and receive real-time individualized health guidance and recommendations based on the clinical expertise of Mayo Clinic . . . [extending] the capabilities of traditional personal health records, using an individual's health information to generate customized recommendations on which they can act to help them better manage their health and the health of their families."

Learn more from the Media Kit or take a tour.

How does this change the current PHR landscape?

Like others who have been commenting today I see this as combining the power brand of Mayo Clinic and its guidelines with what appears to be simple PHR tools designed to allow you to record, track, monitor, etc. your health information. However, at this point it still doesn't get over the hurdle of the individual having to individually input their own data.

Will health consumers become engaged to take on this role? Can providers and payors start to feed good data into the system to lessen the burden on the consumer/patient? What role will state and federal payors play in these systems? How will we all address the issues raised by Dave deBronkart (e-patientDave) which have been the center of discussion on the health blogosphere the past couple of weeks.

More questions than answers.

UPDATE (4/23/09): Did Microsoft sign a HIPAA Business Associate Agreement as a part of the collaboration? In HIPAA lawyer jargon the real question is "whether Mircrosoft is offering a service for or on behalf of the Mayo Clinic and is receiving protected health information." Answer per Microsoft from Nei Versel's Healthcare IT Blog.

Fourth Circuit Affirms Summary Judgment Under Health Care Quality Improvement Act of 1986

noreply@blogger.com (RCoffield@fsblaw.com) — Tue, 21 Apr 2009 11:27:28 PDT

Congratulations to my partners, Rick Jones and David Givens for successfully defending Charleston Area Medical Center, Inc. before the United States Court of Appeals for the Fourth Circuit in the matter of Wahi v. Charleston Area Medical Center, Inc., et al., Slip Op. No. 06-2162 (4th Cir. April 10, 2009). Rick argued the case against well known lawyer, Kenneth Starr, who represented Rakesh Wahi, M.D., the appellant in the matter.

Following is a summary and some of the significant points regarding the impact on peer review privileges.

Wahi v. Charleston Area Medical Center, Inc., et al., Slip Op. No. 06-2162 (4th Cir. April 10, 2009) is a significant decision analyzing the immunity provisions of the Health Care Quality Improvement Act of 1986 (“HCQIA”). It affirms summary judgment on various claims made by the Plaintiff, a cardiothoracic surgeon, arising from the suspension of his privileges at Charleston Area Medical Center (“CAMC”), a Charleston, West Virginia hospital. The underlying facts and procedural history span over a decade of Dr. Wahi's tenure at CAMC. Dr. Wahi was granted privileges at CAMC in 1993. For a variety of reasons, CAMC summarily suspended his privileges in 1996 and reported the suspension, as required, to the National Practitioner Data Bank ("NPDB"). Following rehabilitative efforts, Dr. Wahi was granted restricted privileges.

Subsequently, there were documented instances of Wahi practicing outside the scope of his restricted privileges, as well as charges of practicing below the standard of care. In July 1999, Dr. Wahi was again summarily suspended, and requested a hearing under the applicable provisions of the hospital’s governing documents.

Not satisfied with the hearing procedures set forth in the governing documents, Dr. Wahi retained counsel to negotiate with the hospital over the hearing process. He objected to the hearing examiners, procedures, and ultimately sought the intervention of a state circuit court before the hearing process even began. Following the state court's refusal to intervene, Dr. Wahi ceased efforts to move forward with the hearing process and, some five years later, filed suit in the United States District Court for the Southern District of West Virginia alleging anti-trust monopolization and conspiracy, breach of contract, civil rights conspiracy, defamation and breach of contract. Following limited discovery on the application of immunity under HCQIA1, CAMC moved for summary judgment. Judge Goodwin granted CAMC's motion as to all counts finding that Dr. Wahi failed to rebut the statutory presumption of immunity. Dr. Wahi appealed.

The Fourth Circuit found that Dr. Wahi abandoned any appellate claim as to three of the four prongs under the HCQIA immunity standards and focused its immunity analysis solely on the issue of whether CAMC’s failure to actually set and hold a hearing deprived the hospital of its legally presumed immunity.

The Fourth Circuit affirmed summary judgment, finding the hospital was immune for its actions under the HCQIA despite the fact that a hearing was never actually scheduled or conducted. CAMC’s notification to Dr. Wahi of the charges, the hospital’s many attempts to provide a hearing, and Dr. Wahi’s non-cooperation in the hearing process led the court to conclude that CAMC’s process, when considered in its totality, satisfied the minimum standard of reasonableness required under HCQIA. The Court found that Dr. Wahi’s evidence was simply insufficient to overcome the statutory presumption of immunity under HCQIA, and affirmed the district court's ruling.

The Court also affirmed the District Court’s refusal to grant injunctive relief, finding Wahi did not prove CAMC committed any wrong; that CAMC was not a “state actor” for purposes of § 1983 claims; that he failed to amend his complaint to include a defamation claim, making it non reviewable on appeal; and, that because the hospital bylaws did not form a contract under state law, Dr. Wahi could not allege breach of contract for any violation of the bylaws. A final argument rejected by the Court was Dr. Wahi’s claim that CAMC breached confidentiality required by 45 C.F.R. § 60.13 by disclosures to the press, finding the NPDB “does not prevent the entity who reported NPDB from disclosing the mere fact that a report was filed.”

The Wahi opinion has significance for hospitals and others involved in peer review matters:

HCQIA provides a means of minimizing and limiting discovery to issues related to the availability of immunity to a hospital. HCQIA provides a vehicle through which a hospital may obtain summary disposition of cases without running the risks associated with a jury trial.
For a hospital to avail itself of HCQIA immunity, there need not be precise compliance with all the elements of one’s governing documents, but the hospital may show from a totality of the circumstances that its handling of the matter was objectively reasonable.
HCQIA’s “safe harbor” provisions should be read expansively and not narrowly construed.
The reasonableness of a hospital’s actions is not a subjective determination, and neither good nor bad motives should be considered; rather, the court should look at the objective, overall reasonableness of the hospital’s actions, even if it is later determined that the facts were different or the standard of care was actually met.
A hospital should use care in properly documenting the information upon which it acts and the manner of notifying the physician of the charges and, above all else, make sure the physician is fully advised of the charges and given the opportunity to explain or rebut any charges against him. Proper documentation of all the steps required for HCQIA is crucial.

Rick and David would like to recognize fellow partner, Nate Tawney, and associate, Justin Jack who also worked on defending the matter and assisted in the preparation of this summary.