HIT Blawg

New! Medical Malpractice Litigation Support Expertise

2011-09-09T09:50:00.002-05:00

Gerald "Jud" DeLoss and DeLoss Health Law announce an additional set of professional services available for attorneys, consultants, and executives involved in medical malpractice litigation. Mr. DeLoss is able to provide the following and additional critical assistance during medical malpractice and related litigation:

1. Review Electronic Health Record (EHR) and other electronic data sources to identify other potentially responsible parties and negligent misconduct.

2. Conduct analysis of EHR and audit trail to determine modifications/revisions to medical record following incident and to determine its integrity.

3. Guide and assist counsel in electronic discovery (e-discovery); including identifying electronic data sources, preparing proposed litigation holds/demands, and analyzing metadata for supporting evidence.

4. Expound upon standards associated with adoption and utilization of EHRs.

5. Expound upon standards related to Clinical Decision Support systems incorporated into EHRs.

6. Advise counsel on implications of HIPAA/HITECH Privacy and Security Rules and leveraging each for maximum benefit during litigation.

7. Identify financial incentives that medical providers may have received in exchange for utilizing EHRs in an improper manner.

8. Guide counsel through the interconnected EHR shared among multiple parties.

9. Advise counsel on relationship among parties engaged in Health Information Exchange and recommend potential legal theories under which additional parties may be directly or indirectly engaged in litigation, including tort and contract causes of action.

10. Recommend maximum leverage available under HIPAA/HITECH Breach Notification Rules and potential causes of action.

Mr. DeLoss was one of the first experts to identify the implications of medical negligence/malpractice and HIT. He has written extensively on the potential waiver of the attorney-client privilege related to defense counsel’s HIPAA-mandated Business Associate Contract. In addition, he has addressed the impact of the HIPAA/HITECH access, amendment, and accounting standards during litigation. More recently he has identified how Electronic Health Records will modify medical-related litigation as it relates to Privacy/Security Causes of Action, Electronic Discovery, and the Standard of Care. Finally, Mr. DeLoss has expounded upon the vast legal implications of the admission of a new party to the medical realm – Health Information Exchanges – and how HIEs may be exposed to legal liability.

Selected Articles & Presentations:

"The Life Cycle of Health Information: An Overview of the Creation, Use, and Disclosure of Health Data Across the Health Delivery Spectrum,” Connections Magazine, American Health Lawyers Association, May 2011

“Healthcare Informatics: Clinical and Legal Aspects,” Co-Panelist, 13^th Annual Northern Illinois Quality Conference, Naperville, IL, November 16, 2010

"Complying with the HITECH Act Legal Requirements," American Association of Oral & Maxillofacial Surgeons, Webinar, June 2, 2010

"The New Patient Privacy Challenge: Where Breach Notification, HIPAA & HR Meet," Audio Seminar, November 12, 2009

"Case Law Update and Other Tips, Trends, and Tidbits," Child Health Corporation of America Risk Management Forum, Baltimore, MD, September 17, 2009

“Clinical Decision Support Systems: Towards a New Standard of Care?”, World of Health IT Conference, Copenhagen, Denmark, November 4-6, 2008

"Is Your EMR Legal?" American Medical News, October 13, 2008, Quotation

Please contact DeLoss Health Law and Mr. DeLoss at:

Direct 312.880.9679

Cell 612.432.3135

gdeloss@delosshealthlaw.com

DeLoss Health Law

700 Westgate Road

P.O. Box 1615

Deerfield, IL 60015

DeLoss Named to Illinois Health Information Exchange Authority Advisory Committee

2011-07-14T08:48:00.000-05:00

Gerald "Jud" DeLoss of DeLoss Health Law has been named to the Advisory Committee to the Board of Directors of the Illinois Health Information Exchange Authority. In this capacity, Jud will provide assistance to the Board on technical, legal, and compliance issues. Jud is a health lawyer in Deerfield, Illinois and provides legal advice and guidance on Health Information and Technology issues nationally. He is also currently the Chair of the American Health Lawyers Association, Health Information and Technology Practice Group.

DeLoss Authors Lead Article in American Health Lawyers Association "Connections" Magazine

2011-06-02T01:25:00.000-05:00

The recent edition of the American Health Lawyers Association "Connections" magazine contains an article I authored entitled "The Life Cycle of Health Information: An Overview of the Creation, Use, and Disclosure of Health Data Across the Health Delivery Spectrum." The article provides a summary of the many roles that health information plays in the health care system and describes the legal and other conditions imposed on that same data.

Healthcare Compliance Legal Issues Manual

2011-05-12T10:13:00.000-05:00

The American Health Lawyers Association has recently released the updated and revised Healthcare Compliance Legal Issues Manual, Third Edition. The Manual can be reviewed and purchased here.

I had the good fortune to edit Sections 5.4 (Privacy Laws) and 5.10 (HIPAA Enforcement). Overall, I believe the Manual is a valuable tool for in house and other counsel that need a detailed understanding of legal issues in the healthcare field. The Manual is heavily annotated for further reading and research, if necessary. In addition, I would be happy to expand/expound upon any information contained in my sections (5.4 and 5.10) or put you in touch with my AHLA colleagues who edited other sections.

Upcoming Events

2011-04-27T08:48:00.000-05:00

I will be presenting at a few upcoming conferences relating to EHRs and related legal issues. The following is a summary of the two which are coming up soon.

Seventh Academic Medical Center Conference

"EHRs, Wins, Losses. and Ties"

Friday Center, University of North Carolina
Chapel Hill, NC
May 22-25, 2011

Illinois State Medical Society
"Legal Considerations for EHR Adoption and Usage"
Webinar
June 2, 2011

Announcing the Opening of DeLoss Health Law

2010-11-03T10:50:00.000-05:00

I am proud to announce the founding of DeLoss Health Law, a full-service health law firm emphasizing health information and technology issues. DeLoss Health Law will provide a wide range of legal services to healthcare providers, plans, vendors, and ancillary providers on matters including Stark, AntiKickback Statute, transactions, joint ventures, medical staff privileging, credentialing, provider contracting, electronic health records and health information exchange, and associated litigation.

Please check at www.delosshealthlaw.com for future information.

DeLoss Health Law
P.O. Box 1615
Deerfield IL 60015
312.880.9679 Direct
612.432.3135 Cell
678.928.0205 Fax
gdeloss@delosshealthlaw.com
www.delosshealthlaw.com

Chicago Health Information Technology Regional Extension Center

2010-09-21T15:28:00.000-05:00

Chicago has its very own HIT Regional Extension Center, the CHITREC. Regional Extension Centers were created under the HITECH Act. CHITREC serves to assist primary care providers with adoption and meaningful use of electronic health records.

Regional Extension Centers and CHITREC in particular are excellent sources of information on EHRs, Health IT, and the meaningful use incentives. If you are a PCP in the Chicago area in need of assistance, contact CHITREC. Others may contact their Regional Extension Center for additional information.

HIT Blawg Now on Facebook!

2010-09-14T15:11:00.000-05:00

For all of you that are Facebookers, you can now follow HIT Blawg on Facebook. Just friend us here.

Praxis EMR First to Seek HITECH Certification

2010-09-14T11:39:00.000-05:00

Praxis EMR has submitted its application to the Drummond Group, making it among the first EHRs to apply for HITECH certification. Under the ARRA legislation, medical practitioners can receive up to $65,000 in federal incentives if they can demonstrate "meaningful use" of certified EHR technology. The Drummond Group is authorized by the U.S. Department of Health and Human Services to test and certify EHRs. Praxis is offering a guarantee of stimulus funds for eligible providers that adopt their EHR system.

Praxis prides itself on being "template-free" which supposedly increases productivity the more it is utilized.

Challenges and Barriers to Clinical Decision Support

2010-08-24T16:52:00.000-05:00

I was recently reviewing an AHRQ report entitled "Challenges and Barriers to Clinical Decision Support (CDS) Design and Implementation" which was based upon AHRQ CDS Demonstration Projects. There were several challenges faced:

1. Management of the design of CDS takes considerable time and effort
2. Lack of alignment with the organization's overall goals and incentives
3. Clinicians do not agree on how prescriptive the CDS application should be
4. Local institutions and providers chose to "customize knowledge"
5. Guidelines are ambiguous and unclear
6. Terminology and data exchange standards are still maturing and lack implementation specifications

Additionally, the report noted that suboptimal EHR usage by clinicians diminished the impact of CDS interventions.

Finally, the report set forth some lessons and proposals for improvement.

Guideline developers:
 Guidelines should be specific, unambiguous, and clear.
 Guideline development committees should include individuals with programming expertise and health informaticians.
 Updates of the guideline recommendations are needed. Guideline developers should consider issuing statements of update when new medical evidence is brought forth and providing regular review and updates of guidelines. For example, the USPSTF re-reviews each topic every 5 years.25

IT vendors:
 As most organizations utilize vendor systems with hard-coded functionality, vendors should consider ways to reduce the need for an organization to rebuild the CDS content when upgrading or implementing a new EMR system (e.g., adopting a module or service-oriented approach).
 Incentives for vendor participation in CDS initiatives should be aligned with efforts, such as defining meaningful use criteria, to encourage standards adoption.

Standards development organizations:
 Implementation specifications and guides should be produced that simplify existing standards and support consistent application of standards for messaging, interfacing, and mapping purposes.
 The development of standards and implementation specifications and guides should accommodate appropriate clinical practice variations.

HIT Policy Committee Endorses Tiger Team Recommendations on Consent for HIE

2010-08-23T15:04:00.001-05:00

The federal Health IT Policy Committee has endorsed a set of recommendations on when healthcare providers must obtain consent before exchanging patient heath records electronically with other clinicians, testing labs or health information exchange (HIE) networks. The Committee will submit the recommendations, the product of several weeks' work by a special privacy and security "tiger team," to the Office of the National Coordinator for Health Information Technology. ONC must decide whether to set the recommendations in policy in time for the start of its health IT adoption campaign next year.

The recommendations answer questions that ONC raised about patient consent policies for point-to-point exchanges among providers and between providers and testing labs.

Clinical practices and hospitals must be able to perform such simple or "directed" exchanges in order to qualify for incentive payments in the first stage of the meaningful use project beginning in 2011. "We laid down a foundation with these recommendations," said Deven McGraw, chair of the tiger team at the Aug. 20 meeting. "But only a systemic and comprehensive approach to privacy and security can achieve public confidence."

"Willful Neglect" and HIPAA

2010-08-04T16:24:00.000-05:00

The recently proposed HITECH Act changes to HIPAA go into extensive detail on the categories of culpability. Setting aside some of the other interesting aspects of these modifications, and the other highlights of the rules, one example relating to the "willful neglect" standard struck me as new and unusual.

In describing a situation which may arise to the level of willful neglect, HHS provides an example of a covered entity that failed to respond to an individual's request that it restrict its uses and disclosures of protected health information. HHS's investigation reveals that the covered entity has no policies and procedures to consider the request for a restriction and it "refuses to accept any requests for restrictions from individual patients who inquire." It is the quoted language which seems so odd to me. Under HIPAA's Privacy Rule, a covered entity is not obligated to accept any request for a restriction on uses or disclosures. (45 C.F.R. section 164.522(a)(1)(i)). In the past, many have counseled that covered entities should never agree to such a restriction because it goes beyond what HIPAA mandates and it may subject the covered entity to a multitude of record-keeping and other logistical difficulties. In other words, the patient had the right to request, but did not have the right to receive, such a restriction on the PHI. In addition, the Privacy Rule only requires documentation if the covered entity agrees to the restriction and the implementation specifications (i.e. policies and procedures) only relate to agreement to the restriction.

However, the preamble to the proposed Rule states that "In the second example, the covered entity's refusal to accept any requests for restrictions from individual patients who inquire would be grounds for a separate finding of a violation due to willful neglect." I fail to see how refusing to accept any requests would amount to any violation, let alone willful neglect. Perhaps HHS is using the term "accept" to mean simply that the individual has a right to submit the request and that submission must be accepted (or, that the patient has inquired about the right to request and that inquiry was not accepted), rather than using "accept" to mean agreement. In either case, it is a very strong and straightforward statement that is not completely supported by existing law.

Data Breach Result of Business Associate

2010-07-21T13:18:00.000-05:00

The protected health information of 800,000 patients has been lost or stolen, according to South Shore Hospital in South Weymouth, Massachusetts. Back up computer files that were sent to a contractor for destruction have been lost. The files were not encrypted and, accordingly, notice of the breach was required to be given to both the individuals, media outlets, and the Office for Civil Rights. According to the hospital, it first learned that the files had not been disposed of properly on June 17, 2010. It claims, despite the legal requirements otherwise imposing a more timely notice, that it will not be sending out notices to individual for another 4-6 weeks (the HITECH Breach Notification Rule requires notice to individuals no later than 60 days from the date the breach is discovered).

Interestingly, the notice does not specify the identity of the business associate who purportedly lost the information. Not sure why the hospital would want to take the full brunt of the public relations hit that this breach has caused. It may be that the relationship between the parties was not spelled out as carefully as it should have been under the business associate agreement. Or, it could be that the business associate had inserted some protective language into its form of the business associate agreement that the hospital did not carefully review. I am more inclined to view it as a failure on the part of the hospital to carefully draft its business associate agreement because there is no indication that the hospital intends to provide free credit and identity theft protection. A properly prepared agreement would have put the onus on the business associate to provide for such coverage, among other things.

Hospital ER Computers -- Germ Factories

2010-07-12T15:57:00.000-05:00

A recent study by Henry Ford Hospital found that computer keyboards in the registration and triage areas of the emergency department contained the highest level of germs. "Contamination was predominantly found in non-treatment areas," says Angela Pugliese, M.D., lead author of the study and an emergency department physician at Henry Ford Hospital.

"This suggests that only areas without true patient contact, and likely less frequent hand washing, might benefit from using washable silicone rubber or antibacterial keyboards instead of a standard keyboard."

Dr. Pugliese will present the findings June 5 at the Annual Meeting of the Society for Academic Emergency Medicine in Phoenix.

Multiple studies have found colonies of bacteria on computer keyboards. Due to the threat of its potential spread to patients, Henry Ford's Information Technology and Infection Control departments recommended exchanging traditional keyboards in the Emergency Department for washable, silicone rubber models.

The objective of this study was to determine the frequency and type of keyboard contamination before replacing the keyboards.

Seventy-two standard, non-silicone rubber keyboards were swabbed on two different days, six days apart. All keyboard keys, except the function keys, were cultured and analyzed for bacteria.

Less than 14 percent, or 10 keyboards, were colonized with nine different bacteria. Of the keyboards in non-treatment areas, nearly 32 percent were contaminated, versus less than nine percent in treatment areas.

New HIPAA Regulations Proposed

2010-07-08T12:49:00.000-05:00

New proposed regulations have been released modifying the HIPAA Privacy, Security, and Enforcement Rules. The modifications are made pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act.

A more detailed summary will follow. For now, a copy of the Notice of Proposed Rulemaking may be accessed here.

Health Net to Pay $250K to Settle CT Breach

2010-07-07T13:12:00.000-05:00

Health Net has agreed to pay $250,000 and enter a corrective action plan to settle a lawsuit brought by Connecticut Attorney General Richard Blumenthal after a hard drive containing information of 1.5 million current and former members was lost or stolen.

Blumenthal sued the company in January, becoming the first state attorney general to wield new authority granted under the stimulus law to enforce the privacy provisions of the Health Insurance Portability and Accountability Act of 1996. The agreement resolving the case stipulates that the settlement does not represent an admission of liability or wrongdoing by Health Net.

Further information at Modern Healthcare, in a story by Gregg Blesch.

Hospitals and HIT Benefits

2010-07-07T12:50:00.003-05:00

Hospitals understand the importance of health information technology (HIT) and the benefits of its widespread adoption, yet as a field still face significant barriers to implementation according to a newly released survey of America's Most Wired hospitals and health systems.
This year's survey reveals continued progress for hospitals in patient safety initiatives:
Fifty-one percent of medication orders were done electronically by physicians at Most Wired hospitals, up from 49 percent last year. Over half (55 percent) of Most Wired hospitals match medication orders at the bedside through bar coding or radio-frequency identification, up from 49 percent in 2009 and from 23 percent five years ago. Additionally, Most Wired hospitals have made improvements when it comes to sharing information during care transitions. For example, new medication lists are electronically delivered to caregivers and patients 94 percent of the time when a patient is transferred within the hospital, 98 percent at discharge and 86 percent when transferred to another care setting.

"The survey results highlight that continued progress is being made but the full potential of health IT has not been met," says Rich Umbdenstock, president and CEO of the American Hospital Association (AHA). "Hospitals embrace health IT and recognize the many benefits it can provide to patients, but even Most Wired hospitals face barriers to adoption. We have asked that the federal government stimulate greater adoption by making Medicare and Medicaid incentive payments more widely available to hospitals and physicians so more hospitals can move in this direction."

Survey results speak to the fact that the full potential of health IT has not been met and that the use of electronic medical record (EHR) functions is still not widespread, even with independent physicians who practice within hospitals. For Most Wired hospitals, only 43 percent of independent physician practices have the ability to electronically document medical records, 41 percent have computerized physician order entry (CPOE) and 44 percent have decision support.

Gerry McCarthy, vice president of physician solutions at McKesson Corporation says providers need to be strategic about IT deployments. "You can't just start with CPOE as a first step," he says. "The best way to garner physician adoption of CPOE is to ensure that it adds immediate value to their workflow, which involves automating information across foundational care processes first, such as nursing documentation and bar-code medication administration, clinical monitoring and other features." The same type of thoughtful planning should be applied to information exchange, both with physicians and patients, he adds. McKesson is a major sponsor of the Most Wired Survey.

The 2010 Most Wired Survey is redesigned this year to reflect two years of work with an advisory group to continually improve the survey. The 2010 Most Wired Survey represents a new structure and methodology with an increased use of analytics and reporting. The advisory group was comprised of leaders from the College of Healthcare Information Management Executives (CHIME), chief information officers, Most Wired staff and vendors. Additionally, the new methodology was made available to the entire CHIME membership for review and comment.

Hospitals & Health Networks conducted the 2010 survey in cooperation with McKesson Corporation and CHIME. The H&HN cover story detailing results is available here.

Electronic Discovery and Health Informatics

2010-07-06T11:56:00.000-05:00

I am the guest columnist for this month's "Legal e-speaking" column in the Journal of AHIMA -- the American Health Information Management Association's monthly journal. The column addresses electronic discovery (e-discovery) in litigation and focuses on the judge's perspective. While not limited to electronic health information, the column exposes some of the major and minor issues that HIMs should address both before and during litigation.

Indiana Health Information Exchange

2010-06-25T15:29:00.001-05:00

The board of directors of Indiana Health Information Technology, Inc. (IHIT) is soliciting project ideas for the $10.3 million federal grant the Indiana Family and Social Services Administration (FSSA) received in March. The State of Indiana was awarded the funding to further expand the use of health information exchange under the State Health Information Exchange Cooperative Agreement Program. Project ideas may be submitted online.

ONC Issues Final Certification Rule

2010-06-18T12:13:00.000-05:00

The Office of the National Coordinator (ONC) today released its Final Rule on the Temporary Certification Program for Health Information Technology. This final rule establishes a temporary certification program for the purposes of testing and certifying health information technology.

WellPoint to Offer E-Housecalls

2010-06-16T10:47:00.001-05:00

WellPoint insurance has unveiled a new program to give its members access to healthcare providers via the Internet. The house call would be initiated by a patient logging in for a video chat or text from work or at home. The physician will be able to review patient information, chat, prescribe medicine or suggest a follow-up visit, all while online or the telephone.

Blackhawks Win the Stanley Cup!

2010-06-10T12:01:00.000-05:00

The only news for today is the historic win by the Chicago Blackhawks over the Philadelphia Flyers to claim the Stanley Cup for the first time in almost 50 years.

Congrats to the Hawks. The victory parade is scheduled for Friday morning at 10:30 am on Washington and Michigan Avenues in downtown Chicago.

AvMed Data Breach Tops One Million

2010-06-04T16:35:00.000-05:00

A data breach at AvMed Health Plans that previously was thought to have affected 360,000 current and former members now totals 1.22 million, the Miami-based insurer has announced.

Two laptop computers were stolen last December 11 from an AvMed facility in Gainesville. A preliminary forensic examination found personal data, including name, address, date of birth, Social Security number and health related data, might have been compromised for 360,000 individuals. Further analysis has revealed that information on another 860,000 members may be at risk. To date, AvMed has no evidence that any information on the laptop has been misused. The company on June 7 will begin mailing notification letters and is offering two years of identity protection services.

Breaches Involving 500 or More Patients

2010-06-02T15:58:00.000-05:00

As required by section 13402(e)(4) of the HITECH Act, HHS must post a list of breaches of unsecured protected health information affecting 500 or more individuals. The following breaches have been reported to HHS for the month of May:

Oconee Physician Practices
State: South Carolina
Approx. # of Individuals Affected: 653
Date of Breach: 5/09/10
Type of Breach: Theft
Location of Breached Information: Laptop

VA North Texas Health Care System
State: Texas
Approx. # of Individuals Affected: 4,083
Date of Breach: 5/04/10
Type of Breach: Improper Disposal
Location of Breached Information: Paper Records

Practice Fusion and Kareo Announce New Integrated Software

2010-06-02T15:33:00.000-05:00

Kareo and Practice Fusion today announced their integrated solution for medical practitioners. Kareo, a provider of medical billing software for physicians and Practice Fusion, and EHR vendor, have teamed up.

"This is a ground-breaking health IT partnership that teams the easiest-to-use medical billing solution with the fastest-growing EHR – offering physicians a complete solution to the financial and clinical needs of their practice," said Dan Rodrigues, CEO of Kareo. "With web-based platforms and low cost of ownership from both Kareo and Practice Fusion, there is no other medical billing and EHR solution on the market that's as easy, affordable, and quick-to-setup."

Key Items:

Practice Fusion's free, web-based EHR includes scheduling, charting, e-prescribing, secure messaging, document management and lab interfaces.
Kareo's medical billing software is connected to every major payor in the US and includes electronic insurance billing, patient billing, accounts receivables management and analytics.
Both Kareo and Practice Fusion's services are optional for customers and also available independently.

The Kareo/Practice Fusion integration is live for any doctor in the US starting today. The combined solution is guaranteed to be HHS certified for federal EMR stimulus incentives under the economic stimulus plan. How that is accomplished is unknown.