November 23, 2016

Responding to Negative Internet Reviews: Beware HIPAA

By Kim Stanger, Holland & Hart LLP

As a healthcare provider, you may log onto the internet one day only to discover a negative review from a disgruntled patient or family member. Undoubtedly, the review contains inaccurate, incomplete, or downright defamatory information. Your first impulse may be to post a response online, but doing so may subject you to HIPAA fines, adverse licensure action, or privacy lawsuits.

HIPAA generally prohibits healthcare providers from using or disclosing a patient’s protected health information without the patient’s authorization. (45 CFR 164.502). “Protected health information” includes information that “[r]elates to the past, present, or future physical or mental health or condition of an individual [or] the provision of health care to an individual, and … that [i]dentifies the individual, or [w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” (45 CFR 160.103). Thus, posting any information that identifies the individual as a patient likely violates HIPAA even if specific medical information is not disclosed; a patient does not waive their HIPAA rights by posting his or her own information, and there is no HIPAA exception that allows a healthcare provider to disclose information in response to a negative review. In 2013, Shasta Regional Medical Center paid $275,000 to settle claims that it violated HIPAA when it disclosed a patient’s health information to the media in response to a negative newspaper article. (See Press Release). ProPublica recently published a report identifying numerous HIPAA violations resulting from providers’ ill-considered responses to negative internet reviews. (See article).

Continue reading →

October 26, 2016

Conduct a Thorough HIPAA Risk Analysis or Pay Big Fines

by Kim Stanger, Romaine Marshall, and C. Matt Sorensen, Holland & Hart LLP

St. Joseph Health recently agreed to pay $2.14 million to settle allegations by the Department of Health and Human Services Office for Civil Rights Office (“OCR”) that its data security was inadequate.

In its investigation of St. Joseph’s handling of a 2012 data breach that exposed 31,800 patient medical records, OCR claimed St. Joseph did not change the default settings on a new server, which allowed members of the public to access via search engines the personal health information of 31,800 patients for a full year. By failing to switch off its servers’ default setting, St. Joseph potentially violated the HIPAA Security Rule’s requirement to conduct a technical and nontechnical evaluation of any operational changes that might affect the security of ePHI.

In addition to paying $2.14 million, St. Joseph Health agreed to implement a corrective action plan that requires it to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures. St. Joseph had conducted an enterprise-wide risk analysis in 2010, but the OCR deemed that to be inadequate because the analysis did not include an evaluation of the technical specifications of St. Joseph’s servers. Continue reading →

October 10, 2016

Office of the National Coordinator for Health Information Technology Issues Formal Guidance for Selecting and Negotiating Contracts with Electronic Health Record Vendors

by Teresa Locke, Holland & Hart LLP

On September 26, 2016, the U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health Information Technology (ONC) released a practical and straightforward tool to assist health care providers as they select and negotiate the acquisition of an electronic health record system (EHR). The document’s title accurately encapsulates the content of the 53-page guide: “EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.” The guide can be found at https://www.healthit.gov/sites/default/files/EHR_Contracts_Untangled.pdf. The new contract guide explains important concepts in EHR contracts and includes example contract language to help providers and health administrators in planning to acquire an EHR system and negotiating contract terms with vendors. Continue reading →

October 4, 2016

Check Your Business Associate Agreements: OCR Tags Health System for Outdated BAA

By Kim Stanger, Holland & Hart LLP

The Office for Civil Rights (“OCR”) continues to emphasize the need for covered entities and business associates to have compliant business associate agreements (“BAAs”). Last week, the OCR announced a $400,000 settlement with a hospital system for failing to update its BAAs to include terms required by the 2013 HIPAA Omnibus Rule. In a press release, OCR Director Jocelyn Samuels stated,

This case illustrates the vital importance of reviewing and updating, as necessary, business associate agreements, especially in light of required revisions under the Omnibus Final Rule …. The Omnibus Final Rule outlined necessary changes to established business associate agreements and new requirements which include provisions for reporting.”

See Press Release here. Earlier this year, the OCR entered settlement agreements of $1,550,000 and $750,000 based on the covered entity’s failure to execute BAAs where the business associate had experienced a data breach. See reported settlements at https://www.hhs.gov/hipaa/newsroom/index.html. The lesson is clear: covered entities must have BAAs, and those BAAs must contain the required terms; failure to do so may subject the covered entity to liability for the business associate’s breach. Continue reading →

September 13, 2016

Idaho Board of Medicine Disavows the Corporate Practice of Medicine Doctrine

By Kim Stanger, Holland & Hart LLP

For decades, the Idaho Board of Medicine took the position that, with limited exceptions, the Idaho Medical Practice Act “prohibits unlicensed corporations and entities from hiring physicians as employees to provide medical services to patients.” Memo from J. Uranga to Idaho State Bd. of Medicine dated 2/26/07. This “corporate practice of medicine doctrine” had its Idaho foundation in a 1952 Idaho Supreme Court case which held that:

[n]o unlicensed person or entity may engage in the practice of the medical profession though licensed employees; nor may a licensed physician practice as an employee of an unlicensed person or entity. Such practices are contrary to public policy.

Worlton v. Davis, 73 Idaho 217, 221 (1952). The Board of Medicine warned that violations of the doctrine may result in disciplinary action against physicians and, more recently, physician assistants. Entities that improperly employed physicians or physician assistants risked the possibility of criminal action for the unauthorized practice of medicine.

Over the years, the corporate practice of medicine doctrine has been criticized as anachronistic and inconsistent with recent legislative action. See, e.g., M. Gustavson and N. Taylor, At Death’s Door—Idaho’s Corporate Practice of Medicine Doctrine, 47 Idaho L. Rev. 480 (2011). Continue reading →

July 6, 2016

Providers Must Post New Nondiscrimination Notices

By Kim Stanger, Holland & Hart LLP

Under the new ACA Nondiscrimination Rules, covered entities (including most healthcare providers) must post and publish new mandatory nondiscrimination statements and taglines by October 16, 2016.

1. Notice of Nondiscrimination + Taglines: Facility, Website, and Significant Publications. The new mandatory “Notice of Nondiscrimination” must inform persons that:

  1. the covered entity does not discriminate on the basis of race, color, national origin, sex, age, or disability in its health programs and activities;
  2. the covered entity provides appropriate auxiliary aids and services, including qualified interpreters for individuals with disabilities and information in alternate formats, free of charge and in a timely manner, when such aids and services are necessary to ensure an equal opportunity to participate to individuals with disabilities;
  3. the covered entity provides language assistance services, including translated documents and oral interpretation, free of charge and in a timely manner, when such services are necessary to provide meaningful access to individuals with limited English proficiency;
  4. how to obtain the aids and services described above;
  5. if the covered entity has fifteen or more employees, identification of, and contact information for, the employee responsible for coordinating the covered entity’s compliance as required by the regulations;
  6. if the covered entity has fifteen or more employees, the availability of the grievance procedure required by the regulations and how to file a grievance; and
  7. how to file a discrimination complaint with the Office for Civil Rights (“OCR”).

(45 C.F.R. § 92.8(a) and (b)(1)). HHS has published a sample Notice of Nondiscrimination, which is available here. Although HHS encourages entities to post the Notice of Nondiscrimination in languages other than English, covered entities are not required to do so. Continue reading →

June 14, 2016

New ACA Anti-Discrimination Rules: Language Assistance for Non-English Speakers

By Kim Stanger, Holland & Hart LLP

On May 18, 2016, HHS published its final rules implementing the anti-discrimination provisions of the Affordable Care Act § 1557. This is the first of several alerts discussing aspects of the new rule: this alert focuses on those provisions requiring language assistance for persons with limited English proficiency; future alerts will cover rules related to sex discrimination and persons with disabilities. The new language assistance rules build on but extend beyond HHS’s 2003 Guidance Regarding Limited English Proficient Persons, 68 F.R. 47311 (“LEP Guidance”).

Application. The new rules apply to any entities (“covered entities”) that operate a health program or activity that receives federal financial assistance under programs operated by HHS, including but not limited to Medicaid or Medicare parts A, C and D, but excluding Medicare Part B. (45 C.F.R. § 92.2(a); 81 F.R. 31383). Among others, the rule applies to hospitals, clinics, medical practices, solo practitioners, nursing homes, or other healthcare entities that participate in federal programs other than Medicare Part B. (81 F.R. 31384-85). Covered entities are not required to comply if doing so would violate applicable federal statutory protections for religious freedom and conscience. (45 C.F.R. § 92.2(b)). Also, the regulations do not apply to employment discrimination. (45 C.F.R. § 92.101(a)(2)). Continue reading →

June 9, 2016

New ACA Nondiscrimination Rules: Protecting Individuals Against Sex Discrimination

By Patricia Dean, Holland & Hart LLP

On May 18, 2016, HHS published its final rules implementing the anti-discrimination provisions of the Affordable Care Act § 1557. This is the third of three alerts discussing various aspects of the new rules. This alert focuses on the rules protecting individuals against discrimination based on sex. The first alert (available here) focused on the rules’ requirement for language assistance for persons with limited English proficiency. The second alert (available here) focused on the rules ensuring protections for individuals with disabilities. The final rule goes into effect on July 18, 2016.

Relationship to Other Laws. Section 1557 is the first federal civil rights law to prohibit discrimination “on the basis of sex” (including gender identity and sex stereotyping) in covered health programs and activities. In doing so, it builds on HHS Titles VII and IX, and federal case law to clarify what constitutes sex discrimination and prohibit specific discriminatory practices. It does not preempt or alter other laws, and providers must continue to comply with other state and federal laws in addition to the new ACA nondiscrimination rules. Continue reading →

June 6, 2016

New ACA Nondiscrimination Rules: Assistance for Persons with Disabilities

by Teresa Locke, Holland & Hart LLP

On May 18, 2016, HHS published its final rules implementing the anti-discrimination provisions of the Affordable Care Act § 1557. This is the second of three alerts discussing various aspects of the new rules. This alert focuses on the rules ensuring protections for individuals with disabilities. The first alert – published on May 26 – focused on the rules’ requirement for language assistance for persons with limited English proficiency. The third and final alert – to be issued in the near future – will cover rules related to sex discrimination.

Relationship to Other Laws. The final rules are consistent with existing directives implementing the requirements already existing under the Americans with Disabilities Act (“ADA”) and Section 504 of the Rehabilitation Act of 1973 (“Section 504). Nothing in the new rules should be interpreted to invalidate or limit the rights, remedies, procedures, or legal standards available to disabled persons under the ADA or Section 504. Accordingly, entities must ensure compliance with existing laws in addition to the new ACA rules, including state laws that may be more restrictive than the ACA regulations. Continue reading →