MEDICAL PRIVACY

The modern Hippocratic Oath states, “I will respect the privacy of my patients, for their problems are not disclosed to me that the world may know.

WHY strict privacy laws exist for healthcare????

• First, at the most basic level, medical information is related to the inner workings of one’s body or mind. One’s individual sense of self may be violated if others have unfettered access to this information.

• Second, most doctors believe that patients will be more open about their medical conditions if they have assurance that embarrassing medical facts will not be revealed.

• Third, medical privacy protections can protect employees from the risk of unequal treatment by employers

• HIPAA does not preempt stricter state privacy laws.

  1. California Confidentiality of Medical Information Act (CMIA), for example, expands health information privacy protection duties to providers of software, hardware and online services.

7.2 The Health Insurance Portability and Accountability Act of 1996

1. Protected Health Information (PHI)

   1. Any individually identifiable health information that:

      1. Is transmitted or maintained in any form or medium;

      2. Is held by a covered entity or its business associate;

      3. Identifies the individual or offers a reasonable basis for identification;

      4. Is created or received by a covered entity or an employer;

      5. Relates to a past, present or future physical or mental condition, provision of health care or payment for health care to that individual.

2. Electronic Protected Health Information (ePHI)

   1. any PHI that is transmitted or maintained in electronic media.

   2. This statutory link to electronic reimbursements helps clarify which healthcare information is covered under HIPAA.

   3. Entities covered:

      1. Healthcare Providers that conduct certain transactions in electronic form

      2. Health Plans (e.g. health insurers)

      3. Healthcare clearinghouses (e.g. third-party organizations that host, handle or prices medical information)

      4. HIPAA does not apply to all healthcare providers.

         1. Ex. Some doctors accept only cash and credit cards and do not bill insurance.

   4. NOT COVERED BY HIPAA Ex.

      1. Individuals reveal medical information in a wide variety of settings (conversations, online, etc.).

   5. Outside of HIPAA.

      1. Before the Health Information Technology for Economic and Clinical Health (HITECH) Act, business associates were not subject to HIPAA but became subject to privacy and security protections under the written contracts they signed with covered entities.

      2. Under HITECH, HIPAA privacy and security rules are codified and apply directly to business associates.

      3. Business Associates – may provide services such as claims processing, data analysis, utilization review and billing as well as legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, and/or financial services.

3. The HIPAA Privacy Rule (focus on this area, widely impactful)

   1. The Privacy Rule and the Fair Information Privacy Practices

      1. Privacy Notices – provide a detailed privacy notice at the date of first service delivery.

      2. Exceptions:

         1. A privacy notice does not have to be provided when the healthcare provider has an “indirect treatment relationship” with the patient

         2. In the case of medical emergencies.

      3. Authorization for uses and disclosures – authorizes the use and disclosure of PHI for essential health care purposes: treatment, payment and operations, for certain other established compliance purposes.

         1. Other uses or disclosures of PHI require opt-in authorization.

         2. Cannot require an individual to sign authorization in condition of receiving treatment.

      4. “Minimum Necessary” use or disclosure

         1. other than for treatment, covered entities must make reasonable efforts to limit the use and disclosure of PHI to accomplish the intended purpose.

      5. Access and Accountings of Disclosure – individuals have the right to access and copy their own PHI from a covered entity/business associate.

      6. Safeguard – implement administrative, physical and technical safeguards to protect the confidentiality and integrity of all PHI.

      7. Accountability – to foster compliance, they are subject to a set of administrative requirements.

         1. They must designate a privacy official responsible for the development and implementation of privacy protections.

         2. Personnel must be trained

         3. Complaint procedures, along with other procedures, must be in place.

Note: People (Designated Official, employees) & Procedures

3. 1. 7. 4. Enforcement:

            1. The primary enforcer for the Privacy Rule in HHS is the Office of Civil Rights (OCR), who processes individual complaints and can assess civil monetary penalties of up to approximately 1.6 million per year per type of violation.

            2. DOJ with criminal enforcement authority.

      8. Limits on and Exceptions on the Privacy Rule

         1. De-identification – Privacy Rule does not apply to information that has been “de-identified” – information that does not actually identify an individual.

         2. Research - Research can occur with the consent of the individual, or without consent if an authorized entity such as an institutional review board approves the research as consistent with the Privacy Rule.

         3. Other Exceptions

            1. These include information used for public health activities

            2. To report victims of abuse, neglect, or domestic violence

            3. In judicial and administrative proceedings

            4. For certain law enforcement activities

            5. For certain specialized government functions.

4. The HIPAA Security Rule

   1. This establishes minimum security requirements for PHI that a covered entity receives, creates, maintains or transmits in electronic form. It requires them to implement “reasonable” security measures in a technology-neutral manner.

      1. Security Rule is comprised of “standards” and “implementation specifications,” which encompass administrative, technical and physical safeguards.

         1. Each Security Rule standard is a requirement.

         2. Covered entities and business associates must comply with all of the standards of the Security Rule with respect to the ePHI they create, receive, transmit, or maintain.

         3. Many of the standards contain implementation specifications.

            1. Some of the implementation specifications are required, while others are considered “addressable.”

            2. This means that the covered entity must assess whether it is an appropriate safeguard for the entity to adopt. If not, the covered entity must document why it is not reasonable and, if appropriate, adopt an alternative measure.

   2. The HIPAA Security Rule requires entities and business associates them to:

      1. Ensure confidentiality, integrity, and availability of all ePHI that they create, receive, maintain, or transmit.

      2. Protect against any reasonably anticipated threats or hazards to the security or integrity of the ePHI.

      3. Protect against any reasonably anticipated uses or disclosures or such information that are not permitted or required under the Privacy Rule

      4. Ensure compliance with the Security Rule by its Workforce.

   3. Technology: Requirements for implementation of security measures, implement based on the following:

      1. The size, complexity and capabilities of the covered entity

      2. The covered entity’s technical infrastructure, hardware and software security capabilities

      3. The costs of security measures

      4. The probability and criticality of potential risks to electronic protected health information.

      5. HIPAA Security Rule allows organizations to forego compliance with addressable implementation specifications when the entity has assessed that it is not an appropriate safeguard to adopt, and has documented why it is not reasonable, and any alternative measures adopted

   4. Organization Rule

      1. Designate Individual to run Security Program

      2. Risk Assessments

      3. Security and Awareness training program

7.3 The Health Information Technology for Economic and Clinical Health Act

1. Enacted (2009) to promote the adoption and meaningful use of health information technology (electronic health records).

2. It also strengthened HIPAA to address the privacy impacts of the expanded use of electronic health records.

3. Notice of Breach

   1. Language provides covered entities have the burden of proof that an impermissible use or disclosure did not constitute breach. If there is a high probability that the security or privacy of the information ( nancial, reputational or other) has been compromised, a covered entity must notify individuals.

   2. Must notify individuals within 60 days. If 500 are affected, must notify HHS. 500 or more in the same jurisdiction, must notify the media.

   3. They can avoid liability by using encryption software.

   4. Increase in Penalties – up to $1.5 million for the most willful violations and extends criminal liability to individuals who misuse PHI.

   5. Limited Data – to protect health information that excludes direct identifiers.

Limited Data Set - Refers to PHI that excludes 16 categories of direct identifiers and may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual's Authorization or a waiver or an alteration of Authorization for its use and disclosure, with a data use agreement.

A limited data set is described as health information that excludes certain, listed direct identifiers (see below) but that may include city; state; ZIP Code; elements of date; and other numbers, characteristics, or codes not listed as direct identifiers.

3. 6. Electronic Health Records (HER) – created important incentives for health providers but receiving funds.

7.4 Confidentiality of Substance Use Disorder Patient Records Rule (Title 42 of the Code of Federal Regulations (CFR)

Part 2: Confidentiality of Substance Use Disorder Patient Records (Part 2) was first promulgated in 1975 to address concerns about the potential use of Substance Use Disorder (SUD)

1. Scope

   1. The scope of the Rule covers the disclosure and use of “patient identifying information by treatment programs for alcohol and substance abuse.

   2. Applicability - The law applies to any program that receives federal funding.

   3. Law applies to any program that receives federal funding. The term program means any of the following:

      1. an individual or entity (other than a general medical facility) who holds itself out as providing, and provides substance abuse treatment.

      2. an identified unit within a general medical facility that holds itself out as providing, and provides,” alcohol or substance abuse diagnosis, treatment, or referral for treatment. (the substance abuse ward)

      3. Medical personnel or other staff in a general medical facility whose primary function is provision of” the alcohol or substance abuse diagnosis, treatment, or referral for treatment. Single therapist has this and other jobs

      4. Other entities may become subject to the regulation in either of the following ways:

         1. A state licensing agency requires them to comply

         2. The clinician uses controlled substances for detoxification, requiring licensing through the U.S. Drug Enforcement Administration (DEA). A DR prescribes methodone or other chemicals for detox.

   4. Disclosure – the program must obtain written patient consent before disclosing information subject to the Rule.

      1. Consent form may include a general designation that allows disclosure to either individuals or entities so long as those entities have a treating provide relationship with the patient.

         1. May allow disclosure to either individuals or entities that have a treating provider relationship with the patient

         2. Allow the consumer to receive a list of entities to whom their information has been disclosed

         3. Must explicitly describe the type of information being disclosed

      2. Upon request, patient receives a lists of entities to which his information has been disclosed.

      3. Consent form must explicitly describe the type of information that is to be disclosed related to alcohol or drug abuse treatment.

      4. Redisclosure – Redisclosing information obtained from a program is prohibited when that information would “identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment.”

      5. Exceptions – disclosure without consent:

         1. Emergencies

         2. Scientific Research

         3. Audits and Evaluations

         4. Communications with a qualified service organization (QSO) related to information needed by the organization to provide services to the program.

         5. Crimes on program premises or against program personnel

         6. Child Abuse Reporting

         7. Court Order

      6. Security of Records – must have formal policies and procedures in place to protect the security of this information. There are separate requirements for paper and electronic records.

         1. Violation is criminal. 1st offense - <$500

         2. Each subsequent is fined <$5000.

         3. These violations are reported to the US Attorney’s Office.

7.5 Genetic Information Nondiscrimination Act of 2008

1. Protects individuals from genetic discrimination in health insurance and employment. GINA amended a variety of existing pieces of legislation including:

   1. The Employee Retirement Income Security Act (ERISA),

   2. The Social Security Act

   3. The Civil Rights Act

2. Ammendments prohibit health plan providers from requesting genetic testing, except for requests for voluntary testing in connection with research.

   1. The modification to HIPAA, made in 2013, states that genetic information is considered to be health information; therefore, it cannot be used by health insurers to make any decisions about health insurance benefits, eligibility for benefits, or the calculation of premiums under a health plan

3. Statutory penalty is set at $100 each day of noncompliance for each plan participant or beneficiary

4. GINA also affects employers and the way they hire employees

5. Exceptions:

   1. Employee offered Wellness Program voluntary

   2. Research Exception

      1. GINA includes a "research exception" to the general prohibition against health insurers or group health plans requesting that an individual undergo a genetic test. This exception allows health insurers and group health plans engaged in research to request (but not require) that an individual undergo a genetic test.

      2. Compliance is voluntary

      3. Research will have no effect on enrollment or contributions

      4. No genetic information will be used for underwriting purposes

6. GINA itself does not provide for a private right of action, but depending on the violation private rights of action may be available under the federal laws that it revises as well as under similar state laws.

7. GINA mandates the creation of a commission to review the

8. developments in the science of genetics and make recommendations as to

9. whether to establish a “disparate impact cause of action” under GINA

7.5 The 21st Century Cures Act of 2016

1. Expedite research quicken the process for drug approval, and reform mental health treatment.

2. Privacy provision includes:

   1. Certain individual biomedical research information exempted from disclosure under FOIA

   2. Researchers permitted to remotely view PHI

   3. Information blocking prohibited but HIPAA’s protection of PHI remains

   4. Certificate of confidentiality for research

   5. Compassionate sharing of mental health or substance abuse information with family or caregivers

7.6 Conclusion