Presentation is loading. Please wait.

Presentation is loading. Please wait.

Legal & Regulatory Updates: HITECH and Technology; Closing a Practice; and Legislation re/Prevention of Violence ACA Institute for Leadership Training,

Similar presentations

Presentation on theme: "Legal & Regulatory Updates: HITECH and Technology; Closing a Practice; and Legislation re/Prevention of Violence ACA Institute for Leadership Training,"— Presentation transcript:

1 Legal & Regulatory Updates: HITECH and Technology; Closing a Practice; and Legislation re/Prevention of Violence ACA Institute for Leadership Training, July 23, 2014 The information presented, including handouts, is for educational purposes and is not intended to be legal advice. Attendees should seek advice from local counsel regarding specific legal issues. Anne Marie “Nancy” Wheeler, J.D. © Anne Marie “Nancy” Wheeler, J.D. 1


3 HIPAA/HITECH Rules Subtitle D, Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment Act of 2009, addresses privacy and security concerns re/ electronic transmission of health information and encourages use of health information technology Key provisions are also applicable to paper records and oral communication

4 Final “Omnibus” Rule including “Breach Notification” now in effect (officially released Jan. 25, 2013, effective March 26, 2013, with compliance date for C.E.s and B.A.s of Sept. 23, 2013 – teeth have really grown!) Applies to “covered entities” and “business associates” if protected health information is breached “Covered entity” determination: Administrative- Simplification/HIPAAGenInfo/AreYouaCoveredEntity.html Administrative- Simplification/HIPAAGenInfo/AreYouaCoveredEntity.html Business Associate: A person or organization that performs a function or activity on behalf of a covered entity, but is not part of the covered entity's workforce (x- ref. slide 9) © 2007 – 2014 Anne Marie “Nancy” Wheeler, JD

5 Breach “Breach” defined as the “improper acquisition, access, use or disclosure of protected health information” New presumption of breach under the above definition unless a risk assessment by C.E. or B.A. demonstrates a low probability that PHI has been compromised Prior threshold: significant risk of harm © Anne Marie “Nancy” Wheeler, J.D. 5

6 Breach Notification (cont’d) If approved encryption or destruction is utilized, notification is not required Risk assessment is required when breach occurs If breach has occurred, notice to affected individuals (e.g., clients) required; depending on size, breaches require notice or year-end report to HHS and notice to media achnotificationrule/index.html achnotificationrule/index.html May need to update workforce training, B.A. contracts, granting clients access to EHRs, etc. © 2007 – 2014 Anne Marie “Nancy” Wheeler, JD

7 Risk Assessment Four factors to consider in analyzing and deciding whether to notify individuals: 1) nature and extent of PHI, including types of identifiers and likelihood of re-identification (e.g., breach involving credit card numbers, SSNs and sensitive clinical information likely would call for notice); 2) who the unauthorized person was who used or received PHI; 3) whether PHI was actually acquired or viewed; and 4) extent to which risk has been mitigated. © Anne Marie “Nancy” Wheeler, J.D. 7

8 Breaches Examples of breaches possibly requiring notice: Laptop or smart phone with client records is lost/stolen (RM Service) Paper medical records dumped (MA example involving hospitals, pathologists, etc.) Problems for counselors are real! Do you use a laptop, cell phone, digital copier and/or flash drive with PHI? Do your supervisees use them? Wall of Shame: cationrule/breachtool.html cationrule/breachtool.html © Anne Marie “Nancy” Wheeler, J.D. 8

9 Business Associates Covered entity may be be civilly liable for business associates who act as CE’s agents (common law of agency applies) B.A. contracts may need some revision – required by Sept. 23, 2014 definition of business associates also now includes “subcontractors” who perform functions for, or provide services, to a B.A. (other than as a member of the business associate’s workforce) “conduit” exception (e.g., FedEx, USPS) © Anne Marie “Nancy” Wheeler, J.D. 9

10 Business Associates Business Associates now have direct liability (which they did not have under the original HIPAA rules) for: (1) impermissible uses and disclosures of PHI (2) failure to provide breach notification to the covered entity when unsecured PHI is lost or inappropriately accessed (3) failure to provide access to a copy of electronic PHI to either the covered entity, the individual, or the individual’s designee (whichever is specified in the business associate agreement) © 2007 – 2014 Anne Marie “Nancy” Wheeler, JD

11 Business Associates (4) failure to disclose PHI where required by the Centers for Medicare & Medicaid Services (CMS); and (5) failure to provide an accounting of disclosures of PHI Liability of B.A. does not mean counselor, as a C.E., will not be liable! © Anne Marie “Nancy” Wheeler, J.D. 11

12 Penalties HITECH Act updates civil and criminal penalties for C.E.s and B.A.s – fines up to $50,000 per violation, $250,000 for “willful neglect” and up to $1.5 million for repeated violations of a single provision of the law! Although criminal prosecution may not be likely, imprisonment can be for term of up to 10 years! Be aware of employees’ and supervisees’ actions © 2007 – 2014 Anne Marie “Nancy” Wheeler, JD

13 Penalties Four Penalty Tiers: Lowest tier: cases in which entity did not and reasonably could not know of the breach; Intermediate tier: cases in which entity knew, or by exercising reasonable diligence, would have known of violation, but did not act with willful neglect; and Highest tier: cases in which the entity “acted with willful neglect” and either corrected the problem within the 30- day cure period, or failed to make a timely correction Under the new rules, a covered entity’s or business associate’s lack of actual or constructive knowledge is no longer a complete affirmative defense © Anne Marie “Nancy” Wheeler, J.D. 13

14 Penalties Willful neglect will lead to compliance review by U.S. Dep’t. of Health and Human Services; other behavior may lead to review HITECH authorizes State Attorneys General to bring civil actions on behalf of state residents for HIPAA violations. They may obtain damages or injunctions and attorneys’ fees may be awarded. Additionally, many states (e.g., TX and CA) have enacted their own privacy breach laws which may or may not encompass breaches of PHI. © Anne Marie “Nancy” Wheeler, J.D. 14

15 Miscellaneous HITECH Updates Clients have right to obtain access in electronic form (if EHRs are used) GINA: Genetic information is now considered protected health information (PHI). Additionally, under the HIPAA Omnibus Rule, which adopts GINA’s definition of “genetic information,” it is now clear that most health plans are prohibited from using or disclosing genetic information for underwriting purposes. When individuals pay by cash, they can instruct their provider NOT to share Tx information with their health plan © Anne Marie “Nancy” Wheeler, J.D. 15

16 HITECH Counselor educators/supervisors: think about how clinical audio/video recordings are protected Encryption? Storage? Transmission? © Anne Marie “Nancy” Wheeler, J.D. 16

17 Notice of Privacy Practices: Updated? If you or your supervisors are CEs, do you have an updated Notice of Privacy Practices? Remember to compare state law (e.g. – access). Many counselors who are “covered entities” have HIPAA Notice of Privacy Practice but no policies and procedures for privacy and security! © Anne Marie “Nancy” Wheeler, J.D. 17

18 Private Practice Preparedness: Is This What You Want for Your Future? © Anne Marie “Nancy” Wheeler, J.D. 18

19 Overview Action plan and calendar Sudden death or disability Assessing readiness for retirement or closing practice when counselor is able Critical information for records custodian/personal representative Notice, records, administrative and legal details and resources © Anne Marie “Nancy” Wheeler, J.D. 19

20 Dealing with Sudden Death, Disability or Incapacity Problems stem from lack of planning Spouse, significant other, or colleague is left with no instructions Psychiatrist examples Vulnerable clients/patients are left with grief and confusion and often without continuity of care Potential liability for yourself and your estate © Anne Marie “Nancy” Wheeler, J.D. 20

21 Dealing with Sudden Death, Disability or Incapacity Plan for sudden death, disability or incapacity is important, especially for solo practitioners “Records Custodian” or “Special Administrator” – consider naming person(s) in will, with consent records access, forwarding and retention; notice and referral issues ACA Code of Ethics Covering Provider(s) ERT and “Bridge Therapist” (A. Steiner) Counselor or other similarly licensed therapist Professional Will (Loretta Bradley) © Anne Marie “Nancy” Wheeler, J.D. 21

22 Dealing with Sudden Death, Disability or Incapacity Clause for inclusion in informed consent document Advise clients who will cover practice If not feasible to provide names, explain how procedure and notice will be accomplished Written plan re/ steps for custodian and administrator to take Critical information for records custodian, ERT and personal representative: ACA Podcast: © Anne Marie “Nancy” Wheeler, J.D. 22

23 Retirement on Your Terms © Anne Marie “Nancy” Wheeler, J.D. 23

24 Issues Pertinent to Emergency or Planned Retirement: Notice Employees (if applicable) Clients – 3 months is usually recommended; consult state law on past clients (verbal & written) Records Custodian Licensure Board, Professional Associations Vendors, Utility companies Social Security Administration (SSA) (if death or disability) Colleagues © Anne Marie “Nancy” Wheeler, J.D. 24

25 Issues Pertinent to Emergency or Planned Retirement: Records Client access Release to third party/ another provider HIPAA, state law and ethics Storage HIPAA, state law and ethics Possible corruption of electronic media Consider efficacy of technology in 5 years © Anne Marie “Nancy” Wheeler, J.D. 25

26 Records Retention and Destruction State law and statutes of limitation Medicare/Medicaid false claims HIPAA documents: min. 6 years Electronic records: special concerns Keep list of records which have been destroyed, including client identities, dates of treatment and dates of destruction Business record retention: consult attorney/ accountant © Anne Marie “Nancy” Wheeler, J.D. 26

27 Insurance Professional Liability Insurance Premises or Renter’s Insurance, Life and Disability Insurance Health Insurance Other (Umbrella, etc.) © Anne Marie “Nancy” Wheeler, J.D. 27

28 Other Issues Administrative Sale of practice Legal Dissolution of Practice Personal Issues (advance directives, etc.) © Anne Marie “Nancy” Wheeler, J.D. 28

29 General Resources American Health Lawyers Association, A Guide to Legal Issues in Life-Limiting Conditions (2005). ACA Code of Ethics (2014) Caregiver Information: Eldercare Locator, available at Wheeler, A.M. and Bertram, B. (2012). The Counselor and the Law: A Guide to Legal and Ethical Practice (6 th ed.). Alexandria, VA: American Counseling Association. © Anne Marie “Nancy” Wheeler, J.D. 29

30 Violence Prediction, Prevention and Liability Duty to Warn and/or Protect Case law and statutes (latter often provides immunity to mental health provider) Statute example (Maryland): pdf pdf Make sure your supervisees are familiar with state case law and statutes © Anne Marie “Nancy” Wheeler, J.D. 30

31 Statistics Mass shootings account for <1% of gun deaths Suicide accounts for 61% of gun fatalities in U.S. Majority of people with MI never act violently If MI were eliminated entirely as a risk factor in gun violence, the incidence of gun violence would only go down by 4%! © Anne Marie “Nancy” Wheeler, J.D. 31

32 Statistics (cont’d) Establishing national database on MI would only discourage people from Tx P. Appelbaum: risk of violence among MI with psychotic illnesses appears to be worse in early stages, often before they obtain Tx Media’s impact – e.g., “Watch our exclusive coverage of the massacre at XYZ HS tonight at 11” Above summarized from Joel Dvoskin, Ph.D., U Ariz. College of Medicine, in APA/ABA Joint Conference: Confronting Community and Family Violence (May 1-3, 2014) © Anne Marie “Nancy” Wheeler, J.D. 32

33 Counselor Leaders: Be aware of emerging legislation Impact of gun laws on the mentally ill? School safety? Specific interactive map to keep track of legislation in your state: laws-2014-developments/ laws-2014-developments/ © Anne Marie “Nancy” Wheeler, J.D. 33

34 Gun Legislation A study on firearm storage counseling by family physicians found that 64% of participants who rec’d verbal firearms storage counseling improved their gun safety However, FL Stat. § prohibited physicians from documenting gun ownership in record; mandated that physicians refrain from asking questions about gun ownership (unless imminent threat to self/others); and prohibited discrimination and harassment of pt. during exam (teeth: discip. Action including revocation or suspension and fines up to $10,000 per offense) © Anne Marie “Nancy” Wheeler, J.D. 34

35 Gun Legislation and Case Law Wollschlaeger v. Farmer: Federal District Court granted injunction on basis of First Amendmenet and interference with doctor-patient; on appeal to 11 th Circuit Court of Appeals Not advocating a particular stance but that counselors be aware of growing gun legislation and possible effect on mentally ill population Presidential Executive Action to close loopholes Need to balance safety (including school safety) with rights of MI and possible deterrence if they’re reported to state or federal database © Anne Marie “Nancy” Wheeler, J.D. 35

36 CEU & Insurance Discount CE credit and a 10% discount on ACA-sponsored professional liability insurance is available by reading Wheeler and Bertram’s The Counselor and the Law (6 th Ed.), and passing a test. For more information and registration Successful completion of the exam entitles you to a 10% discount on your ACA-sponsored professional liability insurance renewal for 3 consecutive years. The 10% discount is available for individual policies only and is subject to a $100 minimum premium. © 2007 – 2014 Anne Marie “Nancy” Wheeler, JD

Download ppt "Legal & Regulatory Updates: HITECH and Technology; Closing a Practice; and Legislation re/Prevention of Violence ACA Institute for Leadership Training,"

Similar presentations

Ads by Google