Practical Tips and How to Avoid Pitfalls When Sharing Electronic Health Records Within a Health Care...
-
Upload
karley-burley -
Category
Documents
-
view
212 -
download
0
Transcript of Practical Tips and How to Avoid Pitfalls When Sharing Electronic Health Records Within a Health Care...
Practical Tips and How to Avoid Pitfalls When Sharing Electronic Health Records
Within a Health Care System
Sarah Coyne (Quarles & Brady LLP)Heather Fields (Reinhart Boerner Van Deuren SC)
HIPAA COW Fall ConferenceSeptember 21, 2007
Legal Barriers in Wisconsin• HIPAA • Stark / AKS• Wisconsin general records 146.82• Wisconsin hospital regulations• Wisconsin mental health act and regulations• Wisconsin pharmacy law (e.g. remote dispensing)• Electronic signature requirements• Mishmash of other WI laws• DQA (or is it OQA? Or BQA?) memos• CMS conditions of participation• Other CMS memos/ guidance (SOM)• 42 CFR Part 2• Accrediting agencies (e.g., Joint Commission)• Retention requirements• Potential for patient care/ privacy claims
Non-Legal Barriers
• $$$$• Social/ Organizational (resistance to
change)• Technological barriers• To scan or not to scan (managing
paper)• Who owns the record• What happens in the event of
dissolution/ disconnection
So Why Do It?
• Remember the original ONCHIT goals:– Inform clinical practice– Interconnect clinicians– Personalize care– Improve population health
Basic Components of EMR
• Computerized orders for prescriptions
• Computerized orders for diagnostic tests
• Reporting of test/ lab results
• Practitioner notes
The VA Model
• Veterans Health Information Systems and Technology Architecture (VistA)
• Graphical interface providers may review patient's VA record at any of the 1000+ VA facilities
• Limited somewhat in scope
Managing the Legal Barriers….
HIPAA
• Each entity within the health system may have its own privacy and security policies/ documentation
• Cross-walk them and decide which can be jointly managed in connection with the EMR
HIPAA : Pitfalls to Manage up Front
• Tracking stuff– Required documentation– Requested amendments– Restricted modes of communication– Accountable disclosures– Access to designated record set– Restricted disclosures– Patient authorizations
HIPAA: more pitfalls
• Business Associate management/ tracking
• User role-based access/ minimum necessary for that job description
• User identification
• Sanctions
• Coordination of multiple security or privacy officers
HIPAA: more pitfalls
• Joint training?
• Joint response to complaints – what if only one entity in the health system is the subject of a complaint – sharing liability
Wisconsin – 146.82 : Redisclosure
• The Issue – 146.82(2)(b)
• How it affects transfer of information among related entities
• DHFS may not directly monitor
• Solution – legislative?
146.82(2)(b)
• Except as provided in s. 610.70 (3) and (5), unless authorized by a court of record, the recipient of any information under par. (a) shall keep the information confidential and may not disclose identifying information about the patient whose patient health care records are released.
DHFS Letter
• Providers requested an opinion that:– Wis. Stat. 146.82(2)(b) does not apply to
patient records for continuity of care– Including in the EMR context
146.82(2)(b) cont.
• DHFS said:– Reasonable minds disagree about this– Cannot give that opinion– Identified by eHealth workgroup– Workgroup said: appropriate to seek statutory
change to ensure redisclosure is lawful– "Even for the purposes of further treatment"
146.82(2)(b)
• DQA staff has stated that "enforcement of 146.82(2)(b) is not part of their survey or review process."
• Suggests inclusion of consent to disclosure for continuity of care on patient authorization forms (but…that's not one of the options, technically).
Stark / AKS
• The exceptions and safe harbors establish the conditions under which:– Entities furnishing DHS (and certain other entities
under the safe harbor) may donate to physicians (and certain other recipients under the safe harbor) interoperable electronic health records software, information technology and training services.
– Hospitals and certain other entities may provide physicians (and certain other recipients under the safe harbor) with hardware, software, or information technology and training services necessary and used solely for electronic prescribing.
Wisconsin Hospital Regulations
• HFS 124 contains particular requirements for medical records – electronic or not
• Clinics not as closely regulated
• Shared records must meet the more stringent hospital requirements
Wisconsin Mental Health Act and Regulations – Pitfalls• Informed Consent Form 51.30(2)
– Designated recipient (DHFS: to IT dept.)– Designated purpose (DHFS: must specify to patients
in writing)– Particular information to be disclosed (DHFS: can't
just say "any and all treatment record information") – Expiration date (DHFS: OK to specify an expiration
date in the future, must be confined period of time)
• 92.03(1) Statement (DHFS: must occur, even with EMR)
Mental Health – Pitfalls
• Recent law changes allow at least sharing of medication list
• Contemplated revisions – 51.30 workgroup – how far should the sharing go?– Privacy vs. Patient Care
Wisconsin Ehealth Action Plan
• Patient Care
• Information Exchange
• Consumer Interests
• Financing
• Governance
Electronic Signature Requirements
• CMS CoP 482.24 (2006 revisions)
• Proposed HIPAA requirements for electronic standards
• Ch. 137
• June 27, 1997 DHFS memo re electronic signature in electronic recordkeeping
DQA (or is it OQA? or BQA?) Memos
• Authentication of orders
42 CFR Part 2
• Bottom line: even among related entities, can't easily include AODA records in joint EMR
• Consent needed for more disclosures
• Personal representative concept more stringent
• Redisclosure is prohibited – like WI – Accompanying statement required
Accrediting agencies (e.g. Joint Commission)
• If one of the related entities is not, and the other is not – EMR must comply with accreditation standards.
Retention Requirements
• Each entity must be responsible for maintaining its own records for the required periods of time
• Easier to keep records permanently in EMR environment
Potential for Patient Care/ Privacy Claims
• Key issue to be negotiated up front
• Agreement between separate legal entities– Insurance– Indemnification– Complaint management process – Joint
response
Non-Legal Barriers…..
$$$$
• Wisconsin funding sources
• Federal funding sources (ARHQ)
• Tax breaks
• Shared funding may be a tricky upfront negotiation, between related entities
Social/ Organizational (resistance to change)
• Clashing cultures
• Educating employees
• Patient awareness
• Trust
Technological Barriers
• Software
• Networking
• Programming/ IT support
"Legal" EMR
• Of one entity in the system but not another?
To Scan Or Not to Scan (Managing Paper)
• Will you ever need the paper?
• Costs/ administrative costs of scanning
• Some practitioners are wedded to paper
• "Psychotherapy notes"
Who Owns the Record
• Patients?
• Entities
• If shared – co-owners? (Address via agreement between legally separate entities)
What Happens in the Event of Dissolution/ Disconnection
• Address it in the agreement
Summary points
• Many of the issues in sharing between related entities are the same as those between unrelated entities
• May still need agreements
• Address thorny issues (liability, insurance, governance, financing, patient awareness, scanning, etc.) UP FRONT