Topics for Today HIPAA and COVID-19

© Copyright 2019-2020, Page, Wolfberg & Wirth, LLCLicensed for Use by Registered Conference Attendees Only. Duplication by Any Means Prohibited.

pwwmedia.com ■AmbulanceCompliance.com ■ pwwemslaw.com ■ abc360conference.com

Advanced Administrator of Record Course – 2020

Steve Wirth, Esq., [email protected]

Copyright 2020, Page, Wolfberg & Wirth, LLC. Don’t Steal Stuff From Lawyers. It’s Not Polite.

THIS IS NOT LEGAL ADVICE

This information is presented for educational and general information purposes and should not be relied upon as

legal advice or definitive statements of the law. No attorney-client relationship is formed by the use of these materials or the participation in this seminar. The user of these materials bears the responsibility for compliance

with all applicable laws and regulations.

Topics for TodayPatient Privacy and HIPAA Hot Topics with

COVID-19Compliance UpdateDocumentation Issues in a COVID World Workplace and “People Issues”

HIPAA and COVID-19

OCR General Guidance on COVID-19

HIPAA Strikes a Balance

1 2

3 4

5 6



Can Disclose COVID-19 Information for Treatment

Other first responders • EMS, Fire, Police

Fellow staff members Receiving facilities

Can Report COVID-19 Patients to Public Health Authority

CDCState Health DepartmentCounty Health

DepartmentLocal Health Department

Prevent Serious & Imminent Threat

Very broad permissionIf you believe someone is, or

could be, in imminent danger because of COVID-19 exposure, you may anyone with ability to stop threat

Guidance About Sharing COVID-19 Information With First Responders

https://www.pwwemslaw.com/sites/default/files/forms/pww-covid-19-ems-resources/ocr-guidance-providers-share-information-first-responders-about-individuals-exposed-covid-19.pdf

Disclosure Needed for Treatment

Facility may disclose PHI about an individual who has COVID-19 to personnel who will provide treatment while transporting the individual

Note About Ryan White Act

Applies to COVID-19 Hospitals required to notify the EMS agency

designated infection control officer• Officer would need to determine whether an

exposure to EMS agency personnel actually occurred

7 8

9 10

11 12



To Prevent Serious Threat

Facilities may disclose PHI about individuals who have tested positive for COVID-19 to first responders when the believe in good faith that the disclosure is necessary to prevent or minimize the threat of imminent exposure to such personnel

Sharing a List of Names With Dispatch Centers

Facilities may provide a list of names and addresses of all individuals it knows to have tested positive, or received treatment, for COVID-19 to dispatchOCR says: For use on a per-call basis…to inform

first responders

Cannot With Dispatch List…

Post the list publiclyDistribute the list

to EMS personnel

Dispatch Screening

OCR says 911 call centers may ask screening questions of all callers:• Temperature, cough or difficulty breathing

Dispatch centers may inform all first responders – EMS, fire and police of the name, address, and screening question results

PWW Tip Dispatch Communications

May use generic code to mean COVID that providers in dispatch area understand as meaning suspected or confirmed COVID-19

Other HIPAA Considerations

13 14

15 16

17 18



Disclosures to the Media or Others Not

Involved in the Care of the

Patient

Telehealth Penalty Waivers

During PHE• May Use: FaceTime, Facebook Messenger video

chat, Google Hangouts video, Zoom, or Skype• May NOT use: Facebook Live, Twitch, TikTok

Can use any device and patient’s phone

By The Way, OCR Says the Following Apps will Sign a BAA Skype for Business /

Microsoft TeamsUpdox VSee Zoom for HealthcareDoxy.me

Google G Suite Hangouts Meet

Cisco Webex Meetings / Webex Teams

Amazon ChimeGoToMeeting Spruce Health Care

Messenger

HIPAA Right of Access Initiative

OCR’s initiative to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged

AMA Releases Tips for ElectronicPatient Access

Patients Can View or Get a Copy of Their PHI

19 20

21 22

23 24



Patients Can’t Be Required to Use Your Online Portal

Must give right to receive copy by:• Mail• Fax• Email• Portable media

2. e-Access Should be Low or No Cost to Patient

• Flat fee $6.50 • Cost based fee• Labor • Supplies (e.g., CD or USB

drive) • Preparation

Remember $6.50 is NOT Maximum Amount for e-Copies

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee

Use a Patient Access Request Form

Patient Access Can’t Be Denied in MOST Cases

Can’t deny because:• Patient is suing• You don’t like their

reason• They don’t give a

reason• They didn’t pay!

Can deny because:• Privileged document• May endanger life or

safety

The Patient Can Ask for Unencrypted Email

Transmitting PHI in such a manner does not present unacceptable security risks to the systems of covered entities, even though there may be security risks to the PHI while in transit (such as where an individual has requested to receive her PHI by, and accepted the risks associated with, unencrypted e-mail).

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html

25 26

27 28

29 30



Requests From Third Parties Should Have Patient Authorization

Letter With Patient Signature HIPAA-Compliant Authorization

Patients Have the Right to Ask Record be Sent to Third Party

If requested by an individual, a covered entity must transmit an individual’s PHI directly to another person or entity designated by the individual. The individual’s request must be in writing, signed by the individual, and clearly identify the designated person or entity and where to send the PHI. See 45 CFR 164.524(c)(3)(ii). A covered entity may accept an electronic copy of a signed request (e.g., PDF or scanned image), an electronically executed request (e.g., via a secure web portal) that includes an electronic signature, or a faxed or mailed copy of a signed request.

https://www.hhs.gov/hipaa/for-professionals/faq/2036/can-an-individual-through-the-hipaa-right/index.html

Send a Copy to… Be Timely in Responding

Generally 30 days from requestOne-time 30-day extension if you let

patient knowAct as quickly as possiblee-requests should be fulfilled quickly

Remember Patient Representatives

Adult orAn Emancipated Minor

A person with legal authority to make health care decisions on behalf of the individualExamples: Health care power of attorneyCourt appointed legal guardianGeneral power of attorney or durable power of attorney that includes the power to make health care decisions

Unemancipated Minor

A parent, guardian, or other person acting in loco parentis with legal authority to make health care decisions on behalf of the minor child

Deceased A person with legal authority to act on behalf of the decedent or the estate (not restricted to persons with authority to make health care decisions)

All States in Blue Have Breach Laws

31 32

33 34

35 36



State Laws are Expanding

CA, VT and DC broadened definition of information coveredDC, VT added AG notificationMaine changed deadline to 30 days

2020 HIPAA Action Items

Know Your Exposure – How Many Records do You Have?

Average cost of per record $42910,000 transports/annually

for 10 years = $43 Million

What is our Ransomware Plan?

Can we conduct daily operations?What is our data

restoration plan?What if we go to

paper?

Address Unsupported Software

Windows 7 and olderWindows Server 2008 and

olderSQL 2008 and olderOlder versions of:

• MS Office, Acrobat, etc.

Asset Inventory

37 38

39 40

41 42



Audit Your Local Drives for PHI

Download foldersRecycle BinDesktopFolder redirection

doesn’t catch everything!

Audit Your System Users

Passwords set to never expireInactive accountsGeneric usernames

Check Your Encryption

LaptopsStorage media (USBs)TabletsPCsServersEmail

Risk Analysis

https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool

Key Recent HIPAA Enforcement Actions Enforcement is

Way Up!12 Settlements since last fallNearly $19 Million in finesCould be biggest year ever!

43 44

45 46

47 48



Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over

10.4 Million PeopleSeptember 25, 2020

Cyberattack affecting 10.4 millionNo enterprise-wide risk

analysis

This is Huge!

First ever ambulance HIPAA settlement 2-year corrective

action plan

What Happened?

Breach report to HHS/OCR stating they lost an unencrypted laptop off bumper of an ambulance containing PHI of 500 patients

Uh Oh!

From OCR The last thing patients

being wheeled into the back of an ambulanceshould have to worry about is the privacy and security of their medical information."

-OCR Director Roger Severino

Why Did The Report to HHS/OCR?

All “Breaches” must be reported to HHSBreaches of 500 or

more must be reported at same time you notify patients

49 50

51 52

53 54



So they Told the Truth, That’s Good Right?

Government still can and often willinvestigate after a reportWhen OCR asked

for basic policies and Risk Analysis, you better have them

The Ambulance Service’s Issues

No Risk Analysis Training lacked security awarenessLacked HIPAA security policies Did not encrypt all devices When OCR investigated, providers

said they were only trained at hire!

The Take Home

Ambulance is on the OCR’s HIPAA radarTrainingDO A RISK ANALYSIS!Encrypt your devices

Top Threats For EMS and Healthcare

Threat # 1: Email Phishing Attacks

55 56

57 58

59 60



Train Your Staff to…

Verify that they know the senderLook for spelling or grammatical errorsLook for emails that are too good to be true or

are requiring urgent actionHover over the link to see the URL destination

before clicking it

Before Opening a Questionable Email, Contact…

Other colleagues to find out whether they received the same e-mailThe IT security support team or similar point of

contactThe alleged sender

Use Multi-Factor Authentication

Tag External Emails Threat # 2: Ransomware

61 62

63 64

65 66



Here’s How Ransomware Typically Works

After data is encrypted, the ransomware directs the user to pay the ransom to the hacker (usually in a cryptocurrency, such as Bitcoin) in order to receive a decryption key

Real World EMS ExampleA supervisor at ABC Ambulance visits a site that he

believes is for his bank. Instead, it is an infected website and when he clicks on the “login” link, a malicious program begins downloading onto his machine. He is able to shut down the browser to close out what he believes to be a bogus message popup. An hour later, the supervisor gets a message on his screen stating that all of his files are locked and instructs the user to pay a ransom to unlock or unencrypt the data.

Tell Staff if They are Hit … Immediately disconnect the machine - undock,

disable internet, disconnect from the network Do not power off or shut down the computer or

server, in case a volatile (RAM) memory image needs to be collected for forensics and incident response investigationsNotify IT immediately!

When Browsing

Secure website addresses should start with https://Look for low quality pictures, and spelling errorsBe wary of “FREE” downloads

When Browsing

Manually type the website addressCheck the address bar of the browser –

“www.google.com” not www.g00gle.com

Threat # 3: Loss or Theft of Devices

67 68

69 70

71 72



Real World EMS ExampleTwo providers are on scene and one provider

sits the tablet on a bench and forgets about the device. They load the patient and during the transport to the hospital, the provider realizes what happened. After dropping off the patient, they return to the scene but the tablet cannot be located.

Tell Staff Members…Upon discovery that something has been stolen

or misplaced, immediately contact a supervisor, even if you are going to locate the deviceIf necessary, supervisor should contact IT or

other individual who can take appropriate measures to safeguard the data saved on your device or equipment

Threat # 4: Insider Threats Real World EMS ScenarioOn several occasions, a biller at ABC Ambulance

decides to query the system for records of coworkers. When she finds reports relating to coworkers, she opens and views them. One day, when talking to a coworker, the biller mentions that an EMT they work with “Was recently transported due to a heart condition, and he’s only 32 years old! Must be all that smoking.” The coworker asks how she knows that and the biller says “I saw his trip report.”

Immediate Action StepsImmediately report all snooping

related activity to supervisorThen activity should be reported

to a security professional who can investigate

8 Tips for Cybersecurity

73 74

75 76

77 78



1. Make Sure Your BAs…

Have a documented risk analysisEncrypt PHI during transmission and at

restHave a current BAA in place with youProtect against and notify you about

cyberattacks (even one’s that aren’t breaches)

2. Update Your Software

Many updates address vulnerabilitiesMonitor for critical and urgent patches and

updates that require immediate attentionIf your vendor maintains an open

connection to the installed software (a “back door”) to provide updates and support, ensure a secure connection at the

3. Practice Good Operating System Maintenance

User accounts for former employees appropriately and timely disabledDevices “sanitized” before disposal or

reuseSoftware that is no longer needed fully

uninstalled (including trial software and old versions of current software)

4. Use Strong Firewalls and Monitor

5. Install and Maintain Anti-Virus Software

Symptoms of an infected computer include: • System will not start normally• System repeatedly crashes for no obvious reason

• Internet browser goes to unwanted web pages

• The user cannot control the mouse/pointer

6. Have and Test a Cybersecurity Plan

79 80

81 82

83 84



7. Maintain Good Backup Practices

Frequent backups Periodically test restorationsMaintain backups offline and unavailable

from networks• Malware can disrupt online backups

8. Encrypt EVERYTHING!

Documentation is an Age-Old

Challenge

Ethics in EMS Documentation

The first job of EMS practitioners is to provide effective patient careA PCR is a Patient Care Report

• Vital part of the patient’s medical records• Documentation is an integral part of patient care

If it isn’t documented, it didn’t happen

It Is Your Job! Documentation is an

essential job function of the EMT and Paramedic

Good documentation is not just important – it is an essential part of patient care!

Our Patients are Very Vulnerable!

85 86

87 88

89 90



Good Documentation Helps You, Your EMS Agency, and Your Patient!

EMS practitioners are entrusted with the care of vulnerable patients • Not only medically vulnerable, but financially vulnerable• A serious medical crisis can be devastating financially• Inadequate documentation can leave the patient financially

responsible to pay bills that insurance would have otherwise paid for medically necessary services

• This can exacerbate the suffering of the patient – and that is not good patient care!

Write every PCR as if it

could end up in court!

It’s Just YOU and

Your PCR!

Fundamental Principles of EMS Documentation

DOCUMENT COMPLETELY

DOCUMENT ACCURATELY

DOCUMENT TIMELY

Document Completely

Ensure all relevant information is capturedCapture operational, clinical and financial

documentationObtain necessary signatures

• Crew members• Patient or responsible party (if patient cannot sign)• Receiving facility representative

Document Accurately

Honesty in all aspects of documentationAccuracy in dosages and measurements No purposeful omission of relevant informationNo documentation of information that is not trueNo misrepresentations for the purposes of

reimbursement, liability or any other reasons

91 92

93 94

95 96



Document Timely

Comply with all state EMS requirements for timely completion of patient care reports• Example: Some states have specific timeframes

in which EMS agencies must submit completed PCRs to emergency departments/receiving facilities

Be Descriptive - A Good Narrative Should “Paint a Picture”

A clinical narrative should be a visual exercise – and pass the “visualization test” – others who read it should be able to

“see” the same patient you had on that call

Pain is the Number One Patient Complaint!

Improving Documentation of Pain Will Greatly

Improve Your PCRs

OPQRST

Onset – what was Pt doing when pain started? Was it gradual, sudden or chronic?

Provocation or palliation – what makes it better or worse?

Quality – how does the patient describe the pain?

Region and radiation – is it centrally located, or does it radiate?

Severity – pain scale (0 to 10)

Time – when did the pain begin? Is it constant or at intermittent intervals?

“Pt reports chest pain which began at approximately 0545 today. Pt was laying in bed when pain began and was not physically active at the time. Pt states that pain is not affected by movement and there is no position that makes it better or worse. Pt describes the pain as “achy” and “hot”. Pt states the pain is located in the center of the chest, approximately 2” below left nipple and radiates into the neck. Pt rates pain as a 6 on 1-10 scale. Pt reports that pain was intermittent for the first hour then became constant.”

O P Q R S T

Data Fields vs. Clinical NarrativesePCR data drives

analysis and decision making

ePCR narratives persuade and tell the story

97 98

99 100

101 102



“Double Documentation”

Question:To what extent must the clinical narrative repeat information that is documented in the PCR data fields?

“Double Documentation”

Answer:• If the data field communicates a complete fact for

which no additional context is required, it need not be repeated in the narrative

• If the data field does not provide sufficient context, it must be included in the narrative

Data That Stands Alone

Data field: Data stands on its own and does not require additional context to be clearly understood

No need to repeat the vital sign data in the narrative• “At 1647, BP was 140/96, pulse

was 92 and respirations 24”

Putting Data into Context…

Data FieldPulse: 120 Respirations: 60Blood Pressure: 102/60SpO2: 84%

Narrative“Patient found sitting bolt upright on side of bed, gasping for air with rapid, shallow respirations at 60/min, pale and cyanotic around the lips with SpO2 of 84%”

103 104

105 106

107 108



Amendment or Addendum

EMS practitioners have a duty to ensure that their PCR is complete and accurate • Even if that record was not complete when initially created


PCRs may be amended to:• Add information that needs to be added• Correct information that was incorrect• Delete information that was erroneous


PCRs may never be amended to:• Falsify information• Misrepresent the patient’s condition• Cover up mistakes • Include something that isn’t true• Delete factual information


Only the lead caregiver who completed the original PCR should amend patient care informationMinor amendments to demographic

information may be made by others• Example: billing office changes “132 Main Street”

to “123 Main Street”


Time, date and author of all amendments should be noted• Likely automatically tracked by your ePCR

software• Unique logins are necessary so that the author

of the PCR and any amendments can be accurately identified

REMEMBER…Bad Documentation Will Hurt

You, Good Documentation Can Be Like A

“Shield of Protection”

109 110

111 112

113 114



115

DOCUMENTING MEDICALNECESSITY – COVID 19

116

Will Medicare (and other payors) pay for ambulance service solely because a patient is (or may be) COVID-19 infected?

QUESTION

117

No!• CMS has issued numerous waivers of

certain Medicare requirements during the pandemic

• CMS has not issued a waiver of any medical necessity requirements for ambulance services

ANSWER

118

Existing Medicare regulations state that ambulance services are medically necessary when “other means of transportation are contraindicated.”

HOWEVER …

119

• Means that if a patient cannot be safelytransported by other means, ambulance transport is considered medically necessary

• “Other means” include:

Car, taxi, Uber/Lyft/wheelchair van, shuttle, shared ride, etc.

“CONTRAINDICATED”

120

• Is it safe to transport a COVID-19 patient in a vehicle other than an ambulance?

Other vehicles not set up for infection control

Other vehicles may not have necessary equipment

Other vehicles may transport more than one patient

“SAFELY TRANSPORTED?”

115 116

117 118

119 120



121

EMS documentation must be detailed and accurate to make the case why a COVID-19 patient cannot be safely transported by other means

DOCUMENTATION: MAKING THE CASE

122

• “Patient being transported due to possible COVID-19”

Does not give any indication why an ambulance was needed

Many known or suspected COVID-19 patients may drive themselves to the hospital, or be taken there by a family member

EXAMPLE: NOT ENOUGH

123

“Patient confirmed COVID-19 positive on 3/30/20 via positive test result from county health dept.

Infectious disease protocols in place.

Crew in full PPE and isolation precautions being followed.

Patient currently complaining of SOB with SPO2 of 88%.

Patient has fever of 102.2o and experiencing dry cough.

Patient placed on O2 at 10 lpm via non-rebreather mask and transported to isolation section of ED.”

EXAMPLE: MORE DETAILED

124

TRANSPORT & PATIENTDISPOSITION

125

• Some COVID-19 patients will not be transported

• Document:

Assessment that supports treatment in place

Medical direction/standing protocols

Telehealth call between patient and specific provider

Telehealth technology used

Patient acknowledgement/refusal

DOCUMENTING TREAT-NO-TRANSPORT

126

En route to facility:

• Notify facility of patient’s known/suspected COVID-19 status and document that this information was communicated to the receiving facility

• CDC advises not to let family members accompany patient (document this as well)

TRANSPORT DOCUMENTATION ISSUES

121 122

123 124

125 126



127

• Emergency vs. Non-Emergency?

• Hospital or Alternative Destination?

• Minimum number of caregivers needed?

• Alert hospital and movement to screening area

• Description of patient condition en route to hospital

TRANSPORT CONSIDERATIONS

128

• Some low-acuity COVID-19 patients may be directed to other locations during the PHE

• Document:

Assessment that supports low acuity

Medical direction or standing protocols for alternate destination

Where the patient was taken - be specific Main hospital?

Screening tent in hospital parking lot?

Hospital ship?

DOCUMENTING ALTERNATE DESTINATIONS

129

Disposition of patient - Document patient handoff:

• Was handoff to provider(s) utilizing PPE? Describe.

• Was patient placed in isolated area or in general facility population?

• Was patient isolated from non-essential staff in facility?

DISPOSITION DOCUMENTATION ISSUES

127 128

129 130

131 132



133

One Option…

Thank YOU for All You Do!

133 134

135

Topics for Today HIPAA and COVID-19

Documents

Transcript of Topics for Today HIPAA and COVID-19