Healthcare Law Blog

A New Reason to Protect Protected Health Information

Recently, an Indiana jury awarded a plaintiff $1.8 million in damages after a Walgreens pharmacist inappropriately used her position to find and share the plaintiff’s protected health information (“PHI”). [1] As health care providers know, the Health Insurance Portability and Accountability Act (“HIPAA”) provides both civil and criminal penalties for improper disclosure of medical information but it does not create a state-based private cause of action for violation of its provisions. Thus, when someone’s PHI is inappropriately shared or disclosed by a health care provider, the individual does not have personal legal recourse against the offending party. The recent Indiana case (herein “Walgreens Co.”) illustrates, however, that HIPAA still has a significant role in state court suits alleging negligence and professional liability as it relates to confidentiality.

Should Kentucky Physicians Follow California Physicians’ Lead In Challenging Medicaid Rates?

In recent years, Kentucky physicians have dealt with the state’s prescription drug abuse problem head-on – by adding substance disorder recovery services to their practices or establishing separate addiction recovery clinics. This trend has undoubtedly played a role in the 2013 decline of Kentucky deaths from overdoses of controlled substances – the first in many years. More >

A Win for Washington: Cutting ER Visits

In the summer of 2012, Washington state emergency rooms (“ER”) began tracking patients in a statewide database. Expanding Medicaid rolls and legislative attempts to cap reimbursements for non-emergency visits to ERs left the state, hospitals, and physicians knowing they had to do something to cut costs and improve quality of care within the ER setting. The product of their collaboration was the creation of seven “best practices,” known collectively as the “ER is for Emergencies” campaign. In addition to the mandatory, statewide database, the campaign urged health care providers to: More >

New Enrollment and Re-Validation Requirements for Providers/Suppliers for Participation in Medicare and Medicaid: Watch Your Mail! Part I

Even though the Centers for Medicare and Medicaid Services (“CMS”) published final regulations to implement provisions to the Affordable Care Act (“ACA”) on February 2, 2011, it is likely that many Kentucky health care providers, including physicians, are not aware of the importance of the new requirements for revalidation of Medicare and Medicaid enrollment or the new and more burdensome requirements for initial enrollment. The requirements are aimed at strengthening provider and supplier screening procedures to reduce fraud, waste, and abuse in federal health care programs. Because CMS contractors and KY Medicaid have been slow to comply with these new requirements, it is likely that many providers have not noticed the enrollment/screening changes unless they have been asked to revalidate or have applied for new or additional provider/supplier numbers. More >

A New HIPAA Security Risk Assessment Tool For Your Compliance Arsenal

On Friday, the U.S. Department of Health and Human Services (HHS) announced a new security risk assessment (“SRA”) tool for small and medium size healthcare providers. The downloadable tool (available for free here) is a self-contained, independent application that is available for Windows and iOS platforms. The SRA works by asking a series of in-depth questions about the provider’s activities and facilities. The “yes” or “no” answer format for each question reveals whether corrective action is needed in a particular area. Additional resources in the SRA help providers understand the risks associated with the use, disclosure and storage of protected health information. The SRA offers providers the opportunity to generate, update and document assessment materials and corrective action plans through the SRA; documentation is especially important for audit purposes. More >

Changes Halted on Medicare Prescription Drug Program

After receiving bipartisan opposition and heavy concern from patient groups and insurers, the Centers for Medicare and Medicaid Services (“CMS”) has declared that it will not be moving forward with draft regulations released in January which proposed several changes to the Medicare Part D program. More >

FTC: Don’t Limit APRNs Crucial Role in Health Care

The Federal Trade Commission (“FTC”) recently released a policy paper suggesting that state legislators should be cautious when evaluating legislative proposals to limit the scope of practice of Advance Practice Registered Nurses (“APRNs”). The FTC is concerned that by imposing more stringent physician supervision requirements, APRNS are effectively being restricted by another type of health care professional (the physician) thereby denying consumers the benefits of greater competition. This is especially troubling in light of the significant shortage of primary care practitioners in the U.S. By allowing APRNs to practice without heavier regulatory burdens, access to health care can be increased and possibly lead to “lower costs, better care, and more innovation,” according to the FTC. More >

Guidance on Minors’ Mental Health & the HIPAA Privacy Rule

On Tuesday, some aspects of the new guidance issued by HHS related to mental health and the HIPAA Privacy Rule were discussed. Today’s topic covers the guidance highlights as they relate to minors’ mental health. More >

Guidance on Mental Health & the HIPAA Privacy Rule

The U.S. Department of Health and Human Services recently issued guidance entitled, “HIPAA Privacy Rule and Sharing Information Related to Mental Health.” As the title implies, it offers information as to when it may be permissible under HIPAA for health care providers to share information related to a patient’s mental health, including instances when the patient may be a minor. The direction, issued in the form of Q&As, comes as HHS seeks to strike a balance between a patient’s privacy rights in mental health records and public safety concerns. The clarifications could not come at a better time, as the health care industry prepares for an influx of patients who now have insurance that includes mental health coverage.  Below are some of the highlights from the guidance: More >

Secure Text Messaging in a HIPAA World? Part II

Earlier this week, I referred to mobile applications such as TigerText and Doc Halo which are being touted as a method of “HIPAA-compliant” texting. These apps allegedly secure protected health information (PHI) sent via text message to ensure providers’ compliance with HIPAA privacy law. Covered entities must realize, however, that the use of these apps alone is not sufficient to pass a HIPAA audit. While HHS has not banned the texting of patient information, it has made clear that an organization should approve it only after “performing a risk analysis or implementing a third-party messaging solution that incorporates measures to establish a secure communication platform that will allow texting on approved mobile devices.” More >