HEALTH LAW SUPPLEMENT Spring 2017

HIPAA under the Trump administration. There was renewed interest by clients in HIPAA last year due to enhanced audits and enforcement efforts. During 2016, the last year of the Obama administration, a permanent random audit program called “Phase 2” was launched and there was an unprecedented level of audits, enforcement actions and fines. Audits were undertaken of randomly chosen practices without regard to size of the practice or prior complaints. To compare, in 2014 the OCR (Office of Civil Rights that enforces HIPAA) collected $7.4 million in fines; in 2016 that amount increased to $23 million. The single largest fine was $5.5 million against Advocate Health Care System for the theft of five of its laptops, and misuse of PHI by its biller. The Trump administration has stated its intention to reduce the federal regulatory burden by eliminating unfair and unnecessary oversight, and fewer (or no) HIPAA audits except in response to complaints would seem to be consistent with that goal. But HIPAA fines are a way to raise funds, and given other of the Trump administration’s goals, e.g., cutting taxes, it may continue to aggressively pursue those monies.
HIPAA and cloud service providers (CSP’s). At the end of 2016, the Department of Health and Human Services (HHS) issued formal guidance regarding CSP’s, opining that they are not “conduits” (as telephone companies are) because they retain and do not just transmit PHI, and thus do not fall within any HIPAA safe harbor. Covered entities were advised to enter into Business Associate Agreements with their CSP’s.
HIPAA and confidentiality with caregivers. Under the recently passed “Compassionate Communications on HIPAA” provision of the federal “21st Century Cares Act,” the Secretary of HHS is required by December 13, 2017 to issue guidance to clarify situations in which HIPAA permits mental health care professionals to communicate with caregivers of adults with a serious mental illness to facilitate treatment, with and without the patient’s consent. “Serious mental illness” is defined as “a diagnosable mental, behavioral or emotional disorder that results in serious functional impairment and substantially interferes with or limits one or more major life activities.” Introduced by Representative Tim Murphy, an advocate for families of the mentally ill, the provision is intended to clarify HIPAA constraints for professionals so that they do not inappropriately deprive families of necessary information to assist in the treatment of the mentally ill. Representative Murphy’s stated objective is to “allow the mental health professional to provide the diagnosis, treatment plans, appointment scheduling, and prescription information to the family member and known caregiver for a patient with a serious mental illness. This change would apply for those who can benefit from care yet are unable to follow through on their own self-directed care.” (from the Helping Families in Mental Health Crisis Act of 2015). Even if HIPAA guidance relaxes confidentiality requirements under the federal regulation and allows certain unauthorized disclosures to the families of the mentally ill, New York State regulators, who strictly enforce State confidentiality laws and regulations, may not follow suit. Absent adjudicated incompetence or imminent danger, NYS requires that patients authorize disclosures to family members.
Social media defamation harder to prove in New York State. In 2 recent NYS cases, Jacobus v Trump 2017 NY Slip Op 27006 (Sup Ct, NY Cty, 01/09/2017) and Stolatis v Hernandez, 51 Misc 3d 1203 (Sup Ct, West. Cty 2016), the courts decided that reasonable readers of social media should know that statements of commentators that might appear to be factual (and therefore if proven false, provide the basis for a finding of defamation), were, given the context, “merely rhetorical hyperbole, and not statements of fact…” In the first case, Trump (the current president) tweeted that a Republican TV commentator was “a real dummy,” “really dumb,” “a major loser, zero credibility” who had “begged” him for a job; the court said that even if the tweeted statements might be demonstrably false, their context should have signaled readers that “Jacobus and Trump were engaged in a petty quarrel,” and that Trump’s comments were therefor “nonactionable opinion,” and not actual statements of fact. These cases seem to me to have implications for healthcare professionals considering taking legal action for defamation against social media commentators who impugn the reputations of the professionals; i.e., courts may give the commentators a wider latitude because of the medium used for the communication.
New law in New York City protecting independent contractors. Practices that retain 1099 independent contractors will shortly have another reason to beware (independent contractors are already a suspect class as far as the IRS and NYS Department of Labor, Unemployment Insurance and Workers Compensation are concerned). Beginning May 15, 2017 the Freelance Isn’t Free Act (FIFA) will take effect in NYC. It’s the first such law in the country. It requires that contractors work under a written contract and receive timely payment, and also that they be protected from retaliation for filing complaints or otherwise seeking to enforce their rights in the same manner as W-2 employees are protected.
Proposed NYS legislation requiring collection of school information. A352 and S2113 require that physicians obtain the name of the school attended by their school-aged patients and maintain that information in their medical records. If passed, the requirement may be extended to other health care professionals. The purpose of the law is to facilitate health care professionals’ communication with schools to warn of dangers posed to other students by reason of their patients’ physical or mental health conditions. The law is opposed by the Medical Society of the State of New York, not because it may herald the imposition of a new duty to report, which it may in my opinion, but rather because it imposes a new paperwork requirement.
Authorizations under 42 CFR Part 2 may be generic. The federal Substance Abuse and Mental Health Services Administration (SAMHSA) updated its rules in January so that patients and institutions are now explicitly allowed to use a general designation such as “all of my current and former treating providers” to indicate entities with which their PHI may be shared. Prior to the passage of this final rule, it was believed by many covered entities that authorizations to release patient information had to refer to specific parties by name to whom PHI was to be released. The rationale for the change is to allow patients to benefit more easily from integrated health care.

INFORMATION IN THIS NEWSLETTER IS NOT LEGAL ADVICE FOR ANY PARTICULAR CLIENT OR SITUATION. CONSULT WITH AN ATTORNEY INDIVIDUALLY FOR LEGAL ADVICE REGARDING THE SPECIFICS OF YOUR SITUATION.

Categories