HEALTH LAW SUPPLEMENT Summer 2016

HIPAA Phase 2 audits are coming, slowly at first. Pursuant to the HIPAA Omnibus Rule that was passed in 2013, beginning this year, 2016, the federal Office of Civil Rights (OCR) of the Department of Health and Human Servicese will begin its Phase 2 HIPAA audits. Unrelated to complaints, these audits of small and large covered entities have as their purpose the assessment of compliance with the HIPAA Privacy and Security Rules. The OCR audit protocol is to first screen to form a pool of potential auditees, from that pool select auditees and then through both desk and on-site audits, examine policies and procedures, documentation, training, business associate agreements and most importantly, comprising more than half of the audit, risk analysis and management. 200 actual audits after 800 screening surveys are expected in 2016, increasing annually.

In its Phase 1 audits, a pilot project of just a few audits that took place from 2013 to 2015, OCR commonly found deficiencies in these areas (most to least): risk analysis, lack of written policies, lack of staff training, lack of contingency planning, lack of internal auditing, lack of breach notification policies, and inadequate IT support. After Phase 2 audits the OCR will try to resolve any deficiencies through voluntary compliance, corrective action plans and resolution agreements, although fines are mandatorily imposed in the minimum amount of $10,000 if the covered entity has engaged in “willful” violations. As with other types of audits, the OCR plans to eventually outsource the audits and have them produce revenue. So increasingly, fines are expected even for lesser violations, such as when the covered entity did not know of a particular requirement and by exercising reasonable diligence would not have known ($100 minimum fine per violation), or when the covered entity violated the rules but with reasonable cause and not due to willful neglect ($1,000 minimum fine per violation.)

ACA Risk adjustment audits are already underway, and quite common. These audits, begun in 2016, are by commercial insurers, and are mandated by the Affordable Care Act (“Obamacare”) in order to equalize risk among insurers. The commercial insurers who conduct or authorize their agents to conduct the audits are those whose plans sell through the federal and state insurance exchanges. The immediate purpose of the audits is to assign a risk score to a certain patient based on a review of that patient’s treatment records from his or her different healthcare providers. The audits are not to determine medical necessity or to assess record-keeping, so will not result in a demand for reimbursement (clawback) or a prospective denial of benefits. Practitioners subject to the audits are contracted in-network providers.

Patient consent to provide records to the auditor is generally not required because (1) HIPAA allows disclosure without authorization for purposes of “payment and healthcare operations” which includes insurer audits and (2) New York State recognizes the principle of “implied consent” whereby if a patient authorizes a practitioner to bill his or her insurer, the patient also impliedly consents to the practitioner providing all treatment information to the insurer. Ethical practice probably requires that patients be informed of the auditor’s request and if they decline in writing, then that declination should be respected; the consequences of declinations to risk adjustment audits are as yet unknown, but conceivably could be a denial of benefits. Records to be sent cannot be de-identified as that would defeat the purpose of the audit, but “psychotherapy notes” per se should not be sent, and “psychotherapy note” material that may have been (unnecessarily) included in clinical records should probably, from an ethical and even legal (HIPAA’s minimum necessary disclosure) viewpoint, be redacted.

New York’s highest court gets closer to enunciating a Tarasoff-type duty to protect. In Davis v South Nassau Communities Hospital, 2015 WL 8789470, the Court of Appeals held that a healthcare provider owes a duty to warn patients that medications prescribed by the provider may impair the ability of the patient to drive a car, and that failure by the provider to fulfill that duty may result in liability of the provider to the third parties injured as a result. In the case, a patient treated at the hospital was administered drugs that impaired her ability to drive, was not warned by hospital staff not to drive after the medical procedure, did drive and was involved in an accident with a third party, who sued the hospital. The Court noted that in the past it had been reluctant to expand the duty of care “from physicians past their patients to members of the community individually.” The Court held that the duty of care should be assigned to the party that can most effectively meet the obligation. A limitation of the ruling is that in the case, the duty to protect arose as a direct result of the hospital and physician’s actual treatment (administration of medication), and not through the agency of the patient as it would in psychotherapeutic treatment.

New York’s ban on assisted suicide. In Myers et al v Schneiderman, 151162/15, NY Cty, 10/16/15, a New York Supreme Court upheld the constitutionality of a NY Penal Law {125.13(3)} that “a person is guilty of manslaughter (when he or she) intentionally … aids another person to commit suicide.” The plaintiffs were attempting to de-criminalize assisted suicide for mentally competent, terminally ill patients who request assistance by obtaining prescriptions of lethal drugs from physicians. The plaintiffs alleged that the ban is unconstitutional for lack of equal protection and denial of due process. The Court disagreed on the bases that there were no suspect classifications (such as race, gender etc) and no infringement of a fundamental right in the ban (no right to die by one’s own hand). The Court stated that the issue was one for the legislature to decide, not courts.

In fact, there is “aid in dying” legislation that has been introduced in the NYS legislature this year that would allow terminally ill competent patients to end their own lives by administering to themselves lethal drugs prescribed by a physician. S 5814-A, A 5261-C.

Possible required mental health training for teachers. Pending before the NYS legislature is a bill that would mandate that teachers in the State complete training every five years beginning July 1, 2016, in identifying signs and symptoms of mental illness, de-escalation of crises, and situations that warrant notification to school administrators. S 6234, A 9299. Lawmakers sponsoring the bill state that teachers are in a unique position to identify the 20% of students that have a mental health problem due to their frequent and personal contact. The Mental Health Association of NYS has endorsed the bill, but the teachers’ union, NYSUT, has not, and has noted that there are currently psychologists, social workers and nurses who have extensive mental health training.

INFORMATION IN THIS NEWSLETTER IS NOT LEGAL ADVICE FOR ANY PARTICULAR CLIENT OR SITUATION. CONSULT WITH AN ATTORNEY INDIVIDUALLY FOR LEGAL ADVICE REGARDING THE SPECIFICS OF YOUR SITUATION.

Categories