So, you Disclosed Disease Management Participation to the Patient’s Secretary: Now What?

1. So, you Disclosed Disease Management Participation to the Patient’s Secretary: Now What? Rebekah N. Plowman 945 East Paces Ferry Rd. Atlanta, Georgia 404-923-9080

2. Secretary Knows About Participation • War Story • Patient contacts DMO expressing interest and requesting info at his office • Patient schedules telephonic assessment • Patient reschedules and limited assessment performed • Nurse sends educational information for next call • Nurse follows up at appointed time • Leaves message with Secretary • Name and number only • Talks with secretary two weeks later • Who informs nurse he will call back and let DMO know if he is interested

3. Or Does She? • Nurse Follows Up Two Months Later • New Secretary • Very diligent – she’s new • Very persistent – and apparently persuasive • Nurse Discloses DMO program name • Discloses nature of program and specific disease • Discloses program offered as part of his health plan

4. Could it get worse – or Murphy’s Law • Secretary reports alleged violation of HIPAA to DMO • Enters the Supervisor – • She is a nurse and she will carry out her duty to “care for the patient” - in this case the disease management nurse • Calls Secretary to Explain • Discloses facts upon which nurse thought secretary knew

5. HIPAA Privacy and Disease Management • Disease Management Dilemma • Provides the benefits inherent in controlling the high costs associated with chronic diseases and improving treatment outcomes by: • Identifying chronic disease population • Educating the patient on self-management • Collaborating with other health care providers • Measuring, evaluating and managing process and outcomes • Routinely report and provide feedback • Yet disclose PHI only to those authorized to know • When is an authorization required?

6. Treatment

7. Is it Treatment, HCO or Marketing? • Treatment • Focused on specific individual • Nurse consultation • Patient self-management coaching • Drug Compliance Reminders • Other activities that engage patient in direct health care improvement • And who sends the materials • Health care provider or • Health plan • Where does the nurse come in?

8. Health Care Operations

9. Is it Treatment, HCO or Marketing? • Can a Health Plan provide Treatment? • Unclear in the Rules • Individualized communications with patients are protected under treatment • If occur on behalf of provider and not plan • Providing educational materials may be either treatment or HCO • “It Depends” – Lawyer’s favorite response • Health plans provide HCO activity when they conduct population-based case management program

10. Is it Treatment, HCO or Marketing? • Health Care Operations • QA and improvement • Outcomes evaluation and clinical guideline development • Population-based activities • Relating to improving health or reducing costs • Protocol development • Case management and care coordination • Contacting providers/patients about treatment alternatives • No authorization required

11. Marketing

12. Is it Treatment, HCO or Marketing? • Marketing • Communication about a product or service • Purpose is to encourage recipients to purchase or use the product or service • Managing treatment/coordinating care or • Encourage purchase of product • Care coordination and case management • Not Marketing • Identify at-risk population or • Promote services • Requires authorization

13. At Home Communications

14. Use and Disclosure of PHI • Communicating with Patients • Includes at home, work or other • Includes phone, mail or other • Reasonable Safeguards • Minimal necessary • Begs the question • Need to Know • Who will have access? • Answering machines • Is there a restriction?

15. How Much is Too Much • Rules require reasonable safeguards • Message machines may include secretaries • Patients can request restrictions • Both on alternative means or locations for communications • Closed envelopes vs. postcards • P.O. box vs. home • Calls at office vs. home • Failure to comply • Can lead to severe sanctions

16. The Friends and Family Plan • Privacy Rules permits sharing PHI with • spouses, family members, friends or other persons identified by patient • Patient must agree • or at least not object • Recognizes circumstances may allow reasonable inference • Based on professional judgment • Best interests of patient

17. Incidental Uses and Disclosure • Occurs as a by-product of another permissible or required use or disclosure • Reasonable safeguards and minimum necessary standards must be met • Secondary use or disclosure cannot reasonably be prevented • Is limited in nature and occurs as a result of another permitted use or disclosure • Not permitted if a by-product of an underlying use or disclosure which violates the Privacy Rule

18. So was there a HIPAA violation? • 1st follow up call? • Leaves name and number only • 2nd follow up call? • Secretary informs nurse patient will call back and let her know if patient interested? • 3rd follow up call? • Informs secretary of DMO name and disease specific education information

19. Secretarial Communications

20. DMO Protections • Appoint Chief Privacy Officer • To whom you report potential violations • Avoid the Supervisor Add On • Establish Policies and Procedures • Clearly define minimally necessary • Assure safeguards on alternative communications/locations are in place • Provide Education – Frequently • Make sure nurses are included • Use examples and role play • Never Assume