Regulatory Mandates

1. Regulatory Mandates What You Need To Know About HIPAA and EMTALA Cassandra Bradby, MD

2. Learning Objectives • Define HIPAA and EMTALA • Understand the importance of patient confidentiality and privacy • Describe the effect of EMTALA on the practice of Emergency Medicine • Apply HIPAA and EMTALA to different examples of issues that arise in the Emergency Department • Recognize the repercussions of violating HIPAA or EMTALA

3. HIPAA

4. HIPAA • Health Insurance Portability and Accountability Act of 1996 • National standards for the security of electronic protected health information (e-PHI), electronic exchange, and the privacy and security of health information

5. The Privacy Rule • Protects all “individually identifiable health information” health information, regardless of form (oral, electronic, or paper) • “Protected health information” or PHI • No restriction on deidentified health information

6. Individually Identifiable Health Information or PHI Includes the following: • The individual’s past, present or future physical or mental health or condition • The provision of health care to the individual • The past, present, or future payment for the provision of health care to the individual That may identify the individual or for which there is a reasonable basis to believe it can be used to identify the individual

7. The only times that emergency physicians may use and disclose personal health information without the patient’s written authorization are the following: • To the patient him or herself • Caregivers may use and disclose PHI for their own treatment, payment and healthcare operations activities (ex. Billing, education, insurance) • With the patient’s informal permission – ex. To family members at bedside • For any of the 12 “National Security Purposes”

8. 12 National Priority Purposes • When required by law • For public health activities • For reporting of abuse, neglect, or domestic violence • For health oversight activities • For judicial and administrative proceedings • For law enforcement purposes • For disclosures about deceased persons, to coroners, medical examiners and funeral directors • For organ, eye, and tissue donation purposes • For some types of research • To avert a serious threat to the health or safety of a person or the public • For specialized government functions, such as military missions or correctional activities • For Workmen’s Compensation Claims

9. The Security Rule Requires covered entities to maintain reasonable and appropriate administrative, technical and physical safeguards for protecting e-PHI

10. Why is this so hard in the ED? • ED Overcrowding • Hallway beds • Curtained rooms • Small spaces

11. What can you do? • Use privacy screens whenever possible • Keep a low voice when speaking to hallway patients or when in curtained rooms • Move patients to more private rooms for more sensitive exams when available • Ask patients if their family members or friends are allowed to be present during their exam or treatment at the beginning of the encounter

12. Penalties • A fine up to $50,000, as well as imprisonment up to 1 year • Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine with up to 5 years in prison • Intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm permit fines of up to $250,000 and imprisonment up to 10 years

13. EMTALA

14. EMTALA • Emergency Medical Treatment and Labor Act • Federal law enacted in 1986 • Requires anyone coming to an emergency department to be stabilized and treated regardless of ability to pay

15. EMTALA • ”Anti-dumping” law • Requirement of all Medicare-participating hospitals

16. Emergency Medical Condition “a condition manifesting itself by acute symptoms of sufficient severity (including severe pain) such that the absence of immediate medical attention could reasonably be expected to result in placing the individual's health [or the health of an unborn child] in serious jeopardy, serious impairment to bodily functions, or serious dysfunction of bodily organs."

17. 3 Main Requirements • Any individual who comes and requests must receive a medical screening examination to determine whether an emergency medical condition exists. • If an emergency medical condition exists, treatment must be provided until the emergency medical condition is resolved or stabilized. • Hospitals with specialized capabilities are obligated to accept transfers from hospitals who lack the capability to treat unstable emergency medical conditions.

18. Transfers • EMTALA does not apply to “stable” transfers • Unstable patients cannot be transferred unless: • A physician certifies the medical benefits expected from the transfer outweigh the risks OR • A patient makes a transfer request in writing after being informed of the hospital's obligations under EMTALA and the risks of transfer

19. Transfers • In addition, the transfer of unstable patients must be "appropriate" under the law, such that • (1) the transferring hospital must provide ongoing care within it capability until transfer to minimize transfer risks • (2) provide copies of medical records • (3) must confirm that the receiving facility has space and qualified personnel to treat the condition and has agreed to accept the transfer • (4) the transfer must be made with qualified personnel and appropriate medical equipment

20. Reporting • Anyone can report an EMTALA violation • Failing to report an EMTALA violation is also a violation • Ex. You receive an invalid transfer from another hospital and do not report this

21. Penalties for violating EMTALA • There is a 2-year statute of limitations for civil enforcement of any violation. Penalties may include: • Termination of hospital/physician Medicare provider agreement • Hospital fines up to $50,000 per violation ($25,000 for a hospital with fewer than 100 beds) • Physician fines $50,000 per violation, including on-call docs • The hospital may be sued for personal injury in civil court under a "private cause of action" • A receiving facility, having suffered financial loss as a result of another hospital's violation of EMTALA, can bring suit to recover damages

22. Applying the law

23. Case 1 You are evaluating a patient for a STEMI. The cardiologist is off-site and requests a picture of the EKG be sent to him via text message. What do you do? Does this violate any regulatory mandates?

24. Case 2 Your medical student goes to see patient and inquires about her current HIV status in front of her daughter. The daughter wasn’t aware of the patient’s HIV positive status. What do you do? What are you required to do?

25. Case 3 You have a patient with an open tib/fib fracture from an MVC. Your local orthopedic surgeon refuses to come in and see the patient despite your pleas. Is this legal? What do you do?

26. Case 4 You are scrolling on your Facebook timeline and you see a post from a colleague about a patient they had seen that evening in the ED. It specifically discusses the patient’s chief complaint of rectal foreign body and what was done for the complaint. It does not mention the patient’s name, age, or other identifying information. Is this legal? Should it be reported? What would you do?

27. Case 5 You are called for a transfer of a medically stable patient from an outside hospital that requires repair of a multi-layered complex facial laceration. Plastic surgery is not available at their current hospital. Your hospital does have this subspecialty service available on call, however your hospital is currently on diversion due to capacity issues. Do you accept the transfer? What do you say?

28. Case 6 A homicidal patient presents to your ED endorsing to you that he wants to kill his brother. Are you obligated to tell the brother? The police? Is this legal? What do you do?

29. References • Emergency Medical Treatment and Labor Act (EMTALA), Centers for Medicare and Medicaid Services, http://www.cms.gov/Regulations-and-Guidance/Legislation/EMTALA/index.html • EMTALA Fact Sheet. (2009). ACEP.org. [online] Available at: https://www.acep.org/life-as-a-physician/ethics--legal/emtala/emtala-fact-sheet/#sm.0001k7is7419ujduuu2gdoenk5g53 [Accessed 20 Jan. 2019] • HIPAA for Professionals. (2015). HHS.gov. [online] Available at: https://www.hhs.gov/hipaa/for-professionals/index.html [Accessed 30 Jan. 2019]. • HIPAA Summary. (2015). HHS.gov. [online] Available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/ [Accessed 30 Jan. 2019].