Handling Electronic Medical Records for Trial Lawyers

1. Handling Electronic Medical Records for Trial Lawyers Sidney S. Welch, JD, MPH 404.815.6036 swelch@kilpatricktownsend.com www.kilpatricktownsend.com Presented to: National CLE Conference on January 11, 2014 Vail, Colorado

2. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)

3. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) • In 1996, Congress passed HIPAA, which among other things offers protection for “protected health information,” including electronic medical records. HIPAA requirements and security rules give patients more control over their health information, set limits on the use and release of their medical records, and establishes a series of privacy standards for health care providers which provides penalties for those who do not follow these standards.

4. HIPAA Provisions • HIPAA is made up of certain key sections and works in conjunction with state law to govern the use, disclosure, privacy and security of “protected health information” by “covered entities” and their respective “business associates” • Privacy Rule • Security Rule • Enforcement Rule • Breach Notification Rule

5. HIPAA Provisions • Privacy Rule • The HIPAA Privacy Rule provides federal protections for individually identifiable health information held by “covered entities” and their “business associates” and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of health information needed for patient care and other important purposes. The Privacy Rule is located at 45 CFR Part 160 and Subparts A and E of Part 164. • Security Rule • The Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities and their business associates to use to assure the confidentiality, integrity, and availability of electronic PHI.The Security Rule is located at 45 CFR Part 160and Subparts A and C of Part 164.

6. HIPAA Provisions • Enforcement Rule • The Enforcement Rule contains provisions relating to compliance and investigations, the imposition of civil money penalties for violations of the HIPAA Administrative Simplification Rules, and procedures for hearings.  The HIPAA Enforcement Rule is codified at 45 CFR Part 160, Subparts C, D, and E. • Breach Notification Rule • Interim final breach notification regulations, issued in August 2009, implement section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act by requiring HIPAA covered entities and their business associates to provide notification following a breach of unsecured PHI.  Similar breach notification provisions implemented and enforced by the Federal Trade Commission, apply to vendors of personal health records and their third party service providers, pursuant to section 13407 of the HITECH Act. (See, e.g., 45 C.F.R. 164.400)

7. Protected Health Information • Under the HIPAA Privacy Rule, protected health information (“PHI”) refers to individually identifiable health information.  Individually identifiable health information is that which can be linked to a particular person.  Specifically, this information can relate to: • The individual's past, present or future physical or mental health or condition, • The provision of health care to the individual, or, • The past, present, or future payment for the provision of health care to the individual. See • Common identifiers of health information include names, social security numbers, addresses, and birth dates. (See 45 C.F.R. 160.103; 45 C.F.R. 164.501)

8. Covered Entity • The term “covered entity” is defined as: • A health plan • A health care clearinghouse • A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter (See 45 C.F.R. 160.103)

9. “Business Associate” • The term “business associate” is defined as, with respect to a covered entity, a person who: • “On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits PHI for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or • Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of PHI from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person. • A covered entity may be a business associate of another covered entity.”

10. “Business Associate” • Business associates include: • A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to PHI to a covered entity and that requires access on a routine basis to such PHI. • A person that offers a personal health record to one or more individuals on behalf of a covered entity. • A subcontractor that creates, receives, maintains, or transmits PHI on behalf of the business associate. See 45 C.F.R. 160.103

11. The Health Information Technology for Economic and Clinical Health of 2009 (the “HITECH Act”) • The HITECH Act of 2009 expanded the scope of the privacy and security provisions of the HIPAA and its enabling regulations.  Some of the significant changes for health care providers include: • Applying privacy and security provisions and penalties to business associates  • Imposing new notification requirements in the event of a breach of PHI. • Creating stricter disclosure requirements, such as: Restricting the disclosure of PHI by a health care provider at   the request of a patient if it is for purposes other than treatment and the health care service or item has been paid out-of-pocket and in full (except as otherwise required by law); Limiting the disclosure of PHI to a limited data set or to the minimum necessary to accomplish the intended purpose; and Requiring health care providers to make available an accounting of certain disclosures of PHI that occurred over the past three years at the patient's request • Strengthening enforcement procedures and penalties

12. Final Omnibus Rule Implementing HITECH • January 25, 2013, the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services (“HHS”) published the long-awaited final rule, entitled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules” (Omnibus Rule), 78 Fed. Reg. 5566 (Jan. 25, 2013). • The Omnibus Rule: • Finalizes modifications to the Privacy, Security, and Enforcement Rules to implement the HITECH Act • Finalizes modifications to the Privacy Rule, proposed in July 2010, to increase the workability of the Privacy Rule; • Modifies the Breach Notification Rule, adopted by interim final rule in August 2009; and • Finalizes modifications to the Privacy Rule to implement the Genetic Information Nondiscrimination Act of 2008 (GINA), proposed in October 2009

13. Disclosures under HIPAA

14. Methods for Obtaining Patient Records Under HIPAA • There are various methods for obtaining patient records under HIPAA • Patient requests (subject to certain restrictions) • 45 C.F.R. 164.502(a)(i); 45 C.F.R. 164.524 • Disclosure upon “valid authorization” • 45 C.F.R. 164.502(a)(iv); 45 C.F.R. 164.508 • Subpoena, discovery order, court or administrative order • 45 C.F.R. 164.512(e)

15. Patient Requests

16. Patient Requests • HIPAA permits patients to request copies of their medical records (in either paper or electronic format). See 45 C.F.R. 164.502(a)(i); 45 C.F.R. 164.524 • “An individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for (i) Psychotherapy notes; (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and (iii) PHI maintained by a covered entity that is: (A) Subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. 263a, to the extent the provision of access to the individual would be prohibited by law; or (B) Exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a)(2). • The request must be made in writing and the requestor must be the patient, the patient’s parent, guardian or caregiver • Subject to state law which may impose stricter requirements, providers are required to keep HIPAA patient records for six (6) years • Providers must provide a patient with a copy of their medical records within 30 (and no later than 60) days of the patient’s request.

17. Cignet Health (Feb. 4, 2011); Civil Monetary Penalty of $4.3 Million • Failure to provide a patient with access to their medical records may lead to severe penalties, including civil monetary penalties. • See Cignet Health of Prince George’s County, Notice of Final Determination (February 4, 2011): OCR imposed a civil monetary penalty of $4,351,600 against Cignet Health d/b/a Uplift Medical, P.C., Cignet Health Center, Cignet Health Plan, and/or Cignet Healthcare (referred to collectively as “Cignet”) for failure to produce the medical records of 41 patients when requested by such patients between September 2008 and October 2009. The civil monetary penalties for these violations is $1.3 million. • During the investigations, Cignet refused to respond to OCR’s demands to produce the records. Additionally, Cignet failed to cooperate with OCR’s investigations of the complaints and produce the records in response to OCR’s subpoena. OCR filed a petition to enforce its subpoena in United States District Court and obtained a default judgment against Cignet on March 30, 2010. On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means. • OCR also found that Cignet failed to cooperate with OCR’s investigations on a continuing daily basis from March 17, 2009, to April 7, 2010, and that the failure to cooperate was due to Cignet’s willful neglect to comply with the Privacy Rule. Covered entities are required under law to cooperate with the Department’s investigations. The CMP for these violations is $3 million.

18. Disclosure in Response to a Subpoena or Court Order • The HIPAA Privacy Rule permits the disclosure of PHI for judicial and administrative proceedings by covered entities if certain conditions are met (See 45 C.F.R. 164.512(e)) • A covered entity may disclose PHI in the course of any judicial or administrative proceeding: (i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the PHI expressly authorized by such order; or (ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if: • (A) The covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the PHI that has been requested has been given notice of the request; or • (B) The covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets certain requirements.

19. Disclosure in Response to a Subpoena or Court Order • For purposes of paragraph (A) above, a covered entity receives “satisfactory assurances” from a party seeking PHI if the covered entity receives from such party a written statement and accompanying documentation demonstrating that: • (A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address); • (B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and • (C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and (1) No objections were filed; or (2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution. • For the purposes of paragraph (B) above, a covered entity receives “satisfactory assurances” from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that: • (A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or • (B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.

20. Disclosure in Response to a Subpoena or Court Order • A “qualified protective order” means an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: • (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and • (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding • Acovered entity may disclose PHI in response to lawful process without receiving satisfactory assurance if the covered entity makes reasonable efforts to provide notice to the individual or secures a qualified protective order

21. Recent Action where State Law Trumps HIPAA Disclosure • Although HIPAA permits disclosure in connection with a discovery request or court order, state laws may impose stricter restrictions • HIPAA is the “floor”

22. Turk v. Oiler, No. 09-CV-381 (N.D. Ohio Feb. 1, 2010). • Rejecting a defense based on compliance with HIPAA, a federal court in Ohio denied a medical clinic’s motion to dismiss invasion of privacy claims following the clinic’s disclosure of medical records to a grand jury: “As a general rule, an individual’s medical records are confidential. [… ] Under [HIPAA], a hospital’s release of medical records to law enforcement is permitted under certain circumstances. Indeed, HIPAA specifically authorizes a hospital to release a patient’s medical records in response to a grand jury subpoena. 45 C.F.R. §164.512(f)(1)(ii)(B). Ohio’s physician-patient privilege, however, codified in O.R.C. § 2317.02(B)(1), provides that a physician shall not testify as to “a communication made to the physician . . . by a patient in that relation or the physician’s . . . advice to a patient.” […] Ohio courts have found that O.R.C. § 2317.02(B) is more stringent than HIPAA, and therefore is not preempted, because it “prohibits use or disclosure of health information when such use or disclosure would be allowed under HIPAA.” Grove v. Northeast Ohio Nephrology Assocs., 844 10 N.E.2d 400, 406-07 (Ohio Ct. App. 2005) […] Thus, while HIPAA allows disclosure of protected health information in response to a grand jury subpoena, O.R.C. § 2317.02(B) permits disclosure only in certain limited circumstances.

23. Disclosure upon Valid Authorization • HIPAA permits the disclosure of medical records upon “valid authorization” (See 45 C.F.R. 164.502(a)(iv); 45 C.F.R. 164.508) • A valid authorization under this section must contain at least the following elements: • (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; • (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure; • (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure; • (iv) A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose; • (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure; • (vi) Signature of the individual and date

24. Disclosure upon Valid Authorization • In addition to the core elements, the authorization must contain statements adequate to place the individual on notice. • The authorization must be written in plain language. • If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization

25. Disclosure Without Authorization • HIPAA Privacy Rule permits disclosure without authorization in certain limited cases which must nonetheless comply with required laws (See 45 C.F.R. 164.512) • Instances involving victims of abuse, neglect or domestic violence (See 45 C.F.R. 164.512(c)): “A covered entity may disclose [PHI] about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence […]” • Certain law enforcement purposes (See 45 C.F.R. 164.512(f)), including the reporting of certain types of wounds or other physical injuries, for purposes of locating a suspect, fugitive, material witness or missing person, and where a person may be a victim to a crime

26. Specific Orders

27. Specific Orders • Qualified protective orders • 45 C.F.R. 164.512(e)(1)(ii), (v) • An order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: • (A) Prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested; and • (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

28. Specific Orders • Subpoenas and discovery requests not accompanied by a court or administrative tribunal order • 45 C.F.R. 164.512(e)(1)(ii) (A), (iii) • A covered entity may disclose PHI in response to a subpoena if it receives “satisfactory assurance” from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the PHI protected health information that has been requested has been given notice of the request

29. Specific Orders • “Satisfactory Assurance” • A covered entity receives “satisfactory assurance” if it receives from such party a written statement and accompanying documentation demonstrating that: (A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address); (B) The notice included sufficient information about the litigation or proceeding in which the PHI is requested to permit the individual to raise an objection to the court or administrative tribunal; and (C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and (1) No objections were filed; or (2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.

30. Specific Orders • Court or Administrative Tribunal Order • 45 C.F.R. 164.512(e)(1)(i) • A covered health care provider or health plan may disclose protected health information required by a court order, including the order of an administrative tribunal. However, the provider or plan may only disclose the information “expressly authorized by such order. • Due to the foregoing, it is necessary to be as specific as possible when drafting orders for medical records depending on the purpose

31. Other Laws Impacting Disclosure of Certain Types of Medical Records • Drug and Alcohol Treatment Records • Limits disclosure, redisclosure and use of drug and alcohol treatment records and requires a court order after showing good cause (See 45 U.S.C. 290dd-2(b)(2)(c)) • In assessing “good cause,” the court shall weight the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services • No records may be used to initiate or substantiate criminal charges against a person or to conduct any investigation of a patient • HIV/AIDS Information • HIPAA is silent on this issue but state laws apply

32. Other Laws Impacting Disclosure of Certain Types of Medical Records • Mental Health Records/ Psychotherapy Notes • Patient authorization is required prior to disclosure (See 45 C.F.R. 165.508(a)(2)) • Workers Compensation • Permits the disclosure of PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness (See 45 C.F.R. 164.512(l))

33. Patient Safety • In light of recent current events, the OCR has taken steps to publicly address the disclosure of necessary information to law enforcement agencies, family members of a patient, or others, if the patient’s safety is threatened or the patient is a threat to others • See, e.g. OCR, Message to our Nation’s Health Care Providers (January 15, 2013). Available at http://www.hhs.gov/ocr/office/lettertonationhcp.pdf

34. Remember • Familiarize yourself with state law requirements concerning patient records and use, disclosure or redisclosure of such records • HIPAA is the “floor” • Monitor business associate responses to subpoenas and other court orders and requests • Carefully draft orders to describe with sufficient specificity the patient records that are being requested and for what purpose

35. Questions?