OCR Update on Issuance of HIPAA HITECH Rulemaking

Update from Office for Civil Rights (OCR) on issuance of the Notice of Proposed Rulemaking (NPRM) implementing changes to HIPAA under the Health Information Technology for Economic and Clinical Health Act (HITECH). Health care organizations and health lawyers have been anxiously awaiting rules implementing and interpreting the changes because the effective date for many of the HITECH requirements was February 17, 2010. Of particular interest has been whether or not health care organizations are required to amend business associate agreement.

The notice seems to indicate that the the date for compliance and enforcement may be delayed since it states that the NPRM "will provide specific information regarding the expected date of compliance and enforcement." However, covered entities and business associates need to weigh the risks of not complying with the new requirements while waiting for further clarification from OCR.

The notice states:

OCR will implement important privacy and security provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act through notice and comment rulemaking, as required by the Administrative Procedure Act. These provisions include: business associate liability; new limitations on the sale of protected health information, marketing, and fundraising communications; and stronger individual rights to access electronic medical records and restrict the disclosure of certain information. OCR continues work on a Notice of Proposed Rulemaking (NPRM) regarding these provisions. Although the effective date (February 17, 2010) for many of these HITECH Act provisions has passed, the NPRM and the final rule that follows will provide specific information regarding the expected date of compliance and enforcement of these new requirements.

However, interim final rules implementing HITECH Act provisions in two areas have already been issued and are currently in effect: enforcement and breach notification. New civil money penalty amounts apply to HIPAA Privacy and Security Rule violations occurring after February 17, 2009. Covered entities and business associates must comply now with breach notification obligations for breaches that are discovered on or after September 23, 2009. OCR announced previously that it would use its enforcement discretion not to impose fiscal sanctions with regard to breaches discovered before February 22, 2010. Since that date has passed, OCR will enforce the Breach Notification Interim Final Rule, including with the possible imposition of sanctions, as it does with the HIPAA Privacy and Security Rule requirements.

West Virginia State Bar Issues Advisory Opinion 10-001 Clarifying Rule 8 Pro Hac Vice Admission

Today the West Virginia State Bar announced that the West Virginia State Bar's Unlawful Practice of Law Committee has released Advisory Opinion 10-001, relating to questions from attorneys regarding its interpretation of Rule 8 of the West Virginia Rules of Admission to the Practice of Law, relating to admissions pro hac vice.

Advisory Opinion 10-001 addresses the following issues:

1. Whether the requirement in Rule 8 of of admission pro hac vice extends to matters in which no action, suit or proceeding is pending;

2. To what extent is the responsible local attorney required to participate in proceedings involving the attorney admitted pro hac vice;

3. Whether presiding judicial officers can "excuse" local counsel form participation or "waive" the requirement of participating; and

4. What limitations exist for attorneys seeking to be admitted pro hac vice, particularly their ability to be admitted on a frequent basis, or in multiple or consolidated actions.

AHLA Connections: Legal Implications of Health Care Social Media

The current issue of the American Health Lawyers Association's Connections magazine features an article I co-authored with fellow AHLA health lawyer, Jody Joiner, on the impact of social media use in health care.

The article, Risky Business: Treating Tweeting the Symptoms of Social Media (PDF version), is featured in the March 2010 issue of AHLA Connections (Vol.14, No. 3, March 2010), a health lawyer magazine for the health and life sciences law community.

We provide background context on the use of social media tools by health care providers, address why we think health lawyers need to understand social media, and explore some of the legal implications as social media and the law intersect. The article ends with practical guidance to health care providers and organizations on implementing policies emphasizing the appropriate use of social media.

You can peruse the complete digital edition of the March 2010 AHLA Connections (Vol. 14, No. 3, March 2010). AHLA members should also check out the article in this issue on the recently launch Health Law Wiki. Great to see AHLA adding a wiki resource for members to share their expertise and experience in the complex and ever changing health care legal and regulatory world.

Special thanks to the AHLA Connections staff for allowing Jody and I the opportunity to write the article and for their great editorial assistance.

Lesson for Hospitals and Health Care Providers: Photos of Shark Bite Victim

Martin Memorial too mum: Hospital staff violated privacy of shark victim, an article from the Palm Beach Post. The article highlights the impact ubiquitous mobile devices with cameras are having on our society and the potential liability risks associated with the use/misuse of these devices by health care employees.

The article indicates that various hospital employees took photos of a shark bite victim when he arrived in the emergency room. The article discusses the action taken by the hospital in response to the incident. Another article indicates that the photos were emailed to others.

This type of situation is a nightmare for hospital administration, the privacy officer and legal counsel. The effort and investigation that likely went into figuring out who took photos, where those photos went and the procedure for recapturing/removing the photos from the various sources was time consuming and expensive (both in $$ and reputation) for the hospital.

As such, this incident provides a good example for training and reeducating health care employees on patient privacy issues. Health care employees and professionals must always remember to start from a framework of protecting the health and privacy of their patients. As the use of mobile devices with cameras and social media tools becomes more ingrained in our every day lives -- the ability for private information to be captured, transferred and spread in a viral fashion has become much easier. Caution must be used and this case highlights the importance of retraining staff and highlighting the importance of protecting your patient's privacy.

HITECH Law Blog

A warm welcome to fellow AHLA member and health law blogger, Kathie McDonald-McClure.

I just ran across her blog, HITECH Law Blog. She focuses the blog on health information technology, privacy and security and the blog was named after the HITECH Act. Looks like a great addition to the health law blogosphere.

Ms. McDonald-McClure is a member of the Health Care Services Team at Wyatt Tarrant & Combs, LLP in Louisville, KY.

AHLA Hospital's Friend or Foe: The Age of Social Media and Health 2.0

Today Jody Joiner and I presented at the AHLA Hospitals and Health Systems Institute on the use of social media by hospitals and health care providers. We provided an overview of social media use by hospitals and health care providers, discussed the pros/cons of using social media in the health care environment, presented case studies of the risks and legal implications and did a short role play involving tweets in the context of a medical negligence case. We also provided those attending with recommendations on developing social media guidelines and policies.

To show the speed and ease of using social media tools to spread information, news and photos we we did some live shots during the presentations using an iPhone that were then loaded up to my blog, Twitter and Facebook. We then pulled up the posts and tweets at the end of our hour presentation.

Great audience with great follow up questions. Thanks go out to Mark Browne (@ConsultDoc) and Peter Leibold (@HealthLawyers) for live tweeting during the session.

AIS Report on Patient Privacy: Analysis of Willful Neglect Under HITECH

Recently I was interviewed for a story focused on the changes to the HIPAA civil penalty enforcement under the HITECH Act.

The article, Willful Neglect Is Difficult to Pin Down, but Can Result in Enormous HIPAA Penalties, appears in the Report on Patient Privacy: Practical News and Strategies for Complying with HIPAA, Volume 10, Number 2 February 2010 published by Atalantic Information Services, Inc. (AIS). The article discusses the definition and interpretation of "willful neglect" under the HIPAA penalty provisions. Health care privacy officers should find this article helpful in better understanding their role and responsibility in overseeing privacy compliance efforts.

The full story was reprinted on AIS Health Business Daily website.

WV HIT Funding Under HITECH: WVHIN Gets $7.8M and WV REC gets $6M

Health and Human Services Secretary Sebelius and the National Coordinator for Health Information Technology, David Blumenthal, announced the HITECH funding under the ARRA for State Health Information Exchanges (HIEs) and Regional Extension Center (RECs) across the country.

The White House Press Release provides a detailed list of HIEs and RECs receiving grants. Inormation is also available via the HHS News Release, Sebelius, Solis Announce Nearly $1 Billion Recovery Act Investments in Advancing Use of Health IT, Training Works for Health Jobs of the Future.

West Virginia will receive the following funding:

• West Virginia Department of Health and Human Resources in conjunction with the West Virginia Health Information Network HIE Award: $7,819,000

• West Virginia Health Improvement Institute, Inc. REC ward:$6,000,000

More information about the health information technology programs and awards can be found on the Office of National Coordinator HIT Website.

• State Health Information Exchange Cooperative Agreement Program

• Health Information Technology Extension Program

Model Jury Instruction: Warning Jurors on Use of Electronic Technology and Social Media

The Committee on Court Administration and Case Management of the Judicial Conference of the United States has issued a memo regarding Juror Use of Electronic Communication Technologies.

At its December 2009 meeting, the Judicial Conference Committee endorsed a set of suggested jury instructions that federal district judges should consider using to help deter jurors from using electronic technologies to research or communicate about cases while they serve as jurors. The recommended instructions were developed as a result of the increased use of web enabled mobile phones and devices that can be used to research information and communicated in a variety of ways, including email, social media, etc.

The Proposed Model Jury Instruction reads as follows:

Proposed Model Jury Instructions

The Use of Electronic Technology to Conduct Research on or Communicate about a Case Prepared by the Judicial Conference Committee on Court Administration and Case Management

December 2009

Before Trial:
You, as jurors, must decide this case based solely on the evidence presented here within the four walls of this courtroom. This means that during the trial you must not conduct any independent research about this case, the matters in the case, and the individuals or corporations involved in the case. In other words, you should not consult dictionaries or reference materials, search the internet, websites, blogs, or use any other electronic tools to obtain information about this case or to help you decide the case. Please do not try to find out information from any source outside the confines of this courtroom.

Until you retire to deliberate, you may not discuss this case with anyone, even your fellow jurors. After you retire to deliberate, you may begin discussing the case with your fellow jurors, but you cannot discuss the case with anyone else until you have returned a verdict and the case is at an end. I hope that for all of you this case is interesting and noteworthy. I know that many of you use cell phones, Blackberries, the internet and other tools of technology. You also must not talk to anyone about this case or use these tools to communicate electronically with anyone about the case. This includes your family and friends. You may not communicate with anyone about the case on your cell phone, through e-mail, Blackberry, iPhone, text messaging, or on Twitter, through any blog or website, through any internet chat room, or by way of any other social networking websites, including Facebook, My Space, LinkedIn, and YouTube.

At the Close of the Case:
During your deliberations, you must not communicate with or provide any information to anyone by any means about this case. You may not use any electronic device or media, such as a telephone, cell phone, smart phone, iPhone, Blackberry or computer; the internet, any internet service, or any text or instant messaging service; or any internet chat room, blog, or website such as Facebook, My Space, LinkedIn, YouTube or Twitter, to communicate to anyone any information about this case or to conduct any research about this case until I accept your verdict.