Digitized Medicine

New Texas Privacy Law Increases Physician Liability Including Heftier Enforcement Penalties

As discussed in my post "New Texas Privacy Law Increases Privacy Protections and Physician Cyber Liability Risks", House Bill 300 (HB 300) strengthens protection of patients' electronic health information in Texas beyond HIPAA and becomes effective on September 1, 2012.   In a series of weekly blogs I am writing to illustrate how these stronger patient protections increase physicians' cyber liability.  Consider this case history:

An unencrypted USB drive used to store PHI could not be found in the office.   It contained data on 1,105 patients including names, diagnosis codes and Social Security numbers.   The physician subsequently notified all affected individuals and local media, added technical safeguards of encryption for all PHI stored on mobile devices, added physical safeguards by keeping new portable devices locked in a secure combination safe in doctor’s private office when not in use and added administrative safeguards including annual privacy training of staff. 

For breaches affecting >500 individuals HIPAA requires physicians to notify not only the affected individuals, but also local media outlets and the Department of Health and Human Services (HHS) who then posts breach information on their website.    However, if the PHI was encrypted, then it is not considered to be a violation and no notification is required.    The privacy violation in this case would have been avoided by either encrypting the thumb drive (a technology-based prevention strategy) or by not downloading PHI to a mobile device (an employee training-based prevention strategy).   

HB 300 privacy protections are enforced through penalties, disciplinary actions and audits that are intended to deter breaches.   Several factors are considered when determining the consequences of a breach including the seriousness of violation, compliance history, harm done to individuals and efforts made to correct violations.  Civil penalties may be assessed for each violation up to:

• $5,000 if committed negligently
• $25,000 if committed knowingly or intentionally
• $250,000 if committed intentionally and PHI is used for financial gain
• $1.5 million if a “pattern of practice” found

Physicians should also consider purchasing cyber liability insurance (or increasing current liability limits) and consulting with their Regional Extension Center, such as the North Texas Regional Extension Center (NTREC), about assistance with security risk analysis and management.

cook children

Texas Privacy Laws Provide Patients Stronger Rights to Access Electronic Health Record Than HIPAA

As discussed in my post "New Texas Privacy Law Increases Privacy Protections and Physician Cyber Liability Risks", Texas House Bill 300 (HB 300) strengthens protection of patients' electronic health information in Texas beyond HIPAA and becomes effective on September 1, 2012.  Through a series of blogs I am illustrating a variety of these new protections. Today we contrast a patient's right to access their electronic health record (EHR) under HIPAA against HB 300 requirements in Texas. Case history:

A patient alleged that a physician failed to provide him access to his electronic medical record within 30 days of a written request as required by HIPAA. After the Office of Civil Rights (OCR) notified the physician of this allegation, he provided the records but charged the patient a $100.00 “administrative fee” because the patient was delinquent on bills. HIPAA permits only a reasonable cost-based fee (copying and postage) with an explanation or summary if agreed to by the individual. To resolve this matter, the physician refunded the $100.

When state and federal privacy laws diverge, the more protective law prevails.  In Texas HB 300 combined with other state laws are more protective than HIPAA such as with a patient’s right to access their electronic health records (EHRs). HB 300 mandates physicians who use EHRs to provide patients the requested record in electronic form not later than 15 business days after receiving a written request unless there is an allowable exception.   The EHR may be provided in another format if the physician’s EHR is incapable of producing an electronic copy or if agreed upon by the patient in advance.  Physicians in Texas should align with HB 300 by revising policies on patient access to their EHR and updating their Privacy Notice as needed.

Physicians should also consider purchasing cyber liability insurance (or increasing current liability limits) and consulting with their Regional Extension Center, such as the North Texas Regional Extension Center (NTREC), about assistance with security risk analysis and management.

More on other HB 300 provisions next week...

cook children's

New Texas Privacy Law Increases Employee Training Requirements in Physician Practices

As discussed in my post "New Texas Privacy Law Increases Privacy Protections and Physician Cyber Liability Risks", House Bill 300 (HB 300) strengthens protection of patients' electronic health information in Texas beyond HIPAA and becomes effective on September 1, 2012.   I am concerned that their may be low levels of awareness at this time among Texas physicians regarding the new privacy provisions.  For example, one of the new requirements impacts employee privacy training policies for the physician practice.   As an illustration, consider this case history:

A laptop computer was stolen or lost from the reception desk area possibly after a cleaning crew had left the main door to the building open.   An employee had previously used the laptop to download information that included protected health information (PHI) on 67 patients seen that week.   Following the breach the practice notified all affected individuals, added technical safeguards of encryption for PHI stored on mobile computers, added physical safeguards by keeping all portable devices locked in a cabinet of a locked storage room when not in use and required re-training of all employees on privacy and security policies including immediate training for the cleaning staff.

Many breaches of PHI are avoidable if employees are trained on privacy/security  and remain vigilant when managing PHI.    In Texas HB 300 protects not only PHI as defined by HIPAA, but also “sensitive personal information (SPI)” as defined by the Texas Identity Theft Protection Act.   HB 300 requires all employees who will encounter PHI or SPI to undergo privacy training that is tailored to the employee’s specific responsibilities and types of contact with PHI.    New employees must be trained within 60 days of hiring, and training must be repeated at least once every two years.    A log must be maintained with employee signatures verifying their attendance.    Physicians can prepare by updating employee training policies and materials.

Physicians should also consider purchasing cyber liability insurance (or increasing current liability limits) and consulting with their Regional Extension Center, such as the North Texas Regional Extension Center (NTREC), about assistance with security risk analysis and management.

More on other HB 300 provisions next week...

cook children's

New Texas Privacy Law Places More Accountability on Business Associates of Physician Practices

As discussed in my post "New Texas Privacy Law Increases Privacy Protections and Physician Cyber Liability Risks", House Bill 300 (HB 300) strengthens protection of patients' electronic health information in Texas beyond HIPAA and becomes effective on September 1, 2012.   In a series of weekly blogs I am writing to illustrate some of the new protections.   I think that the most important change imposed by HB 300 is the increased accountability placed on business associates of a physician practice to adhere to the state privacy laws.  Consider this case history:

A physician practice was notified by one of their business associates (BA), a medical transcription service, that dictated patient reports were viewable on the Internet by anyone after the BA’s server was compromised.  The breach involved PHI of 1.085 individuals.  In response, the practice immediately terminated the business associate agreement (BAA) with this company and engaged another medical transcription service.  The practice contracted with forensic consultants to ensure that the cause of the compromise was found and all online traces of breached reports were removed.

HB 300 holds accountable any business in Texas that comes into contact with PHI.   This means that BAs of physician practices are accountable to HB 300 protections and HIPAA unless they have no contact with PHI.   Physicians should revise their BAAs to include language compelling BAs to comply with state and federal privacy laws.  Matters to address in a BAA include:   

• Immediate notification to practice when BA discovers breach
• Who notifies affected individuals?  Who bears the cost?
• Contract termination for failure to comply with law or take "reasonable" steps to fix breach
• BA ‘s compliance with performing security risk analysis at least annually
• BA’s compliance with employee privacy training
• Encryption of PHI on BA’s mobile devices or exchanged online; and other circumstances where PHI is at high risk

Physicians should also consider purchasing cyber liability insurance (or increasing current liability limits) and consulting with their Regional Extension Center, such as the North Texas Regional Extension Center (NTREC), about assistance with security risk analysis and management.

More on other HB 300 provisions next week...

cook children's

New Texas Privacy Law Increases Privacy Protections and Physician Cyber Liability Risks

Privacy protection is getting bigger in Texas.   Last year the Texas Legislature passed House Bill 300 (HB 300) heavily amending the state's Texas Medical Records Privacy Act.   These amendments increase protection of electronic personal health information (PHI) and become effective on September 1, 2012.    HB 300, along with other state privacy laws such as the Texas Identity Theft Protection Act, are more protective of patients' privacy than HIPAA.  Stronger protections translate to increased physician cyber liability risks.

I support strong protection of patients' electronic PHI through state and federal privacy laws including the imposition of fair penalties, disciplinary actions and audits that are strong enough to deter breaches of PHI.   But I am concerned that there may be low levels of awareness among physicians regarding the new state privacy requirements which increase the physician's cyber liability risks.   In the next month I know of  two physician-oriented publications that will discuss the issue, and I will present on the topic at the Texas Medical Association's TexMed 2012 Conference in Dallas, Texas, on May 18th.    Hopefully we can stimulate more conversations and actions across the state.

I suggest that physicians at least consult with their lawyer to ensure their practice is aligned with HB 300.   Specific actions a physician practice may need to take to be compliant with HB 300 include revising employee privacy training policies and materials; revising policies on patient access to their EHR; updating the Privacy Notice; revising business associate agreements; encrypting protected health information (PHI) stored on mobile devices; and encrypting PHI transported online.    Physicians should also consider purchasing cyber liability insurance (or increasing current liability limits) and consulting with their Regional Extension Center, such as the North Texas Regional Extension Center (NTREC), about assistance with security risk analysis and management.

Stay tuned for more blogs on HB 300...   

cook childrens

Progress being made to splice information technology into the healthcare industry's genome in Texas

It's amazing-the progress being made to splice information technology into the health care industry's genome.   When I first dove into health IT a decade ago the use of electronic health records (EHRs) was dismal and healthcare stakeholders rarely sat at the same table with mutually beneficial, collaborative objectives in mind.   Even within the same healthcare organization it was not uncommon for individual department leaders to disrupt an integrated health IT effort in order to protect some of their department's self-interests.   Less than 5% of hospitals had implemented fully functional computerized provider order management (CPOM) systems; less than 1 in 5 physicians were using an ambulatory EHR; and less than 5% of those were fully functional EHRs.    Today the percentage of physicians and hospitals using robust EHRs is rising at a rate that was unthinkable back then.  

This progress parallels the launch of health IT initiatives established through the federal HITECH funds such as the EHR Incentive Program.   In the past two years these funds have been a catalyst here in Texas to engage diverse groups of healthcare stakeholders  to use health IT to improve quality of care.   As a result:  

• Increasing numbers of Texas physicians are using EHRs (approaching 50%)
• More and more hospitals are using CPOM
• Over a dozen of community-wide health information exchanges (HIEs) are up and running
• New health IT workforce training programs are established
• Four regional extension centers were formed covering all geographic areas of the state and are doing a phenomenal job assisting thousands of physicians with EHR selection, implementation and meaningful use
• Texas became the first state to have it’s HIE plan approved by ONC
• Texas was one of the first states to stand up the Medicaid EHR incentive program making our program a model for other states
• Texas was one of four to receive a SHARP grant
• And Texas leads the way with the number of physicians attesting to meaningful use; Texas physicians and hospitals have received over $270 Million in EHR incentives

This rate of progress is only possible when individuals with diverse backgrounds and from different healthcare stakeholder groups are able to collaborate.  In Texas these stakeholders have demonstrated an ability to park their self-interests in order to drive forward with a common vision to improve the quality and delivery of patient care in our communities.

Texas Medical Association video provides in-depth look at meaningful use, how RECs can help physicians

This video does a good job of describing Meaningful Use, the electronic health record (EHR) incentive program and how the four regional extension centers (RECs) in Texas leverage federal grants to subsidize services for physicians that help them select/implement or upgrade an EHR, and then use their EHR to improve quality of care and meet the Meaningful Use requirements.  

The four RECs in Texas currently charge primary care physicians only $300 for consulting services valued at $5,000.  These services include:

o    Select and implement a certified EHR (or upgrade your current EHR to a certified version)

o    Optimize your practice workflow,

o    Achieve meaningful use,

o    Qualify for EHR incentives, and

o    Obtain CME credit hours      

 cook children's

Twitter Chats and Physicians (#eRx630)

Today I (as @drmattmurray) and @TexMed moderated our first Twitter Chat that focused on the topic of e-prescribing. To participate in a Twitter Chat a physician must have a Twitter account and must know the date, time and Twitter hashtag for the Twitter Chat.  In our case the hashtag-- #eRx630--refers to e-prescribing and the date, June 30th, by which time physicians must meet the CMS requirements regarding the use e-prescribing. Physicians who fail to use a qualified e-prescribing system or certified EHR to enter at least 10 e-prescriptions during eligible Medicare encounters will incur a 1% penalty on 2012 Medicare claims.    On the other hand, those who meet this requirement are eligible for a 1% bonus. 

Despite the high importance of this subject matter, there were not any other physicians participating on this particular Twitter Chat.   At least none that we heard from.   It was lonely.  

However, we considered this to be an experiment and a chance to experience what it is like to actually moderate a Twitter Chat.    Without a lot of participating "chit-chat", it was difficult to coordinate questions and answers with my friends @TexMed and @TexMedHIT.     We basically asked each other questions or even asked ourselves for our own answers.  I think we did get out some excellent information, but this would have been more valuable with some active back-and-forth dialogue.   Again, though, the purpose of this venture was to dip our toes in the water to see how this type of format could be used in the future. 

Twitter Chat among physicians will certainly have challenges, but I think it will find it's place as a useful mode of communication for specific purposes and in certain situations.  The format will need to be refined, and this means we will have to try it (like today!), experiment with it, refine it and keep doing that PDSA thing to it (Plan-Do-Study-Act).   Eventually it will find a place where it serves as an effective way to communicate some things.     I already have found Twitter useful at large medical conferences that use a hashtag to communicate real-time information.    It is a matter of finding the right niches. 

One of the useful aspects of a Twitter Chat is that a transcript can be created of the entire conversation.  This means that you don't have to be "online" and engaged in the Twitter stream for the entire duration of the chat.   Since most physicians are hard pressed to find an un-interrupted hour, they would find it very helpful to be able to access and peruse the transcript at their leisure.

Here is a transcript of today's Twitter Chat #eRx630:

 
 
 
 
 
 
 
 
 

Improve Physician Leadership Through Recruitment, Education and Training

A recent discussion among my colleagues about increasing physician leadership in this age of electronic health records (EHRs), Meaningful Use, healthcare reform and Accountable Care Organizations (ACOs) caused me to think about how a physician even starts to go about becoming a leader.   I considered physicians in my own community who are recognized leaders and appreciated that their rise to leadership started by simply getting involved in something.   Their leadership was born out of getting involved just like my colleagues were doing when they began discussing solutions to this particular issue!

Getting involved is a common attribute of physician leaders because there is obviously little merit or trust when a physician leads an effort without previously participating in a similar effort.   Participation is the initial step to gain such trust.   Once a physician gets involved with a successful initiative their community deposits a “coin of trust” into his pocket.    If the physician obstructs progress, though, some coins of trust are removed.   A physician who eventually collects a pocketful of coins is looked upon as a trusted “community leader” who is knowledgeable and experienced, even if he did not actually “lead” any effort.  This is because many successful healthcare initiatives are known to be moved forward by people who are catalysts for collaboration and effective at resolving conflicts between stakeholders.   One does not have to be an ACO board chairman or a formal project leader to be such a catalyst.  In fact, it is often advantageous to be in a more neutral position when exerting that type of influence.

So an increase in physician leadership will initially involve an increase in physician participation in healthcare initiatives.   A good place to start is with local health initiatives such as a Regional Extension Center (REC), health information exchange (HIE)  or Accountable Care Organization (ACO).   Participating in a local initiative provides physicians with the valuable experience of working together, perhaps for the first time, with multiple stakeholders.  Physicians will see the types of communal efforts that are successful at promoting change.  They will gain valuable knowledge about healthcare reform, health IT or other important topics.   They will learn how public policy is developed. They will encounter the frustrations and complexity of efforts that fail.   But they will learn to keep their focus on the long term and not be deterred by a short term failure that they come to realize will not matter at all in 40 years.     

Understanding this process illuminates a path to increase physician leadership.  It starts with the active recruitment of physicians into local, statewide or national activities.  It is accelerated through concurrent education and training to hone leadership skills.  County and state medical societies, who have established physician relationships and are experienced with physician education/training, are ideal entities to facilitate the growth of leadership.  The medical societies could actively identify new and ongoing healthcare initiatives and contact them to ensure there is adequate physician participation.   They could also assist with physician recruitment and training when needed.

Help Available For Small Physician Practices to Overcome Technology Challenges

American Medical Association (AMA) President, Cecil B. Wilson, M.D., said in an AMA Commentary this week, "Physicians should take the time to explore their practice needs, assess their practice's readiness to adopt health IT and select the right system for the practice --and its patients".    This is wise advice that I wholeheartedly agree with.

I also agree that the successful adoption and meaningful use of electronic health records (EHRs) impose many new challenges onto physician practices and that overcoming these barriers is especially difficult for physicians in small practices or solo practices that are constrained by limited resources.   My only disappointment with Dr. Wilson's message to physicians is that it failed to highlight how Regional Extension Centers (RECs) can be leveraged by physicians to address these issues with EHR adoption and use.

The HITECH portion of the 2009 Reinvestment Act (ARRA) included over $677 million in grant funds to establish RECs across the nation to cover every geographic region.   The purpose of each REC is to provide consulting services to physicians that help them overcome many of the described barriers to the adoption and use of EHRs.   It is important for physicians to know that the RECs receive federal subsidies specifically based on and proportionate to the number of primary care physicians in solo or small group practices (<10 physicians) that they successfully help adopt, implement and meaningfully use an EHR.  In other words, RECs are financially dependent on providing effective health IT consulting services to a segment of physicians who have the greatest need for such services.

In Texas there are four RECs including the North Texas REC (NTREC) for which I volunteer time as Board Chairman.    Other Texas physicians volunteer their time to comprise 50% of the governing boards for each of the four RECs.   Our goal is to ensure that our RECs are physician-friendly and remained focused on providing high quality services that meet the technology needs of small physician practices in each region.   Texas RECs collaborated with each other to create a common business plan that leverages the federal subsidies to charge Texas physicians a token fee of $300 for IT consulting services worth over $5,000.    

NTREC will receive 100% of their allotted subsidies if we successfully help 1,500 physicians adopt EHRs and achieve meaningful use.   Since last October more than 500 North Texas physicians have enrolled for NTREC services; over half of them have already successfully implemented an EHR and are now working on the achieving meaningful use of their investment.

My hope is that physicians in other states will emulate our efforts by actively engaging in the governance of their region's RECs to ensure that they are physician-centric and remain focused on addressing the unmet needs of the small physician practices.