1. Electronic Medical Records
ACI’s 7th Annual Forum on Long Term Care Litigation and Risk Management Strategies
January 18-20, 2017
Electronic Medical Records
Clemente Inclan
Shareholder
Saalfield Shad Law Firm
Patrick Oot
Partner
Shook Hardy & Bacon
Erin Pope
SVP Chief Compliance & Privacy Officer
Golden Living & Affiliates
Tweeting about this conference?

2. Electronic Medical Records
Defining the Record
Controlling Access to Electronic Record
Challenges to Changing EMR/EHR
Audit Trails
Legal Response to Challenges and Audit Trails
Where the Vendors Are
Moving, Migrating and Archiving
Intersection of the Company Representative
New Federal Rules and Proportionality
Note: Please include explanatory notes here

3. Defining the Medical Record
Many use Electronic Medical Record (EMR) and Electronic Health Record (EHR) interchangeably
Office of National Coordinator for Health Information Technology, US Health and Human Services defines EMR and EHR separately
EMR: digital version of the paper charts in a clinician’s office; contains the medical and treatment history of the patient in one practice
Typically EMRs
Track data over time
Easily identify which patients are due for preventive screenings or checkups
Check how their patients are doing on certain parameters—such as blood pressure readings or vaccinations
Monitor and improve overall quality of care within the practice
Often the information in EMRs doesn’t travel easily out of the practice
Source: ONC Health IT, HHS
Note: Please include explanatory notes here

4. Defining the Medical Record
EHR: is a digital version of a patient’s paper chart; real-time, patient-centered records that make information available instantly and securely to authorized users.
Typically an EHR
Contains the medical and treatment histories of patients
Is built to go beyond standard clinical data collected in a provider’s office and can be inclusive of a broader view of a patient’s care.
Contain a patient’s medical history, diagnoses, medications, treatment plans, immunization dates, allergies, radiology images, and laboratory and test results
Allow access to evidence-based tools that providers can use to make decisions about a patient’s care
Automate and streamline provider workflow
One of the key features of an EHR is that health information can be created and managed by authorized providers in a digital format capable of being shared with other providers across more than one health care organization. EHRs are built to share information with other health care providers and organizations – such as laboratories, specialists, medical imaging facilities, pharmacies, emergency facilities, and school and workplace clinics – so they contain information from all clinicians involved in a patient’s care.
Source: ONC Health IT, HHS
Note: Please include explanatory notes here

5. Defining the Medical Record
Long Term Care providers may use a EMR, EHR or a hybrid medical record which includes paper and an electronic system
Some providers may use portions of an EHR and portions of an EMR depending on functionality, user preferences, cost, etc.
Beware of legacy and new systems and how they integrate
Benefits to hybrid records may depend on several factors
Best interests of resident/patient
Available resources to use, maintain and operate electronic systems
Integration capabilities of other systems – hospital, pharmacy, labs, therapy, etc.
Fragmented electronic systems may create other challenges
Note: Please include explanatory notes here

6. Controlling Access to the EMR/EHR
Per HIPAA and some state regulations, access to protected health information must be secure and should only be used for treatment, payment, healthcare operations or purposes authorized by the patient/resident
Patients/Residents are not typically provided with access to the EMR/EHR, but instead a copy of the information from the electronic system
Some EMR/EHR systems provide for patient to view, download or transmit records electronically
For example, a patient views the information from a secure portal
More common in hospital setting, not long term care
Plaintiffs are beginning to demand access to the EMR/EHR
Note: Please include explanatory notes here

7. Challenges to Changing EMR/EHR
Typically not a point in time for EMR/EHR systems
EMR/EHR screen seen by caregivers may appear different when printed out in paper
Various formats available when printing depending on EMR/EHR system
How the EMR/EHR appears at the time of an alleged incident may be different when the records are requested
Data may remain the same, but appearance to the end user is different
“Pop up” boxes, alerts, warnings, queries, notices, best practice guidelines, etc. may be available to nurse at the point in time, but not available in the medical record or on printed version of the record
Note: Please include explanatory notes here

8. Challenges to Changing EMR/EHR
Some fields are “hard keyed” and unable to modify (i.e. dates and times of entry) while others can be modified by super user, system administrator, etc.
View and access may be defined by job code, role, etc. so caregiver views may differ and some portions of the EMR/EHR may be seen by some, but not all providers
Software upgrades, new releases, patches, etc. may change how employees view and use the system
Typically not a “print all” button option in EMR/EHR system
Note: Please include explanatory notes here

9. Audit Trails Rise in plaintiff requests for audit trails
Audit trails/access logs are typically not included in producing a medical record
Audit trails provide information about the medical record and may include*
Who documented in the medical record
When the person documented in the medical record
From which computer or device the person documented in the medical record
When a person opened a document within the medical record
A listing of every medical record opened by a provider
A listing of every document a particular caregiver documented in
*Audit trail information is specific to the EMR/EHR system or configuration within the system. Not a defined standardization of audit trail/access log information.
Note: Please include explanatory notes here

10. Audit Trails
Typically not a “print all” option for audit trails/access logs
Determine what is actually needed
Request may not relate to the merits of the case
EMR/EHR systems have different capabilities related to audit trails
Need to understand the capabilities of the EMR/EHR
Burden and/or cost to produce the audit trail information
Is the information available to end users? IT Administrator?
Is the data only available by request and contracting with the vendor?
Note: Please include explanatory notes here

11. Legal Response to Audit Trails and Access
Plaintiffs have argued that due to 45 CFR (a)(1)(d) covered entities are required to provide audit trails and view live data in the EMR/EHR
45 CFR (a)(1)(d) is under the HIPAA security rule related to administrative safeguards
Response:
Does work product or attorney client privilege apply? - Probably not
Peer review or quality assurance? - Probably not, but maybe. Review QAPI process to determine.
Proprietary? - Contract may not allow live viewing of medical records or audit trails for this purpose and plaintiff access may breach contract; may also have license issue; vendor also has rights to product and plaintiff access violates vendor rights.
Audit trails are not medical records pursuant to 45 CFR
“ Health care means, care, services, or supplies related to the health of an individual. Health care includes, but is not limited to, the following: (1) preventative, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body; and (2) sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.”
Limit scope where possible – for example, have corporate representative at the navigate through the EMR/EHR at the direction of Plaintiff counsel and in the presence of defense counsel
Note: Please include explanatory notes here

12. Where the Vendors Are
Several primary EMR/EHR vendors in Long Term Care area, rise in integration offerings
Raises other considerations – Are new or other types of electronic communication considered medical records?
Text messages between the nurse and physician
Medication administration machines/carts
Badges that monitors where the nurse is during the shift
Be aware of contractual provisions related to retention, archiving, access, licenses, audit trails
Some providers may be willing to assist in providing back end database information for undefined fees
Recent trend is electing the ability to archive data in EMR/EHR application
Data is available from vendor if the provider elects to subscribe to archiving
Need to know if the data is truly unavailable or perhaps costly to obtain
Note: Please include explanatory notes here

13. Moving Systems, Migrating, and Archiving Data
Several things to consider when a healthcare provider is moving, migrating or archiving EMR/EHR systems
What data will be available to the healthcare provider after contract ends?
What is the retention period of the data hosted by the vendor?
Are read only, archive options available from the vendor for long term accessibility?
Will healthcare provider receive a copy of the data?
If so, what is the format of the returned data?
Compatible with current IT resources and space?
Is the data searchable?
What is the size of the data? Does the healthcare provider have the capacity to store the data required for retention purposes?
How will the vendor ensure the metadata is not compromised during the migration or archiving process?
Are other vendors, exports or consultants required to complete the migration?
Note: Please include explanatory notes here

14. Moving Systems, Migrating, and Archiving Data
Recommendations when a healthcare provider is moving, migrating or archiving EMR/EHR systems
Define the retention period and what must be retained
Work with IT, legal, clinical and records management departments to define plan
Determine resources needed to move, migrate or archive data including technical skills, storage space, time, interim needs, security measures
Retain data in a format that is well organized or easily searchable for future use
Maintain chain of custody for data
Define ability and parameters to audit migrated data after migration process is complete
Note: Please include explanatory notes here

15. Intersection of Company Representative
Intersection of Clinical, IT, Records Management and Legal employees who manage and administer the EMR/EHR system
Identify the right people to assist with the matter, it may be more than one depending on the size of the organization
Understand the capabilities of the EMR/EHR, what is available and what is not
Are the limitation due to how the software is written or because of user defined modifications or customization?
Gain the institutional knowledge of when the EMR/EHR was implemented and how it has evolved for the healthcare provider, particularly during the relevant time period
Note the implementation timeline and system upgrades
Introduction of new electronic systems
Note: Please include explanatory notes here

16. Intersection of Company Representative
Recognize and be willing to learn IT and clinical perspectives with respect to the EMR/EHR
EMR/EHR systems are not designed for the purpose of litigation/ediscovery
Understand how the EMR/EHR works through the entire organization
If there are portions of a company that use different versions of the same system or different systems altogether, find out why
Identify company representatives that can speak to the system relevant to matter
Learn about the security features which protect the integrity of the system
Access controls and authentication mechanisms
Understand who supports the EMR/EHR and the support relationship
Does the vendor or internal IT make configuration changes to the EMR/EHR?
Does the healthcare provider allow users such as caregivers make configuration changes? What are the limitations?
What support does the vendor provider?
Note: Please include explanatory notes here

17. New Federal Rules and Proportionality
Rule 26 (f)(3) Discovery Conference
(f) Discovery Plan. A discovery plan must state the parties’ views and proposals on: ***
(C) any issues about disclosure, or discovery, or preservation of electronically stored information, including the form or forms in which it should be produced;
(D) any issues about claims of privilege or of protection as trial- preparation materials, including – if the parties agree on a procedure to asset these claims after production – whether to ask the court to include in their agreement in an order under Federal Rule of Evidence 502; ***
Note: Please include explanatory notes here

18. New Federal Rules and Proportionality
Rule 26 (b)(1) Scope of Discovery
Unless otherwise limited by court order…: Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable.
Note: Please include explanatory notes here

19. New Federal Rules and Proportionality
Deleted from Rule 26 (b)(1) Scope of Discovery:
- including the existence, description, nature, custody, condition, and location of any documents or other tangible things and the identity and location of persons who know of any discoverable matter. For good cause, the court may order discovery of any relevant matter to the subject of the matter involved in the action. Relevant information need not be admissible at the trial if the discovery appears reasonably calculated to lead to the discovery of admissible evidence. All discovery is subject to limitations imposed by Rule 26 (b)(2)(C).
Note: Please include explanatory notes here

20. New Federal Rules and Proportionality
Rule 26 (b)(2)(C) Scope of Discovery
When Required. On motion or on its own, the court must limit frequency or extent of discovery otherwise allowed by these rules or by local rule if it determines that: ***
(iii) the burden or expense of the proposed discovery is outside the scope permitted by Rule 26 (b)(1) outweighs its likely benefit, considering the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake in the action, and the importance of the discovery in resolving the matter.
Note: Please include explanatory notes here

21. New Federal Rules and Proportionality
Rule 37 (e) Failure to Preserve Electronically Stored Information.
(e) Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to prevent it, and it cannot be restored or replaced through additional discovery, the court:
Note: Please include explanatory notes here

22. New Federal Rules and Proportionality
Rule 37 (e) Failure to Preserve Electronically Stored Information.
(1) upon finding prejudice to another party from loss of information, may order measures no greater than necessary to cure the prejudice; or
(2) only upon finding that the party acted with the intent to deprive another party of information’s use in the litigation, may,
presume that the lost information was unfavorable to the party:
instruct the jury that it may or must presume the information was unfavorable to the party; or
dismiss the action or enter a default judgment.
Note: Please include explanatory notes here

23. Feel free to contact us with any questions after the presentation.
Closing
Feel free to contact us with any questions after the presentation.
Thank you!
Clemente Inclan
Shareholder
Saalfield Shad Law Firm
Patrick Oot
Partner
Shook Hardy & Bacon
Erin Pope
SVP Chief Compliance & Privacy Officer
Golden Living & Affiliates
Note: Please include explanatory notes here