1. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. HIPAA/HITECH – Where are we now? Jo Ellen Whitney JoEllenWhitney@davisbrownlaw.com Davis Brown Law Firm

2. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. About Davis Brown Founded in Des Moines, Iowa in 1929 Full-service law firm with comprehensive business and litigation practices Offices in Des Moines, West Des Moines, Ames and Emmetsburg, Iowa 79 attorneys and more than 100 paralegals and support staff

3. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Jo Ellen Whitney Senior partner at the Davis Brown Law Firm. Areas of practice include: Employment & Labor Relations Health Law Privacy & Security (HIPAA)

4. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. DISCLAIMER Due to limitations and the nature of this program please understand that printed material and oral presentations or other data presented are not intended to be a definitive analysis of the subjects discussed. Users are cautioned that situations involving healthcare and employment law questions are unique to each individual circumstance, and the facts of each situation will dictate a different set of considerations and varying results. Material contained on this site or listed as a reference is a general review of the issues, and must not be considered as a substitute for advice from your own attorney on your own independent situations. 4

5. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Foundational Questions What is the medical record? – Record created by provider or received by provider which is used for care.

6. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Who Owns the Medical Record? This varies based on the nature of the circumstances. Patients have rights to the data and can limit data use. Providers may have an ownership interest but that may belong to the facility.

7. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Are There Non-HIPAA Special Protection 1)Mental Health 2)HIV/AIDS 3)Substance Abuse 4)Genetic Information

8. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Who Can Access? 1)Age issues 2)POA vs. Guardian vs. Executor 3)Minimum Necessary

9. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Minors and Consent Can a minor consent to his or her health care services? 9

10. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. General Rule The health care provider must obtain the consent of a minor’s parent or legal guardian in order to render medical care, treatment, or services to a minor. – Why? 10

11. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Are there exceptions? Yes – HIV/AIDS care – Contraceptive Services – STD prevention, diagnosis, treatment, – Substance abuse treatment Why? 11

12. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Substance & Alcohol Abuse A minor may consent to substance abuse treatment. Iowa Code § 125.33 - This information must not be reported or disclosed to the minor’s parents or legal guardian without the minor’s consent. - A minor may also consent to a request for discharge if the minor made the original request for treatment 12

13. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Mental Health Any person who is mentally ill or has symptoms of mental illness may consent to admission to a public or private hospital for observation, diagnosis, care, and treatment. Iowa Code § 229.2; Iowa Admin. Code r. 441-29.2(218,229) – “Mental illness” Means every type of mental disease or mental disorder, except that it does not refer to an intellectual disability or certain terms as defined in the Iowa Criminal Code 13

14. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Mental Health A minor’s parent, guardian, or custodian may make an application for admission to a public or private hospital for observation, diagnosis, care, and treatment of the minor child. – The chief medical officer shall provide separate prescreening interviews and consultations with the parent, guardian, or custodian and the minor – The chief medical officer must inform the minor orally and in writing that the minor child has a right to object to the admission. 14

15. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Victim Medical and Mental Health Services “A professional licensed or certified by the state to provide immediate or short-term medical services or mental health services to a victim may provide the services without the prior consent or knowledge of the victim's parents or guardians.” Iowa Code § 915.35 – “Victim” means a minor who has been sexually abused or subjected to unlawful sexual conduct or has been the subject of a forcible felony. The professional MUST notify the victim if the professional is required to report an incident of child abuse pursuant to Iowa Code § 232.68 15

16. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Emergency Health Care Services Health care providers (including physicians, physician designees, ARNPs, PAs, RNs, LPNs, and emergency medical care providers) are not required to obtain parental consent prior to rendering “emergency medical, surgical, hospital or health services” to a minor if the parent or guardian is not “reasonably available.” Iowa Code § 147A.10 16

17. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Minor Consent Laws and Payment Minors often forget their parent or legal guardian may become aware of a certain medical service received by the minor through the minor’s insurance. – Inform the minor that he or she can avoid this by paying for the medical service 17

18. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. OCR BY THE NUMBERS Investigated in excess of 22,222 cases where some action was required. 10,005 investigated found no violation. 54,944 cases weren’t HIPAA – Not a CE or prior to HIPAA – Untimely or withdrawn – Activity does not violate HIPAA (such as reporting vaccinations) 18

19. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. MOST COMMON TYPE COMPLAINT Impermissible use and disclosure Lack of safeguards Lack of patient access More than minimum necessary information released Lack of administrative safeguards 19

20. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. ENTITIES (In Order of Frequency) Private Practice General Hospital Outpatient Health Plans Pharmacies 20

21. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. AUDIT PROGRAM (Sue McAndrew OCR Deputy Director) 115 CE Audited and Pilot Program Completed 21

22. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. PILOT PROGRAM REVELATIONS IN PRIVACY Failure to provide accurate NPP Failure to grant individual access Compliance with minimum necessary Failure to obtain authorizations 22

23. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. PILOT PROGRAM REVELATIONS IN SECURITY Risk Analysis Media Storage / Disposal Audit Controls General Monitoring (Idaho State) 23

24. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. NOT JUST COMPUTERS 22% of all OCR Complaints are about paper records and “fundamental principles” 24

25. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. The Audit Plans Announced 350 CE’s (Fall 2014) 50 BA’s (2015) 25

26. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Target Areas Risk Analysis Proper NPP Patient Access to Data Storage Media Controls Transmission Security Work Force Training 26

27. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Audit Data Map Inventory Privacy Assessment/Audit Security Assessment/Audit Training/Agreement Plan/Policies Follow-up 27

28. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Possible New Substance Abuse Rules HHS Substance Abuse and Mental Health Services Administration (SAMHSA) – Engaged in “listening sessions” regarding changes.

29. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Possible Changes 1)Services based distinction/nature and extent of service; 2)Broaden what is acceptable consent; 3)Emergency Access; and 4)More use for research.

30. ©2014 DAVIS BROWN KOEHN SHORS & ROBERTS P.C. Thank you Jo Ellen Whitney JoEllenWhitney@davisbrownlaw.com Davis Brown Law Firm