Cautionary Tale of Patient Directives

Elizabeth Delahoussaye - Corporate Compliance & Privacy Officer, Ciox HealthJamie Glenn - Corporate HIM Director, Methodist LeBonheur Healthcare

Methodist LeBonheur HealthcareMemphis, TN

• Centralized Release of Informationo Cerner Shop

• Responsibility for 6 area hospitals including one pediatric facility and one facility in MS

• Approximately 30,000 requests annually• Partnership with Ciox

o Prism Software

How We’re Structured

• CROI Director• CROI Manager

• Manages front-line ROI Coordinators• 4 Legal Specialists (RHIAs)

• Created due to increased complaints by attorneys of facilities “withholding information” and eDiscovery

• 1 Specialist serves as our special projects and audit coordinator.• 5 ROI Coordinators

• Handle our day-to-day requests: disability, insurance, patient, continuation of care, etc.

Patient Directive Requests

• 2017 – 1,033oLegal Patient Directives = 705

• 2018 Thru May 31st – 719oLegal Patient Directives = 449

• Anticipated 30%+ Increase oDecrease in from 2016-2017 by $60,000

Loss of Legal Specialist PositionoProjected decrease in 2018 of $90,000

What Are We Seeing?

• Most patient directives are written by attorneys but in the patient’s voice

• If record cost is high due to length of stay/numerous encounters:oNo longer seeing as many revised requestsoSending in patient directives after they receive the invoice to avoid the

fees• HITECH verbiage hidden within requests

• Result: increased customer service calls and redundant work

Patient Directive Examples• Limited Power of Attorney

Examples, continued

• Letters “Written by the Patient”

Examples, continued

All for $6.50 + Tax• Request Received and Date Stamped• Patient MRN looked up, and logged into Prism by ROI Coordinator• ROI Coordinator or Legal Specialist picks up request from queue• Authorization checked• System checked for all records:

• Cerner• Archived Record Storage (Two Different Locations/Vendors)• Records acquired from other facilities

• UT Bowld Transplant, Counseling Centers, etc.• Microfilm/Microfiche• Form Audits Completed• Old MPI Database Search: Softmeds for children’s hospital, Mainframe for adult facilities• Forwarding requests to billing, radiology, pathology, etc. as requested

• Requester decides he doesn’t want to pay for all of these records: sends a patient directive instead or changes request to an abstract

• If request changed to abstract, we re-process the entire request.• Many requests are well over 20,000 pages, and many requests for “any and all” records have encounters that

can span into the 100s, especially with transplant patients.

Impact On Our Department• Less Revenue

• We were contributing financially to the organization• Specialized RHIA positions in place to ensure that a complete and legal

copy of the medical record is prepared…for $7.11 many times – thus, the loss of one of these positions

• Sending pre-payment for records prior to review• Increase in Education of Associates

• Charge Types: When to charge vs. When it’s Free• How to recognize a patient directive• All or none mentality for charging for records

• Now charging patients for copies & discomfort relaying the message

The Difference Between Access Requests & Patient Authorizations

• Right of Access – Individual has right of access to inspect and obtain a copy of PHI about the individual in a designated record set

• Except psychotherapy notes and information compiled in anticipation of civil, criminal, or administrative action

• Timely Action Required – Must act no later than 30 days (outer limit) after receipt of request

• Actions: accept, deny, or extend (max 30 days)

• Form of Access – Provide access in form and format requested by individual (if readily producible), or in readable hard copy/electronic format for or other form/format as agreed to by CE and individual

Individual Right of Access45 CFR § 164.524

• Written Request – CE may require individuals to make request in writing, provided CE informs individual of requirement

• CE may require individual to use entity’s form, provided use of the form does not create a barrier to or unreasonably delay individual from obtaining access to PHI

• Verification – CE required to take reasonable steps to verify identify of an individual making request for access

• Type and manner up to discretion of CE, but cannot create barriers to or unreasonably delay access (e.g., phone, fax/email CE’s form, web portal, etc.)

• Type of verification may depend on how individual is requesting and/or receiving access

Individual Right of Access Cont’d…45 CFR § 164.524

• Manner of Access – If individual directs CE to transmit copy of PHI directly to another person designated by the individual, CE must provide the copy to the designated person

• Request must be in writing, signed by individual, and clearly identify designated person and where to send the copy

• HHS is its FAQ clearly articulates a difference between an authorization and a patient directed request (right of access) request in not only the amount that can be charged but the scope of information to be provided.

Individual Right of Access Cont’d…45 CFR § 164.524

• HHS has made clear that the written request from the individual for PHI to be sent to a designated person or party is treated differently than a third party request and authorization. See Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Nondiscrimination Act; Other Modifications to the HIPAA Rules (“Omnibus Final Rule”), 78 FR 5566, 5635 (January 25, 2013) (“This written request for protected health information to be sent to a designated person is distinct from an authorization form, which contains many additional required statements and elements (see § 164.508(c)).”). The patient has the right to direct the covered entity to transmit the PHI about the individual directly to another person or entity designated by the individual.

Individual Right of Access Cont’d…45 CFR § 164.524

• Fees – CE may impose reasonable, cost-based fee, including: • Labor for copying/scanning (in paper or electronic form), converting electronic info

into format requested/agreed to by individual, transferring (e.g., uploading, downloading, burning, etc.) ePHI from CE’s system to another media/delivery method

• Supplies (electronic media) and postage• Preparing explanation/summary, if agreed to by individual

• Does not include labor associated with reviewing request, retrieving, or otherwise preparing responsive information or ROI outsourcing

• More in FAQs, including how to calculate (actual, average, or flat fee)

Individual Right of Access Cont’d…45 CFR § 164.524

16

Right of Access (patient directive) HIPAA Authorization

Requires CE to disclose PHI (unless exception applies)

Permits, but does not require, CE to disclose PHI

In writing, signed by individual, clearly identify designated person and where to send PHI

Required elements and statements (e.g., who authorized to make disclosure and receive PHI, purpose of disclosure, expiration date/event, signature of individual and date, right to revoke, ability/inability to condition treatment, payment, enrollment or eligibility for benefits

30 days outer limit No timeliness requirement

Fees limited per 45 CFR § 164.524(c)(4) No limitations on fees (but disclose remuneration if disclosure constitutes sale of PHI)

Right of Access vs. Authorization

17

• Patient Directed Request: a directive from the individual written in the individuals voice to request be directed to the individual or to a third party

• e.g., A letter typed or handwritten by the individual and signed by the individual can be on attorney letter or patient letterhead

• Third-Party Request: is a third party initiated request for PHI request on its own behalf with the individual’s HIPAA authorization form.

• e.g., attorney request letter signed by the lawyer/paralegal and an individual's authorization

Identifying a First-Party vs. Third-Party Request

18

Facts of the Case

• Patients’ attorneys requested the medical records using: (1) a request letter signed by the attorney, and (2) a patient signed HIPAA authorization.

• The provider supplied the records and charged a $5.00 retrieval fee under Alabama law.

Patients’ Attorney Argued

• A request by a patient’s attorney is subject to the labor fee restrictions imposed by HIPAA/HITECH.

• Patient’s attorney is an agent/representative of the patient, and therefore, subject to the labor fee restrictions for patient’s imposed by HIPAA/HITECH.

The Court’s Decision

The Court held, “a legal representative who requests an individual’s protected health information (and is not a personal representative of the individual) is not entitled to the fee limitations imposed under HIPAA…”Therefore the court stated that the request did not constitute a patient directive request

• What information does the individual have to provide?

• Did you provide notice of CE’s required form and fees?

• What verification is required/allowed?• Do you have a template response

letter?

How do you Process and Respond?

22

OCR FAQ: When do limits on fees apply to disclosures to a third party?• First-Party: Fee limits apply when individual directs a CE to send PHI to third party regardless of

whether individual has requested copy of PHI be sent to herself, or has directed that CE send the copy directly to a third party designated by individual (and it doesn’t matter who the third party is).

• First-Party: Where a third party is forwarding (on behalf of and at the direction of the individual) the individual’s access request, fee limitations apply.

• Third-Party: Were a third party is initiating a request for PHI on its own behalf, with the individual’s HIPAA authorization (or pursuant to another permissible Privacy Rule disclosure), the access fee limitations do not apply.

• Unclear: Where it is unclear, based on form of request sent by third party, whether the request is an access request initiated by individual or merely a HIPAA authorization by individual to disclose PHI to third party, CE may clarify with individual whether the request was a direction from individual or a request from third party.

Fees: First-Party vs.Third-Party Request

23

Thank You!

Questions?