HIPAA Horrors

This has been a week for HIPAA horrors.

A reporter dropping some trash at a landfill in Massachusetts stumbled on a huge pile of medical records. It seems a former billing company for pathologists who served four hospitals had dumped the records without bothering to shred them. Now the hospitals and pathologists are on the hook – ouch.

Then a psychiatrist on the west coast left his laptop on the back seat of his car, and to his surprise (?) it was stolen, and the laptop contained demographic and billing information on thousands of patients.

Obamacare and PPACA Whistleblower Regs

The Patient Protection and Affordable Care Act of 2009 (H.R. 3590, aka PPACA) includes a number of whistleblower clauses. some are focused specifically on long-term care (which should interest physicians servicing ltcfs).

The broadest provision (Act Section 1558) added whistle blower protection to the Fair Labor Standards Act, referenced only to Title I provisions in the bill (critics wonder why not Titles 2 – 9, but there are other pre-existing regs in the federal (and state) law).

Procedural and remedy sections are tied to and mirror the provisions in the Consumer Product Safety Improvement Act of 2008. These include a 180 day statute of limitations, initial complaints are filed with OSHA, options on litigation venues, a right to a jury trial, and a broad range of remedies. The causation and proof standards are very favorable to the employee, and may be an impossible standard for the employer .

Another Section, 6703(b)(3) creates an additional special responsibility for long-term care providers (on top of numerous other reporting regulations) to inform all officers, employees and contractors of mandatory reporting and whistleblowing situations.

Section 6105, specifically focused on long-term care adds a mandatory complaint form for each nursing home (more paperwork, yippee!) and a prohibition against retaliation. Each state must develop (another) process to track and investigate complaints.

Employer “gag order” policies are voided by employee free speech rights, although “gags” related to HIPAA privacy and related issues would appear to remain valid (whistleblowing should be done through government channels therefore not violating HIPAA regs).

Employers may not use mandatory arbitration clauses to bypass or void these statutory rights.

Violating HIPAA at the Speed of Light

Rarely does a week go by without a story of how "social media"** have caused problems for an employer, often because of posting confidential information, photos or just nasty comments about some phase of the business operation or co-workers.

In health facilities the stakes are much higher.

Now is the time to develop policies and educate the staff, BEFORE something bad happens.



** Facebook, MySpace, Twitter, and of course email is also a problem.

IDS - Wave of the Future?

Among those who ponder the technical aspects of health care reform, there is strong sentiment for more use of Integrated Delivery Systems (IDS) in delivering health care.

This is hardly a new concept, but it may well be the concept of the future.

The first big IDS wave occurred in the early to mid-90s, as physicians and hospitals tried various medical service organization (MSO) models; essentially the hospital owned the physician practices. Many of these deals were disasters, some worked, some evolved into something that worked.

The idea is that if a central entity (an insurer, a hospital, or a hospital network) owns and coordinates services there will better care coordination and cost savings.

The successful integrations so far have largely focused on family practice, internal medicine and ob-gyn (the OBs assistance with malpractice premiums and 24/7 coverage issues).

An interesting change is surfacing, the acceptance of specialists and surgeons into IDS models. Historically there has been a great deal of friction between these docs and the hospitals.

Why the change? Fear of dire economic consequences of staying in a traditional group practice model.

Preliminary numbers from the 6/30/2010 residency class is that for the first time, a majority may opt for IDS employment rather than group practice. There are also reports that young docs are more concerned with life balance issues than previous generations.

So, any problems?

Some hospitals are bad at managing physician practices, physician contracts must be structured carefully, physician productivity sometimes drops off with a steady paycheck, and the process of merging practices and/or converting ownership is a great deal of complex work at no small cost. Also, making this work in rural areas is tough.

Biggest question, will IDS on a large scale really cut costs? Or just reshuffle the deck chairs?