HIPAA: Access to Records

By Elizabeth E. Hogue, Esq.

A key purpose of the Health Insurance Portability and Accountability Act (HIPAA) is certainly to protect patient information. Another is to help ensure that patients have access to their health information. In fact, the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services, the primary enforcer of HIPAA, has focused on enforcement actions against providers that do not make information available to patients on a timely basis. OCR launched a right to access enforcement initiative in 2019 that is continuing.

Providers must give medical information to patients and their representatives within thirty days of requests. When they fail to do so, they may be subject to enforcement action by OCR. Following are two examples of recent enforcement actions.

OCR announced on April 1, 2024, that Essex Residential Care in New Jersey will pay a civil money penalty of $100,000 to resolve violation of HIPAA’s right of access standard. This is the 48th settlement reached under the right of access initiative. OCR received a complaint in May of 2020 from the personal representative of the estate of a patient who passed away. Following an investigation by OCR, the personal representative, who was the son of the patient, received the records in November of 2020. The provider did not contest the fine.

In another recent case, the daughter of a patient who passed away was appointed as the personal representative of her mother’s estate. She made multiple requests to Phoenix Healthcare for a copy of her mother’s medical records. She finally received the records one year after her initial request. Phoenix Healthcare initially received a civil money penalty of $250,000 for failure to provide timely access.

The provider appealed. An administrative law judge (ALJ) upheld the violation and ordered Phoenix to pay a civil money penalty of $75,000. The Departmental Appeals Board affirmed the ALJ’s decision. Then Phoenix agreed to settle for $35,000 and waived the right to further appeals. While it may seem in this case that the provider’s appeals significantly lowered its costs, it is important to note that the provider also undoubtedly expended significant resources on two appeals of OCR’s enforcement action.

Providers have placed a great deal of time and effort into the protection of healthcare information in compliance with HIPAA. Rightfully so, but providers seem to have lost sight of the fact that HIPAA is also about ensuring that patients and their representatives have timely access to their records. Now is the time for providers to conduct intensive education of staff members about HIPAA’s requirements regarding access in order to avoid enforcement actions like those described above.

©2024 Elizabeth E. Hogue, Esq. All rights reserved. No portion of this material may be reproduced in any form without the advance written permission of the author. For more information on how to get access to this or any other article, please contact The Rowan Report.

CMS Announces Multi-Pronged Effort to Strengthen Direct Care Workforce

by Elizabeth E. Hogue, Esq.,

CMS recently issued guidance about how to build and maintain worker registries, i.e., management platforms, that make qualified health workers easy to find so that more individuals who receive Medicaid-covered home and community-based services (HCBS) can receive care in settings of their choice. Worker registries are designed to answer these questions: Who is qualified to provide HCBS in each state and how can Medicaid recipients find them?

On February 27, 2024, CMS announced several new initiatives and Resources from the Administration for Community Living’s (ACL) Direct Care Workforce (DCW) Strategies Center to address the shortage of workers who provide direct care to elderly and disabled clients. New initiatives include several types of assistance that are intended to help states strengthen their systems for recruiting, retaining, and developing direct care workers; and a national hub to connect states, stakeholders, and communities to best practices and other resources related to the direct care workforce.

Specifically, DCW Intensive Technical Assistance will facilitate collaboration among state agencies and with stakeholders to improve recruitment, retention, training, and professional development of direct care workers. The DCW Strategies Center will provide up to two hundred fifty hours of individualized technical assistance on a variety of issues for up to six teams involving multi-agency state teams.

A coach will be assigned to each team and have access to subject matter experts to support them in addressing states’ unique needs. Support provided through this initiative will be coordinated by a consortium led by ADvancing States in partnership with the National Association of State Directors of Developmental Disability Services and the National Association of State Medicaid Directors.

The DCW Peer-Learning Collaborative will bring representatives of four to six states into working groups focused on a particular topic. The DCW Strategies Center will host monthly virtual meetings focused on group learning to facilitate information sharing on best practices, innovative strategies, and demonstrated models for growing the direct care workforce. In addition, each participating state will receive up to seventy hours of individual technical assistance on a topic or issue important to each state. Each participating state is expected to accomplish at least one policy or program-related milestone as a result of participation in this initiative.

CMS also announced the official launch of the DCW Strategies Center website at https://acl.gov/dcwcenter. This website is intended to serve as the national hub for resources about best practices, promising strategies, upcoming events, webinars, and technical assistance opportunities to strengthen and expand local direct care workforces.

CMS acknowledges in the announcement that low wages, lack of benefits, limited opportunities for career growth, and other factors have resulted in a continuing shortage of critical workers. The shortage reached crisis levels, says CMS, during the COVID-19 pandemic and currently continues, with more than three-fourths of service providers that decline new clients and more than half of providers cutting services.

According to CMS, the problem described above must be addressed in order to help ensure that people who need assistance have options other than moving to a nursing home or other institutional setting.

Now is the time for providers of private duty or home care services and the associations that represent them to work intensively with state programs, especially Medicaid Programs, to maximize available assistance as described above.

©2024 Elizabeth E. Hogue, Esq. All rights reserved.

No portion of this material may be reproduced in any form without the advance written permission of the author.

Somebody Messed Up!

by Elizabeth E Hogue, Esq.,

After a hospitalized patient suffered a severe choking incident and was placed on life support, his family faced a difficult decision in response to a telephone call from the hospital. They were asked if they wanted to remove life support. The family told the hospital that they did. The hospital subsequently removed life support and the patient passed away. Then came something that no one expected: the patient who was allegedly deceased telephoned his family!

The mix-up started with a call to 911. Medics responded to a call about a choking incident involving a piece of steak. The man who choked was not breathing and was unconscious when they arrived. Somewhere along the line, the patient was misidentified and treated as another patient.

Mistaken Identity

Parents that were called to make life-ending decision for wrong person

The family of the living patient called non-emergency police services to notify authorities that the patient was not, in fact, deceased. The Medical Examiner’s Office retrieved the body from the funeral home, conducted an external examination, and used fingerprints to confirm the deceased patient’s identity. In a gross understatement, a member of the patient’s family said, “Somebody messed up.”

Although the consequences of decision-making by so-called “substitute decision-makers” are not usually so dire, the fact remains that providers and practitioners are obligated to seek informed consent from those authorized to give it when patients cannot consent for themselves.

Here are some questions that providers frequently ask about substitute consent:

If patients cannot consent, who can consent on their behalf?

The answer to this question varies depending on the laws of the state in which patients reside. Consent may be provided on behalf of incapacitated adults by:

  1. An attorney-in-fact, i.e., someone who has authority under a durable power of attorney
  2. Individuals authorized to consent under state substitute consent statutes
  3. Guardians or conservators of the person
  4. Courts

How old must patients be in order to be able to give valid informed consent?

Generally, patients must have reached the age of adulthood before they can give informed consent. The age at which individuals become adults, as opposed to minors, is defined by state law, so the age of adulthood varies from state to state. Practitioners who provide services in multiple states must take this fact into account when obtaining consent. When minors are unable to consent, the general rule is that their parents may give substitute consent on their behalf.

Are there any exceptions to this rule?

Yes. Patients who are not adults, but who seek certain types of care, such as treatment for sexually transmitted diseases, or who are “emancipated” may consent on their own behalf depending on the law in the state in which the patient resides.

What evidence of valid informed consent should practitioners obtain?

Providers may:

  1. Ask patients to sign a consent form
  2. Document consent in patients’ charts with or without patients’ signatures on the documentation
  3. Record consent
  4. Video the consent process
  5. Give patients a short written quiz on the material provided and, if patients answer the questions correctly, put a copy in patients’ charts
  6. Utilize any other credible forms of evidence of consent

The above case certainly illustrates the need to make sure that consent is obtained from appropriate givers of substitute consent and to document their authority.

©2024 Elizabeth E. Hogue, Esq. All rights reserved.

No portion of this material may be reproduced in any form without the advance written permission of the author.