Privacy and Health Law 9182012 ISC 471HCI 571

Privacy and Health Law 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 1

Learning Objectives • Explain why health information management professionals must be knowledgeable about medico legal issues. • Distinguish between confidential and non confidential information within a health information system. • Describe general legal principles governing access to confidential health information in a variety of circumstances. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 2

Learning Objectives • Distinguish proper or valid requests for access to health information from improper or invalid requests. • Describe the four components of negligence. • Distinguish between properly executed consents and authorizations and incomplete or improper consents and authorizations. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 3

Why are Legal Issues So Important to Health Information Management Professionals? • Health care providers are required by law to maintain health records. • Some requests for health information are legitimate while others are not. • HIM professionals must make decisions about what information can and cannot be disclosed. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 4

Why are Legal Issues So Important to Health Information Management Professionals? Fundamentals of the Legal System • Laws govern: – Private relationships • Relationships between private parties – Public relationships • Relationships between private parties and the government 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 5

Why are Legal Issues So Important to Health Information Management Professionals? Fundamentals of the Legal System • Private Law consists of: – Tort actions • Is allegation that one party’s wrongful conduct has caused another party harm • Wronged party seeks damages. – Contract actions • Is allegation that a contract exists between two parties and that one party has breached that contract in some manner. • Wronged party seeks compensation or a court order to enforce the contract. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 6

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law • Health Care Law comes from four main sources: – Federal and state constitutions – Federal and state statutes – Rules and regulations of administrative agencies – Court decisions 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 7

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law – Constitutional Law • Constitution is the highest law in the United States. • If there is a conflict between the Constitution and other laws, the Constitution overrides the other law. • When a law is found to be “unconstitutional” it means that it conflicts with the Constitution, making that law invalid. 9/18/2012 ISC 471/HCI 571 Isabelle 8 Bichindaritz

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law – Constitutional Law • U. S. Constitution also limits the powers of the federal and state governments. – Bill of Rights protects specific rights of the citizens. • Example: The people are protected from deprivation of property without due process. • In a public health facility, a physician’s appointment to the staff is considered a property right. • The physician cannot be terminated without due process, such as a full hearing. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 9

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law – Constitutional Law • The right of privacy: – Very important in health care – Not an express right in the Constitution – Basic definition is the right to: • Be left alone • Make decisions about one’s own body • Control one’s own information 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 10

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law – Federal and State Statutes • Examples of Laws that affect health care facilities are: – Americans with Disabilities Act – Safe Medical Devices Act – American Recovery and Reinvestment Act of 2009 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 11

Why are Legal Issues So Important to Health Information Management Professionals? Sources of Law – Federal and State Statutes • If there is a conflict between federal and state law, federal law controls. • If there is conflict between state and local law, state law controls. • Therefore the hierarchy of laws is: Constitution federal law state law local law 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 12

The Legal System The Court System Federal Courts • Three levels of courts: – Trial courts – Intermediate courts of appeal – Supreme court • Federal trial courts: U. S. district courts • Appeals from U. S. district courts go to a U. S. court of appeals. – There are 12 circuits, each has its own court of appeals. 9/18/2012 ISC 471/HCI 571 Isabelle 13 Bichindaritz

The Legal System The Court System State and Territory Courts • States typically have three levels of courts just like the federal government: – The names of the courts vary by state, but they still generally include: • Trial courts • Intermediate courts of appeal • A high court • Some state trial courts are further divided into specialty courts such as: – Traffic court – Probate court – Family court 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 14

The Legal System Cases that Involve Health Care Facilities and Providers – Malpractice and Negligence • Negligence: – Conduct that society considers unreasonably dangerous because: • The party knew or should have known that the conduct (or absence of conduct) would subject others to an appreciable risk of harm. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 15

The Legal System Cases that Involve Health Care Facilities and Providers – Malpractice and Negligence • Two theories to hold the hospital responsible for the conduct of its employees: – Respondeat superior: 9/18/2012 • Literally means let the master answer. • Legal system holds the health care organization responsible for the negligent actions of the organization’s employees or agents when their actions are performed within the scope of their employment. ISC 471/HCI 571 Isabelle Bichindaritz 16

The Legal System Cases that Involve Health Care Facilities and Providers – Malpractice and Negligence – Corporate negligence: • Corporate negligence is when courts hold health care organizations liable for their own acts of negligence. • Organizations responsible for monitoring the activities of all the people who function within their facilities. • Includes employees and independent contractors (such as physicians). • Organizations also responsible for complying with appropriate industry standards. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 17

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Claims against health care facilities may include: – Assault – Battery – False imprisonment – Defamation of character – Invasion of privacy – Fraud or misrepresentation – Intentional infliction of emotional distress 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 18

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Assault: – Is a deliberate threat + the apparent ability to do harm to another person without that person’s consent. – Does not require any actual physical contact. – Victim must be aware of the threat. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 19

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Battery – Battery is touching another person in a socially impermissible manner without consent. – Victim does not have to be aware of the touching. – Consent may be implied – when an unconscious person is treated in a facility for life-saving treatment. – This is primary reason that written consent is required for all procedures. – Does not matter if the treatment would help the patient. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 20

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • False imprisonment: – – Unlawful restrain of a person’s personal liberty Unlawful restraining or confining of a person No requirement of physical force Does require the reasonable fear that force will be used to detain or intimidate the victim into following orders – Examples in this context: • Refusing to let a patient leave until the bill is paid • Use of physical restraints only because of understaffing to monitor patients 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 21

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Defamation of character: – Two types: • Slander – oral • Libel – written – Is a communication that tends to damage the defamed person’s reputation in the eyes of the community. – Must show communication to a third party. – A defense to defamation is truth of the statements. – If the statement occurs during a privileged communication (example, confidential communications between spouses, discussion with a priest) there is no defamation unless there was a malicious intent. – Is rare in a health care context. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 22

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Invasion of privacy: – Very important in a health care context – Negligent disregard for a patient’s privacy can result in: • A tort claim • Regulatory penalties • Criminal penalties – Invasion of privacy includes: • Divulging confidential information from a patient’s record to an improper recipient without the patient’s consent 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 23

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Fraud: – Willful and intentional misrepresentation that could cause harm or loss to a person or the person’s property – May include: • Improper billing for procedures not performed • Deliberately coding incorrectly to gain a higher payment • Promising a certain surgical result when not certain 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 24

The Legal System Cases that Involve Health Care Facilities and Providers – Intentional Torts • Intentional infliction of emotional distress – Must be intentional – Must actually cause significant emotional distress 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 25

The Legal System Cases that Involve Health Care Facilities and Providers – Crimes and Corporate Compliance • Health Information Portability and Accountability Act of 1996 (HIPAA), the Balanced Budget Act, and the Federal False Claims Act all impose penalties for health care providers who engage in fraudulent practices. – May include criminal sanctions. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 26

The Legal System Cases that Involve Health Care Facilities and Providers – Noncompliance with Statutes, Rules, and Regulations • Failure to comply with government imposed statutes, rules, and regulations can lead to: – Monetary penalties – Criminal penalties – Removal from participation in Medicare – Loss of licensure 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 27

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duties to Patients in General • Patients have certain rights in connection with their health care. • These rights are established by laws, rules, regulations, ethical codes, or the Constitution. • These laws alert the patients to their rights and provide remedies for the patient if health care providers fail to respect their rights. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 28

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Health Information • HIPAA outlines what documents must be maintained for patient access and use as part of a designated record set (DRS). • Patients must be able to access the information in the designated record set for at least 6 years. • Designated Record Set for a covered entity include: – The medical records and billing records about individuals maintained by or for a covered health provider – The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan – Use, in whole or in part, by or for the covered entity to make decisions about individuals 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 29

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Health Information • Implied duty to maintain health information can be found within: – Vital statistics laws – Mandatory reporting does not require patient consent, in fact may be done over express request by the patient not to report. – Natural tension between reporting requirements and confidentiality 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 30

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Health Information • Laws requiring the reporting of certain diseases and medical events: – – – – 9/18/2012 Gunshot wounds Suspected child abuse Elder abuse Industrial accidents Certain poisonings Abortions Cancer cases Communicable diseases ISC 471/HCI 571 Isabelle Bichindaritz 31

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure • Administrative Simplification section of HIPAA is in part designed to stimulate the development of standards to facilitate electronic maintenance and transmission of health information. – In response DHHS adopted standards for electronically maintained health information and for electronic signatures. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 32

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure • HIM professionals must: – protect health care information from loss or destruction – prevent the corruption of electronically stored data from power losses and surges – protect the integrity of the information itself • protect from inappropriate alteration • control access to records • make special precautions for records involved in litigation 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 33

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure – Addenda • When new information is being added to a record • Patients may ask for an amendment to their record. – Generally will be granted unless it falls under a specific exception that allows for denial. – If granted, should be treated as an addendum to the record without change to the original entry. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 34

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure – Authentication and Authorship Issues • Authentication: – Identification of the author of a document or entry – Indication that the author has reviewed the entry for accuracy and attests to it – Paper: original signature or stamp – Electronic: use of a unique identification code and password 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 35

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure – Validity of Health Information as Evidence • Important reason to protect health records is for their potential use as evidence in court. • Hearsay Rule prohibits the admission into evidence of out-of-court statements (including written statements) unless they fall under one of the specific exceptions to the rule. • Health records are often considered an exception to the “hearsay rule. ” • Exceptions are generally circumstances where there is a presumption of reliability. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 36

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Retain Health Information and Other Key Documents and to Keep Them Secure – Validity of Health Information as Evidence • Judge makes a determination as to whether or not the medical records will be admitted as evidence as an exception to the hearsay rule. • The HIM professional is often responsible for testifying in court that the health record is kept in the normal course of business. • Best evidence rule: If the original record exists, it must be provided; if not, a copy may be deemed acceptable if it can be authenticated properly. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 37

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality • Communications between patients and their health care providers are confidential. • Health care workers are bound to maintain the confidentiality of private health information. • A primary goal of HIPAA is to protect the confidentiality of protected health information. • Organizations required to provide patients with a notice of their privacy practices. • Not all information in the health record is protected so it is important that health care workers understand what is and is not confidential • If the state has more restrictive rules on confidentiality, they will govern, HIPAA would not override 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 38

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality • HIPAA definition of protected health information: – Individually identifiable health information that is transmitted by electronic media, maintained in any medium described as electronic media, or transmitted or maintained in any other form or medium 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 39

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality • Definition of individually identifiable health information: – Information that is a subset of health information, including: • Demographic information • Information created or received by a health care provider, health plan, employer, or health care clearinghouse • Relates to the past, present, or future physical or mental health or condition of an individual • Relates to the provision of health care to an individual • Relates to the past, present or future payment for the provision of health care to an individual • That which identifies the individual. • Information that could reasonably be believed to identify the individual 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 40

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality • HIPAA privacy rule used to only apply to covered entities, it has recently been expanded to include the covered entities business associates. – Covered entity: • Health care provider that conducts certain transactions in electronic form • A health care clearinghouse • A health plan • Business associate agreement: used when a health care organization contracts out to a third party to handle or process personal health information (including billing). 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 41

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality – Privacy Act of 1947 • Designed to give citizens some control over the information that the federal government and its agencies collect • Grants people the right to: – – Find out what information about them has been collected See and have a copy of that information. Correct or amend the information. Exercise limited control of the disclosure of that information to other parties. • Applies to: – Health care organizations operated by the federal government – Record systems operated pursuant to a contract with a federal government agency 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 42

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality – Freedom of Information Act • Requires that records pertaining to the executive branch of the government be available to the public. • Exception is matters that fall within nine explicitly exempted areas. • One of these areas sometimes includes medical records: – Personnel and medical files and similar files, the disclosure of which would constitute a clearly unwarranted invasion of personal privacy. ” – Unwarranted invasion of personal privacy: • Information is contained in a personnel, medical, or similar file. • Disclosure constitutes an invasion of personal privacy. • Severity of the invasion outweighs the public interest in disclosure. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 43

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Maintain Confidentiality – Regulations on Confidentiality of Alcohol and Drug Abuse Patient Records • Restrict disclosures of patient health information without patient authorization • Specifically apply to facilities that provide alcohol or drug abuse diagnosis, treatment, or referral for treatment • Facility must offer either: – An identified unit that provides alcohol or drug abuse diagnosis, treatment or referral for treatment – Medical personnel or other staff whose primary function is the provision of alcohol or drug abuse diagnosis, treatment, or referral for treatment 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 44

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Internal Uses and External Disclosures of Health Information • Internal uses may not need patient authorization. • Health care workers who are involved in the treatment of a patient have access, but this does not extend to employees of the organization who are not involved in the patient’s care. • Minimum necessary is only the minimum necessary amount of information to fulfill 9/18/2012 ISC 471/HCI 571 Isabelle 45 the request should be shared. Bichindaritz

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Internal Uses and External Disclosures of Health Information • Under HIPAA internal uses include: – Treatment – Payment – Health care operations • External disclosures often do not need patient authorization either. – Disclosure to a lawyer who represents someone other than the hospital would require authorization. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 46

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Health Information Ownership • Generally – the health facility owns the record but the patient has an ownership interest in the information within the record. • Patient maintains a right to control the flow of his or her private health information. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 47

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Resources on Releasing Patient Information • Organizations must set policies and have written procedures to guide staff in responding to requests for information. • Should use the most up-to-date resources available because laws change frequently. • Sources to help write the policies: – State HIM association legal manuals – Peers in other local facilities – AHIMA guidelines and practice standards 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 48

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Authorizations for Disclosure of Patient Information • Standards for what must be present in an authorization are included in: – HIPAA Privacy Rule – Regulations on Confidentiality of Alcohol and Drug Abuse Patient Records – Many state laws • HIM professionals have the responsibility to ensure that authorizations meet all applicable standards. • Violations of the standards set forth in the HIPAA Privacy Rule can result in penalties. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 49

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Direct Patient Care • Reasonable assumption that when a patient comes in for care, he or she authorizes the care providers to have information about his or her conditions and treatments. • HIPAA privacy rule allows internal uses of protected health information for treatment without patient authorization. – Does not include access for anyone in the facility who may be curious. • Internal use should still be restricted to those who need to know in order to treat the patient. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 50

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Direct Patient Care • In cases where the patient is being treated externally (by a new doctor, in a nursing facility) some or all the information from the record may need to be disclosed. – In these cases HIPAA Privacy Rule permits disclosure for treatment without authorization. – There may be other regulations (state-based) that do require authorization. • Conservative view – get authorization any time that there is an external disclosure except when an emergency prevents authorization. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 51

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Performance Management and Patient Safety • Health information sometimes is used to evaluate that quality of care and services provided to patients. • In these cases, it is not important who the patient is, just the procedures for treatment. – Records would be referred to by number so no names would be used. • HIPAA does not require authorization for use of health information in this context. • Important to verify that the requester in fact wants the information for quality management purposes. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 52

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Research • Also involves impersonal use of the records • It does not matter who the patient is, just the symptoms, treatment, and results. • Facility should still have a policy as to when records can be released for research without patient authorization. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 53

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Research • Researchers often have to have projects reviewed by an institutional review board. – Researcher may need to specify data security provisions. – HIM professional may need to review the data collection forms to ensure that patient-identifiable data are not to be included. – Special problems arise if the researchers want to contact patients directly. – Verifying the names and addresses of patients is possibly a breach of confidentiality. – The facility may agree to contact the patient on behalf of the researcher to determine the patient’s willingness to participate. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 54

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure for Payment Purposes • This is one of the most frequent disclosures of health information. • HIPAA does not require authorization for this purpose but some states do. • New regulations allow an option for patients to shield some information from their insurer. – Must be a circumstance where the patient is paying for the service in full out of pocket. • Complicated issue because the person whose information is going to the insurance company may not be the person who applied for coverage (generally a family member) – One solution is making the authorization for disclosure to the insurance company a part of the general consent to treatment. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 55

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Disclosure to Attorneys • Requires one of: – Written authorization from the patient or the patient’s legal representative – Valid subpoena that meets HIPAA’s special requirements • No authorization is required if the attorney represents the health care provider that owns the record. – Attorney for the hospital does not require authorization. – Attorney for an individual employee of the hospital does. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 56

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Health Information Management Department Security Measures to Prevent Unauthorized Access • Internal systems must protect health information from: – Loss – Theft – Destruction – Alteration – Unauthorized access 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 57

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Health Information Management Department Security Measures to Prevent Unauthorized Access • Important job of HIM professionals is to keep confidential information out of the hands of unauthorized users through: – Appropriate policies and procedures – Facility and space planning – Information systems design and selection – Staff education – Security management 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 58

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers General Principles Regarding Access and Disclosure Policies – Health Information Management Department Security Measures to Prevent Unauthorized Access • Policies and procedures should be specific as to who has access to what. • HIPAA rules require that access control decisions be based on need. – HIM professionals should never hesitate to verify the validity of a request. – Verification of employee identification is always important. 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 59

Legal Obligations and Risks of Health Care Facilities and Individual Health Care Providers Duty to Obtain Informed Consent to Treatment • It often means getting a patient to sign a form. • Informed consent is only valid though if it means that the patient and the health professional have had: – sufficient communication that the patient has information about the anticipated treatments and – the communication has met certain basic requirements • Duty to obtain informed consent is split into two basic parts: – Duty to obtain a general consent for treatment – Physician’s or surgeon’s duty to obtain a separate informed consent before the performance of surgery or other invasive procedure 9/18/2012 ISC 471/HCI 571 Isabelle Bichindaritz 60