Health information privacy provisions included in the federal stimulus package amount to a "massive" expansion of HIPAA, said a Milwaukee lawyer participating in a conference discussion about its legal and financial implications. Mark Garsombke, a shareholder in Milwaukee-based Whyte Hirschboeck and chairman of the firm's HIPAA practice group, said the new health privacy provisions, included in the HITECH Act embedded within the stimulus bill, apply HIPAA regulations beyond health care providers to the outside accountants, lawyers and others professional they engage.
There is also a requirement included in the legislative, Mr. Garsombke said, that would require health care professionals and their business associates to notify a patient if his or her health record becomes "unsecured." It also contains what Mr. Garsombke called "shaming provisions" that require providers to notify the media and their state health department if more than 500 health records are breached.
Mr. Garsombke said that business associates, as outside service providers are called under HIPAA, now must act like the health care providers or plans they work for in terms of HIPAA. Health care providers and plans may like these provisions because they will force business associates to be more careful, Mr. Garsombke said. But it also may create a burden for them because they may have to redo the agreements they have with their outside consultants regarding the personal health information to which their work exposes them.
Mr. Garsombke began the discussion with an overview of the American Recovery and Reinvestment Act's (ARRA) HIT provisions. There are five key elements of these provisions, including promotion of electronic health records (EHR), creation of standards for the use and exchange of health information, and grant, loan and incentive funding to drive the adoption of EHRs.
Mr. Garsombke also said the stimulus package includes funding for Medicare incentive payments. These payments will be made based on the adoption and use of EHRs. Health care providers, however, must meet the definition of "meaningful use" of EHRs to qualify for the payments.
Dan Miller, a Whyte Hirschboeck lawyer who led the panel, reinforced the points made earlier about the Medicare incentives. Once a provider gets to 2015, Mr. Miller said, its reimbursement will decline if EHRs are not implemented and being used.
Dr. Charles Kennedy, a panelist who is vice president of HIT at WellPoint Inc., said that Congress "split the difference" as it deliberated on the ARRA between stimulating the economy and driving the adoption of HIT, most notably EHRs. Denise Webb, the state eHealth program manager, said there is significant variation in the adoption of EHRs by physicians across Wisconsin. Among the state's rouhgly 15,000 physicians, 63 percent are in group practices of more than 100 physicians. Ninety-five percent of those physicians have access to EHRs. The percent of physicians with access to EHRs in medium and small group practices is significantly lower, as low as 10 percent in some cases, Ms. Webb.
As the discussion turned to the conference audience, Mr. Garsombke said that he believes provisions the HITECH Act may mean that HIPAA regulations may be enforced more vigorously. Regulators, Mr. Garsombke said, already are becoming more aggressive. Dr. Kennedy said in a follow to Mr. Garsombke's comments that Google and Microsoft are using their new personal health record solutions to get around HIPAA compliance. Mr. Garsombke said that PHRs would seem to be outside of HIPAA requirements, but still might face enforcement actions from the Federal Trade Commission for a breach of records violation.
Comments