The settlement highlights that hospitals, physicians, and other covered entities must understand the importance of monitoring the level of access workforce members have to medical and health information. Covered entities must have policies and procedures in place and educate workforce members about only accessing records for necessary and permissible purposes. This settlement resulted from an investigation by OCR after certain celebrity/VIP patients at the UCLA facilities complained that hospital staff, including unauthorized physicians, had inappropriately accessed their health and medical information.

UCLAHS agreed to a Corrective Action Plan for a period of three years under the terms of the Resolution Agreement. The Corrective Action Plan requires UCLAHS to review/update its current HIPAA policies and procedures, conduct follow up workforce training, monitor compliance and submit a monitoring plan, and submit an implementation report and annual reports to OCR. of can be found attached to the Resolution Agreement.

The Resolution Agreement described the events that occurred that lead to the settlement as follows:

On June 5, 2009 and June 30, 2009, HHS began investigations of two separate complaints alleging that the Covered Entity was in violation of the Privacy and/or Security Rules. The investigations indicated that the following conduct occurred (Covered Conduct):

(i) During the period from August 31, 2005 to November 16, 2005, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of Covered Entity patients, and during the period from January 31, 2008 to February 2, 2008, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of a Covered Entity patient.

(ii) During the period 2005-2008, a workforce member of Covered Entity employed in the office of the Director of Nursing repeatedly and without a permissible reason examined the electronic protected health information of many patients.

(iii) During the period 2005-2008, Covered Entity did not provide and/or did not document the provision of necessary and appropriate Privacy and/or Security Rule training for all members of its workforce to carry out their function within the Covered Entity.

(iv) During the period 2005-2008, Covered Entity failed to apply appropriate sanctions and/or document sanctions on workforce members who impermissibly examined electronic protected health information.

(v) During the period from 2005-2009, Covered Entity failed to implement security measures sufficient to reduce the risks of impermissible access to electronic protected health information by unauthorized users to a reasonable and appropriate level.

 More information and background can be found in the iHealthBeat article, UCLA Health System Agrees to Pay $865K over Privacy Breaches, including a link to a statement on the settlement issued by UCLH Health System.

The 4th Circuit Decision in West Virginia Department of Health and Human Resources, Bureau for Medical Services vs. Kathleen Sebelius, et al. ruled that CMS acted within its authority when it withheld from the West Virginia Department of Health and Human Resources, Bureau of Medical Services, West Virginia’a Medicaid Program (DHHR) approximately $634,000 (which was reduced to approximately $446,000)in Medicaid funding, which represented it share of overpayment made to providers as a result of Dey, Inc., a pharmaceutical company, alleged fraud. CMS notified DHHR of the disallowance after Dey entered into an $850,000 settlement of claims brought by the West Virginia Attorney General on behalf of West Virginia under West Virginia’s Consumer Credit and Protection Act.

The disallowance by CMS was calculated by multiplying the state’s estimated damages allocable to Medicaid, approximately 67% by the settlement amount adn then multiplied this figure by West Virginia’s FMAP rate of 78.14% to arrive at the $446,000 amount. The HHS Department of Appeals Board concluded that this allocation methodology was reasonable.

I have only done an initial review of the decision and won’t go into the merits of the arguments at this time. Read the full decision for a more complete understanding of the decision and check out today’s article in the Charleston Daily Mail.

I hope you enjoyed my presentation during the afternoon health care social media sessions at the 2011 American Health Lawyers Association Annual Meeting in Boston. The health care social media sessions this afternoon were a great introduction to a variety of practical and legal issues surrounding the world of social media and its impact on the health care industry.

Now it is time for you to do your “out of the classroom” social media assignment using the SOCIAL MEDIA bucket list. Click on the linked Google Doc and get started. Good luck!

Below is a copy of the written materials from today’s session which were posted here using Scribd. If you want to review my Prezi slides from my presentation watch it below and then go explore Prezi. 

If you have any questions send me a Tweet at @BobCoffield. Follow along with the tweets from the AHLA Annual Meeting at #AHLABoston. David Harlow (@HealthBlawg) also set up a Cover It Live Twitter feed for the Annual Meeting tweets. Thanks for attending the session.

How to Use Social Media (AHLA Annual Mtg – Coffield)

Come join us at the #AHLABoston TWEETup on Tuesday, June 28 starting around 5:30pm at the BrasserieJO bar located across from the Prudential Center at The Colonnade Hotel, 120 Huntington Avenue. The BrasserieJO is located down Huntington Avenue near the Boston Marriott Copley Place, the location of the annual meeting.

Check out the TwtVite set up by David Harlow at HealthBlawg and RSVP that you will be attending. Help us spread the word.

The TWEETup follows an afternoon of health care social media and the law sessions held as a part of the AHLA Annual Meeting. For full details of the sessions and registration information check out the AHLA Annual Meeting schedule here (PDF version).The sessions run from 2pm – 5:30pm and will include:

A Legal Ethics Safety Line for Health Lawyers Online: How to Practice Safe Social Networking
Alan S. Goldberg (@GoldbergLawyer), Annie Hsu

E-Discovery Litigation
Gary L. Kaplan (@Gary_L_Kaplan), Joshua P. Kubicki (@JKubicki)

Cutting the PowerPoint Clutter: Using Zen-Like Visuals for more Compelling and Memorable Presentations
Susan Peterson

Should Health Lawyers Use Social Media?
David Harlow (@HealthBlawg)

HIPAA Privacy Issues in Social Media
Jodi Goldstein Daniel (@JodiDaniel), Daniel S. Goldman (@danielg280)

How to Use Social Media
Robert L. Coffield (@BobCoffield), David Harlow (@HealthBlawg), Gary L. Kaplan (@Gary_L_Kaplan)

Triaging Social Media in the Healthcare Workplace: Assessment, Analysis and Action
Mark W. Peters

A special thanks to @HealthBlawg for helping find the location for the TWEETup. Thanks to all the AHLA health lawyer and others spreading the word about the tweetup. Be sure to follow @HealthLawyers and use the AHLA Annual Meeting hashtag: #AHLABoston.

Here are the “proposed amendments” to the Megavoltage Radiation Therapy Services/Units. Here is a link to the current CON Standards for Megavoltage Radiation Therapy Services/Unit (Approved by Governor on October 9, 2002).

Written comments must be submitted to Tim Adkins, Director of Certificate of Need, at the West Virginia Health Care Authority, 100 Dee Drive, Charleston, West Virginia 25311, no later than July 15, 2011.

Recently I have been preparing a presentation for the AHLA Annual Meeting at the end of June on the practical ways health lawyers can and should use social media. As a result I have tried to step back from the social media explosion to examine some of these issues, including the parallels between Mark Zuckerberg and Johannes Gutenberg referenced in Mr. Keller’s piece.

I love this quote from Mr. Keller’s article that helps visualize the innovation/disruption/impact cycle:

“My father, who was trained in engineering at M.I.T. in the slide-rule era, often lamented the way the pocket calculator, for all its convenience, diminished my generations math skills. Many of us have discovered that navigating by G.P.S. has undermined our mastery of city streets and perhaps even impaired our innate sense of direction. Typing pretty much killed penmanship. Twitter and YouTube are nibbling away at our attention spans. And what little memory we had not already surrendered to Gutenberg we have relinquished to Google. Why remember what you can look up in seconds?”

I also like his explanation of Twitter as a tool, “So let me be clear that Twitter is a brilliant device a megaphone for promotion, a seine for information, a helpful organizing tool for everything from dog-lover meet-ups to revolutions.”

His question around whether these new social media instruments are genuinely social is a good one. It is hard to see the answer to this when you are sitting in the midst of the social media cloud. One question that he doesn’t address is how the collection of all this “collective social media data” about you and me will be used in the future. Is Facebook just one big social experiment. It now knows more about my family and friends than I can probably remember.

Take time away from your Twitter and Facebook posts, go read the article, and then sit back and take some quiet time to reflect on his message. I will leave you with this quote from Mr. Keller’s article:

“The things we may be unlearning, tweet by tweet complexity, acuity, patience, wisdom, intimacy are things that matter.”

Thanks to Jason Keeling (@JasonKeeling) for pointing out this insightful piece that was published back in print on May 22, 2011.

The panel discussion was part of the Annual J.P. Morgan Healthcare Conference held in January 2011.

To start off moderator, John Doerr has the audience rattle off a bunch of great questions for the panel to address. Just listening to the questions will make you want to listen to the panel discussion.

Thanks to Susannah Fox and Claudia Williams for tweeting the link. Thanks to Brian Aheirs for posting the Vimeo link to the panel discussion.

More information about  HEAT Task Force and its mission and efforts can be found on the StopMedicareFraud website. The training information includes 16 modules:

Welcome Remarks 4:37
Overview of OIG 9:56
Navigating the Fraud and Abuse Laws 26:26
Compliance Program Basics 17:01
Operating an Effective Compliance Program 15:59
Understanding Program Exclusions 10:26
Navigating the Government 5:10
Overview of Centers for Medicare and Medicaid Services 34:24
Importance of Documentation 17:06
OIG Subpoenas Audits Surveys and Self Disclosure Protocol 17:42
Health Care Fraud Enforcement Panel 6:08
Health Care Fraud Enforcement Panel with CMS Deputy Admin 13:43
Health Care Fraud Enforcement Panel with Special Agent 15:10
Health Care Fraud Enforcement Panel with Asst. US Attorney 17:08
Health Care Fraud Enforcement Panel – Fraud Control Unit 11:15
Adjournment 0:59

HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act, Office for Civil Rights, Notice of Proposed Rulemaking (76 FR 31426, May 31, 2011)

The regulations greatly expand the responsibility for health care covered entities and business associates to document and track the use and disclosure of health information held in an electronic health record (EHR). Health care providers and business associates should plan to thoroughly review these new regulations to understand the impact on their existing policies and procedures.

The regulations outline new procedures for accounting of disclosures of health information held in an electronic health record and disclosed for treatment, payment, and health care operations (as defined under HIPAA). The accounting period under the proposed regulations is three years. The proposed regulations focus on two rights for individuals — a right to an accounting of disclosure and a “new” right to an access report. The new access report does not distinguish between a use (think internal use by a health care provider) and disclosure (providing the information to a third party). Instead the new right to an access report focuses on whether someone “accessed” the information in the EHR.

Previously under HIPAA, uses and disclosures for treatment, payment, and health care operations (commonly referred to as “TPO”) were exempt from the accounting of disclosures requirements. The requirement for accounting for some limited uses and disclosures has always been a part of the HIPAA Privacy Rule.

The rule proposes separate compliance dates for the changes to the accounting of disclosures requirements (180 days after the effective date of the final rule – 240 days after publication of the final rule) and for the right to receive an access report (beginning January 1, 2013, for any EHR system acquired after January 1, 2009 and January 1, 2014, for any EHR system acquired on or before January 1, 2009).

My initial comments above are based upon a quick review of the proposed regulations. Official comments on the NPRM must be submitted on or before August 1, 2011.

The Centers for Medicare & Medicaid Services Medicare Learning Network has issued a fact sheet on Comprehensive Error Rate Testing (CERT) Signature Requirements with the Q and A. Also mentioned in the guidance as a resourceis the Medicare Learning Network’s MLN Matters Article MM6698, “Signature Guidelines for Medical Review Purposes.”