Check Request Status610-994-7500

Heard on the Hill: A Call for Regulation of Attorney Misuse of Patient-Directed Requests

 

 

 

 

 

 

 

 

 

During the week of November 11, 2019, I visited Capitol Hill with colleagues from the Association of Health Information Outsourcing Services (AHIOS) to address concerns regarding patient access to medical records. As many HIM professionals are aware, in February 2016 the Office for Civil Rights (OCR) released guidance on patient access to health information that is being misused by third parties. During our time on Capitol Hill, we met with staffers from the offices of senators and state representatives of both parties to voice our opinions.

Protected Health Information: Help Make a Difference in Patient-Directed Requests

While this trip to Washington, D.C. was very successful, we will continue to make many trips in 2020 to voice our concerns to policymakers. One critical takeaway is that constituents (both hospitals and patients) need to reach out statewide to the people who can make a difference with regard to this issue. Constituents need to contact their senators and state representatives to express the struggles and hardships related to patient access in their respective states, growing privacy concerns, and in the case of hospitals, cost shifts back to your facility.

If a constituent’s state has a U.S. senator serving on the Health, Education, Labor and Pensions (HELP) Committee, then they should especially reach out to share their patient access concerns. MRO’s legal, privacy and compliance teams are available to all clients to assist in identifying HELP committee members, as well as other key senators and state representatives in their respective states.

Learn More About Protected Health Information

MRO is currently working alongside industry experts to make a difference on Capitol Hill.

To learn more about our visit and our 2020 initiatives, join me and my colleague, Rita Bowen, for our upcoming webinar by registering below.

Register for our webinar "Clearing the Confusion: Attorney Misuse of Patient-Directed Record Requests and How to Cope" on December 11, 2019 at 2pm EST

Read More

Misuse of Patient-Directed Requests for Copies of Medical Records

 

 

 

 

 

 

 

 

MRO has released the white paper, “Misuse of Patient-Directed Requests for Copies of Medical Records,” authored by two attorneys, Beth Anne Jackson, Esq. and Danielle Wesley, Esq., along with privacy expert Rita Bowen, MA, RHIA, CHPS, CHPC, SSGB. The paper provides insights, education and strategies to help hospitals, health systems and other healthcare provider organizations address issues that arise when attorneys solicit copies of medical records—often through record retrieval companies (RRCs)—under the guise of patient-directed requests.

Essential Guide to Understanding and Mitigating Financial, Legal and Privacy Risk

For Health Information Management (HIM) professionals, in-house attorneys and compliance officers, the tenets set forth in the paper serve as an essential guide to understand and mitigate problems associated with these attorney requests, including the rising financial burden imposed on providers when attorneys shift the costs of medical record production for litigation to providers. The following five areas are covered.

  • Perceived loophole in OCR guidance. The paper delves into the history of HIPAA, HITECH and patients’ right to access their Protected Health Information (PHI). This includes examining the language of 2016 OCR guidance that emphasized removal of financial and other roadblocks to individuals’ access to their information by advocating the imposition of a nominal fee for patients to obtain their PHI for personal use, such as providing records to their primary care physician, a mobile healthcare app or to researchers. Though applying a nominal fee for patient-directed disclosures to these types of entities is reasonable, the OCR’s inclusion of the phrase “and it doesn’t matter who the third party is” opened the door for manipulation by attorneys and RRCs demanding the $6.50 fee suggested in the guidance.
  • Increasing volumes of attorney requests under the guise of patient-directed requests. Submitted as patient-directed requests, attorney requests for medical records have soared with a specific pattern identified, which is described in the white paper. The volume of these types of requests is growing exponentially. MRO metrics show a steady increase in the number of attorney requests demanding the patient rate. Additionally, an increase in page count and a higher demand for “any or all” records from the designated record set (DRS) are consistently noted with these attorney requests.
  • Detrimental impact to healthcare systems and their patients. Neither Congress nor the OCR intended for the individual rights to access under 45 CFR §164.524(c) or the guidance to be interpreted and implemented to (a) shift the costs of obtaining medical records for the purpose of for-profit litigation or other non-healthcare related purposes to providers, (b) subject more PHI than necessary—including sensitive PHI that may or may not be related to the litigation—to disclosure, or (c) remove HIPAA protection resulting from disclosure via RRCs to attorneys. However, healthcare organizations are rightfully concerned about these risks. The paper details the detrimental financial, legal and operational impact to health system enterprises and the risks around patient privacy.
  • Recognizing the misuse of patient-directed requests for medical records. Providers should be aware of red flags when receiving incoming requests, including the following:
    • A template form with filled-in blanks and mismatched pronouns is used.
    • The form is included in a larger packet with other documents—such as a HIPAA-compliant authorization.
    • The patient’s signature appears to be copy-pasted or photoshopped. Attorneys or RRCs may lift the patient signature from a driver’s license or other document.
    • The letter is labeled a “HITECH authorization.” This terminology is only used by attorneys and RRCs that work with them.

    The paper provides a thorough list of signs indicating attorney misuse of patient-directed requests.

  • Steps for combating the issue. To combat this problem, healthcare organizations need a comprehensive game plan that includes education and awareness across HIM, compliance, legal, risk management and finance. New strategies must also be employed at the national level to raise awareness and garner support. In our paper, we offer a step-by-step approach to assist healthcare organizations in building their game plan.

Conclusion: For the Better Good

In summary, the white paper states, “The issue is not about prohibiting authorized access. The issue is about limiting the ability of attorneys and other third parties to manipulate the OCR guidance and patient-directed requests for their own commercial gain. Healthcare organizations that give in to attorney misuse of patient-directed requests may think that they are mitigating legal risk. Instead, they are welcoming negative financial impacts for themselves and potential adverse privacy effects for their patients. Producing thousands of pages of PHI for the nominal patient fee is not a business practice that can be sustained in the long term by any provider. This cost-shifting cannot be tolerated.

The efforts of attorneys and RRCs to obtain PHI via their mischaracterization of the guidance—which, to date, has not been challenged—is well documented and significantly more advanced than a lone provider’s ability to combat it. While providers are steadfast in protecting patient privacy, they also need to protect their fiscal health. They can only do so by taking concrete steps now to stop disreputable attorney and RRC behavior before the issue becomes a more serious problem and a financial crisis for provider organizations.”
The contents within our white paper are approved and endorsed by the Association of Health Information Outsourcing Services (AHIOS), a membership group composed of Health Information Management outsourcing organizations.

Complete the form on this page to request a copy of the white paper “Misuse of Patient-Directed Requests for Copies of Medical Records.”

Request the White Paper

Read More