HHS Amends CLIA to Broaden the Patient’s Access Rights to Lab Test Results

by Kathie McDonald-McClure and Elizabeth O’Keeffe

lab_specimensAs we have previously reported on the Wyatt HITECH Law blog on September 14, 2013 and September 23, 2011, the Department of Health and Human Services (HHS) has had in the works, for over two years now, revisions to the Clinical Laboratory Improvement Act of 1988 (CLIA) regulations concerning whether a lab may release test results directly to patients.  On February 3, 2013, HHS announced the release of a Final Rule (Final Rule) amending the CLIA regulations to allow laboratories to give a patient, or a person designated by the patient, his or her “personal representative”, access to the patient’s completed test reports upon the patient’s or patient’s personal representative’s request.  The Final Rule was issued jointly by three agencies within HHS: the Centers for Medicare & Medicaid Services (CMS), which is generally responsible for laboratory regulation under CLIA, the Centers for Disease Control and Prevention (CDC), which provides scientific and technical advice to CMS related to CLIA, and the Office for Civil Rights (OCR), which is responsible for enforcing the HIPAA Privacy Rule. Continue reading

Health Care Providers Need Not Meet Meaningful Use This Year to Remain Eligible for EHR Incentive Payments Next Year!

HITECH EHR Incentive Program PaymentsThe Electronic Health Records (EHR) Incentive Program was implemented by the Centers for Medicare and Medicaid Services (CMS) pursuant to the Health Information Technology for Clinical and Economic Health Act of 2009 (HITECH).  This Program provides incentive payments to Eligible Hospitals, Critical Access Hospitals and Eligible Providers (collectively, “eligible providers”) who make a Meaningful Use (MU) of certified EHRs.  Frequently Asked Question (FAQ) No. 9920 issued in November 2013 by CMS about the EHR Incentive Program deals with whether providers must participate in the Program every year in order to stay eligible for the incentives.  FAQ 9920 clarifies that eligible providers do not have to meet MU in the prior year to be eligible for EHR incentives the following year. Continue reading

Who Accessed My Health Records? Recommendation for Quality over Quantity in Access Reports

By Kathie McDonald-McClure, Ann F. Triebsch and Margaret Young Levi

Group of Healthcare Professionals
Accounting for Disclosures Would Include Disclosures of PHI to All Staff

The Office of National Coordinator (ONC) Health IT Policy Committee voted in December 2013 to recommend that the United States Department of Health & Human Services (HHS) scale back its 2011 proposed rules requiring covered entities to provide patients with reports showing the name of every staff member who accessed their information in an electronic health record (EHR). As reported by Government Health IT, the committee’s Privacy and Security Tiger Team opposes a requirement that entities covered by the Health Insurance Portability & Accountability Act of 1996 (HIPAA) give such broad “accounting of disclosure” reports to patients. Continue reading

OIG recommends fraud safeguards in hospital EHR technology

Doctors Using EHROn December 10, 2013, the Office of Inspector General for the United States Department of Health & Human Services (OIG) issued a report finding that hospital implementation of fraud safeguards in electronic health records (EHRs) falls short of the recommended standards. The report carries out one of the OIG’s 2013 Work Plan objectives to study how EHR technology may lead to improper payments by federal healthcare programs.  In its Work Plan, the OIG had noted that: “Medicare contractors have noted an increased frequency of medical records with identical documentation across services.”

The OIG’s findings were extracted from the responses to an on-line questionnaire to 864 hospitals that had received Medicare EHR incentive payments as of March 2012. The questionnaire focused on four EHR fraud safeguards: 1) EHR audit functions; 2) EHR user authorization and access; 3) EHR data transfer; and 4) patient involvement via the ability to access and comment within their EHR.   The OIG criticized the Centers for Medicare and Medicaid Services (CMS) and the Office of National Coordinator of Health Information Technology (ONC) for failing to incorporate recommended safeguards into meaningful use criteria and EHR certification standards.

Continue reading

CMS Extends Stage 2 Meaningful Use through 2016

Keyboard and stethoscopeOn Friday, November 6, 2013, the Centers for Medicare & Medicaid Services (CMS) and the Office of National Coordinator of Health Information Technology (ONC) announced its proposal to extend the timeline by which eligible healthcare providers must demonstrate a “meaningful use” (MU) of a certified electronic health record (EHR) in compliance with the MU Stage 2 criteria set forth in regulations issued pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.   Originally, eligible providers who demonstrated Stage 1 MU by the end of 2013 would have had to demonstrate at least 3 months of Stage 2 MU by September 30, 2014 for eligible hospitals and critical access hospitals (CAHs) and by December 31, 2014 for eligible professionals, do one more year of Stage 2 in 2015, and then move to Stage 3 by 2016.  The CMS – ONC apparently will give all eligible providers more time to stay in Stage 2, stating: “Under the revised timeline, Stage 2 will be extended through 2016 and Stage 3 will begin in 2017 for those providers that have completed at least two years in Stage 2.” In essence, the start of Stage 3 is being delayed and, apparently (pending further rule making), nothing else.

Continue reading