Privacy & Security

This covers the gamut of patient information privacy and security concerns related to the use of information technology to create, access, maintain, or transmit patient health information, regardless of whether that technology is via an electronic health record, a patient portal, a personal electronic health record hosted by a web or mobile app, medical device technology, a mobile medical application, web-hosted medical device software, or any other form of electronic technology.

Conversion to electronic health record and retention of paper records

Kathie McDonald-McClure Electronic Health Records, Federal Law Resources, Health Information Technology, HITECH Law, Privacy & Security , , ,

Editor’s Note: Due to the continued popularity of this post, this article was reviewed and updated on September 30, 2013. For the later version, click here.

Update: On August 8, 2010, Medicare issued MLN Matters Article SE1022 on Medical Record Retention and Media Formats for Medical Records, which states that the Centers for Medicare and Medicaid Services (CMS) requires records of providers submitting cost reports (most hospitals) to be retained in their original or legally reproduced form (which may be electronic), for at least 5 years after closure of the cost report.

Many hospitals have electronic health records (EHRs) that are hybrid digital records. While the hospital may be using electronic data entry in the ER, inpatient nursing care, pharmacy, lab, and pre-op anesthesia, oftentimes, these EHRs are not integrated and, thus, are not merged into a single EHR. The short-term solution may have been to scan printed records from some department, like lab or pharmacy, into the patient’s on-line digital record. As a result, the hospital’s “electronic health record” contains information that is not captured in a “coded format.”  For one, this will not meet the Stage One “meaningful use” criteria under the HITECH Act.

But let’s assume that the hospital can overcome this hurdle by working with vendors to integrate these records in a way that will meet HITECH EHR certification standards.  If the hospital has been maintaining certain portions of patient records in a paper format, what does it do with those paper records after converting to an EHR?   If the hospital scans all the paper patient records into its EHR, how long should the hospital retain the paper record after it is scanned into their EHR? 

Continue reading →

Event in Louisville, KY to focus on “Meaningful Use” under HITECH

Kathie McDonald-McClure Electronic Health Records, Eligible Professional Incentives, Health care reform, Health Information Technology, HITECH Law, Hospital EHR Stimulus, Meaningful Use, Physician EMR Stimulus, Privacy & Security , , , , , , ,

On January 19, 2010, the Greater Louisville Health Enterprises Network together with Healthcare Information and Management Systems Society, Bluegrass Chapter, will present a panel presentation with discussions surrounding the next steps under the Health Information Technology for Clinical and Economic Health Act (HITECH), part of the American Recovery and Reinvestment Act (ARRA) of 2009.

Expert panelists include:

  • Rick Chapman, CIO, Kindred Healthcare & Member, HITSP Panel
  • Kathie McDonald-McClure, Esq., Wyatt Tarrant & Combs, LLP
  • Joe DeVenuto, CIO, Norton Healthcare

Moderated by Greg Aaron, Past Chapter President Bluegrass HIMSS and Board Member, Health Enterprises Network

Time & Location:

  • 5:30 – 6:00 p.m.  Wine Reception.
  • 6:00 – 7:30 p.m. Dinner & Panel Discussion
  • Sheraton Louisville, Riverside, 700 West Riverside Dr., Jeffersonville, IN 47130

Registration Information: $35 members; Tables available $245

To learn more about the Health Enterprises Network, click here.

Use of electronic communications with patients

Kathie McDonald-McClure Electronic Health Records, Federal Law Resources, Health Information Technology, HITECH Law, Meaningful Use, Privacy & Security , ,

The Office of National Coordinator for Health Information Technology (ONC) and its HIT Policy Committee worked hard throughout the summer to develop a framework for the “meaningful use” standards required to qualify for electronic health record (EHR) adoption stimulus funds available under the Health Information Technology for Economic and Clinical Health Act (HITECH Act).  When I saw the survey that HIMSS released today regarding the use of social networking tools to communicate with patients, it reminded me of the “meaningful use” standard that centers on “engaging patients and families.”  The stated goal of this standard is to “Provide patients and families with timely access to data, knowledge, and tools to make informed decisions and to manage their health.” Although it’s doubtful today that social networking tools would be accepted as meeting this goal for purposes of the EHR stimulus funds, it did get me to thinking about the use of technology to literally communicate with patients and, in particular, the studies that have been done in regard to using technology, such as e-mail and texting, to communicate with patients.  

Continue reading>>

HHS Office of National Coordinator Announces Reorganization

Kathie McDonald-McClure Health Information Technology, HITECH Law, Privacy & Security , , , ,

The Department of Health and Human Services (HHS) published a Notice in the Federal Register, December 1, 2009, Volume 229, No. 74, that it has reorganized the HHS Office of National Coordinator for Health Information Technology (ONC).  The stated purpose of the reorganization was “to more effectively meet the mission outlined by The Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA).”  The new structure establishes the following five offices that all report to the National Coordinator of the ONC:

  1. Office of Economic Modeling and Analysis;
  2. Office of the Chief Scientist;
  3. Office of the Deputy National Coordinator for Programs & Policy;
  4. Office of the Deputy National Coordinator for Operations; and
  5. Office of the Chief Privacy Officer.

The immediate “Office of the National Coordinator,” which also reports to the ONC National Coordinator, constitutes a sixth component.

Notably, implementing the Office of Chief Privacy Officer is a new role for the ONC.  The primary responsibilities of the Officer of Chief Privacy Officer are twofold: “(1) advising the National Coordinator on privacy, security, and data stewardship of electronic health information and (2) coordinating the [ONC’s] efforts with similar privacy officers in other Federal agencies, State and regional agencies, and foreign countries with regard to the privacy, security, and data stewardship of electronic, individually identifiable health information.” The Chief Privacy Officer will primarily advise the National Coordinator, but also may report to other individuals as necessary.

HHS launches new Health IT blog

Kathie McDonald-McClure Electronic Health Records, Health Information Technology, HITECH Law, Hospital EHR Stimulus, Meaningful Use, Physician EMR Stimulus, Privacy & Security, State HIT Grants & Loans , , , ,

On Monday, November 23, 2009, Dr. David Blumenthal, the National Coordinator for Health Information Technology under the Department of Health & Human Services, announced the launch of the Health IT Buzz blog.  The blog is envisioned as a way to reach out to the healthcare IT community and public at large in order to create an open dialogue about the wishes and concerns of the many constituencies that the Office of National Coordinator serves.  The blog will address the wide range of topics impacting the “secure and seamless exchange of electronic health information” across the United States and will include discussions about the “meaningful use” rulemaking and incentives for adopting electronic health records.   We’ve added the Health IT Buzz to our blogroll.