Counsel to Counsel - January 2008 - (Page 29) ELECTRONIC HEALTH RECORDS AND E-DISCOVERY The revised federal discovery rules on electronically stored information have a substantial impact on the electronic health records (EHRs) of provider organizations. EHRs encompass not only electronically stored records, files and correspondence, but also such items as calendars, diaries, images, bills, charts and spoken or handwritten notes. For example, EHRs requested by subpoena could be information stored by medical students and interns on PDAs, handheld recorders or similar devices to record what is taking place in an operating room or patient examination. EHRs raise other unique issues, such as privilege. All patient information is subject to Health Insurance Portability and Accountability Act (HIPAA) privacy protections, and the recorded deliberations of a patient safety committee or peer review committee are typically protected by statute—but e-discovery requests often still will include them. In-house counsel for health care providers should lead a proactive process to examine and understand the discoverable content of EHR systems, and to develop related EHR policies and procedures for the development, control, maintenance, disposal and production guidelines for all EHRs. This process should involve at minimum the general counsel, chief compliance officer and the senior administrators for human resources, information systems and risk management. Key components of the process should be auditing and mapping access to potentially privileged databases, and identifying the means of tracking and producing metadata (draft language and date/time file access records) that often are embedded in EHR and that can contain privileged information that should not be produced. COMPLIANCE WITH DRA COMMUNICATION PROVISIONS As of Jan. 1, 2007, health care employers receiving $5 million or more in revenue from Medicaid or other medical assistance plans are required by the Deficit Reduction Act of 2005 (DRA) to give employees, contractors and agents detailed information about false claims, false statements and whistleblower protections under applicable federal and state fraud laws. This requirement includes developing detailed written employer procedures for detecting and preventing fraud, waste and abuse. Employer information also must specifically discuss the federal False Claims Act and related statutes, and employees’ rights to be protected as whistleblowers under these laws if they report fraud, waste or abuse in federal health care programs. Compliance with these DRA provisions is a condition of receiving future Medicaid payments. Although the DRA does not require training regarding these policies, employers clearly must make employees, contractors and agents aware of them through methods such as orientation and in-service training and communication to contractors. Now that a year has passed since the effective date, an audit of communication compliance is recommended, particularly regarding contractors and agents. Some covered employers have amended their vendor and supplier standard purchase orders, contracts and other legal documents to include the DRA provisions. However, there is a danger of forgetting to include contracts that automatically renew or have no defined term. Incorporating the provisions of the DRA into all the normal business documents of a covered employer is essential to ensure that all vendors, suppliers and agents receive appropriate notification—especially given the harsh penalties for noncompliance. William H. Boling Jr. Partner, Health Care bboling@pogolaw.com Peer Review Rated Thomas H. Keim Jr. Partner, Labor and Employment tkeim@fordharrison.com Peer Review Rated Powell Goldstein LLP Ford & Harrison LLP Ed Honowitz/Stone/Getty Images martindale.com/c2c For more information on these lawyers and their firms as well as health care industry analysis, please visit www.martindale.com and our Legal Articles database. JANUARY 2008 29 http://www.martindale.com http://www.martindale.com/c2c
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.