Chapter 6: Patient Information: Collection, Use, and Confidentiality

1. 1 Chapter 6: Patient Information: Collection, Use, and Confidentiality

2. 2 Pharmacists and Patient Information Pharmacists must maintain patient records Pharmacists must use these records to review therapy prior to dispensing; this is known as Prospective Drug Use Review (P-DUR) Pharmacists must act if a problem is found Pharmacists must provide information to patients necessary to insure appropriate use of their medications and promote the attainment of desired therapeutic outcomes Pharmacists must protect confidentiality of protected health information (PHI)

3. 3 Omnibus Budget Reconciliation Acts (OBRAs) “Omnibus” means “having many purposes”, “all-encompassing” Passed at the last minute by Congress to reconcile Senate and House budget versions (“reconcile”: to bring into harmony) Omnibus Budget Reconciliation Acts Originally, COBRAs (Consolidated Omnibus Budget Reconciliation Act), e.g., 1986 - health insurance transfers on change of employment OBRA-87, use of psychotropics in LTC facilities OBRA-90, Medicaid drug programs Purpose: to save taxpayer dollars or to deal with other budget-related issues

4. 4 OBRA-90 Designed to save Medicaid dollars by reducing waste and misuse of drugs, and by preventing drug-related problems Mandatory manufacturer rebates Mandated HCFA demonstration projects OPDUR Payment for pharmacists’ cognitive services Retrospective drug use review Prospective drug use review Maintain patient drug use histories Pharmacists must offer to counsel Medicaid patients

5. 5 Retrospective DUR Retrospective - after the fact Conducted by state Medicaid agencies

6. 6 Prospective DUR Prospective - before the fact Screen prescriptions against history prior to dispensing Therapeutic duplication Drug-disease contraindications Drug-drug interactions (including OTCs) Incorrect dosage or duration of treatment Drug allergies Clinical abuse or misuse May be manual and/or computer-assisted May be “on-line”

7. 7 Patient Drug Use Histories Name, address, phone number, age or DOB, gender Significant disease states Known allergies or prior drug reactions List of drugs and devices previously used by patient Pharmacist comments relevant to individual’s therapy

8. 8 Offer to Counsel Rules set by states: most require pharmacist to offer each patient a chance to discuss their drug therapy, generally must document refusal to be counseled Significant items Name and description of medication Dosage form, dose, route, duration of therapy Special directions for preparation, administration, or use by patient Common severe side effects, adverse effects, interactions, or contraindications that the patient can detect and deal with Self-monitoring techniques Storage and refill information What to do if a dose is missed

9. 9 Washington State Rules Patient Medication Record Systems - WAC 246-875-020 All OBRA requirements except age and telephone number Drug Use Review - WAC 246-875-040 New and refill prescriptions must be screened Patient Counseling Required – WAC 246-869-220

10. 10 Patient Counseling Required - WAC 246-869-220 No “offer to counsel” -- must counsel Shall “directly counsel” patient If delivered, must offer in writing to provide direct counseling and information about the drug, including how to contact the pharmacist Focus is on counseling patient Judgment used to determine amount of counseling: Reasonable and necessary under the circumstances Promote safe and effective administration of drug Facilitate an appropriate therapeutic outcome for the patient All prescriptions except where medication is to be administered by a licensed health professional authorized to administer drugs

11. 11 Legal Impact of OBRA ’90 States have implemented in different ways Sets objective standard for the structure needed to support patient counseling and prospective drug use review Sets objective standard for the process of patient counseling and PDUR Sets objective standard for the content of patient counseling Documenting adherence to OBRA ’90 standards should provide evidence of proper practice

12. 12 Health Information Portability and Accountability Act of 1996 (HIPAA) Portability Ability of employees to take insurance with them when they change jobs Addition to COBRA provisions Accountability Integrity of health information Confidentiality of health information Availability of health information

13. 13 Portability COBRA Employee who leaves job can keep benefits by paying premiums for up to 18 months HIPAA Maximum time for refusing coverage for preexisting conditions is 12 months for covered conditions

14. 14 “Administrative Simplification” Provisions Transaction standards Standard identifiers Code sets for data elements Security standards Electronic signatures

15. 15 “Covered Entity” Renders care to individuals Collects and maintains PHI Exchanges electronic records

16. 16 Pharmacy Computers: Transaction Standards NCPDP 5.1 standards National Council on Prescription Drug Programs Data interchange standards must be implemented by pharmacy system vendors by October, 2002 (Most requested extension to October, 2003) Medicare claims must be submitted electronically

17. 17 Data Security: Organizational Practices Information and security officers Security and confidentiality policies Education and training programs 1 hour of training for each employee Sanctions

18. 18 Data Security: Technical Practices and Procedures Rules to take effect in 2005 Individual authentication of users Access controls Audit trails Physical security and disaster recovery Protection of remote access points Protection of external electronic communications Software discipline System assessment

19. 19 Standard Indicators Employers: EIN Providers: National Provider Identifier (NPI) Individuals, e.g., physicians, nurses, dentists, pharmacists, physical therapists Organizations, e.g., hospitals, laboratories, ambulance companies, HMOs, pharmacies NPI would be an 8-digit number (7 digits plus check digit) Implementation to be determined Health Plan ID: rule pending

20. 20 Privacy Rule (45 CFR Parts 160, 164) Protected health information (PHI) is that which relates to health condition (past, present, future) and identifies the patient (45 CFR § 164.501) May be used for treatment, payment, and health care operations (TPHCO) Consent not required to use information for TPHCO Notice of Privacy Practices must be provided Must obtain permission to use information for marketing, research, etc. May share data that is “de-identified” Stricter state laws must be followed Business associates must assure compliance with rules Consent from minors is subject to state law

21. 21 Treatment Processing prescriptions and dispensing drugs Maintaining and reviewing patient profile Consulting with prescribers relative to the patient’s care Providing emergency information necessary for the patient’s care Consulting with patient or caregiver regarding the patient’s medications Transferring refill information to other pharmacies

22. 22 Payment Determining eligibility or coverage Preauthorization, utilization review Billing 3rd party payers, justification of charges Collecting payment from the patient, or collecting past-due charge accounts Providing certain information to consumer reporting agencies Transmitting credit card charges Refunding charges

23. 23 Health Care Operations Quality assurance within operation Quality assurance activities with external organizations Contacting providers or patients with information on treatment alternatives and related functions that do not include treatment Medical review, legal services, auditing, and fraud and abuse detection Employee training and development Complying with regulatory agencies and complying with HIPAA Inventory control and planning

24. 24 Notice of Privacy Practices(NOPP) Advises patients that you will use their PHI for TPHCO Spells out what that means in your operation Advises patients of their rights Advises patients that you need written permission to release PHI for other purposes Identifies Privacy Officer and how to contact Describes business associate relationships Describes state laws and regulations Describes how you will notify of changes (by posting them in the pharmacy)

25. 25 NOPP (2) Requires patient to acknowledge receipt of the notice May use a signature log to record Should place indication in computer record that notice was provided Title of notice is specified in regulation: “This Notice Describes How Medical Information About You May Be Used And Disclosed And How You Can Get Access To This Information” Must post a notice in the pharmacy indicating the availability of this information Must provide NOPP to any person who requests Must track changes to NOPP

26. 26 Patient access to records Patients may see records and may request changes in record to correct errors Pharmacy must provide copies of records in a timely manner upon request If information requested is available on site, must reply within 30 days If information is off-site, must provide within 60 days May extend 30 days if reason provided to patient within 30 or 60 day limits above May charge reasonable fee for copying (see RCW 70.02.080, WAC 246-08-200 for maximums in WA) Pharmacy does not have to agree to change record, but must respond in a timely manner to requests If record is not changed, patient may insert a statement in the record

27. 27 Maximum charges and fees for searching and copying patient records in WA Copying charges First 30 pages = $0.88/page Beyond 30 pages = $0.67/page Other charges $20 clerical fee for searching and handling records If provider personally edits confidential information, may charge usual and customary fee for a basic office visit. These fees valid through June 30, 2005 – see WAC 246-08-200.

28. 28 Patient Request for Accounting of Disclosures May request an accounting of disclosures of PHI made in the 6 years prior to the request Do NOT have to account for disclosures Made directly to the patient Made to carry out TPHCO Made pursuant to an authorization granted by the patient Made to persons involved in the patient’s care Made prior to April 14, 2003 No charge for 1st accounting within any 12 month period; reasonable cost-based fee may be charged for additional requests within 12 months

29. 29 Patient Request for Confidential Communication of PHI May request that contacting the patient be restricted to particular address, telephone, or electronic address Will acknowledge that this may restrict communication to family or caregivers Note: WA regulation already restricts communication with family who are not obvious agents or caregivers

30. 30 Key Steps for Pharmacists Appoint privacy officer Receives and handles complaints Receives and handles requests to review records Best if privacy officer is not the pharmacist, due to the amount of clerical work involved Prepare notice to patients regarding pharmacy’s privacy policies Distribute notice to each patient on first visit after April 14, 2003, and obtain signed acknowledgement Train all employees regarding privacy policies and procedures – should be documented Employees includes trainees (e.g., externs and clerkship students)

31. 31 HIPAA Preemption of State Laws §264(c)(2). PREEMPTION. – A regulation promulgated under paragraph (1) shall not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation. §1178(a)(1). … a provision or requirement under this part, … shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records … to be maintained or transmitted in written rather than electronic form.

32. 32 HHS Secretary’s Authority to Allow Preemption Exemptions §1178(a)(2)(A). A provision or requirement … shall not supersede a contrary provision of State law, if the provision of State law is a provision the Secretary determines is necessary to prevent fraud and abuse; to ensure appropriate State regulation of insurance and health plans; for State reporting on health care delivery or costs; or for other purposes; or addresses controlled substances

33. 33 More Stringent State Privacy Requirements are not Preempted §1178(a)(2)(B): [A provision … shall not supersede a contrary provision of State law if the provision of State law], subject to §264(c)(2) [of the Act], relates to the privacy of individually identifiable health information and is more stringent than federal requirements

34. 34 Non-preemption of State Reporting or Surveillance Requirements §1178(b) PUBLIC HEALTH. – Nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention. §1178(c) STATE REGULATORY REPORTING. –Nothing in this part shall limit the ability of a State to require a health plan to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, facility licensure or certification, or individual licensure or certification.

35. 35 45 CFR §160.202: State Laws are More Stringent if they … Prohibit disclosure when Privacy Rule would allow it Unless disclosure is required to determine compliance with rule Unless disclosure is to the patient Permit the patient greater rights of access or amendment, or greater amounts of information than the Privacy Rule would allow Nothing preempts state law that authorizes or prohibits disclosure of information about a minor to a parent, guardian or person acting in loco parentis

36. 36 State Laws are More Stringent if they … Narrow the scope or duration of the period for consent to disclose or use information, or increase privacy protections, or reduce coercive effect of circumstances surrounding authorization or consent Provide for longer duration of records – or more detail therein – related to disclosures of PHI Otherwise provide greater privacy protection for the individual subject to PHI

37. 37 More Stringent Provisions in WA Time limits for access to records WA: ASAP, with 15 day limit for initial response, 21 day maximum HIPAA: 30 days for response, 30 day extension Time limits for amendment of records WA: 10 days for response; 21 days maximum HIPAA: 60 days for response, 30 day extension

38. 38 Non-preempted Consent Requirements in WA Minors – must consent to release of information to parents regarding conditions for which they may consent to treatment STDs (age 14 or above) Outpatient mental health (age 13 or above) Chemical dependency treatment (age 13 or above) Patients with STDs or HIV must consent RCW 70.02.050 does not include reports regarding military personnel within releases permitted without the patient’s authorization Abuse or neglect of a child or vulnerable adult must be reported

39. 39 Release without permission of patient allowed by RCW 70.02.050 To a person who is reasonably believed to be providing health care to the patient; To provider previously treating patient, if necessary for patient’s care, unless patient has said not to disclose; To any person if it is reasonably believed to be needed to avoid or minimize imminent danger to the health or safety of the patient or another individual (allowed but not required); Oral, if made to immediate family members or other person with whom the patient is known to have a close relationship, in accordance with good medical or professional practice, unless patient has instructed the provider in writing not to make the disclosure; To a provider who is the successor in interest to the provider providing maintaining the information See RCW 70.02.050 for additional conditions. This Act was effective July 1, 1993, and revised in 1998.

40. 40 Does Board Rule Prohibit Use of PHI for Payment without Consent? “The information in the patient medication record system which identifies the patient shall be deemed confidential and may be released to persons other than the patient or a pharmacist, or a practitioner authorized to prescribe only on written release of the patient.” “If in the judgment of the dispenser, the prescription presented for dispensing is determined to cause a potentially harmful drug interaction or other problem due to a drug previously prescribed by another practitioner, the dispenser may communicate this information to the prescribers.” – WAC 246-875-070(2) This rule was promulgated on 5/28/92, effective 6/28/92. To the extent it conflicts with RCW 70.02.050, it is probably not enforceable.

41. 41 NOPPs Must Cite More Stringent State Requirements If a use or disclosure for any purpose described in paragraphs (b)(1)(ii)(A) or (B) of this section is prohibited or materially limited by other applicable law, the description of such use or disclosure must reflect the more stringent law as defined in §160.202. – 45 CFR §164.520(b)(1)(ii)(C)

42. 42 NOPPs of Pharmacies Doing Business in Washington

43. 43 Conclusions HCIA generally similar to HIPAA HIPAA NOPP requirement more extensive HCIA requirements are more stringent Regarding access to and amendment of records For minors, STDs, mental health, and military reporting Board of Pharmacy rule more stringent than HCIA or HIPAA Review of WA pharmacies’ NOPPs reveal lack of appreciation for non-preempted provisions of WA law Most NOPPs are not in compliance with 45 CFR §164.520 Likely to be an issue in other states