HIPAA In The World Of ACOs, CCNs, And Other Health Care Delivery Models

1. HIPAA In The World Of ACOs, CCNs, And Other Health Care Delivery Models Clay J. Countryman Breazeale, Sachse & Wilson, L.L.P. clay.countryman@bswllp.com

2. Agenda for Presentation • ACOs, CCNs • Types of PHI to be used • Potential uses of PHI • CMS’ reasoning for permitting use of PHI • Proposed Protections • Practical concerns

3. Demographic Information CMS proposed to allow the use of the following data points to facilitate the assignment of beneficiaries to ACOs and to identify beneficiaries to ACO providers: • Name • Dates of Birth • Sex • Health Insurance Claim Number An ACO may obtain additional identifiable claims data subject to the following 3 conditions: (1) Certification (2) Opt-Out (3) Data Use Agreements

4. ACOs and Marketing • HIPAA limitations for “marketing” • CMS proposed to exempt from the HIPAA definition of “marketing”: • ACO communications that are customized or limited to a subset of beneficiaries, • materials that do not include information about the ACO or providers in the ACO, • materials that cover beneficiary-specific billing and claims issues or other specific health-related issues, • educational information on specific medical conditions such as flu shot reminders, and • referrals for Medicare-covered items and services

5. Rationale: CMS believes that the use of demographic information for assignment and identification purposes is a permissible “health care operation” under HIPAA. • HIPAA permits one covered entity, such as a payer like Medicare, to disclose PHI to another covered entity, like a health care provider, without a patient’s authorization for permissible “health care operations.” • Health care operations include “population based activities related to improving health care or reducing health costs, protocol development, case management and care coordination.”

6. Claims Data • CMS is proposing to allow the ongoing use of detailed Medicare claims data to support care coordination and to track ACO performance against defined performance measures. • The use of claims data is likely permissible under the HIPAA health care operations exception. However, CMS is proposing additional protections for this information.

7. Claims Data Protections CMS proposes the following protections for claims data: • Data Use Agreements • Patient Notice at the point of care • Notice would include the right to opt out of ACO-related data sharing • Advance justification for proposed claims data uses by the ACO (data would not be provided automatically)

8. Practical Concerns • The administrative burden of providing and documenting two notices – a HIPAA Notice of Privacy Practices and a notice of ACO uses and disclosures of PHI • Will patients understand this distinction? • Distinguishing permissible uses of PHI in the ordinary course of care from uses of PHI in connection with ACO-related activities for patients who have opted out • Security and breach related concerns

9. Thank you! Questions? Clay J. Countryman Breazeale, Sachse & Wilson, L.L.P. 225-381-8037 clay.countryman@bswllp.com