170 likes | 648 Views
2. Presentation Overview. Preemption BasicsPreemption Defined (in English)Significance of Preemption Analysis Preemption ExceptionsPerforming the Preemption AnalysisHIPAA COW's Privacy Preemption WorkgroupMembersMeetings and ProcessExcerpts From HIPAA COW AnalysisSample Step-by-Step Preemption AnalysisSpecific Wisconsin Examples.
E N D
1. The HIPAA COWPrivacy Preemption Analysis Heather Fields, JD
Reinhart Boerner Van Deuren s.c.
Chrisann Lemery, MS, RHIA
Wisconsin Health Information Management Association
2. 2 Presentation Overview Preemption Basics
Preemption Defined (in English)
Significance of Preemption Analysis
Preemption Exceptions
Performing the Preemption Analysis
HIPAA COW’s Privacy Preemption Workgroup
Members
Meetings and Process
Excerpts From HIPAA COW Analysis
Sample Step-by-Step Preemption Analysis
Specific Wisconsin Examples
3. 3 HIPAA’s Preemption Provisions HIPAA intended to create “floor” for privacy protections and, therefore, preempts (or supercedes) all “contrary” State laws
Contrary means that when you compare the State law to HIPAA
It would be impossible to comply with both laws
The state law is an obstacle to accomplishment of HIPAA’s purposes
A State law will remain in effect, however, if it falls within one of the listed exceptions or is “more stringent” than HIPAA
4. 4 What is Preemption? Word “preempt” defined by Webster’s as “to take precedence over” or “to replace with something considered to be of greater value or priority”
Prior to HIPAA confidentiality of health information generally regulated by State law
Existing State laws may impose similar or conflicting confidentiality requirements to those prescribed by the HIPAA privacy regulation
Preemption analysis answers the question of which law (state or federal) covered entities will need to follow (note: may be one or both)
5. 5 Significance of Preemption Analysis Preemption analysis will impact the content of:
Authorizations
Notice of Privacy Practices
Policies and Procedures
Preemption analysis will result in even greater “patch work” of confidentiality laws
Must perform analysis on each specific state law provision, not just the entire statutory scheme (e.g., WI Statutes, Chapter 146 exceptions to informed consent requirements)
Many State laws will supplement HIPAA provisions (e.g., additional authorization requirements under WI Statutes, Chapter 51.30 for mental health treatment records)
6. 6 HIPAA Preemption Exceptions:Four Categories of State Laws Not Preempted Category One: Laws DHHS Secretary determines are necessary:
To prevent health care fraud and abuse
To allow State to regulate health plans
For State reporting on health care delivery or costs
To serve compelling need related to public health, safety or welfare when weighed against individual’s privacy right
Laws DHHS Secretary determines are designed to regulate controlled substances
Determination requests must be submitted through a State’s governor, or his or her designee
7. 7 Four Categories of State Laws Not Preempted by HIPAA (cont.) Category Two: State confidentiality/privacy laws that provide more stringent protection for health information
“More Stringent” state laws:
Prohibit or restrict the use or disclosure that HIPAA allows, unless the HIPAA disclosure is required for DHHS to assess HIPAA compliance or is to the individual
Afford individuals greater rights of access or amendment
Require more information be provided to individuals regarding use/disclosure, rights, and remedies
8. 8 Four Categories of State Laws Not Preempted by HIPAA (cont.) Category Three: State laws related to reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation or intervention
Category Four: State laws requiring health plan reporting
9. 9 Additional State Law “Exception” To HIPAA Preemption State laws governing parent/guardian access to health information of minors unless:
State law permits the minor to control access to health information and does not require any other consent
State law permits the minor to consent to the health services and to control access
The parent/guardian agrees to waive his or her right to access the minor’s health information records and to allow the minor to control access
10. 10 Performing the Preemption Analysis: Evaluating State Laws State statutes
State regulations/administrative requirements
Local laws
Case Law/Common law, including evidentiary privileges:
Physician/patient privilege
Discovery of medical records
Must analyze each source of law line by line
11. 11 Performing the Preemption Analysis: The Process Step One: Does the state law fit within one of the four preemption exceptions or relate to parental access to records of minors?
If yes, must comply with state law
If no, move on to next step
12. 12 Performing the Preemption Analysis: The Process Step Two: Is the state law is contrary to HIPAA?
Impossibility Test: Is it impossible to comply with both laws?
Obstacle Test: Does the State law create an obstacle to accomplishing the purpose and objectives of HIPAA?
If no, then must comply with both
If yes, must determine whether HIPAA preempts the state law
13. 13 Performing the Preemption Analysis: The Process Step Three: Does HIPAA preempt the state law? Must determine whether state law is more stringent. TIP: Ask yourself if the State law more protective in any of the following areas?
Use or disclosure
Individual access or amendment
Information provided to an individual
Consent/authorization requirements
Recordkeeping or accounting
Greater privacy protections
14. 14 Performing the Preemption Analysis: The Process If the state law is:
More stringent, then it will remain in effect and you will need to comply with state law
Less stringent, HIPAA will preempt state law and you will need to comply with HIPAA
15. 15 HIPAA COW’s Privacy Preemption Workgroup 14 members total including representatives from law firms, SMS, WHA, payors, providers and counties
Coordinate analysis with WI DHFS Office of Legal Counsel
Meet every other Wednesday via teleconference from 8:30 to 9:30 and in-person 4-5 hour meetings at least every quarter
16. 16 HIPAA COW’s Privacy Preemption Workgroup Workgroup Preemption Teams:
General Confidentiality Laws Team: Chapters 146, 252, and other miscellaneous provisions
County Team: WI laws relating to county human/social/public health services, children’s code and corrections
Insurance Team
Long Term Care Team
Mental Health/DD/AODA laws addressed by entire workgroup
17. 17 Privacy Preemption Workgroup: Process and Status of Analysis Individuals Preemption Teams divide up responsibility for preparing initial analysis themselves and set up meetings
Team then presents preliminary analysis to entire group for discussion
Chapters 146 and 51.30 nearly complete and will be submitted to DHFS for review and “approval” in October
Following DHFS buy-in, post on website
18. 18 Performing the Preemption Analysis: Sample WI Application Wisconsin Statutes, Chapter 146.38 provides general protection to peer review records from disclosure
Is this preempted by HIPAA?
Let’s do the analysis together!