Kiel, Joan M.

English

The Catholic University of America Columbus School of Law

Journal of Contemporary Health Law & Policy (1985-2015) Volume 20 Issue 2 Article 7 2004 The Health Insurance Portability and Accountability Act (HIPAA) Implementation via Case Law Joan M. Kiel Follow this and additional works at: https://scholarship.law.edu/jchlp Recommended Citation Joan M. Kiel, The Health Insurance Portability and Accountability Act (HIPAA) Implementation via Case Law, 20 J. Contemp. Health L. & Pol'y 435 (2004). Available at: https://scholarship.law.edu/jchlp/vol20/iss2/7 This Essay is brought to you for free and open access by CUA Law Scholarship Repository. It has been accepted for inclusion in Journal of Contemporary Health Law & Policy (1985-2015) by an authorized editor of CUA Law Scholarship Repository. For more information, please contact edinger@law.edu. ESSAYTHE HEALTH INSURANCE PORTABILITYAND ACCOUNTABILITY ACT (HIPAA)IMPLEMENTATION VIA CASE LAWJoan M. Kiel, Ph.D, C.H.P.SCompliance with the Transaction and Code Sets, the first of elevenparts of the Health Insurance Portability and Accountability Act(HIPAA), was mandated on October 16, 2002.1 Since that time, thePrivacy Rule and Security Rule have set compliance dates of April 14,2003, and April 20, 2005, respectively. Although healthcare providers,clearinghouses, and health plans have all expressed some displeasurewith the time and expense of implementing the Act, HIPAA will serveto mitigate some situations that have occurred in regards to patienthealth information confidentiality, security, and privacy. Relevantcase law will help to clarify implementation of HIPAA.I. CASE LAWA. Arbster v. Unemployment Compensation Board of Review2Jeanne Arbster was a registered nurse for Forbes Health System inPittsburgh, Pennsylvania. On March 16, 1996, Arbster's mother wasadmitted to Forbes Regional Hospital for orthopedic injuries relatedto a fall.' Arbster was not the nurse assigned to her Mother's care, yetshe would provide "care" to her during her non-working hours, just asany family member would whether or not she was medical personnel.The mother allowed Arbster to play an active role for her during thehospitalization. Her mother though did not give her daughterpermission to access her medical records (the hospital requires written1. 42 U.S.C. § 201 (2000).2. Arbster v. Unemployment Comp. Bd. of Review, 690 A.2d. 805 (Pa. 1997).3. Id. at 807.4. Id.Journal of Contemporary Health Law and Policy [Vol. 20:435permission from the patient for another to access the patient'srecords).5Problems arose when Arbster discussed what her mother's physicianthought was confidential information. How could Arbster haveobtained this confidential information? She was only able to obtainthis information by accessing the hospital's computers because as anemployee she had access.6 Other family members who provide "care"to a relative could not garner this information via the computer system;therefore, Arbster was accused of violating employment privileges.Second, in her official employment capacity as a registered nurse, shewas not the caregiver for her mother and thus should not have used thecomputer system to access the information Jeanne Arbster wasaware of the hospital personnel policy which forbade access to recordsexcept for patients under one's official care in an employmentcapacity. She claimed that although she knew the policy, she alsoknew of other employees who had accessed information regardingpatients not under their care but who were not penalized . JeanneArbster was terminated on April 14, 1996. 9Jeanne Arbster was denied unemployment compensation andappealed the decision.'0  The Forbes Health System reiterated itspolicy that "employees may only access the computer records for thepurposes of performing their job responsibilities." " Because Arbsterwas not officially assigned her mother as a patient, yet provided care toher while off-duty, the ruling was upheld and her termination wasattributed to willful misconduct. 12The HIPPA Privacy and Security Rule would uphold the givenruling. First, an Authorization to Disclose would have needed to besigned as Arbster was not the official caregiver of her Mother andtherefore was not in a "treatment role."13  The patient, via theAuthorization to Disclose, instructs which persons may access thepatient's health information. In addition, the patient can specify whatinformation can be shared. Second, HIPAA follows the "minimum5. Id. at 808.6. Id. at 807.7. Arbster, 690 A.2d at 807.8. Id. at 808.9. Id. at 807.10. Id.11. Id.12. See Arbster, 690 A.2d at 809.13. 45 C.F.R. § 164.508 (1996).The Health Insurance Portabilitynecessary" and "need to know" principles.1 4 Under these principles,the persons accessing the patient health information (PHI) are giventhe minimum necessary information to complete the task at hand.Also, they are only given the PHI that they have a need to know tocomplete the task at hand, their job functions. Given that JeanneArbster was not in an official job role capacity, she did not have a needto know, and thus the minimum necessary amount of PHI that neededto be accessed was zero. The HIPAA Privacy Rule states that onlythose with an official need to know, as specified by the healthcareprovider - here Forbes Regional Hospital - can access the minimumnecessary information to accomplish the work tasks as specified by theprovider. 5 Third, Forbes Regional Hospital dictates computer usage, afacet of the HIPAA Security and Privacy Rules. Computer access isviewed as an employment privilege and thus there is a responsibilityand trust that comes with its usage. The organization dictates therelationship of the employment agreement to the computer usage,keeping in mind the HIPAA minimum necessary and need to knowprinciples. For example, computer usage guidelines might includepreventing employees from the following:-Amending or deleting proprietary software;-Using email for personal use;-Sharing one's password to those without access;-Printing information and removing it from the premises;-Gaining illegal external access to the network.Upon employment, the new employee would sign a "memorandumof understanding" covering computer usage. Forbes RegionalHospital did indeed have a policy which forbade employees frominappropriate computer access and use. Fourth, in relation tocomputer access, the HIPAA Security Rule, Workforce Security,mandates that HIPAA entities implement policies and procedures toprevent workforce members who do not have access to electronicprotected health information from looking at it.16 Employees such asJeanne Arbster would be violating the HIPAA rule and thus besubject to sanctions. Fifth, to have the employee assume the liabilityfor her behavior, upon employment she can be asked to sign a form14. 45 C.F.R. § 164.502(b)(1) (1996).15. 45 C.F.R. § 164.502(b)(1) (1996).16. 45 C.F.R. § 164.308(a)(3)(i) (1996).2004]Journal of Contemporary Health Law and Policy [Vol. 20:435stating her understanding of her access privileges to patient healthinformation. This "Access Form" would specify the employee's roleand the patient health information that she has a need to know in theminimum necessary amount given her job functions. It would alsohave language concerning the importance of keeping the informationprivate and secure, and the ramifications, such as loss of computerprivileges to termination, if such was not done. The employee wouldthen sign and date the form. It is recommended that the form beupdated, at a minimum, at one's annual review.Jeanne Arbster, although claiming to be delivering patient care,violated confidentiality, privacy, and security laws. Forbes RegionalHospital terminated Arbster's employment, but under HIPAA, shecould face civil and criminal penalties.B. Ihekwu v. City of Durham, North Carolina7Patrick Ihekwu of Durham, North Carolina, sued the City claimingthat because the City listed medical information about his positiveHIV status in his file, he was denied employment. 8 Ihekwu beganworking for the city of Durham in 1990 as a parking garage attendant.' 9In 1994 he was promoted to a Records Keeper Specialist in the City'sRecord Management Division (RMD). ° In 1997 Ihekwu and hisfellow employees were told that the RMD was being decentralized andthat a reduction in work force would occur.2' Ihekwu was offered aninterview for a Police Records Clerk position which he successfullydid.22 This led to a conditional offer of employment based on abackground check which included his medical records. 23 Ihekwurefused to supply the City with his medical records and therefore theoffer of employment was rescinded. 24Ihekwu asserted that confidential patient health information wasalready seen by others and used in the employment decisions (such ashim being part of the reduction in work force). He felt that he did not17. Ihekwu v. City of Durham, 129 F. Supp. 2d. 870 (M.D.N.C. 2000).18. Id. at 874.19. Id.20. Id.21. Id. at 875.22. Ihekwu, 129 F. Supp. 2d. at 876.23. Id.24. Id.The Health Insurance Portabilityneed to supply the medical records as unknown city employees hadobtained records of his prescriptions and conveyed this information toothers working for the city.2 The defendant, the City of Durham,North Carolina, argued that the medical information was heldseparately from the other personnel information and thus played nopart in the employment judgment. The ruling was upheld in favor ofthe defendant.26First, given that the City of Durham, North Carolina, is not ahealthcare provider, health plan, or healthcare clearinghouse per se,the type of HIPAA entity arrangement that the City is would first needto be determined. Most likely, the City would qualify as a hybridentity as its main function is not to be a healthcare provider, healthplan, or healthcare clearing house, but rather its involvement in theaccess to, utilization of, and maintenance of individually identifiablehealth Information (IIHI) is a byproduct of its normal businessoperations. Second, under HIPAA, Ihekwu would have the right toauthorize what information to disclose and which persons may receivedisclosure, including information to potential employers. 7 Third, theCity, who houses the individually identifiable health information, candistribute the "Notice of Health Information Practices" to each personfor which it has IIHI. The Notice of Health Information Practicesoutlines how the City of Durham, or any holder of individuallyidentifiable health information, will utilize the patient healthinformation. 28 The Notice first defines "individually identifiable healthinformation" and then lists both the rights of the individual and therights of the entity. For example, the Notice would specify thatindividuals can request of copy of their information, and that they canrequest to amend the information that is inaccurate or incomplete.The Notice then names and describes numerous areas wherebyindividually identifiable health information can be shared. Examplesinclude public health purposes, legal matters, and treatment, payment,and healthcare operations. Although the Notice does not mentionemployment situations, this document has served to educate the publicon just what individually identifiable health information can be usedfor, where it can be sent, and most appropriately, what are the rights ofaccess for the patient. Fourth, the HIPAA Security Rule mandatesadministrative safeguards, 29 physical safeguards,3° and technical25. Id. at 874.26. Id. at 877.27. 45 C.F.R. § 164.522(b)(1)(ii) (1996).28. 45 C.F.R. § 164.520(a)(1) (1996).29. 45 C.F.R. § 164.308 (1996).2004]440 Journal of Contemporary Health Law and Policy [Vol. 20:435safeguards.31  With these three safeguards, "others," as quoted byIhekwu, would not have had legitimate access to his HIV status andrelated health information.C. Burger v. Lutheran General Hospital3 2Doris Burger alleged that Lutheran General Hospital violated herpatient's rights to privacy.33 Doris Burger had filed a lawsuit againstthe hospital concerning her care while a patient. She alleged that thehospital violated her right to privacy by discussing her patient healthinformation with the hospital's legal counsel.34 The hospital claimedthat since it created the patient health information, it had a right to it.35The hospital also asserted that because Doris Burger filed a lawsuitconcerning hospital quality of care, it needed to look at herinformation to further prevent any per se quality of care occurrences."Furthermore, the hospital claimed that it was in the "discovery phase"of the legal proceedings and thus needed to have access to theinformation.37 The Court ruled in favor of the hospital, concluding thatthe hospital had a right to intra-hospital communications of patientinformation.38 The hospital also cited the Hospital Licensing Act whichallows a hospital's staff to communicate to the hospital's legal counselinformation regarding patient care and legal suits.39Under HIPAA, three issues emerge in relation to Burger. First,upon admission to the hospital, Doris Burger would have beenpresented with the hospital's Notice of Health Information Practices. °The Notice specifies what is patient health information, how thehealthcare provider can utilize the patient health information, and therights of the individual in regards to the patient health information.Burger would have read that patient health information can be30. 45 C.F.R. § 164.310 (1996).31. 45 C.F.R. § 164.312 (1996).32. Burger v. Lutheran General Hospital, 759 N.E.2d 533 (Ill. 2001).33. Id. at 537.34. Id.35. Id. at 546.36. Id. at 546.37. Burger, 759 N.E.2d at 548.38. Id. at 556.39. Id. at 535.40. 45 C.F.R. § 164.520(a)(1) (1996).The Health Insurance Portabilitydisclosed for treatment, payment, and healthcare operations.Healthcare operations encompass quality of care issues, such as thecomplaint that Burger brought forth. In order for Lutheran GeneralHospital to operate as a quality healthcare provider, its staff needs tofollow up on patient issues. Second, if Burger believed that the follow-up was not under healthcare operations, but she wanted an answer toher issue, she would have then needed to sign an authorization todisclose. The disclosure specifies what patient health information is tobe shared, to whom, and for what purposes. Here, Burger could havespecified exactly what information the hospital could have used in itsfact finding. Third - although this is a bit of a "Catch-22" as Burgerwanted her complaint investigated, yet she did not want her patienthealth information discussed - the hospital would follow the"minimum necessary" and "need to know" principles in flowing up onher claims. If no follow-up could be conducted, how then would DorisBurger's issue have been resolved?To some HIPAA entities and consumers, The Health InsurancePortability and Accountability Act is confusing, subjective, and time-consuming. But with case law, one can tie theory to practice anddemonstrate that familiar healthcare situations are comprehensiblewithin HIPAA. Arbster, Ihekwu, and Burger enlighten the Act andprovide examples that can be used in deciphering the Act.20041

The Health Insurance Portability and Accountability Act (HIPAA) Implementation via Case Law

https://scholarship.law.edu/cgi/viewcontent.cgi?article=1162&amp;context=jchlp

The Health Insurance Portability and Accountability Act (HIPAA) Implementation via Case Law

Abstract

Similar works

Full text

Available Versions

The Catholic University of America Columbus School of Law