Chapter 6: Patient Information: Collection, Use, and Confidentiality

1
Chapter 6 Patient Information Collection, Use,
and Confidentiality
2
Pharmacists and Patient Information

• Pharmacists must maintain patient records
• Pharmacists must use these records to review
  therapy prior to dispensing this is known as
  Prospective Drug Use Review (P-DUR)
• Pharmacists must act if a problem is found
• Pharmacists must provide information to patients
  necessary to insure appropriate use of their
  medications and promote the attainment of desired
  therapeutic outcomes
• Pharmacists must protect confidentiality of
  protected health information (PHI)

3
Omnibus Budget Reconciliation Acts (OBRAs)

• Omnibus means having many purposes,
  all-encompassing
• Passed at the last minute by Congress to
  reconcile Senate and House budget versions
  (reconcile to bring into harmony)
• Omnibus Budget Reconciliation Acts
• Originally, COBRAs (Consolidated Omnibus Budget
  Reconciliation Act), e.g., 1986 - health
  insurance transfers on change of employment
• OBRA-87, use of psychotropics in LTC facilities
• OBRA-90, Medicaid drug programs
• Purpose to save taxpayer dollars or to deal with
  other budget-related issues

4
OBRA-90

• Designed to save Medicaid dollars by reducing
  waste and misuse of drugs, and by preventing
  drug-related problems
• Mandatory manufacturer rebates
• Mandated HCFA demonstration projects
• OPDUR
• Payment for pharmacists cognitive services
• Retrospective drug use review
• Prospective drug use review
• Maintain patient drug use histories
• Pharmacists must offer to counsel Medicaid
  patients

5
Retrospective DUR

• Retrospective - after the fact
• Conducted by state Medicaid agencies

6
Prospective DUR

• Prospective - before the fact
• Screen prescriptions against history prior to
  dispensing
• Therapeutic duplication
• Drug-disease contraindications
• Drug-drug interactions (including OTCs)
• Incorrect dosage or duration of treatment
• Drug allergies
• Clinical abuse or misuse
• May be manual and/or computer-assisted
• May be on-line

7
Patient Drug Use Histories

• Name, address, phone number, age or DOB, gender
• Significant disease states
• Known allergies or prior drug reactions
• List of drugs and devices previously used by
  patient
• Pharmacist comments relevant to individuals
  therapy

8
Offer to Counsel

• Rules set by states most require pharmacist to
  offer each patient a chance to discuss their drug
  therapy, generally must document refusal to be
  counseled
• Significant items
• Name and description of medication
• Dosage form, dose, route, duration of therapy
• Special directions for preparation,
  administration, or use by patient
• Common severe side effects, adverse effects,
  interactions, or contraindications that the
  patient can detect and deal with
• Self-monitoring techniques
• Storage and refill information
• What to do if a dose is missed

9
Washington State Rules

• Patient Medication Record Systems - WAC
  246-875-020
• All OBRA requirements except age and telephone
  number
• Drug Use Review - WAC 246-875-040
• New and refill prescriptions must be screened
• Patient Counseling Required WAC 246-869-220

10
Patient Counseling Required - WAC 246-869-220

• No offer to counsel -- must counsel
• Shall directly counsel patient
• If delivered, must offer in writing to provide
  direct counseling and information about the drug,
  including how to contact the pharmacist
• Focus is on counseling patient
• Judgment used to determine amount of counseling
• Reasonable and necessary under the circumstances
• Promote safe and effective administration of drug
• Facilitate an appropriate therapeutic outcome for
  the patient
• All prescriptions except where medication is to
  be administered by a licensed health professional
  authorized to administer drugs

11
Legal Impact of OBRA 90

• States have implemented in different ways
• Sets objective standard for the structure needed
  to support patient counseling and prospective
  drug use review
• Sets objective standard for the process of
  patient counseling and PDUR
• Sets objective standard for the content of
  patient counseling
• Documenting adherence to OBRA 90 standards
  should provide evidence of proper practice

12
Health Information Portability and Accountability
Act of 1996 (HIPAA)

• Portability
• Ability of employees to take insurance with them
  when they change jobs
• Addition to COBRA provisions
• Accountability
• Integrity of health information
• Confidentiality of health information
• Availability of health information

13
Portability

• COBRA
• Employee who leaves job can keep benefits by
  paying premiums for up to 18 months
• HIPAA
• Maximum time for refusing coverage for
  preexisting conditions is 12 months for covered
  conditions

14
Administrative Simplification Provisions

• Transaction standards
• Standard identifiers
• Code sets for data elements
• Security standards
• Electronic signatures

15
Covered Entity

• Renders care to individuals
• Collects and maintains PHI
• Exchanges electronic records

16
Pharmacy Computers Transaction Standards

• NCPDP 5.1 standards
• National Council on Prescription Drug Programs
• Data interchange standards must be implemented by
  pharmacy system vendors by October, 2002 (Most
  requested extension to October, 2003)
• Medicare claims must be submitted electronically

17
Data Security Organizational Practices

• Information and security officers
• Security and confidentiality policies
• Education and training programs
• 1 hour of training for each employee
• Sanctions

18
Data Security Technical Practices and Procedures

• Rules to take effect in 2005
• Individual authentication of users
• Access controls
• Audit trails
• Physical security and disaster recovery
• Protection of remote access points
• Protection of external electronic communications
• Software discipline
• System assessment

19
Standard Indicators

• Employers EIN
• Providers National Provider Identifier (NPI)
• Individuals, e.g., physicians, nurses, dentists,
  pharmacists, physical therapists
• Organizations, e.g., hospitals, laboratories,
  ambulance companies, HMOs, pharmacies
• NPI would be an 8-digit number (7 digits plus
  check digit)
• Implementation to be determined
• Health Plan ID rule pending

20
Privacy Rule (45 CFR Parts 160, 164)

• Protected health information (PHI) is that which
  relates to health condition (past, present,
  future) and identifies the patient (45 CFR
  164.501)
• May be used for treatment, payment, and health
  care operations (TPHCO)
• Consent not required to use information for TPHCO
• Notice of Privacy Practices must be provided
• Must obtain permission to use information for
  marketing, research, etc.
• May share data that is de-identified
• Stricter state laws must be followed
• Business associates must assure compliance with
  rules
• Consent from minors is subject to state law

21
Treatment

• Processing prescriptions and dispensing drugs
• Maintaining and reviewing patient profile
• Consulting with prescribers relative to the
  patients care
• Providing emergency information necessary for the
  patients care
• Consulting with patient or caregiver regarding
  the patients medications
• Transferring refill information to other
  pharmacies

22
Payment

• Determining eligibility or coverage
• Preauthorization, utilization review
• Billing 3rd party payers, justification of
  charges
• Collecting payment from the patient, or
  collecting past-due charge accounts
• Providing certain information to consumer
  reporting agencies
• Transmitting credit card charges
• Refunding charges

23
Health Care Operations

• Quality assurance within operation
• Quality assurance activities with external
  organizations
• Contacting providers or patients with information
  on treatment alternatives and related functions
  that do not include treatment
• Medical review, legal services, auditing, and
  fraud and abuse detection
• Employee training and development
• Complying with regulatory agencies and complying
  with HIPAA
• Inventory control and planning

24
Notice of Privacy Practices(NOPP)

• Advises patients that you will use their PHI for
  TPHCO
• Spells out what that means in your operation
• Advises patients of their rights
• Advises patients that you need written permission
  to release PHI for other purposes
• Identifies Privacy Officer and how to contact
• Describes business associate relationships
• Describes state laws and regulations
• Describes how you will notify of changes (by
  posting them in the pharmacy)

25
NOPP (2)

• Requires patient to acknowledge receipt of the
  notice
• May use a signature log to record
• Should place indication in computer record that
  notice was provided
• Title of notice is specified in regulation
• This Notice Describes How Medical Information
  About You May Be Used And Disclosed And How You
  Can Get Access To This Information
• Must post a notice in the pharmacy indicating the
  availability of this information
• Must provide NOPP to any person who requests
• Must track changes to NOPP

26
Patient access to records

• Patients may see records and may request changes
  in record to correct errors
• Pharmacy must provide copies of records in a
  timely manner upon request
• If information requested is available on site,
  must reply within 30 days
• If information is off-site, must provide within
  60 days
• May extend 30 days if reason provided to patient
  within 30 or 60 day limits above
• May charge reasonable fee for copying (see RCW
  70.02.080, WAC 246-08-200 for maximums in WA)
• Pharmacy does not have to agree to change record,
  but must respond in a timely manner to requests
• If record is not changed, patient may insert a
  statement in the record

27
Maximum charges and fees for searching and
copying patient records in WA

• Copying charges
• First 30 pages 0.88/page
• Beyond 30 pages 0.67/page
• Other charges
• 20 clerical fee for searching and handling
  records
• If provider personally edits confidential
  information, may charge usual and customary fee
  for a basic office visit.
• These fees valid through June 30, 2005 see WAC
  246-08-200.

28
Patient Request for Accounting of Disclosures

• May request an accounting of disclosures of PHI
  made in the 6 years prior to the request
• Do NOT have to account for disclosures
• Made directly to the patient
• Made to carry out TPHCO
• Made pursuant to an authorization granted by the
  patient
• Made to persons involved in the patients care
• Made prior to April 14, 2003
• No charge for 1st accounting within any 12 month
  period reasonable cost-based fee may be charged
  for additional requests within 12 months

29
Patient Request for Confidential Communication of
PHI

• May request that contacting the patient be
  restricted to particular address, telephone, or
  electronic address
• Will acknowledge that this may restrict
  communication to family or caregivers
• Note WA regulation already restricts
  communication with family who are not obvious
  agents or caregivers

30
Key Steps for Pharmacists

• Appoint privacy officer
• Receives and handles complaints
• Receives and handles requests to review records
• Best if privacy officer is not the pharmacist,
  due to the amount of clerical work involved
• Prepare notice to patients regarding pharmacys
  privacy policies
• Distribute notice to each patient on first visit
  after April 14, 2003, and obtain signed
  acknowledgement
• Train all employees regarding privacy policies
  and procedures should be documented
• Employees includes trainees (e.g., externs and
  clerkship students)

31
HIPAA Preemption of State Laws

• 264(c)(2). PREEMPTION. A regulation
  promulgated under paragraph (1) shall not
  supercede a contrary provision of State law, if
  the provision of State law imposes requirements,
  standards, or implementation specifications that
  are more stringent than the requirements,
  standards, or implementation specifications
  imposed under the regulation.
• 1178(a)(1). a provision or requirement under
  this part, shall supersede any contrary
  provision of State law, including a provision of
  State law that requires medical or health plan
  records to be maintained or transmitted in
  written rather than electronic form.

32
HHS Secretarys Authority to Allow Preemption
Exemptions

• 1178(a)(2)(A). A provision or requirement
  shall not supersede a contrary provision of State
  law, if the provision of State law is a provision
  the Secretary determines
• is necessary
• to prevent fraud and abuse
• to ensure appropriate State regulation of
  insurance and health plans
• for State reporting on health care delivery or
  costs or
• for other purposes or
• addresses controlled substances

33
More Stringent State Privacy Requirements are not
Preempted

• 1178(a)(2)(B) A provision shall not
  supersede a contrary provision of State law if
  the provision of State law, subject to
  264(c)(2) of the Act, relates to the privacy
  of individually identifiable health information
  and is more stringent than federal requirements

34
Non-preemption of State Reporting or Surveillance
Requirements

• 1178(b) PUBLIC HEALTH. Nothing in this part
  shall be construed to invalidate or limit the
  authority, power, or procedures established under
  any law providing for the reporting of disease or
  injury, child abuse, birth, or death, public
  health surveillance, or public health
  investigation or intervention.
• 1178(c) STATE REGULATORY REPORTING. Nothing in
  this part shall limit the ability of a State to
  require a health plan to report, or to provide
  access to, information for management audits,
  financial audits, program monitoring and
  evaluation, facility licensure or certification,
  or individual licensure or certification.

35
45 CFR 160.202 State Laws are More Stringent if
they

• Prohibit disclosure when Privacy Rule would allow
  it
• Unless disclosure is required to determine
  compliance with rule
• Unless disclosure is to the patient
• Permit the patient greater rights of access or
  amendment, or greater amounts of information than
  the Privacy Rule would allow
• Nothing preempts state law that authorizes or
  prohibits disclosure of information about a minor
  to a parent, guardian or person acting in loco
  parentis

36
State Laws are More Stringent if they

• Narrow the scope or duration of the period for
  consent to disclose or use information, or
  increase privacy protections, or reduce coercive
  effect of circumstances surrounding authorization
  or consent
• Provide for longer duration of records or more
  detail therein related to disclosures of PHI
• Otherwise provide greater privacy protection for
  the individual subject to PHI

37
More Stringent Provisions in WA

• Time limits for access to records
• WA ASAP, with 15 day limit for initial response,
  21 day maximum
• HIPAA 30 days for response, 30 day extension
• Time limits for amendment of records
• WA 10 days for response 21 days maximum
• HIPAA 60 days for response, 30 day extension

38
Non-preempted Consent Requirements in WA

• Minors must consent to release of information
  to parents regarding conditions for which they
  may consent to treatment
• STDs (age 14 or above)
• Outpatient mental health (age 13 or above)
• Chemical dependency treatment (age 13 or above)
• Patients with STDs or HIV must consent
• RCW 70.02.050 does not include reports regarding
  military personnel within releases permitted
  without the patients authorization
• Abuse or neglect of a child or vulnerable adult
  must be reported

39
Release without permission of patient allowed by
RCW 70.02.050

• To a person who is reasonably believed to be
  providing health care to the patient
• To provider previously treating patient, if
  necessary for patients care, unless patient has
  said not to disclose
• To any person if it is reasonably believed to be
  needed to avoid or minimize imminent danger to
  the health or safety of the patient or another
  individual (allowed but not required)
• Oral, if made to immediate family members or
  other person with whom the patient is known to
  have a close relationship, in accordance with
  good medical or professional practice, unless
  patient has instructed the provider in writing
  not to make the disclosure
• To a provider who is the successor in interest to
  the provider providing maintaining the
  information
• See RCW 70.02.050 for additional conditions.
• This Act was effective July 1, 1993, and revised
  in 1998.

40
Does Board Rule Prohibit Use of PHI for Payment
without Consent?

• The information in the patient medication record
  system which identifies the patient shall be
  deemed confidential and may be released to
  persons other than the patient or a pharmacist,
  or a practitioner authorized to prescribe only on
  written release of the patient.
• If in the judgment of the dispenser, the
  prescription presented for dispensing is
  determined to cause a potentially harmful drug
  interaction or other problem due to a drug
  previously prescribed by another practitioner,
  the dispenser may communicate this information to
  the prescribers. WAC 246-875-070(2)
• This rule was promulgated on 5/28/92, effective
  6/28/92. To the extent it conflicts with RCW
  70.02.050, it is probably not enforceable.

41
NOPPs Must Cite More Stringent State Requirements

• If a use or disclosure for any purpose described
  in paragraphs (b)(1)(ii)(A) or (B) of this
  section is prohibited or materially limited by
  other applicable law, the description of such use
  or disclosure must reflect the more stringent law
  as defined in 160.202.
• 45 CFR 164.520(b)(1)(ii)(C)

42
NOPPs of Pharmacies Doing Business in Washington
43
Conclusions

• HCIA generally similar to HIPAA
• HIPAA NOPP requirement more extensive
• HCIA requirements are more stringent
• Regarding access to and amendment of records
• For minors, STDs, mental health, and military
  reporting
• Board of Pharmacy rule more stringent than HCIA
  or HIPAA
• Review of WA pharmacies NOPPs reveal lack of
  appreciation for non-preempted provisions of WA
  law
• Most NOPPs are not in compliance with 45 CFR
  164.520
• Likely to be an issue in other states