I reported in the previous edition of TAP (47/1) that APsaA counsel, Jim Pyles, successfully lobbied for the inclusion of the following in the HIPAA/HITECH Omnibus Rule, “Final Rule, section 164.5229(a)(1) (vi): ”A covered entity must agree to the request of an individual to restrict disclosure“ of personal health information to a health plan if the individual ”has paid the covered entity in full.“ This regulation implements a similar statutory provision that APsaA worked with Congressman Ed Markey (D-MA) to be included in the HITECH Act (2009).
…besides being an attorney, Bendat is a psychoanalyst and a contributing member of CGRI.
This means that covered entities, including mental health practitioners under HIPAA, can protect their patients' right to privacy, excluding Medicare patients, and have a right to pay privately for treatment without running afoul of federal regulations. It also means that any electronic health information system on a national level must have the capability to honor a patient's wishes about privacy with respect to information about a health care service. APsaA will have to fight hard to maintain this ground, because technology vendors and a number of mental health groups are arguing that this provision will unduly delay the implementation of a national health IT system. Hence, these groups are trying to get the right to pay privately weakened or removed before the compliance date of the Final Rule on September 23, 2013.
In addition to assuring protection of the therapist-patient relationship, Pyles has indicated that the organization was successful in obtaining several significant refinements of the Final Rule. The Final Rule eliminates a “harm standard” that was in the Interim Final Rule, (2009). That standard allowed covered entities to bypass informing patients that the privacy of their health information had been breached, regardless of the magnitude of the breach, if the covered entity believed no “harm” would ensue. APsaA argued that this effectively created a conflict of interest, because covered entities would be inclined to conclude that patients would not be harmed in order to avoid patient notification. APsaA also observed that Congress expressly excluded such an exception to breach notification in a draft of the HITECH Act.
The Final Rule replaces the “harm” standard with a requirement that patients (and the Department of Health and Human Services [HHS]) be notified of all breaches, unless the covered entity can demonstrate that there is a low probability that the privacy of the information has been compromised according to a test involving four separate criteria. Under the prior Interim Final Rule, covered entities could avoid notifying the patients and HHS of breaches if they concluded that the breach was unlikely to cause patients “harm.” Under the revised rule, it is likely that fewer breaches will go unreported.
The Final Rule underscores that psychotherapy notes can only be disclosed (absent a requirement in law) with the authorization of the patient. It also provides that authorizations for disclosure of psychotherapy notes cannot be combined with authorizations for disclosure of other types of health information for treatment and research. Additionally, APsaA argued that privacy protections in HIPAA should extend beyond 50 years. The Final Rule retains the 50-year limitation on HIPAA privacy protections, but provides that protections over a longer period of time can be provided by states and by “the professional responsibilities of mental health or other providers.” The continued deference to professional ethics under HIPAA allows professional organizations, like APsaA, to uphold principles necessary to the practice of our profession.
A recent case that illustrates the dangers of breaches involves the Internal Revenue Service. A class-action suit filed by John Doe Company against 15 John Doe IRS agents by
Graham L. Spruiell, M.D., is co-chair of the Committee on Government Relations and Insurance and a member of the Program in Psychiatry and the Law, Beth Israel Deaconess Medical Center, Boston.
Robert E. Barnes on March 11, 2011, alleges that IRS agents illegally confiscated the medical records of 10 million patients, of which one million were California patients, including “intimate medical records of every state judge in California.” Plaintiffs, who are covered entities, maintain that the IRS did this without a search warrant, without a subpoena, and against HIPAA regulations. The IRS allegedly maintains possession of these records to this day. This class action seeks $25,000 in compensatory damages and punitive damages for constitutional violations for each patient whose record was breached. A request has been made “to protect the private proprietary and privileged information of the medical records seized,” and compelling the IRS to return all removed records.
Jim Pyles, on behalf of APsaA, defends confidentiality of our patients and has successfully advocated for both patients and clinicians who contract privately; Robert E. Barnes, counsel for plaintiffs, has filed a class-action suit against the IRS for wrongfully breaching and confiscating medical records; and yet another attorney, Meiram Bendat, has filed a class-action suit involving questions of parity. As many know, besides being an attorney, Bendat is a psychoanalyst and a contributing member of CGRI. These lawyers have been courageous and successful in fighting for principles that are basic to our rights as patients and clinicians.
Bendat, founder of Psych-Appeal, recently filed a nationwide class-action complaint against United Healthcare (including United Behavioral Health and OptumHealth) in the United States District Court for the Southern District of New York (Manhattan) on behalf of the New York State Psychiatric Association and employees of The State University of New York, CBS, and SYSCO. New York State Psychiatric Association vs. United Health Group alleges mass violations of state and federal anti-discrimination laws protecting the rights of most, if not all, of United's beneficiaries throughout the country. There are over one million United Healthcare subscribers of the Empire Plan, covering New York State employees and their dependents; and that number is dwarfed by beneficiaries receiving benefits through private employers who contract with United. This insurer covers an astounding 70 million patients, 25 percent of all insured patients in our country.
Bendat announced:
The class-action suit alleges violations of the Paul Wellstone and Pete Domenici Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA), as well as New York's Timothy's Law and California's Mental Health Parity Act, requiring insurers to administer and reimburse mental health and substance abuse benefits in parity with medical/surgical benefits. The suit further alleges class-wide violations of the Affordable Care Act that requires insurers to adjudicate claims fully and fairly, provide for independent appeals, and ensure continued payment for treatment pending appeals. Further, the suit alleges class-wide unlawful and deceptive business practices by United in New York and California.
Bendat advocates for dialogue about access to mental health treatment and “rampant abuses of the insurance industry's most disenfranchised subscribers.”
Over the next year there will be promising opportunities to influence health care policies and the law with regard to private practice, confidentiality, and parity enforcement. CGRI will keep APsaA members informed about these events and invites your participation.