S. Allan Adelman, JD

Before HITECH, a covered entity, that is, a physician's office, hospital, clinic, etc.-only was required to mitigate the effects of an unauthorized disclosure, which may or may not have included notifying the patient Now, except for certain limited exceptions, a covered entity is required to notify a patient of an unauthorized disclosure of unsecured protected health information if a significant risk of "financial, reputational, or other" harm exists. 

It is important to note that notification is only required for 

 protected health information, not secured protected health information. The Department of Health and Human Services (HHS) issued guidance on what constitutes "secured" protected health information in April, stating that information is deemed secured if rendered "unusable, unreadable, or indecipherable" to unauthorized individuals. 

Any notification to the patient must include a brief description of what happened and the type of protected health information disclosed, any steps the patient should take to protect himself or herself, what the covered entity is doing to investigate and mitigate the breach, and information concerning who to contact for additional information. Any required notification must occur without unreasonable delay but no more than 60 days after the breach is discovered or should have been discovered with the exercise of reasonable diligence. 

Notification must be in writing by mail (or by phone in urgent cases) or electronic means if the patient has consented to electronic notification. Also, specific rules exist regarding what to do if patients cannot be located. If a breach involves more than 500 patients-for instance, the loss of a laptop containing unsecured protected health information, then local media outlets must be notified. In addition, the HHS secretary must be notified-immediately for breaches involving more than 500 patients and annually for others. 

With the new regulations, the knowledge of a covered entity's agents, including business associates, is imputed to the covered entity. Therefore, the clock for notifying patients could begin to run before the covered entity actually is aware of the disclosure. New agreements may be required, and education of business associates is important, to ensure that they are aware of these requirements and that they indemnify your practice if they fail to comply with the new rules and notify you promptly of any breach of protected health information.  

The burden to disclose the breach or establish that no risk of harm to the patient exists is on the covered entity, even if the breach was the fault of one of its agents. A decision not to notify a patient because the covered entity does not believe that a significant risk of harm exists should be carefully investigated and documented. 

The author is a health law attorney with Adelman, Sheff & Smith in Annapolis, Maryland, and Washington, D.C. He can be reached at 

Malpractice Consult deals with questions on common professional liability issues. Unfortunately, we cannot offer specific legal advice. If you have a general question or a topic you'd like to see covered here, please send it to 

Articles

HITECH has new requirements regarding business associates and notification of patients regarding breaches of unsecured protected health information.

New HIPAA requirements target unsecured protected health information

A physician recently asked whether he and his colleagues in a local medical society could write on their prescriptions that they could be not be filled at a specific pharmacy, which had recently opened a walk-in clinic staffed by a nurse practitioner. 

While the desire of the physicians to avoid sending their prescription business to a competitor is certainly understandable, once they launched a concerted effort to impose some sort of economic sanction on a competitor, they essentially embarked on an activity that would constitute an unlawful attempt at restraint of trade. This could expose them to a successful lawsuit by the pharmacy-or even action by government regulators. 

Moreover, it is questionable whether such a restrictive endorsement would be effective in preventing the pharmacy from filling the prescriptions. 

A classic example of physicians running afoul of legal constraints occurred in Florida a number of years ago when a group of physicians that comprised the ob/gyn department at a local hospital banded together and refused to take emergency room call at the hospital unless they were paid.  

The matter came to the attention of the Federal Trade Commission, which initiated an investigation. The FTC concluded that the physicians' actions constituted an "unfair method of competition" that restrained trade and "deprived consumers of the benefit of competition." 

Ultimately, the chair of the ob/gyn department was forced to enter into a consent decree with the FTC that prohibited him from entering into an agreement with any physician to withhold emergency room call services at a hospital. 

There are many other situations where physicians can run afoul of anti-trust, restraint of trade, and unfair competition laws. For example, physicians have generally been aware that if they band together and agree to cooperate in refusing to accept payments from managed-care organizations and third-party payers that are below a certain level, they would undoubtedly be guilty of illegal conduct and restraint of trade. 

The response to this was the development of the "messenger model" of negotiation, in which one individual or organization relayed offers and counter-offers between payers and individual physicians, but did not share the physicians' responses or demands with other physicians. It is a cumbersome and somewhat ineffective procedure, but it was necessary to get around the legal prohibition against the physicians joining forces to set prices. 

While physicians can individually decide whether they want to refuse to take call if they are not paid, or refuse to participate with third-party payers unless they receive certain levels of payment, when those decisions are the product of a concerted effort or agreement among physicians, they could be illegal and could very well subject the participants to significant legal liabilities. 

The author is a health law attorney with Adelman, Sheff & Smith in Annapolis, Maryland, and Washington, DC. He can be reached at 

 Malpractice Consult deals with questions on common professional liability issues. Unfortunately, we cannot offer specific legal advice. If you have a general question or a topic you'd like to see covered here, please send it to 

Think twice before you band together with other physicians to harm a competitor.

Physicians can't unite to stifle competition

"This won't hurt a bit." We first heard that when we were very young and our pediatrician was about to give us a shot. Many of us have had a slight, but lingering, distrust of physicians ever since. Yet, it's an example of how the natural inclination of doctors to comfort patients and relieve their anxiety might do medical professionals more harm than good. 

Simple assurances like, "This is a straightforward procedure and you have absolutely nothing to worry about," or "If you stay on this medication, everything will clear up in a couple of days," don't always yield the promised result. And when that happens, you'll have an unhappy patient-or perhaps even a malpractice claim-on your hands. 

Keep in mind that only two things are required to generate a lawsuit. The first is a patient with unrealistic expectations and the second is a less-than-optimal outcome. Physicians can't always prevent undesirable outcomes, even when they do everything right. However, they can do a great deal to create realistic expectations. 

In some situations, optimistic promises about outcomes, or statements in which risks are downplayed, can trigger a lawsuit for lack of informed consent or "breach of warranty." Such a claim doesn't require the patient to prove the usual elements of a malpractice case-most notably, that the physician failed to act as a reasonably prudent practitioner under similar circumstances. It only requires that the patient establish that he or she wasn't informed of the risks and alternatives that a reasonable person would have considered to be important in deciding whether to undergo the proposed treatment. 

Similarly, to establish a claim for breach of warranty, the plaintiff doesn't have to prove that the physician was negligent. The patient only has to show that he relied on the doctor's representations ("you have nothing to worry about") in consenting to the procedure, and those representations turned out to be wrong. So even if you exceed the standard of care, you'll have a problem if the outcome isn't consistent with the representations and warranties-or the patient wasn't told about common risks and complications. 

In talking with patients about proposed procedures or treatments, you're not required to identify 

possible hazard and potential adverse outcome, just the major ones. It's more important to help the patient understand that while things usually go as planned, each person is different and there are no guarantees. Don't try so hard to calm your patients' anxieties that you end up leaving the impression that you and the proposed treatment are infallible. If you do, you'll only create unreasonable expectations and, should there be an adverse outcome, your patient could become your plaintiff. 

The author is a health law attorney with Adelman, Sheff & Smith in Annapolis, MD, and Washington, DC. He can be reached by e-mail at 

This department deals with questions on common professional liability issues. We cannot, however, offer specific legal advice. If you have a general question or a topic you'd like to see covered here, please e-mail it to 

You may also fax your question to us at 201-690-5420,  or send it to Malpractice Consult, 

123 Tice Blvd., Woodcliff Lake, NJ 07677-7664.

You can't always prevent undesirable outcomes, but you can help create realistic expectations

Author | S. Allan Adelman, JD

Articles

New HIPAA requirements target unsecured protected health information

Physicians can't unite to stifle competition

Be careful what you promise