Posts Tagged consent

Do You Record Patient Phone Calls? Here’s What You Need to Know.

Do You Record Patient Phone Calls? Here’s What You Need to Know.

A physician practice recently inquired about implementing a policy pursuant to which the practice would begin recording phone calls to and from patients and referring providers. The practice of recording phone calls is not uncommon. For example, every time you call a customer service number you are informed that the call “may be recorded for quality purposes.” However, there are some legal issues to consider before implementing a policy pursuant to which you record phone calls with patients.

First, from a HIPAA perspective, any entity you contract with to record the calls with patients and to store the recordings will need to sign a Business Associate Agreement, in which such entity agrees to protect the patient information it receives. Failing to obtain a Business Associate Agreement in this instance would be a violation of HIPAA.

Second, there is the question of whether you need to inform the patient the call is being recorded. Alabama is considered a “one-party consent” state, meaning you only need the consent of one party in order to record a call — and that one party can be the party making the recording. Thus, as long as the physician practice is aware of the recording, a patient located in Alabama does not have to be informed the call is being recorded. However, things get more tricky when you are making and/or receiving calls from patients located outside of Alabama.

Other states (including the neighboring state of Florida) are “two-party consent” states, meaning you need the consent of both parties in order to make the recording. If a call is made from a physician practice in Alabama, a “one-party consent” state, to a patient located in Florida, a “two-party consent” state, the general legal consensus is that the physician practice must comply with the more stringent “two-party consent” requirements. Thus, under this scenario, a disclosure would need to be made to the patient located in Florida that the call is being recorded.

Finally, the issue of malpractice liability should be considered. While a phone recording can be helpful in the event of a negative outcome (to prove what information was provided to the patient), it, just like any other documentation, can also be harmful (to prove what information was not provided to the patient). Thus, physician practices considering recording more than routine scheduling calls need to give some thought as to whether such recordings will be helpful or harmful if an issue were to arise. Practices may also want to reach out to their malpractice carriers to see if they have any opinion or policy regarding recording phone calls with patients.

Kelli Fleming is a partner with Burr & Forman LLP practicing in the firm’s Health Care Industry Group. Burr & Forman LLP is a partner with the Medical Association.

Posted in: HIPAA

Leave a Comment (0) →

HIPAA Guidance for Mass Shootings and Other Tragic and Emergency Situations

HIPAA Guidance for Mass Shootings and Other Tragic and Emergency Situations

In the aftermath of one of the deadliest school shootings in U.S. history, many health care organizations are revisiting their HIPAA policies and procedures to determine exactly what information they are allowed to share and to whom they may share information. 

FAMILY AND FRIENDS

A health care entity may share a patient’s location, general condition or death with a patient’s family, guardian, or friend who is involved in the patient’s care or who may be responsible for payment of the patient’s treatment. This may occur in a variety of circumstances including, but not limited to, the following:

  • If the patient is present and able to consent to the disclosure, the health care provider must obtain the patient’s consent, provide the patient with the opportunity to object to the disclosure, or based on the professional judgment of the health care professional, they may reasonably conclude that the individual would not object to the disclosure being made.
  • If the patient is not present or unable to consent due to incapacity or emergency, the health care professional may in the exercise of professional judgment determine whether the disclosure to the family, friend or guardian is in the best interest of the patient.
  • If the patient is deceased, the health care provider may disclose information about the patient to the family member, friend or guardian unless the health care professional is specifically aware that the patient expressed that the disclosure not be made prior to their death.
  • Health care providers may also share information about a patient with police, media outlets or the general public when attempting to identify, locate or notify family members, guardians or personal representatives of a patient. Information that may be shared include the patient’s location, general health status or death.
  • PHI may be shared with disaster relief organizations that are legally responsible for assisting with disasters if doing so will assist in the notification of family members or other individuals responsible for the patient’s care. [1]

MEDIA OUTLETS

Hospitals and health care entities may share general information about a patient with media outlets in an effort to identify, locate or notify individuals responsible for the patient’s care. However, if the request is initiated by the media, you must consider the following:

  • If the patient is conscious and does not specifically object, limited facility directory information may be shared as long as the requestor identifies the patient by name. This information includes whether the patient is indeed seeking treatment at the facility, whether they are in critical or stable condition, and whether they sought treatment and are now released.
  • If the patient is unable to consent, the health care provider can determine based on their professional judgment whether notifying the media or general public of the patient’s status or death is in the best interest of the patient.

Specific information about a patient’s care, such as x-rays, tests performed and test results, or details of a patient’s diagnosis may not be disclosed without either the patient’s authorization or the authorization of their personal representative.

LAW ENFORCEMENT

Health care entities can provide information to law enforcement with a signed HIPAA authorization from the patient or the patient’s personal representative. However, there are instances in which PHI may be shared with law enforcement without patient consent. Those instances include:

  • When the health care professional reasonably believes that the report would prevent or lessen a serious and imminent threat to the health or safety of an individual or the public;
  • The entity believes in good faith that it is sharing information that may be evidence of a crime that occurred on the premises of the entity;
  • Alerting law enforcement of the death of an individual when there is a suspicion that the death resulted from criminal conduct;
  • When responding to an off-site medical emergency, as necessary to alert law enforcement to criminal activity;
  • When it is required by law to make reports to law enforcement, like in instances of treating gunshot or stab wounds;
  • In compliance with court orders, warrants, subpoenas or summons;
  • In response to a request by law enforcement to identify or locate a suspect, fugitive, material witness or missing person (the information must be limited to basic demographic and identifying information about the person); and
  • Instances of child abuse or neglect reporting when the entity receiving the report is officially authorized by law to receive the report[2].

WHAT ABOUT THE SUSPECT?

When law enforcement needs assistance with identifying and locating a suspect, fugitive or material witness to a crime, health care entities are encouraged to cooperate with these requests.  However, those disclosures must be limited to the following information:

  • Name and Address,
  • Date and Place of Birth,
  • Social Security Number,
  • ABO Blood Type and RH Factor,
  • Type of Injury,
  • Date and Time of Treatment,
  • Date and Time of Death, and
  • Description of Distinguishing Physical Characteristics[3] (Ex. Tattoos, mustache, beard).

Any additional disclosures about a suspect’s medical information, such as DNA tests or body fluid analysis, can only be disclosed upon the presentation of a signed authorization, court order, warrant or documented administrative request.

WHAT IS A HIPAA WAIVER, AND WHEN DOES IT APPLY?

There is no lack of confusion regarding what a HIPAA waiver is and when it may be utilized. Waivers of HIPAA sanctions and penalties occur when the President declares an emergency or disaster and the Secretary of the Department of Health and Human Services (HHS) waives provisions of the Privacy Rule during the emergency or disaster.

If the Secretary issues such a waiver, it only applies:

  • In the emergency area and for the emergency period identified in the public health emergency declaration;
  • To hospitals that have instituted a disaster protocol. The waiver would only apply to patients at such hospital; and
  • For up to 72 hours from the time the hospital implements its disaster protocol.[4] Once the limited waiver terminates, health care entities are required to comply with the HIPAA Privacy Rule.

It is important to know under what circumstances you can disclose information and to whom those disclosures can be offered. Failure to understand these requirements may place you at risk for HIPAA violations and sanctions. If you have specific questions about disclosures of PHI, please contact a health care compliance professional.

[1] 45 CFR 164.510(b)

[2] 45 CFR 164.512

[3] 45 CFR 164.512(f)(2)

[4] 45 CFR 164.510(b)(4)

Article contributed by Samarria Dunson, J.D., CHC, CHPCattorney/principal of The Dunson Group, LLC, a health care compliance consulting and law firm in Montgomery, Ala. The Dunson Group, LLC, is an official partner with the Medical Association.

Posted in: HIPAA

Leave a Comment (0) →

Have You Properly Obtained Informed Consent?

Have You Properly Obtained Informed Consent?

In June, the Pennsylvania Supreme Court issued a controversial opinion holding that a physician had to have face-to-face interaction with the patient to effectively obtain informed consent. This has raised heightened awareness of a physician’s obligations to obtain informed consent from their patients and caused many to evaluate their own practice of obtaining informed consent.

In Shinol v. Toms, a patient brought a medical malpractice case against a neurosurgeon alleging he failed to obtain informed consent. (2017 WL 2655387). The record and testimony at trial established that the physician met with the patient on two occasions prior to surgery to discuss potential complications. The physician testified that he explained the different approaches and options for surgery. The patient also had a telephone conversation with a certified physician assistant (“PA”) who worked for the physician, and just before surgery, the patient met with the PA who obtained her medical history, conducted a physical examination and obtained an executed informed consent form. The form gave the physician permission to perform “‘a resection of recurrent craniopharyngioma.” The patient’s signature acknowledged that she had discussed the advantages and disadvantages of alternative treatments, that the form had been fully explained to her, that she had an opportunity to ask questions, and that she had sufficient information to give her informed consent.

Despite her signature on the consent form, the patient alleged in the lawsuit that she was not fully informed of her options (total versus subtotal resection of a non-malignant brain tumor). According to the patient, if she had been given the option of a subtotal resection, she would have chosen the less aggressive form of surgery.

After the physician received a jury verdict in his favor, the state supreme court declared a mistrial based on an improper jury instruction related to informed consent. The jury had been instructed that it could consider any relevant information it found was communicated to the patient by “any qualified person acting as an assistant to the physician.” In granting a new trial, the Pennsylvania Supreme Court held that the surgeon himself had to have face-to-face conversations with the patient about the risks of surgery in order for him to have properly obtained informed consent from his patient. In other words, evidence of the discussions with the PA could not be considered by the jury in their deliberations of whether informed consent was properly obtained. The court’s opinion was an extension of a previous opinion that held informed consent could not be delegated to a hospital; the physician was responsible for obtaining it.

Similar to Pennsylvania, Alabama courts have found that a hospital and its staff do not have an independent obligation to obtain informed consent from a patient.  Wells v. Storey, 792 So. 2d 1034 (Ala. 1999). However, this does not necessarily equate to the ruling in Shinol. Based on Shinol’s strict interpretation and possible increased scrutiny as a result of the holding, a review of Alabama law on informed consent is warranted.

It is the duty of the physician to inform the patient of the risks and obtain their consent, and if the physician fails to get informed consent, a patient has a cause of action under the Alabama Medical Liability Act (“AMLA”). Historically, the cause of action for a failure to obtain informed consent evolved through the legal theory of battery. The reason being that a person has the “‘right to determine what shall be done with his own body; and a surgeon who performs an operation without his patient’s consent commits an assault for which he is liable in damages.'” See Fain v. Smith, 479 So. 2d 1150 (Ala. 1985) (quoting Schloendorff v. Society of New York Hospital, 105 N.E. 92, 93 (1914)).

The elements of the claim are:

  1. the physician’s failure to inform the patient of all material risks associated with the procedure, and
  2. a showing that a reasonably prudent patient, with all the characteristics of the plaintiff and in the position of the plaintiff, would have declined the procedure had the patient been properly informed by the physician.

The test for determining whether the physician has disclosed all material risks to the patient is “a professional one, i.e. whether the physician had disclosed all the risks which a medical doctor practicing in the same field and in the same community would have disclosed. Expert testimony is required to establish what the practice is in the general community.” Giles v. Brookwood Health Services, 5 So. 3d 533 (Ala. 2008).

In one Alabama case, the physician entered into evidence an informed consent form signed by the patient. Although the patient stated she did not give consent, the court found the forms alone sufficient to dismiss the patient’s claims for assault and battery. There was no discussion in the court’s opinion as to how the form was presented to the patient or whether there was detailed discussion between the patient and the physician.

In another Alabama case involving the scope of consent, the physician obtained an executed form from the patient consenting to a specific procedure but also stating that the physician was authorized to perform “such additional operations/procedures during the course of the above as are considered therapeutically necessary or advisable in the exercise of professional judgment.” The patient alleged that the consent form did not give the physician “carte blanche” to perform any procedure. In this case, the physician had mistakenly removed an ectopic kidney the physician thought was a tumor. The Alabama Supreme Court overturned the lower court’s ruling in favor of the patient on the issue of informed consent and stated that there must be expert testimony as to whether the procedure performed by the physician was reasonable in light of the findings during the surgery.

Although the cases and elements mentioned above require the physician to inform the patient, there are no cases in Alabama that specifically require a face-to-face meeting/encounter with the patient to give informed consent (although this is definitely best practice) and certainly nothing in our case law that says a PA or other qualified health care professional may not explain the risks associated with a procedure. The law requires a physician to exercise that level of reasonable care, skill and diligence as a similarly situated physician and this rule should be followed when it comes to informed consent. It would also be wise to review consent forms to ensure they are not too limited in the grant of consent and ensure you are documenting all discussions with patients about the risks of procedures.

Angie Cameron Smith is a partner at Burr & Forman LLP practicing in the firm’s Health Care Industry Group. Burr & Forman LLP is a partner with the Medical Association.

Posted in: Legal Watch

Leave a Comment (0) →