Kristen Marotta writes:

Recently on Fox’s HIPAA & Health Information Technology blog, we discussed the privacy and security issues arising from the growth of telemedicine, as well as the general benefits that such growth could have for recent medical graduates. Now, with more funding and attention being given to telemedicine, new physicians will have the opportunity to make a difference in rural health care and move the industry into an entirely new direction.

The New York City skyline, including the Empire State BuildingIn New York, recent funding has been made available through the New York Office of Mental Health (OMH) to expand the use of telemedicine in the treatment of mental health patients. This new funding stream for “telepsychiatry” provides a new avenue for the practice of psychiatry in New York and provides a unique consideration for New York physicians considering the practice of psychiatry for their long-term career.

Psychiatrists or physicians considering the practice of psychiatry should familiarize themselves with the OMH’s regulations on telepsychiatry services set forth in Title 14 of the New York Code, Rules and Regulations (NYCRR), including Part 596, which recently expanded the ability of physicians to practice telepsychiatry outside of outpatient clinic settings, including between OMH-licensed sites and provider sites enrolled in New York State Medicaid. A summary of the current regulations, as well as additional guidance on telepsychiatry in New York, can be found on the OMH website. In particular, we note a comprehensive checklist and guidance published by the OMH in early 2017 regarding provider responsibilities in practicing telepsychiatry.  We also note that privacy and security concerns are discussed in this checklist. Providers rendering telepsychiatry services must comply with all federal HIPAA laws and regulations, in addition to New York’s Mental Hygiene Law Section 33.13.

Due to the nature of telepsychiatry (or any type of telemedicine), it is important for providers to remember that there are two physical locations where protected health information of patients is potentially used and disclosed. For telepsychiatry in New York, the policies and procedures at the distant site must match those of the originating site exactly. In addition, both sites must meet “the minimum standards for privacy expected for patient-clinical interaction at a single Office of Mental Health licensed location.” [14 NYCRR 596.6(b)(2)(ii)]. For confidentiality purposes, when physicians practice telemedicine of any type, they should abide by the same rules as they would for written clinical medical records.

In addition to the highly technical components discussed in the OMH’s guidance, providers will also need to substantively update their policies and procedures. Two examples that providers should note are as follows. First, written protocols and procedures relating to telepsychiatry should be developed and followed. These policies and procedures should include a special provision for obtaining a patient’s informed consent before recording telepsychiatry sessions. Second, staff trainings must include the topic of telepsychiatry and technical training of telepsychiatry equipment. Staff will also need to be “immediately available” to attend to emergencies and other concerns during the patient’s actual telepsychiatry session. [14 NYCRR 596.6(b)(7)(iii).]

Stay tuned to Fox Rothschild’s Physician Law blog for updates on how developments in the practice of telemedicine in New York and other states affect physicians.


Kristen A. Marotta is an associate in the firm’s Health Law Department, based in its New York office.

On the firm’s HIPAA & Health Information Technology blog, associate Kristen Marotta discussed the privacy and security issues arising from the growing use of telemedicine, particularly for mental health treatment. Kristen examines the myriad considerations doctors should address in setting up a telemedicine model for their practices, and notes federal funding recently made available via New York State’s Office of Mental Health to expand the use of mental health-focused telemedicine in the state.

We invite you to read Kristen’s piece, and stay tuned for an upcoming post on this blog delving into New York’s regulations surrounding telepsychiatry.

Last month, Apple issued a long awaited announcement of their move into the medical records field, by debuting new functions in the updated Health app for the iOS 11.3 beta, allowing users to view and aggregate their medical records on their iPhones.

The new “Health Records” features within the Health app brings together hospitals, clinics and the existing Health app to make it easy for consumers to see their available medical data from multiple providers whenever they choose. Now, consumers will have medical information from various institutions organized into one view covering allergies, conditions, immunizations, lab results, medications, procedures and vitals, and will receive notifications when their data is updated. The Health Records data is encrypted and protected with the user’s iPhone passcode.

To launch the beta version that features the new “Health Records” section, Apple partnered with 12 major health systems[1] and leading EHR vendors Cerner and Epic, using Fast Healthcare Interoperability Resources (FHIR) to facilitate the transfer of medical records. In the coming months, more medical facilities will connect to Health Records offering their patients access to this feature.

The goal is for consumers to have their medical information from various institutions organized into one view covering allergies, conditions, immunizations, lab results, medications, procedures and vitals. It all works when a user opens the iPhone’s health app, navigates to the Health Record section, and, on the new tool, adds a health provider. From there, the user is connected to Apple’s software system to obtain their records and even incorporate new data. Patients will also receive notifications when new information is added to their record.

Regulators and patient advocates have for years pushed for data-sharing standards within the medical sector to make it easier for records to flow between hospitals and doctors’ offices. The lack of interoperability has led to inefficiencies in care and frustrations from both providers and consumers. This move by Apple could effectively pressure EHR vendors to open up access to patients’ digital records and truly force EHR vendors to provide access to their data through open application programming interfaces (API) as mandated by the 21st Century Cures Act.

 

[1] The following participating hospitals and clinics are among the first to make this beta feature available to their patients:

  1. Johns Hopkins Medicine – Baltimore, Maryland
  2. Cedars-Sinai – Los Angeles, California
  3. Penn Medicine – Philadelphia, Pennsylvania
  4. Geisinger Health System – Danville, Pennsylvania
  5. UC San Diego Health – San Diego, California
  6. UNC Health Care – Chapel Hill, North Carolina
  7. Rush University Medical Center – Chicago, Illinois
  8. Dignity Health – Arizona, California and Nevada
  9. Ochsner Health System – Jefferson Parish, Louisiana
  10. MedStar Health – Washington, D.C., Maryland and Virginia
  11. OhioHealth – Columbus, Ohio
  12. Cerner Healthe Clinic – Kansas City, Missouri

This piece originally appeared in the February 2018 issue of the Allegheny County Medical Society Bulletin.

Richard L. Holzworth writes:

In April 2016, Gov. Tom Wolf signed into law Pennsylvania’s compassionate medical cannabis legislation (Act 16), effectively legalizing medical marijuana in the Commonwealth. Since that time, the Pennsylvania Department of Health (DOH) has awarded 12 licenses to grow medical marijuana and 27 licenses to operate medical marijuana dispensaries. It is anticipated that the grow operations and dispensaries will be open for business in early 2018. Although the proponents of medical marijuana have enjoyed widespread support (as evidenced by the 29 states that have enacted a medical marijuana law, including six since 2016), those in the industry are left to trust that Pennsylvania physicians will register with the DOH and send patients to the dispensaries. In other words, now that the legal medical marijuana system is in place, the onus is on physicians to ensure that patients have access to treatment.

Patient and physician registration

It is important for medical professionals to understand that they are not permitted to “prescribe” medical cannabis products. Rather, physicians who have met the registration requirements of Act 16 are permitted to issue “certifications” to patients who qualify for medical marijuana treatment.

In order for a patient to qualify for medical marijuana treatment, the patient must obtain a certification from a registered physician stating that the patient suffers from one of the 17 “serious medical conditions” identified in Act 16. These conditions include:

  • Amyotrophic Lateral Sclerosis;
  • Autism;
  • Cancer;
  • Crohn’s Disease;
  • Damage to the nervous tissue of the spinal cord with objective neurological indication of intractable spasticity;
  • Epilepsy;
  • Glaucoma;
  • HIV/AIDS;
  • Huntington’s Disease;
  • Inflammatory Bowel Disease;
  • Intractable Seizures;
  • Multiple Sclerosis;
  • Neuropathies;
  • Parkinson’s Disease;
  • Post-Traumatic Stress Disorder;
  • Severe chronic or intractable pain of neuropathic origin or severe chronic or intractable pain in which conventional therapeutic intervention and opiate therapy is contraindicated or ineffective; and
  • Sickle Cell Anemia.

Once a patient obtains a certification, then the patient must apply for a medical marijuana ID card through DOH. If the application is accepted, the patient (or a qualified, registered caregiver) may take the medical marijuana ID card to a state-licensed dispensary to obtain marijuana products.

In order for physicians to issue medical marijuana “certifications,” they must register with the DOH and complete a four-hour training course offered by DOH-approved providers. The DOH training course covers the following areas:

  • Summary of Act 16;
  • General information about medical marijuana under state and federal law;
  • Scientific research on medical marijuana;
  • Recommendations for medical marijuana, including pain management, risk management, palliative care, misuse of opioids and medical marijuana, and informed consent.

Physicians also are required to be licensed to practice medicine in Pennsylvania and be qualified, by training or experience, to treat at least one of the 17 serious medical conditions.

Once registered, the DOH will place the physician’s name, business address and medical credentials on the physician medical marijuana registry. The registry does not include contact information (telephone numbers or email addresses).

Importantly, registered physicians are not permitted to advertise that they are credentialed to certify patients for medical marijuana use. The DOH regulations have not provided much guidance in the way of what constitutes “advertising” or what is actually permitted, including whether physicians may list medical cannabis certification on their “menu” of services.

Continue Reading A Physician’s Guide to Navigating Medical Marijuana Registration

Earlier this month, Attorney General Jeff Sessions issued a Memorandum rescinding the Obama Administration’s “hands off” policy with respect to the prosecution of licensed cannabis distribution in states where medical or recreational marijuana are legalized.  Our sister blog, “In the Weeds” has covered the issuance of this new Memorandum extensively, including how it may affect state medical marijuana programs around the country.

Medical marijuana in jar lying on prescription form
Copyright: megaflopp / 123RF Stock Photo

So far, U.S. Attorneys in many of the states that have legalized medical marijuana (including Pennsylvania) have made public statements to the effect that they are not interested in prosecuting violations of federal law with respect to cannabis, especially if the activity involved is in compliance with state law.

  • For more information on the Sessions Memorandum, please see this post.
  • For more information on the responses to the Memorandum from U.S. Attorneys (including the U.S. Attorney for Pennsylvania’s Middle District), please see this post.
  • For Pennsylvania physicians, it appears that the medical marijuana program continues to be on track for implementation on April 1, 2018.  Pennsylvania Gov. Wolf issued a statement in response to the Sessions Memorandum confirming that he would seek legal action against the federal government to the extent that the federal government interferes with Pennsylvania’s medical marijuana program.  [See Governor Wolf’s statement].

Stay tuned to Fox Rothschild’s Physician Law Blog for updates on how the Sessions Memorandum will affect state medical marijuana programs.

Fox Rothschild’s HIPAA & Heath Information Technology Blog recently published two posts directly relevant to physicians and medical practices.  The first post, 5 Common HIPAA Mistakes to Avoid in 2018, addresses some typical misconceptions regarding disclosure of protected health information (PHI) and offers some ideas regarding how to avoid them.

The second post, New HIPAA Guidance on Disclosure of PHI related to Opioid Abuse and Mental Health, touches on the most recent HIPAA guidance released by the U.S. Department of Health and Human Services, Office of Civil Rights (OCR) regarding when and to whom PHI of patients suffering from addiction and mental illness may be shared.  Among other things, the guidance addresses disclosure of PHI to family members or friends of patients in situations where the patient is incapacitated or there is a serious or imminent threat to the patient’s health.  The guidance also addresses HIPAA’s rules on sharing PHI regarding a patient’s substance abuse or mental health with other treating physicians.

The OCR has published webpages on its website to make this guidance easily accessible and understandable to health care professionals and patients.

As always, if you have a specific question regarding your practice, please consult a knowledgeable attorney.

CMS recently issued an Advisory Opinion suggesting that physicians who refer diagnostic tests reimbursable under Medicare to a laboratory may, under certain circumstances, receive electronic pop-up notifications in the laboratory’s web-based portal alerting the physicians to various potential issues related to the test results.  In the Advisory Opinion, CMS considered certain alerts which a laboratory proposed to provide to its referring physicians without charge via the laboratory’s web-based portal.  The entire Advisory Opinion can be read here.

In short, CMS concluded that the alerts proposed by the laboratory, which would be limited to issues relating to the test results, would not constitute illegal remuneration under the federal Stark law, as long as (1) the alerts are provided solely in connection with the ordering or communication of diagnostic test results from the laboratory, and (2) appropriate safeguards are in place to avoid overutilization or medically unnecessary testing.

Some of the key safeguards that CMS found persuasive included the following:

  • Alerts recommending additional testing would be based on industry-standard, peer-reviewed guidelines;
  • The alerts would not be “overly intrusive” and would not override the physician’s independent medical judgment;
  • Where multiple additional tests would be recommended in an alert, there would be no “select all” button for the physician to click to order all of the tests together;
  • The physician could turn off the alerts for a particular disease condition; and
  • The physician could obtain the information provided in the alerts free of charge from other sources.

An advisory opinion from CMS is a rare occurrence, in comparison to advisory opinions issued by the Office of Inspector General regarding the federal Anti-Kickback Statute, which occur a number of times each year.  This is the first and only advisory opinion issued by CMS in 2017.  To that end, CMS likely considers this Opinion to be useful guidance to physicians and providers regarding their use of online web portals to order diagnostic tests.

If you or your practice has any questions regarding alerts or other benefits you may receive via a laboratory’s online web portal, please consult experienced legal counsel.

[For more information on CMS’s new Quality Payment Program and what physicians need to report in 2017, please see our prior blog posts here and here.]

CMS recently issued guidance (accessible here) on the three-part “Prevention of Information Blocking” attestation which physicians and other eligible clinicians will need to submit to CMS in order to qualify for points under the “Advancing Care Information” category of the Merit-based Incentive Payment System (MIPS).

Although making this attestation and reporting to CMS regarding use of certified EHR technology (CEHRT) is not required to avoid a penalty under the MIPS for 2017, many physicians and group practices wish to report as much as they reasonably can to seek a high score under the MIPS and a positive payment adjustment to their Medicare reimbursements in 2019.

The three-part attestation centers on the representation that the physician/group practice will not knowingly and willfully limit or restrict the compatibility or interoperability of its CEHRT.  CMS’s guidance makes clear that physicians and group practices making the attestation must use good faith and reasonable efforts to enable the exchange of electronic health records between appropriate parties.

According to CMS, examples of situations where access to CEHRT could be reasonably restricted include:

  1. System Maintenance — Disabling CEHRT for as long as reasonably necessary to complete system maintenance, provided that requests for access to EHR information during such time period are responded to when practical;
  2. Security Concerns — Blocking access to CEHRT when reasonably necessary to ensure the security of EHR information, provided that the blocking was narrowly tailored to the bona fide threat; and
  3. Patient’s Health and Well-Being — Restricting access to certain information (such as a patient’s sensitive test results), if the clinician reasonably believes that the restriction is necessary to protect the patient’s health or well-being. In the case of sensitive test results, CMS suggests that restricting access to the results could be reasonable until the physician or clinician who ordered the test has reviewed and appropriately communicated the results to the patient.

CMS expects that physicians and group practices making the attestation will ensure that their organizational policies and workflows will not restrict functionality of the CEHRT in any way, and that they will work with their CEHRT vendors to ensure that the CEHRT is fully functional.

If you or your practice will be reporting EHR data to CMS under the MIPS for 2017, a full review of CMS’s guidance on the attestation is recommended (see the five-page guidance here).  All physicians and practices reporting EHR data under the MIPS have until March 31, 2018 to report the data and make the attestation.

Gov. Christie’s Administration recently proposed a regulation to curtail the prescription of unnecessary opioid painkillers.  Christie, who serves as the Chairman of President Trump’s Commission on Combating Drug Addiction and the Opioid Crisis, expressed concern that treatment decisions of all prescribers (including physicians, dentists and advanced practice nurses) are being improperly influenced by pharmaceutical companies.  According to Christie’s press release, four out of every five new heroin users began by misusing prescription painkillers, and, in 2016, $69 million was paid to physicians in New Jersey by drug companies and device manufacturers, two-thirds of which went to just 300 physicians.

The New Jersey regulation would take big steps toward restricting what prescribers may receive from pharmaceutical companies, including limiting the value and frequency of meals that may be provided in educational settings, and prohibiting the giving of a variety of items to prescribers, except in limited circumstances (such as for educational materials, for presenting at continuing education events and for bona fide consulting arrangements).  Annual payments for bona fide services would be limited to $10,000.

The proposed regulation will be published for comment in the New Jersey Register on October 2, 2017.  Stay tuned to Fox Rothschild’s Physician Law Blog for updates.

As first reported on our sister blog, “In the Weeds” (post accessible here), on July 26, 2017, the Pennsylvania Department of Health opened its Medical Marijuana Practitioner Registry.  Physicians licensed in the Commonwealth of Pennsylvania may now apply online to register to certify the use of medical marijuana for their patients.  The online application may be completed here.

Medical marijuana in jar lying on prescription form
Copyright: megaflopp / 123RF Stock Photo

The Practitioner Registry will be publicly searchable and will include each practitioner’s name, business address, and medical credentials.  As noted in one of our prior blog posts on the subject (accessible here), it is still unclear whether practitioners may represent on their own practice websites that they are registered with the Pennsylvania Department of Health to certify the use of medical marijuana.

In order to complete the registration process, physicians will be required to complete a four-hour training program on the use of medical marijuana to treat serious medical conditions.  As part of its Press Release on the opening of the Practitioner Registry, the Department of Health has announced that the following two continuing education providers have been approved to offer the training program to practitioners at this time:  Answer Page Inc. and Extra Step Assurance LLC.  Further information on the training courses can be found at the companies’ websites.

For more information on Pennsylvania’s Medical Marijuana Program and how it applies to practitioners, please see our prior blog post on the subject (link), as well as the state website for the Program (accessible at this link).  According to the Press Release, Pennsylvania’s Medical Marijuana Program is still on track to be fully implemented in 2018.