Who Owns Medical Records in the Digital Age?

Determining who owns medical records in the age of electronic health records remains somewhat ambiguous. In fact, recent issues at the University of Rochester Medical Center highlight the confusion as the health provider recently reached settlement over a violation of protected health information because a nurse practitioner took patient information to a new practice. Thus, the relevant question is whether the provider, the physician, the electronic health record provider, or the patient own the information?

Many patients assume the Health Insurance Portability and Accountability Act (HIPAA) provides ownership of health information to the patient, but the law, in fact, fails to specify. Largely, this issue is left to state legislatures to determine, but the majority of states have failed to address the issue. According to a recent survey by the George Washington University’s Hirsh Health Law and Policy Program and the Robert Wood Johnson Foundation, only New Hampshire provides ownership of medical records to the patient, while in 20 other states, the healthcare provider owns them.

In the age of electronic health records, patient data is quickly shareable between physicians, patients, and other individuals. This poses new legal challenges for healthcare providers and physicians, especially as the laws and regulations on protected health information continue to evolve and state attorneys general start to enforce the privacy laws under the Health Information Technology for Economic and Clinical Health Act. This means that physicians and healthcare providers of all types should ensure that their internal policies on health records fully comply with the evolving legal landscape.

© 2015 Houghton Vandenack Williams
For more information, Contact Us

Weak Passwords Put Patients’ EHR at Risk

By M. Thomas Langan II.

A recent government report criticized the current electronic health record certification process for failing to require strong passwords.  These vulnerabilities make it easier for hackers to penetrate electronic health record (“EHR”) systems and access patient records.  The report comes amid a study that many patients are reluctant to divulge their information when their physician uses EHR out of fear of their data’s security.  Despite the current lax requirements, it is recommended that all passwords be at least 8 characters long and contain 3 of the following: capital letters, lowercase letters, numbers and special characters and are changed at least monthly.

The government’s report can be found here: http://oig.hhs.gov/oas/reports/region6/61100063.asp

The study can be found here:  http://jamia.bmj.com/content/early/2014/07/24/amiajnl-2014-002804.abstract

© 2014 Parsonage Vandenack Williams LLC

For more information, Contact Us

CMS Website Posts Updated EHR Incentive Program FAQs

The Centers for Medicare & Medicaid Services (“CMS”) recently added to its collection of more than 100 questions about meaningful use, eligibility and other aspects of electronic health-record incentive programs.

For example, new additions to the FAQ section include a clarification of how to calculate Medicaid patient volume or needy patient volume for the Medicaid EHR incentive program.

The 45-question section on meaningful use provides information on a variety of topics, including patient-education resource requirements, specifications for quality reporting and electronic prescribing.

The CMS EHR incentive program FAQs can be viewed at:


© 2011 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

Medicare Attestation of “Meaningful Use” Begins April 18

Physicians who believe they have met the objectives to qualify for meaningful use incentives under the Medicare Electronic Health Record (“EHR”) Incentive Program can start attesting to having met the criteria on April 18, 2011.  Although registration for meaningful use began on January 1, 2011, physicians are required to meet the meaningful use criteria for 90 consecutive days before they qualify for incentive payments. The Centers for Medicare and Medicaid Services (“CMS”) has published a Medicare user guide and webinar to help physicians with registration and attestation.

Physicians are encouraged to register as soon as possible, even if they do not yet have a certified EHR or enrollment record in PECOS.

In Stage 1 of meaningful use, meaningful use includes both a core set and a menu set of objectives that are specific for physicians.

Eligible Professionals must complete:

  • 15 core objectives
  • 5 objectives out of 10 from menu set
  • 6 total clinical quality measures (3 core or alternate core, and 3 out of 28 from alternate set)

It is important for physicians to make sure to start their 90-day reporting period no later than October 1, 2011, in order to attest and receive a Medicare payment in 2011.

For more information, go to Medicare EHR Incentive Program User Guide and the Medicare and Medicaid EHR Incentive Program Webinar.

© 2011 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

“Meaningful Use” Website Launched

The Healthcare Information and Management System Society (“HIMSS”) has launched Meaningful Use OneSource, an online source containing almost 400 documents, tools, and links to other available knowledge.

HIMSS developed the site to help individuals and organizations prepare for the meaningful use and certification criteria and standards regulations.

Among other things, the site clarifies:

  • How to meet and use meaningful use certification criteria;
  • How to receive the Medicare and Medicaid incentive funding and avoid penalties;
  • How to implement meaningful use in a healthcare organization; and
  • How to access recently released updates on federal and state laws and regulations.

The site provides information in three main categories:

  1. The Basics: Meaningful Use 101;
  2. Qualifying for Meaningful Use and Funding; and
  3. Putting Meaningful Use into Practice.

Users can access specific information relevant to their situations and organizations within each area.

New information will be added to the site on a regular basis.  HIMSS reviews all research and information before it is posted, so users can be assured they are viewing accurate, credible and current knowledge.

Source: Rajecki, Ron. “New Web Site is Online Repository for Meaningful Use Information.” InfoTech Bulletin.  10 Feb. 2011.

© 2011 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com

How to Control the Costs of Adopting Electronic Medical Records

One of the growing trends for healthcare practices in 2010 is the adoption of electronic medical records (“EMR”).  By managing the selection and adoption of EMR correctly, practices will save money in the long-term. 

Well-researched and efficient management of the selection and adoption process will help a healthcare practice cut costs and reduce frustration.  The following are five key strategies to follow:

  • Make sure you have a full understanding of what an EMR can really be expected to do before you buy a product.
  • Obtain input from all of areas of the practice, including administrative and clinical support staff, regarding what is needed in terms of EMR.
  • Use the opportunity to change workflow rather than try to make the tool work just like the practice.
  • Do not worry about accommodating every single person’s ideas regarding how the software should look and work – focus on the overall picture.
  • Do not try to save money by skimping on training – proper use of EMR is essential for efficiency and cutting costs.

An EMR can be a great tool that improves a healthcare practice’s efficiency, reduces costs, and increases revenue.  By taking the time to make a careful EMR selection and following the above strategies, the practice will greatly benefit from the product.

© 2010 Parsonage Vandenack Williams LLC

  For more information, contact info@pvwlaw.com