We recently reviewed a medical release from a major U.S. TPA that is very well-known in this industry—their release clearly did not comply with federal law and they are unquestionably violating the law in all of their claims involving use of this release. We have told them it has to be updated. And we just reviewed a medical release from a major Illinois employer and immediately noted a number of deficiencies. We are pretty confident no one in these organizations took the steps necessary to comply with the law more than a decade ago. We have made detailed recommendation on how they should do so and hope they catch up before the Federales catch up first.

HIPAA (it is not HIPPA) is the Health Insurance Portability and Accountability Act. It was signed into law by President Bill Clinton on August 21, 1996. Most healthcare insurance companies and providers were to adhere to the HIPAA regulation guidelines by October 2002. The HIPAA law presents a multi-step approach geared to improve the United States’ health and WC insurance system. One approach of the HIPAA regulations was to protect patient privacy. This provision is in Title IV which defines rules for protection of patient information.

All healthcare providers, health organizations, and government health plans that use, store, maintain, or transmit patient health care information are required to comply with the privacy regulations of HIPAA. We also feel all Illinois and U.S. employers need to create a “HIPAA circle” of the managers who are able to receive, consider and disseminate private health information. To protect your organization, you should consider creating such a “circle” if you haven’t already done so. If you need guidance or counsel on how to set up a HIPAA circle in your organization, send a reply.

One easy step in analyzing all medical releases is to look and see whether the medical release provides the power of revocation. Older releases don’t have such language. Both of the organizations mentioned above presented medical releases that did not allow revocation. When we see a release that doesn’t allow for revocation, we then assume most of the other HIPAA requirements aren’t present.

Here are the HIPAA requirements right out of the applicable Federal Code:

A valid HIPAA authorization under this section must contain at least the following elements:

(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.

(iv) A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.

(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.

(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.

Required statements In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:

(i) The individual’s right to revoke the authorization in writing, and either:

(A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or

(B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entity’s notice.

(ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either:

(A) The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations In paragraph (b)(4) of this section applies; or

(B) The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.

(iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this rule.

Plain language requirement The authorization must be written in plain language. No one knows whether “plain language” relates to folks who have law degrees or folks whose highest grade level was junior high in rural Appalachia.

Copy to the individual If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization.

If you need us to review your current medical release, we are happy to do so without charge—send it along. We appreciate your thoughts and/or comments or simply post them on our award-winning blog run by our Blogmaster, Arik D. Hetue at www.keefe-law.com/blog

The PIL database is most useful for detecting and preventing “doctor-shopping.” It is also helpful if you note a particular claimant is getting more narcotics than they could possibly or safely ingest by themselves and therefore may be illegally reselling the extra drugs for cash. After a provider’s registration is approved, the provider can log on and view the last 6 months of controlled substance prescriptions for a given patient. If a physician sees a pattern of excessive use of controlled substances, violations of narcotic contracts, or multiple providers they can change the treatment plan as well as alert other providers who may also prescribing controlled substances to the patient. The doctor does not have to be from Illinois to have access—they have to simply apply and send their bona fides to the Department for the registration and approval process. Providers who been given a password access to the system by the Illinois Department of Human Services can access patient information by getting logged into the website www.ilpmp.org.

The reader’s question was: You indicate IME doctors should routinely run this prescription check as part of the services included in a solid exam. You also indicate in order for the information to be shared there needs to be HIPAA authorization signed by the claimant. In many cases we are finding claimants refuse to sign the HIPAA releases and when getting them from Petitioner’s attorneys they are exclusively for specific doctors, other care-givers and dates. How can we get the PMP info from the IME doctor if we don’t have a signed release?

The answer is: According to the PIL (Prescription Information Library maintained by PMP) because the disclosures of information to the PIL by pharmacies are mandated by law and not discretionary, the patient does not need to be informed of the disclosure, and does not need to consent to it. That language is taken directly from the PMP website.

Therefore, any licensed doctor or pharmacist can review the website and get the information for you. They don’t need a HIPAA release for that purpose.

As a best practice, we feel the IME doc should have a HIPAA release signed to disclose it to you. Because it is a workers’ comp claim, technically it should fall under the U.S. Department of Labor’s workers’ comp exception to HIPAA but we still encourage folks to have a release signed, if possible. Thereafter, once you or anyone in your company has the results of the PIL from any doc—that information cannot then be redisclosed, openly discussed or used by anyone outside the HIPAA circle without a HIPAA release protecting you when it is redisclosed.

If you have any questions or comments, please forward them to our resident Blog Administrator, Arik D. Hetue, J.D. who can be reached at ahetue@keefe-law.com or post them later today on our award-winning blog at www.keefe-law.com/blog.

We assure all of our readers there is no portion of the Illinois Criminal Code which provides for criminal charges against an insurance adjuster or a nurse case manager if they provide information to a treating doctor, attend an examination of a patient or ask questions of a physician. There are no recorded Illinois workers’ compensation cases that provide any direct sanctions against a nurse or an adjuster who makes professional inquiries of doctors or other care-givers.

Going from the general legislation to the specific, to our knowledge, Illinois Arbitrators and Commissioners have no direct “control” over anything a nurse case manager does other than the general control they have over anyone dealing with injured workers. We point out the word “nurse” does not appear in the Illinois Workers’ Compensation Act. The word “nurse” does appear a couple or three times in the Rules Governing Practice but not in the context of a nurse’s rights and duties. There is no provision in the law providing the Commission any sanctioning power as it relates to nurses.

So what is all the fuss about? Well, we have told you many times it is our view Illinois’ workers’ compensation system continues to demonstrate too much control by claimant lawyers. Such attorneys try and try to exert complete control of any and all medical care for injured workers. Many of them are wildly adamant about the topic and don’t want any other interested party in the system to even “pretend” to have input or control. There are some lawyers who simply make every effort to “bar” nurse case managers from their claims, as if there was something untoward or improper about their role.

The main case that is so badly misrepresented as carrying some penalty or danger for nurses is the Hydraulics v. Industrial Commission ruling which followed a 2d District Appellate Court decision that everyone knows simply as Petrillo. The ruling in Petrillo started the concept in the general liability courts of trying to bar “ex parte” communications with treating physicians based upon the patient-physician privilege. An ex parte communication with a treating physician is a communication without permission of the patient. If you have permission of the patient, you can talk to a treating physician all you want—we jokingly call it a parte communication.

From that base, the Appellate Court, Workers’ Compensation Division in Hydraulics implemented an evidentiary ruling which blocks from evidence medical reports or opinions from treating physicians that are arguably the result of those dastardly ex parte communications. Please note the only thing the Appellate Court did in Hydraulics was create an evidentiary ruling about the admissibility of supposedly tainted treating reports—they created no direct supervisory rules or sanctions relating to nurse case managers in any way. Again, if you have the permission of the patient, you can talk, chat, gossip, use smoke signals or communicate with a treating physician as much as time and the doctor will allow.

In either setting, it always remains the option of the physician when and if they will talk to you. And try as you might, doctors’ opinions are their opinions.

Thereafter, in our opinion, the Federal Government superseded all of it in 1996 when they passed and implemented the HIPAA law and regulations. Always remember HIPAA is federal law that trumps state law. HIPAA provided national control and direction on how to store, handle and disseminate any private health information or PHI.

Every Illinois nurse case manager and insurance adjuster should memorize this sentence:

If a nurse case manager has a signed HIPAA release from an injured worker that provides for communication with a treating doctor, you have the legal power to communicate with a treating doctor in any way the release says.

This is the answer to almost every question we get asked about contacts with treating doctors and other healthcare givers. To all the legal, paralegal and other experts out there who want to tell us there is a workers’ compensation exception to HIPAA, we assure you it is only a weak fall-back position in litigated claims in this state and every claim in Illinois is a potentially litigated claim. The best model to follow is the sentence above—if you want to discuss or have questions about the workers’ compensation exception to HIPAA send a reply and we will further explain why this is a much better approach.

Any answer you get to a question from a treating physician when you have a HIPAA-compliant release signed by the patient should be admissible in any hearing whether it is a general liability, employment law or workers’ compensation claim. Such a communication cannot be ex parte because of the existence of the signed release, providing written permission under federal law for all questions.

So what do you do if claimant’s counsel comes on board and tells you all future communication with a treating physician has to follow his/her rules? Our answer is work with counsel to find a fair and reasonable middle ground. The biggest concern of claimant counsel is to insure all communications between the nurse case manager and treating physician are entirely “transparent.” By that we mean nothing about such communications should be hidden or kept secret from the patient or his attorney. The vast majority of claimant attorneys in this state want and need NCM’s to help get records, insure bills are paid in a timely fashion and track progress. The attorneys also want to protect their injured workers from any interference on the decision-making processes of the treating physicians by anyone. We will let all of you decide whether an NCM can unduly influence a doctor but, at the same time, if your records and reports are transmitted simultaneously to both the insurance carrier, the patient and claimant attorney at the same time, it is hard to imagine any undue influence can be demonstrated.

If you need our recommended HIPAA-compliant release, send a reply. We urge all Illinois employers to have your injured workers fill out an accident report and then sign a HIPAA-compliant release when they first stabilize following injury. If you have other questions or concerns about the issues raised in this article, please send your thoughts and comments.