|
|
|
|
|
|
||||||||
|
New Academic Medical Center Planned for Downtown Las Vegas New Task Force Hopes to Strengthen Chairs Roles as Institutional Managers
|
|
Leadership Q&A: The Impact of HIPAA on FundraisingJoanne E. Pollak, V.P. & General Counsel Johns Hopkins MedicineQ. There seem to be conflicting accounts about the impact of the Health Insurance Portability and Accountability Act (HIPAA) on fundraising activities, particularly for academic medical centers (AMCs). Should they be concerned? A. Yes. Unless the HIPAA privacy regulations are changed, as of April 14, 2003, AMCs will not be able to engage in departmental fundraising without special permission granted by patients. Because most AMCs historically have centered their fundraising through departmental and physician-based efforts, the new rule has the potential for serious harm. Q. Don't the privacy regulations permit use of patient information for fundraising without specific patient permission? A. Yes, but only demographic information such as name, address, and telephone, along with dates that health care was provided. In essence, the regulations allow what could be characterized as a general or bulk mailing to patients. Consequently, unless the AMC has signed permission from patients to do so, a physician's name or department where care was rendered cannot be used to make contact with patients for fundraising purposes. If a patient was seen in the cardiology or oncology department, the development office could not use that information for a cardiology or oncology appeal. In fact, development staff couldn't even see that information without specific patient permission. Q. What's the connection between the physician's name or department and a patient's protected health information? A. HIPAA covers the use and disclosure of protected health information, which includes anything that potentially identifies the individual and any information relating to health care services received, including diagnoses. HIPAA prohibits all uses and disclosures of this protected health information unless the privacy regulations specifically allow the use or disclosure. The regulations expressly allow the use of demographic information and dates of service for fundraising purposes - but nothing else without permission. A doctor's name may reveal the type of care rendered, and the department or division usually reveals the broad area of health care. So even though a specific diagnosis may not be revealed, a broad category of care is involved. Q. But don't most patients come to an AMC for specialty services, and wouldn't most patients expect to receive follow-up letters and communications of various kinds? A. Yes. It appears that the departments patients visit are as important to them as the larger institution. Except in limited situations, such as psychiatry, most AMCs believe that patients expect departmental contact and would not see use of this information as a misuse of their protected health information. Q. Why is this type of fundraising so important for AMCs? A. Although AMCs receive substantial amounts of research dollars from NIH and other private sponsors, most funding for newly emerging and often untested theories is raised through private philanthropy. One might say that traditional funding supports evolutionary research, while philanthropic dollars support revolutionary research. History bears this out; at Johns Hopkins, where I am counsel, Dr. Bert Vogelstein's early research on the genome and Dr. Patrick Walsh's initial research on prostrate cancer are just two examples. These researchers were funded through what I call venture capital for new discovery - philanthropic dollars. Specific departments raise these dollars through grateful patients and their contacts, allowing new discoveries that translate to new treatments. Q. If AMCs must get patients' permission to use doctors' or departments' names, what does this mean? A. A separate "authorization" is required for use of patient information for fundraising; it must contain over a dozen specific items and is quite complex. The most troubling provision, however, is inclusion of a statement that reads substantially as follows: I understand that my protected health information, once used or disclosed in accordance with this authorization, may be subject to redisclosure by the recipient and no longer protected by the HIPAA regulations. In the fundraising context, the only person to whom the fundraiser will disclose the information is the person being solicited. The chance of any other "redisclosure" seems minimal, that is by accident. Therefore, this language seems inappropriate in this context. However, due to the form's complexity and this disclaimer language, many people may not give this advance permission. Q. What can be done to change the privacy regulations? A. The AAMC and others have written to HHS Secretary Tommy Thompson and offered at least two alternatives. First, changing the regulations to allow the physician, department, or division of the covered entity to be included in the patient information that may be used for fundraising without a patient's specific authorization. There could be specific rules for certain contacts, such as mental health patients, and possibly the use of a generic outer envelope for mailings. However, the amendment would allow physicians and departments to be used for contact purposes. Alternatively, if HHS will not exempt departmental information from the authorization requirement, the fundraising authorization could be simplified. A permission form like the following would protect patients, but recognizes the critical role of fundraising for AMCs: [AMC] depends on private philanthropy to support research and discovery. [AMC] has asked if I would agree to be contacted in the future for fundraising purposes for the benefit of [AMC]. I hereby authorize [AMC] to contact me for fundraising purposes and to use the name of my physician(s) and the name of the department(s) or division(s) where I was treated at [AMC] in making the contact. I understand that only my physician(s) and/or the personnel of the development office of [AMC] [or its equivalent] will use this information for contacting me for fundraising purposes and that they will not knowingly disclose this information to any other person or use it for any other purpose. The commentary to the regulations suggests that HHS believed departmental information was not critical for fundraising for most entities. AMCs need to help HHS understand these fundamental facts. Q. What can AMCs do if they want to see the regulations changed? A. They can write to HHS and the Office of Civil Rights about this issue. The more concerned entities who write about it, the better: HHS: Office of Civil Rights: |
||||||
|
||||||||
|
Contact Us © 1995-2008 AAMC Terms and Conditions Privacy Statement |