HIPAA violation?

This forum made possible through the generous support of SDN members, donors, and sponsors. Thank you.

lonelobo

PAIN DOC
Removed
15+ Year Member
Joined
Jun 1, 2005
Messages
3,861
Reaction score
1,194
Situation
New pt comes in(self -referral) reports she is on no pain medications, has good story.

A State RX monitoring report is pulled showing she has received mutliple Rx of same medicines (significant amounts)from several local docs in the last couple months. This was obtained after she has left office.

That information is placed in my dictation and CC'd to several of providers on list.

is this a problem?

Members don't see this ad.
 
Situation
New pt comes in(self -referral) reports she is on no pain medications, has good story.

A State RX monitoring report is pulled showing she has received mutliple Rx of same medicines (significant amounts)from several local docs in the last couple months. This was obtained after she has left office.

That information is placed in my dictation and CC'd to several of providers on list.

is this a problem?

I think it's a grey area but I wouldn't do that again. If she is self referred and you did not refer her to any of those providers than I don't believe those providers would fall into being considered "continuity of care," especially if those providers have never seen the patient. I obtain written permission to forward my patient's PHI to other providers who are not directly involved in the patient's care. Of course, those providers should hopefully check the state monitoring program. However, I'm not exactly sure and I've read only a very limited amount of HIPPA laws.
 
you probably shouldnt send this list to other physicians, without her permission. Of course, hopefully she did get your permission to contact her primary, etc.

on the other hand, each of those physicians is legally allowed to look at the state reporting program if they wrote her a prescription.
 
Members don't see this ad :)
Situation
New pt comes in(self -referral) reports she is on no pain medications, has good story.

A State RX monitoring report is pulled showing she has received mutliple Rx of same medicines (significant amounts)from several local docs in the last couple months. This was obtained after she has left office.

That information is placed in my dictation and CC'd to several of providers on list.

is this a problem?


No way. If you published it in the paper, yes. Look at it this way, if you did not inform those other docs and then she decided to sue you for 'letting her become an addict' then where would you stand. You did the right thing fo so. I think the feds and state medical board would have a very low interest in making an issue of this. Did you Rx for the pt?
 
Wrote a rx, but had nurse call pharmacy she gave us to cancel it.
I also contacted local Narcotics enforcement task force agent to give him heads up,

Not sure it is the exact legal thing to do, but I felt it was the "right" thing to do

Seems to me it is somewhat of a grey area?
 
Wrote a rx, but had nurse call pharmacy she gave us to cancel it.
I also contacted local Narcotics enforcement task force agent to give him heads up,

Not sure it is the exact legal thing to do, but I felt it was the "right" thing to do

Seems to me it is somewhat of a grey area?

From your end, you are licensed by the state to dispense narcotics. As such, you can legally tell the state if someone is doctor-shopping, or if you know the patient is diverting (like if they tell you). Now, the only grey area arises when you contact other doctors that have Rx'd narcs for this patient. As she told you that she is on no meds, already the story is suspect, which makes everything she said suspect. The other docs that have prescribed are in the same boat as you. It's like you're all in your front yards, looking at something on the street, but there are fences on either side. Are you allowed to talk over the fences? Or, would it be to call the state, and tell them what you've found? Then they can (legally, clearly, no question) call the other docs.

The legal question (or part of it) is whether illegal activity is "protected health information". I mean, if there is elder or child abuse, or you get a patient (well, me more likely than you) that has been shot, the patient (or guardian) cannot stop you from divulging those facts (or your professional opinion).

I don't know if you have complete legal immunity to go lateral, but, if your argument was one of concern about patient safety and diversion, it would be a long road to someone successfully suing you.
 
Just curious but did you get a Utox? I think that would be added ammo against any legal action against you, reasoning as follows. If you got a utox and it was completely negative, well she may be diverting the narcs she got from the other docs and you have just protected yourself from action for allerting them to this problem. If you got a utox and she tested positive then she is a liar to begin with and should be confronted.
 
Isn't it amazing how damn time consuming it is to prescribe appropriately. How much of your day did this consume, right? I can see why some pain docs get completely out of the RX game, although I think if you have the training, you best serve the community by managing, although not necess. rx'ing to the high risk pts
 
Wrote a rx, but had nurse call pharmacy she gave us to cancel it.
I also contacted local Narcotics enforcement task force agent to give him heads up,

Not sure it is the exact legal thing to do, but I felt it was the "right" thing to do

Seems to me it is somewhat of a grey area?

Notifying law enforcement and other providers is not violation and is appropriate. She is committing a felony by requesting concurrent rx's. Include fact that you will contact family, other docs, pharmacies in your ICAT. It waives hippa to allow good care.
 
  • Like
Reactions: 1 user
In your treatment agreement/consent have them sign that they knowingly waive confidentiality with other healthcare providers as part and parcel of YOUR treatment.
 
Wrote a rx, but had nurse call pharmacy she gave us to cancel it.
I also contacted local Narcotics enforcement task force agent to give him heads up,

Not sure it is the exact legal thing to do, but I felt it was the "right" thing to do

Seems to me it is somewhat of a grey area?

not a hippa violation. she is doctor shopping which is illegal.
 
This is a very thorny legal area due to the HIPAA law not specifying if illegal acts are being committed, the information about the patient can be disseminated. In fact, HIPAA is silent on the issue, therefore illegal actions by a patient, even if it involves felony drug diversion, does not waive the patient's right to HIPAA privacy. Doctors technically cannot report illegal acts to any entity that they do not have an established medical need to know relationship with business affiliates or pharmacies, or other current treating physicians. This means a doctor is technically violating the HIPAA rights of an individual for reporting drug diversion or doctor shopping to police or DEA or any other federal agency that they do not have a medical relationship with. As far as I can tell, this has not been tested in court, but HIPAA offers protection to doctors who share patient information only in cases where the information was requested by law enforcement or subpoenaed. It is also yet to be tested in court if HIPAA rights of this nature can be waived voluntarily or compelled to be waived under duress (no waiver, no drugs policy). The latter is probably illegal on the part of physicians since HIPAA does address some contingent behavior of that nature.
But all in all, it is likely the felonious patient would not likely engage in any legal action against physician that would bring more attention to themselves, but if they are convicted in part, on physicians revelation of protected information, then the physician stands to lose. This is a part of HIPAA that needs correction on the federal level. Interestingly it appears HIPAA doesn't apply to cash only practices that do not bill insurances.
 
i do find it funny...

that pill mills do not have to follow HIPAA, and could report to police all the opioid prescriptions that they have taken cash for...
 
Members don't see this ad :)
Doctors technically cannot report illegal acts to any entity that they do not have an established medical need to know relationship with business affiliates or pharmacies, or other current treating physicians. This means a doctor is technically violating the HIPAA rights of an individual for reporting drug diversion or doctor shopping to police or DEA or any other federal agency that they do not have a medical relationship with.

On the state level, though, it is clear (as was told to me by my state director, who specifically said that, "we license you, so you can tell us anything that has to do with it without any court order or risk").
 
On the state level, though, it is clear (as was told to me by my state director, who specifically said that, "we license you, so you can tell us anything that has to do with it without any court order or risk").

Agreed. The act of licensure per our state is such that we are required to notify involved parties. Law enforcement, pharmacy, other rx docs. But this is per CSBME, DEA, GDNA and not opposing counsel.

So here is my start to trying to help sort out this mess:

http://ncvhs.hhs.gov/040617l3.htm

Florida PDMP is fully HIPAA compliant and does the same task of notifying physicians prescribing:

When a potential illegal diversion pattern for drugs is identified by the database and doctors/pharmacists have requested the information, the information through a Patient Activity Report (PAR) is then disseminated to the doctors and pharmacists alerting them to the potential problem of “doctor shopping.”

The data is shared with any MD who requests it (as in all patients under out care as detailed in the following:

13. What is a Patient Advisory Report and how is it used?
A Patient Advisory Report (PAR) is provided to a health care practitioner that has requested that if any patient is potentially “doctor shopping” that they wish to be notified. The database will have an alert capability that will then provide the practitioner the information. This helps practitioners identify those patients potentially engaged in the crime of "doctor shopping" (which is a felony in Florida). This allows the practitioner to intervene on their patient’s behalf and assist them in obtaining treatment, if they are addicted.



From the Maine PDMP:

Prescriber Questions:

I got a letter from the Office of Substance Abuse about a patient. Why did I get it? What should I do about it?

If you receive a notification letter with a patient report from the Prescription Monitoring Program, the patient has crossed a threshold for number of prescribers, pharmacies, or drug levels during a given time period (these thresholds may change over time).

Four steps are recommended for handling threshold reports:

CONFIRM that you wrote the prescriptions attributed to you,
CONSIDER contacting the other prescribers on the report,
DISCUSS the report with the patient, and
FILE the report in the patient’s chart.
Further guidelines regarding what can be done with PMP reports may be found on OSA’s prescribers' page.

How can the PMP information help me in my daily practice of medicine?

The PMP database is most useful for detecting and preventing “doctor-shopping.” If you sign up as a data requester, you can log on and view controlled substance prescription history for a patient, dating back as far as July of 2004. If you see a pattern of excessive use of controlled substances, you can use more caution in prescribing or dispensing to the patient.

Another use for the database is for prescribers to detect pharmacy errors or fraudulent use of their DEA numbers. A data requester can log in to the PMP and run a “Prescriber History” query to find what prescriptions for controlled substances were attributed to them during a specified time period.

Can I get PMP information about a new patient?

Yes; if you are registered with the PMP, you can request a report on a new patient you will be seeing at a future appointment. This allows you to check on someone’s Schedule II, III, and IV drug history before you even see them (see above, How do I get PMP information about my patients?).

Can I consult with other Prescribers listed on a patient report without patient authorization?

According to HIPAA, this type of consultation is permitted because consultation is within the HIPAA definition of "treatment." To see the official FAQ about this question, please click here: HIPAA Page.


Looks like HIPAA compliance is rationalized as being met as this is covered under the treatment definition.

I'd be comfortable testifying on behalf of the doc if some atty was representing a diverter (alleged) and he talked to the other docs without a specific ROI.
 
Last edited:
Clearly it is not settled law, and governmental entities within each state feel comfortable with disclosure at different levels. With regards to informing anyone not on a PMP list, according to HIPAA law you are walking on your own and do not have any protection under the HIPAA law In order to follow state regulations/laws regarding reporting drug diversion or criminal acts, it may be necessary to violate HIPAA, a federal law. But in most situations, federal law trumps state law, and that is the conundrum. The state will not be standing beside you providing legal counsel or legal support in case of a federal HIPAA violation.
The question about PMP listings is more vague. For instance, supposing a patient indeed saw 5 doctors in one month, each for a different reason, an none of the doctors either asked about presriptions from other physicians nor ran a PMP query. Then this patient is not in violation of the law. Doctor shopping as an illegal act involves subterfuge, usually with prevarication, not simply not divulging information that wasn't asked. Can each of the 5 PMP prescribers be notified? That is where it becomes vague since it is not clear what the definition of a treating physician is. If the patient specifically terminated the relationship with a physician, can you legally send information to them since they are no longer a treating physician? If the physicians listed are from another part of the state and haven't been visited by the physician for 3 months, are those treating physicians? Or what about 6 months? 2 years? Is it necessary under HIPAA to define who current treating physicians are by asking the patient? HIPPA offers no guidance on this.
 
There are of course a whole bunch of laws, rules, and reg's we have to follow. If someone wants to sue you for a BS reason, they can find a route. Personally I would rather have it be for a very questionable HIPAA issue than Rx'ing and have that person OD, sell it to a 5th grader, or kill someone with their car.

I think some perspective is in order. We are talking about sharing info with docs and pharmacies that have or had a recent relationship with the pt. The cases of HIPAA convictions tend to involve things like this:

http://journal.ahima.org/2010/04/29/californian-sentenced-to-prison-for-hipaa-violation/

I think this also puts perspective on the issue:

http://www.law.uh.edu/healthlaw/perspectives/2007/(DM)HIPAACrimCharges.pdf
 
For instance, supposing a patient indeed saw 5 doctors in one month, each for a different reason, an none of the doctors either asked about prescriptions from other physicians nor ran a PMP query. Then this patient is not in violation of the law. Doctor shopping as an illegal act involves subterfuge, usually with prevarication, not simply not divulging information that wasn't asked.

Boy howdy, you sound like a defense lawyer. As to the bolded, ever hear of "fraud"? Unless the patient has an objective finding, not subjective or unverifiable, who would, except a criminal facilitator or complete dolt, prescribe any narcs? If a person saw 5 different docs in a month, for different complaints, and requested, and got, narcs, then somebody either got suckered, or is a dunce (or complicit).

Not detected does not mean not in violation of the law. If you are speeding, and don't get a ticket, you have still broken the law.
 
When I go online and receive an instant report, there is a checkbox an a comment section that I am supposed to fill out if there is evidence of doctor shopping or diversion in the report.
 
Oh, I have no love of substance abusers or drug diverters. However I have had extensive conversations with the attorney representing the state medical association who recommended to the entire state that the practice of identifying people suspected of drug diversion on PMPs is an activity that should stop immediately. The stakes for HIPAA violations are no longer inconsequential at $10,000 per violation. Where we need changes are in HIPAA itself clarifying and indemnifying physicians who are reporting criminal acts or may report to physicians on PMPs who show up for say, 6 months....
 
"The stakes for HIPAA violations are no longer inconsequential at $10,000 per violation"

that's not too bad- much better than losing your medical or DEA license

Hey - I can trade 5 HIPAAs for 1 COBRA!

(And if you actually know what HIPAA and COBRA stand for, you are a bigger nerd than me.)




Health Insurance Portability and Accountability Act and Consolidated Omnibus Budget Reconciliation Act
 
Hey - I can trade 5 HIPAAs for 1 COBRA!

(And if you actually know what HIPAA and COBRA stand for, you are a bigger nerd than me.)




Health Insurance Portability and Accountability Act and Consolidated Omnibus Budget Reconciliation Act

Health Insurance Portability and Accountability Act
Consolidated Omnibus Budget Reconciliation Act

(mostly because i changed jobs 2 years ago...)
 
i wouldn't cc to any other doctor - because of legal risks -

I just have my office contact the pharmacies and then ask the pharmacies to contact the prescribing physicians to notify them of the multiple rxs being filled...

this absolves my conscience - but takes me out of the legal loop so to say..
 
There is required reporting of child abuse.

There is required reporting of abuse of the elderly and disabled.

There is required reporting for certain communicable diseases.

We are required by law to NOT prescribe to someone we know is selling or diverting the meds we prescribe to them.

However, I don't know of any law REQUIRING us to report such activity. Law may ALLOW us to report it, but not require us to report it, correct? If so, someone please post a link. If there was, it clearly would be in direct conflict with HIPPA. Example: you report someone for diverting. They get arrested, lose their job, their house gets forclosed upon, etc, and then they're found not guilty. Who's at risk now? Although, Lobel posted an above government website stating it's okay to notify based on such information, is there any specific law providing immunity from other liabilities of reporting , like there are in reference to reporting child abuse? Like Algos said, it's law in evolution. Muddy, contradictory and full of gray areas.

Prescription monitoring systems help us avoid contributing to diversion, but I don't believe that there is any requirement to notify anyone of anything learned from such a report. If fact, some have a specific HIPPA disclaimer when you sign in that you will not allow anyone else access to the information.

You don't call the Police when a patient admits to actively using illegal substances. Do you?

Patients admit to doing illegal things all the time. Do you call the Police? Clearly we use the information to guide our treatment, as we should.

If you check the Rx monitoring program and you find evidence of doctor shopping, you clearly should confront the patient, and use the information to guide, change or stop treatment. The other physicians involved have an obligation to check the same report. Is it your responsibility to call all of them?

Is it the responsibility of those who run the website to call YOU and all the other providers on the list. How long have they had this information and done nothing?

Is there legal risk if you notify? Yes. Is there risk if you check the report and don't act on the information? Yes. Is there risk if you don't check the report? Yes. Is there risk if you check the report and DO act? Yes.

On at least one states web Rx monitoring system there is a disclaimer saying, and I'm paraphrasing, "this information is not guaranteed to be accurate".
Let's say the pharmacist enters the information on the wrong patient, you stop their opiate and discharge them from the practice. They show that there was a case of mistaken identity and sue for pain and suffering, patient abandonment, medical costs suffered from treatment of withdrawal and severe emotional distress.

The best advice is to "do the right thing", whatever that may be given the situation and information at hand, and document clearly what you did and why. It is unfortunate that the lawyers have created such a messy heap of gray areas on top gray areas, and that knowing what the "right thing" to do can be very difficult. You can make choice number #1 and they can sue you under law X, that says you should have chosen choice #2. They can also pull out law Z, and sue you because it says you should've made choice #1.

Follow all laws and regulations to the best of your ability. Do what's "right", and what allows you to sleep best at night. And document. That's all we can do.
 
Last edited:
However, I don't know of any law REQUIRING us to report such activity. Law may ALLOW us to report it, but not require us to report it, correct? If so, someone please post a link. If there was, it clearly would be in direct conflict with HIPPA.

The best advice is to "do the right thing",
Follow all laws and regulations to the best of your ability. Do what's "right", and what allows you to sleep best at night. And document. That's all we can do.

Agree that there is no such FEDERAL law. I advise the OP to seek advice from his state medical board, and to follow the laws, rules, and regulations of his state.
 
I queried the research attorney at the link Steve so kindly provided and asked about informing law enforcement about illegal activities and the HIPAA conundrum. Here is her response:
This question has come up several times, and I will preface my response by saying that I am not licensed to practice in Indiana, so I can’t give you legal advice. You should verify the information I’m giving you with an attorney in Indiana that is familiar with HIPAA law. Having said that, I believe that a physician can release protected health information to law enforcement without violating HIPAA.

45 CFR § 164.512 provides uses and disclosures of protected health information where a patient’s authorization or opportunity to agree to the disclosure is not required. 45 CFR § 153.512(a) includes disclosure of protected health information to law enforcement to the extent that such use or disclosure is required by law, which includes by statute or regulation, and which covers the situation in Tennessee where physicians are required by statute to disclose information to law enforcement if they have knowledge that a patient is obtaining controlled substances illegally. 45 CFR § 164.512(f) also provides that disclosure for law enforcement purposes is allowed when required by law, and is not limited to situations where legal process (subpoena, warrant, etc.) is involved.

In situations where there is no statute, regulation, or legal process compelling disclosure of protected health information, 45 CFR § 164.512(f)(5) may provide an avenue by which a physician can disclose health information without fear of being in violation of HIPAA regulations. 45 CFR § 164.512(f)(5) provides that a covered entity – which includes physicians – may disclose information to law enforcement if the entity believes in good faith that the information constitutes evidence of criminal conduct that occurred on the premises of the covered entity. In other words, if you believe that a patient has committed a crime in your office, you may report that information to law enforcement, even if evidence of the crime is contained within the patient’s protected health records. In Indiana, pursuant to Ind. Code Ann. § 16-42-19-16, a person may not obtain or attempt to obtain a legend drug by fraud, deceit, misrepresentation, or subterfuge. Thus, if you have knowledge that a patient has been obtaining prescription drugs from you by fraud, deceit, etc., you can report that information to law enforcement as it would constitute criminal conduct that occurred on your premises.

Further, Indiana law under Ind. Code Ann. § 35-48-7-11.1:thumbdown: provides that a physician who in good faith discloses information based on a report from Indiana’s prescription monitoring program (INSPECT) to law enforcement is immune from civil and criminal liability for having done so. It is presumed under the statute that a physician who so discloses information has acted in good faith. So, if your knowledge of wrongdoing comes from accessing a patient’s prescription monitoring program report, Indiana law provides immunity to you for having done so.
 
Under HIPAA, you do not need the patient's permission to share information with other healthcare professions when the information is for continuity of care. If you possess information showing that a patient is a danger to themselves or others (doctor shopping), you should not be subject to prosecution for this. You are protecting the patient.
 
Anyone on this forum know a lawyer named Jennifer Bolen? I've listened to a few of her lectures through Dannemiller - I'm sure she would know the most appropriate course of action (even if it is to contact each individual state board...)
 
Anyone on this forum know a lawyer named Jennifer Bolen? I've listened to a few of her lectures through Dannemiller - I'm sure she would know the most appropriate course of action (even if it is to contact each individual state board...)

Ms. Bolen is a lawyer and chronic pain patient who advocates strongly for both chronic pain patient's rights and those of the doctors that treat them. She attends and lectures at many conferences over the years, and has a lot of information about opioid use and documentation. She writes a lot of articles that I've seen, and I've been at 2 of her talks.

Like doctors, lawyers can really only give opinions on law and the way things usually go. But, since every case is different, you usually have to pay them for an opinion. :D
 
Anyone on this forum know a lawyer named Jennifer Bolen? I've listened to a few of her lectures through Dannemiller - I'm sure she would know the most appropriate course of action (even if it is to contact each individual state board...)

www.legalsideofpain.com
 
What can be done if family/friends physicians are able to access a patients history on the pmp database? Is this allowed? Can these physicans be blocked from accessing ones profile? Thanks
I don't think you can block them per say, but if you report them they might lose access.
 
I believe acting in the patients best interest overrides right to privacy and is permitted by the HIPAA Privacy Rule. If I was genuinely concerned about undiagnosed addiction I would make a phone call to her PCP and psych doc about my concern. Even without her permission, I would be acting in her best interest which is permitted by the HIPAA Privacy Rule. If I thought she was selling her pills, I certainly could share that with law enforcement without her permission in Missouri.
In Missouri, false statements, misrepresentations, lies, forgery, and the failure to disclose material information relating to controlled substances treatment is class D felony pursuant to Section 195.204 Revised Statues of Missouri. Pursuant to Section 195.375.5, Revised Statues of Missouri, controlled substance records are open for inspection and copying by the Bureau of Narcotics and Dangerous Drugs and law enforcement in the state of Missouri.
 
I call the attending/rx’r if I uds and it’s completey negative with recent fill of controlled substance or non-complaint substance present. Faxing the copy to the office is also done, but documentation of direct conversation shows I have done my due diligence. I had someone with suboxone and morphine present, notified rx’r of the report (who was appropriately pissed). If this individual ODs and I had knowledge of the behavior placing them at risk, I feel I myself am at risk for not notifying the rx’r.
 
  • Like
Reactions: 1 user
Thanks for your responses. I think I meant if noninvolved providers were allowed to snoop through a patients pmp for curiosity purposes and whether that can be blocked or stopped by the pmp if they are notified. Thanks for your reply va hopeful dr.
I would venture to say it is technically illegal to do that for voyeuristic purposes. I have worked at several hospitals where staff were disciplined/fired for looking at medical records for snooping purposes. For example, a celebrity was admitted and a bunch of people were curious about how he was doing and got cold busted looking at his records. But that's within a monitored hospital system. I don't think it's possible to stop it with PDMP. But if a medical professional were to ever misuse the info, they would be in deep crap.
 
Along the same lines...had a patient who was well known to our clinic. PMP was checked at her appointment and revealed she got a narcotic and benzo script from another provider. Prior to seeing her I had ordered a UDS which gets mailed out. After our visit, she was dismissed from the clinic bc she had received another script and admitted to taking it. She signed the paperwork dismissing her, etc.

few days later I get her UDS report back which shows she has no opiate or no benzos in her system. I didn't realize it had been sent out for testing. What do I do with these results of the UDS, now that she's no longer my patient?
 
Along the same lines...had a patient who was well known to our clinic. PMP was checked at her appointment and revealed she got a narcotic and benzo script from another provider. Prior to seeing her I had ordered a UDS which gets mailed out. After our visit, she was dismissed from the clinic bc she had received another script and admitted to taking it. She signed the paperwork dismissing her, etc.

few days later I get her UDS report back which shows she has no opiate or no benzos in her system. I didn't realize it had been sent out for testing. What do I do with these results of the UDS, now that she's no longer my patient?
File in her chart. Any law abiding MD will need her chart before taking her on.
 
contact primary care physician, because more likely than not her PCP will be pestered regarding further prescriptions. she is no longer your patient, but you still have responsibility for the lab test that was ordered by you.

and spell it out ie tell her there should be consideration for diversion, just to be thorough...
 
Top