9.2 Healthcare Law, HIPAA, Confidentiality & Informed Consent

9.2 Healthcare Law, HIPAA, Confidentiality & Informed Consent

Healthcare case management practice is governed by a comprehensive body of federal and state laws. Case managers must understand healthcare privacy regulations, consent requirements, emergency treatment mandates, and end-of-life documentation to protect patient rights and prevent legal liability.

HIPAA Privacy and Security Rules

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 established national standards for the protection of Protected Health Information (PHI).

Protected Health Information (PHI)

PHI includes any individually identifiable health information created, received, or held by a covered entity or business associate, relating to past, present, or future physical or mental health conditions, provision of healthcare, or payment for healthcare.

• 18 HIPAA Identifiers: Names, geographic data below state level, dates (birth, admission, discharge, death), phone numbers, email addresses, Social Security Numbers (SSN), medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device serial numbers, Web URLs, IP addresses, biometric identifiers, full-face photos, and any other unique identifying number or code.

Permitted Disclosures: Treatment, Payment, and Operations (TPO)

Covered entities may use and disclose PHI without client authorization for TPO activities:

1. Treatment: Coordination or management of healthcare among providers (e.g., case manager transferring clinical notes to a rehabilitation facility).
2. Payment: Activities undertaken to obtain premiums or reimbursement (e.g., submitting claims, utilization review, pre-certification).
3. Healthcare Operations: Administrative, financial, legal, and quality improvement activities (e.g., peer review, auditing, accreditation).

Important: Disclosures outside TPO (e.g., marketing, research, or sharing records with an employer, life insurer, or family member without legal authority) require a valid, signed HIPAA authorization.

---

The Minimum Necessary Standard & HITECH Act Provisions

Minimum Necessary Standard

The HIPAA Minimum Necessary Standard requires covered entities to make reasonable efforts to limit PHI disclosures to the minimum necessary required to accomplish the intended purpose.

• Application: Applies to payment, healthcare operations, and third-party requests.
• Crucial Exception: The minimum necessary standard does NOT apply to disclosures among healthcare providers for treatment purposes. When a case manager communicates with a physician or home health nurse regarding patient care, full clinical information may be shared.

HITECH Act & Breach Notification Rule

The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 expanded HIPAA protections and introduced stringent breach notification requirements.

• Business Associates: Directly extends HIPAA compliance obligations and penalties to Business Associates (e.g., third-party case management vendors, cloud storage providers, billing companies).
• Breach Notification Rule: A breach is defined as the impermissible acquisition, access, use, or disclosure of unencrypted PHI.
  • Individual Notification: Covered entities must notify affected individuals in writing without unreasonable delay and no later than 60 calendar days after discovery of the breach.
  • HHS Notification: Breaches affecting 500 or more individuals must be reported to the Secretary of Health and Human Services (HHS) and prominent media outlets within 60 days. Breaches affecting fewer than 500 individuals must be logged and reported annually to HHS.

---

Informed Consent, Capacity, & Informed Refusal

Four Essential Components of Informed Consent

1. Decision-Making Capacity: The patient possesses the cognitive ability to understand the situation, appreciate consequences, and communicate a choice.
2. Disclosure: The provider discloses adequate information regarding the diagnosis, proposed treatment, risks, benefits, alternatives, and risks of refusing treatment.
3. Understanding: The patient demonstrates comprehension of the disclosed information.
4. Voluntariness: The decision is made freely without coercion, undue influence, or duress.

Decision-Making Capacity vs. Legal Competence

• Capacity: A clinical determination made by a healthcare provider (e.g., physician, psychiatrist) evaluating a patient's ability to make a specific healthcare decision at a specific point in time. Capacity can fluctuate based on delirium, medication, or metabolic encephalopathy.
• Competence: A legal determination made exclusively by a judge in a court of law. An individual is presumed legally competent until proven otherwise in court.

Informed Refusal

A competent adult patient has the legal and ethical right to refuse any medical treatment, even if refusal leads to permanent disability or death. The case manager must ensure that informed refusal is thoroughly documented, including the patient's demonstrated understanding of specific risks and potential outcomes.

---

Emergency Medical Treatment and Labor Act (EMTALA)

Enacted in 1986, EMTALA (often termed the "Anti-Dumping Law") mandates that Medicare-participating hospitals with emergency departments provide emergency care to any individual regardless of insurance status or ability to pay.

Three Core EMTALA Obligations

1. Medical Screening Examination (MSE): Mandatory provision of an appropriate MSE by qualified medical personnel (physician, PA, NP) to determine whether an Emergency Medical Condition (EMC) exists. An MSE cannot be delayed to inquire about insurance or financial status.
2. Stabilizing Treatment: If an EMC exists, the hospital must provide stabilizing treatment within its capabilities or execute an appropriate transfer.
3. Appropriate Transfer: Transfer of an unstable patient is prohibited unless:
   • The patient (or surrogate) requests transfer in writing after being informed of risks, OR
   • A physician signs a certification that the medical benefits of transfer outweigh the risks, AND
   • The receiving facility agrees to accept the transfer and has available space and qualified personnel.

---

Advance Directives: Living Wills, DPOA-HC, and POLST/MOLST

Advance directives are legal documents that allow individuals to state their preferences for medical care before losing decision-making capacity.

Comparison of Advance Directive Features

• Portability: Living wills and DPOA-HC documents often require legal interpretation and may not be immediately binding on emergency medical services (EMS). POLST/MOLST orders are actionable medical orders recognized immediately by EMS in pre-hospital settings.
• Substituted Judgment Standard: A designated DPOA-HC proxy must make decisions based on what the patient would have wanted (substituted judgment), not what the proxy personally prefers. If the patient's wishes are unknown, the proxy acts under the best interest standard.

---

Clinical Scenarios & Exam Traps

Clinical Scenario 2: A case manager is preparing a discharge summary for a client transferring to an outpatient physical therapy clinic. The payer claims adjuster requests a full copy of the client's past 5 years of medical history, including unrelated psychiatric notes.

• Legal/HIPAA Action: The case manager must apply the Minimum Necessary Standard. Only clinical data relevant to the physical therapy treatment plan and payment for current care should be released. Psychiatric notes require specific authorization unless directly related to TPO.

Exam Trap: EMTALA vs. Utilization Review: On the exam, if an emergency department patient lacks insurance and the hospital attempts to transfer them to a public facility prior to completing a Medical Screening Exam (MSE) and stabilizing the patient, this is a severe EMTALA violation. Case managers cannot perform utilization review pre-screening to delay or deny an MSE.