Negotiating EHR Agreements: Complying with HIPAA, Stark and AKS, Overcoming Privacy and Security Risks

Description

In response to the Medicare and Medicaid Electronic Health Record Incentive Programs and associated payment penalties beginning in 2015 (the Incentive Program) providers are implementing and/or upgrading their IT systems and exploring new models for acquiring access to certified electronic healthcare records technology (CEHRT). The accelerated timelines contemplated in the Incentive Program regulations can present serious technical, operational, security and risk challenges as providers strive to integrate the technology into operations as necessary to support attestation as a meaningful user under the Incentive Program.

To meet the Incentive Program requirements, physicians are turning to hospitals for a hosted solution or third-party vendors for a software as a service (SaaS) solution. Likewise, hospitals are finding themselves in a new role as the provider of IT services to their non-employed medical staff without regard to whether the hospital is hosting the EHR itself or acquiring it under a services agreement. The structure of how data is stored and accessed within a shared domain, the operational impact of implementing a standardized EHR and the attestation requirements can significantly complicate the delicate relationship between physician and hospital.

Counsel for hospitals and health systems negotiating agreements for the acquisition of CEHRT from vendors and for the provision of CEHRT to medical staff must consider complex and challenging issues to: (1) ensure the CEHRT performs in accordance with both current and future regulatory obligations; (2) identify ownership of patient records, rights to perform data analytics, and procedures for responding to record requests; (3) address privacy and security concerns for services offered through patient portals including compliance with HIPAA and state and federal consumer protection laws; and (4) navigate the Stark Law and Anti-Kickback Statute as medical staff are provided access to, educated on, and encouraged to use the developing technology.

Listen as our experienced panel of healthcare counsel explains the intricate legal issues raised in association with the acquisition and deployment of CEHRT systems. The panel will offer their experiences and strategies regarding navigating this rapidly changing and expanding regulatory environment.