ram4577X_ch03.qxd 4/16/04 11:50 Page 37

Legal and Ethical Issues in
Medical Practice, Including HIPAA
AREAS OF COMPETENCE
2003 Role Delineation Study
CLINICAL
Fundamental Principles ɀ Apply principles of aseptic technique and infection control ɀ Comply with quality assurance practices
Patient Care ɀ Coordinate patient care information with other health-care providers

GENERAL
Legal Concepts ɀ Perform within legal and ethical boundaries ɀ Prepare and maintain medical records ɀ Document accurately ɀ Follow employer’s established policies dealing with the health-care contract ɀ Implement and maintain federal and state health-care legislation and regulations ɀ Comply with established risk management and safety procedures ɀ Recognize professional credentialing criteria

CHAPTER OUTLINE ɀ ɀ ɀ ɀ

Medical Law and Ethics
OSHA Regulations
Quality Control and Assurance
Code of Ethics

ɀ HIPAA ɀ Confidentiality Issues and

Mandatory Disclosure

OBJECTIVES
After completing Chapter 3, you will be able to:
3.1 Define ethics, bioethics, and law.
3.2 Discuss the measures a medical practice must take to avoid malpractice claims. 3.3 Describe OSHA requirements for a medical office.

KEY TERMS abandonment agent arbitration assault authorization battery bioethics breach of contract civil law contract crime criminal law defamation disclosure durable power of attorney electronic transaction record ethics expressed contract felony fraud implied contract law law of agency liable living will malpractice claim misdemeanor moral values negligence Notice of Privacy Practices
(NPP)
Privacy Rule protected health information (PHI)
Security Rule subpoena tort treatment, payments, and operations (TPO) uniform donor card use void

37

ram4577X_ch03.qxd 4/16/04 11:50 Page 38

OBJECTIVES (Continued)
3.4 Describe procedures for handling an incident of exposure to hazardous materials.
3.5 Compare and contrast quality control and quality assurance procedures.

3.6 Explain how to protect patient confidentiality.
3.7 Discuss the impact that HIPAA regulations have in the medical office.

Introduction
Medical law plays an important role in medical facility procedures and the way we care for patients. We live in a litigious society, where patients, relatives, and others are inclined to sue health-care practitioners, health-care facilities, manufacturers of medical equipment and products, and others when medical outcomes are not acceptable. It is important for a medical professional to understand medical law, ethics, and protected health information as it pertains to HIPAA. There are two main reasons for medical professionals to study law and ethics: The first is to help you function at the highest professional level by providing competent, compassionate health care to patients, and the second is to help you avoid legal problems that can threaten your ability to earn a living.
A knowledge of medical law and ethics can help you gain perspective in the following three areas:
1. The rights, responsibilities, and concerns of health-care consumers. Not only do health-care professionals need to be concerned about how law and ethics impact their respective professions, they must also understand how legal and ethical issues affect patients. As medical technology advances and the use of computers increases, patients want to know more about their options and rights as well as more about the responsibilities of health-care practitioners. Patients

want to know who and how their information is used and the options they have regarding health-care treatments. Patients have come to expect favorable outcomes from medical treatment, and when these expectations are not met, lawsuits may result.
2. The legal and ethical issues facing society, patients, and health-care professionals as the world changes.
Every day new technologies emerge with solutions to biological and medical issues. These solutions often involve social issues, and we are faced with decisions, for example, regarding reproductive rights, fetal stem cell research, and confidentiality with sensitive medical records.
3. The impact of rising costs on the laws and ethics of health-care delivery. Rising costs, both of health-care insurance and of medical treatment in general, can lead to questions concerning access to health-care services and the allocation of medical treatment. For example, should everyone, regardless of age or lifestyle, have the same access to scarce medical commodities such as transplant organs or highly expensive drugs?
In today’s society, medical treatment and decisions surrounding health care have become complex. It is therefore important to be knowledgeable and aware of the issues and the laws that govern patient care.

A medical assistant is very busy on a Monday morning. She has drawn blood on a patient that she has known for years and has been very comfortable chatting with this patient. The patient is checking out at the front desk in the reception area, and she notices that he forgot his prescription for Dilantin, a medication for seizure control. She rushes up to the front area and, as he is opening the door, says to him, “Mr.
Doe, you forgot your prescription for Dilantin.”
As you read this chapter, consider the following questions:
1. Does the medical assistant’s comment represent a breach of confidentiality?
2. Has any HIPAA rule been violated? If so, which one?

Medical Law and Ethics
In order to understand medical law and ethics, it is helpful to understand the differences between laws and ethics.
A law is defined as a rule of conduct or action prescribed
38

CHAPTER 3

or formally recognized as binding or enforced by a controlling authority. Governments enact laws to keep society running smoothly and to control behavior that could threaten public safety. Ethics is considered a standard of behavior and a concept of right and wrong beyond what

ram4577X_ch03.qxd 4/16/04 11:50 Page 39

the legal consideration is in any given situation. Moral values serve as a basis for ethical conduct. Moral values are formed through the influence of the family, culture, and society.

ɀ

Classifications of Law
There are two types of law that pertain to health-care practitioners: criminal law and civil law.

Criminal Law. A crime is an offense against the state committed or omitted in violation of a public law. Criminal law involves crimes against the state. When a state or federal criminal law is violated, the government brings criminal charges against the alleged offender, for example,
Ohio v. John Doe. State criminal laws prohibit such crimes as murder, arson, rape, and burglary. A criminal act may be classified as a felony or misdemeanor. A felony is a crime punishable by death or by imprisonment in a state or federal prison for more than one year. Some examples of a felony include abuse (child, elder, or domestic violence), manslaughter, fraud, attempted murder, and practicing medicine without a license.
Misdemeanors are less serious crimes than felonies.
They are punishable by fines or by imprisonment in a facility other than a prison for one year or less. Some examples of misdemeanors are thefts under a certain dollar amount, attempted burglary, and disturbing the peace.
Civil Law. Civil law involves crimes against the person. Under civil law, a person can sue another person, a business, or the government. Court judgments in civil cases often require the payment of a sum of money to the injured party. Civil law includes a general category of law known as torts. A tort is broadly defined as a civil wrong committed against a person or property that causes physical injury or damage to someone’s property or that deprives someone of his or her personal liberty and freedom. Torts may be intentional (willful) or unintentional
(accidental).
Intentional Torts. When one person intentionally harms another, the law allows the injured party to seek a remedy in a civil suit. The injured party can be financially compensated for any harm done by the person guilty of committing the tort. If the conduct is judged to be malicious, punitive damages may also be awarded. Examples of intentional torts include the following: ɀ ɀ

Assault. Assault is the open threat of bodily harm to another, or acting in such as way as to put another in the “reasonable apprehension of bodily harm.”
Battery. Battery is an action that causes bodily harm to another. It is broadly defined as any bodily contact made without permission, In health-care delivery, battery may be charged for any unauthorized touching of a patient, including such actions as suturing a wound, administering an injection, or performing a physical examination. ɀ

ɀ

ɀ

Defamation of character. Damaging a person’s reputation by making public statements that are both false and malicious is considered defamation of character.
Defamation of character can take the form of slander and libel. Slander is speaking damaging words intended to negatively influence others against an individual in a manner that jeopardizes his or her reputation or means of livelihood.
False imprisonment. False imprisonment is the intentional, unlawful restraint or confinement of one person by another. Preventing a patient from leaving the facility might be seen as false imprisonment.
Fraud. Fraud consists of deceitful practices in depriving or attempting to deprive another of his or her rights. Health-care practitioners might be accused of fraud for promising patients “miracle cures” or for accepting fees from patients while using mystical or spiritual powers to heal.
Invasion of privacy. Invasion of privacy is the interference with a person’s right to be left alone. Entering an exam room without knocking can be considered an invasion of privacy. The improper use of or a breach of confidentiality of medical records may be seen as an invasion of privacy.

Unintentional Torts. The most common torts within the health-care delivery system are those committed unintentionally. Unintentional torts are acts that are not intended to cause harm but are committed unreasonably or with a disregard for the consequences. In legal terms, such acts constitute negligence. Negligence is charged when a healthcare practitioner fails to exercise ordinary care and the patient is injured. The accused may have performed an act or failed to perform an act that a reasonable person would or would not have performed. Under the principles of negligence, civil liability exists only in cases in which the act is judicially determined to be wrongful. Health-care practitioners, for example, are not necessarily liable for a poorquality outcome in delivering health care. Practitioners become liable only when their conduct is determined to be malpractice, the negligent delivery of professional services.

Contracts
A contract is a voluntary agreement between two parties in which specific promises are made for a consideration.
The elements of a contract are important to health-care practitioners because health-care delivery takes place under various types of contracts. To be legally binding, four elements must be present in a contract:
1. Agreement—One party makes an offer and another party accepts it. Certain conditions pertain to the offer: ɀ It can relate to the present or the future. ɀ It must be communicated. ɀ It must be made in good faith and not under duress or as a joke.

Legal and Ethical Issues in Medical Practice, Including HIPAA

39

ram4577X_ch03.qxd 4/16/04 11:50 Page 40

ɀ

It must be clear enough to be understood by both parties. ɀ It must define what both parties will do if the offer is accepted.
For example, a physician offers a service to the public by obtaining a license to practice medicine and opening for business. Patients accept the physician’s offer by scheduling appointments, submitting to physical examinations, and allowing the physician to prescribe or perform medical treatment. The contract is complete when the physician’s fee is paid.
2. Consideration—Something of value is bargained for as part of the agreement. The physician’s consideration is providing service; the patient’s consideration is payment of the physician’s fee.
3. Legal subject matter—Contracts are not valid and enforceable in court unless they are for legal services or purposes. For example, a contract entered into by a patient to pay for services of a physician in private practice would be void (not legally enforceable) if the physician was not licensed to practice medicine.
Breach of contract may be charged if either party fails to comply with the terms of a legally valid contract.
4. Contractual capacity—Parties who enter into the agreement must be capable of fully understanding all its terms and conditions. For example, a mentally incompetent individual or a person under the influence of drugs or alcohol cannot enter into a contract.

Types of Contracts. The two main types of contracts are expressed contracts and implied contracts. An expressed contract is clearly stated in written or spoken words. A payment contract is an example of an expressed contract. Implied contracts are those in which the acceptance or conduct of the parties, rather than expressed words, creates the contract. A patient who rolls up a sleeve and offers an arm for an injection is creating an implied contract. Malpractice
Malpractice claims are lawsuits by a patient against a physician for errors in diagnosis or treatment. Negligence cases are those in which a person believes that a medical professional did not perform an essential action or performed an improper one, thus harming the patient.
Following are some examples of malpractice: ɀ ɀ

40

Postoperative complications. For example, a patient starts to show signs of internal bleeding in the recovery room. The incision is reopened, and it is discovered that the surgeon did not complete closure of all the severed capillaries at the operation site.
Res ipsa loquitur. This Latin term, which means “The thing speaks for itself,” refers to a case in which the doctor’s fault is completely obvious. For example, if a lung cancer patient has to have the right lung removed
CHAPTER 3

and the surgeon instead removes the left lung, the patient will most likely sue the surgeon for malpractice. Another example is a case in which a surgeon accidentally leaves a surgical instrument inside the patient. Following are examples of negligence: ɀ ɀ

Abandonment. A health-care professional who stops care without providing an equally qualified substitute can be charged with abandonment. For example, a labor and delivery nurse is helping a woman in labor.
The nurse’s shift ends, but all the other nurses are busy and her replacement is late for work. Leaving the woman would constitute abandonment.
Delayed treatment. A patient shows symptoms of some illness or disorder, but the doctor decides, for whatever reason, to delay treatment. If the patient later learns of the doctor’s decision to wait, the patient may believe he has a negligence case.

Negligence cases are sometimes classified using the following three legal terms.
1. Malfeasance refers to an unlawful act or misconduct.
2. Misfeasance refers to a lawful act that is done incorrectly. 3. Nonfeasance refers to failure to perform an act that is one’s required duty or that is required by law.

The Four Ds of Negligence. The American Medical Association (AMA) lists the following four Ds of negligence: 1. Duty. Patients must show that a physician-patient relationship existed in which the physician owed the patient a duty.
2. Derelict. Patients must show that the physician failed to comply with the standards of the profession. For example, a gynecologist has routinely taken Pap smears of a patient and then, for whatever reason, does not do so.
If the patient then shows evidence of cervical cancer, the physician could be said to have been derelict.
3. Direct cause. Patients must show that any damages were a direct cause of a physician’s breach of duty. For example, if a patient fell on the sidewalk and damaged her cast, she could not prove that the cast was damaged because it was incorrectly or poorly applied by her physician. It would be clear that the damage to the cast resulted from the fall. If, however, the patient’s leg healed incorrectly because of the way the cast had been applied, she might have a case.
4. Damages. Patients must prove that they suffered injury.
To go forward with a malpractice suit, a patient must be prepared to prove all four Ds of negligence.

Malpractice and Civil Law. Malpractice lawsuits are part of civil law. Civil law is concerned with individuals’ private rights (as opposed to criminal offenses against

ram4577X_ch03.qxd 4/16/04 11:50 Page 41

public law). Under civil law, a breach of some obligation that causes harm or injury to someone is known as a tort.
A tort can be intentional or unintentional. Both negligence and breach of contract are considered torts. Breach of contract is the failure to adhere to a contract’s terms. The implied physician-patient contract includes requirements like maintaining patient confidentiality. (Remember that an implied contract is one that is not created by specific, written words, but rather is defined by the conduct of the parties. Usually the parties involved have some special relationship.) Settling Malpractice Suits. Malpractice suits often require a trial in a court of law. Sometimes, however, they are settled through arbitration. Arbitration is a process in which the opposing sides choose a person or persons outside the court system, often with special knowledge in the field, to hear and decide the dispute.
(Your local or state medical society has information about your state’s policy on arbitration.) If injury, failure to provide reasonable care, or abandonment of the patient is proved to have occurred, the doctor must pay damages (a financial award) to the injured party.
If the doctor you work with becomes involved in a lawsuit, you should be familiar with subpoenas. A subpoena is a written court order addressed to a specific person, requiring that person’s presence in court on a specific date at a specific time. If you were directly involved in the patient case that precipitated the lawsuit, you might be subpoenaed. Another important term to know is subpoena duces tecum, which is a court order to produce documents.
If you are in charge of patient records at the practice, you may be required to locate, assemble, photocopy, and arrange for delivery of patient records for this purpose.
Law of Agency. According to the law of agency, an employee is considered to be acting as a doctor’s agent (on the doctor’s behalf) while performing professional tasks.
The Latin term respondeat superior, or “Let the master answer,” is sometimes used to refer to this relationship. For example, the employee’s word is as binding as if it were the doctor’s (so you should never, for example, promise a patient a cure). Therefore, the doctor is responsible, or liable, for the negligence of employees. A negligent employee, however, may also be sued directly, because individuals are legally responsible for their own actions.
Therefore, a patient can sue both the doctor and the involved employee for negligence. The employer, or the employer’s insurance company, can also sue the employee.
The American Association of Medical Assistants
(AAMA) recommends that you purchase your own malpractice insurance and have a personal attorney. Most likely, in a case of negligence the doctor would be sued
(because you as an employee are acting on the doctor’s behalf), and you are usually covered by the doctor’s malpractice insurance. Even if you are young and think you do not have many assets, you should still obtain your own insurance. Courtroom Conduct. Most health-care practitioners will never have to appear in court. If you should be asked to appear, the following suggestions may prove helpful: ɀ ɀ ɀ ɀ

ɀ

ɀ ɀ ɀ

Attend court proceedings as required. Failure to appear in court could result in either charges of contempt of court or the case being forfeited.
Do not be late for scheduled hearings.
Bring required documents to court and present them only when requested to do so.
Before testifying, refresh your memory concerning all the facts observed about the matter in question, such as dates, times, words spoken, and circumstances.
Speak slowly, clearly, and professionally. Do not use medical terms. Do not lose your temper or attempt to be humorous.
Answer all questions in a straightforward manner, even if the answers appear to help the opposing side.
Answer only the question asked, no more and no less.
Appear well groomed, and dress in clean, conservative clothing. How Effective Communication Can Help
Prevent Lawsuits. Patients who see the medical office as a friendly place are generally less likely to sue.
Physicians, medical assistants, and other medical office staff who have pleasant personalities and are competent in their jobs will have less risk of being sued. Medical assistants can help by: ɀ ɀ ɀ ɀ

ɀ ɀ ɀ ɀ Developing good listening skills and nonverbal communication techniques so that patients feel the time spent with them is not rushed
Setting aside a certain time during the day for returning patients’ phone calls
Checking to be sure that all patients or their authorized representatives sign informed consent forms before they undergo medical or surgical procedures
Avoiding statements that could be construed as an admission of fault on the part of the physician or other medical staff
Using tact, good judgment, and professional ability in handling patients
Refraining from making overly optimistic statements about a patient’s recovery or prognosis
Advising patients when their physicians intend to be gone Making every effort to reach an understanding about fees with the patient before treatment so that billing does not become a point of contention

Terminating Care of a Patient
A physician may wish to terminate care of a patient. Terminating care is sometimes called withdrawing from a case. Following are some typical reasons a physician may

Legal and Ethical Issues in Medical Practice, Including HIPAA

41

ram4577X_ch03.qxd 4/16/04 11:50 Page 42

choose to withdraw from a case: ɀ ɀ ɀ ɀ

ɀ

ɀ

The patient refuses to follow the physician’s instructions.
The patient’s family members complain incessantly to or about the physician.
A personality conflict develops between the physician and patient that cannot be reasonably resolved.
The patient insists on having pain medication refilled beyond what the physician considers medically necessary. The patient habitually does not pay or fails to make satisfactory arrangements to pay for medical services.
A physician may stop treatment of such a patient and end the physician-patient relationship only if adequate notice is given to the patient.
The patient fails to keep scheduled appointments. To protect the physician from charges of abandonment, all missed appointments should be noted in the patient’s chart.

A physician who terminates care of a patient must do so in a formal, legal manner, following these four steps.
1. Write a letter to the patient, expressing the reason for withdrawing from the case and recommending that the patient seek medical care from another physician as soon as possible. Figure 3-1 shows an example of a letter of termination.

2. Send the letter by certified mail with a return receipt requested. 3. Place a copy of the letter (and the return receipt, when received) in the patient’s medical record.
4. Summarize in the patient record the physician’s reason for terminating care and the actions taken to inform the patient.

Standard of Care
You are expected to fulfill the standards of the medical assisting profession for applying legal concepts to practice.
According to the AAMA, medical assistants should uphold legal concepts in the following ways: ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ

Maintain confidentiality
Practice within the scope of training and capabilities
Prepare and maintain medical records
Document accurately
Use appropriate guidelines when releasing information
Follow employer’s established policies dealing with the health-care contract
Follow legal guidelines and maintain awareness of health-care legislation and regulations
Maintain and dispose of regulated substances in compliance with government guidelines

LETTER OF WITHDRAWAL FROM CASE

Dear Mr.

:

I find it necessary to inform you that I am withdrawing from further professional attendance upon you for the reason that you have persisted in refusing to follow my medical advice and treatment. Since your condition requires medical attention, I suggest that you place yourself under the care of another physician without delay. If you so desire, I shall be available to attend you for a reasonable time after you have received this letter, but in no event for more than five days.
This should give you ample time to select a physician of your choice from the many competent practitioners in this city. With your approval, I will make available to this physician your case history and information regarding the diagnosis and treatment which you have received from me.
Very truly yours,
, MD

Figure 3-1.

Physicians are required to inform patients in writing if they wish to withdraw from a case.

Source: Medicolegal Forms With Legal Analysis, American Medical Association, © 1991.

42

CHAPTER 3

ram4577X_ch03.qxd 4/16/04 11:50 Page 43

ɀ ɀ ɀ

Follow established risk-management and safety procedures Recognize professional credentialing criteria
Help develop and maintain personnel, policy, and procedure manuals

Often laws dictate what medical assistants may or may not do. For instance, in some states it is illegal for medical assistants to draw blood. No states consider it legal for medical assistants to diagnose a condition, prescribe a treatment, or let a patient believe that a medical assistant is a nurse or any other type of caregiver. In addition to what is stated by law, you and the physician must establish the procedures that are appropriate for you to perform.

Administrative Duties and the Law
Many of a medical assistant’s administrative duties are related to legal requirements. Paperwork for insurance billing, patient consent forms for surgical procedures, and correspondence (such as a physician’s letter of withdrawal from a case) must be handled correctly to meet legal standards. Documentation, such as making appropriate and accurate entries in a patient’s medical record, is legally important. You may also maintain the physician’s appointment book. This book is considered a legal document. It can prove, for instance, that the physician, if unable to see a patient, arranged for the patient to be seen by another physician in the same practice. In other words, the physician provided a qualified substitute as required by law.
You may also be responsible for handling certain state reporting requirements. Items that must be reported include births; certain diseases such as acquired immunodeficiency syndrome (AIDS) and other sexually transmitted diseases; drug abuse; suspected child abuse or abuse of the elderly; injuries caused by violence, such as knife and gunshot wounds; and deaths. Reports are sent to various state departments, depending on the content of the report. For example, suspected child abuse cases are reported to the state department of social services. Addressing these state requirements is called the physician’s public duty.
Phone calls must be handled with an awareness of legal issues. For example, if the physician asks you to contact a patient by phone and you call the patient at work, you should not identify yourself or the physician by name to someone else without the patient’s permission. You can say, for example, “Please tell Mrs. Arnot that her doctor’s office is calling.” If you do not take this precaution, the physician can be sued for invasion of privacy. You must abide by similar guidelines if you are responsible for making follow-up calls to a patient after a surgical procedure.

Documentation
Patient records are often used as evidence in professional medical liability cases, and improper documentation can contribute to or cause a case to be lost. Physicians should

keep records that clearly show what treatment was performed and when it was done. It is important that physicians be able to demonstrate that nothing was neglected and that the care given fully met the standards demanded by law. One cliché to remember is “If it is not written down, then it was not done.” Pay attention to spelling in charts and keep a medical dictionary handy if you are not sure of a spelling. Today’s health-care environment requires complete documentation of actions taken and actions not taken. Medical staff members should pay particular attention to the following situations.

Referrals. Make sure the patient understands whether the referring physician’s staff will make the appointment and notify the patient, or whether the patient must call to set up the appointment. Document in the chart that the patient was referred and the time and date of the appointment, and follow up with the specialist to verify that the appointment was scheduled and kept. Note whether reports of the consultation were received in your office, and document any further care of the patient from the referring physician. Missed Appointments. At the end of the day, a designated person in the medical office should gather all patient charts of those who missed or canceled appointments without rescheduling. Charts should be dated, stamped, and documented “No Call/No Show” or “Canceled/No
Reschedule.” The treating physician should review these records and note whether follow-up is indicated.
Dismissals. To avoid charges of abandonment, the physician must formally withdraw from a case. Be sure that a letter of withdrawal or dismissal has been filed in the patient’s records. All mailing confirmations should be filed in the record, such as the return receipt from certified mail.
All Other Patient Contact. Patient records should include reports of all tests, procedures, and medications prescribed, including prescription refills. Make sure all necessary informed consent papers have been signed and filed in the chart. Make entries into the chart of all telephone conversations with the patient. Correct documentation requires the initials or signature of the person making the notation on the patient’s chart as well as the date and time.

Controlled Substances and the Law
You must also follow the correct procedures for the safekeeping and disposal of controlled substances, such as narcotics, in the medical office. It is important to know the right dosages and potential complications of these drugs, as well as prescription refill rules, in order to understand and interpret the directions of the physician in a legally responsible manner. Prescription pads must be kept secure so that they do not fall into the wrong hands.

Legal and Ethical Issues in Medical Practice, Including HIPAA

43

ram4577X_ch03.qxd 4/16/04 11:50 Page 44

Communication and the Law
Communication with the patient and disclosure of information are sensitive legal areas. You are not allowed to decide what information should be given to the patient or by whom. You can, however, provide support and show respect for the patient as a person. In cases involving sexually transmitted diseases (STDs), for example, clear, nonjudgmental communication is of the utmost importance.
Sensitivity is also required in dealing with special issues such as illiteracy. For example, a patient may not want to admit being unable to read written instructions. In general, your role in maintaining smooth communication between the patient and the medical office is to help prevent misunderstandings that could lead to legal confrontations.

Legal Documents and the Patient
You need to be aware of two legal documents that are typically completed by a patient prior to major surgery or hospitalization: the living will and the uniform donor card.
Traditionally, these documents were completed outside the medical office or in the hospital. The current trend, however, is for medical practice personnel, including medical assistants, to assist patients in developing these important documents. Living Wills. A living will, sometimes called an advance directive, is a legal document addressed to the patient’s family and health-care providers. The living will states what type of treatment the patient wishes or does not wish to receive if she becomes terminally ill, unconscious, or permanently comatose (sometimes referred to as being in a persistent vegetative state). For example, a living will typically states whether a patient wishes to be put on life-sustaining equipment should she become permanently comatose. Some living wills contain DNR (do not resuscitate) orders. These orders mean the patient does not wish medical personnel to try to resuscitate her should the heart stop beating. Living wills are a means of helping families of terminally ill patients deal with the inevitable outcome of the illness and may help limit unnecessary medical costs.
The living will is signed when the patient is mentally and physically competent to do so. It must also be signed by two witnesses. Medical practices can help patients develop a living will, sometimes in conjunction with organizations that make available preprinted living will forms.
The Partnership for Caring (based in Washington, D.C.) is one such organization.
Patients who have living wills are asked to name, in a document called a durable power of attorney, someone who will make decisions regarding medical care on their behalf, if they are unable to do so. Often, a durable power of attorney for health care form is completed in conjunction with a living will.
The Uniform Donor Card. In 1968 the Uniform
Anatomical Gift Act was passed, setting forth guidelines
44

CHAPTER 3

for all states to follow in complying with a person’s wish to make a gift of one or more organs (or the whole body) upon death. An anatomical gift is typically designated for medical research, organ transplants, or placement in a tissue bank. The uniform donor card is a legal document that states one’s wish to make such a gift. People often carry the uniform donor card in their wallets. Many medical practices offer the service of helping their patients obtain and complete a uniform donor card.

Confidentiality Issues
The physician is legally obligated to keep patient information confidential. Therefore, you must be sure that all patient information is discussed with the patient privately and shared with the staff only when appropriate. For example, the billing department will have to see patient records to code diagnoses and bill appropriately. Also, a staff member who has to make an appointment for a patient to get a herpes test at an outside location will need the patient record to do so.
You must avoid discussing cases with anyone outside the office, even if the patient’s name is not mentioned.
Only the patient can waive this confidentiality right. All patients’ records must be kept out of sight of other patients or visitors as well as night staff, such as janitorial service employees. Confidentiality also is required in the handling of test results.

OSHA Regulations
The Occupational Safety and Health Administration
(OSHA), a division of the U.S. Department of Labor, has created federal laws to protect health-care workers from health hazards on the job. Medical personnel may accidentally contract a dangerous or even fatal disease by coming into contact with a virus a patient is carrying. Medical assistants may also be exposed to toxic substances in the office. OSHA regulations describe the precautions a medical office must take with clothing, housekeeping, record keeping, and training to minimize the risk of disease or injury. Some of the most important OSHA regulations are those for controlling workers’ exposure to infectious disease. These regulations are set forth in the Occupational
Safety and Health Administration Bloodborne Pathogens
Protection Standard of 1991. A pathogen is any microorganism that causes disease. Microorganisms are microscopic living bodies, such as viruses or bacteria, that may be present in a patient’s blood or other body fluids (saliva or semen).
Of particular concern to medical workers are the human immunodeficiency virus (HIV), which causes AIDS, and the hepatitis B virus (HBV). AIDS damages the body’s immune system and thus its ability to fight disease. AIDS is always fatal. HBV is a highly contagious disease that is potentially fatal. It causes inflammation of the liver and may cause liver failure. Every year, about 8700 health-care

ram4577X_ch03.qxd 4/16/04 11:50 Page 45

workers become HBV-infected at work, and about 200 die from the disease. (Chapter 21 discusses HIV, hepatitis, and other blood-borne pathogens.)
OSHA requires that medical professionals in medical practices follow what are called Universal Precautions.
They were developed by the Centers for Disease Control and Prevention (CDC) to prevent medical professionals from exposing themselves and others to blood-borne pathogens. Exposure can occur, for example, through skin that has been broken from a needle puncture or other wound and through mucous membranes, such as those in the nose and throat. If these areas come into contact with a patient’s (or coworker’s) blood or body fluids, a virus could be transferred from one person to another. Specific information about Universal Precautions appears in
Chapter 19.
Hospitals are required to follow what are called Standard Precautions, also developed by the CDC. Standard
Precautions combine Universal Precautions with body substance isolation guidelines. Standard Precautions are also described in Chapter 19.

Protective Gear
The more exposure that is involved, the more protective clothing you need to wear (Figure 3-2). Procedures that usually involve exposure to blood, other body fluids, or broken skin require gloves. There are several kinds of gloves for different situations. ɀ ɀ ɀ ɀ

Disposable gloves are worn only once and then discarded. Do not use a pair that has been torn or damaged. Utility gloves are stronger and may be decontaminated. They are used for housecleaning tasks.
Examination gloves are used for procedures that do not require a sterile environment.
Sterile gloves are used for sterile procedures such as minor surgery.

Appropriate masks, goggles, or face shields must be used for procedures in which a worker’s eyes, nose, or mouth may be exposed. These are procedures that may involve spraying or splashes—for example, examining blood. If potentially infected substances might get onto a worker’s clothing, the worker must wear a protective laboratory coat, gown, or apron. Fluid-resistant material is recommended by OSHA.
The law requires that the physician/employer provide all necessary protective clothing to the employee free of charge. The employer also pays for cleaning, maintaining, and replacing the protective items.

Decontamination
After a procedure, you must decontaminate all exposed work surfaces with a 10% bleach solution or with a germkilling solution containing glutoraldohydes approved by the Environmental Protection Agency (EPA). Replace protective coverings on equipment and surfaces if they have been exposed. Regularly decontaminate receptacles such as bins, pails, and cans as part of routine housekeeping procedures. Never pick up broken glass with your hands.
Use tongs, even when wearing gloves, so that the sharp glass does not cut the gloves and expose the skin.
Dispose of any potentially infectious waste materials in special “biohazard bags,” which are leakproof and labeled with the biohazard symbol (Figure 3-3). Wastes that fall into this category include blood products, body fluids, human tissues, and vaccines; table paper, linen, towels, and gauze with body fluids on them; and gloves, diapers, sanitary napkins, and cotton swabs. Disposal of sharp instruments (“sharps”) is discussed in the next section.

Sharp Equipment
Disposable sharp equipment that has been used must not be bent, broken, recapped, or otherwise tampered with, so as to prevent possible exposure to medical workers. It should be placed in a leakproof, puncture-resistant, colorcoded, and appropriately labeled container. Reusable sharp equipment must be placed as soon as possible into a puncture-resistant container and taken to a reprocessing area.
Both disposable and reusable instruments are sterilized in their appropriate containers. Sterilizing is usually accomplished by means of an autoclave, a machine that uses pressurized steam. Sterilization of disposable instruments is usually handled by an outside waste management company. Exposure Incidents
Figure 3-2. Researchers must wear full protective gear in a laboratory that studies infectious diseases.
Regulations for such gear are set by OSHA.

You must give special attention to what to do in case of an exposure incident. This may happen when a medical worker accidentally sticks herself with a used needle. These
“puncture exposure incidents” are the most common kind of exposure.

Legal and Ethical Issues in Medical Practice, Including HIPAA

45

ram4577X_ch03.qxd 4/16/04 11:50 Page 46

Figure 3-3. The medical assistant may be responsible for disposing of wastes such as gloves, table paper, and gauze with body fluids on them in containers that display the biohazard symbol.

When an exposure incident occurs, the physician/ employer must be notified immediately. Quick and proper treatment can help prevent the development of HBV.
Timely action can also prevent exposing other people to any infection the worker may have acquired. Reporting the incident to the physician/employer also may encourage him to revise the office’s safety procedures in some way to help prevent the same type of incident from happening again. Postexposure Procedures
OSHA requires specific postexposure evaluation and follow-up procedures. If an exposure incident occurs, the employer must offer the exposed employee a free medical evaluation by a health-care provider of the employer’s choice. The employer must refer the employee to a licensed health-care provider who will counsel the employee about what happened and how to prevent the spread of any potential infection. The health-care provider will also take a blood sample and prescribe the appropriate treatment.
The employee has the right to refuse both the medical evaluation and the treatment.
When a medical worker starts a job, the physician/ employer is required to offer the worker, at no cost, the opportunity to have an HBV vaccination within 10 days.
46

CHAPTER 3

An employee who refuses vaccination must sign a waiver.
The employee can change his mind at any time and decide to have the vaccination. If an employee who declined the HBV vaccination is exposed to a patient who is HBVpositive or who is being tested for HBV, it is recommended that the employee be tested for HBV and receive the vaccination if necessary. (The employee may decline to be tested, however.) If the patient is being tested for HBV, the employee is legally required to be informed of the test results. (This is true for HIV as well, and the employee still has the right to refuse testing.) The employee may agree to give blood but not be tested. The blood sample must be kept on hand for 90 days in case the worker later develops symptoms of HBV or HIV infection and then decides to be tested. The health-care provider that performs the postexposure evaluation must give the employer a written report stating whether HBV vaccination was recommended and received. The report must also state that the employee, if tested, was informed of the blood test results. Any information beyond this must be kept confidential.
If you plan to do an externship in a medical office, the physician does not have to provide you with the HBV vaccine. She may, however, deny you the opportunity to do the externship if you have not received the vaccination elsewhere. Many accredited medical assisting programs offer the vaccine to their students.

Laundry
OSHA has regulations for handling potentially infectious laundry. Hospitals have their own laundry facilities because these facilities are cost-effective. Some larger clinics also have their own laundry facilities. Most doctors’ offices, however, send laundry out. Laundry must be bagged and labeled. Any wet laundry to be transported should be packed so that it does not leak. The laundry service the medical office uses should abide by all OSHA regulations.
Laundry workers must wear gloves and handle contaminated materials as little as possible. Some doctors’ offices use only disposable items, such as paper robes, and do not need laundry service.

Hazardous Materials
You may encounter hazardous equipment and toxic substances in the office. These hazards include vaccines, disinfectants, and laser equipment.
OSHA’s Occupational Health and Safety Act of 1970 sets minimum requirements for workplace safety. It also requires employers to keep an inventory of all hazardous materials used in the workplace. Containers of hazardous substances must be labeled in a specific way, listing any potentially harmful ingredients. The employer must post
Material Safety Data Sheets (MSDS) about these substances. These sheets specify whether the substance is cancer-causing, list other possible risks, and state OSHA’s requirements for controlling exposure. All employees are

ram4577X_ch03.qxd 4/16/04 11:50 Page 47

entitled to be informed about hazardous substances in the workplace and to be trained in how to use them safely.

Training Requirements
Training requirements are part of OSHA’s hazardous substance regulations. Every employee who may be exposed to hazardous or infectious substances on the job must be given free information and training during working hours at least once a year. Training must also be held when a new chemical or piece of medical equipment is introduced into the office or when a procedure changes. Training must cover the following topics: ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ How to obtain a copy of the OSHA regulations and an explanation of them
The causes and symptoms of blood-borne diseases
How blood-borne pathogens are transmitted
The facility’s Exposure Control Plan and how to obtain a copy
What tasks might result in exposure
The use and limitations of all the precautions
All aspects of personal protective equipment
All aspects of HBV vaccination
Emergency procedures
Postexposure procedures
Warning labels, signs, and color coding

Beyond this federal law, state training requirements vary. The states of Washington and Florida require medical assistants to take a short course specifically covering HIV laws and precautions. Your instructor will familiarize you with your state’s policy. OSHA has its own training institute, supports various other training resources, and develops training videotapes and tests for trainees. In some doctors’ offices, the laboratory supervisor conducts training for the office staff. Anyone who has gone through a training session can then train others.

General Regulations
General work area laws restrict eating, drinking, smoking, applying cosmetics or lip balm, and handling contact lenses in the work area. These laws also forbid storing food or drinks in refrigerators that are used to store blood or other potentially infectious material. Refrigerators must have working thermometers to ensure proper cooling temperature (see Figure 3-4).
There are also required procedures for various specific on-the-job injuries. For instance, for eye injuries such as burns and chemical splashes, OSHA requires flushing the eye(s) for 15 minutes with a constant water flow.

Documentation
Lastly, OSHA’s record-keeping and documentation requirements are intended to protect the legal rights and

Figure 3-4. OSHA laws require blood or other potentially infectious material to be stored separately from food and drinks. Refrigerators storing such material should have working thermometers to ensure proper cooling temperature. safety of everyone in the medical office. The office must have a written Exposure Control Plan describing all precautions against exposure to hazards and blood-borne pathogens and specifying what to do if exposure occurs.
Employee medical and exposure records must be kept on file during employment and 30 years afterward. If an employer retires or closes the practice, the employee records are forwarded to the director of OSHA. Also, a log of occupational injuries and illnesses, OSHA Form 200, must be kept for 5 years. The employer must also keep on file for 3 years records documenting an employee’s training: dates, topics covered, and names and qualifications of the trainers. OSHA Inspections
In response to a complaint, or sometimes at random,
OSHA may send a compliance officer to inspect a medical office. In 1995 approximately 29,000 inspections were performed. The penalties for not complying with regulations vary according to the severity of the offense. For example, if an inspector finds that the medical assistants have not worn gloves for 2 months because the employer did not make them available, that would entail a severe penalty. If four assistants were wearing gloves but one had forgotten to put them on, there would be a lesser penalty. There are reductions for complying on the spot—perhaps no penalty will be charged. In a serious case, the office could be charged up to $10,000 per broken regulation, multiplied by the number of employees. The penalties are paid directly to OSHA, but the money goes into the federal treasury. If a serious violation occurs in a physicians’ office laboratory, the laboratory’s payments from Medicare may be suspended. Legal and Ethical Issues in Medical Practice, Including HIPAA

47

ram4577X_ch03.qxd 4/16/04 11:50 Page 48

Quality Control and Assurance
A medical office often has a physicians’ office laboratory to perform different types of clinical tests, depending on the physician’s specialty and state laws. The Clinical Laboratory Improvement Amendments of 1988 (CLIA ’88) lists the regulations for laboratory testing. Physicians must display a certificate from CLIA confirming that their office complies with CLIA regulations. These regulations set standards for the quality of work performed in a laboratory and the accuracy of test results. Congress passed these laws after publicity about deaths caused by errors in the test used to diagnose cancer of the uterus.
According to CLIA ’88, there are three categories of laboratory tests: waived tests, moderate-complexity tests, and high-complexity tests. Waived tests, the simplest kind, require the least amount of judgment and pose an insignificant risk to the patient in the event of an error. The laboratory applies for a certificate of waiver from the U.S.
Department of Health and Human Services, which grants permission to perform any test on the list of waived tests and to bill it to Medicare or Medicaid. Tests that patients can do at home with kits approved by the department’s Food and Drug Administration (FDA), such as the blood glucose test, also fall under this heading.
Most tests are in the moderate-complexity category.
Cholesterol testing and checking for the presence or absence of sperm are examples. CLIA lists all waived and moderate-complexity tests and considers all other tests to be of high complexity.
Under CLIA ’88, medical assistants are always allowed to perform waived tests. These tests are listed in Figure 3-5. Medical assistants can also perform moderatecomplexity tests as long as the physician can ensure that the assistant is appropriately trained and experienced according to federal guidelines. Some state laws may be stricter than the federal laws, so the medical office should check with the state health department to see if there are any local rules about what kinds of tests medical assistants may perform. As you advance in your career, you will most likely be trained to do more and more types of tests, receiving training either by senior staff members or through outside programs.

Elements of the Quality
Assurance Program
CLIA ’88 also requires every medical office to have a quality assurance (QA) program. This program must include a quality control (QC) program specifically for the laboratory.
The goal is to track and improve the quality of all aspects of the medical practice—including patient care, laboratory procedures, record keeping, employee evaluations, finances, legal responsibilities, public image, staff morale, insurance issues, and patient education. Documentation is

48

CHAPTER 3

Waived Tests ɀ Dipstick or tablet reagent urinalysis

ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ (nonautomated) for the following: bilirubin, glucose, hemoglobin, ketone, leukocytes, nitrite, pH, protein, specific gravity, and urobilinogen
Fecal occult blood
Ovulation tests—visual color tests for human luteinizing hormone
Urine pregnancy tests—visual color comparison determination Erythrocyte sedimentation rate—nonautomated
Hemoglobin—(nonautomated) by copper sulfate
Blood glucose—by glucose monitoring devices cleared by FDA specifically for home use
Spun microhematocrit
Hemoglobin—(automated) by single analyte instruments with self-contained or component features to perform specimen-reagent interaction, providing direct measurement and readout

Figure 3-5. Under CLIA ’88, medical assistants are always allowed to perform waived tests.

required by QA regulations, to provide evidence that QA procedures are in place in the office. This documentation becomes extremely important if there is an inspection or a legal dispute.
Any QA program must include the following elements: ɀ ɀ ɀ ɀ ɀ ɀ Written policies on the standards of patient care and professional behavior
A QC program
Training and continuing education programs
An instrument maintenance program
Documentation requirements
Evaluation methods

Software programs are available to help medical offices develop a QA program and procedures manual.

The Laboratory Program
The laboratory QC program must cover testing concerns such as patient preparation procedures, collection of the specimen (blood, urine, or tissue), labeling, preservation and transportation, test methods, inconsistent results, use and maintenance of equipment, personnel training, complaints and investigations, and corrective actions. The accuracy of the tests, and the instruments and chemicals that are used, must be monitored through QC procedures and documented. (Laboratory QC programs are discussed in more detail in Chapter 45.)

ram4577X_ch03.qxd 4/16/04 11:50 Page 49

Code of Ethics
Medical ethics is a vital part of medical practice, and following an ethical code is an important part of your job. Ethics deals with general principles of right and wrong, as opposed to requirements of law. A professional is expected to act in ways that reflect society’s ideas of right and wrong, even if such behavior is not enforced by law. Often, however, the law is based on ethical considerations. Bioethics: Social Issues
Bioethics deals with issues that arise related to medical advances. Here are three examples of bioethical issues.
1. A treatment for Parkinson’s disease was developed that uses fetal tissue. Some women, upon learning about this treatment, might get pregnant just to have an abortion and sell the fetal tissue. Is this ethical?
2. If a couple cannot have a baby because of a medical condition of the mother, using a surrogate mother is an option some couples choose. The surrogate mother is artificially inseminated with the sperm of the husband and carries the baby to term. The couple then raises the child. Ethically speaking, who is the real mother, the woman who bears the child or the woman who raises the child? If the surrogate mother wants to keep the baby after it is born, does she have a right to do so?
3. When a liver transplant is needed by both a famous patient who has had a history of alcohol abuse and a woman who is a recipient of public assistance, what criteria are considered when determining who receives the organ? Who makes the decision? Ethically, treating physicians should not make the decision of allocating limited medical resources. Decisions regarding the allocation of limited medical resources should consider only the likelihood of benefit, the urgency of need, and the amount of resources required for successful treatment. Nonmedical criteria, such as ability to pay, age, social worth, perceived obstacles to treatment, patient’s contribution to illness, or the past use of resources should not be considered.
Practicing appropriate professional ethics has a positive impact on your reputation and the success of your employer’s business. Many medical organizations, therefore, have created guidelines for the acceptable and preferred manners and behaviors, or etiquette, of medical assistants and physicians.
The principles of medical ethics have developed over time. The Hippocratic oath, in which medical students pledge to practice medicine ethically, was developed in ancient Greece. It is still used today and is one of the original bases of modern medical ethics. Hippocrates, the fourthcentury-B.C. Greek physician commonly called the “father

of medicine,” is traditionally considered the author of this oath, but its authorship is actually unknown.
Among the promises of the Hippocratic oath are to use the form of treatment believed to be best for the patient, to refrain from harmful actions, and to keep a patient’s private information confidential.
The AMA defines ethical behavior for doctors in Code of Medical Ethics: Current Opinions with Annotations
(Chicago: American Medical Association, 1996). Medical assistants as well as doctors need to be aware of these principles. A physician shall be dedicated to providing competent medical service with compassion and respect for human dignity. This concept means that medical professionals will respect all aspects of the patient as a person, including intellect and emotions. The doctor must decide what treatment would result in the best, most dignified quality of life for the patient, and the doctor must respect a patient’s choice to forgo treatment.
A physician shall deal honestly with patients and colleagues and strive to expose those physicians deficient in character or competence or who engage in fraud or deception. Medical professionals, including medical assistants, should respect colleagues, but they must also respect and protect the profession and public welfare enough to report colleagues who are breaking the law, acting unethically, or unable to perform competently. Dilemmas may arise where one suspects, but is not able to prove, for instance, that a coworker has a substance abuse problem or another problem that is affecting performance. Ignoring such a situation in medical practice could cost someone’s life as well as lead to lawsuits.
In terms of billing, a doctor should bill only for direct services, not for indirect ones, such as referrals. The doctor also should not bill for services that do not really pertain to the practice of medicine, such as dispensing drugs.
It is also unethical for the doctor to influence the patient about where to fill prescriptions or obtain other medical services when the doctor has a personal financial interest in any of the choices.
A physician shall respect the law and also recognize a responsibility to seek changes in requirements that are contrary to the patient’s best interests.

Several legal or employer requirements have come under scrutiny as being contrary to a patient’s best interests.
Among them are discharging patients from the hospital after a certain time limit for certain procedures, which may be too soon for many patients. Insurance company payment policies have sometimes been criticized as unfair. So have health maintenance organization (HMO) financial policies that may conflict with a doctor’s preference in treatment. Legal and Ethical Issues in Medical Practice, Including HIPAA

49

ram4577X_ch03.qxd 4/16/04 11:50 Page 50

CODE OF ETHICS
The Code of Ethics of the AAMA shall set forth principles of ethical and moral conduct as they relate to the medical profession and the particular practice of medical assisting.
Members of the AAMA dedicated to the conscientious pursuit of their profession, and thus desiring to merit the high regard of the entire medical profession and the respect of the general public which they serve, do pledge themselves to strive always to:
A. render service with full respect for the dignity of humanity;
B. respect confidential information obtained through employment unless legally authorized or required by responsible performance of duty to divulge such information;
C. uphold the honor and high principles of the profession and accept its disciplines;
D. seek to continually improve the knowledge and skills of medical assistants for the benefit of patients and professional colleagues;
E. participate in additional service activities aimed toward improving the health and wellbeing of the community; Figure 3-6. The AAMA’s Code of Ethics sets the ethical standard for the profession of medical assisting.
(Reprinted with permission of the American Association of Medical Assistants.)

A physician shall respect the rights of patients, of colleagues, and of other health professionals and shall safeguard patient confidences within the constraints of law.

A document called the Patient’s Bill of Rights, established by the American Hospital Association in 1973 and revised in 1992, lists ethical principles protecting the patient. (The text of the Patient’s Bill of Rights appears in
Chapter 36.) Some states have even passed this code of ethics into law. Among a patient’s rights are the right to information about alternative treatments, the right to refuse to participate in research projects, and the right to privacy.
A physician shall continue to study; apply and advance scientific knowledge; make relevant information available to patients, colleagues, and the public; obtain consultation; and use the talents of other health professionals when indicated.

Keeping up with the latest advancements in medicine is crucial for providing high-quality, ethical care. Most states require doctors to accumulate “continuing education units” to maintain a license to practice. These units are earned by means of educational activities such as courses and scientific meetings. The AAMA requires medical assistants to renew their certification every 5 years, by either accumulating continuing education credits through the AAMA or retaking the certification examination.
A physician shall, in the provision of appropriate patient care, except in emergencies, be free to choose whom to serve, with whom to associate, and the environment in which to provide medical services.

Ethically, doctors can set their hours, decide what kind of medicine to practice and where, decide whom to accept as a patient, and take time off as long as a qualified substitute performs their duties. Doctors may decline to accept
50

CHAPTER 3

new patients because of a full workload. In an emergency, however, a doctor may be ethically obligated to care for a patient, even if the patient is not of the doctor’s choosing.
The doctor should not abandon that patient until another physician is available.
A physician shall recognize a responsibility to participate in activities contributing to an improved community.
This ethical obligation holds true for the allied health professions as well.

In addition to knowing the physician’s codes of ethics, medical assistants should follow the AAMA’s Code of
Ethics, which appears in Figure 3-6 and in Chapter 1.

HIPAA
Today, health care is considered a trillion-dollar industry, growing rapidly with technology and employing millions of health-care workers in numerous fields. The U.S. Department of Labor recognizes 400 different job titles in the health-care industry.
On August 21, 1996, the U.S. Congress passed the
Health Insurance Portability and Accountability Act
(HIPAA). The primary goals of the act are to improve the portability and continuity of health-care coverage in group and individual markets; to combat waste, fraud, and abuse in health-care insurance and health-care delivery; to promote the use of medical savings accounts; to improve access to long-term care services and coverage; and to simplify the administration of health insurance.
The purposes of the act are to: ɀ Improve the efficiency and effectiveness of health-care delivery by creating a national framework for health privacy protection that builds on efforts by states, health systems, and individual organizations and individuals

ram4577X_ch03.qxd 4/16/04 11:50 Page 51

ɀ

ɀ

Protect and enhance the rights of patients by providing them access to their health information and controlling the inappropriate use or disclosure of that information Improve the quality of health care by restoring trust in the health-care system among consumers, health-care professionals, and the multitude of organizations and individuals committed to the delivery of care

HIPAA is divided into two main sections of law: Title I, which addresses health-care portability, and Title II, which covers the prevention of health-care fraud and abuse, administrative simplification, and medical liability reform.

designed to provide strong privacy protections that do not interfere with patient access to health care or the quality of health-care delivery. This act creates, for the first time, national standards to protect individuals’ medical records and other personal health information. The privacy rule is intended to: ɀ ɀ ɀ ɀ

Title I: Health-Care Portability
The issue of portability deals with protecting health-care coverage for employees who change jobs, allowing them to carry their existing plans with them to new jobs. HIPAA provides the following protections for employees and their families: ɀ ɀ ɀ ɀ Increases workers’ ability to get health-care coverage when starting a new job
Reduces workers’ probability of losing existing healthcare coverage.
Helps workers maintain continuous health-care coverage when changing jobs.
Helps workers purchase health insurance on their own if they lose coverage under an employer’s group plan and have no other health-care coverage available.

The specific protections of this title include the following: ɀ ɀ

ɀ

ɀ

Limits the use of exclusions for preexisting conditions
Prohibits group plans from discriminating by denying coverage or charging extra for coverage based on an individual’s or a family member’s past or present poor health. Guarantees certain small employers, as well as certain individuals who lose job-related coverage, the right to purchase health insurance.
Guarantees, in most cases, that employers or individuals who purchase health insurance can renew the coverage regardless of any health conditions of individuals covered under the insurance policy.

ɀ

Before the HIPAA Privacy Rule, the personal information that moves across hospitals and doctors’ offices, insurers or third-party payers, and state lines fell under a patchwork of federal and state laws. This information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient’s medical treatment or health-care reimbursement. For example, unless otherwise forbidden by state or local law, without the
Privacy Rule, patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient’s application for a home mortgage or a credit card or could be given to an employer who could use it in personnel decisions.
Individually identifiable health information includes: ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ

Title II: Prevention of Health-Care
Fraud and Abuse, Administrative
Simplification, and Medical
Liability Reform
HIPAA Privacy Rule. The HIPAA Standards for
Privacy of Individually Identifiable Health Information provide the first comprehensive federal protection for the privacy of health information. The Privacy Rule is

Give patients more control over their health information
Set boundaries on the use and release of health-care records Establish appropriate safeguards that health-care providers and others must achieve to protect the privacy of health information
Hold violators accountable, with civil and criminal penalties that can be imposed if they violate patients’ privacy rights
Strike a balance when public responsibility supports disclosure of some forms of data—for example, to protect public health

ɀ ɀ ɀ

Name
Address
Phone numbers
Fax number
Dates (birth, death, admission, discharge, etc.)
Social Security number
E-mail address
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and serial numbers, including license plate numbers
Device identifiers and serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers

The core of the HIPAA Privacy Rule is the protection, use, and disclosure of protected health information
(PHI). Protected health information means individually identifiable health information that is transmitted or maintained by electronic or other media, such as computer

Legal and Ethical Issues in Medical Practice, Including HIPAA

51

ram4577X_ch03.qxd 4/16/04 11:50 Page 52

storage devices. The Privacy Rule protects all PHI held or transmitted by a covered entity, which includes healthcare providers, health plans, and health-care clearinghouses. Other covered entities include employers, life insurers, schools or universities, and public health authorities. Protected health information can come in any form or media, such as electronic, paper, or oral, including verbal communications among staff members, patients, and other providers. Use and disclosure are the two fundamental concepts in the HIPAA Privacy Rule. It is important to understand the differences between these terms.
Use. Use refers to performing any of the following actions to individually identifiable health information by employees or other members of an organization’s workforce: ɀ ɀ ɀ ɀ ɀ ɀ

Sharing
Employing
Applying
Utilizing
Examining
Analyzing

Information is used when it moves within an organization.
Disclosure. Disclosure occurs when the entity holding the information performs any of the following actions so that the information is outside the entity: ɀ ɀ ɀ ɀ

Releasing
Transferring
Providing access to
Divulging in any manner

Information is disclosed when it is transmitted between or among organizations.

ɀ ɀ ɀ ɀ Under HIPAA, patients have an increased awareness of their health information privacy rights, which includes the following: ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ

The past, present, or future physical or mental health or condition of an individual
Health care that is provided to an individual
Billing or payments made for health care provided

Information that is not individually identifiable or unable to be tied to the identity of a particular patient is not subject to the Privacy Rule.
Managing and Storing Patient Information. Medical facilities have undergone many changes to the way they manage and store patient information. The Privacy Rule compliance was enforced in April of 2003. Many facilities contracted consultants that specialized in HIPAA and became certified in HIPAA compliance. For the health-care provider, the Privacy Rule requires activities such as: ɀ 52

Notifying patients of their privacy rights and how their information is used
CHAPTER 3

The right to access, copy, and inspect their health-care information The right to request an amendment to their healthcare information
The right to obtain an accounting of certain disclosures of their health-care information
The right to alternate means of receiving communications from providers
The right to complain about alleged violations of the regulations and the provider’s own information policies Sharing Patient Information. When sharing patient information, HIPAA will allow the provider to use healthcare information for treatment, payment, and operations
(TPO).
ɀ ɀ ɀ

Under HIPAA, use limits the sharing of information within a covered entity, while disclosure restricts the sharing of information outside the entity holding the information.
The Privacy Rule covers the following PHI:

Adopting and implementing privacy procedures for its practice, hospital, or plan
Training employees so that they understand the privacy procedures
Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed
Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them

Treatment—Providers are allowed to share information in order to provide care to patients
Payment—Providers are allowed to share information in order to receive payment for the treatment provided
Operations—Providers are allowed to share information to conduct normal business activities, such as quality improvement

If the use of patient information does not fall under TPO, then written authorization must be obtained before sharing information with anyone.
Patient information may be disclosed without authorization to the following parties or in the following situations: ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ ɀ Medical researchers
Emergencies
Funeral directors/coroners
Disaster relief services
Law enforcement
Correctional institutions
Abuse and neglect
Organ and tissue donation centers
Work-related conditions that may affect employee health Judicial/administrative proceedings at the patient’s request or as directed by a subpoena or court order

ram4577X_ch03.qxd 4/16/04 11:50 Page 53

When using or disclosing PHI, a provider must make reasonable efforts to limit the use or disclosure to the minimum amount of PHI necessary to accomplish the intended purpose. Providing only the minimum necessary information means taking reasonable safeguards to protect an individual’s health information from incidental disclosure. State laws may impose more stringent requirements regarding the protection of patient information. Healthcare providers and staff should only have access to information they need to fulfill their assigned duties. The minimum necessary standard does not apply to disclosures, including oral disclosures, among health-care providers for treatment purposes. For example, a physician is not required to apply the minimum necessary standard when discussing a patient’s medical chart information with a specialist at another hospital.
Patient Notification. Since the effective date of the HIPAA
Privacy Rule, medical facilities have made major changes in how they inform patients of their HIPAA compliance. You may have noticed, as a patient yourself, the forms and information packets that are now provided by your healthcare providers. The first step in informing patients of HIPAA compliance is the communication of patient rights. These rights are communicated through a document called Notice of Privacy Practices (NPP). A notice must: ɀ ɀ

ɀ ɀ ɀ ɀ ɀ ɀ ɀ

Be written in plain, simple language.
Include a header that reads: “This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review carefully.”
Describe the covered entity’s uses and disclosures of
PHI.
Describe an individual’s rights under the Privacy Rule.
Describe the covered entity’s duties.
Describe how to register complaints concerning suspected privacy violations.
Specify a point of contract.
Specify an effective date.
State that the entity reserves to right to change its privacy practices.

The second step in patient notification is to implement a document that explains the policy of the medical facility on obtaining authorization for the use and disclosure of patient information for purposes other than TPO. The authorization form must be written in plain language. Some of the core elements of an authorization form include: ɀ ɀ ɀ ɀ ɀ Specific and meaningful descriptions of the authorized information Persons authorized to use or disclose protected health information Purpose of the requested information
Statement of the patient’s right to revoke the authorization
Signature and date of the patient

Security Measures. Health-care facilities can undertake a number of measures in order to help reduce a breach of confidentiality, including for information that is either stored or delivered electronically (i.e., stored in computers or computer networks, or delivered via computer networks or the Internet).
HIPAA Security Rule. In February 2003, the final regulations were issued regarding the administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of health information covered by
HIPAA. The Security Rule specifies how patient information is protected on computer networks, the Internet, disks, and other storage media and extranets. The rapidly increasing use of computers in health care today has created new dangers for breaches of confidentiality. The
Security Rule mandates that: ɀ ɀ ɀ ɀ ɀ ɀ

A security officer must be assigned the responsibility for the medical facility’s security
All staff, including management, receives security awareness training
Medical facilities must implement audit controls to record and examine staff who have logged into information systems that contain PHI
Organizations limit physical access to medical facilities that contain electronic PHI
Organizations must conduct risk analyses to determine information security risks and vulnerabilities
Organizations must establish policies and procedures that allow access to electronic PHI on a need-to-know basis Computers are not the only concern regarding security of the workplace. The facility layout can propose a possible violation if not designed correctly. All facilities must take measures to reduce the identity of patient information. Some examples of facility design that can help reduce a breach of confidentiality include the security of patient charts, the reception area, the clinical station, and faxes sent and received.
Chart Security. Patient charts can be kept confidential by following these rules: ɀ ɀ

ɀ ɀ Charts that contain a patient’s name or other identifiers cannot be in view at the front reception area or nurse’s station. Some offices have placed charts in plain jackets to prevent information from being seen.
Charts must be stored out of the view of a public area, so that they cannot be seen by unauthorized individuals. Charts should be placed on the filing shelves without the patient name showing.
Charts should be locked when not in use. Many facilities have purchased filing equipment that can be locked and unlocked without limiting the availability of patient information.

Legal and Ethical Issues in Medical Practice, Including HIPAA

53

ram4577X_ch03.qxd 4/16/04 11:50 Page 54

ɀ

Every staff member who uses patient information must be logged and a confidentiality statement signed.
Signatures of staff should be on file with the office.

Reception Area Security. The following steps can be taken to secure the reception area: ɀ ɀ ɀ ɀ

ɀ

Log off or turn your monitor off when leaving your terminal or computer.
The computer must be placed in an area where other patients cannot see the screen.
Many facilities are purchasing flat screen monitors to prevent visibility to the screen.
The sign-in sheet must be monitored and not left out in patient view. The names of patients must be blacked out so the next patient cannot read the names.
It is best to put another system in place and to eliminate the sign-in sheet.
Many offices are reviewing the reception area with regard to phone conversations. Some offices are creating call centers away from the reception/waiting area.

Medical Assistant Clinical Station Security. Medical assistants should follow these guidelines to protect PHI at the clinical station: ɀ ɀ

ɀ

ɀ

ɀ

ɀ

Log off or turn your monitor off when leaving your terminal or computer.
When placing charts in exam room racks or in shelves, the name of the patient or other identifiers must be concealed from other patients.
HIPAA does not have a regulation about calling patients’ names in the reception area, but to increase privacy in your facility, you may suggest a numbering system to identify patients.
When discussing a patient with another staff member or with the physician, make sure your voice is lowered and that all doors to the exam rooms are closed. Avoid discussing patient conditions in heavy traffic areas.
When discussing a condition with a patient, make sure that you are in a private room or area where no one can hear you.
Avoid discussing patients in lunchrooms, hallways, or any place in a medical facility where someone can overhear you.

Fax Security. A lot of information is exchanged over the fax machine in a medical office. The fax machine is a vital link among physicians, hospitals, insurance companies, and other medical staff members. Private health information can be exchanged via faxes sent to covered entities.
Here are some recommendations to help safeguard information exchanged via fax machines: ɀ 54

Fax cover page: State clearly on the fax cover sheet that confidential and protected health information is included. Further state that the information included is to
CHAPTER 3

ɀ

ɀ

ɀ

ɀ

ɀ

be protected and must not be shared or disclosed without the appropriate authorizations from the patient.
Location of the fax machine: Keep the fax machine in an area that is not accessible by individuals who are not authorized to view PHI.
Faxes with protected health information: Faxes that your office receives with PHI must be stored promptly in a protected, secure area.
Fax number: Always confirm the accuracy of fax numbers to minimize the possibility of faxes being sent to the wrong person. Call people to tell them the fax is being sent.
Confirmation: Program the fax machine to print a confirmation for all faxes sent, and staple the confirmation sheet to each document sent.
Training: Train all staff members to understand the importance of safeguarding PHI sent or received via fax.

Violations and Penalties. Every staff member is responsible for adhering to HIPAA privacy and security regulations to ensure that PHI is secure and confidential.
Anyone who uses or shares patient information is ethically obligated to comply with HIPAA. If PHI is abused or confidentiality is breached, the medical facility can incur substantial penalties or even the incarceration of staff.
Violations of HIPAA law can result in both civil and criminal penalties.
Civil Penalties. Civil penalties for HIPAA privacy violations can be up to $100 for each offense, with an annual cap of $25,000 for repeated violations of the same requirement. Criminal Penalties. Criminal penalties for the knowing, wrongful misuse of individually identifiable health information can result in the following penalties: ɀ ɀ ɀ For the knowing misuse of individually identifiable health information: up to $50,000 and/or one year in prison. For misuse under false pretenses: up to $100,000 and/ or 5 years in prison.
For offenses to sell for profit or malicious harm: up to
$250,000 and/or 10 years in prison.

Administrative Simplification. The main key to the set of rules established for HIPAA administrative simplification is standardizing patient information throughout the health-care system with a set of transaction standards and code sets. The codes and formats used for the exchange of medical data are referred to as electronic transaction records. Regulated transaction information is given a transaction set identifier. For example, a health-care professional claim would be given an identifier of ASC
X12N 837. This is a standard transaction code given to any facility that submits a health-care claim to an insurance company. ram4577X_ch03.qxd 4/16/04 11:50 Page 55

Standardized code sets are used for encoding data elements. The following books are used for the standardized code sets for all health-care facilities: ɀ ɀ ɀ ICD-9-CM, Volumes 1 and 2. This book is used to identify diseases and conditions.
CPT 4. This book is used to identify physician services or procedures.
HCPCS. This book is used to identify health-related services that are not physician or hospital services and procedures, such as radiology or hearing and vision services. Confidentiality Issues and
Mandatory Disclosure
Related to law, ethics, and quality care is the issue of when the medical assistant can disclose information and when it must be kept confidential. The incidents that doctors are legally required to report to the state were outlined earlier in the chapter. A doctor can be charged with criminal action for not following state and federal laws.
Ethics and professional judgment are always important. Consider the question of whether to contact the partners of a patient who has a sexually transmitted disease and whether to keep the patient’s name from those people.
The law says that the physician must instruct patients on how to notify possibly affected third parties and give them referrals to get the proper assistance. If the patient refuses to inform involved outside parties, then the doctor’s office may offer to notify current and former partners. The
Caution: Handle With Care section addresses this issue.
In general, the patient’s ethical right to confidentiality and privacy is protected by law. Only the patient can waive the right to confidentiality. A physician cannot publicize a

patient case in journal articles or invite other health professionals to observe a case without the patient's written consent. Most states also prohibit a doctor from testifying in court about a patient without the patient’s approval.
When a patient sues a physician, however, the patient automatically gives up the right to confidentiality.
In terms of rights to the patient’s chart, the physician owns the chart, but the patient owns the information. The patient has a right to a copy of the chart for a reasonable fee. (It is illegal for the patient to be denied a copy of his chart if he is unable to pay the fee.)
Following are six principles for preventing improper release of information from the medical office.
1. When in doubt about whether to release information, it is better not to release it.
2. It is the patient’s, not the doctor’s, right to keep patient information confidential. If the patient wants to disclose the information, it is unethical for the physician not to do so.
3. All patients should be treated with the same degree of confidentiality, whatever the health-care professional’s personal opinion of the patient might be.
4. You should be aware of all applicable laws and of the regulations of agencies such as public health departments. 5. When it is necessary to break confidentiality and when there is a conflict between ethics and confidentiality, discuss it with the patient. If the law does not dictate what to do in the situation, the attending physician should make the judgment based on the urgency of the situation and any danger that might be posed to the patient or others.
6. Get written approval from the patient before releasing information. For common situations, the patient should sign a standard release-of-records form.

Notifying Those at Risk for Sexually
Transmitted Disease
Few things are more difficult for a patient with a sexually transmitted disease (STD) than telling current and former partners about the diagnosis. In fact, some patients elect not to do so. When patients refuse to alert their partners, the medical office can offer to make those contacts. Often that responsibility lies with the medical assistant.
You are most likely to encounter such a situation if you are a medical assistant working in a family practice, an obstetrics/gynecology practice, or a clinic. Becoming familiar with all facets of the situation—from

ensuring patient confidentiality to handling potentially difficult confrontations—will help you best serve the patient.
The first step is to get the appropriate information from the patient who has contracted the STD. Because the patient may be sensitive about revealing former and current partners, help him feel more comfortable.
First, spend some time talking about the STD. How much does the patient know about it? Educate him about implications, including the probable short- and long-term effects of the disease. Explain how the STD

continued

Legal and Ethical Issues in Medical Practice, Including HIPAA

55

ram4577X_ch03.qxd 4/16/04 11:50 Page 56

Notifying Those at Risk for Sexually
Transmitted Disease (continued) is transmitted. Alert the patient as to precautions to take so he will not continue to transmit the disease to others. Help the patient understand why it is important for people who may have contracted the disease from him to be told they may have it.
Then, offer to contact the patient’s former and current partners. Fully explain each step in the notification process, assuring the patient that his name will not be revealed under any circumstances. Answer any questions and address any concerns about the notification process. If the patient is still reluctant to provide information, give him some time to think about it away from the office, and follow up periodically with a phone call.
Once the patient agrees to reveal names, write down the names and other information, preferably phone numbers. To make sure you have correct information, read it back to the patient, spelling each person’s name in turn and reciting the phone number or address. Write down the phonetic pronunciations of any difficult names. Tell the patient when you will make the notifications.
You now are ready to contact these individuals.
Professionals who work with STD patients recommend guidelines for contacting current and former partners to alert them about potential exposure to an
STD. Note that these guidelines are applicable only to
STDs other than AIDS.
Determine how you will contact each individual: in writing, in person, or by phone.
1. If you use U.S. mail, mark the outside of the addressed envelope “Personal.” On a note inside, simply ask the person to call you at the medical office. Do not put the topic of the call in writing.
2. If you make the contact in person, ask where you can talk privately. Even if the person appears to be alone, others may still be able to overhear the conversation.
3. If you use the phone, identify yourself and your office, and ask for the specific individual. Do not reveal the nature of your call to anyone but that person. If pressed, tell the person who answers the phone that you are calling regarding a personal matter.

56

CHAPTER 3

Once on the phone or alone with the person, confirm that you are talking to the correct person. Mention that you wish to talk about a highly personal matter, and ask if it is a good time to continue the discussion. If not, arrange for a more appropriate time.
Inform the individual that she has come in contact with someone who has a sexually transmitted disease.
Recommend that the person visit a doctor’s office or clinic to be tested for the disease.
Be prepared for a variety of reactions, from surprise to anger. Respond calmly and coolly. Expect to respond to questions and statements such as: ɀ Who gave you my name? ɀ Do I have the disease? ɀ Am I really at risk? I haven’t had intercourse

recently (or) I’ve only had intercourse with my spouse. ɀ I feel fine. I just went to my doctor recently.
Let the person know that you cannot reveal the name of the partner because the information is strictly confidential. Assure the person that you will not reveal her name to anyone either.
Explain that exposure to the disease does not mean a person has contracted it. Encourage the person to get tested to know for sure.
Tell the person that she is still at risk, even if she hasn’t had intercourse recently or has had it only with a spouse. Let the person know that someone with whom she came in close contact at some point has contracted the disease.
Even if the person says, “I feel fine,” she may still have the disease. Again, stress the importance of getting tested.
Provide your name and phone number for contact about further questions. Recommend local offices and clinics for testing, and provide phone numbers. If the person will come to your office, offer to make the appointment. Finally, document the results of your call. Log in the original patient’s file the date that you completed notification. Include any pertinent details about the notification. Alert the patient when all people on the list have been notified.

ram4577X_ch03.qxd 4/16/04 11:50 Page 57

The AMA has several standard forms for authorization of disclosure and includes disclosure clauses in many other forms. For example, the consent-to-surgery form includes a clause about consenting to picture taking and observation during the surgery. When using a standard form, cross out anything that does not apply in that particular situation. Medical practices often develop their own customized forms.

Summary
You must carefully follow all state, federal, and individual practice rules and laws while performing your daily duties.
You must also follow the AAMA Code of Ethics for medical

assistants. It is an important part of your duties to help the doctor avoid malpractice claims—lawsuits by the patient against the physician for errors in diagnosis or treatment. To perform effectively as a medical assistant, you must maintain an office that follows all OSHA regulations for safety, hazardous equipment, and toxic substances. The office also must meet QC and QA guidelines for all tests, specimens, and treatments. It is your responsibility to follow HIPAA guidelines, to ensure patient privacy and confidentiality of patient records, to fully document patient treatment, and to maintain patient records in an orderly and readily accessible fashion.

Legal and Ethical Issues in Medical Practice, Including HIPAA

57

ram4577X_ch03.qxd 4/16/04 11:50 Page 58

CHAPTER

3

Now that you have completed this chapter, review the case study at the beginning of the chapter and answer the following questions:

1. Does the medical assistant’s comment represent a breach of confidentiality?

2. Has any HIPAA rule been violated? If so, which one?

1. How does the law of agency make it possible for a patient to sue both the medical assistant and the physician for an act of negligence committed by the medical assistant?
2. Under HIPAA, what rights do patients have regarding confidentiality and ownership of their medical records?
When does a patient give up the right to confidentiality?
3. Are health-care professionals legally liable for all unsatisfactory outcomes?
4. What are two scenarios that would void a contract between physician and patient?

1. What is an example of a bioethical issue? Give two opposing views of the issue.
2. What are two different situations that could turn into a malpractice or abandonment suit if committed by physicians or their medical staff members?
3. Describe implied consent and two ways that a patient can accept treatment by implied consent.

1. Research a controversial topic from the following list:
Euthanasia
Surrogacy
Abortion
Fetal stem cell research
Cloning
Emergency contraceptive (morning-after pill)

58

CHAPTER 3

Write a three-page report that presents both the pro side and the con side of the issue. Write a closing paragraph that gives your personal opinion and views and how you have been conditioned in that belief, for example, social, cultural, and religious beliefs.
2. Choose teams of four people, and stage debates on the controversial topics listed in question 1. Research your topics thoroughly and present arguments on both sides.
Your purpose is to state facts and persuade your audience to your beliefs.
Rules for the debate: ɀ Participants must be courteous and professional ɀ Presentations must be factual ɀ Opening arguments are four minutes for each side ɀ Each side presents, and then for three minutes each side is allowed to counter any fact ɀ Closing arguments are five minutes for each side ɀ Have the class vote on which side was more persuasive. 3. In a medical law textbook or journal, research a malpractice case. Prepare a 10-minute presentation for the class in which you summarize both sides of the case
(patient and caregiver). Include when and where the case took place. Explain how the case was settled and whether the settlement took place in a court of law or through arbitration. Close with your opinion about whether the case was settled fairly.
4. Research a piece of legislation on a health-care issue or practice, either a bill passed in the last 5 years or a bill currently being considered in Washington. What impact has this bill had or might this bill have on the medical assisting profession? Summarize your findings in a one- to two-page report.