Electronic Medical Records

Recently, physicians and other health care providers have been inundated with information regarding electronic medical records (“EMR”). Medical tests, prescriptions, medical histories and other information would be kept in electronic files that could follow a patient from one doctor's office to another or to a hospital or other facility, as well as allow patients access to their own information. Proponents of EMR believe that such systems will improve patient care, prevent medical errors and lower costs. However, it is believed that the vast majority of health care transactions in the United States are still taking place on paper, whether it involves a patient chart, a prescription, a consultation or a laboratory test result.

According to a recent survey, less than one-third of all medical practices in the United States have EMR systems. In early 2009, the United States government allocated, as part of the economic stimulus program, nearly a billion dollars in Medicare and Medicaid compensation bonuses available to hospitals and physicians who switch to EMR. In addition, the Medicare/Medicaid reimbursement rates may be reduced in the future for claims submitted by providers who are not using EMR. Through this carrot and stick approach, the federal government is addressing two otherwise distinct issues: subsidizing the EMR market and promoting the use of EMR as a desirable attribute of the nation's health care system. Not only would the switching to EMR stimulate the businesses engaged in providing EMR services, but the Obama administration believes that significant health care savings will result by eliminating the redundancies inherent in paper records.

Problems with Implementation of EMR

Notwithstanding these positive attributes and predictions, there are many physicians who complain that EMR is simply too expensive and will cause them to move away from direct interaction with their patients and toward electronic communication, which they feel will negatively impact care. Researching the available systems, deciding which to consider, listening to proposals, making a selection, and working through the training and installation processes are also daunting tasks.

The costs of EMR systems are not insignificant, and vary considerably. By far, the greatest number of medical practices in the nation are staffed with three or fewer physicians, and the smaller the practice, the greater the relative cost of the EMR system. Although licensing fees are based upon the number of “providers” (usually physicians, physician assistants and nurse practitioners), some of the other costs such as training and software maintenance can be disproportionately large for the smaller practice. Also, no two medical practices operate in exactly the same way. While EMR systems permit customization, finding the system that best adapts to how a particular practice operates is not simple, and extensive customization will delay installation and may further increase costs.

Making Choices

As with any electronic technology, there are a wide array of systems and choices in the market. There are hundreds of EMR system vendors. The Certification Commission for Healthcare Information Technology has certified about 200 systems since 2006. This is a dizzying array of possibilities. But the use and feel of the software is not the only issue. The EMR system must be reliable. Whether the records are kept within the medical practice on a computer server, or accessed via the Internet from the vendor's location, the records must be available when needed. The EMR vendor must have an acceptable response time for any problems, whether technical or user related. An inability to access records or complete a transaction can be detrimental to the patient and even result in a malpractice claim. Moreover, since most systems include electronic prescription writing, every practitioner must be certain that drug contraindication information is constantly kept up to date by the EMR vendor.

Storage

Where should patient files be stored? Choosing to store data within the practice is generally far more expensive in the beginning, but saves money over time. Having the EMR vendor store the data for Internet access costs far less initially, but can ultimately cost a lot more in the long run.

Then, there is the issue of what to do with the pre-existing records. How far back in time should records be incorporated into the new EMR system? What about patients who have not been in for over a year or two? Should the practice wait until they return? What should be done with the medical records ' should they be stored or thrown out? Scanning and inputting these records is time consuming and costly and needs to be done with a great deal of vigilance to ensure that the record is reproduced accurately and completely. Very simple issues like scanning both sides of a double sided document or scanning any document with a post-it twice (both with and without the post-it), can be critical to maintaining an accurate and complete medical record.

Culture Change

It is dangerous to underestimate the culture change in the practice brought about by an EMR system. Change invites resistance. Every member of a practice must buy into the new system. All support personnel, including nurses, receptionists, technicians and office management professionals must be made to understand how the EMR works, and each must be comfortable with those components of the system they will most frequently use. Even if a small portion of the staff resists switching to EMR, the system may fail for the entire practice. Inclusion, patience and genuine team spirit will optimize success, but the level of each team member's commitment to the new system must be carefully assessed if success is to be assured.

Additionally, there is the issue of compatibility. The system must work with other systems in order to accomplish one of the broader goals of EMRs, which is to have the ability to transfer information and allow (appropriate) access to information. Thus, the system must be compatible with other physician practices, hospitals, pharmacies and insurance companies.

EMR and the Law

New technological developments create new legal issues, and EMR is not an exception. Issues relating to the preservation and authenticity of medical records are relevant, as are concerns relating to amending or altering records, digital signatures and identification of users.

The economic stimulus program compensation, noted above, is in the form of increased reimbursement rates from Medicare and Medicaid. To receive those funds, a practice must make “meaningful use” of an EMR system by 2011. Unfortunately, “meaningful use” has not yet been fully defined. A proposed definition, issued June 15, 2009, requires the physician to meet a considerable number of objectives and measures by 2011. For example, electronic prescriptions, drug interactions, patient demographics, lab tests and progress notes must be included in each patient's EMR. The system must also produce statistical analyses of specified patient data. The criteria for “meaningful use” will likely expand in 2013 and 2015. This further complicates the selection process, since a physician must have some sense that the EMR vendor will continue to satisfy the evolving definitions. The reward for compliance is substantial. Depending on the nature of the practice, the economic stimulus program may pay as much as $64,000 per physician for switching to EMR.

The physician's handwriting and personal style of writing or organizing content will be obsolete with the full adoption of EMR methods. This will impact medical malpractice litigation. If a physician is involved in a litigation, and discovery is undertaken with respect to medical records, the question arises as to what constitutes “the medical record.” Many EMR systems integrate not just the medical and health information of the patient but also billing information and, depending upon the policies of a practice, additional data such as annotations, e-mails, voice messages, instant messages, clinical alerts and other data. Accordingly, care must be taken when establishing an EMR system that the legal requirements for a medical record are fully complied with and are maintained consistently with the laws of the jurisdiction in which the physician practices. The system must have the means to produce a record of everything that is legally required concerning the patient, but not necessarily everything in the record.

Medical records are one of the greatest sources of personal identifying information, whether by insider theft, outside intrusion or loss of storage media and laptops. Of critical importance is the security of the system and the confidentiality of patients' health information. The system needs to comply with all applicable federal and state confidentiality laws, including the Health Insurance Portability and Accountability Act (“HIPAA”). The HIPAA Security Rule enforces the Privacy Rule through a comprehensive set of regulations covering everything from software updates to password controls. Compliance is mandatory.

Additionally, the use of EMR systems must satisfy the Identity Theft Red Flags Rule of the Federal Trade Commission, currently scheduled to become effective on Nov. 1, 2009. Medical practices must consider how many people, in addition to the physician treating the patient, will have access to information. In many physician offices there will be a nurse, laboratory technician, transcriptionist, billing clerk and records clerk. Accordingly, not only must the system be secure from inappropriate access from the outside but it also needs to be protected internally as well. Most medical records contain not only important health information but also vital information that identifies a person, such as addresses, phone numbers, email addresses and even social security numbers. This information is of great value to an identity thief in enabling such a person to open credit in a person's name in addition to other nefarious activities. Therefore, internal controls need to be established regarding employee access (and significantly also former employee access), as well as physically protecting the computer system itself. The doctor's physical office and any other locations where the computer system or components of the computer system are stored needs to be well secured and monitored.

Getting Started

The realities of the government's stimulus program and physician and patient demand will certainly generate a rapid increase in the number of installed EMR systems. However, as is well known, the law usually lags behind technology. Physicians must be aware of both the benefits and pitfalls relating to EMR and should take appropriate actions to minimize their exposure to liability.

Before buying into an EMR system, the contract for its purchase and installation should be reviewed by a competent attorney. Many EMR contracts are little more than grocery lists of products and services, and their price tags. They commonly omit any guarantee as to the accuracy of the billing software, the date of installation or any other specific obligations on the part of the vendor, including indemnification and hold-harmless clauses. Training costs and financing charges can add a significant price to the basic licensing fee. Technological changes will continue at a fast pace. Will the government or private third-party payers try to standardize record formats? What happens if a practice tries to change EMR vendors ' how does the data migrate?

Conclusion

Attorneys with medical provider clients should become familiar with the applicable portions of the economic stimulus program, with the requirements of HIPAA with relation to EMR systems, and with the contractual pitfalls that may befall the unwitting EMR system purchaser. Lawyers who are not comfortable with these and other issues surrounding the implementation of EMR systems should consider referring their clients' questions to an attorney who is.

Barry B. Cepelewicz, M.D., Esq., a member of this newsletter's Board of Editors, and Gary S. Sastow, Esq., practice at Meiselman, Denlea, Packman, Carton & Eberz P.C.'s Health Care Group, in White Plains, NY. For over 30 years, the firm has represented physicians and other health care providers in litigation, transactional and regulatory matters. The authors can be reached at 914-517-5000, or [email protected] and [email protected].

Recently, physicians and other health care providers have been inundated with information regarding electronic medical records (“EMR”). Medical tests, prescriptions, medical histories and other information would be kept in electronic files that could follow a patient from one doctor's office to another or to a hospital or other facility, as well as allow patients access to their own information. Proponents of EMR believe that such systems will improve patient care, prevent medical errors and lower costs. However, it is believed that the vast majority of health care transactions in the United States are still taking place on paper, whether it involves a patient chart, a prescription, a consultation or a laboratory test result.

According to a recent survey, less than one-third of all medical practices in the United States have EMR systems. In early 2009, the United States government allocated, as part of the economic stimulus program, nearly a billion dollars in Medicare and Medicaid compensation bonuses available to hospitals and physicians who switch to EMR. In addition, the Medicare/Medicaid reimbursement rates may be reduced in the future for claims submitted by providers who are not using EMR. Through this carrot and stick approach, the federal government is addressing two otherwise distinct issues: subsidizing the EMR market and promoting the use of EMR as a desirable attribute of the nation's health care system. Not only would the switching to EMR stimulate the businesses engaged in providing EMR services, but the Obama administration believes that significant health care savings will result by eliminating the redundancies inherent in paper records.

Problems with Implementation of EMR

Notwithstanding these positive attributes and predictions, there are many physicians who complain that EMR is simply too expensive and will cause them to move away from direct interaction with their patients and toward electronic communication, which they feel will negatively impact care. Researching the available systems, deciding which to consider, listening to proposals, making a selection, and working through the training and installation processes are also daunting tasks.

The costs of EMR systems are not insignificant, and vary considerably. By far, the greatest number of medical practices in the nation are staffed with three or fewer physicians, and the smaller the practice, the greater the relative cost of the EMR system. Although licensing fees are based upon the number of “providers” (usually physicians, physician assistants and nurse practitioners), some of the other costs such as training and software maintenance can be disproportionately large for the smaller practice. Also, no two medical practices operate in exactly the same way. While EMR systems permit customization, finding the system that best adapts to how a particular practice operates is not simple, and extensive customization will delay installation and may further increase costs.

Making Choices

As with any electronic technology, there are a wide array of systems and choices in the market. There are hundreds of EMR system vendors. The Certification Commission for Healthcare Information Technology has certified about 200 systems since 2006. This is a dizzying array of possibilities. But the use and feel of the software is not the only issue. The EMR system must be reliable. Whether the records are kept within the medical practice on a computer server, or accessed via the Internet from the vendor's location, the records must be available when needed. The EMR vendor must have an acceptable response time for any problems, whether technical or user related. An inability to access records or complete a transaction can be detrimental to the patient and even result in a malpractice claim. Moreover, since most systems include electronic prescription writing, every practitioner must be certain that drug contraindication information is constantly kept up to date by the EMR vendor.

Storage

Where should patient files be stored? Choosing to store data within the practice is generally far more expensive in the beginning, but saves money over time. Having the EMR vendor store the data for Internet access costs far less initially, but can ultimately cost a lot more in the long run.

Then, there is the issue of what to do with the pre-existing records. How far back in time should records be incorporated into the new EMR system? What about patients who have not been in for over a year or two? Should the practice wait until they return? What should be done with the medical records ' should they be stored or thrown out? Scanning and inputting these records is time consuming and costly and needs to be done with a great deal of vigilance to ensure that the record is reproduced accurately and completely. Very simple issues like scanning both sides of a double sided document or scanning any document with a post-it twice (both with and without the post-it), can be critical to maintaining an accurate and complete medical record.

Culture Change

It is dangerous to underestimate the culture change in the practice brought about by an EMR system. Change invites resistance. Every member of a practice must buy into the new system. All support personnel, including nurses, receptionists, technicians and office management professionals must be made to understand how the EMR works, and each must be comfortable with those components of the system they will most frequently use. Even if a small portion of the staff resists switching to EMR, the system may fail for the entire practice. Inclusion, patience and genuine team spirit will optimize success, but the level of each team member's commitment to the new system must be carefully assessed if success is to be assured.

Additionally, there is the issue of compatibility. The system must work with other systems in order to accomplish one of the broader goals of EMRs, which is to have the ability to transfer information and allow (appropriate) access to information. Thus, the system must be compatible with other physician practices, hospitals, pharmacies and insurance companies.

EMR and the Law

New technological developments create new legal issues, and EMR is not an exception. Issues relating to the preservation and authenticity of medical records are relevant, as are concerns relating to amending or altering records, digital signatures and identification of users.

The economic stimulus program compensation, noted above, is in the form of increased reimbursement rates from Medicare and Medicaid. To receive those funds, a practice must make “meaningful use” of an EMR system by 2011. Unfortunately, “meaningful use” has not yet been fully defined. A proposed definition, issued June 15, 2009, requires the physician to meet a considerable number of objectives and measures by 2011. For example, electronic prescriptions, drug interactions, patient demographics, lab tests and progress notes must be included in each patient's EMR. The system must also produce statistical analyses of specified patient data. The criteria for “meaningful use” will likely expand in 2013 and 2015. This further complicates the selection process, since a physician must have some sense that the EMR vendor will continue to satisfy the evolving definitions. The reward for compliance is substantial. Depending on the nature of the practice, the economic stimulus program may pay as much as $64,000 per physician for switching to EMR.

The physician's handwriting and personal style of writing or organizing content will be obsolete with the full adoption of EMR methods. This will impact medical malpractice litigation. If a physician is involved in a litigation, and discovery is undertaken with respect to medical records, the question arises as to what constitutes “the medical record.” Many EMR systems integrate not just the medical and health information of the patient but also billing information and, depending upon the policies of a practice, additional data such as annotations, e-mails, voice messages, instant messages, clinical alerts and other data. Accordingly, care must be taken when establishing an EMR system that the legal requirements for a medical record are fully complied with and are maintained consistently with the laws of the jurisdiction in which the physician practices. The system must have the means to produce a record of everything that is legally required concerning the patient, but not necessarily everything in the record.

Medical records are one of the greatest sources of personal identifying information, whether by insider theft, outside intrusion or loss of storage media and laptops. Of critical importance is the security of the system and the confidentiality of patients' health information. The system needs to comply with all applicable federal and state confidentiality laws, including the Health Insurance Portability and Accountability Act (“HIPAA”). The HIPAA Security Rule enforces the Privacy Rule through a comprehensive set of regulations covering everything from software updates to password controls. Compliance is mandatory.

Additionally, the use of EMR systems must satisfy the Identity Theft Red Flags Rule of the Federal Trade Commission, currently scheduled to become effective on Nov. 1, 2009. Medical practices must consider how many people, in addition to the physician treating the patient, will have access to information. In many physician offices there will be a nurse, laboratory technician, transcriptionist, billing clerk and records clerk. Accordingly, not only must the system be secure from inappropriate access from the outside but it also needs to be protected internally as well. Most medical records contain not only important health information but also vital information that identifies a person, such as addresses, phone numbers, email addresses and even social security numbers. This information is of great value to an identity thief in enabling such a person to open credit in a person's name in addition to other nefarious activities. Therefore, internal controls need to be established regarding employee access (and significantly also former employee access), as well as physically protecting the computer system itself. The doctor's physical office and any other locations where the computer system or components of the computer system are stored needs to be well secured and monitored.

Getting Started

The realities of the government's stimulus program and physician and patient demand will certainly generate a rapid increase in the number of installed EMR systems. However, as is well known, the law usually lags behind technology. Physicians must be aware of both the benefits and pitfalls relating to EMR and should take appropriate actions to minimize their exposure to liability.

Before buying into an EMR system, the contract for its purchase and installation should be reviewed by a competent attorney. Many EMR contracts are little more than grocery lists of products and services, and their price tags. They commonly omit any guarantee as to the accuracy of the billing software, the date of installation or any other specific obligations on the part of the vendor, including indemnification and hold-harmless clauses. Training costs and financing charges can add a significant price to the basic licensing fee. Technological changes will continue at a fast pace. Will the government or private third-party payers try to standardize record formats? What happens if a practice tries to change EMR vendors ' how does the data migrate?

Conclusion

Attorneys with medical provider clients should become familiar with the applicable portions of the economic stimulus program, with the requirements of HIPAA with relation to EMR systems, and with the contractual pitfalls that may befall the unwitting EMR system purchaser. Lawyers who are not comfortable with these and other issues surrounding the implementation of EMR systems should consider referring their clients' questions to an attorney who is.

Barry B. Cepelewicz, M.D., Esq., a member of this newsletter's Board of Editors, and Gary S. Sastow, Esq., practice at Meiselman, Denlea, Packman, Carton & Eberz P.C.'s Health Care Group, in White Plains, NY. For over 30 years, the firm has represented physicians and other health care providers in litigation, transactional and regulatory matters. The authors can be reached at 914-517-5000, or [email protected] and [email protected].