12 Nuggets of Wisdom You Missed at the New England Fertility Society 2016 Annual Meeting

By Griffin Jones

It was a weekend of fools at the New England Fertility Society's (NEFS) 14th annual meeting, which took place on April Fools'weekend, April 1 and 2. The meeting was set amidst the gorgeous landscape of Vermont's Green Mountains in the resort town of Stowe. Yes, we had dessert catered by Ben and Jerry's Ice Cream. NEFS President, Jill Attaman, MD, thanked the roughly 170 people in attendance, and introduced the April Fool's theme, with practical jokes played throughout the weekend. Yes, there were woopie cushions. If you weren't fortunate enough to have joined us for this year's meeting, here is a brief synopsis of what you missed.

1). 2014 SART reports expected to be released this week. Brad Van Voorhis, MD, the President of the Society for Advanced Reproductive Technology (SART) discussed Big Data for Personalized Medicine and the role that SART has played over the last thirty years as the nation's first national patient health registry. Dr. Van Voorhis reports that just under 400 treatment centers report directly to SART, with only roughly 30% of that number reporting directly to the Center for Disease Control (CDC).

2). Selwyn Oskowitz has left the building. Well, sort of. Selwyn Oskowitz, MD, the founding president of NEFS (then the Boston Fertility Society), retired from his storied career at Boston IVF the day before the meeting began. His colleagues paid him an emotional homage, and he received a standing ovation from everyone in attendance. "Is this real?" Dr. Oskowitz joked, referencing the April Fool's theme. Dr. Oskowitz will be traveling to Rwanda intermittently over the next year to provide pro bono medical services to those with infertility.

Dr. Oskowitz's colleagues remember his career fondly

3). 60% of human embryos result in pre-clinical losses. Steven Young, MD, PhD, of the University of North Carolina School of Medicine lectured on Endometrial Receptivity. Implantation abnormalities are common causes of infertility, pregnancy loss, and pregnancy complications. Dr. Young believes that the next major breakthrough for infertility therapy will come from optimizing successful embryo implantation, which may have important downstream advantages in reducing pregnancy complications.

4). Focus on fertility preservation. Clarisa Gracia, MD of Penn Fertility Care discussed Ovarian Tissue Cryopreservation. With respect to reproductive function, high-risk cancer survivors in their mid twenties have measures similar to naturally aging women in their early forties. She adds that maturing immature eggs from tissue in vitro eliminates the risk of transplanting cancer cells.

5). Cryopreservation now routinely applied to oocytes and embryos. Terry Schlenker, of the Colorado Center for Reproductive Medicine presented on the Vitrification of Oocytes and Biopsied Embryos. Ice formation is avoided by loading the cells with high concentrations of solutes to convert the water into a  non-crystalline solid. Vitrification is now considered indispensable to ART.

6). May the force be with you. Judith Daar, JD, of the Whittier Law School reports that in February 2016, U.S. Secretary of Defense, Ashton Carter, announced a $150 million pilot program to fund egg and sperm freezing for all active duty military. Due to Congress's current ban on IVF, however, the frozen eggs might never be accessed once the soldier is discharged from service.

7). Stress on the rise. 44% of Americans report that their stress levels have increased over the last five years, according to a 2012 American Psychological Association study cited by Courtney Lynch, PhD, MHP, of The Ohio State University Wexner Medical Center. Though not yet conclusive, evidence is suggestive of an association between infertility and stress. 

8). You're not crazy. Rachel K. Ashby, MD, of Brigham and Women's Hospital talked about the importance of validation of feelings with respect to Patient Centered Care in an Infertility Practice. "Patients are worried, 'I'm crazy, I'm not handling this well, everyone else's relationship is stronger than mine'". Dr. Ashby emphasizes the importance of validating these patient experiences as common and that distress is an appropriate reaction. 

9). Triplets don't come cheap. Barbara Luke, ScD, of Michigan State University cited a 2013 American Journal of OBGYN study in her lecture on Designing Research to Assess Health Outcomes After Assisted Reproduction. The per infant cost of triplets counts at $135,733, compared with $8,327 for singletons. Media outlets often sensationalize high profile cases of multiple births but omit information regarding the highly common medical risks.

10). Politics is messy business. 132 Congressmen and Congresswomen have co-sponsored the leading federal embryo-personhood bill. Lee Rubin Collins, JD, spoke on behalf of RESOLVE on Infertility, Ideology, Patients and Politics. RESOLVE has fought legislation threatening IVF in 24 states and counting. 

11). We're not the only ones. "Why would they invite a Canadian to come speak on law regarding funding for reproductive health in New England?" joked Neal Mahutte, MD, of Montreal Fertility Centre. Dr. Mahutte shared the legislative challenges to ART in Canada and in Quebec. Like the United States and virtually every nation in the world, it is very difficult for lawmakers to write consistent laws pertaining to ART. In Canada for example, clinics can import sperm from paid donors in other countries, but donor compensation within Canada is prohibited.

12). People aren't having enough sex. That was the conclusion of pretty much everyone I spoke with. Well...you heard it here first.

How Much Does IVF Really Cost? Why No One Will Tell You The Plain, Ugly Truth

By Griffin Jones

How do people feel about the financial charges associated with IVF? I don't know, you tell me.

• "Incompetent or possibly fraudulent insurance practices"

• "Almost a year later I am still unable to officially take care of my billing issues"

• "They have no problem with asking me for money but pointing out there was a descrepancy [sic] in billing no one would answer"

All of these comments come from real fertility clinic reviews. Is this frustration familiar to you? Financial stress is one of the biggest pain points in dealing with infertility and it sometimes negatively influences your relationship with your fertility clinic. As if infertility didn't already give you enough to deal with, its best medical solution is one of the most expensive endeavors you'll ever face. Some people talk about the cost of IVF in terms of financial infertility, because it is the most common obstacle that prevents couples and individuals from seeking treatment. We frequently see GoFundMe and other crowdfunding campaigns to raise money for IVF. In most U.S. states and Canadian provinces, the expense of IVF is paid out of pocket. Even in the United Kingdom, where the National Health System (NHS) covers most health expenses, there are still many people in the U.K. who don't qualify for the terms of coverage and they too have to pay from their own accounts.

Organizations like RESOLVE advocate for broader and deeper coverage of fertility treatment and you can join them for their 2016 infertility advocacy day on May 11.  Still, even in states like Massachusetts where insurance companies are mandated to offer IVF coverage, you find plenty of complaints about billing and unexpected charges.  At issue, there are many items you can be charged for because needs vary from patient to patient. It's not uncommon to see posts from people who say they've spent over $50,000 on costs associated with IVF. That's a wide leap from the IVF packages listed at $7,500. 

This variance poses a problem to you as you search for information to properly plan your budget. In the spring of 2015, I surveyed a small group of people dealing with infertility who listed cost confusion as one of their three most common pain-points in dealing with their clinics. You want a clear answer.  You want the transparency that you enjoy in almost every sector in which you spend your money. You instantly pay for everything else at fixed prices from Amazon, Priceline, Fandango, and Blue Apron. Why can't you get a straight answer about how much IVF will run you? You need to know what costs you'll incur and how much of it will be covered by insurance in order to budget for your treatment. Why aren't clinics more transparent with you? 

The answer is multi-faceted, so let's dig into it.

proven fact: insurance is the devil

Let's start with one of the very few, axiomatic, incontrovertible laws of the universe: insurance is a nightmare. Remember the national debate we had about healthcare coverage just a few years ago? Effectively, the arguments centered around whose solution would make our horrible payer system even more horrible. The problem certainly isn't unique to fertility care; all of healthcare is plagued by the problem of cost uncertainty.  A study conducted by Consumer Reports shows that billing disputes are the third most common complaint Americans have about their doctors. Why can't a provider tell you how much a service will cost before you decide to go through with it? CEO of tech startup, PokitDok, Lisa Maki, says that people "are trapped by a system that requires that they agree to a service with no knowledge of what the outcome or what the consequences might be to them financially". It's a conundrum. Put yourself in the position of the billing manager; they hate it just as much as you do.

does insurance even cover ivf?

Glad you asked. Every U.S. state and Canadian province is different. In the United States, some states have mandated coverage. If you don't know the universal definition of mandated coverage for infertility...it's because there isn't one. It's helpful that RESOLVE grades states based on how much coverage is mandated. Some states like New York and Texas may be considered mandated states, but their coverage varies. In New York, insurance companies are mandated to cover certain treatments like IUI, but not IVF. In Texas, insurance companies are required to offer coverage in plans to employers, but employers do not have to purchase those plans.

Even in states like Massachusetts and Illinois, the law doesn't apply to certain types of employers, such as those who self-insure. What's more, you may live in a mandated state, but if your employer is not based in that state, then your home state's coverage doesn't apply to you. Don't forget about deductibles, either. You may need to spend a certain amount before insurance will pay for anything. Certain tests and medications might be covered and some might not. If you'd like to take a look at your clinic's website to see what insurances they accept, that won't help much. Every person's coverage depends on their individual plan. What might be covered for your co-worker might not be for you.

the ivf package price is not the total cost of treatment

Is your head spinning yet? We'll table the idea of insurance for the moment. Let's approach this as though you're paying entirely out of pocket. What other costs might you incur in addition to the price of the IVF cycle?

• Tests. Ask your IVF coordinator if your package has a limit on labs or ultrasounds during treatment. If there is a limit, how many labs and ultrasounds are included and how much is each additional?

• Medications. Which drugs are included in the package and which are not? How much do they cost? Is your doctor able to prescribe generic or other brand labels that might be covered by insurance? Are you allowed to buy them on your own?

• Labs. Does your clinic have an in-house endocrine lab or are your labs sent out to a third party? Labs will be drawn throughout your treatment that need to be resulted the same day. If your labs are sent to a third party, there may be an additional cost to you.

• ICSI. Is Introcytoplasmic Sperm Injection included in the package? According to Sher Fertility Institute, ICSI is often required when cases involve the severest degrees of male infertility.

• Embryo freezing. Some clinics will store your embryos in cryopreservation for six months after your IVF cycle, and some might include it for a year. How many months are included in your IVF package? What is the fee for each additional month of storage?

There are even more potential costs associated with IVF

• Anesthesia. If the clinic doesn't disclose whether or not anesthesia is included, it is likely that they charge an additional fee.

• Donor eggs. Donor egg prices are not included in IVF packages unless specifically mentioned in separate pricing. The clinic may have their own donor bank or they may use a third party. If this is a need of yours, it will mean additional costs.

• Surrogacy. If you have this need, the total cost of surrogacy may be as high as $150,000.

• PGD. Preimplantation genetic diagnosis can greatly improve pregnancy success rates by carefully selecting embryos. For older women, and women who have suffered early pregnancy loss, PGD may be all but necessary. Rarely do IVF packages include the cost of PGD.

See? Now you understand why it's so hard for clinics to quote one all-encompassing price for IVF, beyond the most basic IVF package. Rachel Gurevich of About Health reports that the total cost of IVF treatment averages around $20,000, as opposed to the $12,000 average cycle price. There are so many moving parts, it's virtually impossible to give you one set price. As far as clinics are concerned, they need to start displaying "sample pricing". As far as you're concerned, it's better to estimate very conservatively.

then why the heck doesn't my clinic just tell me all this?

This is a great question and it's part of the reason I wrote this post. Fertility practices need to get better at educating prospective patients on cost complexity. From my observation as a marketer, some fertility centers aren't good at discussing finances for two main reasons.

1. Doctors don't like to talk about money. Generally speaking, they find it unbecoming of the conduct of a physician. They hold the patient-physician relationship to be very sacred and they don't want to cause you to think otherwise. They want you to know that they are invested in your care and not the financial arrangement behind it. I see two scenarios play out in online reviews--one that validates physicians'reluctance to talk about money and one that reveals an adverse effect. In the first scenario, the doctor is perceived as "money-grubbing" or trying to "sell" IVF. In the second, people are surprised by a bill and they lash out at their practice for a charge they weren't expecting. Finance isn't an easy subject to bring up, and that's why most physicians leave the discussion to their billing department. The appropriate sales conversation for infertility treatment is content for another post.

2. Clinics are afraid to be punished for doing the right thing. What happens when a fertility practice tells you to budget $20,000, and you get a quote of $8,000 from one of their competitors? To a degree, this concern is justified. Tests show that, if not supported by the necessary context, pricing can sometimes drive people away. I would know. I am not the cheapest marketer that someone can hire and I never want to be. When I quote someone for a price, I want to include everything they might need. If I tell someone they should budget for a marketing strategy at $6,000/month, I include an advertising budget, graphic design, web development, etc. Someone else might tell them that they charge $600 per month for marketing services. That $600 doesn't do much but it sure sounds better than $6,000. No matter the service, people often ask about price before considering the total value being offered. This creates an undesirable cycle: you won't tell me your pricing until I'm more interested; I'm not interested until I know your pricing. This is very annoying for both parties involved, fertility centers and their patients.

be an educated consumer, and make sure they know it

So why should your  fertility clinic show you detailed sample pricing? Are they trapped in a catch 22? Tests prove that the advantages of publishing prices far outweigh the disadvantages Think of it this way. Do you ever stop shopping before you know what the price is? What is the cost of a ride across town? You won't know until the cab stops and adjusts their meter. So you choose Uber, because you see the price in advance, and peer reviews validate the experience you're looking for. To compete for your selection, fertility clinics need to be more upfront with pricing. Leave that part to me.

For your part, the more educated you are as a patient-consumer, the more information practices will have to provide to you ahead of time. You are now conversational in the basics of infertility financing. You will be fluent by the end of your journey. To start, you have some background knowledge of which costs to investigate. Clinics are reluctant to share more information on pricing, partly because they are concerned that their competitors will get away with cost ambiguity. Don't let competing fertility clinics win by giving you less information. As an educated patient-consumer, you have the power to let transparency rule the day.

What Canadian Fertility Centres Need to Know About the Law and Digital Media

By Griffin Jones

A patient’s health information is sacred and a fertility practice’s community of adoring supporters is invaluable. In a world where social media and communication technology develop years ahead of the law, how do we safeguard both privacy and engagement without sacrifice to one or the other? I have interviewed several attorneys regarding the Health Information Portability and Accountability Act (HIPAA) and other regulatory schemes in the United States, but I’ve yet to investigate the law relevant to you, the leaders in reproductive health across Canada.

Dr. Alan West

That is, until now. Dr. Alan West is a physician and a partner at the law firm of Gowling WLG in Toronto. He specializes in healthcare advertising law. Mr. Evan Atwood is a senior associate at the same office who specializes in consumer and healthcare privacy law. You should always consult an attorney for specific legal advice, which Dr. West and Mr. Atwood do not give here, but they offer us some education about how the law can pertain to a Canadian fertility clinic’s internet presence.

Federal and provincial regulations

“We don’t have HIPAA. My head spins when I have to deal with HIPAA.” West clarifies. “We have a mix of federal and provincial laws”. Canada’s PIPEDA (Personal Information Protection and Electronic Documents Act), applies to health information as well as consumer information and applies only in provinces that haven’t passed their own statutes with privacy protections equivalent to those contained in the federal statute. .

Several provinces, including British Columbia and Ontario, have their own health privacy laws. In Ontario, the law is called PHIPA (the Personal Health Information Protection Act).  Atwood explains, “Both fortunately and unfortunately, the law does not explicitly state what information is prohibited from being released without authorization.” Unlike HIPAA in the United States, which has a data set of 18 identifying factors (name, date of birth, license plate number, etc.) for Protected Health Information (PHI), there is no concept of a data set in Canadian privacy law. The principles are much more general.

HIPAA’s 2013 Omnibus rule, adds liability to “business associates”, those who receive and send PHI to “covered entities” (healthcare providers). The obligations of a business associate are explicit. Again, in Canada, the law is not as specific, but the health records custodian (you, the fertility centre) is obliged to see that its vendors only store that data on behalf of the health records custodian, with the same protections in place.  

“The law is always behind the actual practice of medicine.”

Mr. Evan Atwood

In some provinces, medical practices are prohibited from mentioning the brand names of pharmaceuticals and devices in their advertisements. The regulation of marketing falls more on the practices than on the drug companies. “Doctors are allowed to advertise their own services, but they are not supposed to identify or associate themselves with specific products or drugs. Although many do so.” West finds. West and Atwood point to the example of “physician locators”, search engines within pharmaceutical or manufacturer websites, that list nearby physician offices who administer their products. These websites may be impermissibly marketing directly to the consumer, but “I know of no prosecution for using brand names in advertising,” West says.

West offers some insight as to why there is a lack of enforcement of some laws in healthcare advertising. Provincial boards of medical examiners have limited resources, and they spend their attention on investigating serious cases of fraud and malpractice, not on the use of brand names in advertising, which in some instances, have found their way into the public vernacular. In some provinces, there is no obligation to investigate every complaint that is reported to the provincial board. In others, such as Ontario, the board is obliged to investigate every written complaint. They might not take an enforcement action, but the risk is higher because they have to at least open the file.

This is important to know, because what is permissible in one province, may be prohibited by another province’s advertising law. In Ontario for instance, under the Medicine Act, patient testimonials are not permissible. Nonetheless, some medical practices may include testimonials on their websites, including some fertility centres. Whether you use testimonials on your website or not, what about the content posted by a patient to your Facebook or Google Places profile? In that case, it might be advisable not to solicit reviews. “It might not be the intent of the law, but I would rather be the prosecuting attorney than the defendant in such a scenario,” West opines. “As the law is written, I think the doctor has an obligation to police the postings on his or her social media channel”.

“The law has not caught up to reality, to put it mildly”, Atwood adds. “Still, there’s never been a prosecution for what a patient has put on a provider’s social media channel”.

Digital Media and Privacy Law

This wisdom comes with regard to provinces with regulations prohibiting patient testimonials, not with regard to health privacy. Consent is implied when a patient posts his or her own information on a clinic’s blog or social media channel. The doctor can leave it on their site. “Doctors and practices are allowed to respond to reviews and comments because the patient waives his or her right to privacy when they post their own information” West says.

“Implied consent has limits,” Atwood cautions. “You can’t take that content and use it somewhere else”. Failing to obtain the proper consent is a mistake that Atwood and West commonly see. Though Canadian law does not specify six core elements for what is required in an authorization (as in HIPAA), expressed, written consent should be obtained whenever you use patient information outside of what is specified in the law.

West leaves us with a bit of caution. While provincial boards have not yet enforced certain regulations, such as those against the use of brand names in physician advertising, he believes punitive measures could be likely in the future. “Be forewarned of enforcement action. That may be something we see quite a bit more.”

Get specific legal advice

In every country, the technologies and media that people use to communicate develop much more rapidly than the laws that regulate them. We have to engage our online communities in a way that respects patient privacy and also complies with the law. In my opinion, Canada’s laws seem to follow common sense more so than the ambiguity of other regulatory schemes, but I’m not an attorney. I recommend you always consult an attorney about the federal, provincial, and local regulations specific to your area.

Dr. Alan West is a partner in Gowling WLG's Toronto office, practicing primarily in areas of law related to pharmaceuticals and health care.

Mr. Evan Atwood is a senior associate at Gowling WLG’s Toronto office, with experience in guiding clients with advertising compliance issues with Health Canada.

What Are We Doing? An Interview on Forming Social Media Policy with Paul Anderson

By Griffin Jones

This is the eighth interview in a series that explores the implications of patient privacy and the effective use of digital media. This piece centers on the importance of forming a social media policy. Paul Anderson is director of risk management publications at ECRI Institute.

Paul A. Anderson

Jones: You don’t tell practices that they have to be on social media, but what do they need to consider?

Anderson: Your patients, colleagues, and even your competitors are using social media. You want to know what patients are saying. If it’s positive, you want to thank them and share that. If it’s negative, you want to be aware of what they’ve said. If you’re not participating in social media, you’re missing part of your constituency. If you’re not using it, they’re going to sail right past you. You’re not in the space where people are talking.

There is often worry from physicians about participating in that space where people are talking. What about the risk? What about privacy?

Providers have a lot of misconceptions and fears about HIPAA. And of course, there is cause for concern. You don’t want to identify a patient in any way without their authorization. It is much better to get patients to tell their own stories, because patients can tell their own story to whomever they want. Practices should consult someone who is experienced with HIPAA compliance. I also recommend thoroughly educating someone in the practice on compliance issues, and having that person in charge of advising the social media policy. That person can be the word of caution and help the practice be smart about what they are doing. The first thing an agency will look for when investigating a privacy complaint is to see if there was a policy in place. The second thing they’ll look for is, “did we teach anyone about it?”

Many fertility centers participate in social media, but have yet to put a policy in place. Where do they start?

They first have to identify their goals. “Are we just going to monitor or are we going to engage people? Who’s going to approve content? Who’s going to post? What is our voice? Is it formal and academic? Or informal and casual?” Depending on the size of the practice, an individual or a committee should be placed in charge of initiating and enforcing the policy. Someone needs to be in charge of posting, because if a practice has a social media account, but never posts anything, that doesn’t look very good. I’m in favor of being active by posting and promoting content. You only do that when you have a well-defined reason for doing that and goals to employ.

How should practices respond to negative reviews?

One first has to be aware of the risks. If the review is too hostile to address productively, it’s perfectly reasonable to just leave it alone. If it’s negative commentary, take that conversation offline. There’s a lot of high emotions. You don’t want to inflame the situation.  Your response may be as simple as, “We hear your concern. We value your feedback. We’d like to talk to you. Here’s our phone number.” You can get a sense pretty quickly if the situation is resolvable. If it’s not, you have to disengage and try to balance that with positive reviews.

How about responding to positive reviews?

It’s never bad to say thank you, or when someone’s said “thank you” to say “you’re welcome.” Keep it simple. You don’t want to say too much but you’ve got to engage. Social media is a marketing tool that isn’t one-way.

Who is a healthcare provider with an exemplary social media policy?

The folks at the Mayo Clinic really have one of the best social media presences in all of healthcare. They have a center for social media and educational boot camps and social media trainings for employees. They’re very active on social, you can follow them almost everywhere. Their policy and their practices in place are really great resources.

But how does a small fertility practice implement a good social media policy?

Whoever’s going to spearhead this initiative better know how to use social media. Familiarity with the platforms and their nuances is necessary in order to be able to use them to effectively communicate. Define why you are going to use social media, first. If you can articulate that clearly, that will drive the rest of your conversation.

Paul Anderson is the director of risk management publications at ECRI Institute, an independent, non-profit, research institute that works with all sizes of healthcare providers from single practitioners to large research hospitals. They help practices with risk, quality, and patient safety management. You can learn more about ECRI Institute and their services here

Avoid Common HIPAA Violations: An Interview with George Indest

By Griffin Jones

This is the seventh interview in a series that explores the crossroads of the Health Insurance Portability and Accountability Act (HIPAA) and digital media.

George Indest

George Indest practices healthcare law in Florida and across the country. Mr. Indest’s comments don’t provide legal advice, but they do offer us some insight on how the Health Insurance Portability and Accountability Act (HIPAA) impacts digital media for fertility centers. I asked Mr. Indest about some of the more common mistakes that practices have made to lead to a HIPAA breach.

Indest: Very often, breaches are inadvertent disclosures of protected health information (PHI) to people who didn’t have authorization to view it. Unauthorized disclosures may even include the patient’s immediate family members. Unless the patient has signed a HIPAA authorization for their family members to be able to view their information, the provider cannot release those records. There are several inadvertent mistakes that lead to HIPAA breaches, often including unintended recipients of patient information. This can include sending or forwarding an e-mail to the wrong person, replying to all instead of to an individual, or sending a fax to a recipient whose number is only one digit different from the intended recipient.

What happens when a patient releases their own information on a blog, place page, or social media channel operated by the practice?

The patient is free to release whatever information they want. That in no way effects the practice or the covered entity. I know of no legal obligation to take down patient posts. If the channels are open to the public, it’s the patient’s right and decision to disclose that information. That’s not covered by HIPAA. But, if the channels are open to the public, the covered entity needs to make warnings available that the practice does not have control over who can see that information.

What are the implications when the practice responds to the patient? Does a general response disclose a patient-physician relationship?

I don’t think there’s any sort of violation at all in a response that doesn’t contain PHI. Social interactions take place between patients and physicians all the time. There’s no breach of anyone’s confidentiality unless medical information is discussed. With that said, I have read of breaches wherein a practice responded to a patient’s Better Business Bureau (BBB) complaint and disclosed some of their records to refute the complaint. This is an unauthorized disclosure of PHI and a clear HIPAA violation. The patient is free to release whatever information they want, but that doesn’t authorize the practice to do the same. Even if it is a positive review, where the practice wants to share or retweet information that the patient has already made public, it would be on the safe side to get HIPAA authorization.

What should healthcare providers be doing right now to ensure HIPAA compliance?

The Office of Civil Rights (OCR) and the Department of Health and Human Services (HHS) have indicated more HIPAA audits and investigations. There are more law suits and more complaints of breaches than ever before. Personnel need constant training. They need constant reminders of HIPAA risks. Go overboard in your risk assessment and risk management. There are plenty of plaintiff attorneys looking for suits and there are plenty of things that shouldn’t be occurring. Personnel not directly involved in a patient’s care should not be viewing that patient’s records, and it’s a risk that happens far too often. Education and training need to be provided on an ongoing basis.

George Indest is the principal of the Health Law Firm in Altamonte Springs, Florida. The Health Law Firm, concentrates in representing health care providers, exclusively. Their attorneys include those Board Certified in Health Law. If you would like to learn more from George’s legal expertise, you can contact him here.

Preparing for HIPAA Compliance Audits: An Interview with Valerie Breslin Montague

By Griffin Jones

This is the sixth interview in a series exploring the implications of the Health Insurance Portability and Accountability Act (HIPAA) as it relates to digital media.

Valerie Breslin Montague

Valerie Breslin Montague is an attorney who specializes in HIPAA in Chicago, IL. Ms. Montague’s comments do not contain legal advice, but they do educate us about some of the risks that face fertility centers with respect to HIPAA and social media. I started the interview with a topic that we are all very interested in--what are the implications when patients include their own information on a practice’s website, blog, place page, or social media channel?

Montague: Generally, under federal and state privacy laws, when a patient is forthcoming with their own information, that’s not a disclosure by the practice. Anything posted by the patient would be their disclosure. With that said, it would be wise for practices to include that publicly in their social media policy. Patients should know that social media channels and review sites are public places, and anything posted on the internet should be considered permanent. The practice should inform the public that they do not have control over who can see that information, once posted. When responding to patient comments, it would be wise to do so in a general manner (such as “thank you” or “we appreciate that”). I wouldn’t confirm the patient’s visit, or add any new information.

Is there a danger of disclosing the physician-patient relationship even if it’s a basic acknowledgement of the comment?

I don’t think there’s any guidance here, but I don’t believe that’s something that would be enforced as a HIPAA violation. I think the government would have a hard time arguing that was a breach of PHI. If the government wanted to be very overreaching, I suppose they could, but I don’t see a very big risk there. The practice wouldn’t want to do anything to amplify or further share the patient’s message, such as adding a hash tag, tagging another person, or retweeting or sharing the post, without a proper HIPAA authorization.  The practice can directly message or e-mail the commenter, to ask them to complete a HIPAA authorization. Then they can share the posted content for purposes agreed upon in the authorization.

Why don’t the department of Health and Human Services (HHS) and the Office of Civil Rights (OCR) issue guidelines on practice engagement on digital media?

Hopefully OCR will in the near future but its focus now is on enforcement and audits.

Tell us about the pending round of HIPAA compliance audits.

OCR has been warning of a second round of audits for more than a year. The first round of HIPAA compliance audits took place in 2012. This time, the audit will include both covered entities (healthcare providers and health insurers) and their “business associates” (EHR providers, billing companies, etc.) The agency has said they will audit a large scope of entities from large health systems to small practices.

What are common vulnerabilities that might be exposed for healthcare providers during these audits?

 It’s very common to have HIPAA policies in place for privacy obligations. Providers have been doing a pretty good job of keeping up in that respect. Some smaller or newer business associates may need more help. Where I’m concerned that many people may fail to meet compliance is their requirement to do a security risk assessment. They need to check the security of everything that impacts PHI. Once strengths and weaknesses have been analyzed, a risk management plan has to be implemented.

Not having a “business associate” contract in place is also a risk for both the healthcare provider and the business associate. The arrangement, not the agreement, determines if the relationship exists, and both parties are culpable if a signed contract is not in place.

What should healthcare providers be doing right now to ensure HIPAA compliance?

Providers should be prepared for risks before any incidents might occur. It is much easier to correct security weaknesses before an audit or investigation, and much more difficult to do so in the midst of one. Our firm (Nixon Peabody) works with providers and their vendors to review HIPAA compliance programs and implement any necessary updates before issues arise. OCR will definitely investigate any mass breach that involves over five hundred people and they may investigate smaller breaches and complaints, especially if it is a high profile case.

 It’s important to be proactive to determine where your practice stands, relative to compliance, before a complaint or breach requires it.

Valerie Breslin Montague focuses her practice on regulatory compliance, nonprofit governance and tax exemption, and HIPAA/health information privacy and security. She is a partner at the firm, Nixon Peabody, in Chicago. If you would like to learn more about HIPAA compliance and risk management, you can contact her here.

A Look Into Practice-Wide HIPAA Education with Ashley Trotto

By Griffin Jones

This is the fifth interview in a series exploring the implications of the Health Insurance Portability and Accountability Act (HIPAA) as it relates to digital media.

Ashley N. Trotto

Ms. Ashley Trotto practices health care law in Knoxville, Tennessee. Ms. Trotto’s comments do not contain legal advice, but they do educate us about some of the risks that face fertility centers with respect to HIPAA and social media. The reason I’ve reached out to Ms. Trotto and other experts in healthcare law is because there is surprisingly little guidance online about HIPAA and social media. Much of the information available is vague or may even be incorrect. I asked Ms. Trotto why there is so little information on the subject.

Trotto: The information that is online is often gray, which is understandable because the Department of Health and Human Services (HHS) and the Office of Civil Rights (OCR) have not issued guidelines regarding social media and HIPAA. But it’s coming. We don’t know when, but the agencies will have to issue guidelines eventually.

The greatest unknown for healthcare providers in social media may be when a patient posts their own information. I think we all know to never post protected health information (PHI) on our websites or social media without express written consent.

You would think it’s common knowledge not to post patient information without authorization, but apparently it’s not as common as we might think. If you read some of the briefs of these breaches, most of them are inadvertent. There are 18 different identifiers that are addressed in HIPAA’s privacy rule. A staff member may believe that they are not publishing patient information, but many factors can be used to identify a patient. There have been breaches where the practice or staff members have shared information without the patient’s explicit consent. While any consent would be better than none, HHS has specific regulations regarding what is needed for a HIPAA authorization.

For this reason, I recommend against publishing any patient information whatsoever unless accompanied by a HIPAA authorization for the explicit use of marketing and social media. What happens when patients post their own information to a fertility practice’s blog, place page, or social media channel?

Physicians can’t stop patients from posting their own information. A big concern would be if patients posted content that included information about other patients. The practice would want to take that down, but a patient is free to talk about their own information wherever they like.

Is acknowledging a patient comment or review with a simple “Thank you”, or “We take your concern very seriously, please call us at…” disclosure of the patient-physician relationship?

 Generally, no. I wouldn’t be concerned about responding where the patient has already disclosed that information. However, that the doctor or practice must be very careful not to offer medical advice or include any additional information that the patient did not.

What should healthcare providers be doing right now to ensure HIPAA compliance?

The greatest action a practice can take to prevent a breach of HIPAA is to implement team-wide education. We need everyone in the practice to know what HIPAA is, what PHI is, and what a breach is. Practice-wide education is key, and policy drafting is second. Practices need to have a privacy officer who is in charge of HIPAA compliance so it may make sense to bring in outside firms who can help explain the complex law and implement training procedures.

Generally, I think the biggest thing is just being aware. The smallest mistake could be a breach. There is a recent example of a HIPAA breach where a medical practice used an online scheduling calendar in which users could see the names of other people who had scheduled appointments, and their appointment times. The breach wasn’t intentional, but the calendar was not secure, and the practice was found in violation.

To name just one HIPAA risk to look out for would be extremely difficult. But to name one thing that you can do to protect your practice—that would absolutely be education and training for the entire team.

Ashley Trotto focuses her practice on Affordable Care Act (ACA) compliance. She practices with the firm, Kennerly Montgomery, in Knoxville, Tennessee. If you would like to learn more from Ashley’s expertise, you can contact her here.

Start With The Law: An Interview on HIPAA and Social Media with Paul Hales

By Griffin Jones

Paul Hales

This is the fourth interview in a series exploring the implications of the Health Insurance Portability and Accountability Act (HIPAA) as it relates to digital media.

Paul Hales is an attorney from St. Louis, who specializes entirely in HIPAA law. Mr. Hales’ comments do not contain legal advice, but they do educate us about some of the risks that face fertility centers with respect to HIPAA and social media. Mr. Hales gives us some background on the Act.

Hales: We have to start with the law. My focus is on enabling practitioners to make use of social media and comply with the law. HIPAA was passed in 1996 with two objectives;

1. To be able to keep insurance when switching from one provider to another.

2. To have a uniform code for information and payment

It has had further additions since.

• The privacy regulations were added in 2003.

• The HIPAA security rule was added in 2005

• HITECH was passed in 2009.

• In 2013, the Omnibus rule was added to HIPAA to extend liability to “business associates”.

What is a business associate?

A “business associate” is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.

What are common areas in which covered entities and businesses associates fail to meet HIPAA compliance?

• Protected Health Information (PHI) is made up of 18 identifiers, including but not limited to name, e-mail address, full face photos, and date of birth.

• Under HIPAA, every health care practice or organization must designate a privacy officer. The privacy officer must perform a risk-analysis.

• Health plans and covered health care providers are required to develop and distribute a notice that provides a clear explanation of privacy rights and practices with respect to patients’ personal health information.

What about when a patient posts their own information on a blog, social media channel, or place page operated by the practice?

It’s important to look at how HIPAA defines a website, which is any site that provides information about a covered entity’s services or benefits. Therefore, if a patient posts their own information to a site that’s owned by the practice, that is unauthorized PHI on the practice’s site. The practice has to obtain HIPAA authorization before allowing any patient content to be published to its sites.

What is necessary in a HIPAA authorization?

HIPAA Authorizations have six core elements:

1. A specific and meaningful description of the information to be used or disclosed.

2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

3. The name or other specific identification of the persons(s), or class of persons, to whom the covered entity may make the requested use or disclosure (i.e., the intended recipients).

4. Description of each purpose of the requested use or disclosure.

5. Must contain an expiration date or an expiration event.

6. The signature of the individual and the date.

A HIPAA authorization must also include three statements.

1. Individual’s right to revoke the Authorization.

2. Clarification that the covered entity is not permitted to condition the provision of treatment on the execution of a valid Authorization.

3. Explanation that there is a potential that the information may be re-disclosed by the recipient of the information and that the recipient may not be required to comply with the Privacy Rule.

What should fertility practices be conscious of right now to minimize risk of HIPAA violations?

Recently, there has been more enforcement, and soon there will be audits. On February 16, 2016 the Office of Civil Rights (OCR) settled an enforcement action against Complete P.T., Pool & Land Physical Therapy, Inc. for impermissibly disclosing patient information in the form of testimonials on their website. HIPAA is a very extensive law. There is a lot of information on the internet that is simply wrong. HIPAA regulations are very demanding and products cannot ensure compliance. No product can be HIPAA compliant. It’s how a covered entity uses a product that makes it compliant or not.

Paul Hales is an attorney who provides legal services and consultation regarding HIPAA compliance. His software, the HIPAA e-tool helps covered entities and business associates with a complete HIPAA compliance solution. If you’re interested in an educational webinar with Mr. Hales, you can register here.

Legal Considerations When Responding to Online Patient Reviews: An Interview with Eric Goldman

By Griffin Jones

Eric Goldman

This is the third interview in a series which explores digital media and the law, including questions about HIPAA and online engagement.  Eric Goldman is a professor at Santa Clara University School of Law. While Mr. Goldman's answers don't provide us with legal advice, they do give us some insight into how fertility practices might consider the law when responding to patient reviews online.

Jones: Should physicians respond to reviews written about them online? Why or why not?

Goldman: In most circumstances, physicians either should not respond to online reviews or respond generically by thanking the reviewer and indicating that the physician appreciates and carefully considers online feedback. It rarely makes sense to get into substantive discussions with reviewers online. Not only could such discussions implicate HIPAA, but physicians often look thin-skinned and petty when they attempt to debate fact matters online. Furthermore, increasing the number of comments to a review may actually cause search engines to rank the content higher (a counterproductive result if the review is negative). If the physician chooses to engage a negative review about the facts (which is rarely if ever advisable), the response should discuss the office’s general practices and not discuss how those practices were applied in the reviewer’s specific situation.

J: What information should physicians never include in their responses to reviews?

G: Given the boundaries of HIPAA, there are few circumstances where a physician can discuss any individual facts about the reviewer. Indeed, it is potentially problematic to even acknowledge that the reviewer is a patient.

J: Are there different implications for responding to patients when their identities are public (ex. Facebook) vs. when they are anonymous (ex. RateMDs)?

G: I couldn’t think of any.

J: Are responses to reviews considered protected health information (PHI) if the patient posted the information?

G: It’s a risky practice for physicians to confirm information that a patient or family member voluntarily publicly disclosed.

J: What should physicians and practices always be wary of regarding online reviews and their public reputation?

G:

1. Prospective patients are increasingly looking at other patients’ reviews when selecting physicians. I know many physicians wish this weren’t true, but there’s no point pining for an alternative universe.

2. Prospective patients are savvy enough to discount outlier reviews. If one negative review is surrounded by multiple positive reviews, it will have minimal effect on the physician’s reputation.

3. Patients’ reviews of their physicians are overwhelmingly positive, i.e., in some cases 90%+ of patients’ reviews are positive.

4. If a physician deals with dozens or hundreds of patients, inevitably there will be a few unhappy patients who will vent online.For these reasons, physicians should be actively encouraging their patients to review them online. This will better inform future prospective patients, and it usually will help create a base of positive reviews that will insulate the physician from the occasional negative reviews that inevitably will come.

G: A final thought: getting negative feedback never feels good, but it can provide a candid insight into the patient’s experiences. If the physician can overcome the emotional sting of a negative review, there may be valuable customer feedback that can help physicians do a better job meeting their patients’ needs.

If you would like to read a short essay by Mr. Goldman which explores how doctors and other healthcare professionals have responded to patient reviews of their services and addresses how they should deal with patient reviews in the future, you can find it here.

1 Big Unexpected HIPAA Risk Facing Fertility Centers Online: An Interview with Rachel Yaffe

By Griffin Jones

This is actually the second interview in a series exploring the Health Insurance Portability and Accountability Act (HIPAA) that I recorded in August of 2015 and published in September. The Fertility Bridge blog was not active in its current form, then. I wanted to make sure this interview was in the blog archives because (speaking for myself) HIPAA is not always as common sense as we would like it to be. Rachel Yaffe practices healthcare law in Chicago. Ms. Yaffe's comments are not legal advice, they simply offer us some insight into how HIPAA might impact a fertility center's digital media strategy. In this interview we discuss

• What are the implications when a patient posts their own information on a fertility center's website, place page, or social media channel?

• Should practices follow patients on platforms like Twitter and Instagram?

• Should practices have personal Facebook pages for their business?

Rachel Yaffe represents physicians, medical practices, laboratories, pharmacies, and other healthcare clients in corporate, transactional and regulatory matters. She practices with the firm, McDonald Hopkins in Chicago. If you would like to learn more about HIPAA compliance from Rachel, you can contact her here.

Every Fertility Center Needs a HIPAA Compliant Social Media Strategy: An interview with Mike Bossenbroek

By Griffin Jones

This was the first interview that I did in a series exploring the Health Insurance Portability and Accountability Act (HIPAA) and its implications regarding digital media. I originally recorded this interview in August of 2015,  before the Fertility Bridge blog was active in its current form. Per usual, my video intro is corny, and very crudely edited, but the content is very valuable because practices should educate themselves about HIPAA considerations in social media as much as they can.

Michael Bossenbroek practices healthcare law in Michigan. Of course, Mr. Bossenbroek's comments are NOT legal advice, but they give us important information to consider about how fertility centers should approach social media and patient engagement. In this interview, we address

• What are some things that a HIPAA compliant social media policy should include?

• Where should a fertility practice's social media policy be visible?

• What else should fertility practices consider when deciding their activity on social media?

Michael Bossenbroek is a partner at Wachler & Associates, P.C.  in Royal Oaks Michgian. Mr. Bossenbroek practices in all areas of health care law, including representing clients in matters relating to HIPAA compliance. If you'd like to learn more about HIPAA compliance from Mike, you can contact him here.