David Harlow, JD, MPH

Conservative and libertarian writers, some with ties to the Reagan and Bush I administrations, have 

 that health insurance mandates—which may end up in a final federal health insurance reform law&mdash;are well beyond the constitutional authority of the federal government to tax, spend, and regulate interstate commerce. Others have picked up on these arguments and applied them to the EHR-implementation incentives under the HITECH Act as well. The bottom line is that these arguments fail, for four reasons:

there is no mandate to implement EHRs in the HITECH Act

. The EHR incentive provisions allow for reimbursement of certain costs, up to a stated maximum per provider, for the “meaningful use” of a “certified” EHR. Definitions of these key terms are being worked out by 

 and should be formally adopted by the end of December. Failure to begin meaningful use of a certified EHR system will result in a penalty, or discount, being applied to payments for services provided to enrollees in federal healthcare programs after the phase-in period is complete, in 2015.

As is the case with many other initiatives promoted by the federal government when it is acting as a third-party payor, incentives are provided for early adoption of new initiatives and/or penalties are imposed for failure to comply by the end of a phase-in period, with the financial incentives for compliance increasing over time. One example of this is the 

Reporting Hospital Quality Data for Annual Payment Update (RHQDAPU) system

 of “pay for reporting” of quality indicators by hospitals. It may feel like a mandate to some, but the existence of incentives and disincentives under a Medicare provider agreement do not a mandate make. No provider is required to participate in the Medicare program.

Second, even if the HITECH Act were a mandate for the use of EHRs, it would easily survive an attack based on the Commerce Clause of the US Constitution. Due to the limited powers granted by the states to the federal government, federal laws affecting economic activity may only be adopted if they regulate interstate commerce. Such a challenge to the HITECH Act, then, would have to be based on the contention that the federal government lacks the authority to regulate the delivery of healthcare services, because healthcare is neither “economic activity” nor an activity touching on interstate commerce. Given the development of Commerce Clause jurisprudence in the US Supreme Court, it is too late in the day to assert that healthcare services—even though they may be provided locally&mdash;do not involve interstate commerce. To suggest that healthcare  a $2.4 trillion sector of the US economy involves only local commerce and/or “non-economic activity” strains credulity.

Third, the argument has been made that Congress cannot tax what it cannot otherwise regulate, with the corollary being that a financial penalty associated with a decision not to adopt an EHR may not be imposed. While the basic proposition—that Congress may not tax what it cannot otherwise regulate&mdash;may have merit, the fact of the matter is that Congressional authority under the Commerce Clause is extremely broad; thus, there is indeed little that it cannot regulate and, therefore, tax. Many other sectors of the economy are constitutionally regulated and taxed; even if the HITECH Act’s disincentives were found to constitute a tax, they would be permissible under the US Supreme Court’s expansive reading of the Commerce Clause.

Finally, the HITECH Act may not be challenged as a bill of attainder, violating individual rights by imposing penalties without trial. Opponents of the law characterize the monetary penalty that may be imposed on Medicare providers that fail to make meaningful use of certified EHRs by 2015 as being similar to a government seizure of paychecks of Communists employed by the federal government in the 1940s—a legislative act that was overturned in the courts as a bill of attainder. The legitimate legislative purpose in the case of the HITECH Act is the anticipated improvement to the healthcare provided to Medicare beneficiaries served by providers adopting EHR systems, and the cost savings associated with anticipated system efficiencies; the class of persons being regulated is, appropriately, healthcare providers that participate in the Medicare program.

The promotion of meaningful use of certified EHRs by financial incentives and disincentives set forth in the HITECH Act pass constitutional muster as a rational set of rules designed to improve and streamline a significant sector of our economy.

, and is a healthcare lawyer and consultant based in Boston, MA. He helps healthcare providers and related businesses of all shapes and sizes realize their goals in an increasingly regulated environment. His blog, 

, is recognized as a leading healthcare law and policy blog. Follow him on Twitter: 

Articles

Arguments that the EHR-implementation incentives under the HITECH Act are unconstitutional fail for a variety of reasons.

The HITECH Act Is Constitutional

If your patient records aren’t already stored digitally, they are likely to be digitized soon. There is a tremendous push by the federal government—as well as by some private payors and self-insured employers&mdash;to get all healthcare providers wired in the near future, in order to better coordinate patient care, improve outcomes, and “bend the cost curve” all at the same time. There are some 

 in play to achieving “meaningful use” of “certified” EHR systems; those terms are to be defined in federal regulations later this year, but the outlines of those definitions are already pretty clear. 

Once all that patient data—or as it is known in HIPAA-speak, protected health information (PHI)&mdash;is stored electronically, it becomes exposed to potential data breaches. In late September, two sets of federal regulations took effect that address the way in which PHI should be maintained, and the steps that should be taken to prevent a data breach and to notify the government and affected individuals in the event there is a data breach. Compliance with these rules&mdash; issued under authority of the HITECH Act by the 

US Department of Health and Human Services

 (HHS) with respect to healthcare providers, and by the 

 (FTC) with respect to EHR vendors and other similar third parties—requires affected practices and businesses to assess and update their data privacy and security policies and procedures, as well as train all affected staff accordingly. 

The exposure in case of violation is significant, both in terms of fines and penalties and in terms of bad publicity—certain data breaches require notice to potentially affected individuals via the general media in addition to notices required to be filed with the regulators. The new rules&mdash;I call them Son of HIPAA&mdash; are layered on top of existing HIPAA privacy and security rules: the 

, regarding identity theft protections to be put in place by any “creditor” (which includes healthcare providers not paid in full at the time of service), and state privacy rules. While HHS and FTC took some pains to harmonize the new rules so that patients will not be bombarded with multiple data breach notifications about the same incident, for example, the other applicable rules out there have not been harmonized. 

The key concept in the new breach notification rules is that encryption of patient data will eliminate the need to notify patients and the federal regulators in case of an inappropriate release of data. Such a release, if the data is encrypted (ie, unusable, unreadable, or indecipherable), is not considered a breach. Encryption is not required, though, and each affected entity must engage in a cost-benefit analysis before deciding whether to encrypt all affected data. 

Another important aspect of the rule is the concept of harm—the regulators decided that not every data breach should trigger all of the notice requirements, just breaches that “pose a significant risk of financial, reputational, or other harm to the individual.” For example, if an employee of a healthcare provider accesses a patient record inappropriately, but immediately realizes his or her mistake, and exits the record quickly and does not retain any PHI, that is not a reportable data breach. 

Finally, “business associates” under HIPAA are now required to implement policies and procedures to maintain privacy and security of PHI, parallel to those that have been required of “covered entities” under HIPAA since the beginning. All business associate agreements and notice of privacy practices (NPPs) will have to be updated to account for the new requirements before February. Healthcare providers that wish to distinguish themselves should consider revising their NPPs to highlight the ease with which they will make copies of records available to patients. This is 

 for many patients, and ensuring that patients’ rights to their records are easily exercised () could be a way to build goodwill among patients and potential patients. 

By necessity, this is an extremely brief introduction to a very involved set of regulations. My hope is that you now have a sense of how important it is to be sure that your operations are fully compliant with the regulatory requirements before full enforcement and random field audits begin in February 2010. 

Mr. Harlow, Principal of The Harlow Group LLC, is a healthcare lawyer and consultant based in Boston, MA. He helps healthcare providers and related businesses of all shapes and sizes realize their goals in an increasingly regulated environment. His blog, HealthBlawg, is recognized as a leading healthcare law and policy blog. You should subscribe to his blog and follow him on Twitter: @healthblawg

Son of HIPAA: Who's Been Looking at My Data?

, some with ties to the Reagan and Bush I administrations 

have written that health insurance mandates—which may end up in a final federal health insurance reform law&mdash;are well beyond the constitutional authority of the federal government to tax, spend, and regulate interstate commerce. Others have picked up on these arguments and applied them to the EHR-implementation incentives under the HITECH Act as well. The bottom line is that these arguments fail, for four reasons:

First, there is no mandate to implement EHRs in the HITECH Act. The EHR incentive provisions allow for reimbursement of certain costs, up to a stated maximum per provider, for the “meaningful use” of a “certified” EHR. 

of these key terms are being worked out by governmental advisory boards 

and should be formally adopted by the end of December. Failure to begin meaningful use of a certified EHR system will result in a penalty, or discount, being applied to payments for services provided to enrollees in federal healthcare programs after the phase-in period is complete, in 2015.

Reporting Hospital Quality Data for Annual Payment Update

 (RHQDAPU) system of “pay for reporting” of quality indicators by hospitals. 

It may feel like a mandate to some, but the existence of incentives and disincentives under a Medicare provider agreement do not a mandate make. No provider is required to participate in the Medicare program. 

Second, even if the HITECH Act were a mandate for the use of EHRs, it would easily survive an attack based on the Commerce Clause of the US Constitution. Due to the limited powers granted by the states to the federal government, federal laws affecting economic activity may only be adopted if they regulate interstate commerce. Such a challenge to the HITECH Act, then, would have to be based on the contention that the federal government lacks the authority to regulate the delivery of healthcare services, because healthcare is neither “economic activity” nor an activity touching on interstate commerce. Given the development of Commerce Clause jurisprudence in the US Supreme Court, it is too late in the day to assert that healthcare services—even though they may be provided locally&mdash;do not involve interstate commerce. To suggest that healthcare&mdash;a $2.4 trillion sector of the US economy&mdash;involves only local commerce and/or non-economic activity strains credulity.

Some pundits have written that health insurance mandates are well beyond the constitutional authority of the federal government to tax, spend, and regulate interstate commerce. Others have picked up on these arguments and applied them to the EHR-implementation incentives under the HITECH Act as well. The bottom line is that these arguments fail, for four reasons.

Is the HITECH Act Unconstitutional? - Part 2

If your patient records aren't already stored digitally, they are likely to be digitized soon. There is a tremendous push by the federal government-as well as by some private payors and self-insured employers-to get all healthcare providers wired in the near future, in order to better coordinate patient care, improve outcomes, and "bend the cost curve" all at the same time. There are some financial incentives in play to achieving "

" of "certified" EHR systems; those terms are to be defined in federal regulations later this year, but the outlines of those definitions are already pretty clear.

Once all that patient data-or as it is known in HIPAA-speak, protected health information (PHI)-is stored electronically, it becomes exposed to potential data breaches. In late September, two sets of federal regulations took effect that address the way in which PHI should be maintained, and the steps that should be taken to prevent a data breach and to notify the government and affected individuals in the event there is a data breach. Compliance with these rules-issued under authority of the HITECH Act by the 

 (FTC) with respect to EHR vendors and other similar third parties-requires affected practices and businesses to assess and update their data privacy and security policies and procedures, as well as train all affected staff accordingly.

The exposure in case of violation is significant, both in terms of fines and penalties and in terms of bad publicity-certain data breaches require notice to potentially affected individuals via the general media in addition to notices required to be fled with the regulators. The new rules-I call them Son of HIPAA-are layered on top of existing HIPAA privacy and security rules: the FTC's 

, regarding identity theft protections to be put in place by any "creditor" (which includes healthcare providers not paid in full at the time of service), and state privacy rules. While HHS and FTC took some pains to harmonize the new rules so that patients will not be bombarded with multiple data breach notifications about the same incident, for example, the other applicable rules out there have not been harmonized.

The key concept in the new breach notification rules is that encryption of patient data will eliminate the need to notify patients and the federal regulators in case of an inappropriate release of data. Such a release, if the data is encrypted (ie, unusable, unreadable, or indecipherable), is not considered a breach. Encryption is not required, though, and each affected entity must engage in a cost-benefit analysis before deciding whether to encrypt all affected data.

Another important aspect of the rule is the concept of harm-the regulators decided that not every data breach should trigger all of the notice requirements, just breaches that "pose a significant risk of financial, reputational, or other harm to the individual." For example, if an employee of a healthcare provider accesses a patient record inappropriately, but immediately realizes his or her mistake, and exits the record quickly and does not retain any PHI, that is not a reportable data breach.

Finally, "business associates" under HIPAA are now required to implement policies and procedures to maintain privacy and security of PHI, parallel to those that have been required of "covered entities" under HIPAA since the beginning. All business associate agreements and notice of privacy practices (NPPs) will have to be updated to account for the new requirements before February. Healthcare providers that wish to distinguish themselves should consider revising their NPPs to highlight the ease with which they will make copies of records available to patients. This is a bone of contention for many patients, and 

ensuring that patients' rights to their records

 are easily exercised could be a way to build goodwill among patients and potential patients.

By necessity, this is an extremely brief introduction to a very involved set of regulations. My hope is that you now have a sense of how important it is to be sure that your operations are fully compliant with the regulatory requirements before full enforcement and random field audits begin in February 2010.

Mr. Harlow, Principal of The Harlow Group LLC, is a healthcare lawyer and consultant based in Boston,  MA. He helps healthcare providers and related businesses of all shapes and sizes realize their goals in an increasingly regulated environment. His blog, 

, is recognized as a leading healthcare law and policy blog. You should subscribe to his blog and follow him on Twitter: 

If your patient records aren't already stored digitally, they are likely to be digitized soon. There is a tremendous push by the federal government-as well as by some private payors and self-insured employers-to get all healthcare providers wired in the near future, in order to better coordinate patient care, improve outcomes, and "bend the cost curve" all at the same time. 