Barbara A. Gabriel


Does having an EMR really help you? Are patients more likely to get the tests they need, timely diagnoses, and proper treatments? Do you code more accurately now that your EMR is a part of your daily work flow? Does this result in higher reimbursements? 

In short, are you a better doctor - both clinically and operationally - with an EMR than you were without one? 

It was questions like these that Jeffrey Linder, an internist and an assistant professor of medicine at Harvard Medical School, tried to answer as he assessed the results of his study on the relationship between EMR usage and quality care. A well-known advocate for EMR implementation, he felt pretty confident the answer to all these questions would be a resounding yes. 

He and his team investigated the relationship between EMRs and the quality of patient care in physician practices across the U.S. by scrutinizing the CDC’s 2003 and 2004 National Ambulatory Medical Care Survey (NAMCS). This survey asked practices if their visits were performed in offices equipped with EMRs (or EHR, as Linder and many others call the systems; the terms are interchangeable). Eighteen percent of respondents indicated that they did. 

Linder’s team then compared the response to that question to 17 quality measures, including management of chronic diseases, preventive disease, treating acute problems, and avoiding inappropriate medication prescribing in the elderly, to name a few. 

And what did they find? “Essentially there was no association between people saying they use EHRs and those 17 different quality measures.” 

 How could this be in the wake of so much hype touting the efficacy of electronic records in enhancing patient care - particularly among those suffering from chronic illnesses? 

Disappointing, says Linder. However, upon further reflection - and in the wake of the barrage of media attention that followed the study’s publication in the July 2007 issue of 

 - he admits the results really aren’t all that surprising. 

First, the NAMCS data - the best data pool available to Linder and his team, both in terms of size and currency - was, from a technology perspective, woefully outdated. Second, the survey simply asked physicians whether they had an EMR - not how they were using it. 

Hmm. That’s like saying you’ll get six-pack abs by the simple act of buying a Bowflex (if only). 

“There’s nothing magic about EHRs,” says Linder. “If people are simply turning on a computer replacement for their old paper records, why would you even expect quality to improve? So in light of what was being installed, which were relatively unsophisticated EHRs, it’s not surprising we didn’t see quality improvements as well.” 

Linder was very fearful that the study would be interpreted as, “Electronic health records don’t work.” He tried to send out the right message, that these high-tech systems are just tools. “You have to use a tool the right way if you want to see quality improvements. We were very careful about the bottom line in the abstract which was, ‘EHRs, 

, were not associated with better quality ambulatory care,’” he says. 

Other studies have yielded results similar to Linder’s, including one published in the December 2007 issue of the 

, which concluded, “Whereas EMRs can be powerful tools to improve the quality of care, their implementation is neither easy nor cheap, and barriers are especially high for solo and small group providers.” 

Another study, released in July 2006 by the California Healthcare Foundation (an independent philanthropic organization that aims to improve the state’s healthcare delivery and financing systems), found that “it can take as long as several years for clinicians to fully integrate EMR functions into their daily work. Some of the functions most critical for managing disease, such as reports and health-maintenance reminders and alerts, usually are the last to come online and may have to be customized.” 

Of course, all these nuances were lost on the popular press. 


Jane Sarasohn-Kahn, a health economist and management consultant, who serves as president of the healthcare IT consulting firm THINK-Health, stresses the importance of using an EMR to its fullest capacity. “You can spend all the money you want on [an EHR], but if you don’t implement it fully or teach people how to use it fully, that’s the secret of the sauce right there. You can’t buy an EHR without spending a lot of money and time on implementation,” she says. “It doesn’t work by itself. You’ve got to train people to use it and re-engineer your processes and your work flow after you adopt it.” 

Do it right, though, and your EMR really can pay off. Evans Medical Group in Evans, Ga., adopted EMR technology 12 years ago. The project was championed by primary-care physician Robert Lamberts; the difference in the quality of care offered before and after implementation was marked. Pre-EMR, he says, “we had no mechanism to improve quality. We had a single record that may or may not have accurate info in it.” 

But today, he can say with full confidence that “our practice outperforms most practices on quality measures by at least 50 percent, and we out earn most practices; we’re in the top 5 percent of income for primary care.” 

A long-time proponent and nationally known speaker on health IT automation, Lamberts can cite positive outcomes backed up by actual data - not just a gut feeling. Average LDL cholesterol for all of his diabetes patients? Under 100 - not bad. “All of our providers have 50-plus percent of our diabetics with A1c under seven,” he continues, “and around 10 percent with A1c over nine.” 

Evans Medical Group understands that “if you use [your EMR] as a tool to redesign work flow, then it will greatly improve things,” says Lamberts. You can also set, track, and achieve your patient-care improvement goals. For example, the practice decided to target patient vaccination rates for Pneumovax. The result? Patient compliance is now up to more than 90 percent. 

The only real obstacles to accomplishing whatever they want, says Lamberts, are time and resources. “It is hard when these things aren’t rewarded. If you don’t get paid more for doing a good job, there is no motivation. We feel like if we had financial reward for reaching any specific goal clinically, we could do it.”

There’s one more player that must be included on the team - the patient. Truly effective EMR implementation - one that achieves better patient outcomes - comes only with physician-patient teamwork. This means including regular, electronic, two-way communication as an essential component. “It ain’t just about the EHR,” Sarasohn-Kahn explains. “It’s about the ongoing communication of data with the patient, empowering the patient to engage with real data in real time and then getting that patient really interested through measuring themselves at home.” 

Sarasohn-Kahn says that for outcomes to be truly optimal, your patients should be able to:

 - Lab reports, target weight, cholesterol/triglyceride numbers, other relevant stats;

 - Blood glucose levels, daily weight, blood pressure, etc. 

This sort of involvement, where your patient becomes an active partner in his own care, can work with your EMR to improve patient-care outcomes. 

Linder says he began fielding phone calls from EMR vendors a week after his study was published. One of those callers was Hugh Zettel, director of government and industry relations at GE Healthcare and vice chair of Healthcare Information Management Systems Society (HIMSS). Zettel concurs that the data used for Linder’s study was essentially obsolete. He also notes another shift in the EMR paradigm; namely, what is the definition of an EMR, and how has it changed since 2003? 

“When the NAMSC asked its question about EHR use, there wasn’t a lot of specificity regarding what an EHR was,” says Zettel. “Depending on how a physician answered it, they could have been talking about their practice management system instead of an EHR.” Certainly, the impact of a practice management system on patient outcomes would be different from an EMR’s impact. 

Zettel also says that the accepted understanding of what constitutes “quality care” today has undergone a sea change over the past five years. In 2003, he says, quality care was defined by:

Not losing charts or other patient records; and

Integrating lab and prescription information into single records. 

Those are … aspects of quality that are important,” says Zettel, “but now our expectations of quality are a lot higher. Today we know that quality means doing a better job of measuring outcomes, looking at a patient’s care longitudinally, and working in an active partnership with patients to help manage their care. No one was even thinking about that back in 2003.” 

“There’s the old saying that the fool with a tool is still a fool,” he adds. “When you’re implementing an EHR or any sort of healthcare IT application, you’re really transforming the way you practice medicine.” Zettel likens this to embarking on a journey with the understanding that “your success depends on whether you have the buy-in of everyone on your practice team.” 

Sarasohn-Kahn agrees. Without team effort, she says, even the most top-of-the-line EMRs won’t accomplish a thing. “The EHR is necessary,” she says, “but it’s not sufficient.” 

Just like everything else in life, you must take time to fully master this potentially invaluable piece of software. After that, tell the researchers to bring it on, says Lamberts. “With a good EMR, you set the bar and we can reach it.” 

has served as editor and writer for numerous healthcare publications over the past 10 years. Want to comment on this article? Please e-mail 

This article originally appeared in the July/August 2008 issue of Physicians Practice.

Articles

Conventional wisdom has it that doctors who use EMRs are better prepared to treat patients comprehensively - especially those with chronic conditions. New research, though, is raising doubts. What’s the real story?

Technology: Do EMRs Make You a Better Doctor?


The National Institutes of Health. The Gap. Pennsylvania Department of State. Blue Cross/Blue Shield. Harvard University. Kraft Foods. Tenet Healthcare Corporation. What do these seemingly disparate organizations have in common? They’ve all experienced either outright theft or inadvertent loss of sensitive consumer or patient data - just between February and March of this year. 

The missing data ranged from dates of birth, Social Security numbers, credit card numbers, medical conditions, to even political affiliations. How did this happen? Stolen laptops, hard drives, and flash memory sticks top the list. Other organizations mistakenly sent e-mails containing private information to unintended recipients, had consumer data retrieved from discarded PCs, or experienced Web programming errors. 

According to the U.S. Department of Justice statistics, identity theft is currently surpassing drug trafficking as America’s No. 1 crime. 

And while the sheer size of these organizations might make them tempting targets for crooks, don’t assume that your practice is safe just because it’s smaller than the NIH. Anyone can be a victim. But there are ways to protect yourself - and your patients. 

In 2006, the nonprofit Privacy Rights Clearinghouse’s analysis of data breaches found that of those reported by medical organizations, 40 percent were attributable to laptop thefts, 20 percent to “insider malfeasance,” 20 percent to “human/software incompetence,” 17 percent to non-laptop computer theft, and 3 percent to outside hackers. A study by the University of Massachusetts Dartmouth conducted in 2004 estimated that in the U.S. alone, a laptop is stolen every 53 seconds. Gartner, Inc., a worldwide IT research and advisory company, says its research reveals that 80 percent of computer crime consists of “inside jobs” by “disgruntled employees.” 

In February, a laptop containing the names, Social Security numbers, and personal health information of 4,800 patients was stolen from the relatively small University Health Care in Salt Lake City. Reports of stolen or lost patient data abound among practices large and small. 

Do you or your staff take home laptops to catch up on patient paperwork outside of clinic hours? Do you ensure that your staff members are able to gain access only to the patient information they need to do their jobs? Do you know where your patient information resides within your network, PCs, portable devices, and backup storage? And how secure is your practice’s office building when you’re not in it? 

Very few practices can confidently answer all of these questions. And the consequences of such ignorance can be devastating. 

Take the case of Compass Health, a small mental-healthcare provider in Washington, which in June 2006 reported a laptop theft to authorities. The computer contained patients’ Social Security numbers and clinical and demographic data. The practice sent letters to all potentially affected patients with information about the steps they should take as a result of the theft. And it distributed a state wide media advisory in an effort to notify other individuals for whom it did not have current contact information. And then, of course, came the calls from local and national media outlets. 

“The nature of the beast here is that the devices go missing,” says Stephen Sprague, CEO of Wave Systems, a provider of client and server software for hardware-based digital security. “So assume all your patients’ records are on that device. Do you really want to have a press conference?” 

Even if, like Compass Health, you take all appropriate steps to protect your patients in the wake of a computer theft, bad press can severely damage your credibility with current and future patients. 

So should you just toss out your electronic equipment and go back to paper files? 

You probably know the answer to that. Whether you own an EMR or not, your practice cannot operate without computers running the software that is vital to its everyday operations. So tossing your PCs out the window isn’t an option. Besides, paper is just as, or more, vulnerable to theft as is electronic equipment. 


“Paper is an insecure form for storing patient data, which is at best locked behind doors or within file drawers,” says Stephen Moulton, director of product development for Innovative Card Scanning, a developer of scanning devices and software for hospitals and practices. “Paper can be copied, stolen, taken without you even knowing it, as well as lost or misplaced, which could give you the feeling that it was stolen if it is out of your control or possession.” 

Thomas Weida, medical director of the University Physician Group at Fishburn Road in Hershey, Pa., says that in his previous paper-based office, he recalls an instance in which a file clerk easily pulled a specific paper chart she was unauthorized to view - her ex-husband’s. The practice fired the employee when it learned what she’d done, but not before she shared the stolen information with others. Of course, the practice also had to inform the ex-husband about the incident. Certainly, this was nothing to call a press conference about, but it was a privacy violation for which the practice was responsible, nonetheless. 

“From my personal experience,” says Weida, “the protection for inadvertent or malicious access to charts is better electronically than it used to be when we had paper charts. With paper charts, anyone could go to the chart rack, open it up, and look at the full chart. If they were really slick people from outside, they could throw a stethoscope around their neck and put on a white coat and flip through records. … I would say that the information is more secure now than it was before even though more people have the potential to access it, and that’s because we can track every access.” 

Electronic charts may be better protected than paper, but they’re hardly failsafe. Indeed, Weida reports that his current practice, which uses an EMR, also experienced an incident in which a woman snooped through her ex-husband’s medical records. In this case, recalls Weida, “the initial excuse was that she needed his new address. But our IT department was able to look at that record, realize that she opened it more than once, maybe about five or six times, and also realized that she was not just opening demographic data. She was terminated. We have a very strong policy on that here. You only get one strike, and you’re out.” 

One significant difference between the incidents: The EMR-based practice didn’t have to find out through the grapevine about the security breach or launch a he-said/she-said investigation. The computer kept a record of each accessed file. Another difference: The EMR practice was able to implement additional security protocols to prevent further breaches. 

The office network now has a built-in mechanism to ensure that only those authorized individuals can view sensitive patient information. 

The bottom line: Both paper and electronic charts are vulnerable to theft or loss. But while paper records carry their inherent vulnerabilities, a stolen or improperly accessed laptop can reveal much more patient data than a single paper file. Although the healthcare industry has in general been slower to adopt new technologies, the electronic age has dawned, and there’s no turning back. You can no longer operate an efficient practice without some type of software containing patient data. And like most new technologies, these capabilities bring with them new opportunities for criminal activity. 

Still, most people give little thought to the consequences of stolen hardware until it happens to them. When Mark Anthony LaPorta, an internist in Miami, purchased a software-based theft protection service for his new laptop a couple of years ago, it was little more than an afterthought. His fancy new computer cost him $2,000, and paying an additional $105 for three years’ theft protection seemed to make sense. “I was going to be carrying a big brand-new laptop around,” says LaPorta, “so I thought, ‘Let’s protect it and see what happens.’ I’m amenable to that sort of thing. … I thought ‘Oh well, after three years, I’ll forget about it; nothing will happen.’” 

Turns out he didn’t have to wait long before something 

A few weeks later, while traveling on a speaking circuit, LaPorta received a call from his local police, informing him that his house had been broken into. He was told that nothing appeared to be missing, but when he returned home he discovered that the shiny new computer he had left sitting on his coffee table was gone. 

So LaPorta reported the theft to the vendor of the Computrace LoJack software he’d purchased. At that point, the vendor placed Computrace’s monitoring center on alert for the missing computer. When the thief logged onto the Internet on LaPorta’s stolen laptop, the computer “called” the monitoring center every 15 minutes, allowing Computrace to track its whereabouts. 

A week later, LaPorta received an e-mail from his vendor telling him that his computer had “called home.” Computrace’s own “recovery team” was activated and worked with LaPorta’s local law enforcement and his Internet Service Provider to obtain the necessary subpoenas and warrants to apprehend the thief and recover the computer. A few days later, LaPorta’s vendor restored the stolen laptop to the police station in his home town. All he had to do was pick it up. 

When LaPorta booted up his retrieved laptop, none of his data was missing: “The software I purchased puts itself on the hard drive, buried down deep inside of the computer, so even if the thief tried to wipe the drive to start over after stealing it, he couldn’t.” 

John Livingston, CEO of Absolute Software, which manufactures Computrace LoJack, says that had LaPorta’s computer been populated with patient data that was already backed up elsewhere, the vendor could have remotely deleted that information before Computrace’s recovery team joined local police to physically recover the laptop. According to Livingston, the company’s recovery team maintains partnerships with more than 1,000 police departments across North America. 

Of course, computers are targets for theft everywhere, including within the offices that use them. Livingston says that his father was a physician for almost 40 years, and the semi-public places in which he saw his father work made an impression on him. “There’s a lot of patient data being stored on computers, and in somewhat unsecured areas,” says Livingston, “so that’s the obvious vulnerability. … Securing data in any type of healthcare environment is challenging.” 

Livingston says that small- and medium-sized healthcare practices are especially vulnerable to theft. “Often the office buildings that they are located in are quite easy to break into. … You might get people breaking in thinking that there are drugs in storage or something like that. … And once criminals get inside the office, they take whatever they can. The computers are a really easy target, because they’re worth a couple hundred bucks sold on the street, or they’re sold on eBay for closer to the value of the machine, and that happens a lot, unfortunately.” 

Livingston also points out that smaller doctors’ offices often don’t have the comprehensive IT infrastructure that many larger healthcare organizations possess. “So their backup may be somewhat stale, and in those situations, we’ve recovered computers for small physician offices in which we’ve sort of saved the practice, if you will, because everything was on the computer that was stolen. We located the computer and got it back, and all of the patient information and billing systems were retrieved.” 

There are other products that aim to retrieve stolen laptops or deter their theft. The Caveo Anti-Theft PC Card issues audible warning signals if a laptop is moved beyond a distance specified by its owner. Developed by Caveo Technology, the device operates whether the laptop is turned on or off. In addition to emitting sound, laptops equipped with Caveo’s PC card can also automatically prevent thieves from accessing the computer’s operating system, passwords, and encryption keys. If a stolen computer is recovered, a master code is required to regain access. 

SprintSecure Laptop Guardian utilizes a mobile broadband connection card that serves as an ignition key (the user must insert it into the laptop to use the computer). If both the laptop 

 card are stolen, an IT administrator can remotely revoke authentication privileges, rendering the laptop useless to the unauthorized user. 

Besides theft, Livingston says the other prime vulnerability especially specific to small- and medium-sized practices is the transmission of patient data to third parties. 

In August 2006, a computer was discovered missing from Unisys, a subcontractor that provides billing and claims support to the VA Medical Centers in Pittsburgh and Philadelphia. Information contained on this computer included the names, dates of birth, addresses, Social Security numbers, and claims information on approximately 16,000 patients. 

Does your practice outsource its billing like the VA? If so, can you ensure that your patients’ information is secure? 

Even if your laptop is never stolen, data in transit can be intercepted. That’s why Livingston says secure firewall and encryption systems are crucial. “You need that especially if practices are digital, and they’re uploading patient or financial information … to a central site somewhere for billing purposes,” says Livingston. “The doctors have the onus on them to … secure that transaction on both ends to ensure … no third party can gain access to the information as it transmits back and forth.” 

But once you’ve transmitted patient data to a third party, how can you be sure the vendor’s own safety practices are adequate? Tell them to prove it, says Sprague, “When your vendor says, ‘We’ve got it all covered; it’s safe,’” Sprague advises asking it to explain and demonstrate to you exactly 

 it encrypts your patient data to protect it from prying eyes. Don’t let up until you’re convinced. 

If you sufficiently address the physical storage of your hardware and secure your data transmission beyond your practice, Livingston says “you’re pretty well covered.” 


But take note that when Livingston refers to “physical storage,” he’s not talking about simply placing your portable devices in file drawers. He recommends physically locking down all hardware - your laptops as well as your desktops - “so you can’t remove them without some type of physical force.” Such locking devices are easily available and affordable. And don’t forget your server - you’ll want to bolt that down too. 

Sound a bit paranoid? Given the frequency with which patient data is compromised, these preventive steps can go a long way toward not only avoiding that embarrassing press conference, but also toward possibly saving your entire practice. Don’t take refuge in the thought that your portable devices require user IDs and are password-protected. While these safeguards shouldn’t be neglected, they’ve also proven to be surmountable barriers in the hands of knowledgeable techies. Your best defense is to keep them from falling into the wrong hands in the first place. 

But a determined thief can defeat even your most zealous efforts to protect your property. If a laptop or other portable device does go missing, how can you prevent the thief from accessing the precious data it contains? 


When you purchase a new laptop, you are buying a blank slate, although standard software, such as Microsoft Office, is often already installed. But the extra protection you’ll need to prevent unauthorized access to the patient information that will soon populate your computer’s hard drive is most often purchased in the form of additional software that you must select and install yourself. Such installation is usually quite easy, but you may want to consider upping the ante by purchasing a computer hardwired against unauthorized use. 

Sprague says “the first and most simplistic” protective action any practice can take is to encrypt the data stored in their computers. “If a laptop walks out the door, and there is data stored on that laptop, you want to ensure it’s not lost,” he says. “So whole-disk encryption of your data is very important.” To that end, Sprague advises practices to opt for corporate-model computers over consumer ones: “Specifically say to your vendor: ‘I want to buy a machine with hardware-based, full-disk encryption,’” he says. “The extra cost is small, so it’s a relatively inexpensive option for a small office that wants to know that its data are encrypted on its hard drives.” 

If your offices’ hard drives aren’t encrypted and upgrading your machines isn’t in your short-term business plan, you can purchase software to encrypt your current hard drives. Sprague says that although software-based encryption isn’t as foolproof as hardware-based encryption, “it works reasonably effectively.” 

But to completely secure your data, you need to go even beyond encryption. 

Consider the following plausible scenario: En route to your house after work, you stop at a grocery store to pick up some essentials. In your back seat is a laptop from the office that you’ve neglected to keep from sight. When you return with your groceries, your car window is smashed and the laptop is gone - a computer containing many of your patients’ personal identification and clinical information. The worst-case scenario is upon you, and you’re at fault. 

Now let’s say this thief is no amateur. Before he unloads his stolen merchandise, he wants to investigate to see whether it contains any useful information. Finding himself locked out of your computer without your user ID and password, he and his friends do a little digging and find what they are looking for on the hard drive. They enter the correct user ID and password, and … Bingo! A treasure trove of personally identifiable information is at their fingertips for the taking. 

Most operating systems (Windows being the most ubiquitous) have remarkable memories and cache much of your computer activity. 

If your computer is like most on the market, your personal authentication information is in there 

 - hidden deep, though not so much so that it can’t be retrieved by a knowledgeable and determined techie. The key is to keep unauthorized users from ever being able to crack your passwords. Requiring authorized users to log into your network with unique user IDs and passwords should be part of your standard operating procedure, but it’s not foolproof. 

Such a scenario wouldn’t be possible if your new laptop was equipped with a trusted platform model, or TPM, says Sprague. He explains that a TPM “is in essence a silicon vault for keys on your laptop or desktop.” If you authenticate yourself to your computer with your user ID and password, the process takes place within that TPM chip. “So the secret is never exposed to the operating system or external memory or any of those other devices,” Sprague explains. 

Computers with TPM systems are also useful to IT departments that can track exactly how many computers are authorized to access your practice’s network. So if you have, say, 35 machines in your network and a 36th pops up, you know your network’s been compromised. Sprague likens the technology to that used in cell phones: “Your cell phone is secured on [the carrier’s] network because it has a little secret in the hardware in the phone that I can’t steal,” he explains. “Therefore, I can’t bill phone calls to your account because I can’t get your secret code out of your phone because the hardware is extremely hard to break. There are billions of phones out there, so this is a pretty well-understood technology.” 

Currently, Sprague says, TPM-model computers are available on most commercial PCs and laptops. He estimates that it’ll probably be another year until the technology trickles down to consumer machines. So he strongly recommends that practices purchase commercial-model computers for their offices. 

Since protecting your patient data is your responsibility, it’s ultimately up to you to inventory your capabilities, your budget, and your manpower to decide how you will put into place your own protocols to ensure peace of mind. 

Yes, you’ll want to equip yourself with the appropriate software and hardware to secure your data. But establishing best practices for your office, educating your staff about them, and enforcing a “no tolerance” policy may be the most effective steps you can take. 

Give your staff unique user IDs and passwords and regularly change them; enable “unlocking” functions on other portable computers, such as Blackberries, that require the user to enter a unique PIN to gain access; regularly audit your electronic assets to ensure they are accounted for and in the right hands; regularly upgrade your antivirus software. 

Establish a “shutting down” protocol when you close your clinic each night; 

 give your employees unauthorized permission to remove any hardware from your office; take measures to lock down your office when you are not there; and, if you are in a larger commercial building, talk to your landlord about their after-hours security to ensure you are comfortable with the protection provided. 

If you can’t afford fancy new anti-theft hardware and software solutions, look into lower-cost options that can add new layers of protection to the equipment you already possess. Keep a watchful eye on all of your paper-based and electronic assets that contain patient information, but remember that laptops in particular have proven to be the Achilles heel of many data theft victims. 

“The data on your laptop is a controlled substance,” says Sprague. “Treat it as such. Is it under lock and key, and how can you be sure?” 

has served as editor and writer for numerous healthcare publications over the past 10 years. Barbara can be reached via 

This article originally appeared in the 2008/2009 Physicians Practice 

Incidents of data theft grab media headlines almost daily. How can you ensure that your data remains secure? We give you the best bets for implementing that “ounce of protection” that can protect your patients and your practice.

Security: Protect Your Practice and Sleep Better


When Mark Anthony LaPorta, an internist in Miami, Fla., received a letter from an employee at his practice alleging that he was at fault for causing her a serious injury, he didn’t bother calling his attorney. He simply asked her lawyer to prove the allegation. Why? LaPorta knew that not only was the claim false, but it also could never be proven. 

Being an employer means following federal and state laws that protect your employees. Of course, the law also provides you protection against frivolous employee claims and lawsuits. But do you know the difference? Do you know when it’s time to simply inform your employee that you are within your legal rights and when it’s time to call a lawyer? 

“She alleged that I had been cruel to her and yelled at her and caused her to go blind in one eye as a result,” recalls LaPorta. “We knew the poor girl was just sick and emotionally ill. I remember the afternoon that I yelled at her. She wasn’t blind when she left, and she came back to work the next day. The bottom line was, there was no way anyone could prove that … and I think even she didn’t believe her own story.” 

But what about allegations that are not so cut-and-dry? After all, the legal system wouldn’t exist without the shades of gray that cloud all aspects of the law. 

Although federal law affords protections to most employers, individual state laws can add to those protections or modify the mechanisms through which employees and employers must adhere regarding complaints and remediation procedures. And there are state and federal “threshold requirements” that must be met for certain employment laws to apply. For example, federal laws that protect some aspects of discrimination, such as the Americans with Disabilities Act, do not apply to employers with 15 or less employees. 

Although employment law can sometimes feel like a dense thicket of rules and regulations you’ll never be able to wade through, rest assured that there are lawyers on whose expertise you can rely, and a general knowledge of employment law will generally lessen your chances of having to call your attorney. 

Wise physician employers regularly conduct background checks on potential employees or on existing employees who they are considering promoting or with whom they are having trouble. But do those employees have a legal right to be informed that these checks are occurring? Or is it your right to do so as a potential or existing employer? Like nearly all aspects of employment law, it depends. 

“If the employer is conducting a background check that uses a third-party vendor to provide that background check information, then the employer must comply with the Fair Credit Reporting Act (FCRA),” says Jana Woefel, an employment lawyer and commercial litigator with the Dallas-based law firm, Strasburger & Price. “The employer must obtain the employee’s or the applicant’s prior authorization to go through and conduct that background check.” 

But if you are conducting a background check on an existing employee, you may not have to inform that employee that a third-party check is being conducted on their behalf if that employee has already signed over that permission in her employment contract, says Woefel. “Some [employment contracts] are written so [background checks] just cover the application process, but it doesn’t give you the right or ability to conduct it during the course of employment. Others are written more broadly to allow it for various reasons during the scope of employment.” 

If you do a background check on a potential employee on your own - that is, without using a third-party vendor - then the FCRA does not apply, and you do not have to inform the applicant that you are conducting the check. This applies not only to calls to previous employers, but also to searches through public records. 

But the FCLA applies in all cases regardless of whether you use the information gleaned from either a third-party check or a check you conduct yourself to decide against hiring a potential employee or to take adverse action against an existing employee, Woefel says. “There are forms that are required by the FCRA to go through the process, and there are penalties if an employer doesn’t comply with the FCRA.” 

Woefel encourages physician employers to ensure their compliance with the law whenever they take any action regarding their employees that involves invoking the services of outside parties. After all, she points out, “It’s not intuitive to most people that if you do a criminal background search … that such actions can be considered a credit report under the FCRA.” 


The Occupational Safety and Health Administration (OSHA), administered by the U.S. Department of Labor, sets the federal standards for workplace safety. Beth-Ann Jackson, associate attorney at Thorpe, Reed & Armstrong in Pittsburgh, says that workplace hazards are generally more numerous within medical settings than they are in other office settings, so physician employers need to pay special attention to OSHA regulations. 

“Generally OSHA requires employers to maintain a safe workplace for the employees and to eliminate all known risks and hazards,” says Jackson. “OSHA also requires all employers to keep a log of all injuries in the workplace, and it can also require employers to disclose known hazards to employees so they are aware of some of the hazards they are working around.”

Common injuries in physician practices include coming into contact with patients’ bodily fluids via exposure to sharps, disposing contaminated waste, and even handling office laundry. OSHA-required responses to accidents that can result from these types of risks have been in place since the early 1990s, says Jackson, who says that most physicians have by now become quite familiar with the protocols the Department of Labor requires to protect employees in these common scenarios. 

But OSHA may also dictate other aspects of employee activity in the office that may not be as obvious. For example, says Jackson, physician employers need to be “very careful” regarding where they allow their employees to eat lunch. And then there’s the question of whether or not you should allow employees to wear sandals to work, Jackson adds, noting that there are “over two hundred” OSHA requirements that apply to employee use of protective equipment when working within patient care environments. 

Bruce Armon, a partner in the Philadelphia-based firm, Saul Ewing LLP, notes that due to their training, nurses are very likely to be knowledgeable about what precautions they should take in the office. Other staff, who may have less clinical knowledge, will be more likely to adhere to the protective protocols that you require they follow if they understand the reasoning behind them. “Ensure everyone knows the reason everything needs to be clean, the reason why waste should be labeled appropriately, the reason why dirty linens need to go in a specific place,” says Armon. “What we’re doing in terms of preventing infection requires job-specific appropriate reminders.” 

Physician employers must make an employee injury log available to OSHA should they conduct a safety audit of their workplace. And as of February 2008, OSHA began requiring employers to post a summary of the total number of job-related injuries and illnesses that occurred in their workplace during 2007 on a specific OSHA form downloadable from the Internet. 

According to OSHA’s Web site, “The [posted] summary must include the total number of job-related injuries and illnesses that occurred in 2007 and were logged on the OSHA Form 300. To assist in calculating incidence rates, information about the annual average number of employees and total hours worked during the calendar year is also required. … The form must be signed and certified by a company executive. Form 300A should be displayed in a common area where notices to employees are usually posted.” 

Of course, there are some exemptions; employers with 10 or fewer employees are exempt from this law. And state laws governing workplace safety can also apply. 

Jackson admits that wading through OSHA’s numerous and dynamic regulations can be overwhelming. “The standards can be pretty technical, but they are available on the Internet, on 

,” she says. “The other way [to be in full compliance] is to consult with an attorney and develop safety practices for the practice. … OSHA’s Web site can be a bit of information overload.” 

Employees can allege workplace discrimination on a number of grounds, including gender, race, religion, disability, and age. Individual states may also have legislated against discrimination on other grounds, such as sexual orientation. While many discrimination claims are legitimate and rightfully prosecuted, employers often do not know all the facts and must protect themselves against unfounded allegations. Expert lawyers agree that there are a number of ways they can do so. 

 employees to have remediation procedures in place and in writing should an employee allege discrimination or harassment. “They should … clearly identify a person to whom harassment can be reported,” says Woefel. “They should also provide a bypass mechanism in the case that, say it’s your supervisor that you’re supposed to report to, and he’s the one who is harassing you, you need a bypass mechanism. If the employee doesn’t avail himself of that procedure, then there’s an affirmative defense” should legal action ensue. 

If the employer cannot work out the problem via its own remediation procedures, employees may contact the 

 (EEOC), or depending upon where they are located, an equivalent state agency. These government entities may investigate and find cause for a lawsuit. But most cases don’t make it that far. “The EEOC doesn’t want to respond to every complaint,” says Woefel. “They want employers to police themselves and address problems as they arise. … The EEOC is meant to be a fail-safe when that system breaks down.” 

Maureen Binetti, chair of the employment law department in the law firm of Wilentz, Goldman & Spitzer in Woodbridge, N.J., says of federal discrimination law: “It basically says, ‘Now we want you to stop this stuff before it happens. And if you can’t, then at least you have to immediately look into it and remediate it after it happens.’” That’s why training is so important, says Binetti. If employers train their employees about sexual harassment and other areas of protected activity in advance, they also give themselves much more protection against liability if there is a complaint down the road. 

Of course, perceptions of discrimination and harassment can vary widely on an individual basis. What may be perceived as a casual friendly gesture by one person could be perceived as inappropriate by another. Michael Schaff, chair of the corporate and healthcare teams at Wilentz, Goldman & Spitzer, says not explicitly spelling out for your employees what may be perceived as harassment can have consequences. “If practices don’t do the training, they don’t understand the risk of putting an arm around a coworker when you’re talking to them,” he says. “If it’s someone of the opposite sex, they may claim that it was inappropriate.” 


But sometimes allegations will be made regardless of the amount and quality of training you provide. It happened to LaPorta. 

“In 1997, one of the employees in my practice insinuated that I was a little too close with her, which took me by surprise,” he recalls. “I was told that the woman alleged I was fresh with her, that I hugged her all the time, and that it must stop or she would file a complaint. Well, she had already filed a complaint by telling the office manager.” 

Rather than call an attorney, LaPorta chose to work with his office manager to remediate the situation. He says the manager spoke to the woman about her allegations, ultimately concluding that they indeed had no factual basis. “I know there were no threats, and we basically made it go away through reasonable, mature conversation,” says LaPorta. “I told the manager that I had never touched the woman, and she replied, ‘I know that, and now she knows that.’ We used real character, real humanity, to fix the problem instead of having to hire a lawyer.” 

You know they do it. They know they do it. Heck, even you probably do it. The Internet is a ubiquitous presence in the workplace, and its occasional use by employees for personal matters is generally perceived as relatively harmless, given that it does not cut too much into an employee’s productivity. But what you perceive as the harmless checking of personal e-mail accounts and occasional employee Internet bargain hunting may expose your practice to risks you may never have considered. 

Not only can the Internet become an extreme distraction in the workplace, cutting significantly into employee productivity, it can also expose your computer network to viruses that can be easily and unwittingly downloaded into your system by unsuspecting staff. 

Binetti recommends that employers establish broad policies that block employees’ use of all company-owned computers and telephones for any personal use at all. “In general, if you as an employer tell your employees in advance that the Internet, that their e-mail, that even their voice mail … is for business purposes only, and if they choose to use it for personal reasons, they must understand that the employer has the right to do whatever they want, including listening to voice mails, viewing e-mails, and viewing what sites they’ve visited,” says Binetti. 

She reasons that having such a policy in place can protect employers from some state-specific laws that do provide some protections to employee Internet and e-mail use in the name of privacy. “If you have a policy already in place that states otherwise, then that argument is out the window,” Binetti says.

Today more than ever, the possibility of employees being called up for active duty is a very real one. Reservists are now serving multiple tours of duty that can take them away from the workplace for long periods, leaving their employers - especially businesses - in a quandary over what to do in their absence. 

The Uniformed Services Employment and Reemployment Rights Act requires all employers, no matter their size, to hold the positions vacated by reservists for up to five years. Woefel says that not only must employers offer returning troops their same or an equivalent position, but also any promotion or seniority that they would have acquired were their employment uninterrupted, as well as the pay raises that accompany those promotions. 

“That may mean that you have to hire someone on a temporary basis, but when that service member returns, whether it be at the scheduled end of their deployment or for a shorter period of time because of an injury or whatever circumstances that allows them to return home earlier, then you have an obligation to return them to the position that they had or would have had in regard to seniority or promotions,” says Woefel. 

Yes, employment law can seem like a labyrinthine maze which you as a physician have little knowledge. But you’re not alone. Practices built on solid business plans with the help of attorneys who specialize in employment law can help you find your way. And when issues arise, these experts are trained to help you deal with your situation. Just choose your counsel wisely - a business attorney may not know the intricacies of the specific state and federal employment laws to which you must adhere. 

The more knowledgeable you become on the employment laws that govern your practice, the more prepared you will be when legal issues arise. And remember that training your employees on your office’s processes and procedures can go a long way toward saving you from future headaches. Binetti’s mantra, “an ounce of prevention is worth a pound of cure,” is more than a cliché. It may one day save your practice. 

holds an MA in English literature and is the associate editor of

She has served as editor and writer for numerous healthcare publications during the past 10 years. She can be reached at 


This article originally appeared in the May 2008 issue of Physicians Practice.

Think malpractice is your only potential legal liability? Sorry, but that’s not true. You’re an employer, too, and need to know the basics on laws governing your rights, and your employees.

The Law: Understanding Employment Law


Superman was the victim of a medical mistake. 

Sound far-fetched? The Man of Steel survived a spinal cord injury so severe that it left him paralyzed from the neck down for the last nine years of his life - years that he spent actively defying his doctors’ dire predictions by living an active life and advocating for medical research. 

Ultimately - under the care of his devoted wife and the best doctors money could buy - Christopher Reeve died from a pressure ulcer, more commonly known as a bed sore. The infections that can result from bed sores are not uncommon. Obese patients and victims of paralysis are often confined to the same positions for extended periods of time, and pressure ulcers can develop even under the best medical care. 

But under a new Medicare rule that will take effect October 1, 2008, Reeve’s death would be attributable to a medical error. And Medicare has announced that it will no longer reimburse hospitals for remedying a specific list of events - including pressure ulcers - that CMS deems preventable. 

Pressure ulcers are on a list of 28 medical errors, or “never events,” defined by the National Quality Forum (NQF) in 1992 as preventable medical mistakes that the forum says should never occur in a hospital (see “Never Events” text box). In addition to pressure ulcers, these events include medication errors, falls, and much more egregious mistakes such as wrong-site surgeries. 


In August 2007, Medicare announced that, starting October 2008, it will no longer reimburse the treatment hospitals must provide to redress eight medical errors, a list likely to lengthen in the future (see “Nonreimbursable” text box). In fact, CMS has already announced its plan to add ventilator-associated pneumonia and deep vein thrombosis to its list in fiscal year 2009. 

Some of the additional NQF-specified never events that experts predict Medicare will add to its list 

 no-brainers, and many hospitals do not charge for them anyway. Operating on the wrong patient or wrong side of the body, indeed, should never happen. But there are several events on the list that hospitals consider unpreventable in some instances. For example, many hospitals maintain that pressure ulcers, patient falls, and vascular catheter-associated infections (all included on Medicare’s initial list) are inevitable 
in some cases and in others totally outside of physicians’ control. 

When announcing its decision, Medicare stated in a press release: “While the exact number of never events is not known, they result in many deaths and additional healthcare costs. In 1999, the Institute of Medicine estimated that as many as 98,000 deaths a year were attributable to medical errors, and recommended that error-related deaths be decreased by 50 percent over five years.” 


The Bush administration has stated that this new policy is a big step toward encouraging hospitals to enhance their quality-control measures and cut down on preventable injuries and deaths. 

reimbursement. What does that have to do with physician practices? 

“So goes Medicare, so goes the healthcare system,” says David Nash, chairman of the Department of Health Policy at Jefferson Medical College in Philadelphia. “You can run, but you can’t hide; there’s no question about that in my mind.” 

Indeed. Since Medicare’s announcement last August, Aetna, WellPoint, UnitedHealth Group, Cigna, and Blue Cross/Blue Shield have either already implemented similar policies, are testing them in specific markets, or are considering doing so. 

Private-practice physicians following these developments are fearful that these new rules will either affect them in their capacity of treating their hospitalized patients and/or trickle down into the outpatient environment. Physician bloggers took to their keyboards immediately after the news broke. 

“This is extraordinarily detrimental for physicians,” wrote one doctor. “It will increase malpractice premiums enormously. Bed sores, particularly heel ulcers, in patients with diabetic vascular disease, are nearly impossible to prevent in patients with strokes.” 

“This ‘remedy’ appears to be designed to penalize bad results, not real mistakes,” wrote another physician. “Bedsores and infections are sometimes unavoidable, even with the best care. It is a hallmark of some diseases. This is a very ill-advised means to cut costs; it is actually a cost shift from CMS to the hospital and, eventually, physician.” 

“Not paying for a blood clot following surgery? Are you kidding?” questioned a third physician. “I’ve had patients on heparin and they throw a clot anyway. Patients need to take some responsibility too. Some of them are multisystem train wrecks.” 

Well, Armageddon, if it does arrive, is still a ways off, says Robert Field, chair of the Department of Health Policy and Public Health at the University of Sciences in Philadelphia. 

“The never events that are being discussed are pretty much all inpatient related - incorrect surgeries, incorrect drugs, incorrect blood infusions … These are typically not going to happen in outpatient settings, particularly not in physician offices,” says Field, although he does say that, in time, the rule could conceivably apply to surgical ambulatory or diagnostic clinics. 

 think could trickle down is the general mindset of being more aggressive in dealing with errors and quality lapses,” says Field. Noting that significant errors do not typically occur in routine physician practices, Field does link the never-event initiative to current pay-for-performance programs. Admitting that his view is “speculative,” Field says it’s conceivable that the financial awards and penalties currently made available to physicians by Medicare and commercial payers for meeting prescribed quality standards could grow significantly in scope: “So if a physician takes an action that isn’t a serious action, but it doesn’t meet the guideline that the payer believes should be followed, they could become aggressive in either not paying it at all, or paying less for it.” 

Nash agrees. He also sees the never-event program as Medicare taking one more step toward expanding its pay-for-performance agenda. “The Physicians Quality Reporting Initiative (PQRI), which right now is voluntary but will become compulsory later this year, involves ambulatory quality measures of what goes on in the office,” says Nash. He perceives the PQRI program on the ambulatory side to be analogous to the never-event policy on the hospital side: “It’s all part of the same philosophy, which is to change Medicare into a savvy shopper for healthcare.” 

Alice Gosfield, past president of the American Health Lawyers Association and president of Alice G. Gosfield & Associates, LLP, believes that Medicare’s new rule is a much-needed step to force physicians to pay attention to the quality of care their patients are receiving when they are hospitalized. 

“There is no reason whatsoever to believe that this will not be extended to physicians,” says Gosfield. “Why should a physician be paid when he operates on the wrong side of the body? There’s absolutely no justification for it.” 

Although under the never-event rule physicians may still bill for their services when a mistake on Medicare’s list occurs in the hospital, Gosfield says those days are numbered. “I think at some point that will change,” she says. “There’s going to be more and more emphasis on shared clinical responsibility for patients - that you should pay attention to where you are referring to and who you’re taking referrals from. 

“The message of the never events is that it’s time for physicians to stand up and take responsibility to make sure the hospitals in which they practice are safe, or find other hospitals.” 

Experts agree that another way in which private-practice physicians could be affected by the never-event rule is its potential to influence their credentialing privileges within specific hospitals. 

“The never events are eventually going to come around to the physician in that hospitals will be more vigilant about physicians who are connected to these events,” says Nash. “Eventually, hospitals that are smart will link these events back through the credentialing process to individual doctors. I don’t think it’s an immediate risk today, but clearly, in another year, I think it’s going to be very, very important that physicians recognize how these events could be traced back to them. … Even private-practice doctors, via the credentialing process could be identified as difficult physicians.” 

Monica Berry, director of patient safety and risk management at the Loyola University Health System in Chicago and past president of the American Society for Health Risk Management, agrees that private-practice physicians will need to keep a keener eye on their hospitalized patients lest they be connected with a never event. 

To protect themselves, Berry recommends that doctors pay close attention to documenting their patients’ health histories and presenting illnesses. “My recommendation is to document what the status of the patient is, and make sure that their history is the best that you can do,” says Berry. 

Accurate charting and documentation are key, agrees Nash. After all, it’s not inconceivable that a patient you admit to a hospital already has a pressure ulcer or an infection that remains undetected until that patient is hospitalized. So full examinations are crucial. Detailed patient notes can also inform hospital staff that a patient’s immune system is compromised, making her more susceptible to infections, or enlist staff to encourage an obese patient to walk around lest pressure ulcers form. 

“Here is where very, very good charting and documentation protects everybody,” says Nash. “I think the take-home message here is to make sure that your office records reflect the office admission record, and that you are as detailed and as comprehensive as possible.” 

Of course, any time a major change in Medicare reimbursement is announced, the specter of increased malpractice claims and higher premiums arises. 


Gosfield speculates that as the kinks are smoothed out in the new never-event rule, litigation will inevitably occur. “Any time risk expands and your risk-protecting techniques are not commensurate with the exposure, then your risk goes up,” she says. “Do I think premiums will go up immediately? No. … I don’t think we’re there yet.” 

Berry agrees that litigation will arise in cases in which hospitals attempt to prove that an adverse event should be reimbursed, but she also says she doesn’t expect that to happen any time soon. However, malpractice carriers will start looking into the new risks associated with this rule, says Berry: “When you look at how much money could be involved here, it’s a significant chunk of change.” 

“There are always litigation risks,” adds Nash. “That goes without saying. There are going to be all kinds of precedent-setting cases that are going to come from this, but it’s way too early to tell right now.” 

To nip such risks in the bud, the Washington State Medical Association took the proactive step in January of pledging not to bill payers or patients for its own list of 28 never events, most of them taken from NQF’s list. Brian Wicks, president of the association and the owner and founder of a nine-physician multispecialty practice in Washington, says the decision not to bill patients for the listed events had nothing to do with Medicare’s impending rule. 

Wicks says that when the association looked at the number of medical mistakes occurring in hospitals across the state, they were “extremely” small. “Over the past year, the state had 619,000 admissions and 193 never events, and most of those were bed sores,” says Wicks, “so it wasn’t like there was a whole lot of never-event activity going on that this agreement was going to eliminate. Our goal is to bring these events to peoples’ attention so we can set into place the systems that will potentially reduce these never events to zero. … If you apply appropriate protocols for handling central lines, for handling patients on ventilators, you can dramatically decrease the incidence of these infections.” 

While you will find bed sores on the association’s list, Wicks says that sometimes they are simply inevitable. “If you have people who are extremely ill, elderly, and in the ICU, there’s a limited amount of stuff that you can do to prevent bed sores,” says Wicks. “So we had a lot of discussion among our members about wording the language such that there would be some ability to do a root-cause analysis to find out if an event was indeed preventable.” 

Wicks says he expects that physicians and hospitals will now more thoroughly screen patients before admission, examining them for bed sores, checking for urinary tract infections, and screening for pneumonia. “If you identify those items before the patient is admitted, then it’s not legitimate for Medicare to say it was a hospital-acquired infection,” he says. “I think you’re going to find people saying, ‘Listen Medicare, we’re taking care of extremely sick people with suppressed immune systems, and we can’t prevent ventilator-acquired pneumonia in everybody.” 

The Washington Ambulatory Surgery Center Association joined the Washington State Medical Association in its agreement not to bill for the same list of never events. The association represents freestanding ambulatory surgery centers that include physician-owned practices ranging from multispecialty to single-specialty groups. Terry Hawes, the association’s president, maintains that the 28-item list of never events they’ve adopted so rarely occur in ambulatory centers that the decision not to bill for them was not a difficult one. “These events happen so infrequently … that not billing a patient once a year, if that, is not going to cause the downfall of that center,” she says. 


Gosfield says the new rule is a long-overdue wake-up call for physicians. “Clearly, the surgical specialties are the ones at greatest risk, and also specialties that are involved with patients in the ICU, where complex things happen,” she says. “Doctors have to ask themselves about the hospitals they admit their patients to: ‘How many hearses are pulling up to the back door?’ ‘How many people are discharged with life-changing tragedies?’ I think it speaks to the intensified, reinvigorated responsibility of the physicians in the hospital to step up.” 

For her part, Berry finds the new rule troubling. “I understand the need for organizations to take responsibility for some of the patient events,” she says. “But some of what happens is not a result of negligence. These events simply happen.” 

In particular, Berry worries that hospital rehab units, and in time, physician-owned private rehab practices are especially at risk. As part of patients’ rehab, they have to relearn how to walk and thus are unstable, she points out. “Does that mean that the organization has to take a financial hit if a patient in the course of his or her rehab takes a tumble and fractures a hip? … I’m just not sure that the government in the enforcement of this rule is going to be as knowledgeable as it needs to be in understanding those hospital-acquired injuries.” 

Field perceives the new rule to be the opening round in the government’s effort to “get serious” about medical errors. Calling egregious errors, such as wrong-site surgery, “low-hanging fruit,” he foresees Medicare’s list expanding over time. “I think it will likely get the ball rolling, because we do now have almost ten years of discussion and analysis and debate about what to do about the problem of medical errors. … This list of medical mistakes will increase. It’s sort of a matter of getting the kinks out over time.” 

Clearly, some doctors are worried that CMS is embarking on an intentionally slippery slope. 

Another physician blogger recently posted that the new rule is a backdoor method to reduce costs as much as possible. “CMS assumes that it can force hospitals to force physicians to start to either change processes or assume some risk (certainly not true for most hospitals and physicians at this point) … We should expect to see more of the same type of cuts very soon, and yes, the next round of cuts will hit physicians’ pocketbooks.” 

The government rocked the hospital world with its plan to stop paying hospitals for the treatment necessary to fix their so-called mistakes. Could your office be next?