Pamela L. Moore

Today’s "share" culture puts medical practices in legal danger, said Barbara Zabawa and Melissa Giftus, attorneys with Whyte Hirschboeck Dudek in Madison, Wisc., during a presentation at the  

Medical Group Management Association Annual Conference

They outlined five key issues to watch for:

1. Damage to reputation and compliance with Federal Trade Commission (FTC) guidelines for advertising.

 If you are seeking - or just getting - reviews from patients, be aware that they might not all be glowing. You can even get false reviews, Giftus pointed out.

If you actively solicit patient testimonials for use online there is more to watch out for. FTC guidelines require you to be able to substantiate advertising claims (as in, if a patient says they got better under your care, you better be able to pull a medical record to prove it). Advertisers also are prohibited from using only extraordinary results; you should show a spectrum. If you pay patients for their efforts or offer small gifts or rewards, be sure to include a disclaimer making the monetary exchange clear. Finally, don’t disparage competitors; it only makes them likely to report you to the FTC, Giftus pointed out.

 With more devices and more sharing, your HIPAA policies need to keep up. Of course, protected patient health information (PHI) should be encrypted on laptops. Zabawa shared a story about one stolen laptop that cost a practice a $100,000 settlement.

But also train staff on HIPAA as it relates to posts on Facebook, Twitter, and even e-mail. While the actions of an employee might not be the fault of a practice, it is better to avoid any question, have policies, and educate - "take reasonable measures" in the words of Giftus. Consider this example: Two paramedics in training took pictures of a shark attack victim and sent them to friends via e-mail. While the patient’s face and name didn’t get passed around, there are only so many shark attacks in any given day, and the newspaper reports made it clear who got bit. Anything that makes the patient identifiable is PHI.

 Giftus focused on two issues: protecting data on the cloud and explaining the rules on mobile devices. Many software vendors -from billing to EHR providers - now store data on the "cloud" rather than on a server in an office. Cloud-based services can easily be even more secure and complaint than a box sitting un-backed up and unprotected behind reception. Just make sure the contract with your vendor makes it clear what happens to the data if you change to another company or it goes out of business. "It has to be spelled out," Giftus urged.

Further, if physicians are accessing your EHR on iPads at home and not just on their secure work computers, make sure those devices, too, have HIPAA-compliant protections.

 Plenty of businesses have policies regarding employee use of social media in relation to the workplace. That’s fine. But look carefully to make sure nothing in your rules violate the National Labor Relations Act (NLRA). The Act prohibits employers from restraining or coercing employees in the exercise of the Section 7 rights; those are rights like the ability to organize or take other actions related to compensation, work conditions, or other workplace complaints.

How can this come in to play? Consider the case Giftus presented: General Motors. Its policy stated:

• "Think carefully about friending co-workers on Facebook," and

• "Communication with co-workers that would be inappropriate at work are also inappropriate online," she summarized.

A court deemed these "over-broad." It’s just not clear if Section 7 rights are included in what is considered inappropriate or if suggesting employees not "friend" each other constitutes an effort to stop them from organizing around work issues.

 Patients who ask friends for medical advice are more likely to consider your advice bad. Giftus also warned that patients are using mobile devices to record visits, creating additional discoverable evidence. State rules determine whether patients can make recordings without telling you, she clarified, but the record is discoverable either way.

The digital social world is here. The only question is whether your practice is prepared for it.

Articles

Attorneys Barbara Zabawa and Melissa Giftus warn improper social media use can lead to possible HIPAA violations, increased malpractice liability, and more.

Social Media Risks at Your Medical Practice: 5 Key Issues

When Kyle Matthews joined CardioVascular Associates of Mesa (Ariz.) as CEO, the eight-physician practice had $1 million in short-term debt, bad IT contracts, a practice manager everyone was afraid of, an in-house consultant eating up $350,000 to $400,000 a year, and a larger, 12-physician practice down the road about to eat its lunch.

Matthews' solution: Make friends. He joined forces with the neighboring cardiology group and other cardiology practices in the area, starting with five, ultimately saving his practice nearly $400,000 in overhead and restoring fiscal sanity. If he can do it, anyone can, he promised, even if your group considers its neighbors fierce competitors. "When you boil it down to money, it's funny how fast doctors can forget the past," he joked. Everybody can find allies.

He explained the details at a session at the 

The alliance Matthews created is officially an LLC that offers a level of shared decision-making and cooperation. It's sort of like a management services organization (MSO), but where most MSOs entail a lot of overhead with separate management teams, this LLC is a very casual affair, with administrators at each participating practice organizing meetings and cutting checks on a rotating basis. All other decisions are made together; there is not a separate team.

In addition, and crucially, the practices do not collaborate to negotiate with payers. Contracting is off the table, and a mere mention of a new contract during a meeting gets shut off immediately, Matthews explained. There is no need for the complexities involved in ensuring no collusion.

Rather, the LLC is all about shared savings.

Cardiologists have high supply costs with all those EKGs and nuclear supplies. The LLC's first move was to send out an RFP to vendors and buy in more volume for lower prices. Participation is required and uniformity in purchasing is encouraged, though practices can also order different supplies if they really need to. It was hard for some practices to "break up" with their long-time sales folk, but, in the end, his practice is saving $81,000 a year.

Similarly, the practices share an IT support vendor and even a CIO, who rotates among the practices. (They don't share an EHR, which seemed too hard.) That shaved $180,000 a year. They even share governance on a partly self-funded, employee health plan, deciding together what benefits to prioritize. Importantly, each practice does end up with separate plan documents and individual loss ratios to avoid complications relating to the dreaded multiple employer welfare (MEW) arrangements, which are illegal. Total savings: $105,000 a year. Even sending all their statements at the same time saved postage costs.

There are other benefits, too, like helping each other learn about ICD-10 in group sessions. "We can assign just one billing manager to answer a question everyone has," Matthews explained. There is no competitive advantage lost; everyone has to learn it.

The system did take some tweaking, and Matthews encouraged his audience to follow these rules:

• Require physician ownership: Every physician pays in around $1,000 to $2,000 that gets used to establish a line of credit.

• Set a management fee: Practices pay a "single-digit" percentage fee on everything they buy (like those supplies). The money goes to reimburse the practice that is using its administrator to orchestrate the LLC and for capital investments that everyone has to agree on. Because it is set as a percent fee, practices that spend more, also pay more into the system, keeping things fair.

• Equal representation: At birth, the coalition consisted of groups as big as 12 physicians and as small as two. Every group has the same voting power on collective decisions, regardless of size.

• Talk a lot: Matthews' organization holds one to two physician meetings month on top of even more regular administrator meetings. Open communication is the single biggest requirement, he stressed.

• Legal caution: When Matthews worked out his LLC, he had a high-power attorney review it and then had attorneys from each practice review it, too, for good measure. He said that having that many lawyers agree gave him a level of security.

These days, that teetering cardiology practice has zero short-term debt, good financial health, competitive staff compensation, and is looking into partnering with hospitals in the region on accountable care organization projects. Making friends surely didn't accomplish all of that, but $390,000 a year in savings sure didn't hurt.

How one medical practiced saved more than $390,000 and got financially stable.