The Essential Guide to Navigating Medical Record Denials

Good afternoon, everyone. I’m Leah Nicholson, the event specialist at Ciox. Thank you all for taking the time out of your schedules to join us today for this insightful webinar.

OCR’s NPRM on reproductive health privacy, and state legislative updates. What does it mean for you? As we allow a few more moments for everyone to join this afternoon, I’ll go through a few housekeeping items.

I will be managing this webinar from the back end, and I’m here to help with any questions or concerns you might have. Please feel free to drop questions in either the chat or question function at the bottom of the screen.

Furthermore, this webinar does grant a CEU certificate.

At the end of this webinar, an email with a link to that certificate will be sent to you. You should expect that to arrive within twenty four to forty eight hours.

Alright. I think it’s time to get started.

Today, we are honored to have two exceptional speakers with us. Elizabeth Delahoussey, and Kyle Propst esquire.

Firstly, let’s welcome Elizabeth Delahoussey. Vice President, and Chief Privacy Officer for Syox.

Elizabeth has made significant contributions to the field, serving on the ahima Board of Directors and acting as the speaker of the House of Delegates in two thousand sixteen.

With an illustrious career that includes being recognized as a women in health IT to watch in twenty twenty two, and one of the twenty twenty two women power players in health IT were privilege to have her insights today.

Joining her is our second speaker. Kyle Propz Esquire, the deputy general counsel and director of government relations for Ciox.

Kyle has been instrumental in drafting, negotiating, and testifying both for and against medical record related legislation in over thirty states in the past decade.

As a Georgia licensed attorney, and a graduate of the Weidner University Delaware Law School, whose expertise is crucial to today’s discussion.

Without further ado, I’ll pass things over to Elizabeth to get started.

Thanks, Leah. I appreciate that. So we’re gonna start out with a little disclaimer just so everybody is aware.

The information that we will be covering today and the topics we’ll be discussing does not constitute legal advice. We do recommend that if you do have legal questions to go to your own general counsel, within your provider site.

So just so you’re aware of that piece of it. So let’s just go ahead and jump in and talk about we’re gonna be covering today.

So we’re gonna talk about a brief overview of OCR’s notice of proposed rulemaking, you’ll hear us reference it, the NPRM.

We’ll discuss, of course, the reproductive health privacy as far as some of the key concepts and definitions that they have, And then Kyle’s gonna jump in. He’s gonna talk a little bit about the notice of proposed rulemaking and state legislative updates. As you guys are all probably aware of, we’ve seen quite a few states back in twenty twenty two and in twenty twenty three past legislative updates around reproductive health. And then talk about real world, as far as how this affects you as the provider.

And then, you know, some strategies around making sure you’re compliant with the notice of proposed rulemaking along with the state laws.

And then we’ll have some time after this presentation for an open q and a session. So please feel free to, as Leah said, dropped your questions into the chat function.

Leah will be reading them off to us at the end of this session, and we will try our best in answering for you. So let’s go ahead and get started. Let’s first start out with the OCR’s notice of proposed rulemaking, the NPRM, what it is and why it’s important. So, as you guys may or may not be aware of, OCR actually issued a proposed rule back in April of this year.

Common were actually due last week on June the sixteenth, so we had about sixty days from the federal register when it got published to provide a response. I’m hoping that most of you all have already had conversations with your government relations individual.

At your respective site, discussed obviously what was contained in the NPRM, how you felt it may or may not affect you guys. From a day to day operational standpoint, probably some real world examples, which I’ll talk about as well.

And some things that, you know, obviously, OCR probably needs to take in consideration.

Now one thing that I will have to say was that OCR focused in on was, as opposed to what we saw in twenty twenty two, where a lot of states were coming in and focusing specifically on the term reproductive health.

Instead, OCR is actually focusing on the using and disclosing of the individual’s PHI for purposes of conducting a criminal, civil, or an administrative investigation.

With any person proceeding in connection with seeking, obtaining, and providing or facilitating lawful reproductive health. Or the identification of any purpose for the person, for the purpose of initiating such an investigation.

So they don’t dive too much into necessarily looking at reproductive health as far as how that nuance within the EMR, and we’re gonna talk about that here in just a little bit. Instead, they’re talking about listen, if somebody’s coming forward, and, again, we’ll dive into this as well and requesting information for investigation purposes, when you should or should not release it. And, you know, if you do release it some additional documentation, that is gonna be required or potentially required in having the capability of releasing that information to an individual for criminal investigation.

They do touch, however, a little bit on proposing a subcategory around the term healthcare as far as adding an additional definition for reproductive health. And how they talk about it is they talk about as care services or supplies related to the reproductive health of an individual. And I wanna stress the individual piece on here. Because as we have talked about this, again, and during the state regulations, would they are not identifying a specific gender.

So as we talk about reproductive health, it’s a natural assumption that a lot of people immediately go to the female reproductive health, but this is reproductive health across the board. So this could this could female female, transgender, you know, so there is not a specific definition around who this is going to apply to as far as that gender. So I think that that’s very important as you guys look at the NPRM, and even at the state regs and again, Kyle’s gonna dive into this, because we need to make sure we’re all encompassing as to who this applies to.

Now, one question The OCR did ask during their notice of proposed rulemaking is they said should OCR provide examples?

Of how they’re putting this whole subcategory for reproductive health. I mean, my personal recommendation was yes. They should. We need to make sure that we have clear definition and understanding of exactly what they’re indicating when discussing reproductive health. Again, we’ve seen a lot of states come out with some very narrow definitions.

This one obviously is very broad. And so we wanna make sure that we understand what they have in their mind as should be incorporated into this definition.

So the other thing that they talked about, and as I mentioned, just a moment ago, they really focused in on the whole use and disclosures of protected health. Now, I’m a read a little bit of this, but then I’m gonna summarize it. So just bear with me as I read it because I will just wanna make sure everybody understands the piece of it. So how they’re proposing this, is that information sharing would apply where one or more of the following conditions exist.

So the relevant criminal, civil, or administrative investigation of proceeding is in connection with any person seeking, obtaining, providing, or facilitating, Again, this is very broad. It’s not just the individual getting it. It’s also the individual who’s providing or facilitating reproductive healthcare outside of the state. Where the investigation or proceeding is authorized unlawful in the state in which it is provided, or the relevant criminal civil and administrative investigation or proceeding is connection with any person seeking, obtaining, providing, or facilitating reproductive healthcare that is protected, required, or authorized by federal law, regardless of the state in which such healthcare is provided.

And then the relevant, criminal, and civil, or administrative investigation of proceeding is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care that is provided in the state in which the investigation or proceeding is authorized and that is permitted by this law of that state. So what does this mean? So it essentially means that if there is a criminal investigation occurring in a state where that procedure is legal, then they essentially have a right to it because the procedure is illegal.

But if it’s in a state where they’re doing an investigate where the procedure was legal, then you have to have some additional documentation attached to it, And we’ll go into that as well, then the additional documentation that OCR is proposing is that of an attestation.

And we’ll talk about what the requirements are that they’re looking for around that at a station.

The other piece that I wanna focus in is number two, where it does talk about required or authorized by federal law, and they focus a little bit in on the Emtala law. Meaning that, as you guys are more than aware of, under Imptala, if the procedure is required because the patient’s life is at risk.

And so, therefore, the procedure must be done so that the patient may survive, and Tala then falls into place.

Now there are questions about this, and there have been I have seen some challenges in states about whether the intolerable would or would not apply in certain scenarios, so that’s something you have to kinda keep in mind. But again, the simplistic way to look at this is like I said, if it’s illegal in that state, then the invest criminal investigation has a right to that information. If it’s illegal in that state, then you have to have an attestation. Now that sounds very simple, but let me provide you some of challenges that as we look at this, that we can see could potentially occur with that. So the first one is we’ll talk about a marital exam.

So let’s just say, hypothetically, there is a divorce case currently going on. And potentially, within that divorce case, a has to be battle is occurring.

And the husband could say, I don’t think that the mother is a fit mother. And so, therefore, she should not have custody of the children. But to prove that, he obviously needs to obtain probably some documentation to show that the mother is unfit. And that documentation potentially could be that in reference to medical records.

So that spouse then turns around and gets to attains a a copy of that medical records for the purpose of the custody. Right? There’s no criminal investigation going on at this time.

But it’s solely for the purpose of the to determine who the children should reside with. But as they obtain those medical records, could there be reproductive health information in there that the husband or spouse is not aware of, such as could there have potentially been during that time? Maybe the mother went across state lines and had a procedure performed.

Could have been that the procedure could have been performed, but there was no sexual activity between the two individuals. So that also proves the fact that that she had an affair. So that’s one of the challenges that we saw.

The other challenge we saw were minors So in one state, a minor could have maybe have the right to consent to procedure, let’s say, at the age sixteen or older.

I take that back when the state fifteen are older. But in another state, it’s only sixteen and older. So you have it where you’ve got an individual sitting at your facility trying to determine, okay, where was this legal? Was this illegal or legal at that time.

What’s our own state law? What’s the surrounding state? Or maybe it could have not even been a boarding state. It could be a state, you know, four states over.

That is asking for this information.

So that’s a lot of responsibility being placed on that individual to understand and really capture that the legal nuance. And then the other example we saw, and of course Kyle and I had many, many, many, you know, conversations about all of this, when the posed rule came out. But the one I sat there and I thought about was, even within your own respective state, there could be a situation where maybe the procedure was legal up to twelve weeks, but then after twelve weeks, it’s considered illegal.

So now you have an individual who’s now not being an attorney, but being a clinician.

Trying to determine hey, where was this individual at during their pregnancy to have this procedure perform? Were they at twelve weeks when it was legal, or were they at thirteen weeks, fourteen weeks when it was illegal? So as you can see, there’s a lot of challenges around this.

In trying to actually figure out when you need to have that authorization or additional attestation.

So OCR actually going back to the definition that they had recommended, in the proposal, they actually said, hey, should we regulated entities, do regulated entities, have the technical capability to differentiate between types of PHI. In other words, they were looking at highly sensitive PHI. Do you put reproductive health into that bucket? But remember how I said at the beginning, remember reproductive health isn’t we’re not narrowing it down to a specific gender.

So it’s everybody that, you know, has that incorporated into their medical record.

And at this time, the challenge that you encounter with that in containing highly sensitive PHI, as opposed to what we see in the forty two CFR part two, where, obviously, you can carve that information very easily out. You can put it, and you can push it away. You can do the whole break the class. With this, that’s not so easy.

We all know that when we go into wherever it is, and it may not specifically be related to an OB GYN visit or a urologist visit. It’s it’s any type of clinical visitation that you have. You normally have a standard history and physical performed.

And within that history and physical, it’s a review of systems. And so it’s review of all of your systems. And at this time, EMRs do not have the capability to say, hey, this is a review of a reproductive system, so we need to segment that data out and not release it. That opportunity is not available at this time.

Maybe sometime down the road, it might be. But even if it is available at this time, then how do you know Because as we all know, you know, there’s certain medications that could be utilized as dual purposes.

You know, like, there’s medications such as methotrexate that can not only be utilized as the morning after pill, but it can also be utilized for cancer patients. So then you not only have to turn around and determine if it was reproductive health, but how is this information this medication utilized? So now, again, it’s one thing to see the word methotrexate and go, oh, that’s reproductive health. But is it?

And I know that, you know, Kyle a while back had done a Google out there around birth control And I think he said that he located, like, over two hundred names for birth control.

So, you know, again, the EMR systems don’t have the capability of doing this.

We, you know, are not necessarily clinical experts.

We don’t know all of the terminology around all of it. And, again, we don’t know what all the uses are around all of it. So I think that to turn on and say, hey, we’re gonna be able to differentiate between types of PHI at this time is not a feasible ask.

And so I know a lot of entities actually responded to OCR with that statement so they were aware, it’s not gonna be something you can simply just turn a switch on for.

So I mentioned the attestation. So, basically, what OCR was saying is that if the procedure was done in a state where it was legal, and some sort of request for that patient’s reproductive health has come forward.

Then you have to have an at a station.

Now, again, remember all of those challenges I said stated earlier, like, how do you know when it’s legal and when it’s not legal? And so that’s gonna be one of the challenges that we think that a lot of covered entities are gonna have. Now OCR was proposing or is proposing that the condition would require a regulated entity to obtain assurances from the person requesting the PHI. So you’re looking at a third person, third party.

In the form of a signed and dated written statement attesting that the use of disclosure would not be for prohibited purposes where the person is making the request under the privacy rule permission at forty five c f r one sixty four point five t. So The good thing about this is, it does put as far as the individual who signed the attestation they’re saying, okay, you’ve got some skin in the game with this because you signed it and yours you’re telling us. You’re assuring us that you’re not gonna be utilizing this for any prohibited purpose.

But the challenge, again, is trying to determine when an attestation is or is not required.

So OCR asked some questions around the attestation. When they did bring it up, because I they realized there were there was gonna be, you know, some challenges around this. The one thing they said was should the requester of the PHI required to name the individuals who PHI they are requesting or describing a class of individuals. Now most of the time, they don’t have class of individuals on there.

But, you know, again, I think that as far as having the individual PHI probably should be on there.

The mode of out of station to be useful for regulated entities and what other information should be included within the model out of station, One thing was that OCR recommended or not recommended, I apologize. Propose is, hey, should we create the attestation, which is actually number five, where and I agree they should create the attestation I think that that would be much easier to follow. You know, unlike when HIPAA came out, you know, there was several different ways in which and HIPAA authorization could be formatted, what I mean, granted it has your basic components on there, but we all know some of those components could be moved around, you know, sometimes they could be left off, those pieces. So it’d be great if actually the office of civil rights does turn around and combines or creates their own attestation.

They also are proposing that they that this should not be incorporated with any other document. So, again, in today’s world, we’re seeing some states that have come out with reproductive health regulations. And we have seen providers that will turn around and take that regulation and incorporate it into their standard authorization form. And actually, OCR is proposing that the at a station needs to stand on, you know, be able to be a separate document, which I do agree, I think that would be much better to have it as a completely separate document, and then that way the confusion is minimized when it’s not combined with another document.

Now, the good thing about all of this is OCR is actually not requiring you as a provider to investigate the validity of the attestation. Because, again, how I said a second ago, the person who’s signing that attestation is assuring us that they’re gonna utilize this information in the appropriate way and not in a prohibitive way. So that’s good. You know, you don’t have to worry about doing that particular piece of it. But, again, the concern I would have is, was there an attestation required during a certain scenario, and maybe, you know, your staff members didn’t know it needed to be required picking again on the whole minor challenge whether, you know, the procedure was legal to be consented by a fifteen year old or by sixteen year old, and that’s where I have concerns of whether or not people are gonna be able to catch when that at a station is gonna be required.

So we talk a little bit this. Right? Is that the scenarios and attestation department. Again, when is the investigation legal and when it is not? And then how’s gonna really jump in to know in the state laws because I think you guys as an audience are gonna find it really interesting. Again, Kyle and I have had many discussions about this, but you’re gonna find it interesting as to how some of these state laws may be more stringent or potentially could conflict with what is currently out there with this proposal.

So we talk about this as well. Use disclosure which an authorization opportunity to agree or object is not required.

So, again, the proposed rule would create a new requirement obtain the attestation for the person requesting the use and disclosure of PHI, potentially related to reproductive healthcare as a condition for certain types of permitted use and disclosures of PHI.

So right now, as you guys know, when it comes to criminal or judicial investigations, you know, a lot of times, you know, these law enforcement individuals to come in and felt like, hey, I can get whatever I need. I I think that one thing that I would highly recommend to OCR as well is let’s make sure our law enforcement officials, if they pass this proposed rule, as is, are well educated because I can really see a lot of abrasion going on between the law enforcement and the provider world. And because they’re educated as far as what they do or do not have.

So, you know, I’m not sure how the Office of Civil Rights would recommend doing that. You know, or do they look to us as, you know, privacy experts to to educate our law enforcement?

So I’ve got a poll question I’m a throw out to you guys.

And the question is so with what I’ve covered so far, is how do you perceive right now this proposed rules impact on the protection of reproductive health information?

And the four options is is that you think, okay, this is great. Significantly enhances privacy in safeguards of PHI, or it provides some privacy improvements, but there are limitations.

It doesn’t offer sufficient privacy protection for reproductive health, and you’re just unsure about its impact on privacy health. So I’m a give it a second. I know Lee is gonna call it out to me, and let me know how everybody’s trending on this poll question.

Looks like people are just starting to jump in an answer. We’ve had about twenty five percent to vote, so we’ll give them maybe ten more seconds here.

Okay.

Are you mixed results?

Really? So what are you seeing, Leah?

Let’s see. So far, about forty percent are saying some privacy improvements, but there’s limitations.

There’s about twenty five percent each for the enhances privacy and safeguards and also that people are unsure.

Here, let me post these results.

There you have it. Forty four percent was the leave of some privacy improvements but limitations.

And I’m pretty close with enhances privacy and safeguard PHI or unsure about the impact, and then eleven percent says it does not offer sufficient protection.

Great. That’s interesting. So, and then I’d say it’s interesting. That was some of it. I think as far as how people responded back to it provides some privacy improvements with their limitation.

Doesn’t surprise me too much. But let’s go to the next question because I have one more to ask you guys before I turn it over to Kyle So what challenges do you foresee with the attestation? Right? I talked about that in some detail report in detail.

For disclosure and reproductive health PHI. So do you feel like it would effectively prevent unauthorized disclosures and circumvent them? Is it gonna add administrative burdens for regulated entity, could it potentially lead to difficulties in complying with law enforcement requests And, you know, you’re uncertain about the practical implications of the attestation requirement.

Thirty percent have voted. So, again, yeah, we’ll give them just a moment. Definitely viewing heavier to one answer this time compared to the last?

Oh, I’ll be interested which answer that was.

Okay. Just one more second.

Alright.

We have sixty percent. It may add administrative burdens for regulated entities.

Followed by twenty one percent says there’s difficulties in complying with law enforcement requests.

Yeah. That I mean, I thought it’ll be split between two and three.

So that’s entered. That is really interesting. So So what I’m gonna do now is I’m gonna hand it over to Kyle Croge. And Kyle, like I said, he’s gonna talk about the state legislative updates. And again, you know, Kyle, I I pick his brain quite often. He’s fantastic when it comes to the state regulations.

So I’m super excited for you guys to hear the content that he’s gonna be covering. So, Kyle, just let me know when you’re ready to flip to the next slide, and I’ll keep flipping.

Sure. That sounds good. Thanks, Elizabeth, and thank you everyone for joining us today. And I think I’d like to do a little level set while we’re on this introductory slide and just give a little bit of background as to, you know, my role with Siox’s health and government relations for the last ten plus years has been to monitor and get involved in state legislation regarding HIPAA privacy rights, medical information, release of information, the fees around the release of medical information, anything really to do with that release or medical information in general.

And I can say that in the ten plus years, I had not seen any state legislation that passed regarding reproductive health privacy up until two thousand and twenty two. And as you all are probably aware, that came about because of the Supreme Court decision in the DOB’s case, which what that DOB’s case did, is it shifted I guess, protections, as well as burdens on the states, to figure out how they were going to handle the issues around abortion and termination of pregnancy, as well as the privacy issues that are implicated in providing those various services.

And so that’s where when we had the DOBs decision at the end of June two thousand twenty two, we started to see flurry of legislation that was passed in four specific states, and and we’ll get to that in a minute here, but then because it was done on such short notice, I I think that the states weren’t really sure how to grapple with this issue, but they weren’t sure either how quickly they would need to protect these various rights, including the privacy rights. So there’s probably gonna be some cleanup legislation on those initial states, I would imagine. But why don’t we go ahead to the next slide, Elizabeth, and we’ll jump right into twenty twenty two.

Now I know this is about twenty twenty three in new state legislation, but I think it’s important to understand what states did in twenty twenty two as an immediate reaction to the DOG’s decision so that we can have a level set and include those states so that we know that they’re in our list of states that have reproductive health privacy laws. And it’s also important to understand that reproductive health privacy laws can take a number of different shapes and different approaches to protecting reproductive health records.

And so we can’t really couch these all into one, like, kind of bill, if you will, or one type of language. And you’ll see that with the bills that we had that were passed in twenty twenty two right off the bat.

In twenty twenty two, we have four states, California, Connecticut, Delaware and New Jersey that passed laws all within a week of the DOB’s decision.

And I’m gonna start with New Jersey and Connecticut, and When I say I’m gonna start, I’m gonna talk about these in broad general terms. I look at my clock here, and we’re at two zero one, and I think this wraps up at two thirty. So I’ve got twenty nine minutes. We can’t really get into the details of each state’s law, but I do wanna talk just broadly about the concepts in each of the laws. And then if you have any additional questions, you can follow-up with us, or definitely follow-up with your council.

Or your government relations team so that you can narrow down the issues and understand them better, and how to address them at your sites.

So New Jersey and Connecticut started off with these very broad concepts of, we wanna protect reproductive health privacy. And and as Elizabeth mentioned in the NPRM, they elected not to mention a sex, or and what I mean by that is by male or female, and they elected not to distinguish the types of services specifically. They just have reproductive healthcare services, and then they use this term, you’ll see frequently legislation, including but limited to, and then they listed abortion, termination of pregnancy, contraception, and then termination of pregnancy, but then it encompasses a lot of other things. So it could encompass something like your menstrual cycle, and if that’s protected, it could encompass issues like a male getting a vasectomy.

It could encompass a lot of gender affirming care, like hormone therapy.

So New Jersey, Connecticut took this really broad approach And they said, if you’re going to disclose any of this information, you need to get express consent from the patient before doing so.

And so we have a lot of conversations with our providers in Connecticut, New Jersey, and we felt like the best way to address this was really to because they’re asking for patient consent, put something on the authorization form.

And so now, a lot of our providers in those two states have an extra box where you’ll see a box that says, if you agree to disclosing your psychotherapy notes, check this box. If you agree to disclosing records related to substance use and abuse, check this box, and now you’ll see one in these two states for a lot of providers that says, if you agree to disclose your reproductive health records, please check this box. And so that gave the provider some comfort in knowing that if we put that on there, and we have this checked, then we won’t have to go through any kind of redaction of, let’s say, you go to the emergency room, and it’s after a car accident, and the emergency room admission doctor says, when was your last menstrual cycle?

That’s something then that you could just disclose.

Because you would have that box checked, and you wouldn’t have to worry about that being in violation of the reproductive health services, privacy law that was adopted.

Now, I wanna focus a little bit more in New Jersey, Connecticut here, and combine the NPRM that Elizabeth just talked about. Because Elizabeth and I were talking yesterday, about a really interesting concept, and that is that the NPRM has a preemption provision, similar to HIPAA, HIPAA generally that you’re all familiar with, that says that if the state law grants more privacy rights to the patients, then the state law will preempt HIPAA, but the NPRM on reproductive health actually says that be quite the opposite of that. So you’ve got this contradiction now, because now in New Jersey and Connecticut, you have laws that say you have to get the expressed consent of the patient, but the proposed rule for reproductive health And keep in mind, it’s only proposed rule.

Says that you cannot rely upon the patient sign authorization because they are concerned that an investigative agency, like an attorney general, a district attorney, a police officer, or other investigating officer, may put undue pressure on the patient to get an authorization signed, so they wanna make sure that the patient isn’t pressured into signing an authorization, So I wonder if they don’t address that in the NPRM, how we can work around the fact that New Jersey and Connecticut require expressed consent to disclose reproductive health information. But if the NPR impasse as is, it says you can’t rely on the fact that a patient assigned an authorization, you still need the attestation.

So there’s a direct contradiction.

So again, we don’t have the answers today, but that’s something for you to think about and take back to your teams.

I’d like to talk now about the two other states in twenty twenty two, Delaware, and California.

Delaware took a similar approach in that they used broader terms for reproductive health. They talked about abortion, termination of pregnancy, emergency contraception, medical, surgical counseling, referral related to pregnancy or termination of pregnancy, and they also require you to get the patient’s expressed consent before you can disclose those records. But it is more narrow. So they do limit it to these types of requests or information, if you will. They don’t go as broadly as to cover Possible other issues that aren’t related to pregnancy, abortion, or termination pregnancy.

And then we have California, which is really interesting, because California took the most narrowly tailored approach, and basically said, we’re not going to allow out of state subpoenas or court orders or other investigative documents like, you know, warrants or something of that nature to search warrants. To seek records from a California provider if the service that was provided in California was legal at the time. Regardless of whether the service was legal in another state that’s investigating it.

So It’s almost like California had some foresight to say, we think this is where HHS will go, or OCR will go with their proposed rule and reproductive health, because they actually made this a lot more narrowly tailored, and it facilitates because of its narrowly tailored language, it facilitates the transfer of information to those other providers who may need the information, like for the continuing care purposes, or let’s say that you’re transferring to another doctor or afford TPO purposes, or even in those instances where the information would not be necessarily used against the patient. A situation like a worker’s comp case or a disability case. So California really took a little bit more of a a thoughtful approach, if you will, rather than just saying, we’re going to broadly require that any information related to reproductive health requires the patient’s expressed consent.

And as you can imagine, requiring that consent is going to be difficult, because if you put that on the authorization and a patient does not consent to it, Your options, really, are you’re gonna have to look at the record and perform some form of redaction. And and that’s where someone who’s Clinically, Abel will have to evaluate the record and determine what can be disclosed and what can’t be. So with that, let’s jump into twenty twenty three, and and see how things have changed.

So in twenty twenty three, we had thirty four pieces of legislation that were introduced in seventeen states. And you you can infer from that, and it’s absolutely correct, that some states have multiple pieces of legislation. There are certain states like New York, New Jersey, are two of them, where it requires a house and a senate bill to be introduced and to run at the same time.

In order for that bill to have any viability.

So some of these are duplicative, but still thirty four pieces is an interesting number.

Now, if we look at this legislation, and we look at the states where it’s come from, we can identify some quick trends.

And Some of this you probably would anticipate, but this legislation is primarily coming from democrat controlled states. And what I mean by a democrat controlled state, is where we have the house or assembly that’s controlled by Democrats, then we have the senate that’s controlled by Democrats, and then we have a Democrat governor, And the reasons for this are are fairly obvious, if you look at the DOB’s decision and the politics that flow from this, But these states are trying to protect the rights to abortion and termination of pregnancy, and in order to do so, they also want to protect the rights to privacy in those services, and that if someone wants to cross state lines to have one of those services performed in their state, they want that patient to feel secure that they can have a conversation with their provider, and be free in that conversation to discuss all issues and get the best care for themselves, and know that their records will be protected by that state’s law and not subject to some other state where they may or may not be from, that’s pursuing or could pursue some type of a civil or criminal or investigative action.

So if we look at the states where we’ve got Democratic control. I mean, I’ll just quickly run through them here. You see them identified on the map, and you’ve got California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Illinois, Maine, Massachusetts, Michigan, Minnesota, New Jersey, New Mexico, New Mexico, Oregon, Rhode Island, and Washington.

These are not the only states that introduce legislation, though. Although, I will say they are our focus because that’s where most of the legislation is coming from. We have had some bills introduced in other states. I believe there was one that was introduced in Pennsylvania.

It was introduced by someone in the minority party there from one of the Democrats that would address reproductive health privacy as well, but it didn’t get any traction. So that’s where some of this additional thirty four pieces of legislation comes from, is it’s introduced, but it doesn’t really get any traction.

Now, the legislation we’ve seen, again, focuses on these out of state investigations, and that’s really a good thing for the release of information and for medical providers because you can more narrowly tailor your SOPs to identify these issues. Because if you’re talking about out of state investigations, the first thing you should look for is where is the subpoena coming from?

Like, if I’m in New Mexico, and I get a Texas subpoena, that should be a red flag right away, because you’re like, I have an out of state subpoena. I need to examine this and see if it’s done in accordance with New Mexico law, because you as a New Mexico provider would be subject to New Mexico laws, not necessarily Texas laws, unless of course there’s some kind of multidirectional issue where or long arm jurisdiction where you may be subject to Texas in certain circumstances.

But typically, you’re gonna wanna look at any state subpoena or court order that crosses your lines. It’s not from your state. That should cause you to take a pause, and evaluate that subpoena or court order, and take it to your legal counsel to say, how should we address this?

Now, some of these laws like California’s actually put a burden on the court as well.

So those laws, I really like, because what happens now is that the court, when you get a subpoena from across state lines, you typically want it to be domesticated.

Or brought to a court that’s within your state so that that subpoena can actually be enforced by that court against you because your subject that jurisdiction. And California did this. California said, when you are from, let’s say, Texas and you bring a subpoena to us in California, You’re gonna have to get it domesticated by a California court. And now that California court has a burden to make sure that when they say, okay, you can issue this subpoena. You can serve it on this medical provider. It’s upon it’s incumbent upon the court to make sure that that subpoena that’s being enforced is not in violation of California law.

So that, in my mind, really relieves the covered entity or the medical provider from some of that burden because now the courts are going to assume that burden. And I really wish more states would take that approach, but California is one that did that.

Now in twenty twenty three, we actually had five states that passed reproductive health privacy legislation, and we’re gonna get into those on the next slide.

So here we go. Maryland, Minnesota, New Mexico, New Mexico, and Washington. If you are in one of those states, or if you have providers in one of those states, you now have reproductive health privacy issues that you have to be aware of. And I’m not gonna get like I said, I’m not gonna get into the details of each of these laws because they do vary, and there’s a lot of nuance to them. But at the end of this presentation, and I believe that we’re getting a copy of this as well, I included links to each of these laws. So you’ll be able to see the bill as it was passed and as it was enacted by the governors, and you’ll be able to research these. So that’s a resource that we’re providing to you.

I’d like to give you some general trends, though, that I’ve seen in this legislation. Now this won’t apply to all of these all five of these, but it will apply as a general concept for what these states we’re trying to do. You will see broad definitions for reproductive health services.

It’s not limited to abortion, pregnancy, or termination of pregnancy, or contraception.

Many states actually in these five anyway, many of these five actually call out gender affirming care. And and I believe this is a direct intention to address some states that are prohibiting gender affirming or transgender care for certain individuals by their state laws. We saw several states this year, I think, off the top of my head, I believe Georgia, Florida were two that limited the ability for a minor to receive transgender care whether that would be through hormone therapy or even through psychiatry or or through visits with a psychiatrist.

And so these five states, or most of them, are calling that out and recognizing it and saying, well, we’re gonna get ahead of this. Not gonna make this just about abortion, pregnancy, and termination pregnancy, we’re gonna cover gender affirming care because that seems to be the next thing that’s on the radar, if you will, it’s state legislative issues.

Now, these states also focus on these out of state investigations.

I think that these states recognize that This general consent to release your reproductive health information and then not narrowly define it was a little too broad and a little too burdensome. So they’re focusing again on what the issue would be, and that issue really boils down to, if we have For example, a Texas attorney general coming into New Mexico, trying to prosecute a Texas citizen for receiving medical care in New Mexico.

Is that legitimate.

And so these these states here really narrowed it down and focused on that issue.

So Maryland, and I believe New Jersey is another one. Actually included language in their bills that will require their and I’m gonna say department of health here, but it could be a little broader. To come up with regulations for the enforcement, as well as some penalties.

That would be in place if a covered into your medical provider violated one of these state laws. Now, in Maryland, we have December first, twenty twenty three is the deadline when this commission is to be established under the legislation will actually make recommendations to the Department of Health, who will then come up with regulations that would provide support or guidance on how to comply with the reproductive health privacy law in the state of Maryland. So we’re keeping a close eye on that as well, as that commission is appointed with members to sit on it, and then as they hold hearings throughout the summer and fall, and then hopefully we’ll make recommendations to the Department of Health. And then we’ll be monitoring any kind of draft regulations that are filed for public comment at that point.

We’ll go to the next slide.

So Sorry, Kyle. Did you want me to go? I’m I know these were the link, so I apologize. I I got a little click happy.

Yeah. Okay. So we’re on the state reproductive health privacy laws and the actual laws that are linked then. Right? And so Here is the last slide that you’ll have to reference the actual laws that passed, and hopefully you’ll find this as a valuable resource.

And feel free to, you know, ask any questions that you might have, but I encourage you all to follow-up counsel or follow-up with your government relations team after you review these laws and see how they will affect you and your and your employers. Can we go next slide then?

Now, many states have adjourned for the year, However, there are still some states that are in session, and some of those still have some reproductive health privacy legislation that’s pending. And so here is a quick list of those. I continue to monitor bills in these states, and if anything comes out, I will obviously be updating our Ciox team and and I don’t know if we’ll have another webinar later in the year as kind of a wrap up to see if we have any additional states to address, because there’s a chance that some of these bills won’t even pass, like the one in Pennsylvania that I mentioned.

But you can see from this short list here that we still do have some states in session like California, Connecticut, Main, Massachusetts, Oregon and Pennsylvania that are still considering reproductive health privacy legislation, and Many of them are on the shortlist to adjourn here pretty quickly. I think California will adjourn sometime in August, and actually Connecticut did adjourn. They just adjourned last week So this is a matter of, you know, the PowerPoint being done before or being required to be done before we could actually update it with most up to date information. Connecticut has adjourned.

I don’t have anything additional to report there. So their bill that they passed in twenty twenty two, Lorraine, as is.

I have had some conversations with some legislators in Connecticut.

I don’t know if there will be any amendments coming to that in the future, but We did, again, have a bill that would have addressed it this year. Then we also have Maine. Maine will be adjourning shortly. Massachusetts is in session until December, as is Pennsylvania. So we keep a close eye on those two states to see exactly what happens with their legislation. And then Oregon actually we’ll be adjourning here at the end of June. So you’ve got a handful of states there that are gonna be in session through the end of the year, some that are still in, but will be done probably by the end of summer, and we’ll continue to monitor those.

Next slide, Elizabeth.

So now we have another poll question for you all.

And if we can Leah, would you like to guide the poll question here?

Yes. So for poll question three, we have which area of the new state regulations do you find most challenging.

Understanding key terms and definitions, analyzing the implications of the NPRM versus current state regulations, interpreting state legislative set up updates or developing compliance strategies.

So we’ll post that and give everyone probably about fifteen seconds answer here.

We got a good mix of answers coming in here as well.

Currently, it’s a pretty even split between analyzing the implications, interpreting state legislative updates, and developing compliance strategies. Give everyone just a few more seconds. Alright.

The results.

Tied to thirty three percent seeing interpreting state legislative updates and developing compliance strategies followed closely by twenty eight percent saying analyzing the implications of the NPRM?

So hopefully we’ll be able to help them at least with developing the compliance strategies. So let’s talk a little bit of some recommendations we have as far as how you can stay on top of the new regulations.

I know, like, it’s very exciting for me, it is. Right? But reading the notice of proposed rulemaking, I will have to say, I’ve read several times. And again, like Kyle and I were talking about, there’s been many times in which we have come back and went, oh, what about this?

So I highly recommend you do that.

You know, staying up to date on your state legislative updates. Also, I would recommend staying up to date on your bordering date, legislative updates. We have seen it where sometimes the boarding state could be passing a a regulation, which means that yours might not be far behind.

And, obviously, talking to your health care organization, your government relations, your legal department, and just, you know, talking again about the notice of proposed rulemaking, if you have a specific state, but even if you don’t, you know, again, those bordering states, and Kyle did present some in which, I’m sure you guys saw or there could be some pending right now.

And then once you talk to your legislative your government relations individual, in your legal counsel, like, how do you wanna approach that and having conversations with your state legislator? I think it’s very important they understand.

How these regulations can impact your day to day work. As Kyle mentioned, he does a lot of conversations with our state legislators, and he tries to talk to them.

Does a phenomenal job, but a lot of times they wanna hear from the providers. They wanna hear from you guys as well.

New regulations go ahead. Yeah, Kyle. Jump in. I just wanna add there that when I’ve had these conversations with legislators, one thing that really does not surprise me is that they’re being called upon to protect reproductive health privacy, but they don’t know the practical way to do that.

Right? So that’s where I think you have these bills that are introduced that say any patient’s consent. And they don’t understand how difficult that is for a provider. So if you can work with your state hema to reach out and or work with your government relations team, to provide some clearer ways that are easier that will protect patient privacy, but at the same time will be easier to implement.

I think that is key.

I agree.

So we have one more poll question, and then we’ll have a couple minutes for q and a.

How prepared do you feel to comply with these new regulations highlighted that we’ve discussed in the notice of proposed rulemaking and the call discussed in the state legislative updates. I mean, do you feel fully prepared, somewhat, not very prepared and not prepared at all. So let’s open up that poll real quickly and see what our responses are.

Results are coming in.

Again, I will give you all about ten more seconds. It looks like forty percent of you have been able to vote.

Alright.

Looks like we have a clear leader here.

Fifty four percent said somewhat prepared, followed by thirty five percent still feel not very prepared.

Yeah. It’s a lot. So we totally respect that. Again, Kyle and I are here to help. If you have questions, we’d be more than happy to talk your privacy compliance in your legal departments to talk about some of the things that we’ve talked about on this webinar and challenges that we had. So let’s just take this last four minutes, and we’ll do a quick QA. And, Leah, I know you put a question in the chat.

In here that I I think I wanna go ahead and jump in and answer just very quickly.

It was when it comes to reproductive how alert that wasn’t the one. Here we go. Would it be be prudent to add language about reproductive health PHI onto your authorization form in addition to a separate attestation.

The one thing I will caution you with with that is that if that individual because Kyle just touched upon this, marks no, are you gonna be prepared to be able to remove that information such as, you know, again, call has redacted out of the chart.

So, just something to think about on that one. Do we have any other questions later that have come in through the chat?

Yes.

Also from Audrey, she followed up with, would the attestation be required for TPO release of PHI?

No. It would not be required for TPO release of of PHI.

Perfect. Another question that came in says why is political class important to this health issue? I’m not sure I understand.

I think she was and Kyle, I’ll let you jump into this a little bit, because I believe that’s when you were touching upon some of the states that we were seeing based on the democratic makeup or democratic or republican make up?

Yeah. And, you know, for someone following the news and following politics, I think it just I can’t get into the why per se, but it’s just abundantly clear. I mean, if we look at the states that have passed it and the states that introduced it, and and the parties who have introduced it, it is what it is. And I think It’s interesting. I look at that first poll question we had, and, Leah, you may have that readily available, the results. But I think it was it was not provide enough protections.

And I wonder if Yeah, there are some privacy improvements, but there’s limitations.

And and I wonder if the reason for that answer is because we as health information management professionals, understand protecting patient privacy, and we’re looking at this NPRM saying, well, you’re only protecting the privacy to the extent that a government agency wants to obtain that information for an investigation regarding a criminal criminal civil or or disciplinary action.

And so I think that might be where that answer is coming from, is that, you know, the OCR said we have our hands tied with what we can actually do here, and it’s going to be with respect to this multi jurisdictional request for information.

I know that’s not really responsive, but I mean, that’s that’s kind of where we are, is that if you look at the states that have passed it, it’s clear who’s in charge of the politics in the state.

Yeah. I agree, Kyle.

Leah, do we have any other questions?

The other question was when it comes to reproductive health this include IVF treatment, general care for reproductive systems, etcetera?

It does. I mean, well, if well, let me back up. If you’re talking about the notice well, actually, probably, that’s for state too, because states are very broad that we’re seeing as well in twenty twenty two. Right?

Yeah. Yeah. I would say that those procedures or medical services would be covered under pretty much every state Well, not pretty much. Every state that we’ve seen past something as well as the proposed rule.

Yeah. Because you gave a great example. Right? Like, we go into the emergency room, that’s a standard question that’s usually asked is, you know, is there a potential for you being pregnant?

And you can say no, but there’s still gonna be a pregnancy test performed. And so therefore, that’s classified as reproductive health.

Any other questions, Leah? I know we’re at the bottom of the hour. Let’s see if we can get a quick one in. We just had one more come in, and it says, do you see this affecting pay or request for medical records for audits?

Not at this time. I mean, I do know that we have obviously had a lot of conversations around self pay. I think that’s something that, honest, as a provider, you probably need to kinda look to make sure that you have ease of access and view as to which patients are coming in as cell pay.

So you can identify it appropriately.

But as far as just payer, I’ve got Blue Cross listed as my, you know, payer on whatever visit. It’s not affecting them.

I know we’re, like, a minute over. I just wanna very quickly just provide you guys I mean, Kyle gave you guys some fantastic you’ll get this presentation.

But here is some additional helpful resources. I know Lee is probably gonna tell you just very quickly. We’re gonna send you out, of course, the CEU. You should be getting it in the next day or so.

We also ask that you please write this give us a survey for this. It’s fantastic. We actually take this information and utilize it as to what you know, if it was useful information, if you see something else that we need to cover or that we needed to dive further into.

Again, thank you guys for taking so much time of your schedule to attend this webinar. And on behalf of Kyle and myself, we really appreciate it. Thank you. Yes. Thank you, everyone.