How to manage your medico legal risk by Health and Life

How to manage your medico-legal risk | Medical Observer

Page 1 of 12

(/)

(/member/47535 Edit profile (/user/47535/edit) Log out (/user/logout)

Menu ☰

All Updates (/river-of-news)

Professional News

▼

Read Later (0) (/read-later)

Favorite Categories

▼

Medical News

▼

How to manage your medico-legal risk Dr Penny Browne (/author/dr-penny-browne) 27 October 2015 Dr Walid Jammal (/author/dr-walid-jammal)

2 Likes 1 Comment (/professional-news/how-to-manage-your-medico-legal-risk#comments)

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

! Read Later

Page 2 of 12

(/flag/flag/read_later/23366?destination=node/23366%3Fmkt_tok%

3D3RkMMJWWfF9wsRojvazPZKXonjHpfsX% 252B7OkuXqWzlMI/0ER3fOvrPUfGjI4ET8FqI% 252BSLDwEYGJlv6SgFSLHMMbNn0LgLXhg% 253D&token=UNi5kf_avm_mKY0xtsqqqNWLAOIqcVn3w4Gasg1B0Aw)

In Part 1 of this three-part Update, we deal with the risks surrounding health records and privacy. Stay tuned for Part 2. The authors have no conflicts to declare. Coordinated by Dr Claire Berman MBBCh (mailto:claire.berman@medobs.com.au) INTRODUCTION As GPs will be aware, the range of medico-legal risks we and our practice staff face today are wide and varied. We now practise in an environment of shared electronic health records, employment, privacy, and industrial relations changes, increasing regulation of medicine, social media, and increasing accountability to Medicare and other government bodies. Many practices are now group practices and most are fully computerised and employ both clinical and administrative staff. This means that, as practitioners, we need to be aware not only of our own responsibilities, but where we may be responsible for actions of staff and professional partners. Risks that were unheard of a decade ago are now common issues for practitioners; for example, using computer systems and IT security, using document automation systems to generate letters, emailing patient information, social media and file-sharing applications. Our experience at Avant is that members regularly contact us for advice on avoiding and managing these risks. In this article, we will focus on the risks surrounding health records, privacy and managing your own and staff membersâ&#x20AC;&#x2122; responsibilities. UNDERSTANDING YOUR LIABILITY Under Australian law, employers are responsible, and potentially liable, for the actions of their employees. Having a financial interest in a medical practice exposes a doctor to additional risks that are in many cases not covered by their

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

Page 3 of 12

personal practitioner medical indemnity insurance. Additional exposures include vicarious liability for the actions of employees, or the practice entity being named as a defendant in legal proceedings. This can occur when: • A patient has seen multiple doctors in the practice, particularly employed registrars. • The alleged error or injury relates to the actions or advice of a practice staff member, such as a nurse or receptionist, with no involvement of an individual doctor or where involvement of an individual doctor is unclear. • There are divided responsibilities and obligations relating to patient care. • Practice staff (for example, a receptionist) provide services to a third party (for example, a doctor who hires rooms at the practice) who then joins them in a claim. Comprehensive practice insurance should include cover for the entity and all staff employed in the practice. By way of example, an insurance company requested the records and a report on a female patient using her married name, yet she was still known at the practice by her maiden name. Unfortunately, her married name was also the same as another patient. Both the contracted doctor and the practice staff, despite having established policies, did not check three identifiers. The wrong patient’s entire file was sent to the insurance company. The error was discovered when the wrong patient was contacted by the insurance company. This case potentially exposes the practice entity, as well as the individual doctors, to an adverse finding and penalties from the Office of the Australian Information Commissioner. INFORMATION PRIVACY While technologies change, the fundamental principle remains that maintaining patients’ privacy is an ethical cornerstone of good medical practice. Following amendments to the Privacy Act in 2014, the need for an appropriate privacy policy, systems and procedures is more important than it has ever been. The Privacy Act applies to all health organisations in the private sector. Penalties of up to $1.7 million for corporations and $340,000 for individuals apply for a serious interference with the privacy of a person or repeated breaches of privacy.

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

Page 4 of 12

The amendments last year included the introduction of Australian Privacy Principles (APP) (http://www.oaic.gov.au/privacy/privacy-act/australian-privacyprinciples), new obligations relating to the transfer of information overseas, and

new enforcement powers for the Australian Information Commissioner. More information is contained in the Avant Guide to Privacy Reforms (http://www.avant.org.au/news/20130211-avant-guide-to-privacy-reforms/).

Some particular areas to watch out for include: • Understanding what constitutes apatient record • Using document automation technologies • The requirement to have a privacy policy • Use and disclosure of personal information • Integrity and security of medical records • Direct marketing. RECORDS AND TECHNOLOGY With the (almost) ubiquitous use of electronic health records in general practice, the preliminary question often arises as to what parts of the electronic health record constitutes a patient record, and what should be provided in different circumstances. We have worked closely with the RACGP in the development of their guidance document Managing external requests for patient information (http://www.racgp.org.au/your-practice/ehealth/optimus/managing/). This document

helps to define what constitutes a medical record in various circumstances. PRIVACY OBLIGATIONS IN THE USE OF EMAIL Health information is one of the most sensitive types of personal information. Health practitioners have a fundamental role in ensuring the privacy of patient health information. Ensuring that you and your staff understand your obligations in relation to email communications is also important. Unless you do not use and do not intend to use email at all, it is important to have policies and processes in place to manage email. For example, maintaining passwords and keeping them secure, using processes to verify and update email addresses, and obtaining patient consent to use email are all important steps to reduce the risk of breaching patient privacy. We have assisted the RACGP in developing guiding principles on using email in general practice.

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

Page 5 of 12

DOCUMENT AUTOMATION TECHNOLOGY Technology such as document automation can save time, for example, in populating referral letters. It can also give rise to privacy issues if not used carefully, and offers a good illustration of the kinds of process issues of which doctors need to be aware. We have seen cases where information automatically copied over from the patientsâ&#x20AC;&#x2122; summaries included sensitive information, for example, about sexually transmitted diseases or HIV status. The patients believed this information was not relevant or necessary for the purpose of the referral. They were upset and embarrassed that the information was disclosed not only to specialists but also to their employers (and other third parties) who received a copy of the referral letter. It is always necessary to consider the clinical relevance of the information disclosed to a specialist, and whether it is considered reasonable that such information be shared with another treating doctor. Consider not only the medical point of view, but the patientâ&#x20AC;&#x2122;s point of view and their reasonable expectation. For example, does the orthopaedic surgeon need to know that the patient has a history of an ectopic pregnancy? Or does the dermatologist need to know that the patient had a history of chlamydia? In some cases it may be clinically necessary to disclose such information to a specialist, even if the patient prefers that it is not disclosed. In those cases it is best to let the patient know what information is being disclosed if it is potentially sensitive, and why you consider it relevant. It will be difficult to defend acomplaint if you have not read the letter before it is given to the patient to hand over to his or her specialist, and no check is made of the relevance of the information included. It is also possible that the information in the patient summary is not up to date or accurate and needs to be amended before it is included in the referral letter. This particularly applies to lists of medications, allergies and history. PRACTICE LAYOUT

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

Page 6 of 12

It is also important to think about the physical layout of your practice and how this may enhance privacy and confidentiality, or potentially contribute to a breach. Think about: • The physical layout of your reception area to provide sound barriers and reduced view of computer screens, using ambient background noise or walls to reduce sound and the chance of conversations between staff or patients being overheard. • Providing appropriate sound proofing between internal walls to maintain privacy in consultation or treatment rooms. • Raising staff awareness as to volume and location of their conversations with patients, especially when on the telephone and using language that may identify the patient. • Providing access to private areas to conduct sensitive conversations and for upset or grieving patients.

Computer screens should not be seen by patients. Key points: • The range of medico-legal risks we and our practice staff face today are wide and varied.

http://www.medicalobserver.com.au/professional-news/how-to-manage-your-medico-l...

3/11/2015

How to manage your medico-legal risk | Medical Observer

Page 7 of 12

• Under Australian law, employers are responsible, and potentially liable, for the actions of their employees. • Comprehensive practice insurance should include cover for the entitity and all staff employed in the practice. • Maintaining patients' privacy is an ethical cornerstone of good medical practice. • Your medical defence organisation is an important source of information and assistance in helping you build strategies to mitigate risks. Tags: Medicolegal (/tags/medicolegal), General Practice (/tags/general-practice)

Author: Dr Penny Browne Dr Penny Browne is a Senior Medical Officer with Avant.

More articles by this author > (http://www.medicalobserver.com.au/author/drpenny-browne)

Author: Dr Walid Jammal Dr Walid Jammal is a Senior Medical Adviser - Advocacy at Avant.

More articles by this author > (http://www.medicalobserver.com.au/author/drwalid-jammal)