NEWSLETTER Volume Ten - Number Ten October 2014 Audit Trails in Professional Liability Claims Internal auditing is part of the fabric of compliance work in a healthcare entity. Along with external audits, the internal component is designed to identify questionable billing and coding practices and other types of variances that merit a drill down, or further review. As defined by the Institute of Internal Auditors, internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. 1 Internal audits also play an important role in other aspects of healthcare operations. Internal audits are very useful in completing HIPAA analyses to make certain that information sharing is within the defined scope of treatment, payment and operations, or TPO. That covered entities must provide individuals with an accounting of disclosures of protected health information is consistent with developing audit trails in this area. 2 The same is true for purposes of compliance with the HIPAA Security Rule, in which there is a specific standard on audit controls. 3 For its part, the Office of Civil Rights of the Department of Health and Human Services has a pilot audit program that encompasses the HIPAA Privacy and Security Rules as well as the Breach Notification requirements. 4 RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 1
Internal audits have other applications, including inventory control. Even in the arena of clinical trials, internal audits are integral to contractual compliance with sponsored research programs. What is increasingly becoming a source of concern for healthcare risk managers and claims managers is the issue of audit trails in professional liability claims. 5 Requests for such information can facilitate the work of legal counsel representing plaintiffs alleging medical malpractice and more. As seen in an Illinois intermediate appellate court ruling, 6 the audit trail is very much in the mind of counsel representing plaintiffs in medical malpractice litigation. In an era of EMR, EHR and PHR, the audit trail could lead to some interesting outcomes in cases involving professional liability risk exposure. The Appellate Court of Illinois Decision. The facts in the Illinois case are quite detailed. The case involved a patient with renal failure who experienced related maladies as a result of her kidney dysfunction. One ailment that was particularly burdensome was acute gout for which her primary care provider, Dr. W.F.B., prescribed Colchicine and Allopurinol. The latter was prescribed in late August 2005 in an effort to block future gout attacks. 7 The patient saw her primary care provider s office several times in the next two months. She was also hospitalized for two days during September 2005 due to chest pain. While in the hospital, the patient was diagnosed with indigestion for which Prevacid was prescribed. It was also noted that she had elevated liver enzymes. During that hospital stay it was noted that she had been prescribed Allopurinol but that it had been stopped. 8 In early October 2005, the patient presented at an outpatient dialysis clinic with chills and nausea. She was given two antibiotics by intravenous injection, Vancomycin and Tobramycin. Two days later when the patient went to the dialysis clinic for treatment she still had a fever and once again the same antibiotics were administered to her. 9 The patient s condition evolved over the next several days, including development of a rash that was diagnosed as a possible drug reaction secondary RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 2
to Vancomycin. The patient s primary care provider prescribed Prednisone and recommended weaning her from that medication to Benedryl. 10 The patient had multiple encounters with care providers. The sequence of events included the following: October 14, 2005 - dialysis visit at outpatient clinic. Record indicated the patient was taking Allopurinol. October 18, 2005 - seen by the primary care provider because the patient s rash had become worse. Nurse notes in the office record that the patient is taking 300 mg/daily of Allopurinol. Patient is sent to the hospital emergency department. Patient is admitted to the hospital. Emergency department record notes that the patient told the emergency room physician that she had a medical history of taking Allopurinol. 11 October 19, 2005 - In the hospital the attending physician calls in Dr. P., an infectious disease specialist to determine if the patient s rash was an infection. Dr. P. rules out an infection. October 20, 2005 - Patient is seen by a dermatologist for an evaluation. October 22, 2005 - Patient is evaluated by a gastroenterologist who ordered a liver biopsy. The results reveal damage to the patient s liver. Expert analysis by a group at another facility results in a report indicating that the liver damage was consistent with drug injury and may be related to prior antibiotic use. The report also stated that a thorough drug history should be taken. 12 October 24, 2005 - October 29, 2005 - Patient developed eosinophilia and her liver enzymes continued to increase. After October 29, the liver enzymes began to return to normal limits and the patient s condition began to improve. November 2, 2005 - Primary care provider discharges the patient from the hospital with a diagnosis including autoimmune hepatitis, chronic renal failure, and a drug rash that was probably secondary to the administration of Vancomycin. The patient was instructed at the time of her hospital discharge to take six medications at home. Allopurinol was not on the list of medications that the patient was instructed to take. 13 November 8, 2005 - Patient is seen by her primary care provider with a complaint of fever. It is noted in the office medical record that the patient told the nurse that she was taking Allopurinol. November 13, 2005 - Patient returned to the hospital emergency department. The patient s rash became much worse and her skin was RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 3
peeling. During that emergency department encounter the patient indicated that she was taking Allopurinol, Prednisone, Prevacid and Lopressor. Approximately 40 minutes after her arrival at the hospital emergency department, the patient s skin started to rub off with even slight pressure. She was in excruciating pain. After administration of pain medication the patient was transferred to a large, academic teaching hospital. November 14, 2005 - The patient is admitted to an academic teaching hospital where she was diagnosed with toxic epidural necrosis (TEN). She was transferred to the burn unit of another teaching hospital that day. By this stage the patient s skin was described as sliding off and she was experiencing multiple organ failure. The patient was also septic. Given the state of the patient s condition she was placed in comfort care. 14 November 21, 2005 - The patient died in the hospital. A biopsy confirmed the TEN diagnosis. It was noted that 62% of the patient s body surface was involved in the toxic epidural necrosis. 15 The executor of the patient s estate filed a lawsuit for wrongful death and a survival action alleging medical malpractice against a number of the care providers and medical groups involved in her care. The primary care provider, one of the other physicians, and one of the medical groups settled out of court prior to trial. The jury returned a plaintiff s verdict in the amount of $5,132.197.00 against the nephrologist and his employer, a medical group. However, the jury found Dr. P., the infectious disease specialist, and his medical group, not liable. Thereafter, appeals were filed by the two defendants who were found culpable, and by the plaintiff. 16 The Appellate Court of Illinois affirmed the circuit court ruling in the case. Of particular note was the court s analysis of the plaintiff s arguments that the trial court had erred when it quashed a subpoena that it argued would have assisted the plaintiff in establishing his claim against Dr. P and his medical group. 17 Prior to the trial, the plaintiff issued a subpoena to the hospital for an audit trail that included the dates, times, and names when any individual accessed the patient s record during her month-long hospitalization from September 17 through October 18, 2005. The hospital complied with this request and sent the information to the plaintiff as well as all legal counsel of record in the case. 18 The patient s electronic medical record included the liver biopsy report dated October 26, 2005. The hospital audit trail revealed that Dr. P., the infectious RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 4
disease specialist, reviewed the report on November 2, 2005. At trial, Dr. P. testified that he had signed off on the patient s care on October 31, 2005. Plaintiff s counsel thought that it was noteworthy that Dr. P. reviewed the report after the date that he claimed he had signed off on the case, suggesting that Dr. P. had a duty to conduct a thorough medication history. 19 After the trial had started, the plaintiff s attorney issued a subpoena to the hospital asking that the person most knowledgeable appear to give testimony regarding the audit trail for the patient s records during her month-long hospitalization. Counsel for the hospital moved to quash the request on procedural grounds. 20 The plaintiff s counsel explained that he had not specified a named individual on the subpoena as he believed that the hospital would send the person who printed out the audit trail. Further, the plaintiff s attorney explained that the audit trail was important because it would show that Dr. [P.] looked at various documents even after he claimed that he no longer saw the patient. 21 Counsel representing Dr. P. informed the trial court that this was the first time that he was learning the reason for the plaintiff s request for the audit trail was to impeach his client. Counsel gave a number of reasons for objecting to the use of the audit trail. Following arguments on the issue, the trial court granted the oral motion to quash the subpoena and gave no explanation for doing so. 22 On appeal, Dr. P. asserted that the issues raised regarding the timing and relevancy of the subpoena did not reflect legal questions. Rather, he argued, that on appeal the standard of review was whether or not the trial court abused its discretion in quashing the subpoena. The appellate court agreed. 23 The plaintiff s appeal asserted that the trial court s decision prejudiced his case against Dr. P. For the plaintiff the main issue was whether Dr. P. should have conducted a thorough drug history and that the audit trail show he viewed the results of the liver biopsy which stated that a thorough drug history should be undertaken. 24 RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 5
The plaintiff argued that had the jury heard evidence about the audit trail it could have drawn the inference that Dr. P. was still on the patient s case as of November and therefore should have completed a thorough medication history. It was on this basis that the plaintiff sought a new trial. 25 In rejecting the plaintiff s request, the appellate court pointed out that the plaintiff was aware of Dr. P s testimony through deposition and an opinion prior to trial. Further, the plaintiff knew of the existence of the audit trail years before the trial. As the court said: The plaintiff had ample opportunity prior to the start of trial to appropriately identify and subpoena a CDH witness to lay the foundation for the audit trail. Instead, the plaintiff waited until two weeks into the trial and after Dr. [P] had already testified. Under these circumstances, the trial court did not abuse its discretion in quashing the subpoena as untimely. 26 The appellate court also pointed out that the plaintiff was able to cross-examine Dr. P. on the issue of the liver biopsy report and the comment in it that a thorough medication history should be taken from the patient. During that testimony Dr. P. said that the purpose of his consultation was not to investigate a drug reaction; his purpose was to determine whether the decedent s condition was caused by an infection. 27 The appellate court noted that the jury ruled in Dr. P. s favor, apparently accepting the explanation given in his testimony. Having noted that a new trial was not warranted unless an evidentiary ruling was substantially prejudicial and could affect the outcome in the case, the appellate court said: showing the audit trail that Dr. [P.] looked at the liver biopsy report on November 2 would not have affected the outcome of the trial. 28 The appellate court affirmed the lower court judgment. 29 Observations on the Illinois Decision. An important lesson can be learned from the Illinois case about the need to comply with procedural and evidentiary rules when seeking to use an audit trail as evidence in civil litigation. The lesson learned is particularly apt in cases RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 6
involving professional liability for medical malpractice and wrongful death. That the case involved the intended use of data from an audit trail is pertinent to the work of healthcare risk management and claims management professionals. Not only can the audit trial be a potent tool in the hands of a plaintiff, it can be valuable in claims analysis and legal defense. Implementation of electronic medical records and electronic health records have helped the plaintiff s bar focus attention on the use of the audit trail. While the intent in the Illinois case was to use the audit trail to impeach the defendant, it may have a broader application. The audit trail may provide clear evidence of a breach of a standard of care. It may also help establish a causal link between the breach of the applicable standard and the harm that occurred to the plaintiff. In egregious cases, evidence from the audit trail may help the plaintiff make the case for punitive damages, too. The audit trails in professional liability claims may also have unintended consequences, including billing and coding inaccuracies. By the same token, those who complete internal audits for billing and coding may be the early warning identifiers of potential compensable events (PCEs) that have not come to the attention of risk management. The same may be said for potential patient grievances that have not reached the level of patient relations. One audit trail may be of particular importance to the defense in professional liability claims. It is an audit trail conducted on the patient portal or patient health record (PHR). As more and more hospitals and medical practices use such technology as a mechanism for fostering continuity of care and communication, the PHR becomes an electronic log that could defeat claims of I did not know or No one ever told me. Such an approach may have been very useful in the Illinois case, especially if the PHR captured a self-documented acknowledgement of the medication regimen not including continued use of Allopurinol, the drug at the center of the patient s untoward treatment outcome. Each time the patient accesses the PHR, the encounter generates a time and date of access. Hence, if a patient were to argue that she was not told to reduce her Allopurinol, the audit trail in the PHR could be used to defeat such a claim based on the automatic date and time stamp. In other words, the audit trail can RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 7
be both a sword and a shield in litigation. Risk Management Strategies for Audit Trails in Professional Liability Claims. Leveraging the audit trail in medical malpractice claims requires consideration of several items involving documentation practices, communication and education. Several strategies can be used to strengthen the hand of the defense with regard to audit trails in medical malpractice claims, including the following: 1. Identify Data Subject to Audit Trails in Professional Liability. Assemble a list of topics or subject matter that would be relevant to an audit trail in a professional liability claim. Recognize that the content may include hard copy, electronic and hybrid information. Note that some audit trail requests may extend to fetal monitoring strips, voice messages, email transmissions and telemedicine documentation. 2. Correlate e-discovery and Legal Hold Protocols with Requests for Audit Trails in Professional Liability Claims. Work with legal counsel to address e-discovery, legal holds and anticipated audit trail requests in medical malpractice claims. 3. Implement an Audit Trail Request Response Protocol. Use a consistent response to requests for audit trails in professional liability claims, making certain that the requests or subpoenas are within the framework of a applicable civil procedure and evidentiary rules. 4. Incorporate Exceptions in the Audit Trail Request Response Protocol. Anticipate that there may be situations in which requests for an audit trail or a subpoena come within an exception either under organizational policy and procedure or applicable law. Work with legal counsel on managing exceptional requests for audit trails in such situations. 5. Encourage Key Constituents to Participate in Audit Trail Orientation and In-Service Programs. Stress the importance of participation in orientation and in-service programs for those involved in responding to an audit trail request. Ask panel counsel, the general counsel, the compliance officer, the managers of billing and coding and patient registration to participate in the education programs. Make a particular effort to engage in education and in-service RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 8
programming those responsible for assembling an audit trail in the HIM department as well as those who are apt to be asked to give testimony in a deposition or a trial on an audit trail. 6. Consider Use of a PHR Audit Trail in Claims Analysis. Work with IT, HIM, and defense counsel in the development of an audit trail of patient health records or portals as a way to capture evidence about the time and date when patients accepted notification of test results and messages or responses provided to the patient. Should the audit trail analysis suggest culpability on the part of the healthcare organization or care provider, such information may provide decisive in the disposition of the claim. Note, however, that the audit trail analysis may provide evidence that disputes the patient s cause of action and that it can be used in the defense of the claim as well. 7. Implement a Chain of Command to Address Issues in Requests for Audit Trails. Provide a clear chain of command for personnel tasked with assembling or responding to an audit. Indicate who should be contacted and the method for doing so when there are concerns about an audit trail request or subpoena. 8. Log the Development and Delivery of Audit Trails in Professional Liability Claims. Create a documentation log that tracks the development and delivery of audit trail information in professional liability claims. Consider including the dates, times, and sources of information included in the audit trail. Conclusion. The Illinois case demonstrates that the plaintiffs bar is on to the use of audit trails. Taking appropriate steps now can help foster consistent, thorough and timely uses of audit trails in defense of professional liability claims. Collaborative efforts are warranted among key constituencies in the healthcare entity or medical practice, including IT, coding and billing, patient registration, risk management, patient relations, and defense counsel. Including corporate compliance in the collaborative effort is prudent especially when managing regulatory grievance issues linked to a PCE. RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 9
If you would like assistance in developing a risk management www.therozovskygroup.com or (860) 242-1302 1 Definition of Internal Auditing, the Institute of Internal Auditors accessed at: https://na.theiia.org/standards-guidance/mandatory-guidance/pages/definition-of-internal- Auditing.aspx. 2 See, 45 C.F.R. 164.528(a) (2014). Standard: Right to an accounting of disclosures of protected health information. Under the HIPAA Privacy Rule, notwithstanding some exceptions, an individual has the right to receive what is termed an accounting of disclosures of protected health information going back as far as six years prior to the date on which the accounting is requested. The content of the accounting includes information that would be consistent with analysis of information in an audit trail. 3 See, 45 CFR 164.312 Technical safeguards. It states: (b) Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. 4 Audit Pilot Program, OCR HHS accessed at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/auditpilotprogram.html. 5 For a news account highlighting the practice see, P. Murphy, Audit trails increasingly playing role in medical-malpractice suits, Mass. Lawyers Weekly 43(9): 1 et seq, October 12, 2014. 6 J.F. v. G.K, et al, 2014 Ill. App. Unpub. LEXIS 791 (No. 2-13-0677 & 2-13-0707 cons., April 23, 2014). 7 Id. a 793. 8 Id. at 794. 9 Id. 10 Id. at 795. 11 Id. 12 Id. at 796. 13 Id. at 796-797. 14 Id. at 797-798. 15 Id. at 798. 16 Id. at 791. 17 Id. at 847. 18 Id. at 848. 19 Id. at 849. RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 10
20 Id. The hospital attorney argued that the plaintiff had given insufficient notice to produce a witness and that the plaintiff s attorney had not responded to her about who was he seeking to testify in the case: the person who printed the audit trail, the person who scanned the records in, or the person who knew the record system. Id. 21 Id. at 850. 22 Id. 23 Id. at 851. 24 Id. at 852. 25 Id. 26 Id. at 853. 27 Id. at 854. 28 Id. 29 Id. at 859. RMS NEWSLETTER ALL RIGHTS RESERVED 2014 PAGE 11