Other private laws

HITECH Act

One of the issues with HIPAA was the limited enforcement and penalties. In 2009, as part of the American Recovery and Reinvestment Act, the Health Information Technology for Economic and Clinical Health (HITECH) Act was passed. HITECH Act is enforced by the OCR.

The HITECH Act contains provisions that increase the enforcement of the privacy and security of electronic transmission and health information. HITECH Act modified HIPAA in the following ways:

• Made business associates directly liable for compliance with HIPAA.
• Prohibited the sale of PHI without the patient’s authorization.
• Created a tiered violation category that included unknowing, reasonable cause, willful neglect–corrected, and willful neglect–uncorrected. Violation penalties range from $100 for each “unknowing” violation to $1.5 million per calendar year. The greater the violation, the greater the penalty amount. Individuals, healthcare agencies, and business associations could be penalized and fined.
• Breach notification requirements were increased. Individuals must be notified of the breach via mail or email. If the facility does not have up-to-date contact information for 10 or more patients, then a notice must be posted on the company’s website for at least 90 days. If more than 500 individuals were affected, the media and the OCR secretary must be notified. A list of breaches reported is published on the OCR website.

It is important for the medical assistant to be aware of the importance of keeping the PHI secure. Any breaches or loss/theft of computer equipment must be reported immediately to the facility’s security officer.

Drug laws

The Food, Drug, and Cosmetic Act and the Controlled Substance Act regulate medications in the United States. The following sections describe each law and how it impacts healthcare.

Food, Drug, and Cosmetic Act (FDA)

In 1906, the Food and Drug Act became law. It prohibited the misbranding of food and drugs. It was replaced in 1938 by the Food, Drug, and Cosmetic Act, which is still enforced today. The US Food and Drug Administration (FDA) enforces the act. The FDA is responsible for the safety, effectiveness, security, and quality of drugs, cosmetics, and food. Some of the areas overseen by the FDA include human and veterinary drugs, vaccines, biological products (e.g., blood components), medical devices, food, cosmetics, dietary supplies, and products that give off radiation. When you see recalls of food, cosmetics, or medications, the FDA is involved with the process.

The FDA website provides useful information for the healthcare facility. The website is the resource for information and recalls on the areas overseen by the FDA. Many times, the medical assistant is responsible for maintaining the stock medications and equipment in the department. Any medications or medical devices recalled need to be removed immediately and not used. The providers should be notified of recalls.

Controlled Substances Act

The Controlled Substances Act (part of the Comprehensive Drug Abuse Prevention and Control Act of 1970) is a federal law. The US Drug Enforcement Agency (DEA) enforces the law. The DEA oversees the manufacturing, importation, possession, use, and distribution of certain drugs and chemicals. The DEA handles both illegal and legal controlled substances. The Controlled Substances Act has five schedules of medications. These schedules are arranged from greatest to least abuse potential. State statutes also address procedures related to scheduled medications. Some scheduled medication prescriptions are handled differently. It is important for the medical assistant to be aware of the schedule of medications.

Each provider prescribing scheduled medications needs to have a unique DEA number. The DEA number needs to be renewed every 3 years. The medical assistant may need to assist the provider in renewing or obtaining a DEA number. This can be done at the DEA website.

Workplace safety laws

The Occupational Safety and Health Act and the Needlestick Safety and Prevention Act mandate standards that help protect employees. The following sections describe each law and how it impacts the healthcare setting, making the environment safe for employees.

Occupational Safety and Health Act

The Occupational Safety and Health Act of 1970 (OSH Act) is enforced by the Occupational Safety and Health Administration (OSHA). Based on this act, OSHA sets workplace standards and conducts inspections to ensure employee safety. Employers must comply with all of OSHA’s regulations.

Needlestick Safety and Prevention Act

The Needlestick Safety and Prevention Act was signed into law in 2000. The goal of the act was to reduce the risk of healthcare workers’ exposure to bloodborne diseases. The act required OSHA to update its Bloodborne Pathogens Standard. The revised standards apply to all employees with anticipated occupational exposure to blood or other potentially infectious materials (OPIM).

Healthcare workers must use safer medical devices. For example, many needles can be capped with a special safety device after use. The facility’s Exposure Control Plan must include a sharps injury log documenting all instances of injuries from sharps (e.g., used needles, blades). Used needles, blades, and other sharps must be put in sharps disposal containers.

Personal protective equipment (PPE) (i.e., gloves, mask, and gown) must be worn if there is a risk of blood or body fluid exposure.