Policing the Electronic Frontier: An Introduction to E-Health Legal Issues
[December 1999]

E-health companies and those engaging in health care e-commerce should prepare for a new regulatory environment in which state and federal authorities apply heightened scrutiny to this burgeoning sector of the New Economy.

It is rapidly becoming clear that the relatively freewheeling early stages of the e-health industry are drawing to a close, a development that was inevitable given the highly regulated character of the American health care industry and the public policy concerns that attach to the provision of health care services in any form. First generation health care "dot coms" should reevaluate existing business models for legal compliance and second generation companies must develop business models with an eye towards anticipating this changing regulatory landscape.

This E-Health Law Advisory Bulletin provides a brief overview of some key legal issues relevant to e-health companies. A series of executive summary bulletins will follow in the coming months reviewing many of these and other issues in greater detail.

HIPAA Electronic Data Security Standards
The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") mandated the creation of electronic data security standards, which promise to have a profound impact on health care information technology practices for years to come. In August 1998, the Department of Health and Human Services ("HHS") issued proposed electronic data security regulations (the "HIPAA Security Regulations"). It is anticipated that the final HIPAA electronic data security regulations will be issued by HHS prior to the end of 1999. The HIPAA Security Regulations require that any health plan, health care clearing-house or health care provider that electronically maintains or transmits individually identifiable health information must adopt policies, practices and procedures to protect the confidentiality of that information. Transmission of individually identifiable health information over the Internet is a type of transaction subject to the HIPAA security requirements.

Many e-health companies will not be directly subject to HIPAA because they are not health care providers, health plans or health care clearinghouses, as those terms are defined in the HIPAA Security Regulations. However, a wide variety of e-health companies are likely to be viewed as "business partners" of HIPAA covered entities. Business partners are required to enter into "chain of trust partner agreements," pursuant to which a HIPAA covered entity and an e-health company business partner would agree to electronically exchange data and protect the integrity and confidentiality of that data. Although the HIPAA Security Regulations will not become effective until late 2001 or early 2002, the regulations are likely to become the industry standard for commercially reasonable security practices prior to the effective date. As a result, many e-health companies can expect to be asked in the near future to enter into chain of trust partner agreements with health care providers and other parties subject to HIPAA.

HIPAA Privacy Standards
HIPAA also mandated the establishment of new standards governing privacy of individually identifiable health information that is electronically transmitted or electronically maintained by health care providers, health plans and health care clearinghouses. The Secretary of HHS has issued proposed privacy regulations pursuant to HIPAA ("HIPAA Privacy Regulations"), which were published in the Federal Register on November 3, 1999. Because it appears unlikely as of this writing that congress will pass comprehensive privacy legislation or legislation to extend HIPAA's statutory deadline, HHS is expected to issue final HIPAA privacy regulations by February 21, 2000. Although the HIPAA Privacy Regulations apply only to information that is electronically transmitted or maintained, and not to paper-only records, the privacy standard will substantially increase the rights of patients to control the use and dissemination of their health information, and cause HIPAA covered entities and their business partners, such as e-health companies, to adopt HIPAA-compliant privacy protections.

The HIPAA Privacy Regulations prohibit a covered entity from using or disclosing an individual's protected health information, except as expressly permitted or required by the regulations. As with the HIPAA Security Regulations, many e-health companies will find that they are not directly subject to the HIPAA Privacy Regulations, which apply to health care providers, health plans and health care clearinghouses, but will be required to enter into chain of trust partner agreements with HIPAA covered entities. The HIPAA Privacy Regulations set forth specific terms and conditions for chain of trust agreements. E-health companies that receive protected health information from providers and other HIPAA covered entities should begin considering HIPAA privacy compliance now in order to avoid being forced to react to chain of trust partner agreements presented by their clients.

Jurisdiction
Because the Internet transcends local, state and national boundaries, an e-health company's operations may be subject to the jurisdiction of courts in multiple states. Recent court cases indicate that a web site is more likely to be subject to the laws of another state if it is an interactive site that engages in commerce or two- way communications with citizens of that state. Web sites that are merely passive postings of information are less likely to be subject to the laws of other states. Of course, few "sticky" e-health sites today are purely passive postings. In the case of an interactive site, the operator may seek to exclude users from certain states by requiring user registration or by posting disclaimers on the site specifying that its activities are not directed toward certain jurisdictions.

Practice Liability Issues
Some e-health companies provide medical information by allowing users to submit questions to, or engage in online dialogue with physicians or other health care professionals. E-health companies must carefully consider at what point the provision of user-specific health care information may create a provider-patient relationship. The scope of practice of physicians and other providers is determined by state licensing authorities, making these questions all the more complicated for e-health companies, which typically provide services on a nationwide basis. If, for example, a physician employee of an e-health company provides medical information to a user that is deemed to create a physician-patient relationship, then the e-health company may be violating state corporate practice of medicine prohibitions, aiding and abetting in the unlicensed practice of medicine, and exposing itself to possible liability for harm caused by the actions of its physician agent. The employed physician may be subject to professional discipline for practicing medicine without a license in the state in which the user resides. Even if the physician is licensed in the user's state of residence, the provision of online medical advice without an in-person evaluation may violate applicable state scope of practice and professional standards. This is an area of law that is unsettled, but as certain e-health companies seek to expand the range of health care services that may be delivered on the Internet, these questions will increasingly be confronted.

Chat Rooms and Message Boards
Medical information web sites often feature chat rooms in which users share information regarding medical conditions. E-health companies may subject themselves to liability by establishing or sponsoring a site in which erroneous medical information is disseminated by users or company personnel. E-health companies must carefully consider the liability issues related to monitoring or moderating chat rooms and message board communications. While monitoring or moderating chat room content helps to limit inappropriate or misleading communications, it also causes the e-health company to assume greater responsibility for that content, thus arguably increasing the company's potential liability. The terms of use of an e-health company's site should clearly state the extent to which the company is assuming responsibility for chat room and message board communications. The terms of use should also clearly articulate any monitoring or moderating activities, or the absence of such activities. Monitoring or moderating activities should also be highlighted in the site's privacy policy.

Fraud and Abuse Issues
The application of state and federal laws prohibiting kickbacks and physician self-referrals to e-health companies is still a fairly uncharted area. Nonetheless, online advertising arrangements may implicate laws such as the federal anti-kickback statute, which generally prohibits the knowing and willful solicitation, offer, payment or acceptance of remuneration (i) for referring an individual for an item or service covered by the Medicare program or another federal health care benefit program or (ii) for purchasing such items or services. Online advertising is often paid for based upon a percentage of the dollar volume of click-through purchases. If the items being advertised and purchased are goods or services covered by Medicare or other federal health care programs, such as pharmaceuticals, then such arrangements should be carefully reviewed for compliance with applicable fraud and abuse statutes.

Ethical Considerations
Ethical issues have rapidly moved to the forefront of the consideration of the e-health industry by the public and the media. These concerns frequently are precipitated by the involvement of physicians and other health care providers in the ownership, management or operations of e-health companies. health care providers have played instrumental roles in the ownership, management and operation of many notable e-health companies, but activities that are appropriate when engaged in by lay persons may take on a different character and public perception when a health care professional is involved - the so-called "white coat syndrome."

E-health ethics issues are being addressed on several fronts, including the Hi-Ethics Alliance, the Internet health care Coalition and the Health on the Net Foundation's Code of Conduct for Medical Web Sites.

The law of cyberspace and the application of health care regulatory laws to e-health are both evolving at the speed of the Internet. The functionality of e-health webs sites and partnering relationships among e-health companies tend to evolve just as quickly. For these reasons, e-health companies should engage in periodic legal audits to make sure that their practices remain in compliance with a regulatory landscape that is still emerging. The next edition of this E-Health Law Bulletin will provide a more detailed analysis of the recently issued HIPAA privacy regulations.

return to Advisory Bulletins main page