Legal Issues for the Medical Director

Abstract

The nephrologist serving as medical director of a dialysis clinic must understand that the role of director is not simply an extension of being a good nephrologist. The two roles—nephrology practice and the leadership of a dialysis clinic—may be filled by a single person. However, each role contains unique tasks, requiring specific skill sets, and each role comes with inherent, associated legal risks. The medical director assumes a new level of responsibility and accountability defined by contractual obligations to the dialysis provider and by state and federal regulations. Hence, a medical director is accountable not only for providing standard-of-care treatment to his or her private practice patients dialyzed at the clinic but also for maintaining the safety of the dialysis clinic patient population and staff. Accordingly, a nephrologist serving in the role of medical director faces distinct legal risks beyond typical professional liability concerns. The medical director must also be mindful of regulatory compliance, unique avenues to licensure board complaints, and implications of careless communication habits. A thoughtful and prepared medical director can mitigate these risk exposures by understanding the sources of these challenges: contractual obligations, pertinent regulatory responsibilities, and the modern electronic communications environment.

Introduction

For the nephrologist serving as medical director of an outpatient long-term dialysis clinic, the additional director responsibilities are of a different scale and scope than those of an attending physician. While the attending nephrologist role and the medical director role share a focus on clinical excellence, the medical director role confronts often underappreciated legal risks as one person effectively undertakes these two distinct and specific roles. The medical director faces novel legal risks for professional liability, regulatory compliance, licensure board complaints, and careless communication habits. However, a more thoughtful understanding of the distinct obligations and potential legal risks, as presented here in brief, may help the medical director avoid unnecessary stress and minimize the chances of legal entanglements.

The practice of nephrology rightly requires focus on clinical excellence. Practicing nephrologists are accustomed to frontline care for their patients, both providing appropriate, standard-of-care treatment and reviewing health outcomes. Keeping apprised of peer-reviewed literature and medical research in the field is also familiar to the working nephrologist, who often becomes a medical information resource for staff members and colleagues in other specialties. When serving patients with chronic kidney failure, nephrologists often find themselves in the practical circumstance of coordinating care among multiple comorbidities. For most patients with ESRD, loss of kidney function is not the primary disease process. The practicing nephrologist understands, as do physician specialists, that professional liability risk exposures are best mitigated by providing appropriate standard-of-care treatments and properly maintaining local, state, and federal credentialing or licensure.

Some nephrologists are presented with the opportunity to serve as a medical director at some point in their career. This most often takes the form of a leadership role in the outpatient, long-term dialysis clinic environment. All medical directors are credentialed nephrologists who, practically speaking, treat at least some of their dialysis patients at the clinic where he or she is the director. The “attending” role, as care coordinator and primary prescriber for patients with CKD and ESRD in private practice, is familiar from experience, but many nephrologists are less familiar with the new responsibilities imposed by their medical director role.

The medical director role encompasses specific, clinical oversight functions that are neither identical nor coequal to the role of attending nephrologist. In short, the medical director assumes additional oversight accountability for the entire patient population of the dialysis facility, a distinction sometimes opaque even to those with long, successful private practices.

This additional accountability is most prescriptively defined by the Centers for Medicare & Medicaid Services (CMS) Conditions for Coverage because every patient with ESRD is or will be a Medicare beneficiary and therefore within the purview of the Conditions for Coverage. Further, medical directors also undertake defined duties under the contract, or medical director agreement, with the dialysis provider (1). In day-to-day terms, these obligations are personified by the facility governing body. A medical director is in the unique position of serving as clinical head of the dialysis facility governing body (including facility administrator, clinical nurse manager, dietitian, social worker, and other staff members who are responsible for dialysis facility quality and safety) and also accountable to it. Finally, the medical director is accountable by regulation to federal and state agencies (e.g., state surveyors) that enforce the CMS Conditions for Coverage and, in some locales, state-specific regulations. Accordingly, the medical director’s professional purview extends to safety of the facility as a whole, including patient outcomes, staff training, documentation, and quality of care. This includes oversight of other attending nephrologists seeing patients in the clinic, who may be unaffiliated with the medical director’s private nephrology practice. With these more expansive obligations in mind, let’s examine the areas of legal navigation for the medical director.

Professional Liability

“Professional liability” is another way of saying “medical malpractice.” Professional liability is a function of state law, and most physicians have a basic familiarity with this legal risk in their professional lives. While substantive law and procedural rules vary from state to state (2), the general framework for professional liability is a civil lawsuit or claim in which the plaintiff alleges that the medical practitioner was negligent. For purposes of this discussion, “negligence” is defined loosely as “failure to exercise ordinary care” or failing to act within the “standard of ordinary care.” Ordinary care in turn can be roughly expressed as “doing that which a reasonable and prudent nephrologist (or other specialty) would do under the same or similar circumstances.” Professional or medical malpractice lawsuits are usually conducted in state courts and the core anatomy of a professional liability claim is fairly standard: a plaintiff will seek to establish three elements—negligence, proximate cause, and damages (economic or noneconomic)—in order to recover compensation. Many states’ laws require the first two elements be established by expert testimony; the plaintiff’s attorney will retain an expert (e.g., another nephrologist) to opine on those issues.

Generally speaking, nephrologists are not sued as commonly as physicians in other specialties, such as obstetrics. From the point of view of a plaintiff’s attorney, who essentially pursues a given claim with the hope of a future return in the form of a monetary damages award or settlement, nephrology malpractice claims represent comparatively complex legal cases because they often involve patients with multiple comorbidities. Therefore, even if successful, these claims may have a low or capped damages value. To illustrate, economic damages (e.g., lost income) are rarely pursued because patients with ESRD are older and either disabled or retired from the work force.

One way to overcome the “low damages potential” reality for a lawyer in the business of pursuing malpractice litigation is to consider alternative theories of recovery beyond the usual malpractice question (i.e., “Did the physician fail to comply with the standard of care in treating a particular patient?”). In this regard, a medical director role offers opportunity to the legal opponent. Our hypothetical plaintiff’s attorney can consider other avenues of liability in order to “take two bites at the apple” (sue the same physician on multiple theories of recovery) or to add defendants (sue the medical director, attending physician, or dialysis provider). Allegations against a medical director might include those based on any deficiencies in clinic-wide quality (e.g., outcomes), safety (e.g., infection control), compliance with policies and procedures, training or education, or patients’ rights. The argument will be that the medical director was negligent in his or her distinct role, separate and apart from any direct care issues. In states where state survey Statements of Deficiency are public record, for example, regulatory survey history can be used as an evidentiary source to argue negligence in the form of departure from the minimum requirements imposed by the CMS Conditions for Coverage.

Most practicing physicians, naturally including nephrologists, carry professional liability insurance, which will respond to and defend against medical negligence claims and also pay any indemnity payment up to the limits of the policy. Medical directors will want clarity, with both their professional malpractice carrier and the dialysis provider (through the terms of the medical director agreement), as to what coverage (theirs and/or the dialysis provider’s) would respond to alleged acts or omissions sounding specifically in the medical director role.

In this landscape of legal liability, it may appear that the medical director and the dialysis provider are in competition for protecting themselves individually. In reality, accountability is shared between the medical director and dialysis provider in order to mitigate liability exposure and meet the standard of care for patient treatment. For example, in the typical arrangement, the provider underwrites liability by carrying insurance for the dialysis facility staff and by contracting or self-insuring for the administrative duties of the medical director, while the medical director as nephrologist maintains his or her personal malpractice insurance for the practice of medicine. In this example, the providers and physicians collaboratively discharge shared accountability as the provider hires and insures qualified staff and the medical director regularly reviews and approves staff competencies, skills, and professionalism. The medical director can build goodwill and rapport by fulfilling all points of the director contract and fully engaging the work of the governing body (i.e., patient safety and quality of care) where the provider is broadly represented by the facility administrator, clinical nurse manager, dietitian, and social worker. Fundamentally, for the medical director and the dialysis provider, professional engagement should not be driven by crisis management but rather should be a longstanding working relationship with both parties fully invested. Then, when legal risk exposures are incident, shared accountability is best managed.

Regulatory Liability—Conditions for Coverage

In assuming the medical director role, a nephrologist agrees to abide by two basic commitments: to the dialysis provider organization contract (through the medical director agreement) and to federal (and in some geographic locations, state) regulations. The medical director role typically is initiated as a contractual agreement between the nephrologist and a dialysis provider organization. The contract language defines the roles and responsibilities of the medical director vis-à-vis the contracting provider. Typical provisions speak to compliance with the dialysis provider’s policies and procedures, quality assurance processes, peer review processes, clinical oversight for the facility, and compliance with laws and regulations.

A medical director is accountable for compliance with federal regulation, most immediately expressed by the CMS Conditions for Coverage. As a practical matter, all patients with ESRD receiving dialysis are or will become Medicare beneficiaries (3), and kidney disease represents a disproportionately large section of the Medicare budget (4). Therefore, the federal government highly regulates the dialysis industry. The CMS Conditions for Coverage define regulatory standards that health care organizations must meet to participate in the Medicare and Medicaid programs. These regulations define regulatory policy for general provisions, patient safety, patient care, and clinic administration. In the realm of ESRD, the Conditions for Coverage extensively define the medical director’s roles and responsibilities, giving global responsibility to the medical director for the dialysis patient population safety, the facility staff safety and training, and clinical oversight for all patients in the facility, including those attended by other nephrologists credentialed in the facility. The primary enforcement process for evaluation of compliance is the state/CMS survey, which is an audit of the dialysis clinic. Through this method, state or CMS surveyors evaluate and document a clinic’s degree of compliance with federal regulations. A section of these surveys specifically evaluates the medical director’s defined roles and responsibilities, and the physician in that role can be held accountable (as part of his or her oversight function) for any general clinic noncompliance and any personal noncompliance (5).

Regulatory Liability—Privacy

While the Conditions for Coverage most directly affect the medical director’s day-to-day responsibilities, there is another regulatory source worthy of mention in this context. “Covered entities” are obligated to safeguard patients’ protected health information (PHI). Before 2009, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 was the primary federal regulation for protecting the privacy of individually identifiable health information (6). In 2009, HIPAA was amended and expanded by the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was part of the American Recovery and Reinvestment Act signed into law that year (7). As a result of HITECH, the Office of Civil Rights inside the US Department of Health and Human Services was authorized to enforce the privacy and security rule, and penalties for noncompliance were increased (8,9). While many dialysis providers take the laboring oar to implement sophisticated technical, policy, training, and audit solutions to comply with HIPAA/HITECH, it is prudent for the medical director to understand the obligations imposed upon him or her as a “covered entity” (10). Many continuing medical education courses are available to physicians on patient privacy regulations, and this is an extensive, constantly evolving area of the law. Full treatment of this topic is beyond the scope of this article, and readers are encouraged to avail themselves of continuing medical education resources. However, as discussed below regarding communication habits, today’s technology platforms provide ample opportunity to run afoul of HIPAA/HITECH.

Licensure Boards

Complaints against licensure are another consideration of which the prudent medical director should be mindful (11). Like professional malpractice, this is a risk area originating at the state, rather than federal, level. Although each state medical licensure board’s regulatory scheme is unique, all have a similar, basic function: to control entry into and police the medical profession in the given state. As a matter of public policy, most state medical boards have patient complaint mechanisms in place. Furthermore, these mechanisms are designed so that it is relatively easy for a patient, or any other member of the public, to register a complaint against a physician. Complaints can be anonymous. Even when complaints are not anonymous, the medical board may not reveal the identity of the person(s) making the complaint to the target physician, depending on the board’s rules of procedure.

It can prove expensive and time consuming for the target physician to satisfactorily resolve a board complaint, even if it lacks merit. It is typical for a board inquiry to come to the physician’s attention first with a letter from the medical board. It is unwise to ignore or procrastinate in reacting to an inquiry letter. There are deadlines for the practitioner to respond to board requests (e.g., requests for records or narrative response to the complaint), and noncompliance can put the physician in a position of facing sanction for failing to cooperate or to respond to the inquiry itself, regardless of the underlying merits. It is wise to seek legal counsel immediately and avoid “going it alone.” Fortunately, professional liability insurance policies will often include provisions for retaining counsel and responding to board inquiries. The prudent practitioner will have a good understanding of their coverage on this point ahead of such a contingency, however unlikely it may seem.

Complaints regarding the role of the nephrologist may come from any patient receiving treatment under the physician’s license, and complaints regarding the role of the medical director may come from any patient treated at the dialysis clinic, even if a different nephrologist coordinated the patient's care. Furthermore, complaints against the medical director could encompass dialysis clinic–related issues, such as treatment, safety, or facility conditions. Patient grievances inside the facility can result in a complaint to the board. Good familiarity with grievance policies (most dialysis providers promulgate policy around grievance), active engagement with the renal networks, and aggressive resolution of patient grievances within the facility will help mitigate this risk substantially. The medical director is unwise to disengage from any patient grievance process, even if it does not involve the director’s personal care (e.g., a grievance related to an attending physician).

Communications

A final area in which the unwary medical director may encounter traps is in electronic or online communication. Physicians can unintentionally use modern communication methods such as email, text messaging, instant messaging, and social media in ways that violate HIPAA/HITECH, contractual agreements, or confidentiality agreements or that stray past the boundaries of professionalism. While this area of the law is extensive and evolving, the prudent medical director should observe some basic rules, particularly in the online and social media arenas:

• Assume and believe there is no anonymity online.

• Remember that personal opinions, carelessly expressed, can have professional consequences.

• Know that once the “post” or “send” button is clicked, the author has lost control of the content.

• Note that there is no predicting how a message or post can be repackaged or forwarded.

• Draft all online communication as though it will be public.

• Never betray a confidence or share PHI online.

• Do not “overshare” with patients or family members in an unprofessional manner. (If it isn’t appropriate in the clinical setting, it likely isn’t appropriate online.)

• Remember that most electronic communications platforms are not secure.

• Remember that social media platforms have extensive data-mining capabilities.

• Assume electronic communications, no matter how informal, will exist forever.

In 2010, the “Email Statistics Report” noted that roughly 25% of all email accounts belonged to corporate users who exchanged approximately 110 email messages daily (12). In this fast-paced environment of quickly exchanged information, physicians must understand that email communications are generally not secure and routinely are subject to discovery in litigation. For example, during the trial involving the diet drug Phen-Fen, several million corporate emails were produced as evidence. When emailing patients, physicians should consider the content of the email. Although emailing for administrative purposes (e.g., appointment scheduling and notifications) presents relatively little risk, if PHI is included in the email content, then legal liability increases (9). For example, PHI breaches easily occur upon emailing a patient at a corporate email address or a personal email address that is accessible by another person (e.g., unauthorized spouse or family members). Because of the uncertainty of the end viewer, it is advisable to exclude PHI from physician-patient electronic correspondence. Sophisticated providers design online portals and secure email communication systems in order to facilitate convenient patient communication in a secure environment. The same protections do not exist with the typical physician’s email account. The takeaway is that electronic communications are not an area in which to experiment or “take chances” if secure portal systems are not in place and administered by competent information technology professionals.

Social media use has exploded in recent years, with the creation of numerous social and professional platforms such as Facebook, YouTube, LinkedIn, Twitter, and Pinterest. Many physicians feel the desire or need to access these platforms as a branding or marketing exercise. In 2011, the American Medical Association adopted guidance titled “Professionalism in the Use of Social Media” (13). In this guidance, the American Medical Association encourages physicians to be mindful of patient privacy, monitor their own Internet presence, maintain appropriate patient-physician boundaries, encourage good Internet behavior from colleagues, and recognize that online content can negatively affect individual careers or the medical profession.

The legal community has taken notice of this trend and is increasingly surveying social media for informal discovery (14–18). How can Internet use be exploited in a professional liability case? Each of the social media platforms builds a profile about the user with parameters such as location, behavior, and “likes” (19–23). Tweets and Facebook posts create timelines of activities and (incomplete) portraits of personal character. Thoughtless and unprofessional social or “party” Tweets or Facebook status updates can call into question the professional competence of the physician at that point in time. Embarrassing or incriminating photos, even if not posted by the physician, can bring unwelcome legal risk. Even physicians who are mindful of their own social media presence may find their image or words posted, without their knowledge, by another user. Accordingly, in this environment of instant sharing, even small gatherings should be treated as public spaces.

Social media use is not immune from litigation. Libel or defamation may be charged based on online comments that rate other sites or organizations or assert information as a fact (24,25). To illustrate, calling someone a “jerk” and a “buffoon” may be safe from a lawsuit because it states an opinion. However, saying someone wrongly “pocketed” money could lead to a defamation claim because it asserts something as a fact. Under federal law, websites generally are not liable for comments posted by outsiders. Websites can, however, be forced to reveal the poster's identity if the post includes false information presented as fact.

In addition, physicians and medical directors must guard against creating online physician-patient or treatment relationships. Not only is this type of relationship inappropriate and unethical, but it also easily allows for PHI breaches and imposition of professional liability. Finally, a medical director, as a dialysis clinic leader, must consider the implications of “friending” or otherwise signifying online relationships with patients, family members, employees, or clinic staff. This can lead to appearances of favoritism or unprofessional demeanor, affecting safety or quality in the facility.

Conclusions

Assuming the role of medical director involves widening the professional gaze from providing care for a particular patient to overseeing the overall safety of the patient population and staff in the dialysis facility. It is critical for medical directors to understand that their role is not simply an extension of their nephrology practice. Rather, the medical director assumes a new level of responsibility and accountability principally defined by CMS Conditions for Coverage and contractual obligations to the dialysis provider. As such, the medical director uniquely faces legal risks in both roles—nephrologist and medical director. Understanding the expectations of the government regulators and the contracted provider are cornerstones of serving competently, leading the clinical team, and minimizing risk exposure to professional malpractice claims or patient complaints to the licensing board. Common sense habits with electronic communications will similarly minimize exposure to attacks on professional credibility and keep clear boundaries between personal and professional life.

Disclosures

W.G.T. is employed by DaVita HealthCare Partners, Inc.