In addition to the medical record-related issues discussed above, physicians may wish to ensure that any data-sharing or other agreement they enter into with a group practice or clinic addresses certain general legal obligations of the parties, if not already addressed in another agreement between them. Some areas that have emerged as problematic include how to deal with the ongoing requirements of the management of the organization, and how to manage the potential conflict between the one party’s legal obligations and another party’s legal or ethical obligations. Physicians may wish to consider drafting clauses that address the extent of their duty to cooperate with each other and to refrain from interfering. If the agreement (or any of its obligations), was assigned or subcontracted, or if a lien or security interest was placed on the clinic’s assets, these factors may also have an impact on the physician’s duties.
Additionally, physicians may wish to consider the following:
- Details of the services provided by the Clinic:
- Hours, office/administrative support, staffing levels.
- Data location.
- Documentation provided.
- Details of the services to be provided by the physician.
- Roles and responsibilities of the parties to the agreement, including oversight and structure of the Practice (i.e., name/title of executives who are accountable for legal compliance).
- Financial terms.
- Vendor ownership.
- Performance expectations of the service providers.
- Service levels (uptime/downtime; attendance etc.), to provide a minimum uptime of 95% or better, to provide support services during business hours/24 hours.
- Consequences of failure to meet service levels.
- Systems security and support and maintenance obligations.
- Reporting requirements, frequency, type of reports.
- Data back-up frequency, type, and location.
- Details of contingency plan/disaster recovery plan.
- Hardware requirements.
- Software requirements.
- Providing secure computer hardware and software facilities to receive, store, and transmit Patient Information.
- Providing a virtual private network to enable secure remote access to such medical records and secure communication between the physicians and staff within the group/division.
- Using reasonable efforts to schedule any planned outages or system downtime to minimize or eliminate interference with patient care and to provide at least four business days’ notice of such outages or downtime.
- Ensuring sufficient insurance coverage.
Appendix G contains sample contractual terms addressing some of these general legal obligations as well as additional issues to consider when entering into an agreement with a practice or a clinic.
