Timothy Norton – Health First

In early August, Timothy Norton’s phone started ringing off the hook—and the news wasn’t good.

Just when he thought a semi-vaccinated public might put COVID-19 in the rear-view mirror, the CEO of Health First’s Hospital Division told him available space in South and Central Florida hospitals was dwindling fast.

As system vice president, associate general counsel and chief privacy officer for Health First—the nonprofit community health system based in Rockledge, Florida—Norton had already navigated a seemingly endless gauntlet of state and federal mandates during the first waves of COVID-19. Now, he was once again being tasked with protecting patient privacy and complying with the latest laws.

Timothy Norton | System Vice President, Associate General Counsel, Chief Privacy Officer | Health First

“Talk about Federalism at its finest,” Norton says. “This time it was different: Florida’s state emergency was expired, but yet the federal Public Health Emergency still exists.”

First response

At Health First, Norton oversees transactional and regulatory delivery of healthcare services in four hospitals in Brevard County; two outpatient medical groups; health insurance products; and several outpatient and wellness divisions across southern and central Florida. Beginning in March 2020, every location was put to the test.

“From a legal perspective, the first days of the pandemic were hectic,” Norton recalls. “Given the ever-changing landscape of healthcare laws, at times they changed daily, if not hourly.”

Then as now, Norton’s focused on making sure the organization provides the necessary services to support its customers and associates. With the law in flux, he’s also helping in the expansion of telehealth throughout Health First’s network.

During the first wave of COVID, it was also Norton’s job to establish and enforce policies at Health First from mask wearing and patient visitation to advising on Section 1135 Waivers—issued by the Department of Health and Human Services after declaration of a public health emergency.

“The waivers enabled us to do many things—from establishing emergency triage tents at our four hospitals, to providing Medicare patients with multiple refills of medications,” Norton says. “It was an ever-changing situation.”

Rapid response

Throughout the pandemic, Norton has been on-site to address legal and logistical concerns, while sharing responsibilities with his counterpart, Kathy Magar, the system vice president of risk and informational security officer. Together, they responded to incoming information, deciphering the best way—from a legal perspective—to treat patients, such as transferring them between hospitals safely.

Following a state mandate on March 20, 2020, Health First suspended elective surgeries—a move which impacted physicians’ income. In response, Norton became the lead counsel to structure their compensation program.

“We experienced so many regulatory changes during this first wave of the pandemic,” Norton says. “We even had to assess a visitor’s constitutional rights for refusing to wear a mask in our facilities.”

As the number of infected patients escalated last year, Norton also worked with Heath First’s Hospital Division to transfer patients to to locations where they could receive treatment.

“We managed through the initial crisis well, putting systems and protocols in place,” Norton says. “The fact that we’re having to jump into crisis mode again is disturbing. I’m more concerned than before. Health First currently has an increased COVID-19 positive hospitalization rate with more than 97 percent of the patients unvaccinated.”

Privacy protections

With positive cases inundating Florida hospitals during the first wave, Health First instituted patient privacy protections that took effect the moment a user signed into the healthcare system. An auditing tool assisted its privacy department to ensure proper access of patient records.

Also in March 2020, Norton established protections for patients who tested positive for COVID-19. Working with the Clinical Transportation Services Department, he received a daily list of all positive-testing patients admitted. The privacy department then flagged those records to ensure that only those treating these patients had access to the information.

Meanwhile, Norton also worked to ensure that Health First’s telehealth options remained compliant, providing regular feedback on what services could be provided—and which medications could be prescribed—through digital telehealth with waivers.

“I even was able to provide advice so we could provide physical therapy through telehealth in Florida thanks to the waivers,” he says.

Unprecedented events

Although he’s been an attorney for more than 12 years, Norton says he never encountered anything like COVID-19.

“Nothing prepares you for this … except perhaps law school, where you learn to think on your feet,” he jokingly says.

After graduating with a degree in public administration from George Mason University in 2006, Norton earned his J.D. at Widener University School of Law in 2009. Eight months later, Congress passed the Affordable Care Act, an event that forever changed the course of Norton’s career.

Hired as an attorney at CGA Law Firm in 2009, Norton handled health, employment, corporate relations and litigation for five years, often representing physicians. To expand his knowledge in healthcare, he returned to school, earning an LL.M. in health law at Loyola University Chicago School of Law in 2014, focusing his thesis on healthcare fraud.

Degree in hand, he became assistant general counsel for Pennsylvania’s WellSpan Health in 2014. For more than three years, he advised departments on everything from hospital medical staff issues to HIPAA privacy and security; and was lead counsel on the Epic electronic health record implementation.

It was during a snowstorm in 2018, while watching a Philadelphia Eagles football game on TV, that he applied for the Health First job in Florida. Hired as senior counsel in 2018, he was promoted to system vice president, associate general counsel and chief privacy officer 10 months later. Currently he’s acting as interim chief integrity officer.

“I built my reputation as the “go-to guy” handling healthcare regulations, privacy concerns and putting together contracts,” he says.

Bracing for the next wave

For Norton, the work’s been fascinating, allowing him to cultivate his expertise across multiple healthcare divisions—while gaining insight into how hospitals affect healthcare systems (and vice-versa).

“You can’t just think about something strictly from a hospital perspective; it’s truly a case of how each system, or outlet, is integrated with the other,” he says.

As Heath First and other organizations nationwide face an impending COVID-19 surge in the coming months, Norton says community education on the importance of vaccines is vital for turning the tide. To makes his case, he plans to draw from his law school days, where he learned the value of debating with the Socratic method.

“Getting grilled by my professors back then was great preparation for what I’m experiencing now,” Norton says. “It’s helped me answer the types of questions coming at me when I don’t have all the information, or the laws are vague.”

Thankful for surviving the first wave, Norton feels confident for what he’ll face next.

“I think I’ve built up a pretty good immunity to protect us going forward,” Norton says.

View this feature in the Vanguard Fall I 2021 Edition here.