HHS

NQF Telehealth Draft Report Provides Opportunity For Stakeholders

Posted by Rene Quashie on June 15, 2017
HHS, Telehealth / No Comments

Close up of male doctor with laptop computerThe National Quality Forum (“NQF”) has published a draft report (“Report”) recommending various methods to measure the use of telehealth.  By way of quick background, NQF is a non-profit, nonpartisan organization that seeks national collaboration to improve health and healthcare quality through measurement.  The Department of Health and Human Services (“HHS”) requested NQF to convene a multi-stakeholder committee to recommend various methods to measure the use of telehealth as a means of providing care. Among other things, the Report analyzes the best way to ensure clinical measures are appropriately applied to telehealth, proposes a measure framework, sets some guidelines for future telehealth measurement, and identifies measurement gaps.

To help develop a telehealth measurement framework, NQF began by conducting a comprehensive scan identifying existing measures and potential measure concepts related to telehealth. As explained in the Report, the “framework is a conceptual model for organizing ideas that provides high-level guidance and direction on priorities for what is important to measure in telehealth and how measurement should take place in order to assess its impact on healthcare delivery and outcomes.” The Report analyzed reports and white papers from organizations such as the American Telemedicine Association, the Health Information Management and Systems Society, and the Office of the National Coordinator for Health Information Technology. Continue reading…

Tags: , , , ,

Trump Takes First Step Toward Dismantling ACA and Buys Time with an Executive Order: Is it Substantive or Merely Symbolic?

Posted by Chris Raphaely on January 23, 2017
ACA, HHS / No Comments

Hours after taking the oath of office President Donald Trump signed a broadly worded executive order (“Order”) intended to minimize if not eliminate the impact of the ACA’s least popular provisions. With the Order President Trump can claim immediate action towards fulfilling a major campaign pledge while giving his administration and the Republican led Congress time to come up with a replacement plan.

The Order directs the secretary of HHS and other agency heads to, among other directives:

[E]xercise all authority and discretion available to them to waive, defer, grant exemptions from, or delay the implementation of any provision or requirement of the [ACA] that would impose a fiscal burden on any State or a cost, fee, tax, penalty, or regulatory burden on individuals, families, healthcare providers, health insurers, patients, recipients of healthcare services, purchasers of health insurance, or makers of medical devices, products, or medications. [And] [t]o . . . exercise all authority and discretion available to them to provide greater flexibility to States and cooperate with them in implementing healthcare programs. [And] [t]o . . . encourage the development of a free and open market in interstate commerce for the offering of healthcare services and health insurance, with the goal of achieving and preserving maximum options for patients and consumers.

The Order makes it clear that any agency actions under the order must be within the confines of the law and its existing regulations, both of which remain in place at least for now. The agencies still have the option of amending or repealing ACA regulations but the Order gives them the authority to take some action before going through the regulatory approval process.

Apparently, the agencies will decide which stakeholders’ costs and “burdens” under the ACA will be reduced. This presents them with an interesting challenge given the opposing interests inherent in the broad group of stakeholders expressly targeted for relief under the Order. For example, if the scope of the individual mandate (likely the prime target of the Order) were reduced relieving some individuals of the cost of buying health insurance, it would likely skew the risk pool of the exchange plans to less healthy participants increasing the cost and burden on the exchange’s insurers and those individuals who want to purchase insurance through the exchanges. That action could also end up reducing overall insurance coverage increasing the uncompensated care hospitals and other providers would be required to deliver.

Perhaps the most interesting aspect to watch, however, will be whether the Order ultimately has any significant substantive effect or simply ends up being a symbolic gesture. Some observers have contended that significant delays to, or gutting of, a portion of the ACA’s tightly woven and inter-related pieces mid-year 2017 would create chaos in the affected programs, like the health insurance exchanges, which are already underway this year. Therefore, there has been speculation that actions under the Order are not likely to be effective until 2018. The question is whether any actions under the Order, which are expressly limited to those that are permissible under the ACA, will mean anything in 2018 when it is almost certain that the ACA will have already been repealed.

Whether substantive or symbolic, clearly the first step in the ACA’s dismantling has been taken and we will be watching very closely as the administration and Congress take many more.

 

 

Chris Raphaely

Chris Raphaely

R. Christopher Raphaely joined Cozen O'Connor's Philadelphia office in 2014 as co-chair of the Health Care Practice Group. Chris joins the firm from Jefferson Health System, where he served as deputy general counsel and general counsel to the system’s accountable care organization and captive professional liability insurance companies.

More Posts

Tags: , , , , , ,

CMS Hears and Responds to Physician Feedback Regarding MACRA

Posted by J. Nicole Martin on September 09, 2016
Accountable Care Organizations, CMS, HHS, Medicare / No Comments

CMS Hears and Responds to Physician Feedback Regarding MACRAOn September 8, 2016, CMS announced in its blog that it will allow physicians to select their level of participation for the first performance year of the Medicare Access and CHIP Reauthorization Act of 2015 (“MACRA”) Quality Payment Program, which begins January 1, 2017. Importantly, during the first performance year (2017), “[c]hoosing one of these options would ensure [physicians] do not receive a negative payment adjustment” under MACRA in 2019.

Under the Quality Payment Program physicians will fall under the Merit-Based Incentive Payment System (“MIPS”) if they do not qualify under the Advanced Alternative Payment Model (“Advanced APM”) option.  In 2019, physicians who are in the MIPS default option could face Medicare rate adjustments of up to 5% based on their performance under four weighted performance categories: quality (50%); resource use (10%); advancing care information (25%); and clinical practice improvement (15%). Advanced APMs include, for example, Track 2 and 3 MSSP ACOs; next generation ACOs; and bundled payment models, and physicians who qualify under the Advanced APM option earn a 5% incentive, are excluded from MIPS adjustments and receive higher fee schedule updates after 2024.

Recognizing that many physicians may face negative payment adjustments under MIPS as a result of participating under the Quality Payment Program, CMS is going to allow eligible physicians to “pick their pace of participation” and ensure they do not receive such negative payment adjustments in 2019 by choosing one of four options for the first performance year:

  1. Test the Quality Payment Program;
  2. Participate for part of the calendar year;
  3. Participate for the full calendar year; or
  4. Participate in an Advanced APM in 2017.

The first three options fall under MIPS, while the fourth option falls under the Advanced APM. In the first option, physicians could “submit some data to the Quality Payment Program”, avoid negative payment adjustments and test the waters before broader participation in subsequent years. Under option two, the performance year could begin later than January 1, 2017, a physician practice “could qualify for a small positive payment adjustment”, and a physician would submit Quality Payment Program information for fewer days. The third option is ideal for those physician practices that are ready to participate beginning January 1, 2017 and who are able to submit a full year of quality data. Additionally, physicians “could qualify for a modest positive payment adjustment.” The fourth option would be viable for those physicians or physicians groups who treat enough Medicare beneficiaries and who receive enough of their Medicare payments through an Advanced APM (e.g., MSSP ACOs). Through the Advanced APM option, physicians/physician groups would “qualify for a 5 percent payment in 2019.” It remains unclear what the difference is between a “small” and “modest” payment adjustment. However, CMS may address this in the final rule along with how it will implement MIPS and the Advanced APM. CMS will release the final rule by November 1, 2016.

For more information about MACRA, contact Chris Raphaely, Nicole Martin or a member of Cozen O’Connor’s Health Law team.

J. Nicole Martin

J. Nicole Martin

J. Nicole Martin is an associate and practices in the Health Care Practice Group. Nicole assists accountable care organizations, health care systems, long term care providers, behavioral and mental health providers, medical device manufacturers, physician practices and pharmacies with their compliance, regulatory and transactional needs. Nicole’s practice includes providing clients with counsel regarding HIPAA/HITECH and state privacy and security laws, data breaches, business associate and covered entity obligations, licensure laws, Medicare, Medicaid and third-party payer matters, medical staff issues, and fraud and abuse laws. Nicole also represents clients undergoing changes of ownership and changes of control, and assists them with the transactional, regulatory and compliance requirements necessary to finalize the transactions.

More Posts - Website

Tags: , , , , , , , , , , , , ,

OCR Announces New HIPAA Guidance on Ransomware

Posted by Gregory M. Fliszar on July 13, 2016
HHS, OCR / No Comments

shutterstock_438013921In response to the increasing prevalence of ransomware cyber-attacks by hackers on electronic health information systems in hospitals and medical practices, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced on Monday July 11, 2016 its publication of new HIPAA guidance on ransomware (“Ransomware Guidance”). According to OCR:

Ransomware is a type of malware (or malicious software) that encrypts data with a key known only to the hacker and makes the data inaccessible to authorized users. After the data is encrypted, the hacker demands that authorized users pay a ransom (usually in a cryptocurrency such as Bitcoin to maintain anonymity) in order to obtain a key to decrypt the data.

Notably, the HIPAA Security Rule already requires implementation of security measures to help covered entities and business associates prevent the introduction of malware (e.g., ransomware) into their systems, and to implement policies and procedures to assist in responding to ransomware attacks. The Ransomware Guidance addresses, among other areas, how to implement security measures in order to prevent, mitigate the chances of, or even recover from ransomware attacks. Not surprisingly, conducting a risk analysis (or risk assessment) is at the core of covered entities and business associates implementing security management processes as required by the HIPAA Security Rule. The Ransomware Guidance further notes that maintaining an overall contingency plan, as required by the Security Rule, that includes disaster recovery planning, emergency operations planning and frequent backups of data can also help covered entities and business associates respond to and recover from malware infections, including ransomware attacks.

In addition, the Ransomware Guidance states that ransomware attacks against a covered entity or business associate can be considered a breach under the HIPAA Rules. Specifically, the Ransomware Guidance provides, “[w]hen electronic protected health information (ePHI) is encrypted as the result of a ransomware attack, a breach has occurred because the ePHI encrypted by the ransomware was acquired (i.e. unauthorized individuals have taken possession or control of the information), and thus is a ‘disclosure’ not permitted under the HIPAA Privacy Rule.” Therefore, unless it can be shown that there is a low probability that the PHI involved in the ransomware attack has been compromised based on the factors in the Breach Notification Rule, a breach is presumed to have occurred, which would trigger the applicable breach notification provisions.

Even before OCR’s publication of the Ransomware Guidance, in late June the Secretary of HHS sent a letter (“Letter”) to the attention of chief executive officers at health care entities addressing the threat of ransomware. The Secretary attached interagency guidance to the Letter containing best practices and mitigation strategies integral to combatting ransomware incidents.

Ransomware is immediately disruptive to the day-to-day operation of businesses, as seen by its impact earlier this year on health care systems like MedStar in Washington, D.C. and Hollywood Presbyterian Medical Center in Los Angeles (“HPMC”), resulting for example, in HPMC paying 40 Bitcoins (approximately $17,000) to regain control of its computer system. Although the Ransomware Guidance does not address whether payment or ransom should be paid to regain access to computer systems, the interagency guidance attached to the Letter advises against paying hackers because, among other reasons, paying a ransom doesn’t necessarily guarantee that an entity will regain access to its system. The Ransomware Guidance does recommend that an entity victimized by a ransomware attack contact its local FBI or United States Secret Service field office.

For more information about the Ransomware Guidance contact Gregory M. Fliszar, Ryan Blaney, J. Nicole Martin or a member of Cozen O’Connor’s Health Law team.

Gregory M. Fliszar

Gregory M. Fliszar

Greg Fliszar is member in the firm’s Health Law Group. Greg’s practice focuses on health law litigation and regulatory and compliance matters, as well as compliance with the Medicare Secondary Payer Act and HIPAA. Greg is also a licensed doctoral level clinical psychologist and was a clinical instructor of psychiatry at the MCP-Hahnemann School of Medicine.

More Posts - Website

Tags: , , , , , , , , , , , , , , , , ,

The E-Cigarettes Industry Fights Back Challenging the FDA in Federal Court

Posted by Ryan Blaney on May 16, 2016
E-Cigarettes, Food and Drug Law, HHS, Regulations / No Comments

e cig

Days after the publication of the Food and Drug Administration’s controversial final rule regarding e-cigarettes (and other nicotine-delivering products), a company called Nicopure Labs LLC filed a lawsuit challenging it in the U.S. District Court for the District of Columbia.  Nicopure seeks to have the rule vacated and declared unlawful, and has requested a preliminary injunction barring enforcement of the rule and prohibiting the FDA from taking any action under the rule pending resolution of the lawsuit.

The final rule, which will take effect on August 8, 2016 absent an injunction, grants the FDA authority to regulate electronic cigarettes and other vaping products and imposes rules on the industry that many insiders fear will leave it decimated.  These rules include banning sales to anyone younger than 18 years of age, requiring extensive warning labels on packing and — most significantly — subjecting all products (even those currently on the market) to the FDA approval process and the FDA’s reporting and recordkeeping requirements.  The price tag associated with the FDA approval process alone likely will pose an insurmountable barrier for the small vape shops, device manufacturers and e-liquid producers that currently drive most of the industry.

Nicopure, a Florida company that distributes battery-powered vaping devices and manufactures and distributes e-liquid, seeks to have the Final Rule vacated on several grounds.  First, Nicopure alleges that the deeming rule defines “tobacco product” so broadly that it constitutes an unreasonable construction of the authority granted under the Administrative Procedure Act (APA).  Additionally, Nicopure contends that the rule should be vacated as arbitrary and capricious in violation of the APA.  Finally, Nicopure brings a constitutional challenge, arguing that the rule violates the First Amendment by prohibiting manufacturers from “making truthful and nonmisleading statements regarding vaping devices, e-liquids and related products” and from “engaging in other forms of protected expression, including by distributing free samples of vaping devices or e-liquids.”

As of this writing, the FDA has not responded to Nicopure’s complaint, but the case (Nicopure Labs, LLC v. Food and Drug Administration, et al.,1:16-cv-00-878) will no doubt be closely watched by the rule’s proponents and detractors alike.

For more information you can contact Ryan Blaney or another member of Cozen O’Connor’s Health Law team.

 

Ryan Blaney

Ryan Blaney

Ryan Blaney joined Cozen O'Connor as a member of the firm's Health Law group. Ryan practices in the firm's Washington, D.C., office. He focuses his practice on representing clients in the health care and life sciences industries in a wide range of matters, including health care fraud and abuse, civil and criminal government investigations, qui tam and whistle-blower disputes under the False Claims Act and other federal and state laws and regulations, HIPAA privacy and data security, compliance and transactional services, and antitrust matters.

More Posts - Website

Tags: , , ,

Heads-up! HIPAA Phase Two Audits Begin – Business Associates Included!

Posted by Gregory M. Fliszar on March 22, 2016
HHS, OCR / No Comments

The Department of Health and Human Services (HHS) Office of Civil Rights (OCR) finally announced on March 21 that it is ready to begin Phase Two of its HIPAA audit program, which will include business associates. These audits, mandated by HITECH, will primarily be comprised of desk audits, scheduled for completion by the end of December 2016, followed by onsite audits.

OCR explained it will immediately commence Phase Two by verifying, via email, cover entities’ and business associates’ contact information. The OCR is requesting timely responses, so that it can send pre-audit questionnaires out in order to gather data from covered entities and business associates for the creation of potential audit subject pools. The data will relate to the entities’ size, type and operations. Should covered entities and business associates fail to respond to OCR’s requests, they may still be part of OCR’s potential subject pools because OCR plans to compile publically available information about covered entities and business associates that do not respond to its requests.

The first round of desk audits will focus on covered entities, and the second round will focus on business associates. The third round will be onsite audits, with a greater focus on the HIPAA requirements. OCR explains that some covered entities and business associates who are subject to desk audits may also be subject to onsite audits. According to OCR, all covered entities and business associates are eligible to be audited. The audits will focus on identifying compliance with specific privacy and security requirements under HIPAA/HITECH, and OCR will notify auditees by letter, regarding the subject(s) of their specific audits. On the HHS website, OCR provides a sample letter for review. Subsequent to the audits, OCR will review and analyze information from audit final reports.

Importantly, if an audit report uncovers significant noncompliance with HIPAA, it could prompt an investigation by OCR. The areas of interest for OCR in Phase Two will become clearer as the Phase Two audit program gets underway, but for now, we know OCR will focus on assessing covered entities’ and business associates’ HIPAA compliance, identifying best practices and discovering risks and vulnerabilities.

More information about the Phase Two audits is available here, and you can also contact Greg Fliszar, Ryan Blaney, J. Nicole Martin or another member of Cozen O’Connor’s Health Law team.

 

Gregory M. Fliszar

Gregory M. Fliszar

Greg Fliszar is member in the firm’s Health Law Group. Greg’s practice focuses on health law litigation and regulatory and compliance matters, as well as compliance with the Medicare Secondary Payer Act and HIPAA. Greg is also a licensed doctoral level clinical psychologist and was a clinical instructor of psychiatry at the MCP-Hahnemann School of Medicine.

More Posts - Website

Tags: , , , , , , , , , , , , , , , ,

OCR Announces Two Significant HIPAA Breach Settlements

Posted by Gregory M. Fliszar on March 21, 2016
HHS, OCR / No Comments

shutterstock_62667685On consecutive days, the Office of Civil Rights (“OCR”) of the Department of Health and Human Services (“HHS”) recently announced two large HIPAA breach settlements. On March 16, 2016, OCR announced that it entered into a Resolution Agreement with North Memorial Health Care of Minnesota for $1.55 million plus a two-year corrective action plan. On March 17, 2016 OCR followed by announcing that Feinstein Institute for Medical research, a New York biomedical research institute, agreed to pay to OCR $3.9 million and enter into a three-year corrective action plan to settle potential HIPAA violations. Both cases resulted from the all too familiar scenario of breaches resulting from stolen, unencrypted laptops.

In the Minnesota hospital breach, the unencrypted laptop containing the PHI of over 9,000 individuals was stolen from the locked car of an employee of a business associate of the hospital. According to the OCR’s investigation, the hospital failed to have a business associate agreement in place with that particular business associate. OCR also alleged that the hospital had not previously performed a risk analysis to identify and address potential risks and vulnerabilities to the ePHI it maintained, accessed or transmitted.

In the New York research corporation breach, OCR alleged that the institution did not have policies and procedures in place, including a policy on encryption and one that addressed use and access of electronic devices (e.g., the removal of the devices from the institution’s facility), nor did it have in place a security management process that sufficiently addressed potential security risks and vulnerabilities to ePHI, namely, its confidentiality, vulnerability or integrity. Notably, the stolen, unencrypted laptop contained the PHI of approximately 13,000 individuals.

As above, both OCR settlements also include multiple year corrective action plans requiring the hospital and research facility to conduct risk analyses/assessments, train their employees, and have HIPAA compliant policies and procedures in place. The Resolution Agreement for the Minnesota hospital breach is available here, and the Resolution Agreement for the New York research institute breach is available here.

Takeaways: The OCR’s 2016 breach enforcement is off to a very strong start with two high dollar settlements. Lessons learned from both breaches include the significance of encrypting electronic devices, conducting and updating on a regular basis security risk assessments and analyses, having adequate safeguards in place to protect PHI, having business associate agreements with all business associates, and having and implementing HIPAA policies and procedures to protect the security and privacy of PHI, including for example, policies related to encryption, authorized access to ePHI/PHI, and removal of electronic devices from facilities.

 

For more information, contact Greg Fliszar, J. Nicole Martin, or a member of Cozen O’Connor’s Health Law team.

 

Gregory M. Fliszar

Gregory M. Fliszar

Greg Fliszar is member in the firm’s Health Law Group. Greg’s practice focuses on health law litigation and regulatory and compliance matters, as well as compliance with the Medicare Secondary Payer Act and HIPAA. Greg is also a licensed doctoral level clinical psychologist and was a clinical instructor of psychiatry at the MCP-Hahnemann School of Medicine.

More Posts - Website

Tags: , , , , , , , , , , , , , , , , ,

Gun Control and HIPAA

Posted by J. Nicole Martin on January 06, 2016
HHS, OCR / No Comments

shutterstock_320073545In the wake of recent gun violence and in a concerted effort to protect public safety, the Department of Health and Human Services (HHS) released a final rule published in the Federal Register January 6, 2016, that modifies the HIPAA Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of persons who are subject to a Federal “mental health prohibitor” that would prevent such individuals from possessing a firearm (“Final Rule”). The covered entities are those that have “lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of NICS reporting purposes.”

The Final Rule, which will appear at 42 C.F.R § 164.512(k)(7), adopted what HHS had initially proposed in April 2013 in its proposed rule. The purpose of the Final Rule is to afford the NICS with the ability to identify individuals subject to this prohibitor for the purpose of disqualifying them from shipping, transporting, possessing or receiving a firearm. Individuals subject to the Federal mental health prohibitor include those who have been involuntarily committed to a mental health institution, found incompetent to stand trial or not guilty by reason of insanity, or have been determined by a court or other lawful authority to be a danger to themselves or others or being unable to manage their own affairs. The disclosures to the NICS will be restricted to limited demographic and other information required by the NICS. Further, the Final Rule specifically prohibits the disclosure of any diagnostic or clinical information and “any mental health information beyond the indication that the individual is subject to the Federal mental health prohibitor.”

Importantly, the Final Rule’s express permission to disclose/report is narrowly tailored. Specifically, it does not extend to covered entities permission to report to the NICS the protected health information of individuals who are subject to the State-only mental health prohibitors. Additionally, the permission is not extended to “most treating providers”, which emphasizes HHS’ intention to protect the privacy of the patient-provider relationship.

A key tension at the heart of the gun control issue for years has been how to adequately protect individual privacy, in particular, mental health information, and maintain public safety. Not surprisingly, the Final Rule’s publication comes at a time of heightened tension between these issues, and President Obama announced yesterday that under his executive actions on guns, the administration will, among other actions, seek to expand mandatory background checks for certain private gun sales.

The Final Rule is effective February 5, 2016, 30 days from its publication in the Federal Register. To learn more about reporting under the Final Rule and the amended HIPAA regulation, please contact Greg Fliszar, J. Nicole Martin or any member of Cozen O’Connor’s Health Care team.

J. Nicole Martin

J. Nicole Martin

J. Nicole Martin is an associate and practices in the Health Care Practice Group. Nicole assists accountable care organizations, health care systems, long term care providers, behavioral and mental health providers, medical device manufacturers, physician practices and pharmacies with their compliance, regulatory and transactional needs. Nicole’s practice includes providing clients with counsel regarding HIPAA/HITECH and state privacy and security laws, data breaches, business associate and covered entity obligations, licensure laws, Medicare, Medicaid and third-party payer matters, medical staff issues, and fraud and abuse laws. Nicole also represents clients undergoing changes of ownership and changes of control, and assists them with the transactional, regulatory and compliance requirements necessary to finalize the transactions.

More Posts - Website

Tags: , , , , , , ,

Physician Group to Pay $750,000 to Settle a HIPAA Violation

Posted by J. Nicole Martin on September 03, 2015
HHS, HIPAA, OCR / No Comments

In August 2012, a Physician Group—comprising of nearly 20 physicians—reported its HIPAA breach to HHS, which resulted from a laptop bag containing the employee’s laptop and a computer server backup being stolen from an employee’s car in July 2012. According to the Resolution Agreement between HHS and the Physician Group, the laptop did not contain ePHI, but the portable, unencrypted server backup in the employee’s bag did. The backup contained ePHI for 55,000 individuals. To settle this matter, the Physician Group has agreed to pay $750,000.

Although stolen laptops and lack of encryption is nothing new in the world of HIPAA breaches, this situation stands out for a few reasons:

  •  The Physician Group did not conduct “an accurate and thorough” risk assessment;
  •  The significance of encryption extends not only to desktop computers and laptops, but also to portable devices, including but not limited to computer server backups; and
  • This is a notable fine for a Physician Group of less than 20 physicians.

For more information regarding this incident and HIPAA compliance, including the importance of encryption and risk assessments, contact J. Nicole Martin or any member of Cozen O’Connor’s healthcare law team.

 

 

J. Nicole Martin

J. Nicole Martin

J. Nicole Martin is an associate and practices in the Health Care Practice Group. Nicole assists accountable care organizations, health care systems, long term care providers, behavioral and mental health providers, medical device manufacturers, physician practices and pharmacies with their compliance, regulatory and transactional needs. Nicole’s practice includes providing clients with counsel regarding HIPAA/HITECH and state privacy and security laws, data breaches, business associate and covered entity obligations, licensure laws, Medicare, Medicaid and third-party payer matters, medical staff issues, and fraud and abuse laws. Nicole also represents clients undergoing changes of ownership and changes of control, and assists them with the transactional, regulatory and compliance requirements necessary to finalize the transactions.

More Posts - Website

Tags: , , , , , , ,

Third Circuit Invalidates HHS’ Medicare Wage Index Reclassification Rule

Posted by Robert A. Chu on August 04, 2015
HHS, Hospital, Medicare / No Comments

shutterstock_182426978On July 23, 2015, the Third Circuit invalidated, as being contrary to the Medicare statute, the U.S. Department of Health and Human Services’ (HHS) Medicare wage index “reclassification rule,” 42 C.F.R. § 412.230(a)(5)(iii). That rule was designed to prevent (and did prevent) urban hospitals that had strategically reclassified as being rural from being reclassified again (based on their newly acquired rural status) to a particular urban area, to benefit from a higher Medicare standardized amount and wage index.

In Geisinger Community Medical Center v. Secretary United States Department of Health and Human Services, the hospital first reclassified, successfully, as a Section 401 hospital (i.e., an urban hospital that elects to be treated as rural). It then sought to reclassify, based on its newly acquired rural status, to the Allentown urban wage index area. The hospital estimated that such a reclassification would increase its Medicare reimbursements by approximately $2.6 million per year. The Allentown urban area is 27 miles from the hospital. To be reclassified to that area, the hospital had to rely on the relaxed 35 mile maximum distance applicable to rural hospitals; it would not qualify under the maximum 15 mile distance applicable to urban hospitals. The reclassification rule, however, prohibited Section 401 hospitals from reclassifying based on their acquired rural status.

The Third Circuit panel majority, under a Chevron Step One analysis, agreed with the hospital that HHS’ reclassification rule is unlawful. It specifically held that the statutory text of Section 401 unambiguously requires HHS, through broad and mandatory language, to treat Section 401 hospitals like hospitals that are actually located in rural areas. The reclassification rule, therefore, unlawfully prevented the Section 401 hospital from being considered as a rural hospital in its application to reclassify to a different wage index area.

Robert A. Chu

Robert A. Chu

Rob Chu is an associate in the firm’s Health Law Group, focusing on the litigation of health law matters. Upon graduation from Villanova School of Law, Rob was awarded the ABA-BNA Award for excellence in the study of health law. Rob earned an MBA from Villanova University and Master of Public Health from Yale University.

More Posts - Website

Tags: , , , , , ,