OCR Announces Two Significant HIPAA Breach Settlements

Posted by Health Law Informer Author on March 21, 2016
HHS, OCR / No Comments

shutterstock_62667685On consecutive days, the Office of Civil Rights (“OCR”) of the Department of Health and Human Services (“HHS”) recently announced two large HIPAA breach settlements. On March 16, 2016, OCR announced that it entered into a Resolution Agreement with North Memorial Health Care of Minnesota for $1.55 million plus a two-year corrective action plan. On March 17, 2016 OCR followed by announcing that Feinstein Institute for Medical research, a New York biomedical research institute, agreed to pay to OCR $3.9 million and enter into a three-year corrective action plan to settle potential HIPAA violations. Both cases resulted from the all too familiar scenario of breaches resulting from stolen, unencrypted laptops.

In the Minnesota hospital breach, the unencrypted laptop containing the PHI of over 9,000 individuals was stolen from the locked car of an employee of a business associate of the hospital. According to the OCR’s investigation, the hospital failed to have a business associate agreement in place with that particular business associate. OCR also alleged that the hospital had not previously performed a risk analysis to identify and address potential risks and vulnerabilities to the ePHI it maintained, accessed or transmitted.

In the New York research corporation breach, OCR alleged that the institution did not have policies and procedures in place, including a policy on encryption and one that addressed use and access of electronic devices (e.g., the removal of the devices from the institution’s facility), nor did it have in place a security management process that sufficiently addressed potential security risks and vulnerabilities to ePHI, namely, its confidentiality, vulnerability or integrity. Notably, the stolen, unencrypted laptop contained the PHI of approximately 13,000 individuals.

As above, both OCR settlements also include multiple year corrective action plans requiring the hospital and research facility to conduct risk analyses/assessments, train their employees, and have HIPAA compliant policies and procedures in place. The Resolution Agreement for the Minnesota hospital breach is available here, and the Resolution Agreement for the New York research institute breach is available here.

Takeaways: The OCR’s 2016 breach enforcement is off to a very strong start with two high dollar settlements. Lessons learned from both breaches include the significance of encrypting electronic devices, conducting and updating on a regular basis security risk assessments and analyses, having adequate safeguards in place to protect PHI, having business associate agreements with all business associates, and having and implementing HIPAA policies and procedures to protect the security and privacy of PHI, including for example, policies related to encryption, authorized access to ePHI/PHI, and removal of electronic devices from facilities.

 

For more information, contact Greg Fliszar, J. Nicole Martin, or a member of Cozen O’Connor’s Health Law team.

 

Tags: , , , , , , , , , , , , , , , , ,

Update No. 2: Is This The Year Florida Recognizes Direct Primary Care?

Posted by Health Law Informer Author on March 14, 2016
primary care / No Comments

House Bill 37 (“HB 37”), a bill intended to codify and regulate direct primary care in the State of Florida, which had sailed through the Florida House with virtually unanimous support, died in the Senate as the legislative clock ran out on it last week. When the Senate failed to take it up for vote before the session expired on March 11th, it had the effect of killing the bill. The 60-day 2017 legislative session begins on March 14, 2017.

 

For more information, please contact Marc I. Goldsand of Cozen O’Connor at mgoldsand@cozen.com or (786) 871-3935, or a member of Cozen O’Connor’s Health Law team.

 

 

Tags: ,

Does Arbitration Belong in the Nursing Home World?

Posted by Health Law Informer Author on March 07, 2016
CMS / No Comments

shutterstock_336389885As part of admission into a nursing home, a facility typically requires prospective residents to agree to binding arbitration. Arbitrating disputes generally allows nursing facilities to handle disputes without incurring the onerous costs – both of time and money – associated with litigation. Nursing facilities, which operate on razor thin margins, consider the costs of litigation to be an unnecessary burden for resolving disputes that could be resolved more efficiently and just as fairly in the arbitration context. Moreover, nursing facilities fear believe that they are not operating on a level playing field in a jury trial, because juries are typically biased in favor of residents and do not understand the constraints under which facilities operate. At the same time, nursing home resident advocates have long argued that use of arbitration in the nursing home setting is a legitimate concern because residents may feel coerced into signing them and may not fully understand the implications of signing such an agreement–that it means they are waiving their right to a jury trial.

Since last year, the use of arbitration agreements in nursing facilities has been in the forefront, both in state courts, and in the July 16, 2015 CMS proposed rule regarding the regulation of nursing homes, where the Centers for Medicare & Medicaid Services (“CMS”) proposed specific requirements regarding arbitration agreements (“Proposed Rule”).

For example, in Wert v. Manorcare of Carlisle PA, LLC (2015 WL 6499141, No. 62 MAP 2014 (Pa. Oct. 27, 2015)), the Pennsylvania Supreme Court addressed the enforceability of a nursing home’s arbitration agreement. While the Wert Court did not squarely address the issue of whether the arbitration clause is void as against public policy, the Wert Court stated it “recognize[s that premising the integrality of a contractual term on the subjective understanding of a far less sophisticated non-drafting party is ill-advised public policy that would further distort an already lopsided balance of power.” Despite the Wert Court’s acknowledgement of this being a public policy concern, the decision turned on the procedural validity of the clause because it required the use of the National Arbitration Forum’s code, which the Wert Court found the clause unenforceable. However, the brief reference to the public policy implications of arbitration agreements suggests that if the actual clause is called into question—other than for procedural reasons—Pennsylvania courts may void them as against public policy. On February 29, 2016, the United States Supreme Court (GGNSC Gettysburg LP v. Wert, U.S., No. 15-820) refused to review the Wert decision. The United States Supreme Court’s refusal is in line with other states as well, which like Pennsylvania, have found such agreements requiring the use of the National Arbitration Forum’s code to govern and address disputes between nursing homes and residents unenforceable.

In contrast, in Carrigan v. Live Oak Nursing Ctr., LLC (2015 WL6692199, No. 2:15–CV–319 (S.D. Tex. Nov. 3, 2015)), a Texas federal court decided late last year that an arbitration agreement signed along with the resident admission agreement was enforceable and that the parties would have to resolve their dispute through arbitration. The Carrigan Court further found that all parties who benefited from the resident admission agreement would be bound by the arbitration clause even though they did not sign it, that is, those parties who were suing to enforce duties under the resident admission agreement—that existed because of the relationship between the former resident and facility under the resident admission agreement—would also be bound by the arbitration agreement.

In the Proposed Rule, CMS expressed concern about the use of arbitration agreements in nursing homes. While soliciting comments on whether binding arbitration agreements should be prohibited, CMS nevertheless proposed a new regulation (42 C.F.R. 483.70(n)) with the following requirements:

  • The agreement is to be explained to the residents who acknowledge that they understand the agreement;
  • The agreement is to be entered into voluntarily;
  • Arbitration sessions be conducted by a neutral arbitrator in a location that is convenient to both parties.
  • Admission to the facility is not contingent upon the resident or the resident representative signing a binding arbitration agreement.
  • The agreement could not prohibit or discourage the resident or anyone else from communicating with federal, state, or local health care or health-related officials, including representatives of the Office of the State Long-Term Care Ombudsman.

Both the Wert case and the Proposed Rule highlight concerns about the use of arbitration agreements in the nursing home world. Given CMS’ expressed concern about them, nursing homes who ask residents to sign binding arbitration agreements would be well advised to look carefully at the process by which the residents agree to binding arbitration and to implement policies that ensure that residents clearly understand what they are signing and that they are not pressured to sign these agreements.

For more information regarding the use of arbitration agreements in the nursing home context, contact J. Nicole Martin or any member of Cozen O’Connor’s healthcare law team.

 

 

Update: Is This The Year Florida Recognizes Direct Primary Care?

Posted by Health Law Informer Author on March 02, 2016
DPC / No Comments

House Bill 37 (“HB 37”) passed the Florida House 116-0 today. In a hostile political environment, the unanimous vote in Florida’s more conservative chamber confirms what many in the direct primary care medical (“DPC”) space already believe: that DPC is not a political issue.

HB 37’s virtually identical Senate counterpart, Senate Bill 132 (“SB 132”), is on that chamber’s “Second Reading” calendar, and also appears to be moving forward. If SB 132 is indeed approved in the coming weeks it will be sent to Governor Scott for his signature. The 2016 legislative session ends on March 11th. This one is going down to the wire.

For more information, please contact Marc I. Goldsand of Cozen O’Connor at mgoldsand@cozen.com or (786) 871-3935, or a member of Cozen O’Connor’s Health Law team.

Finally! CMS Publishes the 60-Day Rule for Reporting and Repaying Medicare Overpayments

Posted by Health Law Informer Author on February 12, 2016
ACA, Affordable Care Act, False Claims Act, Final Rule, Fraud and Abuse / No Comments

After four years and 200 comments, CMS finalized the much‑awaited “60‑Day Rule” for reporting and repaying Medicare Part A and B overpayments (CMS issued a Final Rule related to Medicare part C and D overpayments in the May 23, 2014 Federal Register, 79 FR 29844, and will address Medicaid overpayments in future rulemaking). The 60-Day Rule is part of CMS’s efforts to reduce fraud, waste, and abuse in the Medicare program.

Section 6402(d) of the Affordable Care Act (ACA), created section 1128J(d) of the Social Security Act (codified at 42 U.S.C. 1320a-7k(d)), requiring a person or entity who has received an overpayment to report and return the overpayment to the appropriate entity by the later of: (1) 60 days after the date on which the overpayment was “identified”; or (2) the date any corresponding cost report is due (if applicable). Importantly, the ACA also made reporting and repaying overpayments within 60 days an “obligation” under the False Claims Act (FCA), and therefore subject to FCA liability. Proof of specific intent to defraud the government is not required for a person or entity to be liable under the 60-Day Rule.

The Final Rule slightly relaxes some of the onerous requirements in the 2012 Proposed Rule:

Six Year Lookback Period: CMS responded to numerous comments and concerns that the proposed 10-year look back period for identifying overpayments was too long. The 60-Day Rule changed the lookback period to 6 years, consistent with the statutory limitations for the FCA.

Definition of Identify: CMS acknowledged the numerous comments submitted on what it means to “identify” an overpayment and said, “We agree and have revised the language … to clarify that part of identification is quantifying the amount, which requires a reasonably diligent investigation.” According to CMS, “[t]he Final Rule clarifies that a person has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” CMS warned Medicare providers and suppliers not to use the “ostrich defense”; reasonable diligence includes both proactive compliance activities conducted in good faith by qualified individuals, and good faith investigation of credible information conducted in a timely manner by qualified individuals. Quantification of the amount of the overpayment may be determined using statistical sampling and extrapolation methodologies.

How to Report and Return Overpayments: The Final Rule states that providers and suppliers must use an applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to satisfy the obligation to report and return overpayments.

The Final 60-Day Rule is available at: https://federalregister.gov/a/2016-02789. By way of comparison, the February 16, 2012 Proposed Rule is available at:  https://www.gpo.gov/fdsys/pkg/FR-2012-02-16/pdf/2012-3642.pdf

To learn more about reporting or making repayments under the Final Rule, please contact Ryan Blaney, Dana Petrillo or any member of Cozen O’Connor’s Health Law team.

Tags: , , , , ,

Medical Home Plans Saved Minnesota $1 Billion from 2010-2014

Posted by Health Law Informer Author on February 11, 2016
HCH / No Comments

shutterstock_320140895A five-year study released by the Minnesota Department of Health this week, which recorded reams of data in comparing traditional primary care practice patient and cost results with those of health care home practices (“HCH”), gives a fascinating, data-driven glimpse of patient center medical home plans established within the existing Medicare/Medicaid/third party payor system over a five-year period. The findings are especially notable in that these HCHs remained within the traditional reimbursement system as opposed to a direct primary care medical home practice model, which generally requires the practice to forego traditional insurance and seek payment only from the patient.

Some notable results:

  • HCHs had significant and substantial savings on their Medicare, Medicaid, and Medicare/Medicaid dual-eligible patients compared to non-HCHs between 2010 and 2014.
  • HCHs had lower costs.
  • In the subject population, there was a major decrease in the use of hospital services, which was the primary driver of cost savings.
  • In the subject population, there was a modest decrease in prescription drug use.
  • HCHs generated over $1 billion in savings.

The full study is available here.

For more information about this blog, please contact Marc I. Goldsand, Esq., or another member of Cozen O’Connor’s Health Care team.

Tags: , ,

Will Congress Come Together for Telemedicine?

Posted by Health Law Informer Author on February 05, 2016
Healthcare, Medicare, Telehealth, Telemedicine / No Comments

Consistent with what we have been seeing in our own practice, and consumers’ growing demand for better access to telemedicine services, a bi-partisan movement is growing in both houses of Congress to expand telehealth services, improve health outcomes, and reduce healthcare costs. On Wednesday February 5, 2016, U.S. Senators Brian Schatz (D-Hawaii), Roger Wicker (R-Miss.), Thad Cochran (R-Miss.), Ben Cardin (D-Md.), John Thune (R-S.D.), and Mark Warner (D-Va.) introduced the Creating Opportunities Now for Necessary and Effective Care Technologies (CONNECT) for Health Act (s. 2484), which seeks to overhaul Medicare’s treatment of the practice of telemedicine and its related technologies. Companion legislation was introduced in the House of Representatives by U.S. Reps. Diane Black (R-TN), Peter Welch (D-VT), and Gregg Harper (R-MS). According to the Senate bill’s sponsors, the CONNECT for Health Act would:

  1. Create a bridge program to help providers transition to the goals of the Medicare Access and CHIP Reauthorization Act (MACRA) and the Merit-based Incentive Payment System (MIPS) through using telehealth and RPM without most of the 1834(m) restrictions contained in the aforementioned Senate bill;
  2. Allow telehealth and Remote Patient Monitoring to be used by qualifying participants in alternative payment models, without most of the aforementioned 1834(m) restrictions;
  3. Permit the use of remote patient monitoring for certain patients with chronic conditions;
  4. Allow, as originating sites, telestroke evaluation and management sites; Native American health service facilities; and dialysis facilities for home dialysis patients in certain cases;
  5. Permit further telehealth and RPM in community health centers and rural health clinics;
  6. Allow telehealth and RPM to be basic benefits in Medicare Advantage, without most of the aforementioned 1834(m) restrictions; and
  7. Clarify that the provision of telehealth or RPM technologies made under Medicare by a health care provider for the purpose of furnishing these services shall not be considered “remuneration.”

So far, the following organizations have publically endorsed the bill:

  • AARP
  • ACT | The App Association
  • Airstrip
  • Alliance for Aging Research
  • Alliance for Connected Care
  • Alliance of Community Health Plans (ACHP)
  • Alzheimer’s Foundation of America
  • America’s Essential Hospitals (AEH)
  • America’s Health Insurance Plans (AHIP)
  • American Academy of Neurology (AAN)
  • American Academy of Physician Assistants (AAPA)
  • American Association of Diabetes Educators (AADE)
  • American Heart Association/American Stroke Association (AHA)
  • American Medical Association (AMA)
  • American Medical Group Association (AMGA)
  • American Nurses Association (ANA)
  • American Occupational Therapy Association (AOTA)
  • American Osteopathic Association (AOA)
  • American Psychological Association (APA)
  • American Society of Nephrology (ASN)
  • American Telemedicine Association (ATA)
  • American Well
  • Anthem
  • Association for Ambulatory Behavioral Healthcare
  • Association for Behavioral Health and Wellness (ABHW)
  • CAPG
  • Cerner
  • DaVita
  • Federation of State Medical Boards (FSMB)
  • Hawaii Medical Service Association (HMSA)
  • Health Care Chaplaincy Network
  • Healthcare Leadership Council (HLC)
  • Healthcare Information and Management Systems Society (HIMSS)
  • Intel
  • Kaiser Permanente
  • LifeWIRE
  • NAADAC
  • National Association for Home Care & Hospice
  • National Association for the Support of Long Term Care (NASL)
  • National Association of ACOs (NAACOS)
  • National Association of Community Health Centers (NACHC)
  • National Council for Behavioral Health
  • National Council of State Boards of Nursing (NCSBN)
  • National Health IT Collaborative for the Underserved
  • Personal Connected Health Alliance (PCHA)
  • Population Health Alliance
  • Qualcomm Incorporated (and Qualcomm Life)
  • Telecommunications Industry Association (TIA)
  • The ERISA Industry Committee (ERIC)
  • The Evangelical Lutheran Good Samaritan Society
  • The Jewish Federations of North America
  • Third Way
  • University of Mississippi Medical Center (UMMC) Center for Telehealth
  • University of Pittsburgh Medical Center (UPMC)
  • University of Virginia (UVA) Center for Telehealth

The full text of the bill can be found here.

Tags: , , ,

Is This The Year Florida Recognizes Direct Primary Care?

Posted by Health Law Informer Author on February 03, 2016
Affordable Care Act, DPC, Healthcare / No Comments

shutterstock_128160911Florida House Bill 37 and Florida Senate Bill 132, similar bills aiming to expressly authorize and regulate direct primary care medical home plans in the State of Florida (“DPCs”) and both stating that DPCs are not “insurance” under State law, have been smoothly sailing through committees in their respective chambers. The House Bill has already passed through the Select Committee on Affordable Healthcare Access, the Finance and Tax Committee, and the Health and Human Resources Committee. Its next step is a vote in front of the entire House. The Senate Bill cleared the Health and Policy Committee, but no word yet from the Banking and Insurance and Fiscal Policy Committees. At some point before the session ends on March 11, 2016, if they continue to move forward, the bills will be consolidated and approved by both chambers, after which the final bill will be subject to approval or veto of Governor Rick Scott. Passage is by no means certain, but there appears to be an appetite for this law with – so far – no real opposition this year.

 DPCs are private payment agreements between primary care physicians and their patients, whereby patients typically pay low dollar (perhaps $75 to $100) monthly payments directly to the provider for primary care services, in lieu of typical insurance covering primary care services.  In return for the monthly payments (which are easily collected by credit card or cash, without the need for insurance/managed care code-based reimbursement billing), primary care providers offer at little or no additional charge an array of primary care services to the member patients. When paired with a high-deductible “wrap-around” insurance policy, the DPCs comport with the requirements of the Affordable Care Act.     

 

Tags: , , , ,

Gun Control and HIPAA

Posted by Health Law Informer Author on January 06, 2016
HHS, OCR / No Comments

shutterstock_320073545In the wake of recent gun violence and in a concerted effort to protect public safety, the Department of Health and Human Services (HHS) released a final rule published in the Federal Register January 6, 2016, that modifies the HIPAA Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of persons who are subject to a Federal “mental health prohibitor” that would prevent such individuals from possessing a firearm (“Final Rule”). The covered entities are those that have “lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of NICS reporting purposes.”

The Final Rule, which will appear at 42 C.F.R § 164.512(k)(7), adopted what HHS had initially proposed in April 2013 in its proposed rule. The purpose of the Final Rule is to afford the NICS with the ability to identify individuals subject to this prohibitor for the purpose of disqualifying them from shipping, transporting, possessing or receiving a firearm. Individuals subject to the Federal mental health prohibitor include those who have been involuntarily committed to a mental health institution, found incompetent to stand trial or not guilty by reason of insanity, or have been determined by a court or other lawful authority to be a danger to themselves or others or being unable to manage their own affairs. The disclosures to the NICS will be restricted to limited demographic and other information required by the NICS. Further, the Final Rule specifically prohibits the disclosure of any diagnostic or clinical information and “any mental health information beyond the indication that the individual is subject to the Federal mental health prohibitor.”

Importantly, the Final Rule’s express permission to disclose/report is narrowly tailored. Specifically, it does not extend to covered entities permission to report to the NICS the protected health information of individuals who are subject to the State-only mental health prohibitors. Additionally, the permission is not extended to “most treating providers”, which emphasizes HHS’ intention to protect the privacy of the patient-provider relationship.

A key tension at the heart of the gun control issue for years has been how to adequately protect individual privacy, in particular, mental health information, and maintain public safety. Not surprisingly, the Final Rule’s publication comes at a time of heightened tension between these issues, and President Obama announced yesterday that under his executive actions on guns, the administration will, among other actions, seek to expand mandatory background checks for certain private gun sales.

The Final Rule is effective February 5, 2016, 30 days from its publication in the Federal Register. To learn more about reporting under the Final Rule and the amended HIPAA regulation, please contact Greg Fliszar, J. Nicole Martin or any member of Cozen O’Connor’s Health Care team.

Tags: , , , , , , ,

Health Law Year in Review

Posted by Chris Raphaely on December 17, 2015
Uncategorized / No Comments

IMG_1128On Tuesday, December 8 Cozen O’Connor’s Health Care practice and industry team hosted the Health Law Year in Review, an annual discussion of hot topics facing those in the health care industry.

Presentation topics included:

  • Update from Washington, DCHavi Glaser discussed the Affordable Care Act five years in and provided updates. She also gave a forecast of what is likely to happen in 2016 and discussed pharmaceutical pricing.
  • The Move to Pay for Value ReimbursementChris Raphaely discussed changes to how we pay for health care services and pay providers. He also discussed new initiatives, including ACOs, risk arrangements, readmission penalties, care management fees, capitation, bundled payments, quality incentives and patient experience.
  • Employment UpdateDebra Friedman looked back at hot employment issues from 2015 and forward to issues that may come up in 2016, including wellness programs and wage and hour developments impacting health care providers.
  • Are You Protecting Your Intellectual Property?Kyle Vos Strache looked at the different types of intellectual property and how each can increase a company’s value and mitigate risk.
  • Hot Tax TopicsRichard Silpe talked about the 2018 Cadillac Tax, final regulations under IRC Section 501(r) and the tax implications of the case involving Morristown Memorial Hospital determining whether the hospital was non-profit or for-profit.
  • Trends in Concierge Medicine and Alternative Payment Methods – Marc Auerbach discussed the three models of concierge medicine, traditional, hybrid and direct primary care medical home, and the benefits of choosing each.
  • Antitrust Developments in Health CareJonathan Grossman led a discussion on the recently announced mergers of Aetna/Humana and Anthem/Cigna. He also discussed the Supreme Court’s limit of state action immunity in NC Dental and the continuing aggressive federal and state antitrust enforcement.
  • Cybersecurity and Health CareRyan Blaney and Gregory Fliszar discussed cybersecurity risks and best practices and the steps to take for compliance.
  • M&A UpdateAnna McDonough and Trey Crabb (Ziegler Investment Banking) talked about recent trends in health care transactions.

IMG_1137For more information about any of the topics listed above, or copies of the presentations, please click the speaker’s name to be directed to their biography. Please click here to be added to our health care alert list to read about new developments and to receive invitations to upcoming seminars and webinars.