Category Archives: Health Law

Solo Practitioner Pays $100,000 Settlement to the Office of Civil Rights (OCR) for Self-Reported HIPAA Breach

OCR began investigating the solo practitioner after his medical practice (the “Practice”) filed a breach report with OCR related to the Practice’s dispute with its electronic health record (EHR) provider. The Practice’s breach report alleged that the EHR provider was blocking access to the Practice’s medical records, until the Practice paid the EHR provider $50,000.

Upon receipt of the breach report, OCR initiated a compliance review of the Practice and found that the Practice demonstrated significant noncompliance with the HIPAA rules. Specifically, the OCR investigation determined that the Practice had never conducted a risk analysis at the time of the breach report, and despite significant technical assistance throughout the investigation, had failed to complete an accurate and thorough risk analysis after the breach and failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

In addition to the $100,000 settlement, the Practice entered into a Resolution Agreement with OCR and Corrective Action Plan.

OCR issued a press release regarding the settlement stating: “All health care providers, large and small, need to take their HIPAA obligations seriously,” said OCR Director Roger Severino. “The failure to implement basic HIPAA requirements, such as an accurate and thorough risk analysis and risk management plan, continues to be an unacceptable and disturbing trend within the health care industry.”

The take away “All health care providers, large and small, need to take their HIPAA obligations seriously,” and maybe the age old wisdom, people in glass houses should not throw stones.


A recent whistleblower case led to the filing of a false claims act complaint against Community Health Network (CHN) by the United States of America Department of Justice on January 7, 2020. The complaint, filed in the U.S. District Court for the Southern District of Indiana, alleges that CHN compensated providers significantly over fair market value (FMV) in order to roll up referrals from the provider’s practices in violation of the Stark Law, which prohibits a hospital from billing Medicare for services referred by a physician with whom the hospital has a financial relationship that does not meet any statutory or regulatory exception.

In its complaint, the government alleges that CHN had employment relationships with numerous physicians that did not meet any Stark Law exception, because the compensation paid to the providers by CHN was well above FMV. In addition to the excessive compensation allegation, the complaint alleges that CHN conditioned the physician’s incentive or bonus compensation based on the physician meeting a target of hospital downstream revenue specific to the physician.

According to the complaint, CHN wanted to tie physicians with existing business in lucrative specialties to CHN. A number of the recruited physicians already had medical staff privileges at CHN hospitals and were already referring patients to CHN hospitals. The government complaint states that the physician integration strategy was defensive in nature meaning that CHN recruited and employed the providers to secure their referrals and out of concern that referrals would otherwise leak to CHN’s competition.

The whistleblower provided information to the government suggesting that CHN knew the compensation exceeded FMV and had withheld details of the proposed compensation from FMV consultants in order to obtain a more favorable FMV analysis. The whistleblower also claimed to have documentation showing that CHN executives calculated the provider’s excessive compensation based on the value of expected referrals. The January 6, 2020 amended complaint claims that CHN ignored the consultant’s warnings that the proposed compensation was in excess of FMV.

While the Stark law strictly prohibits a hospital from paying a physician in excess of FMV, the calculation of FMV is subjective and influenced by a wide variety of factors. There can be good reasons for paying a physician in excess of what other doctors are paid. The rationale for paying a physician in excess of what other doctors are paid should be objective, legitimate and well documented.

Hospitals should obtain a FMV analysis of physician compensation arrangements, make sure that the valuator has the necessary information and understands any unique circumstances. Hospitals should consider obtaining the FMV analysis in draft form under attorney-client privilege, in case the valuator failed to consider a relevant factor and meet with the valuator to discuss the valuation, before the analysis is finalized. Finally, it is imperative that hospitals consult with legal counsel throughout the valuation process to assure compliance with legal and regulatory requirements.

Insurers Preempting Upcoming Changes for E/M Visit Documentation

On November 15, 2019, the Centers for Medicare and Medicaid (“CMS”) published the 2020 Physician Fee Schedule Final Rule in the Federal Register. Among the several changes outlined in the rule, this post specifically focuses on the changes to documentation requirements for Evaluation and Management (“E/M”) Visits. The first important note is the CMS will maintain the existing documentation requirements for all E/M codes for the year 2020.

However, in an effort to update the currently applicable guidelines (published in 1995 and 1997), the E/M documentation requirements will be revamped in 2021 for office visits only. In other words, the emergency department E/M code documentation will remain unchanged. But the focus of the E/M code documentation for office visits will be based solely on Medical Decision-Making (“MDM”) or E/M visit time with patient. Continue reading Insurers Preempting Upcoming Changes for E/M Visit Documentation


As physician practices, health care entities, private equity and venture capital firms consider physician practice investments and acquisitions, the players need to address the unique nature of physicians and physician practices in order to assure a successful deal. Peter Drucker is quoted as saying that “Only three things happen naturally in organizations: friction, confusion and underperformance. Everything else requires leadership.” With respect to physician practice investments and acquisitions, communication is key to the ultimate success of the transaction.

Understanding The Deal: Case Study One

Effective communication is absolutely essential. Too often, physician practices view a practice merger or acquisition as easy access to cash, without understanding that the cash comes with a price.

A physician group was selling their practice to a publically traded company. A few members of the group believed that each physician would walk away with a substantial amount of cash with no strings attached. Those physicians told the rest of the group not to worry about the written agreements, as the agreements were just words put on paper by lawyers who did not understand the “real deal”. The “real deal” as described by those physicians was that the non-compete was not enforceable and that there would be no changes to the group or the way the group practiced medicine, despite the written agreement.

Legal counsel, who continuously tried to get the group to focus on the terms of the agreement, was viewed as an obstacle to the cash prize. The group’s legal counsel repeatedly told the group that the buyer would not spend millions of dollars to purchase the practice and then not enforce the non-compete and furthermore, according to the written agreements, there would be changes to the group and the way the group practiced medicine.

The deal makers for the buyer were soft-pedaling the non-compete and the proposed changes in order to make the deal and purchase the practice. Finally, at the urging of the group’s legal counsel, the buyer’s legal counsel stepped in and made it clear to the group that the non-compete would be enforced and that there would be changes.

Once the group understood that the deal on paper was the “real deal”, the physician group negotiated a higher sales price, the physicians who opposed the sale of the practice were provided with a pre-closing exit plan option and the transaction closed. Years later, the practice continues to be successful, because the sellers and the buyers understood the deal and had a meeting of the minds.

What Not To Do: Case Study Two

A health system hospital acquired a large multi-specialty practice. The practice was responsible for the majority of admissions to the hospital. However, the practice had a number of underperforming physicians. Day one after the acquisition, based on the advice of a recent business school graduate, the health system sent 120-day contract termination notices to every one of the practice’s physicians and advised the physicians to reapply for their jobs. The termination notice stated that the physicians were not guaranteed employment and that individual physicians would be notified within 90 days, if they were being rehired. The notice also stated that the terms and conditions of employment, including compensation, would likely be substantially different.

What happened next should not have been a surprise. Many of the physicians immediately began looking for new positions outside the health system. Many physicians, including the entire OB/GYN practice, ended up at a nearby hospital, owned by a competing health system. The acquiring health system went to court seeking an injunction to enforce the non-compete and the providers and their patients went to the media and the court of public opinion. At the preliminary injunction hearing, several pregnant women testified that enforcement of the non-compete would cause irreparable harm to them and furthermore the hospital no longer had the capacity to care for the pregnant women as all of the OB/GYN providers had been terminated by the health system.

In order to avoid an adverse decision, the health system withdrew their preliminary injunction complaint and ceased efforts to enforce the non-compete. While a few physicians stayed with the health system, most went elsewhere and took their patients with them. The physician group disintegrated. The health system lost money and suffered substantial collateral damage from the public outcry.

“The most important thing in communication is to hear what isn’t being said.” Peter Drucker. The health system never shared their plan to terminate all physicians and then selectively rehire physicians post-closing and the physicians assumed that it would be business as usual post-closing. Both the health system and the practice failed to communicate and that failure to communicate quickly doomed the practice acquisition.

The Dog And The Tail: Case Study Three

A large orthopedic practice that owned a specialty hospital, received an unsolicited proposal from a health system to purchase a minority interest in the hospital. The physicians entered into negotiations with the health system. The physicians were in the driver’s seat with respect to negotiations, because the health system wanted the transaction and the physicians did not need the cash. The physicians and their attorney were tough negotiators. At one point, the health system CEO was exasperated and declared that the health system was not going to let the tail wag the dog. The physician’s attorney tried not to laugh-out-loud, but the CEO observed the attorney’s amusement and repeated that the tail was not going to wag the dog. The attorney agreed, but pointed out that while the health system’s CEO was accustomed to being the dog, in this case, the health system was the tail and the physician group was the dog. The transaction closed on the physician’s terms.

The Take Away

Ideally in physician practice investments and acquisitions, neither party feels like the dog or the tail. All parties to the transaction must understand the deal and effectively communicate and agree on plans for the future. Post-closing with respect to physician practice investment and acquisition, the buyer and the seller will continue to work together. Effective communication will minimize the risk of friction, confusion and underperformance.

Skilled Nursing Facilities, Beware of ACOs

Providers in the long term care industry often ask me whether they should sign on with their local accountable care organization (“ACO”). My answer has always been, for years now, absolutely! After all, ACOs can be a good source of referrals for skilled nursing. Plus, a team-oriented ACO can foster better patient care, quality care and wellness in the ACO setting in the community. However, more of our skilled nursing facility clients have been experiencing problems with certain ACOs operating as dictatorships. Perhaps this is because more and more skilled nursing facilities are finally entering the realm of ACO involvement.

While it is good for a skilled nursing facility to be on the ACO’s “A List” of skilled nursing home providers, skilled nursing facilities need to carefully review their contracts with ACOs to make sure they are not taken advantage of or subject to increased liability. For example, recently one skilled nursing facility relationship with its ACO was so strained that it fired its ACO due to problems with patient care.  See Alex Spanko, “How One Skilled Nursing Operator Navigates The Occasional Single ‘Dictatorship’ of ACOs,” Skilled Nursing News, October 16, 2019. In some cases, there were reports that ACOs are placing too much pressure on skilled nursing facilities to discharge residents earlier than indicated, or forcing facilities to provide less care in order to reduce ACO costs, often times to the detriment of residents. Continue reading Skilled Nursing Facilities, Beware of ACOs

New CMS Final Rule Strengthens Enforcement Authorities To Bolster Fraud and Abuse Prevention

On September 5, 2019, the Centers for Medicare and Medicaid Services (“CMS”) issued a final rule that strengthens a number of enforcement measures.  The new rules go into effect beginning November 4, 2019.  The goal for CMS is to keep those providers and suppliers that have committed fraud out of the federal healthcare programs.

For one, the new final rules provide CMS with new revocation and denial authorities, as part of the Provider Enrollment Process, for “affiliations” that pose an undue risk of fraud, waste or abuse. Continue reading New CMS Final Rule Strengthens Enforcement Authorities To Bolster Fraud and Abuse Prevention

Trump Administration Proposes Rule Requiring Hospitals to Disclose Negotiated Rates with Insurers

The rule proposed by the Centers for Medicare and Medicaid Services (CMS) would require that all facilities licensed as hospitals within their respective states (including the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands) disclose their “Standard Charges.” The rule would define “Standard Charges” as the hospital’s gross charge for an item or service as well as the charges that it negotiates with insurance companies and other payors. The rule would require hospitals to publish these “Standard Charges” for at least 300 shoppable services, with the rule defining a “shoppable service” as one that can be scheduled by a healthcare consumer in advance. These pricing disclosures—subject to annual updates—would be required to appear prominently on publicly available websites.

President Trump, who signed an executive order last month calling for changes that would allow healthcare consumers to compare prices for shoppable services, argues that the disclosed price discounts would enhance transparency and enable consumers to make informed, educated choices. The healthcare industry has already voiced opposition to this plan by arguing that the discounted rates are trade secrets or that they promote competition.

A few months ago, the Trump administration made headlines when it took another step aimed at lowering the cost of healthcare; that time, the administration announced a new rule that would require pharmaceutical companies to disclose the prices of prescription drugs in television commercials. The response, by the pharmaceutical industry, was swift, raising a number of arguments in opposition, including that the rule would confuse the public. According to the industry, there would be no practical way to disclose the “price” of a given drug, because different end-user consumers pay different out-of-pocket costs based on varying co-insurance requirements, co-pays, etc. The drug industry also argued that the required disclosure would violate First Amendment free speech protections, and further insisted that the Department of Health and Human Services (HHS) didn’t have the authority to force the pharmaceutical companies to publish their prices in their ads. In that case, pharmaceutical industry representatives, including a number of manufacturers, as well as the Association of National Advertisers, filed suit against the Trump administration to block the rule from taking effect. A federal court sided with the industry, blocking the initiative on the grounds that HHS lacked the requisite regulatory power.

Whether the negotiated rate proposal from CMS will face the same fate as the HHS advertising proposal is unclear. Stakeholders are encouraged to submit comments to the agency. The deadline for comment submission is September 27, 2019.

This blog post was co-authored by Justin M. L. Stern and Ryan Wesley Brown.

Government Accountability Office Focuses on Nursing Home Abuse Reporting

By Susan V. Kayser

On July 23, 2019, the U.S. Senate Finance Committee held a hearing where a representative of the Government Accountability Office testified on elder abuse in nursing homes.  At the hearing, reported at GAO-19-671T, the GAO representative discussed the June 2019 GAO report entitled “Improved Oversight Needed to Better Protect Residents from Abuse” (GAO-19-433).

The GAO analysis of CMS data found that, while relatively rare, abuse deficiencies cited in nursing homes more than doubled, increasing from 430 in 2013 to 875 in 2017, with the largest increase in severe cases. In light of the increased number and severity of abuse deficiencies, GAO testified that, while it is imperative that CMS have strong nursing home oversight in place to protect residents from abuse, there are several oversight gaps that may limit the agency’s ability to do so.  The gaps include:

  1. Information on abuse and perpetrator type is not readily available. CMS does not require state survey agencies to record the type of abuse and perpetrator and, when this information is recorded, it cannot be easily analyzed. Without this information, CMS lacks key information and, therefore, cannot take actions—such as tailoring prevention and investigation activities—to address the most prevalent types of abuse or perpetrators.
  2. Facility-reported incidents lack key information. CMS has not issued guidance on what nursing homes should include when they self-report abuse incidents to state survey agencies. This contributes to delays in state agency investigations and the inability to prioritize investigations for quick response.
  3. Gaps in CMS processes can result in delayed referrals to law enforcement. CMS requires a state survey agency to make a referral to law enforcement only after abuse is substantiated—a process that can often take weeks or months. As a result, law enforcement investigations can be significantly delayed. GAO reported that delay in receiving referrals limits law enforcement’s ability to collect evidence and prosecute cases—for example, bedding associated with potential sexual abuse may have been washed, and a victim’s wounds may have healed.

The report on which the GAO testimony was based made several recommendations, including that CMS:

  • require state survey agencies to submit data on abuse and perpetrator type;
  • develop guidance on what abuse information nursing homes should self-report; and
  • require state survey agencies to immediately refer to law enforcement any suspicion of a crime.

GAO reported that the Department of Health and Human Services concurred with GAO recommendations.

Some in the health care provider sector have raised concern about confusing definitions of the term “abuse,” pointing out that the CMS definition that applies to various types of providers differs from the definition in the Elder Justice Act of 2010, which requires nursing home reporting of certain types of incidents.  As a result, while a nursing home would be obliged to report an incident under the Elder Justice Act, another type of health care provider may not be mandated to do so.

In fall 2019 another GAO report concerning abuse matters is due to be published.  It is expected to compare federal abuse reporting requirements for nursing homes and assisted living residences.

Of course, it remains to be seen whether Congress or CMS will act soon to address issues raised by GAO.

Unclaimed Property and Record Management

As healthcare providers and entities merge, consolidate or close their doors, record management and unclaimed property obligations are among the concerns that must be addressed.

In our experience, many healthcare providers engage in a mild to severe form of hoarding, addressing unclaimed property and record management matters on a regular basis will make the merger, consolidation or practice closure process much easier.

Unclaimed Property

Unclaimed or abandoned property refers to money or property held by the healthcare provider or entity that has generated no activity or had no contact with the owner of the money or property for one year or longer. Common forms of unclaimed property for health care providers include uncashed payroll checks, patient refunds and overpayments, and insurance payments or refunds. State laws require businesses to perform due diligence regarding unclaimed property. Businesses must contact the presumed owner of the unclaimed property and if the owner fails to step forward, the business must turn the unclaimed property over to the state each year.

Unclaimed property is often overlooked or deposited in the provider or healthcare entity’s bank accounts and only comes to the forefront when entities merge, are acquired, stop doing business or when the state exercises its unclaimed or abandoned property audit rights. States have audit rights pertaining to unclaimed or abandoned property and there can be stiff penalties for failing to relinquish unclaimed property. As states look for additional revenue, expect unclaimed property to be increasingly on the radar.

Healthcare providers should routinely examine their books and records and identify unclaimed or abandoned property. Once the unclaimed or abandoned property is identified, the provider should consult legal counsel and follow the state law requirements with regard to the unclaimed or abandoned property. Unclaimed or abandoned property does not belong to the healthcare provider or business and must be returned to the rightful owner or relinquished to the state.

Record Management

Every business needs a records management process. At a minimum, the process should: identify the records to be maintained; specify who is responsible for management of the records; clarify the record retention schedule; address record storage; and address records disposal. Record management should be part of everyday life for healthcare providers and entities. When providers and entities, merge, consolidate or close, record management becomes a front and center concern, particularly if records have not been consistently managed previously.

An interesting related question was recently posted on the American Association of Healthcare Lawyers list serve regarding the liability and responsibility of a business associate (BA) to a patient and/or other third parties as it relates to access to electronic patient records when a covered entity is no longer in existence. The post queried 1) whether the BA was required to keep the records in accordance with the state statute of limitations; 2) whether the BA agreement controlled; and 3) what would happen if the BA was the only entity still in existence with access to the PHI.

My initial thought is that the business associated agreement (BAA) contract terminates when the BA is no longer performing services for or on behalf of the covered entity, so when the covered entity closes, the BA automatically terminates. Standard BAA language generally states, “Upon termination of this Agreement for any reason, business associate shall return to covered entity [or, if agreed to by covered entity, destroy] all protected health information received from covered entity, or created, maintained, or received by business associate on behalf of covered entity, that the business associate still maintains in any form. Business associate shall retain no copies of the protected health information.”

Make sure if you are a BA that the covered entity agrees in the BAA to the destruction of all protected health information received by the covered entity if the covered entity ceases to do business for any reason.

Healthcare M&A Corner – The Escrow Holdback: Another Buyer Security Blanket

In my last post, I discussed the dynamics behind materiality scrapes with respect to purchase agreement representations and warranties, and indemnification provisions.  Another tool utilized by buyer and seller parties to an M&A deal that affects allocation of risk is a concept known as the escrow holdback, normally effectuated through a separate escrow agreement.  While sellers want the entirety of their sale proceeds yesterday, that mindset is not always practical considering the parties’ negotiating positions and resulting leverage.
Continue reading Healthcare M&A Corner – The Escrow Holdback: Another Buyer Security Blanket