There are several measures OCR/HHS has taken to lessen the regulatory burden of HIPAA for health care providers amidst COVID-19. Here is the latest breakdown of important pronouncements and guidance set forth by OCR/HHS to help providers deal with COVID-19 and HIPAA compliance:
Continue reading “OCR Loosens HIPAA Enforcement Amidst Coronavirus Pandemic”
OCR began investigating the solo practitioner after his medical practice (the “Practice”) filed a breach report with OCR related to the Practice’s dispute with its electronic health record (EHR) provider. The Practice’s breach report alleged that the EHR provider was blocking access to the Practice’s medical records, until the Practice paid the EHR provider $50,000.
Upon receipt of the breach report, OCR initiated a compliance review of the Practice and found that the Practice demonstrated significant noncompliance with the HIPAA rules. Specifically, the OCR investigation determined that the Practice had never conducted a risk analysis at the time of the breach report, and despite significant technical assistance throughout the investigation, had failed to complete an accurate and thorough risk analysis after the breach and failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
In addition to the $100,000 settlement, the Practice entered into a Resolution Agreement with OCR and Corrective Action Plan.
OCR issued a press release regarding the settlement stating: “All health care providers, large and small, need to take their HIPAA obligations seriously,” said OCR Director Roger Severino. “The failure to implement basic HIPAA requirements, such as an accurate and thorough risk analysis and risk management plan, continues to be an unacceptable and disturbing trend within the health care industry.”
The take away “All health care providers, large and small, need to take their HIPAA obligations seriously,” and maybe the age old wisdom, people in glass houses should not throw stones.
A recent whistleblower case led to the filing of a false claims act complaint against Community Health Network (CHN) by the United States of America Department of Justice on January 7, 2020. The complaint, filed in the U.S. District Court for the Southern District of Indiana, alleges that CHN compensated providers significantly over fair market value (FMV) in order to roll up referrals from the provider’s practices in violation of the Stark Law, which prohibits a hospital from billing Medicare for services referred by a physician with whom the hospital has a financial relationship that does not meet any statutory or regulatory exception.
In its complaint, the government alleges that CHN had employment relationships with numerous physicians that did not meet any Stark Law exception, because the compensation paid to the providers by CHN was well above FMV. In addition to the excessive compensation allegation, the complaint alleges that CHN conditioned the physician’s incentive or bonus compensation based on the physician meeting a target of hospital downstream revenue specific to the physician.
According to the complaint, CHN wanted to tie physicians with existing business in lucrative specialties to CHN. A number of the recruited physicians already had medical staff privileges at CHN hospitals and were already referring patients to CHN hospitals. The government complaint states that the physician integration strategy was defensive in nature meaning that CHN recruited and employed the providers to secure their referrals and out of concern that referrals would otherwise leak to CHN’s competition.
The whistleblower provided information to the government suggesting that CHN knew the compensation exceeded FMV and had withheld details of the proposed compensation from FMV consultants in order to obtain a more favorable FMV analysis. The whistleblower also claimed to have documentation showing that CHN executives calculated the provider’s excessive compensation based on the value of expected referrals. The January 6, 2020 amended complaint claims that CHN ignored the consultant’s warnings that the proposed compensation was in excess of FMV.
While the Stark law strictly prohibits a hospital from paying a physician in excess of FMV, the calculation of FMV is subjective and influenced by a wide variety of factors. There can be good reasons for paying a physician in excess of what other doctors are paid. The rationale for paying a physician in excess of what other doctors are paid should be objective, legitimate and well documented.
Hospitals should obtain a FMV analysis of physician compensation arrangements, make sure that the valuator has the necessary information and understands any unique circumstances. Hospitals should consider obtaining the FMV analysis in draft form under attorney-client privilege, in case the valuator failed to consider a relevant factor and meet with the valuator to discuss the valuation, before the analysis is finalized. Finally, it is imperative that hospitals consult with legal counsel throughout the valuation process to assure compliance with legal and regulatory requirements.
As physician practices, health care entities, private equity and venture capital firms consider physician practice investments and acquisitions, the players need to address the unique nature of physicians and physician practices in order to assure a successful deal. Peter Drucker is quoted as saying that “Only three things happen naturally in organizations: friction, confusion and underperformance. Everything else requires leadership.” With respect to physician practice investments and acquisitions, communication is key to the ultimate success of the transaction.
Understanding The Deal: Case Study One
Effective communication is absolutely essential. Too often, physician practices view a practice merger or acquisition as easy access to cash, without understanding that the cash comes with a price.
A physician group was selling their practice to a publically traded company. A few members of the group believed that each physician would walk away with a substantial amount of cash with no strings attached. Those physicians told the rest of the group not to worry about the written agreements, as the agreements were just words put on paper by lawyers who did not understand the “real deal”. The “real deal” as described by those physicians was that the non-compete was not enforceable and that there would be no changes to the group or the way the group practiced medicine, despite the written agreement.
Legal counsel, who continuously tried to get the group to focus on the terms of the agreement, was viewed as an obstacle to the cash prize. The group’s legal counsel repeatedly told the group that the buyer would not spend millions of dollars to purchase the practice and then not enforce the non-compete and furthermore, according to the written agreements, there would be changes to the group and the way the group practiced medicine.
The deal makers for the buyer were soft-pedaling the non-compete and the proposed changes in order to make the deal and purchase the practice. Finally, at the urging of the group’s legal counsel, the buyer’s legal counsel stepped in and made it clear to the group that the non-compete would be enforced and that there would be changes.
Once the group understood that the deal on paper was the “real deal”, the physician group negotiated a higher sales price, the physicians who opposed the sale of the practice were provided with a pre-closing exit plan option and the transaction closed. Years later, the practice continues to be successful, because the sellers and the buyers understood the deal and had a meeting of the minds.
What Not To Do: Case Study Two
A health system hospital acquired a large multi-specialty practice. The practice was responsible for the majority of admissions to the hospital. However, the practice had a number of underperforming physicians. Day one after the acquisition, based on the advice of a recent business school graduate, the health system sent 120-day contract termination notices to every one of the practice’s physicians and advised the physicians to reapply for their jobs. The termination notice stated that the physicians were not guaranteed employment and that individual physicians would be notified within 90 days, if they were being rehired. The notice also stated that the terms and conditions of employment, including compensation, would likely be substantially different.
What happened next should not have been a surprise. Many of the physicians immediately began looking for new positions outside the health system. Many physicians, including the entire OB/GYN practice, ended up at a nearby hospital, owned by a competing health system. The acquiring health system went to court seeking an injunction to enforce the non-compete and the providers and their patients went to the media and the court of public opinion. At the preliminary injunction hearing, several pregnant women testified that enforcement of the non-compete would cause irreparable harm to them and furthermore the hospital no longer had the capacity to care for the pregnant women as all of the OB/GYN providers had been terminated by the health system.
In order to avoid an adverse decision, the health system withdrew their preliminary injunction complaint and ceased efforts to enforce the non-compete. While a few physicians stayed with the health system, most went elsewhere and took their patients with them. The physician group disintegrated. The health system lost money and suffered substantial collateral damage from the public outcry.
“The most important thing in communication is to hear what isn’t being said.” Peter Drucker. The health system never shared their plan to terminate all physicians and then selectively rehire physicians post-closing and the physicians assumed that it would be business as usual post-closing. Both the health system and the practice failed to communicate and that failure to communicate quickly doomed the practice acquisition.
The Dog And The Tail: Case Study Three
A large orthopedic practice that owned a specialty hospital, received an unsolicited proposal from a health system to purchase a minority interest in the hospital. The physicians entered into negotiations with the health system. The physicians were in the driver’s seat with respect to negotiations, because the health system wanted the transaction and the physicians did not need the cash. The physicians and their attorney were tough negotiators. At one point, the health system CEO was exasperated and declared that the health system was not going to let the tail wag the dog. The physician’s attorney tried not to laugh-out-loud, but the CEO observed the attorney’s amusement and repeated that the tail was not going to wag the dog. The attorney agreed, but pointed out that while the health system’s CEO was accustomed to being the dog, in this case, the health system was the tail and the physician group was the dog. The transaction closed on the physician’s terms.
The Take Away
Ideally in physician practice investments and acquisitions, neither party feels like the dog or the tail. All parties to the transaction must understand the deal and effectively communicate and agree on plans for the future. Post-closing with respect to physician practice investment and acquisition, the buyer and the seller will continue to work together. Effective communication will minimize the risk of friction, confusion and underperformance.
While it is good for a skilled nursing facility to be on the ACO’s “A List” of skilled nursing home providers, skilled nursing facilities need to carefully review their contracts with ACOs to make sure they are not taken advantage of or subject to increased liability. For example, recently one skilled nursing facility relationship with its ACO was so strained that it fired its ACO due to problems with patient care. See Alex Spanko, “How One Skilled Nursing Operator Navigates The Occasional Single ‘Dictatorship’ of ACOs,” Skilled Nursing News, October 16, 2019. In some cases, there were reports that ACOs are placing too much pressure on skilled nursing facilities to discharge residents earlier than indicated, or forcing facilities to provide less care in order to reduce ACO costs, often times to the detriment of residents. Continue reading “Skilled Nursing Facilities, Beware of ACOs”
On July 23, 2019, the U.S. Senate Finance Committee held a hearing where a representative of the Government Accountability Office testified on elder abuse in nursing homes. At the hearing, reported at GAO-19-671T, the GAO representative discussed the June 2019 GAO report entitled “Improved Oversight Needed to Better Protect Residents from Abuse” (GAO-19-433).
The GAO analysis of CMS data found that, while relatively rare, abuse deficiencies cited in nursing homes more than doubled, increasing from 430 in 2013 to 875 in 2017, with the largest increase in severe cases. In light of the increased number and severity of abuse deficiencies, GAO testified that, while it is imperative that CMS have strong nursing home oversight in place to protect residents from abuse, there are several oversight gaps that may limit the agency’s ability to do so. The gaps include:
The report on which the GAO testimony was based made several recommendations, including that CMS:
GAO reported that the Department of Health and Human Services concurred with GAO recommendations.
Some in the health care provider sector have raised concern about confusing definitions of the term “abuse,” pointing out that the CMS definition that applies to various types of providers differs from the definition in the Elder Justice Act of 2010, which requires nursing home reporting of certain types of incidents. As a result, while a nursing home would be obliged to report an incident under the Elder Justice Act, another type of health care provider may not be mandated to do so.
In fall 2019 another GAO report concerning abuse matters is due to be published. It is expected to compare federal abuse reporting requirements for nursing homes and assisted living residences.
Of course, it remains to be seen whether Congress or CMS will act soon to address issues raised by GAO.
As healthcare providers and entities merge, consolidate or close their doors, record management and unclaimed property obligations are among the concerns that must be addressed.
In our experience, many healthcare providers engage in a mild to severe form of hoarding, addressing unclaimed property and record management matters on a regular basis will make the merger, consolidation or practice closure process much easier.
Unclaimed Property
Unclaimed or abandoned property refers to money or property held by the healthcare provider or entity that has generated no activity or had no contact with the owner of the money or property for one year or longer. Common forms of unclaimed property for health care providers include uncashed payroll checks, patient refunds and overpayments, and insurance payments or refunds. State laws require businesses to perform due diligence regarding unclaimed property. Businesses must contact the presumed owner of the unclaimed property and if the owner fails to step forward, the business must turn the unclaimed property over to the state each year.
Unclaimed property is often overlooked or deposited in the provider or healthcare entity’s bank accounts and only comes to the forefront when entities merge, are acquired, stop doing business or when the state exercises its unclaimed or abandoned property audit rights. States have audit rights pertaining to unclaimed or abandoned property and there can be stiff penalties for failing to relinquish unclaimed property. As states look for additional revenue, expect unclaimed property to be increasingly on the radar.
Healthcare providers should routinely examine their books and records and identify unclaimed or abandoned property. Once the unclaimed or abandoned property is identified, the provider should consult legal counsel and follow the state law requirements with regard to the unclaimed or abandoned property. Unclaimed or abandoned property does not belong to the healthcare provider or business and must be returned to the rightful owner or relinquished to the state.
Record Management
Every business needs a records management process. At a minimum, the process should: identify the records to be maintained; specify who is responsible for management of the records; clarify the record retention schedule; address record storage; and address records disposal. Record management should be part of everyday life for healthcare providers and entities. When providers and entities, merge, consolidate or close, record management becomes a front and center concern, particularly if records have not been consistently managed previously.
An interesting related question was recently posted on the American Association of Healthcare Lawyers list serve regarding the liability and responsibility of a business associate (BA) to a patient and/or other third parties as it relates to access to electronic patient records when a covered entity is no longer in existence. The post queried 1) whether the BA was required to keep the records in accordance with the state statute of limitations; 2) whether the BA agreement controlled; and 3) what would happen if the BA was the only entity still in existence with access to the PHI.
My initial thought is that the business associated agreement (BAA) contract terminates when the BA is no longer performing services for or on behalf of the covered entity, so when the covered entity closes, the BA automatically terminates. Standard BAA language generally states, “Upon termination of this Agreement for any reason, business associate shall return to covered entity [or, if agreed to by covered entity, destroy] all protected health information received from covered entity, or created, maintained, or received by business associate on behalf of covered entity, that the business associate still maintains in any form. Business associate shall retain no copies of the protected health information.”
Make sure if you are a BA that the covered entity agrees in the BAA to the destruction of all protected health information received by the covered entity if the covered entity ceases to do business for any reason.
In my last post, I discussed the dynamics behind materiality scrapes with respect to purchase agreement representations and warranties, and indemnification provisions. Another tool utilized by buyer and seller parties to an M&A deal that affects allocation of risk is a concept known as the escrow holdback, normally effectuated through a separate escrow agreement. While sellers want the entirety of their sale proceeds yesterday, that mindset is not always practical considering the parties’ negotiating positions and resulting leverage.
Continue reading “Healthcare M&A Corner – The Escrow Holdback: Another Buyer Security Blanket”
By Jerome T. Levy and Lauren G. Perry
On June 17, 2019, the New York Legislative session adjourned without passing a bill that would have legalized adult use cannabis in the state. The sponsor of the leading bill in the assembly and Manhattan Democratic Senator, Liz Krueger, announced that there was not sufficient time to gain the support necessary for passage of a bill. Although there appears to be broad popular support for legalization of marijuana in New York, a number of “safety” issues arose, particularly among suburban constituencies relating to concerns such as operation of motor vehicles under the influence of marijuana. Sentiment in suburban areas caused lawmakers from those districts to withhold the support needed, particularly in the state senate. In addition, many blamed the failure on Governor’s Cuomo’s reluctance to give the measure full support. Although the governor had endorsed adult use legalization earlier in the session, and had attempted to include it within the budget bill passed at the end of March, at the critical time before adjournment he appeared to take a hands‑off approach, becoming oddly passive, a pose this activist governor rarely adopts. Continue reading “Effort to Legalize Adult Use of Marijuana Fails in New York State”
Not a week goes by without some mention of the opioid crisis and opioid litigation, including the recent settlement proposal by Purdue Pharma to pay $270 million to resolve a case pending with the State of Oklahoma. Purdue Pharma, the maker of OxyContin®, has had over 1,000 lawsuits filed against it by State and local governments alleging that it caused the opioid crisis. On April 5, 2019, the Illinois Attorney General filed a lawsuit against Purdue Pharma LP and Purdue Pharma Inc. over their alleged roles in the opioid crisis. According to the lawsuit, more than 2,000 Illinois residents died in 2017 alone due to opioid overdoses.
Drug Enforcement Administration (“DEA”) representatives recently advised State regulators that it is turning up the heat to aggressively crack down on a common practice among physicians or practitioners, nurses, and pharmacists who provide Schedule II controlled substances to residents of long-term care facilities (“LTCFs”). The practice involves the admission of a resident to a LTCF after hours and the administration of a Schedule II controlled substance without a valid prescription.
Often, due to the after-hours admission and without a valid prescription, the nurse removes the Schedule II controlled substance from the facility’s emergency box or narcotics box and administers it to the resident. Although convenient for the nurse administering the drug, this practice violates federal law and State law, and can result in any number of legal actions against the physician or practitioner, nurse, administrator, facility, or pharmacist by the DEA, Department of Justice, federal Office of Inspector General, State Department of Professional Regulation, State Medicaid department, and State Department of Public Health, among other federal and State agencies. All health care providers and practitioners should ensure that they are following the law when prescribing, dispensing, or administering controlled substances.
