Health law is the federal, state, and local law, rules, regulations and other jurisprudence among providers, payers and vendors to the healthcare industry and its patient and delivery of health care services; all with an emphasis on operations, regulatory and transactional legal issues.
On October 23, 2019, the U.S. Department of Health and Human Services has imposed a civil money penalty of over $2 million against Jackson Health System in Florida for repeated HIPAA violations.
The HIPAA violations mentioned in the HHS Press Release include: 1-Loss of paper patient records in December 2012; 2-Loss of additional paper patient records in January 2013; 3-A media report containing patient information (a photo shared on social media); 4-Employees accessing the information of one patient without a job related purpose; 5- An employee’s improper access and sale of patient records in 2011.
“OCR’s investigation revealed a HIPAA compliance program that had been in disarray for a number of years,” said OCR Director Roger Severino. The state of the compliance program allowed for the failure of several HIPAA requirements, including provision of timely and accurate HIPAA breach notifications, performance of regular risk assessments, investigation of identified risks, audits of system activity records, and imposing appropriate restrictions on workforce members’ access to patient information. The government’s final determination is available here.
When a HIPAA breach is discovered and reported, the government will often take the time to review a covered entity’s history of compliance or non-compliance. This may include an investigation into prior issues, effectiveness of policies and procedures, and employee issues. Overlooking one suspected breach may result in the imposition of sanctions on any later breach. This is why it’s so important for a healthcare business to understand its HIPAA obligations and take them seriously.
When was the last time your business conducted a security risk assessment to understand its potential risk areas for security breaches? If you’ve never had one, or haven’t had one recently, the time is now to conduct one. “When was your last security risk assessment?” is often the first thing that the government will ask in response to a breach.
Federal fines for noncompliance with HIPAA are based on the level of negligence perceived by the Federal government at the time of the breach. Fines and penalties range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million. Simply put, your healthcare business can’t afford to bury its head and hope that it won’t be hit.
HHS found that a home health agency incorrectly billed Medicare and did not comply with Medicare Billing requirements for beneficiaries that were not homebound and for others that did not require skilled services at all.
In August and September 2018, physicians and the owner of a home health agency were each sentenced on multiple counts of conspiracy and healthcare fraud and ordered to pay $6.5 million in restitution. One physician was sentenced to 132 months in prison following trial. A physician who pled guilty was sentenced to 27 months in prison following a guilty plea. The home health agency owner was sentenced to 42 months in prison. The defendants paid and received kickbacks in exchange for patients and billed Medicare more than $8.9 million for services that were medically unnecessary, never provided, and/or not otherwise reimbursable. Additionally, certain defendants provided prescriptions for opioid medications to induce patient participation in the scheme.
In September 2018, the co-owner and administrator of a home health agency was sentenced to 24 months in prison, ordered to pay over $2.2 million in restitution, and ordered to forfeit over $1.1 million. The co-owners participated in a home healthcare fraud conspiracy that resulted in Medicare paying at least $2.2 million on false and fraudulent claims. The owners and their co-conspirators paid kickbacks to doctors and patient recruiters in exchange for patient referrals, billed Medicare for services that were medically unnecessary, and caused patient files to be falsified to justify the fraudulent billing.
Back in February 2018, the owner of more than twenty home health agencies was sentenced to 240 months in prison and ordered to pay $66.4 million in restitution, jointly and severally with his co-defendants, after pleading guilty to one count of conspiracy to commit health care fraud and wire fraud. A patient recruiter for the home health agencies, who also owned a medical clinic and two home health agencies of her own, was sentenced to 180 months in prison. Another patient recruiter, who also was the owner of two home health agencies, was sentenced to 115 months in prison. These conspirators paid illegal bribes and kickbacks to patient recruiters in return for the referral of Medicare beneficiaries many of whom did not need or qualify for home health services. Medicare paid approximately $66 million on those claims.
Illegal kickbacks in exchange for referrals of Medicare beneficiaries, lack of medical necessity for home health services, failing to meet the guidelines, fraudulent billing, billing for services beneficiaries did not receive and fraudulent documentation continues to plague the home healthcare industry.
If you have ever been the recipient of a Florida state agency’s (i.e. Department of Health, AHCA, etc.) notice regarding an adverse action, such as a Notice of Intent to Deny, licensure application, renewal or change of ownership, you probably received an Election of Rights form along with the agency’s notice. The Election of Rights form must be completed and returned to the agency within 21 days of receiving the agency’s notice. In completing the Election of Rights form, you are given three options to choose from in deciding how you want to respond to the agency’s notice.
Under Option One you admit to the allegations of facts and law contained in the agency’s notice of intended action and waive the right to object and have a hearing. This is akin to an admission of guilt, that the agency is right in its decision, and you agree to a final order that supports the agency’s actions, including imposition of fines and punishment against you. Option One is generally not in your best interest. read more
As you have probably heard, Governor Scott signed Senate Bills 6A and 8A on June 23, 2017. What this means for practitioners is an increased opportunity to help patients that might derive benefit from treatment with medical marijuana. However, with increased opportunity comes increased scrutiny. Although these laws open up treatment options, practitioners need to ensure they strictly abide by the statutes and rules to be implemented by the Department of Health (“Department”). The Department has already published notice of the first conference call on Senate Bill 8A and emergency rule making authority, with the first conference call scheduled for Friday, July 14, 2017. Practitioners should also keep in mind that marijuana is still a schedule 1 controlled substance under federal law, thus, insurance companies are not covering treatment with medical marijuana. read more
A new law passed by the Florida Legislature shaves off some of the sharp edges of Florida law that applies to physicians who are impaired by substance abuse or mental illness. The hub of treatment referenced in the law is the Impaired Practitioner Program (IPP). Over the years, the IPP (a quasi-governmental entity) has come under fire for being too aggressive in how it deals with impaired physicians, by acting more like law enforcement than a healthcare provider. Allegations in the past include physicians feeling “hauled off” to treatment before the demonstrated need was clear and being directed to providers that were expensive or inconvenient with reasonable alternatives exist.
The new law rounds out the IPP operations in creating additional accountability through the appointment by the Department of Health (DOH) of one or more consultants. It also:
allows certain providers to report an impaired practitioner to a consultant instead of the DOH. Some in the program felt they were being leveraged into cooperating when they felt it was counter-indicated. This measure might help balance the issues by interposing an independent consultant that is not under the IPP;
prevents the consultant from reporting to DOH a practitioner who is self referring for treatment, but keeps intact features of accountability to help ensure the practitioner completes treatment;
requires the consultant to copy the patient and any legal representative on any information release; and
protects the consultant by extending sovereign immunity to him/her.
Healthcare professionals interacting with the IPP need to know their rights and options. The new law helps facilitate that.
It’s that time of year. People are scrambling around, deciding what they want to give and what they want to get. Brand new packages are being wrapped up and filed away. Excitement and tension fill the air. Everyone can’t wait for the big day; but in this season that big day doesn’t happen until the first Tuesday after the first Monday in March. But it’s never too early to start getting ready, right? In fact, the Florida Legislature is currently in session, drafting and filing bills that the sponsors hope will be considered in March and will become law in 2016. And as usual, health care is on a lot of legislative wish lists. Although all of these bills are subject to significant revision, and some may never make it out of a subcommittee, here’s a sneak peek of some of the proposed health care legislation (without editorial – for now).
Scope of Practice Expansion
Three categories of health care professionals may see significant expansion of the scope of their practice.
Both Advanced Registered Nurse Practitioners and Physician Assistants would gain the right to prescribe controlled substances pursuant to Senate Bill 676. Most of the details about specific medications and dosages is left to an administrative committee, but the bill seems to anticipate broad authority. The bill also adds references to ARNPs and PAs throughout the Florida Statutes, indicating a willingness to accept these professionals into a significant role in the delivery of care. Additionally, SB 572 would add PAs and ARNPs to the list of providers who can certify that an individual meets Baker Act criteria to justify a patient’s involuntarily confinement for mental health reasons. read more
Section 13411 of the HITECH Act authorizes and requires the Department of Health & Human Services Office for Civil Rights (“OCR”) to provide for periodic audits to ensure that covered entities and business associates comply with the HIPAA Privacy and Security Rules. OCR conducted its first round of those audits in 2011 and 2012, and has announced that it will begin a second phase. Unlike the first phase of audits, which were limited to covered entities, both covered entities and business associates are intended to be audited during this second phase.
How will audited businesses be selected?
This fall, OCR will deliver pre-audit surveys to between 550 and 800 covered entities. OCR is attempting to obtain a fair snapshot of all covered entities, so these pre-audit surveys will be sent to health care providers, health plans, and health clearinghouses. Moreover, the audits will span the gamut of business sizes, from large corporations to solo practitioners. After pre-audit surveys are returned, OCR will randomly select 350 of those covered entities for a full audit. As a part of these full audits, covered entities will be asked to identify their business associates. OCR will then select 50 business associates to participate. read more
The Federal Government lists marijuana as a “Schedule I” controlled substance, meaning it has a high potential for abuse and no currently accepted medical use. 21 USC § 812(b)(1). Because there is no current accepted medical use, Federal law prohibits physician from issuing prescriptions for marijuana. 21 CFR § 1306.04(a). However, the Federal Government has traditionally deferred to the States to prosecute small-scale marijuana violations. This lack of Federal enforcement has encouraged the States to enact less stringent controls on the marijuana industry. read more
Since its passage in 1989, the now ubiquitous federal law known as the Stark Law has driven the business behavior of health care providers of many kinds. Recent developments, however, make us wonder whether the end of Stark is near, and if so, whether that’s a good thing.
By way of background, the Stark law has two components: part one, a self referral prohibition, generally forbids physicians from referring to a provider of any “designated health service” (DHS) (e.g. MRI, PT, clinical lab) if the physician or his/her immediate family member has a financial relationship (including ownership interest) with the provider of the service. Part two mandates that certain compensation arrangements between healthcare providers meet certain requirements. Things like medical director agreements, management agreements, employment and independent contractor arrangements have been regulated by the law since its inception. Most notably, for purposes of this article, one provision (the “In Office Ancillary Services” exception or “IOAS”, also known as the “Group Practice Exception”) has allowed medical practices to provide all sorts of “ancillary services” to their own patients. That is the key aspect of the law that is lately coming under serious attack. read more