On October 23, 2019, the U.S. Department of Health and Human Services has imposed a civil money penalty of over $2 million against Jackson Health System in Florida for repeated HIPAA violations.
The HIPAA violations mentioned in the HHS Press Release include: 1-Loss of paper patient records in December 2012; 2-Loss of additional paper patient records in January 2013; 3-A media report containing patient information (a photo shared on social media); 4-Employees accessing the information of one patient without a job related purpose; 5- An employee’s improper access and sale of patient records in 2011.
“OCR’s investigation revealed a HIPAA compliance program that had been in disarray for a number of years,” said OCR Director Roger Severino. The state of the compliance program allowed for the failure of several HIPAA requirements, including provision of timely and accurate HIPAA breach notifications, performance of regular risk assessments, investigation of identified risks, audits of system activity records, and imposing appropriate restrictions on workforce members’ access to patient information. The government’s final determination is available here.
When a HIPAA breach is discovered and reported, the government will often take the time to review a covered entity’s history of compliance or non-compliance. This may include an investigation into prior issues, effectiveness of policies and procedures, and employee issues. Overlooking one suspected breach may result in the imposition of sanctions on any later breach. This is why it’s so important for a healthcare business to understand its HIPAA obligations and take them seriously.
When was the last time your business conducted a security risk assessment to understand its potential risk areas for security breaches? If you’ve never had one, or haven’t had one recently, the time is now to conduct one. “When was your last security risk assessment?” is often the first thing that the government will ask in response to a breach.
Federal fines for noncompliance with HIPAA are based on the level of negligence perceived by the Federal government at the time of the breach. Fines and penalties range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million. Simply put, your healthcare business can’t afford to bury its head and hope that it won’t be hit.
Has your attorney ever told you to do your best to comply with certain safe harbors to the Federal Anti-Kickback Statute, and you’ll be likely to survive scrutiny under the Florida Patient Brokering Act (the PBA)? If you’ve heard that, it’s time to re-examine that relationship. In the last month, the Patient Brokering Act has been amended, and then interpreted by a court of law in a way that affects all healthcare providers.
The Patient Brokering Act has been used in recent years to prosecute abuses in the addiction treatment industry. Other healthcare providers subject to the act have largely been uninvolved in these prosecutions. However, the PBA has been remolded 4 times in the past 5 years as a means to tailor it to allow for prosecutions of bad actors in healthcare, including addiction treatment. One item should be made clear: the PBA applies to any facility at all that is licensed by the Agency for Healthcare Administration (AHCA) or practitioner licensed by the Department of Health (DOH), including physicians, surgery centers, home health agencies, skilled nursing facilities, hospitals, DME providers, diagnostic imaging facilities, clinical laboratories, pharmacies and many other. During the legislative process, barely any healthcare industry representatives (from any provider group) showed up to any legislative workshops or produced counterbalancing input or language proposals that reflected a broader perspective.
Over the past few years, it seems like physician employment agreements are getting shorter and shorter. While I applaud all efforts towards efficiency and economy, you should not always take those documents at face value. For example, I recently reviewed a one page employment contract for a client. That single page basically said, “We are hiring you as our employee for a term of one year, with an annual salary of $$$.”
At first glance, the simplicity of that document might seem refreshing. That’s especially true if you’re worried about how much time it’s going to take for your lawyer to get through it! My client’s second glance revealed a multitude of unanswered (and essential) questions. There was no mention of expected duties, schedules, standards, renewals, terminations, insurance, benefits, vacation time, sick leave, CME, etc. in the employment contract However, when we reviewed the contract together, we discovered that although those points were not even referenced on that single page, they were still legally, “in there.”
Attorneys Susan St. John and Michael Silverman of the Florida Healthcare Law Firm will present this live lunch n’ learn webinar for providers interested in learning more about the direct patient care model. They will discuss the recent legislative updates that have brought this issue to the forefront in Florida.
Further reading per AAFP.org – The direct primary care (DPC) model gives providers a meaningful alternative to fee-for-service insurance billing, typically by charging patients a monthly, quarterly, or annual fee (i.e., a retainer) that covers all or most primary care services including clinical, laboratory, and consultative services, and care coordination and comprehensive care management. Because some services are not covered by a retainer, DPC practices often suggest that patients acquire a high-deductible wraparound policy to cover emergencies. Direct primary care and concierge care are not synonymous. In practices offering concierge care, the patient typically pays a high retainer fee in addition to insurance premiums and other plan obligations (e.g., copays, out-of-pocket expenditures), and the practice continues to bill the patient’s insurance carrier.
Over the past several months, the Centers for Medicare & Medicaid Services (CMS) has taken a number of steps that show an awareness of the regulatory burden placed upon participants in the government’s health care programs, and even some willingness to consider reducing those burdens. While it remains to be seen whether the recent proposals will have measurable results, the following actions can still be viewed with guarded optimism.
Proposed Changes to Medicare
In July, 2018, CMS proposed significant changes to Medicare, to be included in rules that take effect in 2019. These changes cover physician fee schedules, streamlining Evaluation & Management (E&M) billing, advancing “virtual care,” decreasing drug costs, revising the MIPS program and establishing the MAQI demonstration project. The agency also asked for comments on price transparency issues.
A recent ruling by a state trial court handling the Palm Beach County Sober Home Task Force prosecutions against providers of addiction treatment and sober home services is creating lots of confusion and alarm around the state and could have very far reaching consequences for the entire healthcare industry well beyond addiction treatment.
The issue presented by the prosecution focuses on whether a person charged with violating the state’s Patient Brokering Act (PBA) can be found guilty even if he/she didn’t know what he was doing was unlawful. The PBA broadly prohibits paying someone for patient referrals, very much like the federal Anti-Kickback statute. If allowed, the client would have gotten legal advice, paid for it, followed it, and still not be able to show a judge or jury that, despite all their best efforts, they simply followed the law as instructed.
Can a healthcare facility or provider be guilty of violating a criminal law [the PBA] if they’d gotten legal advice and followed it? Traditionally, the answer would be a clear “no.” The argument against the State’s position would be something like “How can someone intend to violate a criminal law if they got legal advice regarding how to comply with it and then followed that advice?” The argument of the state might look something like “We don’t even think the judge or jury ought to be able to hear that the person got legal advice and followed it.” The court punted the issue to the appellate court.
In 2012, the American Hospital Association (AHA) along with three member hospitals filed a lawsuit against the U.S. Department of Health and Human Services (HHS) for the agency’s failure to meet the 90 day decision requirement at the Administrative Law Judge (ALJ) level known as the Office of Medicare Hearings and Appeals (OMHA). Through the years, the case has moved back and forth between a federal district court and federal appeals court in the District of Columbia. Most recently in March, a federal district court judge ordered the AHA to expand on its suggestions it has made over the course of its litigation for how HHS can clear the ever-growing backlog and additionally, explain why the current procedures are insufficient.
Attorneys from the Florida Healthcare Law Firm will hold a live call to present an urgently needed update regarding FARR certification.
The recent petition for Declaratory Statement filed with the Department of Children and Families on behalf of Amethyst Recovery Center focuses on one thing: whether the FARR certification requirements for Recovery Residences also apply to facilities licensed by DCF to provide Day and Night treatment with community housing and to Res-5 housing. A review of FARR recovery residence certification shows that there is significant conflict with DCF requirements for licensure of treatment facilities that have a housing component. There are no referrals to and from the community housing component of Day and Night or for Res 5: patients are simply housed under the DCF licensed component while in treatment. Referrals from Recovery Residences to addiction treatment facilities are generally made for individuals who are seeking treatment, not for housing.
Day and Night Treatment Providers with community housing may make referrals for individuals who have completed inpatient treatment, requiring them to step down to an outpatient provider. Many times, clients desire to live in a recovery residence to maintain their sobriety. In that case, it would be appropriate for the Day and Night Treatment Provider to refer to a FARR-certified recovery residence.
When asked about why Amethyst filed for clarification, Pamela Springer, Chief Operating Officer with Amethyst Recovery Center stated, “Amethyst supports FARR’s mission and the State of Florida’s requirement for recovery residence certification. However, thus far, DCF has indicated to Amethyst Recovery Center that it does not require FARR certification for licensed community housing. FARR has stated to us and other providers that Day and Night treatment with community housing must obtain FARR certification or they will be in violation of the law. This is the reason we sought clarification from DCF”.
If history teaches anything, it’s to learn from it. The addiction treatment industry can’t afford to sit idly by and watch. Uniform application of the law is essential to avoid unfair, unreasonable and unintended results. Step up; show up. Register for FREE: https://attendee.gotowebinar.com/register/4977722626987986435 and stand up for your rights under Florida law.
Effective July 1, 2018, Florida’s recent legislation SB 622 repeals the entirety of Chapter 483, Part I of the Florida statutes, and removes the state licensure requirement for clinical laboratories operating in-state and out-of-state. Section 97 of SB 622, approved by the Governor on March 19, 2018, repeals the entirety of Chapter 483, Part I of the Florida statutes, and so eliminates section 59A-7.024(1).
Health law is the federal, state, and local law, rules, regulations and other jurisprudence among providers, payers and vendors to the healthcare industry and its patient and delivery of health care services; all with an emphasis on operations, regulatory and transactional legal issues.