Healthcare Law Blog

New Guidance Maps HIPAA Security Rule to NIST Cybersecurity Framework to Help Providers Manage Cybersecurity Risk

In a world of looming data breaches and significant penalties for the release of protected health information, the complexities of cybersecurity and compliance with the HIPAA Security Rule can be incredibly daunting. In 2014, in response to the growing threat of data breaches, the National Institute of Standards and Technology (“NIST”) released the Framework for Improving Critical Infrastructure Cybersecurity (“the Framework”) as a means to standardize best practices in cybersecurity across organizations. To assist providers with implementing the Framework while remaining in compliance with the HIPAA Security Rule, the Department of Health and Humans Services Office for Civil Rights (“OCR”) published a HIPAA Security Rule Crosswalk (“the Crosswalk”) to tie the standards together and help strengthen cybersecurity preparedness. More >

CMS finalizes the 60-day overpayment rule and providers can breathe a little easier

The wait is over – in February, the Centers for Medicare & Medicaid Services (“CMS”) released its Final Rule on identifying, reporting, and returning overpayments to the Medicare and Medicaid programs. This rule is the result of provisions in the Patient Protection and Affordable Care Act (“ACA”) which created a 60-day safe harbor during which providers can identify overpayments by the two major federal healthcare programs. If a provider fails to report an overpayment within 60 days of the date that it was identified, the overpayment may be considered a violation of the federal False Claims Act (“FCA” - for more information on the FCA, please read my earlier blog posts). The Final Rule implementing this provision became effective on March 14, 2016. More >

CDC Releases New Guidelines for Prescribing Opioids for Chronic Pain

This week, the Centers for Disease Control and Prevention released new guidelines for the prescribing of opioids for treatment of chronic pain. The guidelines can be found here:

http://www.cdc.gov/mmwr/volumes/65/rr/rr6501e1.htm

Resources for healthcare providers regarding the guidelines can be found here:

http://www.cdc.gov/drugoverdose/prescribing/resources.html

Supreme Court Rejects Private Suits to Challenge Medicaid Rate Reductions

One of the areas of healthcare impacted heavily by the Great Recession beginning in 2007 was Medicaid reimbursement. Cash-strapped states, in an attempt to alleviate budgetary issues, reduced Medicaid provider reimbursement rates. These rates often fell below the actual cost of care to the providers themselves, which in turn limited the ability of providers to provide care and Medicaid beneficiaries to access care. In response, healthcare providers challenged these rate cuts using a provision of federal law that requires states that accept Medicaid funds to “assure that payments…are sufficient to enlist enough providers so that care and services are available under the plan at least to the extent that such care and services are available to the general population of the geographic area.”[1] Over the years, providers have mounted challenges to rates using this provision – referred to colloquially as Section 30(a) – with varied results as the law itself change over the years. With the decision in Armstrong v. Exceptional Child Center, Inc.,[2] in March of 2015, however, the U.S. Supreme Court effectively ended the use of Section 30(a) as a viable means to challenge reduced reimbursement rates.

[1] 42 U.S.C. §1396a(a)(30)(A).

[2] Armstrong v. Exceptional Child Center, Inc., 135 S.Ct. 1378 (2015). More >