Healthcare Law Blog

OCR Updates HIPAA Audit Protocol for Phase 2

Recently, the Office of Civil Rights (“OCR”) provided an updated protocol that it will use when assessing compliance with HIPAA rules. OCR recently began Phase 2 of its HIPAA compliance audits, extending coverage of these audits to Business Associates (“BAs”) as well as Covered Entities (“CEs”). Both BAs and CEs should pay particular attention to these revised audit protocols, as they indicate exactly what OCR will be looking for when conducting these audits. More >

CMS Issues Proposed Rule to Cast a Wide Program Integrity Net

On March 1, 2016, the Centers for Medicare & Medicaid Services (“CMS”) quietly issued a proposed rule that would give the agency far-reaching tools in the area of program integrity enforcement. On its face, the Rule addresses enrollment and revalidation reporting requirements for Medicare, Medicaid and CHIP, but it also significantly increases its authority with regard to the denial or revocation of providers’ Medicare enrollment. More >

Good News, Providers: A Mere Difference of Medical Opinion Does Not A False Claim Make

FINALLY, some good news for providers related to false claims. In a very important Alabama case, a federal trial court granted summary judgment to AseraCare, Inc., in a False Claims Act[1] action where it had been alleged that the hospice program had knowingly submitted false claims to Medicare for patients who were allegedly not terminally ill. In its opinion, the U.S. District Court ruled that the Government may not prove falsity for purposes of the False Claims Act based solely upon the opinion of one medical expert who disagrees with the certifying physician and the patient's treating physicians about whether the medical records reported eligibility for the hospice benefit. In a ruling that all health providers can cheer, the court held that "[a] mere difference of opinion between physicians, without more, is not enough to show falsity."[2]

[1] 31 U.S.C. §§ 3729–3733

[2] United States v. AseraCare, lnc., No. 2:12-CV-245-KOB (MD

Alabama March 31, 2016) at 2. More >

HHS Finalizes Exception to HIPAA Privacy Rule for Firearm Background Checks

In January of 2016, the Department of Health & Human Services (“HHS”) issued a final rule modifying the HIPAA Privacy Rule.[1] This modification allows certain covered entities to disclose the identities of certain individuals to the National Instant Criminal Background Check System (“NICS”), a database maintained by the FBI. The information disclosed by the entities would pertain to an individual’s mental health, preventing those subject to a federal “mental health prohibitor” from possessing or receiving a firearm. Such a disclosure naturally creates a tension in the patient-provider relationship, however, and critics contend it could potentially discourage mentally ill individuals from seeking treatment.

[1] 45 C.F.R. §164 (2016) More >

New Stark Law Exception Breathes Life into Primary Care, Especially in Underserved Areas

With the recent and significant shortages of primary care providers, the Centers for Medicare & Medicaid Services (“CMS”) recently created a rather important exception to the Stark Law as a means to expand access to primary care and mental health care through incentives for non-physician practitioners.  The Stark Law prohibits referrals for Medicare and Medicaid services from physicians to other entities if the physician has a financial relationship with that entity, such as ownership, investment or a structured compensation arrangement. Under the new exception, hospitals, federally qualified health centers (“FQHCs”) and rural health clinics (“RHCs”) may give financial assistance to a physician or a physician practice to hire a non-physician provider (“NPP”), and this relief opens the door for expanded practices in primary care and mental health at a time when the need is critical. More >

New Guidance Maps HIPAA Security Rule to NIST Cybersecurity Framework to Help Providers Manage Cybersecurity Risk

In a world of looming data breaches and significant penalties for the release of protected health information, the complexities of cybersecurity and compliance with the HIPAA Security Rule can be incredibly daunting. In 2014, in response to the growing threat of data breaches, the National Institute of Standards and Technology (“NIST”) released the Framework for Improving Critical Infrastructure Cybersecurity (“the Framework”) as a means to standardize best practices in cybersecurity across organizations. To assist providers with implementing the Framework while remaining in compliance with the HIPAA Security Rule, the Department of Health and Humans Services Office for Civil Rights (“OCR”) published a HIPAA Security Rule Crosswalk (“the Crosswalk”) to tie the standards together and help strengthen cybersecurity preparedness. More >

CMS finalizes the 60-day overpayment rule and providers can breathe a little easier

The wait is over – in February, the Centers for Medicare & Medicaid Services (“CMS”) released its Final Rule on identifying, reporting, and returning overpayments to the Medicare and Medicaid programs. This rule is the result of provisions in the Patient Protection and Affordable Care Act (“ACA”) which created a 60-day safe harbor during which providers can identify overpayments by the two major federal healthcare programs. If a provider fails to report an overpayment within 60 days of the date that it was identified, the overpayment may be considered a violation of the federal False Claims Act (“FCA” - for more information on the FCA, please read my earlier blog posts). The Final Rule implementing this provision became effective on March 14, 2016. More >

CDC Releases New Guidelines for Prescribing Opioids for Chronic Pain

This week, the Centers for Disease Control and Prevention released new guidelines for the prescribing of opioids for treatment of chronic pain. The guidelines can be found here:

http://www.cdc.gov/mmwr/volumes/65/rr/rr6501e1.htm

Resources for healthcare providers regarding the guidelines can be found here:

http://www.cdc.gov/drugoverdose/prescribing/resources.html

Supreme Court Rejects Private Suits to Challenge Medicaid Rate Reductions

One of the areas of healthcare impacted heavily by the Great Recession beginning in 2007 was Medicaid reimbursement. Cash-strapped states, in an attempt to alleviate budgetary issues, reduced Medicaid provider reimbursement rates. These rates often fell below the actual cost of care to the providers themselves, which in turn limited the ability of providers to provide care and Medicaid beneficiaries to access care. In response, healthcare providers challenged these rate cuts using a provision of federal law that requires states that accept Medicaid funds to “assure that payments…are sufficient to enlist enough providers so that care and services are available under the plan at least to the extent that such care and services are available to the general population of the geographic area.”[1] Over the years, providers have mounted challenges to rates using this provision – referred to colloquially as Section 30(a) – with varied results as the law itself change over the years. With the decision in Armstrong v. Exceptional Child Center, Inc.,[2] in March of 2015, however, the U.S. Supreme Court effectively ended the use of Section 30(a) as a viable means to challenge reduced reimbursement rates.

[1] 42 U.S.C. §1396a(a)(30)(A).

[2] Armstrong v. Exceptional Child Center, Inc., 135 S.Ct. 1378 (2015). More >

Up, Up and Away: Penalties and CMPs to be Adjusted for Inflation

As part of the recent bipartisan budget deal, the Federal Civil Penalties Inflation Adjustment Improvements Act of 2015 (the “Improvements Act”) requires that all federal agencies make inflation-based adjustments to all civil monetary penalties (CMPs) within their jurisdictions beginning no later than August 1, 2016. In the health care context, the legislation means that the penalties available to the government under the Civil Monetary Penalties Law (CMPL), as well as the False Claims Act (FCA), must be adjusted for inflation and increased. More >