Fee Set for Providers & Plans Using No Surprises Act Independent Dispute Resolution To Resolve Post 2/20/24 Disputes

December 19, 2023

$115 is the fee that with health care providers, facilities, and providers of air ambulance services (“providers”) and health plans participating in the Independent Dispute Resolution (“IDR”) process required by the No Surprises Act (the “NSA”) to resolve disputes over the amount the health plan will pay the provider for out-of-network health care or items for because the health plan and provider cannot reach agreement about the appropriate amount outside the IDR process will be required to pay disputes initiated on or after February 21, 2023 under a new final rule scheduled for publication by the of Health and Human Services (“HHS”), Labor (“DOL”) and Treasury (“Treasury”) (collectively the “Departments”) on December 21, 2023.

The Departments establishment of the IDR fee for post-February 20, 2025 disputes and their previous December 15, 2023 announcement of the full reopening of the IDR portal for all dispute categories are part of the Departments’ ongoing response to the August 3, 2023 Federal District court ruling in Texas Medical Association, et al. v. U.S. Department of Health & Human Services, et al., No. 6:23-cv-00059-JDK (TMA IV), which vacated portions of the previous guidance that the Departments previously adopted to establish the IDR process and the administrative fee amount for the Federal IDR process for disputes initiated during the calendar year beginning January 1, 2023.

Post February 22, 2024 IDR Fees

On December 18, 2023, the Departments released an advance copy of the final rule (the “Rule”) setting the fees the NSA requires both the health plan or issuer and a health care provider, facility, or air ambulance services provider (the “parties”) when the parties must use the NSA Federal Independent Dispute Resolution (IDR) process to set the amount a health plan must pay the provider for out-of-network medical care or items because the plan and provider cannot agree on an appropriate payment amount for disputes initiated on or after the date the Rule is published in the Federal Register. Since the Rule is scheduled for publication in the Federal Register on December 21, 2023, the new fee will apply to disputes initiated after February 20, 2023.

In response to the TMA IV ruling, the Rule amends existing regulations to provide that the Departments going forward will determine the administrative fee charged by the Departments to participate in the Federal IDR process, and the ranges for certified IDR entity fees for single and batched determinations, through annual notice and comment rulemaking, rather than in guidance published annually. The preamble to the final rule also sets forth the methodology used to calculate the administrative fee and the considerations used to develop the certified IDR entity fee ranges.

Following this new process, the Rule also finalizes an administrative fee amount of $115 per party and finalizes a certified IDR entity fee range of $200-$840 for single determinations and $268-$1,173 for batched determinations for disputes initiated on or after February 21, 2023. 

Interested parties can review the Rule here and the Departments Fact Sheet on the Rule here.

IDR Portal Reopened December 15, 2023

The Rule establishing the IDR fee for disputes initiated after February 20, 2024 follows the Departments’ December 15, 2023 announcement of their reopening of the IDR portal for processing all health benefit disputes covered by the NSA between providers and payers. 

As part of its provisions to protect patients from “surprise bills” or out-of-network services covered by the NSA, the NSA establishes rules and procedures for providers and payers to determine the appropriate out-of-network payment rate for out-of-network services received by patients enrolled in covered payer programs. Where payers and providers cannot agree about the appropriate payment rate using other NSA procedures, the IDR portal is the online system established under the NSA for disputing payers and health care providers arrange for a certified IDR entity to resolve disagreements about the appropriate out-of-network payment rate for items and services subject to the surprise billing protections in the NSA through a process in which the certified IDR entity reviews offers made by each disputing party along with supporting information about the dispute. Once established under the NSA, payers are required to pay providers the appropriate payment rate for the covered out-of-network services provided to the member patient and the provider is prohibited from balance billing charges in excess of the appropriate payment rate for those services. The Departments previously suspended the operation of the IDR portal earlier this year after a federal court ruled that rules adopted by the Departments implementing the NSA violated the NSA. 

In connection with the reopening of the IDR Portal, the Departments also announced the following extensions of the applicable IDR deadlines for the initiation of new batched disputes and new single disputes involving air ambulance services, resubmission of disputes determined by certified IDR entities to be improperly batched, and selection or reselection of a certified IDR entity.

  • Parties for whom the IDR initiation deadline under applicable regulations fell on any date between August 3, 2023 and December 15, 2023 will have until the 20th business day after the Federal IDR portal reopens, which is January 16, 2024, to initiate a new batched dispute or a new single dispute involving air ambulance services. Parties for whom the IDR initiation deadline falls between December 16, 2023 and January 15, 2024 will also have until January 16, 2024 to initiate a batched or air ambulance dispute. Parties whose initiation deadline falls on January 16, 2024 or after will have the usual 4 business days after the end of the Open Negotiation Period, or if the dispute is subject to the 90-calendar-day suspension period following a payment determination, the usual 30 business day period, to initiate a batched or air ambulance dispute in the Federal IDR portal.
  • For batched disputes and single disputes involving air ambulance services initiated under extensions of deadlines after the Federal IDR portal reopens, the deadline for the parties to jointly select a certified IDR entity will be 10 business days after initiation.
  • For disputing parties that were engaged in certified IDR entity selection for batched disputes when the Federal IDR portal temporarily closed, the deadline for parties to jointly select a certified IDR entity will be 10 business days after the Federal IDR portal reopens, which is December 29, 2023.
  • An initiating party that has received a notification from a certified IDR entity that a dispute initiated before August 3, 2023 was improperly batched will have one opportunity to resubmit the improperly batched items and services for reconsideration within 10 business days of being notified by the certified IDR entity, provided that the initiating party’s 4-business-day period to resubmit the batched dispute expired between August 3 and August 9, 2023.
  • The deadline to submit fees and offers will remain 10 business days after certified IDR entity selection.
  • Disputing parties with batched disputes that were impacted by the temporary suspension of use of the notice of offer form will be granted an additional 10 business days to submit offers, as communicated to impacted disputing parties by email from the Federal IDR Inbox.

The deadline extensions announced December 15, 2023 supplement extensions the Departments previously announced in November, 2023. On November 22, 2023, the Departments used their statutory authority (Internal Revenue Code Section 9816(c)(9), ERISA Section 716(c)(9), and PHS Act Section 2799A-1(c)(9)) to grant extensions in the following circumstances:

  • Disputing parties may request additional time, beyond the current business day deadline, to respond to the certified IDR entity’s requests for additional information. The Departments instructed certified IDR entities to grant such requests through January 16, 2024.
  • Certified IDR entities may provide parties, upon request, an additional 10 business days after the original offer deadline to submit an offer. Certified IDR entities may provide parties this additional time, as needed, through January 16, 2024.

On November 29, 2023, the Departments also announced another extension of the timeline for disputing parties to select a certified IDR entity. Under this extension, disputing parties will have 10 business days to select a certified IDR entity for all disputes through January 16, 2024. This extension will be provided automatically and does not require a request by disputing parties.

The Departments already announced the November 22, 2023 and November 29, 2023 extensions until January 16, 2023 for new single and bundled disputes and these extensions will persist for all disputes until January 16, 2023.

In connection with their full reopening of the IDR portal, the Departments renewed prior reminders to parties accessing or using the IDR portal to clear their computer’s cache or open the Federal IDR initiation web forms in a private or incognito window to see all the new features at least once a week to ensure access to the most up-to-date version of the initiation form as the Departments continue to implement Federal IDR web forms to accommodate guidance-related and system enhancements. Users failing to follow this recommendation risk additional follow-up with certified IDR entities or system errors.  

Users also are encouraged to review other previously published guidance, including No Surprises Act (NSA) Independent Dispute Resolution (IDR) Batching and Air Ambulance Policy Frequently Asked Questions (FAQs), FAQs about Affordable Care Act and Consolidated Appropriations Act, 2023 Implementation Part 63 (FAQs Part 63), FAQs about Consolidated Appropriations Act, 2021 Implementation Part 62 (FAQs Part 62), and the August 2023 IDR Administrative Fees FAQs for further information.

Parties can also reference updated IDR system job aids and updated guidance documents for further information

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Leave a Comment » | balance billing, Health Care, Health Care Finance, health care reimbursement, Health Plans, Reimbursement, Self-Insured Group health Plans | Tagged: , , , , , , , , | Permalink
Posted by Cynthia Marcotte Stamer

No Surprises Act IDR Portal Now Open For All Covered Health Claims; Added Deadline Extensions Announced

December 15, 2023

The No Surprises Act (“NSA”) Federal Independent Dispute Resolution (“IDR”) portal now is reopened for processing all health benefit disputes covered by the NSA between health care providers, facilities, and providers of air ambulance services (“providers”), and group health plans, health insurance issuers, and Federal Employee Health Benefits Program carriers (“payers”) (collectively, “disputing parties”). The Departments of Health & Human Resources, Labor and Treasury (“Departments”) reopened the IDR Portal on December 15, 2023 for all types of NSA-covered claims including previously initiated batched disputes, new batched disputes, and new single disputes involving air ambulance services. 

As part of its provisions to protect patients from “surprise bills” or out-of-network services covered bu the NSA, the NSA establishes rules and procedures for providers and payers to determine the appropriate out-of-network payment rate for out-of-network services received by patients enrolled in covered payer programs. Where payers and providers cannot agree about the appropriate payment rate using other NSA procedures, the IDR portal is the online system established under the NSA for disputing payers and health care providers arrange for a certified IDR entity to resolve disagreements about the appropriate out-of-network payment rate for items and services subject to the surprise billing protections in the NSA through a process in which the certified IDR entity reviews offers made by each disputing party along with supporting information about the dispute. Once established under the NSA, payers are required to pay providers the appropriate payment rate for the covered out-of-network services provided to the member patient and the provider is prohibited from balance billing charges in excess of the appropriate payment rate for those services. The Departments previously suspended the operation of the IDR portal earlier this year after a federal court ruled that rules adopted by the Departments implementing the NSA violated the NSA. 

In connection with the reopening of the IDR Portal, the Departments also announced the following extensions of the applicable IDR deadlines for the initiation of new batched disputes and new single disputes involving air ambulance services, resubmission of disputes determined by certified IDR entities to be improperly batched, and selection or reselection of a certified IDR entity.

  • Parties for whom the IDR initiation deadline under applicable regulations fell on any date between August 3, 2023 and December 15, 2023 will have until the 20th business day after the Federal IDR portal reopens, which is January 16, 2024, to initiate a new batched dispute or a new single dispute involving air ambulance services. Parties for whom the IDR initiation deadline falls between December 16, 2023 and January 15, 2024 will also have until January 16, 2024 to initiate a batched or air ambulance dispute. Parties whose initiation deadline falls on January 16, 2024 or after will have the usual 4 business days after the end of the Open Negotiation Period, or if the dispute is subject to the 90-calendar-day suspension period following a payment determination, the usual 30 business day period, to initiate a batched or air ambulance dispute in the Federal IDR portal.
  • For batched disputes and single disputes involving air ambulance services initiated under extensions of deadlines after the Federal IDR portal reopens, the deadline for the parties to jointly select a certified IDR entity will be 10 business days after initiation.
  • For disputing parties that were engaged in certified IDR entity selection for batched disputes when the Federal IDR portal temporarily closed, the deadline for parties to jointly select a certified IDR entity will be 10 business days after the Federal IDR portal reopens, which is December 29, 2023.
  • An initiating party that has received a notification from a certified IDR entity that a dispute initiated before August 3, 2023 was improperly batched will have one opportunity to resubmit the improperly batched items and services for reconsideration within 10 business days of being notified by the certified IDR entity, provided that the initiating party’s 4-business-day period to resubmit the batched dispute expired between August 3 and August 9, 2023.
  • The deadline to submit fees and offers will remain 10 business days after certified IDR entity selection.
  • Disputing parties with batched disputes that were impacted by the temporary suspension of use of the notice of offer form will be granted an additional 10 business days to submit offers, as communicated to impacted disputing parties by email from the Federal IDR Inbox.

The deadline extensions announced December 15, 2023 supplement extensions the Departments previously announced in November, 2023. On November 22, 2023, the Departments used their statutory authority (Internal Revenue Code Section 9816(c)(9), ERISA Section 716(c)(9), and PHS Act Section 2799A-1(c)(9)) to grant extensions in the following circumstances:

  • Disputing parties may request additional time, beyond the current business day deadline, to respond to the certified IDR entity’s requests for additional information. The Departments instructed certified IDR entities to grant such requests through January 16, 2024.
  • Certified IDR entities may provide parties, upon request, an additional 10 business days after the original offer deadline to submit an offer. Certified IDR entities may provide parties this additional time, as needed, through January 16, 2024.

On November 29, 2023, the Departments also announced another extension of the timeline for disputing parties to select a certified IDR entity. Under this extension, disputing parties will have 10 business days to select a certified IDR entity for all disputes through January 16, 2024. This extension will be provided automatically and does not require a request by disputing parties.

The Departments already announced the November 22, 2023 and November 29, 2023 extensions until January 16, 2023 for new single and bundled disputes and these extensions will persist for all disputes until January 16, 2023.

In connection with their full reopening of the IDR portal, the Departments renewed prior reminders to parties accessing or using the IDR portal to clear their computer’s cache or open the Federal IDR initiation web forms in a private or incognito window to see all the new features at least once a week to ensure access to the most up-to-date version of the initiation form as the Departments continue to implement Federal IDR web forms to accommodate guidance-related and system enhancements. Users failing to follow this recommendation risk additional follow-up with certified IDR entities or system errors.  

Users also are encouraged to review other previously published guidance, including No Surprises Act (NSA) Independent Dispute Resolution (IDR) Batching and Air Ambulance Policy Frequently Asked Questions (FAQs), FAQs about Affordable Care Act and Consolidated Appropriations Act, 2023 Implementation Part 63 (FAQs Part 63), FAQs about Consolidated Appropriations Act, 2021 Implementation Part 62 (FAQs Part 62), and the August 2023 IDR Administrative Fees FAQs for further information. Parties can also reference

Parties should reference the No Surprises Act (NSA) Independent Dispute Resolution (IDR) Batching and Air Ambulance Policy Frequently Asked Questions (FAQs), FAQs about Affordable Care Act and Consolidated Appropriations Act, 2023 Implementation Part 63 (FAQs Part 63), FAQs about Consolidated Appropriations Act, 2021 Implementation Part 62 (FAQs Part 62), and the August 2023 IDR Administrative Fees FAQs for further information. Parties can also reference updated IDR system job aids and updated guidance documents for further information.

Questions can be directed to the Federal IDR mailbox at FederalIDRQuestion@cms.hhs.gov. Any additional updates will be provided at www.cms.gov/nosurprises as they become available.

Parties should reference the No Surprises Act (NSA) Independent Dispute Resolution (IDR) Batching and Air Ambulance Policy Frequently Asked Questions (FAQs), FAQs about Affordable Care Act and Consolidated Appropriations Act, 2023 Implementation Part 63 (FAQs Part 63), FAQs about Consolidated Appropriations Act, 2021 Implementation Part 62 (FAQs Part 62), and the August 2023 IDR Administrative Fees FAQs for further information. Parties can also reference updated IDR system job aids and updated guidance documents for further information.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Leave a Comment » | Health Care | Tagged: , , , , , , , , , , , , , , | Permalink
Posted by Cynthia Marcotte Stamer

Texas Man Charged With Filing $60 Million DME Medicare Fraud Scheme

December 15, 2023

A Texas man could serve more than 20 years in prison if convicted of health care fraud for his alleged role in a $60 million health care fraud, wire fraud, and kickback scheme involving the submission of false and fraudulent claims to Medicare for medically unnecessary durable medical equipment (DME), genetic tests, and foot bath medications included in a December 13, 2023 federal grand jury indictment marketed using offshore call centers.

According to court documents, Robert Leon Smith III, owned or operated a network of DME companies in Florida, Texas, and Maryland through which he allegedly billed Medicare for medically unnecessary orthotic braces ineligible for Medicare reimbursement. Smith also allegedly referred doctors’ orders for medically unnecessary orthotic braces, genetic tests, and foot bath medications to other DME suppliers, pharmacies, and laboratories in exchange for kickbacks and bribes.

Court documents charge Smith allegedly paid kickbacks and bribes to offshore call centers operated by his co-conspirators to obtain Medicare beneficiary information and falsified doctors’ orders. The offshore call centers allegedly used deceptive tactics to pressure Medicare beneficiaries to accept the orthotic braces, genetic tests, and foot bath medications. Smith and his co-conspirators allegedly paid kickbacks and bribes to the offshore call centers in exchange for the Medicare beneficiary information, sometimes together with a forged doctor’s order. Smith also allegedly paid kickbacks and bribes to purported telemedicine companies in exchange for doctors’ orders signed by telemedicine practitioners who did not examine or treat the Medicare beneficiary. Smith allegedly used some of the doctors’ orders he acquired as a result of the payment of kickbacks and bribes to bill Medicare through his own network of DME companies, and also referred doctors’ orders to other DME suppliers, pharmacies, and labs in exchange for kickbacks and bribes.

Smith is charged with one count of conspiracy to commit health care fraud and wire fraud, four counts of health care fraud, one count of conspiracy to defraud the United States and to pay and receive health care kickbacks, and two counts of solicitation and receipt of health care kickbacks. If convicted, he faces a maximum penalty of 20 years in prison on each conspiracy to commit health care fraud and wire fraud count, a maximum penalty of 10 years in prison for each health care fraud and anti-kickback violations count, and a maximum penalty of five years in prison on each conspiracy to defraud the United States and to pay and receive kickbacks count. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The Department of Justice Criminal Division Fraud Section is prosecuting the charges, which resulted from the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Force Program. Since March 2007, this program, currently comprised of nine strike forces operating in 27 federal districts, has charged more than 5,400 defendants who collectively have billed federal health care programs and private insurers more than $27 billion. In addition, the Centers for Medicare & Medicaid Services, working in conjunction with HHS-OIG, are taking steps to hold providers accountable for their involvement in health care fraud schemes.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Leave a Comment » | Health Care | Permalink
Posted by Cynthia Marcotte Stamer

Federal Court Orders Manufacturer, President To Recall & Stop Making & Distributing Defective Drugs

December 15, 2023

Massachusetts based drug company Pharmasol Corporation and its president, Marc L. Badia are enjoined from manufacturing and distributing adulterated drugs in violation of the Federal Food, Drug and Cosmetic Act (FDCA) and must take other corrective actions as part of a consent decree entered December 13, 2023. resolving a lawsuit filed by the United States on November 17, 2023.

The decree resolves a lawsuit brought by he United States that alleged that Pharmasol Corporation and Badia violated the FDCA at the company’s facility in South Easton, Massachusetts, by manufacturing and distributing adulterated drugs. Pharmasol manufactured and processed prescription and over-the-counter drugs, including Lexette, which is used to treat itching, redness and swelling of skin, and Dexamethasone, which is used to relieve arthritis inflammation. The United States alleged that the company violated the FDCA by failing to notify its customers about defects in its finished products, failing to establish a complaint procedure or corrective action plan despite receiving, within a 12-month period, 533 customer complaints relating to defects in its drug products, and failing to adequately clean and maintain its equipment. According to the complaint, the Food and Drug Administration (FDA) inspected Pharmasol in 2018, 2021 and 2022, and issued the company several warnings, including a warning letter in 2019, regarding its alleged violations. The United States alleged that many of the violations FDA identified in 2022 were repeat violations identified in earlier inspections.

The current good manufacturing practice regulations for drugs mandate that manufacturers control the processes and procedures by which their drugs are manufactured, processed, packed and held, to ensure that the drugs have the identity, strength, quality, purity and other attributes necessary for their safe and effective use. Drugs not made in conformance with current good manufacturing practice regulations are adulterated and in violation of the law.

Under an agreement reached with the United States, Pharmasol Corporation and Badia agreed to settle the suit and be bound by a consent decree of permanent injunction. The negotiated consent decree entered by the court permanently enjoins the defendants from violating the FDCA, and requires, among other things, that they stop manufacturing, processing, labeling, holding or distributing adulterated drugs. Further, the company must recall all adulterated prescription drugs that the company manufactured or distributed on or after February 10, 2022.

Justice Department and FDA leaders reiterated the Federal government commitment to enforcing drug quality and safety requirements in their press release on the entry of the injunction.

“Drug manufacturers have a responsibility to comply with requirements designed to ensure drug quality and safety,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division. “The Justice Department will continue to work closely with the FDA and take action against manufacturers who fail to meet this responsibility.”

“When drug manufacturers violate the law and disregard safety standards, they put consumers at significant risk. In this case, the defendant’s company distributed adulterated, poor-quality drugs without regard for patients and consumers,” said Director Jill Furman of the  in FDA’s Center for Drug Evaluation and Research’s Office of Compliance. “The FDA plays an important role in protecting consumers, and we will continue to work with our federal partners to pursue and bring into compliance those who do not prioritize the health and safety of the American public.”

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Leave a Comment » | Health Care | Permalink
Posted by Cynthia Marcotte Stamer

1st Phishing-Related HIPAA Settlement Sends Other HIPAA Entities Phishing Warning

December 8, 2023

A resolution agreement with a Louisiana medical group announced December 7, 2023, that resolves the first charges arising from a phishing attack under the Health Insurance Portability and Accountability Act (“HIPAA”) warns other health care providers, health plans, health care clearinghouses (“Covered Entities”) and their business associates (collectively, “HIPAA Entities”) to ensure the adequacy of their risk analysis, safeguards, training and other processes for guarding electronic protected health information (“ePHI”) against phishing or other impermissible access.

According to the Department of Health and Human Services Office of Civil Rights (“OCR”) announcement of the landmark settlement, the charges against LaFourche Medical Group (“LaFourche”), a Louisiana medical group specializing in emergency medicine, occupational medicine, and laboratory testing, resulted from OCR’s investigation into a successful phishing attack on March 30, 2021 that allowed identity thieves to access an email account that contained ePHI of approximately 34,862 individuals.  

HIPAA Entities Duty To Guard EPHI Against Phishing

The HIPAA Privacy Rule and Security Rule require health care providers, heath plans, health care clearinghouses (“Covered Entities”) and their businesses associates (collectively “HIPAA Entities”) to protect EPHI and other protected health information against use, access, disclosure or destruction by third parties except under the conditions allowed by HIPAA.  These requirements include the requirements of the Security Rule to conduct and document comprehensive security assessments of risks to sensitive data systems, to implement and enforce detailed security safeguards to protect EPHI and the systems containing that data against these threats, to train and enforce compliance with these safeguards, and other requirements.  Meanwhile, the HIPAA Breach Notification Rule requires Covered Entities to report most breaches of unsecured EPHI to individuals whose data is affected, OCR, and in the case of breaches of EPHI affecting more than 500 individuals, to the media. 

Phishing is a type of cybersecurity attack used to trick individuals into disclosing sensitive information via electronic communication, such as email, by impersonating a trustworthy source. See OCR Quarter 1 2022 Cybersecurity Newsletter; OCR February 2018 Phishing Cybersecurity Newsletter.

OCR guidance confirms OCR views defending ePHI against phishing as a key part of compliance with these HIPAA requirements.  See, e.g. OCR Quarter 1 2022 Cybersecurity Newsletter; Defending Against Common Cyber-Attacks; AI-Augmented Phishing and the Threat to the Health Sector; HHS 405d Health Industry Cybersecurity Practices on Email Phishing Attacks; Videos on “How the HIPAA Security Rule Can Help Defend Against Cyber-Attacks” in English and Spanish. OCR February 2018 Phishing Cybersecurity Newsletter.  

OCR data confirms the number of breaches of unsecured ePHI reported to the OCR affecting 500 or more individuals (“large breaches”) due to hacking or IT incidents increased 45% from 2019 to 2020,  and hacking or IT incidents accounted for 66% of all large breaches reported to OCR in 2020. U.S. Department of Health and Human Services Breach Portal.  In keeping with this trend, large breaches affected more than 55 million individuals in 2022 and more than 89 million individuals in 2023.  OCR reports phishing played a key role in many of these breaches and contributed to many other breaches currently under OCR investigation.  See U.S. Department of Health and Human Services Breach Portal; OCR Quarter 1 2022 Cybersecurity Newsletter. 

The widespread availability and use of artificial intelligence technology has only made phishing attempts more effective, especially since those tools are freely available to the public. AI-Augmented Phishing and the Threat to the Health Sector. 

The 2021 HIMSS Healthcare Cybersecurity Survey reveals phishing is the most common attack impacting healthcare organizations, comprising almost half of all attacks. Data shows hackers frequently use phishing against the health sector because it often leads to data breaches that allow attackers to access large quantities of lucrative stolen health data. AI-Augmented Phishing and the Threat to the Health Sector.

LaFourche Phishing Breach

The OCR investigation of LaFourche arose from a May 28, 2021 data breach report LaFourche filed reporting a March 30, 2021 breach. According to the breach report, LAFOURCHE  learned on March 30, 2021, that an unauthorized individual obtained access to one of its owners’ email accounts through a phishing attack. LAFOURCHE  determined that the email account contained patients’ EPHI. According to the report, on March 30, 2021, LAFOURCHE  learned that an unauthorized individual obtained access to one of its owners’ email accounts through a phishing attack. LAFOURCHE  determined that the email account contained patients’ protected health information (PHI). As LAFOURCHE  was unable to identify the specific patients affected, LAFOURCHE  notified all of its patients – approximately 34,862 individuals of the incident. As LAFOURCHE  was unable to identify the specific patients affected, LAFOURCHE  notified all of its patients – approximately 34,862 individuals – of the incident.

OCR’s investigation opened in January, 2022 in response to the breach report revealed found that before LAFOURCHE  made the breach report LAFOURCHE  never conducted a Security Rule risk analysis and had no policies or procedures in place to regularly review information system activity to safeguard protected health information against cyberattacks. 

To resolve OCR HIPAA charges arising from the breach, LaFourche agreed to pay $480,000 to OCR and to implement and follow a corrective action plan that includes the following requirements:

  • Establishing and implementing security measures to reduce security risks and vulnerabilities to electronic protect health information in order to keep patients’ protected health information secure;
  • Developing, maintaining, and revising written policies and procedures as necessary to comply with the HIPAA Rules; and
  • Providing training to all staff members with access to patients’ protected health information on HIPAA policies and procedures.

OCR will monitor for two years. LaFourche’s adherence with the compliance plan for two years.

While the $480,000 that LaFourche is a significant amount for a medical practice to pay, agreeing and adhering to the requirements of the settlement agreement and its incorporated corrective action plan allows LaFourche to avoids becoming subject to significantly greater civil monetary penalties authorized by HIPAA for breaches of its Privacy, Security and Breach Notification Rules.  Under the terms of the resolution agreement, however, HHS can still pursue civil monetary penalties against LaFourche for the violations if OCR finds LaFourche failed to comply with any of the requirements of its corrective action plan or otherwise violates HIPAA.

LaFourche Experience Warns Other HIPAA Entities To Tighten Phishing Defenses

The LaFourche resolution agreement serves as a warning to other HIPAA entities.  OCR’s announcement of the settlement quotes OCR Director Melanie Fontes Rainer as stating, “It is imperative that the health care industry be vigilant in protecting its systems and sensitive medical records, which includes regular training of staff and consistently monitoring and managing system risk to prevent these attacks. We all have a role to play in keeping our health care system safe and taking preventive steps against phishing attacks.”

Based on the LaFourche resolution agreement and other guidance, HIPAA entities should heed this warning by ensuring their organization is prepared to demonstrate to OCR in the event of an OCR audit or breach investigation by among other things, establishing appropriate governance with C-level oversight of compliance efforts; conducting documented periodic systemic risk assessments addressing phishing and other threats;  actions taken to implement appropriate safeguards and monitor their effectiveness; appropriate workforce training and enforcement of policies and procedures; timely investigation and response to known or suspected breaches; timely breach reporting and mitigation; and other compliance with the Security Rule.

With regard to phishing, the Office of Information Security Whitepaper on AI-Augmented Phishing and the Threat to the Health Sector provides specific tips for successful prevention of phishing attacks including but not limited to:

  • Ensuring proper email server configuration or integrating a spam gateway or other appropriate additional platform into the information infrastructure, such as a spam gateway filter, to help filter unwanted e-mails;
  • Multi-factor authentication (MFA) requirements to protect against stolen credentials, which can be the initial purpose of a phishing attack;
  • Up-to-date malware and other security software to detect malware as it is being executed onto the system;
  • Conducting periodic end-user awareness training on detection of phishing e-mails and interacting with all e-mail with healthy skepticism including specific training on comment formats and tricks including those generated using AI tools;
  • Systematically using appropriately updated and robust processes for monitoring and detecting suspicious activities/indicators on an ongoing basis.

HIPAA entities also should keep in mind that phishing is only one of a multitude of compliance and enforcement risks highlighted by OCR’s recent enforcement and guidance. Along with reviewing and updating their phishing defenses, HIPAA entities also should review and update other processes as needed to manage these exposures.

Additionally, HIPAA entities and their leaders also should take steps to understand and fully address all other statutory, ethical, contractual or other privacy or confidentiality requirements beyond those imposed by HIPAA. For example, health care providers, health plans and their fiduciaries, brokers, administrators and insurers also may bear responsibilities under the Employee Retirement Income Security Act fiduciary responsibility rules, the Fair and Accurate Credit Transactions Act, federal and state electronic crimes and privacy laws. Publicly traded organizations and their leaders may face responsibilities and liability under new Securities and Exchange Commission regulations. The Employee Benefit Security Administration considers managing cybersecurity risks a part of the fiduciary obligations of fiduciaries of employment-based health plans. Meanwhile, health care providers, insurance organizations and brokers, third party administrators, government contractors, attorneys and other advisors and others also may be subject to medical confidentiality and other data privacy and security obligations under federal and state electronic crimes, identity theft, ethics, professional licensure, contractual, common law privacy and other statutory and common laws.

While it commonly is necessary or advisable to involve consulting or other technical support in the conduct of these activities, HIPAA entities should keep in mind the likelihood that their analysis and review is likely to uncover and prompt discussion of potentially legally or politically sensitive information. For this reason, HIPAA entities and their leaders generally will want to engage experienced legal counsel for assistance in structuring and executing these activities to maximize their ability to claim attorney-client privilege or other evidentiary protections against discovery or disclosure of certain aspects of these activities.

Finally, HIPAA entities should keep in mind that HIPAA and other cybersecurity compliance and risk management is an ongoing process requiring constant awareness and diligence.  Consequently, HIPAA entities should both monitor OCR and other regulatory and enforcement developments as well as exercise ongoing vigilance to monitor and maintain compliance within their organizations.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Leave a Comment » | Health Care | Tagged: , , , , , , , , , , | Permalink
Posted by Cynthia Marcotte Stamer