Health Care Provider |

11/30 Deadline For Critical Access Hospital Hardship Exception Applications

November 13, 2017

November 30 is the deadline for Critical Access Hospitals (CAHs) to submit a hardship exception application to avoid the 2016 payment adjustment based on the 2016 reporting year for failing to meet the meaningful use requirements of the American Recovery and Reinvestment Act of 2009 (ARRA),

Under AARA, Congress mandated CAHs that are not meaningful users of Certified Electronic Health Record (EHR) Technology under the Medicare EHR Incentive Program receive negative payment adjustments beginning in 2015. Specifically, section 4102(b)(2) of the HITECH Act amended section 1814(l) of the Act to include an adjustment to a CAH’s Medicare reimbursement for inpatient services if the CAH is not a meaningful EHR user for an EHR reporting period unless the CAH qualifies for a hardship exception. CAHs must demonstrate meaningful use every year according to the timelines specified to avoid Medicare payment adjustments. For example, CAHs that demonstrate meaningful use in 2017 will avoid the payment adjustment in 2017, but they also must demonstrate meaningful use in 2018 to avoid the payment Medicaid CAHs that do not bill Medicare are not subject to these payment adjustments in 2018. Medicaid CAHs that do not bill Medicare are not subject to these payment adjustments.

A CAH demonstrates meaningful use by successfully attesting through either the CMS Attestation System or through its state’s attestation system annually by the applicable deadline:

If a CAH does not meet the meaningful us requirement, it may be possible to avoid the payment adjustment by qualifying for a hardship exception. AARA allows CMS on a case-by-case basis, to grant CHAs an exception from this adjustment if CMS or its Medicare contractor determines, on an annual basis, that a significant hardship exists.

If the facility is a CAH, as defined in the Stage 2 Final Rule 42 CFR Part 413 § 413.70(C), that is new in the payment adjustment year (2016) and has not previously operated, CMS will grant a hardship exception automatically and is automatically exempt from the payment adjustment. Note that CAHs are NOT considered NEW if any of the following circumstances apply:

The CAH builds a new or replacement facility/facilities at the same or another location even if this is coincidental with a change of ownership, a change in management or a lease arrangement;
A CAH closes and subsequently reopens; or o A CAH that has been converted from an eligible hospital.

If any of the outlined circumstances listed apply, the CAH should consider applying for a hardship if it has not successfully demonstrated meaningful use for an EHR reporting period and if at least one of the hardship reasons indicated on the application was met.

There are several categories of hardship exceptions for CAHs:

CAHs can also apply for a hardship exception for the following circumstances:

Insufficient Internet Connectivity – The CAH was located in an area without sufficient Internet access to comply with meaningful use objectives requiring Internet connectivity, and faced insurmountable barriers to obtaining such Internet connectivity.
Extreme and Uncontrollable Circumstances – If they encounter an unforeseeable barrier, such as a natural disaster (includes vendor issues).

CAHs can submit hardship exception applications in two ways:

Electronic submission via e-mail to Sent to ehrhardship@provider-resources.com; or
Paper submission via fax to 814-456-7132.

All hardship exception determinations will be returned via email from ehrhardship@provider-resources.com to the email address provided on the application.

If approved, the hardship exception is valid for the 2016 payment year only. If the CAH claims a hardship exception for a following payment year, the CAH must submit a new application.

For more information, reviewthe Critical Access Hospital Payment Adjustment and Hardship Exception Tipsheet and visit the Payment Adjustments and Hardship Information webpage on the EHR Incentive Programs website.

About the Author

Ms. Stamer’s legal, management, governmental affairs work and speaking and publications have focused on helping health industry, health benefit and other organizations and their management use the law, performance and risk management tools and process to manage people, performance, quality, compliance, operations and risk.

Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer supports these organizations and their leaders on both a real-time, “on demand” basis as well as outsourced operations or special counsel on an interim, special project, or ongoing basis with strategic planning and product and services development and innovation; workforce and operations management, crisis preparedness and response as well as to prevent, stabilize and cleanup legal and operational crises large and small that arise in the course of operations.

As core components of this work, Ms. Stamer helps health industry, health plans and insurers, health IT, life sciences and other health industry clients manage regulatory, contractual and other compliance; vendors and suppliers; Medicare, Medicaid, CHIP, Medicare/Medicaid Advantage, ERISA and other private payer and other terms of participation, medical billing, reimbursement, claims administration and coordination, and other provider-payer relations, contracting, compliance and enforcement; Form 990 and other nonprofit and tax-exemption; fundraising, investors, joint venture, and other business partners; quality and other performance measurement, management, discipline and reporting; physician and other workforce recruiting, performance management, peer review and other investigations and discipline, wage and hour, payroll, gain-sharing and other pay-for performance and other compensation, training, outsourcing and other human resources and workforce matters; board, medical staff and other governance; strategic planning, process and quality improvement; meaningful use, EMR, HIPAA and other technology, data security and breach and other health IT and data; STARK, antikickback, insurance, and other fraud prevention, investigation, defense and enforcement; audits, investigations, and enforcement actions; trade secrets and other intellectual property; crisis preparedness and response; internal, government and third-party licensure, credentialing, accreditation, HCQIA and other peer review and quality reporting, audits, investigations, enforcement and defense; patient relations and care; internal controls and regulatory compliance; payer-provider, provider-provider, vendor, patient, governmental and community relations; facilities, practice, products and other sales, mergers, acquisitions and other business and commercial transactions; government procurement and contracting; grants; tax-exemption and not-for-profit; 1557 and other Civil Rights; privacy and data security; training; risk and change management; regulatory affairs and public policy; process, product and service improvement, development and innovation, and other legal and operational compliance and risk management, government and regulatory affairs and operations concerns.

Her clients include public and private, domestic and international hospitals, health care systems, clinics, skilled nursing, long term care, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, insurers, self-insured health plans and other payers; and other health industry clients to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry investigation, enforcement including insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

Author of leading works on a multitude of health care, health plan and other health industry matters, the American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting, former Vice President of the North Texas Health Care Compliance Professionals Association, past Chair of the ABA Health Law Section Managed Care & Insurance Section, past ABA JCEB Council Representative and CLE and Marketing Committee Chair, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer’s health industry clients include public health organizations; public and private hospitals, healthcare systems, clinics and other health care facilities; physicians, physician practices, medical staff, and other provider organizations; skilled nursing, long term care, assisted living, home health, ambulatory surgery, dialysis, telemedicine, DME, Pharma, clinics, and other health care providers; billing, management and other administrative services organizations; insured, self-insured, association and other health plans; PPOs, HMOs and other managed care organizations, insurance, claims administration, utilization management, and other health care payers; public and private peer review, quality assurance, accreditation and licensing; technology and other outsourcing; healthcare clearinghouse and other data; research; public and private social and community organizations; real estate, technology, clinical pathways, and other developers; investors, banks and financial institutions; audit, accounting, law firm; consulting; document management and recordkeeping, business associates, vendors, and service providers and other professional and other health industry organizations; academic medicine; trade associations; legislative and other law making bodies and others.

Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other nonpar insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, MGMA, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A former lead consultant to the Government of Bolivia on its Pension Privatization Project with extensive domestic and international public policy concerns in Pensions, healthcare, workforce, immigration, tax, education and other areas.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on these and other related concerns by her service in the leadership of the Solutions Law Press, Inc. Coalition for Responsible Health Policy, its PROJECT COPE: Coalition on Patient Empowerment, and a broad range of other professional and civic organizations including North Texas Healthcare Compliance Association, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children (now Warren Center For Children); current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, past Representative and chair of various committees of ABA Joint Committee on Employee Benefits; a ABA Health Law Coordinating Council representative, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

Leave a Comment » | Accreditation, Ambulatory care, Electronic Health Records, Electronic Medical Records, Health Care, Health Care Provider, Health Care Quality, health care reimbursement, Health IT, Hospital, hospitals, Medicare Fee Schedule, Reimbursement, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Comment By 1/8 on Guidance for Industry on Expedited Programs for Serious Conditions– Drugs and Biologics

November 8, 2017

January 8, 2018 is the deadline to submit comments to the Food and Drug Administration (FDA or Agency) on the proposed collection of information by the Agency.on the information collection in the guidance for industry “Expedited Programs for Serious Conditions–Drugs and Biologics.”

The guidance provides a single resource for information on FDA’s policies and procedures related to the following expedited programs for serious conditions: (1) Fast track designation, (2) breakthrough therapy designation, (3) accelerated approval, and (4) priority review designation. The guidance describes threshold criteria generally applicable to expedited programs, including what is meant by serious condition, unmet medical need, and available therapy. The guidance addresses the applicability of expedited programs to rare diseases, clarification on available therapy, and additional detail on possible flexibility in manufacturing and product quality. The guidance also clarifies the qualifying criteria for breakthrough therapy designation and provides examples of surrogate endpoints and intermediate clinical endpoints used to support accelerated approval.

The information collection resulting from requests for priority review designation and breakthrough therapy designation is set forth in rows 1 and 2 of table 1 and is approved by the Office of Management and Budget (OMB) under control number 0910-0765. The information collection resulting from requests for accelerated approval is approved by OMB under control numbers 0910-0001 and 0910-0338.

The provisions of the guidance relating to fast track development and other issues such as serious condition and unmet medical need replace the guidance entitled “Fast Track Drug Development Programs–Designation, Development, and Application Review.” Consequently, the information collection resulting from the “Fast Track Drug Development Programs–Designation, Development, and Application Review” (OMB control number 0910-0389) is now being incorporated into OMB control number 0910-0765 (guidance for industry “Expedited Programs for Serious Conditions–Drugs and Biologics”).

A sponsor or applicant who seeks fast track designation is required to submit a request to the Agency showing that the drug product: (1) Is intended for a serious or life-threatening condition and (2) has the potential to address an unmet medical need. The Agency expects that most information to support a designation request will have been gathered under existing requirements for preparing an investigational new drug (IND), new drug application (NDA), or biologic license application (BLA). If such information has already been submitted to the Agency, the information may be summarized in the fast track designation request. A designation request should include, where applicable, additional information not specified elsewhere by statute or regulation. For example, additional information may be needed to show that a product has the potential to address an unmet medical need where an approved therapy exists for the serious or life-threatening condition to be treated. Such information may include clinical data, published reports, summaries of data and reports, and a list of references. The amount of information and discussion in a designation request need not be voluminous, but it should be sufficient to permit a reviewer to assess whether the criteria for fast track designation have been met.

After the Agency makes a fast track designation, a sponsor or applicant may submit a premeeting package that may include additional information supporting a request to participate in certain fast track programs. The premeeting package serves as background information for the meeting and should support the intended objectives of the meeting.

As with the request for fast track designation, the Agency expects that most sponsors or applicants will have gathered such information to meet existing requirements for preparing an IND, NDA, or BLA. These may include descriptions of clinical safety and efficacy trials not conducted under an IND (e.g., foreign studies) and information to support a request for accelerated approval. If such information has already been submitted to FDA, the information may be summarized in the premeeting package.

For more information and detailed instructions on the request for comments, see https://www.gpo.gov/fdsys/pkg/FR-2017-11-08/html/2017-24296.htm.

Health care providers and others commenting in response to this invitation are cautioned that the FDA will post your comment, as well as any attachments, except for information submitted, marked and identified, as “confidential” is submitted as detailed in the instruction. To submit a comment with confidential information that you do not wish to be made publicly available, the FDA directs to submit your comments only as a written/paper submission by submitting two copies total:

One copy will include the information you claim to be confidential with a heading or cover note that “THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.” The Agency will review this copy, including the claimed confidential information, in its consideration of comments.
The second copy, which will have the claimed confidential information redacted/blacked out, will be available for public viewing and posted on https://www.regulations.gov.
If you do not wish your name and contact information to be made publicly available, you can provide this information on the cover sheet and not in the body of your comments and you must identify this information as “confidential.”

Interested persons may access the docket to read background documents or the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the “Search” box and follow the prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.

About the Author

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

Solutions Law Press, Inc.™

Leave a Comment » | Consumer Driven Health Care, Controlled Substances, DEA, drug treatment, Fast Track Approval, FDA, Health Care Provider, Pharmaceudical, Pharmacy, Prescription Drugs, research, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

CMS Publishes 2018 Updates To Home Health Prospective Payment Rates & Rules

November 8, 2017

The Centers for Medicare & Medicaid Services (CMS) today (November 7, 2017) published the CY 2018 Home Health Prospective Payment System Rate Update and CY 2019 Case-Mix Adjustment Methodology Refinements; Home Health Value-Based Purchasing Model; and Home Health Quality Reporting Requirements (Final Rule), updating the home health prospective payment system (HH PPS) payment rates, including the national, standardized 60- day episode payment rates, the national per-visit rates, and the non-routine medical supply (NRS) conversion factor, effective for home health episodes of care ending on or after January 1, 2018.

In addition to updating the HH PPS rates for 2018, the Final Rule also:

Updates the HH PPS case-mix weights using the most current, complete data available at the time of rulemaking; implements the third year of a 3-year phase-in of a reduction to the national, standardized 60-day episode payment to account for estimated case-mix growth unrelated to increases in patient acuity (that is, nominal case-mix growth) between calendar year (CY) 2012 and CY 2014;
Discusses CMS efforts to monitor the potential impacts of the rebasing adjustments that were implemented in CY 2014 through CY 2017; and
Finalizes changes to the Home Health Value-Based Purchasing (HHVBP) Model and to the Home Health Quality Reporting Program (HH QRP).

The Final Rule also announced CMS’s decision not to finalize the implementation of the Home Health Groupings Model (HHGM) in the Final Rule at this time.

Section V. of the Final Rule, we finalizes updates to the Home Health Quality Reporting Program, including:

Replaces one quality measure;
Adopts two new quality measures, data submission requirements, exception and extension requirements, reconsideration and appeals procedures;
Finalizes the removal of 235 data elements from 33 current OASIS items, effective with all HHA assessments on or after January 1, 2019; and
Does not finalize the standardized patient assessment data elements that we proposed to adopt for three of the five categories under section 1899B(b)(1)(B) of the Act: Cognitive Function and Mental Status; Special Services, Treatments, and Interventions; and Impairments.

Home health providers and others concerned with Medicare reimbursement for home health should begin reviewing and preparing for these changes in preparation for the Final Riles’s implementation on January 1.

About the Author

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

Solutions Law Press, Inc.™

Leave a Comment » | Affordable Care Act, Conditions of Participation, Doctor, false claims act, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, home health, Medicare, Medicare Advantage, Medicare Fee Schedule, Money Laundering, Outcomes Data, Reimbursement | Permalink
Posted by Cynthia Marcotte Stamer

CMS Publishes 2018 Physician Fee Schedule Rule

November 2, 2017

On November 2, the Centers for Medicare and Medicaid Services (CMS) issued a final rule that includes updates to payment policies, payment rates, and quality provisions for services furnished under the Medicare Physician Fee Schedule (PFS) on or after January 1, 2018.

The overall update to payments under the PFS based on the finalized CY 2018 rates will be +0.41 percent. This update reflects the +0.50 percent update established under the Medicare Access and CHIP Reauthorization Act of 2015, reduced by 0.09 percent, due to the misvalued code target recapture amount, required under the Achieving a Better Life Experience Act of 2014. After applying these adjustments, and the budget neutrality adjustment to account for changes in Relative Value Units, all required by law, the final 2018 PFS conversion factor is $35.99, an increase to the 2017 PFS conversion factor of $35.89.

The Final Rule Includes:

Patients over Paperwork Initiative
Changes in valuation for specific services
Payment rates for nonexcepted off-campus provider-based hospital departments
Medicare telehealth services
Malpractice relative value units
Care management services
Improvement of payment rates for office-based behavioral health services
Evaluation and management comment solicitation
Emergency department visits comment solicitation
Solicitation of public comments on initial data collection and reporting periods for Clinical Laboratory Fee Schedule
Part B drugs: Payment for biosimilar biological products
Part B drug payment: Infusion drugs furnished through an item of durable medical equipment
New care coordination services and payment for rural health clinics and federally-qualified health centers
Appropriate use criteria for advanced diagnostic imaging
Medicare Diabetes Prevention Program expanded model
Physician Quality Reporting System
Patient relationship codes
Medicare Shared Savings Program
2018 Value Modifier.

Physicians and other healthcare organizations should review this new guidance as soon as possible and begin preparing for these changes which take affect at the first of the year.

About The Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications. Ms. Stamer works with health industry and related businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management, disaster and other crisis preparedness and response, and other performance and operations management and compliance. Her experienced includes career long involvement in advising and defending health industry and other organizations about disaster and other crisis preparation, response and mitigation arising from natural and man-made disasters, government enforcement, financial distress, workplace emergencies and accidents, data breach and other cybersecurity and other events. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

About Solutions Law Press, Inc.™

Leave a Comment » | Conditions of Participation, Corporate Compliance, Doctor, Electronic Health Records, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health IT, Hospital, Medicaid, Medicare, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Money Laundering, OIG, Outpatient, Physician, Prospective Payment, quality reporting, Reimbursement, Rural Health Care, Stark, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Check Your Medicare/Medicaid Compliance Against Against Quarterly Guidance Changes List

October 27, 2017

Healthcare providers, Medicare/Medicaid Advantage Plans, beneficiaries, and suppliers should use the Medicare and Medicaid Programs; Quarterly Listing of Program Issuances—July Through September 2017 published today to help confirm compliance and other practices take into account potentially relevant new key Medicare and Medicaid guidance issued during the period from July 1 to September 30, 2017.

Staying up-to-date with the latest Program is critical maintain qualification for benefits and rights and avoid getting nailed for harsh civil or even criminal penalties that violations can trigger. However keeping up with the constantly evolving guidance can be daunting.

The quarterly notice lists updates that happened in the 3-month period along with a hyperlink to the full listing that is available on the CMS Web site or the appropriate data registries that are used as Center for Medicare and Medicaid Services resources. for beneficiaries, providers, and suppliers.

The resource provides a convenient tool for the public to find the full list of qualified providers for these specific services and offers more flexibility and ‘‘real time’’ accessibility. In addition, many of the Web sites have listservs; that the public can subscribe and receive immediate notification of any updates to the Web site. These listservs avoid the need to check the Web site, as notification of updates is automatic and sent to the subscriber as they occur.

This notice is organized into 15 addenda so that a reader may access the subjects published during the quarter covered by the notice to determine whether any are of particular interest. Interested persons should use the Quarterly Notice in concert with previously published notices.

About The Author

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Affordable Care Act, ASC, Border Health, Centers For Disease Control, Childrens Health Insurance Program, Conditions of Participation, Consumer Driven Health Care, Controlled Substances, Corporate Compliance, Cultural diversity, data breach, data security, Disability Discrimination, Disease Management, DME, Doctor, drug treatment, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, EMTALA, Evidence Based Medicine, false claims act, FDA, Federal Health Center, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health Insurance Exchange, Health IT, healthcare, HIPAA, Home Health, Hospice, Hospital, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medicaid, Medical Licensure, Medicare, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Mental Health, Mental Heatlh, Money Laundering, NIOSH, OCR, OIG, Outcomes Data, Pharmaceudical, Pharmacy, Physician, Physician Licensing, Prescription Drugs, Psychiatric, quality reporting, Reimbursement, Rural Health Care, Stark, Substance Abuse, Telemarketing, Uncategorized, Veterans Health, Veterans Health Care | Permalink
Posted by Cynthia Marcotte Stamer

HHS Picks Hargan As Acting HHS Secretary

October 11, 2017

President Trump has appointed Eric D. Hargan Acting Secretary of the U.S. Department of Health and Human Services (HHS).

Hargan, who was just sworn into office as Deputy Secretary of HHS on Oct. 6, 2017, takes over the duties of former Secretary Dr. Tom Price, who recently resigned in response to criticism about his expenditures for charter flights.

Before joining HHS, Mr. Hargan was an attorney, most recently a shareholder in Greenberg Traurig’s Chicago office in the Health and FDA Business department, where he focused his practice on transactions, healthcare regulations and government relations. He represented investors, companies, and individuals in healthcare investments and issues across the entire sector.

From 2003 to 2007, Mr. Hargan served at HHS in a variety of capacities, ultimately holding the position of Acting Deputy Secretary. During his tenure at HHS, Mr. Hargan also served as the Department’s Regulatory Policy Officer, overseeing the development and approval of all HHS, CMS, and FDA regulations and significant guidances.

Prior to this role, he served HHS as Deputy General Counsel. More recently, he was tapped by Governor Bruce Rauner to serve during transition as lead co-chair for Gov. Rauner’s Healthcare and Human Services committee.

During his time in Illinois, Mr. Hargan taught at Loyola Law School in Chicago, focusing on administrative law and healthcare regulations. He was a member of the U.S. government team at the inaugural U.S.-China Strategic Economic Dialogue in Beijing in 2006-2007, worked with the State Department’s Bureau of Arms Control to advance biosecurity in developing nations, and initiated and led the HHS team that developed the first responses to international food safety and importation issues in 2007.

He received his B.A. cum laude from Harvard University, and his J.D. from Columbia University Law School, where he was Senior Editor of the Columbia Law Review. Mr. Hargan also received a Certificate in International Law from the Parker School of Foreign and Comparative Law at Columbia University.

Before returning to Washington, D.C., Mr. Hargan lived in the suburbs of Chicago with his wife, Emily, and their two sons.

About The Author

Ms. Stamer works with health industry and related businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management, disaster and other crisis preparedness and response, and other performance and operations management and compliance. Her experienced includes career long involvement in advising and defending health industry and other organizations about disaster and other crisis preparation, response and mitigation arising from natural and man-made disasters, government enforcement, financial distress, workplace emergencies and accidents, data breach and other cybersecurity and other events. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and publisher disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | Academic medicine, Affordable Care Act, Anti-KickBack, ASC, Centers For Disease Control, Childrens Health Insurance Program, Conditions of Participation, data breach, data security, DEA, Doctor, Electronic Medical Records, EMTALA, FDA, Federal Health Center, Federal Sentencing Guidelines, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health Insurance Exchange, Health IT, Health Plan, Health Plans, healthcare, HHS, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, hospitals, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, managed care, Meaningful Use, Medicaid, Medical Privacy, Medical Records, Medicare, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Mental Health, Mental Heatlh, OCR, OIG, Outcomes Data, Outpatient, Peer Review, Pharmaceudical, Pharmacy, Physician, Preexisting Condition Insurance Plan, Prescription Drugs, Privacy, Prospective Payment, Psychiatric, public health, Public Policy, quality reporting, Reimbursement, Reproductive Rights, Rural Health Care, Skilled Nursing Facility, Stark, Substance Abuse, substance abuse treatment, Telemarketing, Telemedicine, Uncategorized, Wellness | Tagged: Affordable Care Act, controlled substance, drugs, false claims act, Health Care, Health Care Compliance, Health Care Fraud, Health Care Provider, Health Care Reimbursement, Health Plans, HEAT, HHS, HIPAA, Hospital, Medicaid, Medicare, OCR, pain management, pharmacist, pharmacy, Physician, Physicians, Privacy, Reimbursement | Permalink
Posted by Cynthia Marcotte Stamer

OCR Gives Health Care Providers, Other Covered Entities Post-Las Vegas Shooting HIPAA Medical Privacy Guidance On Disclosures To Family, Media & Others For Notification & Other Purposes

October 9, 2017

Widespread media coverage of this week’s Las Vegas, Nevada mass shooting (Las Vegas Shooting), and recent Hurricanes in Texas, Florida and Puerto Rico shows the barrage of requests for patient information from emergency and disaster response personnel, concerned family and friends, the media or others about the identity, status and other circumstances of patients and other individuals that health care providers caring for patients following a mass disaster or other emergency.

The tight restrictions and potentially stiff penalties authorized under the Health Insurance Portability And Accountability Act (HIPAA) Privacy and Security Rule (Privacy Rule) on health care providers, health plans, and health care clearinghouses (Covered Entities) for improperly disclosing information about identifiable patients under the Privacy Rule necessitate that health care providers and other Covered Persons exercise great care to ensure that statements and other disclosures of identifiable patient information either are authorized in writing in accordance with HIPAA or otherwise specifically allowed under the Privacy Rule. See, e.g., $2.4M HIPAA Settlement Warns Providers About Media Disclosures Of PHI; $2.4M HIPAA Settlement Message Warns Health Plans & Providers Against Sharing Medical Info With Media, Others; $2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use.

Following the Las Vegas Shooting, the Department of Health & Human Services (HHS) Office for Civil Rights (OCR) on October 3, 2017 issued an announcement on “Disclosures to Family, Friends, and Others Involved in an Individual’s Care and for Notification” (Announcement) intended to clarify certain limited situations when OCR interprets the Privacy Rule as allowing Covered Entities to disclose PHI to individuals involved in the patient’s care, the media or other parties not involved in the patient’s care for notification purposes without prior patient authorization. Health care providers and other Covered Entities should review and update their existing Privacy Rule policies, practices and training in response to this and other evolving guidance to help prepare their teams appropriately to respond to family, media and other inquiries about patients in emergency and other circumstances.

Privacy Rule Generally

While mass shooting events like the Las Vegas Shooting, recent hurricanes, Ebola or other contagious disease outbreak and other mass injury or illness events garner widespread media and public attention, health care providers and other Covered Entities also regularly field requests for PHI about current or former patients from family and others involved in patients’ care or treatment, law enforcement, law enforcement, and the media or other members of the general public not involved in patient care.

The Privacy Rule generally requires Covered Entities to keep confidential, and prohibits Covered Entities from disclosing individually identifiable health care information about a patient that qualifies as “protected health information” or “PHI” without first obtaining a HIPAA-compliant authorization unless the disclosure meets all the requirements to fall under an exception defined in the Privacy Rule.

Since HIPAA’s broad definition of PHI encompasses even the name, identity and even existence of a patient, as well as more specific information about the current or past health condition and treatment of a patient, health care providers and other Covered Entities must prepare and train their staff to be prepared appropriately to comply with the Privacy Rules even when considering disclosing PHI to identify an incapacitated patient, notify or respond to inquiries of family or others involved in caring for patient during an emergency or disaster.

As OCR guidance consistently reaffirms, the Privacy Rule’s general prohibition against PHI without prior patient authorization and other requirements generally still apply during public health or other emergencies.[1] While Social Security Act § 1135(b)(7) allows HHS temporarily to waive sanctions and penalties for violations of some, but not all Privacy Rule requirements by a covered hospitals operating under disaster protocols during periods the President declares an emergency or disaster and the HHS Secretary declares a public health emergency as in response to Hurricanes Katrina,[2]Harvey,[3] Irma,[4] and Maria,[5] this relief is rarely applicable, and limited in scope, applicability and duration.[6] Consequently, Covered Entities still need to ensure that any contemplated disclosure is either authorized or meets all requirements the Privacy Rule requires to fall under an exemption to its general prohibition against unauthorized disclosure to avoid becoming subject to civil or even criminal sanctions under the Privacy Rule even when responding to inquiries during mass disaster, public health emergency or other exigent circumstances.

As discussed in November 2016 OCR Bulletin On HIPAA Privacy in Emergency Situations, the Privacy Rule includes various exceptions that may allow a health care provider or other Covered Entity to disclose the PHI of a patient involved in a public health or other emergency without patient authorization including:

PHI about the patient necessary to treat the patient or to treat a different patient including the coordination or management of health care and related services by one or more health care providers and others, consultation between providers, and the referral of patients for treatment. See 45 CFR §§ 164.502(a)(1)(ii), 164.506(c), and the definition of “treatment” at 164.501;
To a public health authority, such as the Centers for Disease Control and Prevention (CDC) or a state or local health department, authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability. See 45 CFR §§ 164.501 and 164.512(b)(1)(i);
As necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public when consistent with applicable law (such as state statutes, regulations, or case law) and the provider’s standards of ethical conduct. See 45 CFR 164.512(j);
To a patient’s family members, relatives, friends, or other persons identified by the patient as involved in the patient’s care or as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death provided that the Covered Entity gets at least verbal permission from individuals or otherwise be able to reasonably infer that the patient does not object, when possible; or if the individual is incapacitated or not available, in the Covered Entity’s professional judgment, doing so is in the patient’s best interest. See 45 CFR 164.510(b);
With disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts, for the purpose of coordinating the notification of family members or other persons involved in the patient’s care, of the patient’s location, general condition, or death without authorization if doing so would interfere with the organization’s ability to respond to the emergency; or
Limited facility directory information to acknowledge an individual is a patient at the facility and provide basic information about the patient’s condition in general terms (e.g., critical or stable, deceased, or treated and released) to the media or others not involved in the care of the patient upon request for information about a particular patient by name, if the patient has not objected to or restricted the release of such information or, if the patient is incapacitated, if the disclosure is believed to be in the best interest of the patient and is consistent with any prior expressed preferences of the patient. See 45 CFR 164.510(a).

Announcement Clarifies Privacy Rules For Disclosures To Individuals Involved In Patient’s Care; For Notification; And To Media Or Others Not Involved In Patient Care

The new OCR Announcement provides clarification of the applicability of the Privacy Rule exemptions regarding disclosures of PHI by health care providers or other Covered Entities:

To individuals involved in the patient’s care or for notification purposes; or
To media or other individuals not involved in the patient’s care.

In addition, the Announcement also reminds Covered Entities:

Of their responsibility to limit disclosures made without HIPAA-compliant patient authorization other than for treatment purposes to the minimum necessary,
That the Privacy Rule allows Covered Entities to rely upon certifications that information requested by public health authorities or officials that the information requested is the minimum necessary; and
To continue to enforce role-based restrictions on PHI.
Disclosures to Family, Friends, Disaster Relief Responders and Others Involved in an Individual’s Care and for Notification

Privacy Rule §164.510(b) permits a Covered Entity to share PHI:

With a patient’s family members, relatives, friends, or other persons identified by the patient as involved in the patient’s care.
About a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death. This may include, where necessary to notify family members and others, the police, the press, or the public at large. See Privacy Rule § 164.510(b).

When making such disclosures, the Announcement states a Covered Entity should get verbal permission from individuals or otherwise be able to reasonably infer that the patient does not object, when possible.

Concerning patients who are unconscious or incapacitated, the OCR guidance also states that a health care provider may share relevant information about the patient with family, friends, or others involved in the patient’s care or payment for care, if the health care provider in its professional judgement determines that doing so is in the best interests of the patient.

In addition, OCR says Covered Entities also may share PHI with disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts, for the purpose of coordinating the notification of family members or other persons involved in the patient’s care, of the patient’s location, general condition, or death. When disclosing PHI to disaster relief organizations, the Announcement states it is unnecessary to obtain a patient’s permission to share the information in this situation if doing so would interfere with the organization’s ability to respond to the emergency.

Disclosures to the Media or Others Not Involved in the Care of the Patient/Notification

As the Las Vegas Shooting illustrates, health care providers and other Covered Entities caring for patients during public health or other emergency situations often must deal with news or other media crews on or around treatment or other health care facilities and media and inquiries from the media or others about the identity, status or other PHI of patients. OCR’s past imposition of stiff penalties against other Covered Entities for improperly disclosing patient PHI to the media or the public without authorization alert Covered Entities of HIPAA risks of failing to properly control access and disclosures of PHI to the media or other general public without obtaining prior written authorization from patients or their personal representatives. See e.g., $2.4M HIPAA Settlement Warns Providers About Media Disclosures Of PHI. See also HIPAA Sanctions Triggered From Covered Entity Statements To Media, Workforce.

Previously issued OCR guidance makes clear that health care providers and other Covered Entities risk sanction both from allowing media or other members of the public inappropriate access to patient treatment or other areas with unsecured PHI as well as media statements and other disclosures of PHI to the media or public without first obtaining a HIPAA-compliant authorization except under narrow circumstances specified in the Privacy Rule.. See 45 CFR 164.510(a). OCR FAQ on Disclosures to the Media, for instance, states:

“the HIPAA Privacy Rule does not permit health care providers to disclose PHI to media personnel, including film crews, without having previously obtained a HIPAA-compliant authorization signed by the patient or his or her personal representative. In other words, health care providers may not allow members of the media, including film crews, into treatment areas of their facilities or other areas where PHI will be accessible in written, electronic, oral or other visual or audio form, without prior authorization from the patients who are or will be in the area or whose PHI will be accessible to the media. It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients (using techniques such as blurring, pixilation, or voice alteration software) for whom an authorization was not obtained, because the HIPAA Privacy Rule does not allow media access to the patients’ PHI, absent an authorization, in the first place.

In addition, the health care provider must ensure that reasonable safeguards are in place to protect against impermissible disclosures or to limit incidental disclosures of other PHI that may be in the area but for which an authorization has not been obtained.

While emphasizing the Privacy Rule’s general requirement to secure advance authorization, OCR FAQ on Disclosures to the Media also recognizes the following “very limited situations” that the Privacy Rule permits a Covered Entity to disclose limited PHI to the media without obtaining a HIPAA authorization:

A Covered Entity may disclose limited PHI about an unidentified incapacitated patient to the media seek to have the media help identify or locate the family of an unidentified and incapacitated patient in its care if, in the hospital’s professional judgment, doing so is in the patient’s best interest. See 45 C.F.R. 164.510(b)(1)(ii);
A Covered Entity may disclose a patient’s location in the facility and condition in general terms that do not communicate specific medical information about the individual to any person, including the media, without obtaining a HIPAA authorization where the individual has not objected to his information being included in the facility directory, and the media representative or other person asks for the individual by name. See 45 C.F.R. 164.510(a);
The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility;
A health care provider may utilize the services of a contract film crew to produce training videos or public relations materials on the provider’s behalf if certain protections are in place. If patients are to be identified by the provider and interviewed by a film crew, or if PHI might be accessible during filming or otherwise disclosed, the provider must enter into a HIPAA business associate agreement with the film crew acting as a business associate. Among other requirements, the business associate agreement must ensure that the film crew will safeguard the PHI it obtains, only use or disclose the PHI for the purposes provided in the agreement, and return or destroy any PHI after the work for the health care provider has been completed. See 45 C.F.R. 164.504(e)(2). As a business associate, the film crew must comply with the HIPAA Security Rule and a number of provisions in the Privacy Rule, including the Rule’s restrictions on the use and disclosure of PHI. In addition, authorizations from patients whose PHI is included in any materials would be required before such materials are posted online, printed in brochures for the public, or otherwise publicly disseminated; and
Covered Entities can continue to inform the media of their treatment services and programs so that the media can better inform the public, provided that, in doing so, the Covered Entity does not share PHI with the media without the prior authorization of the individuals who are the subject of the PHI.

The Announcement reaffirms the general principles stated in this and other prior guidance concerning Covered Entities dealings with the media and public and clarifies its interpretation about what PHI, if any, the Privacy Rule allows hospitals and other health care providers about PHI may share in response to requests from the media or other individuals not involved in the care of a patient without first obtaining an authorization.

The Announcement reaffirms that affirmative reporting to the media or the public at large about an identifiable patient, or the disclosure to the public or media of specific information about treatment of an identifiable patient, such as specific tests, test results or details of a patient’s illness, may not be done without the patient’s written authorization (or the written authorization of a personal representative who is a person legally authorized to make health care decisions for the patient) that complies with HIPAA’s authorization requirements. See 45 CFR 164.508.

The Announcement also clarifies, however, that Covered Entities that are hospitals or health care facilities that receive a request for information about a particular patient by name may release limited facility directory information to acknowledge an individual is a patient at the facility and provide basic information about the patient’s condition in general terms (e.g., critical or stable, deceased, or treated and released) if the patient has not objected to or restricted the release of such information or, if the patient is incapacitated, if the disclosure is believed to be in the best interest of the patient and is consistent with any prior expressed preferences of the patient.

Minimum Necessary Requirements & Other Privacy Rule Responsibility Reminders

The Announcement also cautions Covered Entities of the need to ensure beyond ensuring that a disclosure falls under a Privacy Rule exception, Covered Entities also need to ensure that other requirements of the Privacy Rule applicable to the disclosure also are met. In this respect, the Announcement cautions Covered Entities that the Privacy Rule requires they limit any otherwise permitted disclosure of PHI other than for treatment purposes made without obtaining a HIPAA-compliant patient authorization to the minimum necessary to achieve the allowed purpose, while also reminding Covered Entities that when making disclosures otherwise permitted to public health authorities or public officials, the Privacy Rule allows the Covered Entity to rely on representations from a public health authority or other public official that the requested information is the minimum necessary for the purpose.

Furthermore, the Announcement also warns Covered Entity that they should continue to apply their role-based access policies to limit access to PHI to only those workforce members who need it to carry out their duties. See Privacy Rules §§ 164.502(b), 164.514(d).

In addition to keeping in mind these Privacy Rule conditions, Covered Entities also need to take steps to ensure that their organizations and workforce also continue to follow all necessary procedures to ensure that their organizations can demonstrate continued compliance with other Privacy Rule requirements on verification, documentation and recordkeeping, accounting for disclosure, business associates and the like. In this regard, it is important that Covered Entities and their business associates take appropriate steps to ensure that their workforce carefully creates and retains the documentation and records needed to defend their actions as well as to respond to HHS requests and/or requests for accounting or disclosure that might arise in the future.

Required Action: Review & Update Emergency & Other Practices, Training In Response To Evolving Guidance

The Privacy Rules and other OCR guidance make clear that health care providers and other Covered Entities and their business associates are expected both to implement and maintain their practices, policies, workforce training and safeguards appropriately to control use, access and disclosure in emergency and other situations as well as to implement the necessary systems and safeguards to protect sensitive PHI, electronic PHI and associated records and system from improper access from the media or others and damage or destruction from disaster or other events.

In recognition that maintaining Privacy and Security Rule Compliance can prove challenging for Covered Entities and their business associates during emergency or other exigent events, OCR has published various other guidance it hopes will help Covered Entities and business associates prepare for and respond to these challenges including its Disclosure For Emergency Preparedness Decision Tool; and Public Health Authority Disclosure Request Checklist.

Covered Entities and their business associates should act promptly to review and update their policies, practices, safeguards and workforce training as needed in response to the new Announcement and other OCR guidance promptly.

About The Author

Repeatedly recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, a Fellow in the American College of Employee Benefit Council, the American Bar Foundation and the Texas Bar Foundation and board certified in labor and employment law by the Texas Board of Legal Specialization, Cynthia Marcotte Stamer is a practicing attorney, management consultant, author, public policy advocate and lecturer widely known for health and managed care, employee benefits, insurance and financial services, data and technology and other management work, public policy leadership and advocacy, coaching, teachings, and publications. Nationally recognized for her work, experience, leadership and publications on HIPAA and other medical privacy and data use and security, FACTA, GLB, trade secrets and other privacy and data security concerns, Ms. Stamer has worked extensively with clients and the government on cybersecurity, technology and processes and other issues involved in the use and management of medical, insurance and other financial, workforce, trade secrets and other sensitive data and information throughout her career. Scribe or co-scribe of the ABA Joint Committee on Employee Benefits Agency meeting with OCR since 2011, Ms. Stamer extensive experience, advising, representing, training and coaching health care providers, health plans, healthcare clearinghouses, business associates, their information technology and other solutions providers and vendors, and others on HIPAA and other privacy, data security and cybersecurity design, documentation, administration, audit and oversight, business associate and other data and technology contracting, breach investigation and response, and other related concerns including extensive involvement representing clients in dealings with OCR and other Health & Human Services, Federal Trade Commission, Department of Labor, Department of Treasury, state health, insurance and attorneys’ general, Congress and state legislators and other federal officials.

Ms. Stamer also has an extensive contributes her leadership and insights with other professionals, industry leaders and lawmakers. Her insights on HIPAA risk management and compliance often appear in medical privacy related publications of a broad range of health care, health plan and other industry publications Among others, she has conducted privacy training for the Association of State & Territorial Health Plans (ASTHO), the Los Angeles Health Department, SHRM, HIMMS, the American Bar Association, the Health Care Compliance Association, a multitude of health plan, insurance and financial services, education, employer employee benefit and other clients, trade and professional associations and others. You can get more information about her HIPAA and other experience here. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources here.
If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

[1] See e.g. OCR Bulletin: HIPAA Privacy in Emergency Situations (November 2014).

[2] Disclosing PHI in Emergency Situations; Compliance Guidance and Enforcement Statement.

[3] August 2017 Hurricane Harvey Bulletin.

[4] September 2017 Hurricane Irma Bulletin.

[5] September 2017 Hurricane Maria Bulletin

[6] The HIPAA Privacy Rule is not suspended during a public health or other emergency; however, Section 1135(b)(7) of the Social Security Act allows HHS to waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the Privacy Rule events if the President declares an emergency or disaster and the Secretary declares a public health emergency:

the requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).
the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).
the requirement to distribute a notice of privacy practices. See 45 CFR 164.520.
the patient’s right to request privacy restrictions. See 45 CFR 164.522(a).
the patient’s right to request confidential communications. See 45 CFR 164.522(b).

If the Secretary issues such a waiver, it only applies: (1) in the emergency area and for the emergency

period identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol.

When the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol. See also Social Security Act 1135(b)(7); Frequently Asked Question: HIPAA waiver during a national or public health emergency; OCR Bulletin: HIPAA Privacy in Emergency Situations (November 2014).

Leave a Comment » | 1335 Waiver, Academic medicine, ARRA, ASC, Childrens Health Insurance Program, Corporate Compliance, Cyber crime, data breach, data security, Disaster Relief, Doctor, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, ERISA, FACTA, Federal Health Center, Fiduciary Responsibility, GINA, Health Care, Health Care Provider, Health Care Quality, Health IT, Health Plan, Health Plans, Health Policy, healthcare, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospital, Hospital, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Joint Commission, Laws, managed care, Meaningful Use, Medical Privacy, Medical Records, Mental Health, Pharmaceudical, Pharmacy, Privacy, Psychiatric, Skilled Nursing Facility, Technology, Telemedicine, Uncategorized, Veterans Health Administration | Tagged: Crisis preparedness, Cybercrime, Disaster, dta breach, Emergency, Health Care, HIPAA, Hurricane, Hurricane Harvey, Hurricane Irma, Hurricane Maria, Las Vegas Shooting, Mass Shooting, Medical Privacy, OCR, Privacy, public health, Terrorism | Permalink
Posted by Cynthia Marcotte Stamer

Christus Pays $12.24M Settlement Resolves False Claims Act Charges From “Donations” To New Mexico

September 11, 2017

CHRISTUS St. Vincent Regional Medical Center (St. Vincent) and its partner, CHRISTUS Health (CHRISTUS), have agreed to pay $12.24 million, plus interest to resolve charges by the U.S. Department of Justice (DOJ) and U.S Department of Health and Human Services Office of Inspector General (OIG) they violated the False Claims Act by making illegal donations to county governments that the counties used to fund the state share of Medicaid payments to the hospital. The settlement announced September 1, 2017 highlights the needs for States and private healthcare providers to use care to ensure that creative partnerships don’t violate federal Medicare or other program requirements as well as the risk that the False Claims Act or other whistleblower rules will incentivize disgruntled employees or other service providers to bring aggressive conduct to the attention of federal officials.

The settlement resolves allegations made in U.S. ex rel. Stepan v. Christus St. Vincent Regional Medical Center Corp. et al., Civil Action No. 11-cv-572 (D.N.M.) that St. Vincent and CHRISTUS allegedly caused the State of New Mexico to present false Medicaid claims in violation of the False Claims Act by making non-bona fide donations to the State of New Mexico that New Mexico improperly used to fulfill the requirement that the State pay 25% “matching” share to fund the New Mexico Sole Community Provider Program (SCP) between 2001 and 2009.

Under the now defunct SCP Program, federal law required that New Mexico fund 25% of the costs of the SCP program to qualify for reimbursement from the federal government for approximately 75 percent of its health care expenditures under the SCP program. Under federal law, New Mexico’s 25 percent “matching” share of SCP program payments had to consist of state or county funds, and not impermissible “donations” from private hospitals. Congress enacted this restriction on the use of private hospital funds to satisfy state Medicaid obligations to curb possible abuses and ensure that states have sufficient incentive to curb rising Medicaid costs.

The charges resolved by the settlement originally were brought in a qui tam lawsuit filed by a former Los Alamos County, New Mexico Indigent Healthcare Administrator . The whistleblower will receive $2.249 million as her share of the recovery in this case.

The prosecution and its settlement drive home both the importance for States receiving Medicaid funds and private health care partners providing services to patients reimbursed by these funds to use care to comply with all applicable program requirements, as well as the continuing risk of exposure and resulting liability from whistleblower claims brought by unhappy employees or others looking to use their knowledge of questionable conduct to realize profitable recoveries.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications. Ms. Stamer works with health industry and related businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | Academic medicine, Anti-KickBack, Conditions of Participation, Corporate Compliance, Employment, false claims act, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Reform, health care reimbursement, Hospital, Hospital, Medicaid, Uncategorized | Tagged: DOJ, false claims act, Health Care Fraud, HEAT, Medicaid, OIG, St. Vincent Christus, Whistleblower | Permalink
Posted by Cynthia Marcotte Stamer

Oklahoma Nursing Home Settles HHS HIV Discrimination Charges

September 8, 2017

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) has entered into a Voluntary Resolution Agreement with Heritage Hills Living & Rehabilitation Center, LLC (Heritage Hills) that resolves a HHS complaint alleging that Heritage Hills discharged a seriously ill patient from its facility upon learning that she was HIV positive and in violation of Section 504 of the Rehabilitation Act of 1973 and Section 1557 of the Affordable Care Act. Part of HHS’ expanding civil rights enforcement emphasis, the resolution agreement reminds health care providers and others receiving or providing services funded by programs managed by HHS of their growing exposure to civil rights prosecutions and liability for failing to comply with federal civil rights law nondiscrimination rules.

Heritage Hills is a for-profit, 81-bed, certified skilled nursing facility located in the City of McAlester, in Pittsburg County, Oklahoma. Because Heritage Hills receives Federal financial assistance through its participation in the Medicare and Medicaid programs, it is subject to the requirements of Section 504 and Section 1557.

Heritage Hills agreed to resolve the complaint after OCR initiated an investigation into whether Heritage Hills discriminated against the complainant’s daughter on the basis of the daughter’s disability (HIV/AIDS) in violation of Section 504 and Section 1557.

Under the Resolution Agreement, Heritage Hills agrees to:

Ensure compliance with Section 504 and Section 1557;
Report admissions and discharge data to OCR for a 12 month period;
Appoint a Civil Rights Coordinator;
Publish and post a new non-discrimination policy;
Iimplement a new patient grievance procedure and inform patients of their right to file complaints with OCR;
Rrequire its staff to receive training on HIV/AIDS and Federal non-discrimination obligations; and
Rrevise its admissions policy to ensure that all individuals with disabilities, including but not limited to HIV/AIDS, are provided equal access to and an equal opportunity to participate in all programs, benefits and services offered by the facility.

The HHS enforcement action reminds health care providers about the importance of properly managing their civil rights compliance. During the last five years, OCR has engaged in more than 200 enforcement and outreach efforts involving HIV/AIDS, including public education campaigns, HIV-related civil rights complaint investigations, HIV-related health information privacy investigations and 12 joint civil rights/health information privacy compliance reviews, which were the subject of OCR’s report, Protecting the Civil Rights and Health Information Privacy of People Living with HIV/AIDS. The report is available here.

Of particular note, OCR has launched an Information is Powerful Medicine public education campaign, which encourages those living with HIV to be proactive in their health care. The campaign explains individuals’ health information privacy rights, including how individuals can monitor and access a copy of their medical records.

OCR’s enforcement in this and other HIV discrimination actions is part a broader nondiscrimination and civil rights enforcement initiative under Section 1551 and other federal laws which has resulted in a growing list of multi-million dollar settlements from health care providers, state and local government agencies and others receiving federal funding from programs managed by the Department of Health & Human Services. See here. Health care providers should verify their policies and operations comply with these civil rights nondiscrimination rules.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications. Ms. Stamer works with health industry and related businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. Her experienced includes more than 20 years of experience advising and defending health industry and other organizations about disability and other civil rights discrimination law compliance and risk management. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | ADA, Corporate Compliance, Cultural diversity, Disability Discrimination, Discrimination, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Provider, HIPAA, Home Health, Hospice, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Medicaid, Medical Privacy, Medicare, Medicare Advantage, OCR, Pharmacy, Rehabilitation Act, Skilled Nursing Facility, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

HHS Issues Hurricane Irma Relief For Puerto Rico, U.S. Virgin Islands & Florida

September 8, 2017

In preparation for anticipated disruptions and damage from Hurricane Irma, Health and Human Services (HHS) Secretary Tom Price, M.D. declared a Public Health Emergency in Puerto Rico and the U.S. Virgin Islands on Wednesday, September 6, 2017 and in Florida on Thursday, September 7, 2017.

By declaring the disaster and before the Hurricane makes landfall, HHS seeks to maximize the flexibility of healthcare providers to respond to the anticipated deluge of health care needs anticipated to occur around the Hurricane by using its authority under Social Security Act 1135 to waive and modify certain health care rules under Medicare, Medicaid and certain other federal programs. See here.

Beyond modification of these requirements, the declaration also triggers limited relief for covered health care providers from certain otherwise applicable requirements of the Health Insurance Portability & Accountability Act (HIPAA) Privacy Rules. See here for OCR’s latest guidance on the limited waiver of HIPAA Sanctions and penalties during a declared emergency.

About the Author

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | 1335 Waiver, Academic medicine, Ambulatory care, Border Health, Childrens Health Insurance Program, Conditions of Participation, Disaster Relief, DME, Doctor, EMTALA, Federal Health Center, Health Care, Health Care Finance, Health Care Provider, Health Care Quality, health care reimbursement, Health Plan, healthcare, HIPAA, Hospice, Hospital, hospitals, Inpatient Rehabilitation Facility, Medical Privacy, Medical Records, Medicare Fee Schedule, OCR, Physician, Physician Licensing, public health, Public Policy, Reimbursement | Permalink
Posted by Cynthia Marcotte Stamer

CMS Proposes Cutbacks To Medicare Bundled Payment Program

August 15, 2017

A Centers for Medicare and Medicaid Services (CMS) proposed rule scheduled for publication in the August 18, 2017 Federal Register will propose to reduce the number of mandatory geographic areas for the joint bundled payment program and cancel the cardiac bundled payment program model for determining reimbursement of providers for care under Medicare as well as make other refinements to the bundled payment program scheduled to take effect in January.

Widely criticized by many providers including department of Health and Human Services Secretary Dr. Tom Price, the mandatory bundled payment program presently is scheduled to take effect in January, 2018 after multiple delays.

According to the advanced copy of the proposed rule released by CMS on August 15, 2017, the proposed rule will propose among other things the following changes to the bundled payment program:

Cancel the Episode Payment Models (EPMs) and Cardiac Rehabilitation (CR) incentive payment model and rescind the regulations governing these models;
Revise certain aspects of the Comprehensive Care for Joint Replacement (CJR) model, including: giving certain hospitals selected for participation in the CJR model a one-time option to choose whether to continue their participation in the model;
Make technical refinements and clarifications for certain payment, reconciliation and quality provisions; and
Increase the pool of eligible clinicians that qualify as affiliated practitioners under the Advanced Alternative Payment Model (APM) track.

Healthcare providers and others interested in the proposed changes should carefully review the proposed changes and provide feedback as soon as possible and no later than the October 17, 2017 deadline the proposed regulation sets for submitting comments.

About The Author

The author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

An American Bar Foundation, American College of Employee Benefits Counsel, and Texas Bar Foundation Fellow, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, Ms. Stamer’s health industry experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management and a broad range of other legal and operational concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

Solutions Law Press, Inc.™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates, publications, training program, advocacy and other initiatives available here.

Go here to register to receive other Solutions Law Press, Inc. updates and announcements about other upcoming briefings, training or other programs, products, services, and activities or to learn more about Solutions Law Press, Inc., its publications, programs and training, PROJECT COPE: Coalition on Patient Empowerment community service and education projects, event management and other resources and services.

For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Anti-KickBack, billing, Clinical pathway, Conditions of Participation, Consumer Driven Health Care, Corporate Compliance, Doctor, Electronic Medical Records, Evidence Based Medicine, false claims act, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health Plan, Health Plans, healthcare, Hospital, Inpatient Rehabilitation Facility, Medicare, Medicare Fee Schedule, OIG, Physician, Prospective Payment, Reimbursement, Uncategorized | Tagged: Affordable Care Act, bundled payment program, CMS, false claims act, Health Care, Health Care Compliance, Health Care Fraud, Health Care Policy, Health Care Provider, Health Care Reform, Health Care Reimbursement, HHS, Hospital, Hospitals, Medicaid, Medicare, OIG, physical therapy, Physician, Physicians, Reimbursement | Permalink
Posted by Cynthia Marcotte Stamer

CMS Releases 2017 Provider Payment Program Hardship Exception Application

August 4, 2017

The Quality Payment Program Hardship Exception Application for the 2017 transition year now is available on the Quality Payment Program website.

MIPS eligible clinicians and groups may qualify for a reweighting of their Advancing Care Information performance category score to 0% of the final score, and can submit a hardship exception application, for one of the following specified reasons:

Insufficient internet connectivity
Extreme and uncontrollable circumstances
Lack of control over the availability of Certified EHR Technology (CEHRT).

Some MIPS eligible clinicians who are considered Special Status, will be automatically reweighted (or, exempted in the case of MIPS eligible clinicians participating in a MIPS APM), do not need to submit a Quality Payment Program Hardship Exception Application.
In addition to submitting an application via the Quality Payment Program website, clinicians also may contact the Quality Payment Program Service Center and work with a representative to verbally submit an application.

To submit an application, a physician or other applying clinician will need:

The Taxpayer Identification Number (TIN) for group applications or National Provider Identifier (NPI) for individual applications;
Contact information for the person working on behalf of the individual clinician or group, including first and last name, e-mail address, and telephone number; and
Selection of hardship exception category (listed above) and supplemental information.

Applicants for a hardship exception based on the Extreme and Uncontrollable Circumstance category, also must select one of the following and provide a start and end date of when the circumstance occurred:

Disaster (e.g., a natural disaster in which the CEHRT was damaged or destroyed);
Practice or hospital closure;
Severe financial distress (bankruptcy or debt restructuring);
EHR certification/vendor issues (CEHRT issues)

Once an application is submitted, CMS will send the applicant a confirmation email acknowledging receipt of the application and when it is pending, approved, or dismissed. Applications will be processed on a rolling basis.

Physician and other clinicians or practices interested in pursuing an exemption should act promptly.

About The Author

Cynthia Marcotte Stamer is a Martindale-Hubble “AV-Preeminent (Top 1%) rated practicing attorney and management consultant, health industry public policy advocate, widely published author and lecturer, recognized for her nearly 30 years’ of work on health industry and other privacy and data security and other health care, health benefit, health policy and regulatory affairs and other health industry legal and operational as a LexisNexis® Martindale-Hubbell® “LEGAL LEADER™ and “Top Rated Lawyer,” in Health Care Law and Labor and Employment Law; a D Magazine “Best Lawyers In Dallas” in the fields of “Health Care,” “Labor & Employment,” “Tax: Erisa & Employee Benefits” and “Business and Commercial Law,” a Fellow in the American Bar Foundation, the Texas Bar Foundation and the American College of Employee Benefit Counsel.

Technical advisor to the National Physicians Council for Healthcare Policy, Vice President of the North Texas Healthcare Professionals Association, American Bar Association (ABA) International Life Sciences Committee Vice Chair, Policy; Scribe for ABA JCEB annual agency meeting with OCR, Ms. Stamer is well-known for her extensive work and leadership throughout her career on healthcare and health policy, regulatory, operations and other industry topics. Her clients include public and private healthcare systems, hospitals and other healthcare facilities, health care providers, health insurers, health plans, employers, health and other technology and other vendors, communities and others.

In addition to representing and advising these organizations, she also speaks extensively and conducts training on health care and other privacy and data security and many other matters.

Beyond these involvements, Ms. Stamer also is active in the leadership of a broad range of other health care and other professional and civic organizations. Through these and other involvements, she helps develop and build solutions, build consensus, garner funding and other resources, manage compliance and other operations, and take other actions to identify promote tangible improvements in health care and other policy and operational areas.

For additional information about Ms. Stamer, see here or contact Ms. Stamer directly by e-mail here or by telephone at (469) 767-8872. ©2017 Cynthia Marcotte Stamer. Limited, non-exclusive right to republish granted to Solutions Law Press, Inc. All other rights reserved.

Leave a Comment » | Academic medicine, Affordable Care Act, Conditions of Participation, E-Prescribing, Evidence Based Medicine, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, healthcare, Home Health, Hospice, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medical Records, Medicare, Medicare Fee Schedule, OIG, Outcomes Data, Peer Review, quality reporting, Reimbursement, Rural Health Care, Skilled Nursing Facility, Uncategorized | Tagged: Affordable Care Act, CMS, Doctor, false claims act, Health Care, Health Care Compliance, Health Care Fraud, Health Care Policy, Health Care Provider, Health Care Reform, Health Care Reimbursement, HEAT, HHS, Hospital, Medical Board, Medicare, Medicare Part B, physical therapy, Physician, Physicians, PQRS, Reimbursement | Permalink
Posted by Cynthia Marcotte Stamer

RAISE Act Immigration Visa, Visa Holder Public Benefit Limits Create Potential Health Industry Concerns

August 3, 2017

Immigration law changes proposed in the newly revised version of the Reforming American Immigration for a Strong Economy Act (RAISE Act) reintroduced yesterday (August 2, 2017) seek significant changes in the foreign workers granted United States (U.S.) work visas and the public benefit eligibility of work and other visa holders in the U.S. that could have significant impacts on health care providers and other health industry organizations.

Backed by President Trump, Senate Co-Sponsor Tom Cotton said the the RAISE Act seeks to refocus U.S. legal immigration system to promote two main goals:

Helping American workers get a decent pay raise and have a higher standard of living; and
Helping promote economic growth to make America more competitive in the world.

The promote these Goals, the RAISE Act would overhaul the procedures that the U.S. uses to pick foreign immigrants granted certain U.S. work and other visas as well as reform rules and limits for granting work, refugee and family member visas and limit their eligibility for public benefits.

The centerpiece of the RAISE Act’s proposed reform is replacement of the current U.S. permanent employment visa and lottery visa programs with a new “merit based” selection process that would rely upon a “skills-based points system” created under the Act to determine the foreign workers eligible to receive work visas. As proposed under RAISE Act, the U.S. would issue a maximum of 140,000 employment-based visas annually. The U.S. Citizenship and Immigration Service would select the applicants invited to file full application and undergo security vetting twice a year from a pool of potential immigrants based on their point score ranking under the new skills-based point system. The new skills-based points system would prioritize workers for visa eligibility based applicants’ relative scores determined based on the English language ability, education, age and other “predictors of immigrant success and economic contribution” listed in the RAISE Act. For more details, see here.

Beyond replacing the current employment visa and lottery visa programs, the RAISE Act also would impose new limits on the number of visas granted, tighten the eligibility rules and requirements for granting visas to noncitizen family members of U.S. citizens and legal residents and foreign workers and refugees and exclude holders of these visas from eligibility for government benefits.

In addition to reforming the visa selection process, the RAISE Act also includes reforms intended to protect U.S. taxpayers against the cost of providing public benefits for visa holders. The REACH Act provides that immigrant households arriving through the skills-based points system are not eligible for federal means tested benefits for a period of 5 years. It also generally would restrict public benefit eligibility for immigrants in the U.S. on family or parent visas and require among other things, that adult citizens and legal residents sponsoring a newly created parental visa must provide health insurance coverage at no cost to the parent and other required support. Section 6 conditions naturalization on the sponsors of an immigrant fulfilling their obligation to reimburse the federal government for benefits used by the immigrant, as required under current law.

The RAISE Act’s proposed modifications to the work and other visa eligibility and selection process and imposition of restrictions on public benefit eligibility of visa holders are likely to have multiple implications for health care providers and other health industry organizations. Beyond potential implications on the recruitment and availability foreign workers to fulfill various positions, the proposed reforms are likely to change the mix and characteristics of foreign workers eligible to obtain visas to work in the United States, the predictability and timing of the selection of workers, foreign workers’ compensation, employer-provided and government provided benefit needs and and expectation, and other recruitment, compensation and other requirements and expectations of foreign workers and their families.

Meanwhile, the proposed limits on public benefits for visa holders contained in the RAISE Act also are likely to impact the availability, reliability, predictability and source of payment for health care or other services health care and other agencies provide to immigrant populations and raise questions about how the proposed public benefit reforms will interact with emergency assessment and treatment mandates like the Emergency Medical Treatment and Labor Act (EMTALA), federal and state English as a Second Language and other nondiscrimination and cultural diversity requirements that commonly trigger special responsibilities or risks relative to treatment or other interactions involving immigrants in the U.S.

Furthermore, it also remains to be seen how consideration under the skills-based points system of applicants’ English language skills, education, age and other criteria will impact English-only prohibitions, employment discrimination and affirmative action, and other “linguistic and cultural diversity” laws and practices that have gained traction over the past decade, U.S. employers will want to carefully evaluate the likely implications of these and other potential workforce implications on their recruitment, hiring and workforce practices, provide any relevant input concerning potential concerns to Congress and monitor the progress of these proposed reforms as President Trump and its sponsors push for the RAISE Act’s enactment.

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications. Ms. Stamer works with health industry and related businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. For additional information about Ms. Stamer, see here, e-mail her here or telephone Ms. Stamer at (214) 452-8297.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advise or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | Civil Rights, Cultural diversity, Discrimination, EMTALA, English as A Second Language, Health Care, Health Care Finance, Health Care Provider, Health Care Reform, Immigration, Medicaid, Medicare, Uncategorized | Tagged: EMTALA, Health Care, Health IT, Immigration, Indigent Care, Public Benefits, Visa | Permalink
Posted by Cynthia Marcotte Stamer

SCOTUS Bars State Law Restrictions On Health, Other Arbitration Agreement Enforceability

May 16, 2017

Monday’s U.S. Supreme Court ruling in Kindred Nursing Centers L.P. v. Clark boosts the ability of health care and other businesses and employers to enforce contractual agreements to arbitrate free from limits or other interference by State law imposed restrictions limiting the use or enforcement of arbitration agreements. Healthcare and other businesses and employers operating in States with special requirements for the enforcement of arbitration agreements should consult with legal counsel about the implications of the decision on their ability to use and enforce arbitration agreements with patients and other customers, employees and others prospectively and in ongoing disputes where the enforceability of arbitration agreements based on state law restrictions is an issue, as well as re-evaluate the effects of their own agreements to arbitration in past and future contracts might strengthen the ability of others unexpectedly to force arbitration.

The Kindred decision arose from the efforts of a health care provider, Kindred, to enforce arbitration clauses in nursing home agreements signed by legal representatives of patients admitted to its facilities. Kindred appealed to the federal courts after the Kentucky Supreme Court blocked Kindred from enforcing these contractual agreements to arbitrate because neither power of attorney specifically entitled the representative to enter into an arbitration agreement. The Kentucky Supreme Court imputed the requirement that the power of attorney specifically grant authority to agree to arbitration because the Kentucky Constitution declares the rights of access to the courts and trial by jury to be “sacred” and “inviolate” even though Kentucky law ordinarily would not require a similar express grant of power to enforce other types of contractual provision.

The U.S. Supreme Court in Kindred held that the Kentucky Supreme Court’s clear-statement rule violates the Federal Arbitration Act (FAA) by singling out arbitration agreements for disfavored treatment. Pp. 4–10.

The Supreme Court decision construed the FAA provision that arbitration agreements are “valid, irrevocable, and enforceable, save upon such grounds as exist at law or in equity for the revocation of any contract,” 9 U. S. C. §2, as requiring equal treatment of arbitration provisions with other contractual provisions. Under this equal treatment principle, the Supreme Court ruled a court may invalidate an arbitration agreement based on “generally applicable contract defenses,” but not on legal rules that “apply only to arbitration or that derive their meaning from the fact that an agreement to arbitrate is at issue.” Accordingly, the Supreme Court ruled that the FAA preempts any state rule that discriminates on its face against arbitration or that covertly accomplishes the same objective by disfavoring contracts that have the defining features of arbitration agreements.

Concluding that the Kentucky Supreme Court’s clear statement requirement for enforcement of arbitration provisions fails to put arbitration agreements on an equal plane with other contracts by requiring an explicit statement before an agent can relinquish her principal’s right to go to court and receive a jury trial, the Supreme Court found the Kentucky Supreme Court did exactly what the FAA barred: adopt a legal rule hinging on the primary characteristic of an arbitration agreement. Pp. 4–7. Accordingly the Supreme Court ordered the arbitration agreements enforced in Kindred.

Management Pointers & Action Items

The Supreme Court’s construction in Kindred of the FAA as establishing an “equal protection” rule for arbitration provisions expands the ability of health care organizations and others to enforce arbitration clauses in patient and other customer, employee and other contracts which previously might have been barred by special State statutory, regulatory or judicial requirements on the enforceability of arbitration clauses not generally applicable to other types of contractual provisions. While very valuable for health care organizations, this ruling also is likely to have implications beyond health care contracts to a broad range of other state laws and rules that purport to protect consumers, employees and others to contractually waive their litigation rights. While the Supreme Court ruling leaves open the ability to challenge arbitration clauses on contractual grounds generally applicable to all contracts, special State law rules for enforcing arbitration are not allowed.

Health industry and other management should review their arbitration agreements and related dispute resolution agreements with qualified legal counsel for potential options to reduce risks and manage dispute resolution costs using arbitration agreements with patients and other customers, employees, service providers and others as well as to understand the implications of existing arbitration clause is on their exposures to others arising from contractual agreements to arbitrate previously thought to be subject to state law restrictions on enforceability. Health care and other businesses and individuals considering entering in or enforcing arbitration agreements should keep in mind, however, that the Kindred ruling does not insulate arbitration agreements from State law defenses that apply equally to other non-arbitration contracts.

About The Author

Ms. Stamer works domestically and internationally with health, insurance and financial services, data and technology, services and consulting, energy, retail, hospitality and other businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. Her day-to-day work encompasses both labor and employment issues, as well as independent contractor, outsourcing, employee leasing, management services and other nontraditional service relationships. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with all aspects for workforce and human resources management, including, recruitment, hiring, firing, compensation and benefits, promotion, discipline, compliance, trade secret and confidentiality, noncompetition, privacy and data security, safety, daily performance and operations management, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

Well-known for her extensive work with health, insurance, financial services, technology, energy, manufacturing, retail, hospitality and governmental employers, her nearly 30 years’ of experience encompasses domestic and international businesses of all types and sizes.A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on these and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association; Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Gulf Coast TEGE Council Exempt Organization Coordinator; a founding Board Member and past President of the Alliance for Healthcare Excellence; former board member and Vice President of the Managed Care Association; past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; a member and advisor to the National Physicians’ Council for Healthcare Policy; current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee; current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section; Past Chair of the ABA Health Law Section Managed Care & Insurance Section; a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group; immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council; past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a former member of the Board of Directors, Treasurer, Member and Continuing Education Chair of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on human resources, labor and employment, employee benefits, compensation, occupational safety and health, and other regulatory and operational risk management. Examples of her many highly regarded publications on these matters include the “Texas Payday Law” Chapter of Texas Employment Law, as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications.

Want to know more? See here for details about the author of this update, attorney Cynthia Marcotte Stamer, e-mail her here or telephone Ms. Stamer at (469) 767-8872.

About Solutions Law Press, Inc.™

If you or someone else you know would like to receive future updates about developments on these and other concerns, please provide your current contact information and preferences including your preferred e-mail by creating or updating your profile here.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The publisher and the author expressly disclaim all liability for this content and any responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. ©2017 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved.

Leave a Comment » | Ambulatory care, Consumer Driven Health Care, Health Care, Health Care Finance, Health Care Provider, Health Care Quality, Hospital, Hospital, hospitals, Physician, Rural Health Care, Skilled Nursing Facility, Uncategorized | Tagged: arbitration, dispute resolution, Health Care, nursing home, Risk Management, SCOTUS, SNF | Permalink
Posted by Cynthia Marcotte Stamer

Stamer Speaks, Moderates On Medical Cyber Security At LA Medical Privacy Summit

May 12, 2017

Solutions Law Press, Inc. editor and attorney Cynthia Marcotte Stamer will speak and moderate two key panel programs on health care privacy and data security scheduled at the Healthcare Privacy & Security Form hosted on May 19, 2017 by the Information Security Systems Association of Los Angeles County (ISSA-LA) as a component of its 9th Annual ISSA-LA Information Security Summit. The presentations of Ms. Stamer and others at the conference are particularly timely coming on the heels of the May 12 Cyber alerts to U.S. health industry and other businesses about the urgent need to defend against the spread of an epidemic international malware threat targeting U.S. healthcare and other businesses. See Health Care, Health Plan & Other Health IT Systems Warned of E-Mail Cyber Attack; Urgent WannaCry Ransomware Cyber Warning Issued; Alert: Guard Health E-Mail, Other IT Against WannaCry Malware Attack.

The Medical Privacy & Security Summit is part of the 9th Annual ISSA-LA Information Security Summit scheduled for May 18-19, 2017 at the Universal City Hilton in Los Angeles. Recognized as a premier information security education and networking event, the Summit is expected to bring together 1000 or more health industry and other IT and InfoSec executives, leaders, analysts, and practitioners to learn from the experts, exchange ideas with their peers, and enjoy conversations with the community.

The Healthcare Privacy & Security Forum offered for the 5^th year as a component of the annual Summit on May 19 specifically focuses on leading challenges, issues and opportunities confronted by health industry privacy and security professionals and their organizations. Ms. Stamer has served on the steering committee, moderator and popular faculty member for the 2017 Forum for the 5^th consecutive year. During the 2017 Forum, she will moderate and speak on two panels:

“Finding & Negotiating The Mine Fields: CISO, CIO & Privacy Officer’s Playbook for Promoting Compliance & Security Without Getting Fired,” a luncheon interactive panel discussion with the audience exploring the challenging mission CISOs, CIOs and Privacy Officers face to ensure their healthcare, financial and other critical information, data and systems continue to support the patient care and operating functions of their organizations, while at the same time defending these systems, operations and their sensitive, but mission critical data against malicious or innocent misappropriation, use, access or destruction; and
The closing panel on “What Initiatives Are on the Horizon in Healthcare, and How Can We Secure Them?”, which will explore likely future emerging privacy and security threats and technologies, regulatory challenges and enforcement, and other trends that Privacy and Security professionals are likely to face and tips and strategies for preparing to leverage these likely new opportunities and manage new challenges.

Register or get the full schedule of programs and other events scheduled at the Healthcare Privacy & Security Forum specifically along with the overall Information Security Summit here.

About Ms. Stamer

Scribe for ABA JCEB annual agency meeting with OCR for many years, Ms. Stamer is well-known for her extensive work and leadership throughout her career on HIPAA, FACTA, PCI, IRC and other tax, Social Security, GLB, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns. Ms. Stamer has worked extensively throughout her career with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks, insurers and other financial institutions, and others on trade secret confidentiality, privacy, data security and other risk management and compliance including design, establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, drafting and negotiation of business associate, chain of custody, confidentiality, and other contracting; risk assessments, audits and other risk prevention and mitigation; investigation, reporting, mitigation and resolution of known or suspected breaches, violations or other incidents; and defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies, other business partners, patients and others; reporting known or suspected violations; commenting or obtaining other clarification of guidance and other regulatory affairs, training and enforcement, and a host of other related concerns.

Her clients include public and private health care providers, health insurers, health plans, employers, payroll, staffing, recruitment, insurance and financial services, health and other technology and other vendors, and others.

Author of a multitude of highly-regarded works and training programs on HIPAA and other data security, privacy and use published by BNA, the ABA and other premier legal industry publishers In addition to representing and advising these organizations, she also speaks extensively and conducts training on health care and other privacy and data security and many other matters Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

Beyond these involvements, Ms. Stamer also is active in the leadership of a broad range of other professional and civic organizations. Through these and other involvements, she helps develop and build solutions, build consensus, garner funding and other resources, manage compliance and other operations, and take other actions to identify promote tangible improvements in health care and other policy and operational areas.

Leave a Comment » | Corporate Compliance, Cyber crime, data breach, data security, Disease Management, DME, Doctor, drug treatment, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, ERISA, FDA, Federal Health Center, Federal Sentencing Guidelines, Fiduciary Responsibility, Genetic Information, GINA, Health Care, Health Care Finance, Health Care Provider, Health Care Quality, Health Insurance Exchange, Health IT, Health Plan, Health Plans, healthcare, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, managed care, Meaningful Use, Medical Malpractice, Medical Privacy, Medical Records, Medicare, Medicare Advantage, Mental Heatlh, OCR, OIG, Pharmaceudical, Pharmacy, Physician, Prescription Drugs, Privacy, Psychiatric, quality reporting, Rural Health Care, Skilled Nursing Facility, substance abuse treatment, Technology, Telemarketing, Telemedicine, Uncategorized | Tagged: Cyber Security, Cybercrime, HIPAA, Malware, Medical Privacy, Medical Security, Technology, WannaCry | Permalink
Posted by Cynthia Marcotte Stamer

Health Care, Health Plan & Other Health IT Systems Warned of E-Mail Cyber Attack

May 12, 2017

Health care providers, health plans, health insurers, healthcare clearinghouses, their business associates and others involved in health information technology or related activities should raise their cyber security defenses and use cyber security best practices to defend their information systems and data against ongoing cyber security attacks targeting health industry information systems in the United States and abroad in a cyber security alert issued by Department of Health and Human Service (HHS) Laura Wolf Critical Infrastructure Protection Lead.

The cyber security alert states that there is evidence that cyber attacks affecting hospitals and healthcare information systems in the UK and other international locations” now are “occurring inside the United States.”

HHS states it is “working with our partners across government and in the private sector to develop a better understanding of the threat and to provide additional information on measures to protect your systems.

Meanwhile,HHS advises U.S. health industry organizations and information systems to exercise cyber security best practices – particularly with respect to email including HHS Ransomware Guidance available here and other information on ransomware in the following HHS Cyber Newsletters:

https://www.hhs.gov/sites/default/files/hippa-cyber-awareness-monthly-issue1.pdf

https://www.hhs.gov/sites/default/files/hipaa-cyber-awareness-monthly-issue3.pdf

https://www.hhs.gov/sites/default/files/february-2017-ocr-cyber-awareness-newsletter.pdf

About The Author

Recognized by LexisNexis® Martindale-Hubbell® as a “AV-Preeminent” (Top 1%/ the highest) and “Top Rated Lawyer,” with special recognition as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Health Care,” “Labor & Employment,” “Tax: Erisa & Employee Benefits” and “Business and Commercial Law” by D Magazine, the author of this update is widely known for her 29 plus years’ of work in health care, health benefit, health policy and regulatory affairs and other health industry concerns as a practicing attorney and management consultant, thought leader, author, public policy advocate and lecturer.

A core focus of this work includes work to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; dealings with JCHO and other accreditation and quality organizations; investigation and defense of private litigation and other federal and state health care industry investigations and enforcement; insurance or other liability management and allocation; process and product development; managed care, physician and other staffing, business associate and other contracting; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.
Author of leading works on HIPAA and other privacy and data security works and the scribe leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with OCR, her experience includes extensive compliance, risk management and data breach and other crisis event investigation, response and remediation under HIPAA and other data security, privacy and breach laws.

In connection with this work, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others.

Her work includes both regulatory and public policy advocacy and thought leadership, as well as advising and representing a broad range of health industry and other clients about policy design, drafting, administration, business associate and other contracting, risk assessments, audits and other risk prevention and mitigation, investigation, reporting, mitigation and resolution of known or suspected violations or other incidents and responding to and defending investigations or other actions by plaintiffs, DOJ, OCR, FTC, state attorneys’ general and other federal or state agencies, other business partners, patients and others.
In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, MGMA, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.
A former lead consultant to the Government of Bolivia on its Pension Privatization Project with extensive domestic and international public policy concerns in Pensions, healthcare, workforce, immigration, tax, education and other areas.

Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health plans, health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other “nonpar,” insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, privacy and data security, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns.
A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on these and other related concerns by her service in the leadership of the Solutions Law Press, Inc. Coalition for Responsible Health Policy, its PROJECT COPE: Coalition on Patient Empowerment, and a broad range of other professional and civic organizations including North Texas Healthcare Compliance Association, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children (now Warren Center For Children); current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, past Representative and chair of various committees of ABA Joint Committee on Employee Benefits; an ABA Health Law Coordinating Council representative, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposium and chair, faculty member and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, Insurance Thought Leadership and many other prominent publications and speaks and conducts training for a broad range of professional organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

©2017 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved. For information about republication or other use, please contact Ms. Stamer here.

Leave a Comment » | Academic medicine, Ambulatory care, CDC, Controlled Substances, Corporate Compliance, data breach, data security, DME, Doctor, drug treatment, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, FDA, Federal Health Center, Genetic Information, GINA, Health Care, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, Health Insurance Exchange, Health IT, Health Plans, healthcare, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Indian Health, Inpatient Rehabilitation Facility, Laws, managed care, Meaningful Use, Medicaid, Medical Privacy, Medical Records, Medicare, Medicare Advantage, Medicare Fee Schedule, Mental Heatlh, OCR, Pharmaceudical, Pharmacy, Physician, Privacy, Psychiatric, Telemarketing, Uncategorized | Tagged: Cyber Security, Cybercrime, Data Security, E-mail, Health Care, HIPAA, Malware | Permalink
Posted by Cynthia Marcotte Stamer

$2.4M HIPAA Settlement Warns Providers About Media Disclosures Of PHI

May 11, 2017

Healthcare providers, health plans, healthcare clearinghouses and their business associates (Covered Entities) can’t disclose the name or other protected health care information about a patient in press releases or other announcements without prior authorization from the patient. That’s the clear lesson Covered Entities should learn from the $2.4 million payment to the U.S. Department of Health and Human Services (HHS) that the largest not-for-profit health system in Southeast Texas, Memorial Hermann Health System (MHHS) is paying to settle charges it violated the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by issuing a press release with the name and other protected health information (PHI) about a patient without the patient’s prior HIPAA-compliant authorization under a Resolution Agreement and Corrective Action Plan (Resolution Agreement) announced May 10, 2017 by HHS Office of Civil Rights (OCR).

The Resolution Agreement resolves OCR charges the operator of 13 hospitals, eight Cancer Centers, three Heart & Vascular Institutes, and 27 sports medicine and rehabilitation centers violated the Privacy Rule that resulted from an OCR compliance review of MHHS triggered by multiple media reports suggesting that MHHS improperly disclosed the name and other details about a patient arrested and charged with presenting an allegedly fraudulent identification card to office staff at an MHHS’s clinic after MHHS clinic staff alerted law enforcement of suspicions the patient was presenting false identification to the clinic. According to OCR, after law enforcement investigated and arrested the patient, MHHS published a press release concerning the incident in which MHHS senior management approved the impermissible disclosure of the patient’s PHI by adding the patient’s name in the title of the press release without securing prior authorization of the patient.

While OCR concluded the report to law enforcement allowable under the Privacy Rule, OCR found MHHS violated the Privacy Rule by issuing the press release disclosing the patient’s name and other PHI without authorization from the patient and also by failing to timely document the sanctioning of its workforce members for impermissibly disclosing the patient’s information.

To resolve and avoid the potential Civil Monetary Penalties that HIPAA could authorize OCR to impose for the alleged Privacy Rule violation, MHHS agrees in the Resolution Agreement to pay OCR a $2.4 million monetary settlement and implement a corrective action plan that obligates MHHS to update and train its workforce on its policies and procedures on safeguarding PHI from impermissible uses and disclosures including specific instructions and procedures to:

Address (a) Uses and disclosures for which an authorization is required, including to the media, to public officials, and on the internet; (b) Disclosures for law enforcement purposes; and (c) Uses and disclosures for health oversight activities;
Identify MHHS personnel or representatives whom workforce members, agents, or business associates may contact in the event of any inquiry or concern regarding compliance with HIPAA in relation to these activities;
Internal reporting procedures requiring all workforce members to report to the designated person or office at the earliest possible time any potential violations of the Privacy, Security or Breach Notification Rules or of MHHS’ privacy and security policies and procedures and MHHS promptly to investigate and address all received reports in a timely manner; and
Application and documentation of appropriate sanctions (which may include retraining or other instructive corrective action, depending on the circumstances) against members of MHHS’ workforce, including senior level management, who fail to comply with the Privacy, Security or Breach Notification Rules or MHHS’ privacy and security policies and procedures, including a description of the sanctions; a timeframe in which MHHS will apply and document sanctions for violations of the HIPAA Rules or of MHHS’ privacy, security or breach policies or procedures; the manner in which MHHS will document the sanctions; and where MHHS will store or retain such documentation (e.g., personnel file).

The corrective action plan in the Resolution Agreement also requires all MHHS facilities to attest to their understanding of permissible uses and disclosures of PHI, including disclosures to the media and others.

Covered entities should keep in mind the MHHS Resolution Agreement is the latest in a series of OCR enforcement actions and resolution agreements highlighting the need for Covered Entities to adopt and use appropriate policies and procedures to prevent wrongful disclosures of PHI to the media or public. For instance, in June, 2013, OCR required Shasta Regional Medical Center (SRMC) to pay a $275,000 settlement payment and implement a comprehensive corrective action plan to resolve OCR charges stemming from SRMC’s disclosure of PHI about a patient to members of the media and its workforce in an effort to respond to accusations the patient made that SRMC engaged in fraud and other misconduct. See HIPAA Sanctions Triggered From Covered Entity Statements To Media, Workforce. In contrast, the $2.2 million resolution agreement that OCR required New York Presbyterian Hospital for improperly allowing a film crew to film hospital patients in violation of HIPAA was almost 10 times greater than the SRMC penalty and was accompanied by OCR’s publication OCR of specific additional guidance warning Covered Entities against improper disclosures to the media. See $2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use.

Following on the heels of this previous guidance and prior enforcement actions warning Covered Entities against wrongful disclosure to the media, the MHHS Resolution Agreement sends a strong message to Covered Entities that they should expect little sympathy if their organizations improperly share PHI with the media. OCR’s announcement of the MHHS Resolution Agreement, for instance quotes OCR Director Roger Severino with stating that “Senior management should have known that disclosing a patient’s name on the title of a press release was a clear HIPAA Privacy violation that would induce a swift OCR response.” The announcement goes on to quote Director Severino further as stating, “This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when making statements to the public and elsewhere.”

Risk Assess & Control Media Relations & Other Communications For PHI Disclosures Enterprisewide

Covered entities should heed the warning by conducting a risk assessment of their organization’s susceptibility to potential improper disclosures to media or others and reviewing and implementing necessary written policies, procedures and training to prevent the improper disclosure of patient PHI to media or others unless the Covered Entity either secures prior HIPAA-compliant authorization from the patient or can prove the disclosure falls squarely under an exception to the Privacy Rule’s prohibition against disclosure of PHI without authorization except as allowed by the Privacy Rule.

Taking these and other needed steps to evaluate, and strengthen and enforce as needed, risk assessments, policies, procedures, and training to prevent wrongful use, access or disclosure of PHI to the media or others is particularly critical in light of the ongoing tightening of expectations, and rising enforcement and sanctions for HIPAA violations since Congress amended HIPAA in 2009. See OCR Audit Program Kickoff Further Heats HIPAA Privacy Risks; HIPAA Heats Up: HITECH Act Changes Take Effect & OCR Begins Posting Names, Other Details Of Unsecured PHI Breach Reports On Website.

Based on experiences reported in the MHHS and other similar resolution agreements, Covered Entities also generally will want to ensure that their policies, procedures and training extend to all potential sources of communications that could involve patient information and make clear that the Privacy Rule restrictions must be followed even if the circumstances involve allegations of misconduct, special performance by healthcare providers or others that it would benefit the organization or certain individuals to have known to the public, or other circumstances likely to be of interest to the media or other parties.
As part of this process, covered entities should ensure they look outside the four corners of their Privacy Policies to ensure that appropriate training and clarification is provided to address media, practice transition, workforce communication and other policies and practices that may be covered by pre-existing or other policies of other departments or operational elements not typically under the direct oversight and management of the Privacy Officer such as media relations. Media relations, physician and patients affairs, outside legal counsel, media relations, marketing and other internal and external departments and consultants dealing with the media, the public or other inquiries or disputes should carefully include and coordinate with the privacy officer both to ensure appropriate policies and procedures are followed and proper documentation created and retained to show authorization, account, or meet other requirements.

In conducting this analysis and risk assessment, it will be important that Covered Entities include, but also look beyond the four corners of their Privacy Policies to ensure that their review and risk assessment identifies and assesses and addresses compliance risks on an entity wide basis. This entity-wide assessment should include both communications and requests for information normally addressed to the Privacy Officer as well as requests and communications that could arise in the course of media or other public relations, practice transition, workforce communication and other operations not typically under the direct oversight and management of the Privacy Officer.

For this reason, Covered Entities also generally will not only to adopt and implement specific policies, processes and training in these other departments to prohibit and prevent inappropriate disclosures of PHI in the course of those departments operations. It also may be advisable to pre-established processes for reviewing media or other communications for potential PHI content and require prior review of any proposed public relations and other internal or external communications containing patient PHI or other information by the privacy officer, legal counsel or another suitably qualified party.

Because of the high risk that the preparation or review of media or other public communications reports will involve the use and disclosure of PHI, Covered Entities also generally should verify that all outside media or public relations, legal, or other outside service providers participating in the investigation, response or preparation or review of communications to the media or others both are covered by signed business associate agreements that fulfill the Privacy Rule and other requirements of HIPAA as well as possess detailed knowledge and understanding of the Privacy and Security Rules suitable to participate in and help safeguard the Covered Entity against violations of these and other Privacy Rules. See e.g., Latest HIPAA Resolution Agreement Drives Home Importance Of Maintaining Current, Signed Business Associate Agreements.

About The Author

Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health plans, health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other “nonpar,” insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Accreditation, Ambulatory care, Clinical pathway, Consumer Driven Health Care, data breach, data security, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, ERISA, FACTA, Federal Health Center, Fiduciary Responsibility, Genetic Information, GINA, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Insurance Exchange, Health IT, Health Plan, Health Plans, HIPAA, HIPAA Cyber Crime, HITECH Act, Hospital, Indian Health, Meaningful Use, Medicaid, Medical Malpractice, Medical Privacy, Medical Records, Medicare, OCR, Physician, Prescription Drugs, Privacy, Psychiatric, Wellness | Tagged: HIPAA, medical orivacy, Privacy Rule | Permalink
Posted by Cynthia Marcotte Stamer

6/26 Deadline To Comment On Proposed Medicare SNF (Nursing Home) Rule Changes

May 10, 2017

June 26, 2017 is the deadline to submit comments to the Department of Health & Human Services (HHS) Centers for Medicare & Medicaid Services (CMS) on changes to Medicare’s Skilled Nursing Facility (nursing home) reimbursement, quality reporting and various other proposed by CMS in the Medicare Program; Prospective Payment System and Consolidated Billing for Skilled Nursing Facilities for FY 2018, SNF Value-Based Purchasing Program, SNF Quality Reporting Program, Survey Team Composition, and Proposal To Correct the Performance Period for the NHSN HCP Influenza Vaccination Immunization Reporting Measure in the ESRD QIP for PY 2020 (Proposed Rule) published May 4^th. With the U.S. aging population making SNF expenditures both a significant Medicare cost driver and a major care concern for American families and communities, SNF and other health care providers, payers, community leaders, caregivers and other concerned stakeholders should act promptly to review the proposed changes and timely submit feedback in response to the Proposed Rule.

Among other things, the Proposed Rule as currently proposed would revise Medicare reimbursement and terms of participation rules for SNFs to:

Update the Skilled Nursing Facility (SNF) prospective payment rates and other background information for Fiscal Year (FY) 2018 in response to §§ 1888(e)(4)(E) and (H) of the Social Security Act (the Act);
Update the requirements for the Skilled Nursing Facility Quality Reporting Program (SNF QRP) and additional proposals for the Skilled Nursing Facility Value-Based Purchasing Program (SNF VBP);
Clarify requirements related to survey team composition and investigation of complaints under 42 C.F.R §§ 488.30, 488.301, 488.314, and 488.308;
Add a proposal related to the performance period for the National Healthcare Safety Network (NHSN) Healthcare Personnel (HCP) Influenza Vaccination Reporting Measure included in the End-Stage Renal Disease (ESRD) Quality Incentive Program (QIP); and
Solicits comments about potential changes to the recently finalized Requirements for Long-Term Care Facilities that CMS intends to reduce regulatory burdens as well as potential CMMI models and other demonstration projects that would reduce cost and increase quality of care for SNF, or more generally Post-Acute Care patients.

The Proposed Rule regulatory burden reduction proposals primarily focus on three areas also invites input about other areas of burden reduction and cost changes that could be accomplished by revising current SNF requirements for Medicare participation:

The Grievance and Abuse/Neglect Reporting Processes
Quality Assurance and Performance Improvement (QAPI)
Discharge Notices

SNF and other healthcare providers, payers, accreditation and oversight, payers, caregivers and others concerned about SNF care and reimbursement for patients in SNFs should carefully evaluate these proposals and share their input on the proposals and other opportunities to improve the Medicare SNF quality and reimbursement rules as soon as possible.

About The Author

Throughout her career, she has helped health industry clients manage workforce, medical staff, vendors and suppliers, medical billing, reimbursement, claims and other provider-payer relations, business partners, and their recruitment, performance, discipline, compliance, safety, compensation, benefits, and training ;board, medical staff and other governance; compliance and internal controls; strategic planning, process and quality improvement; change management; assess, deter, investigate and address staffing, quality, compliance and other performance; meaningful use, EMR, HIPAA and other data security and breach and other health IT and data; crisis preparedness and response; internal, government and third-party reporting, audits, investigations and enforcement; government affairs and public policy; and other compliance and risk management, government and regulatory affairs and operations concerns.

As a core component of her work, Ms. Stamer has worked extensively throughout her career with health care providers, health plans and insurers, managed care organizations, health care clearinghouses, their business associates, employers, banks and other financial institutions, management services organizations, professional associations, medical staffs, accreditation agencies, auditors, technology and other vendors and service providers, and others on legal and operational compliance, risk management and compliance, public policies and regulatory affairs, contracting, payer-provider, provider-provider, vendor, patient, governmental and community relations and matters including extensive involvement advising, representing and defending public and private hospitals and health care systems; physicians, physician organizations and medical staffs; specialty clinics and pharmacies; skilled nursing, home health, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing and management services organizations; consultants; investors; technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, insurers, self-insured health plans and other payers; and other health industry clients to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry investigation, enforcement including insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on health care, disability, aging, workforce, retirement and other related concerns by her service in the leadership of the Solutions Law Press, Inc. Coalition for Responsible Health Policy, its PROJECT COPE: Coalition on Patient Empowerment, and a broad range of other professional and civic organizations including North Texas Healthcare Compliance Association, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children (now Warren Center For Children); current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, past Representative and chair of various committees of ABA Joint Committee on Employee Benefits; a ABA Health Law Coordinating Council representative, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Corporate Compliance, Disease Management, Doctor, Federal Sentencing Guidelines, Health Care, Health care coding, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health Plan, Health Policy, healthcare, Hospice, Hospital, hospitals, Laws, Medicaid, Medical Malpractice, Medicare, Medicare Fee Schedule, Medicare Fee Schedule, Outcomes Data, public health, Skilled Nursing Facility, Uncategorized | Tagged: aging, Disability, Health, healthcare, Medicare, Medicare Reimbursement, nursing home, quality reporting, Skilled Nursing, SNF | Permalink
Posted by Cynthia Marcotte Stamer

CardioNet $2.5M HIPAA Resolution Agreement Schools HIPAA Entities To Clean Up Their Acts

April 26, 2017

Remote cardiac monitoring provider CardioNet is paying $2.5 million and implementing a corrective action plan to settle potential charges of noncompliance with the Health Insurance and Portability Act (HIPAA) Privacy and Security Rules by the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) based on the impermissible disclosure of unsecured electronic protected health information (ePHI).

The first OCR HIPAA settlement involving a wireless health services provider, the CardioNet Resolution Agreement and Corrective Action Plan (Resolution Agreement) announced by OCR on April 24, 2017 clearly illustrates for all covered entities and their business associates of the substantial liability risks of failing to finalize and actually adopt, implement, administer and maintain the necessary HIPAA Privacy and Security policies and procedures required by HIPAA as well as some of the steps OCR expects to fulfill these requirements.

CardioNet Charges & Settlement

As has become increasingly common in recent years, the CardioNet settlement arose from concerns initially brought to OCR’s attention in connection with a HIPAA breach notification report. On January 10, 2012, OCR received notification from the provider of remote mobile monitoring of and rapid response to patients at risk for cardiac arrhythmias that a workforce member’s laptop with the ePHI of 1,391 individuals was stolen from a parked vehicle outside of the employee’s home. CardioNet subsequently notified OCR of a second breach of ePHI 2,219 individuals, respectively.

Likewise, the HIPAA breaches uncovered by OCR in the course of investigating these CardioNet breaches occur in the operations of many other covered entities. According to the OCR’s investigation in response to these breach reports revealed a series of continuing compliance concerns, including:

CardioNet failed to conduct an accurate and thorough risk analysis to assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI and failed to plan for and implement security measures sufficient to reduce those risks and vulnerabilities;
CardioNet’s policies and procedures implementing the standards of the HIPAA Security Rule were in draft form and had not been implemented;
CardioNet was unable to produce any final policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices;
CardioNet failed to implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of its facilities, the encryption of such media, and the movement of these items within its facilities until March 2015; and
CardioNet failed to safeguard against the impermissible disclosure of protected health information by its employees, thereby permitting access to that information by an unauthorized individual, and failed to take sufficient steps to immediately correct the disclosure.

To resolve these OCR charges, CardioNet agrees in the Resolution Agreement to pay $2.5 million to OCR and implement a corrective action plan. Among other things, the corrective action plan requires CardioNet to complete the following actions to the satisfaction of OCR:

Prepare a current, comprehensive and thorough Risk Analysis of security risks and vulnerabilities that incorporates its current facility or facilities and the electronic equipment, data systems, and applications controlled, currently administered or owned by CardioNet, that contain, store, transmit, or receive electronic protected health information (“ePHI”) and update that Risk Analysis annually or more frequently, if appropriate in response to environmental or operational changes affecting the security of ePHI.
Assess whether its existing security measures are sufficient to protect its ePHI and revise its Risk Management Plan, Policies and Procedures, and training materials and implement additional security measures, as needed.
Develop and implement an organization-wide Risk Management Plan to address and mitigate any security risks and vulnerabilities found in the Risk Analysis as required by the Risk Management Plan.
Review and, to the extent necessary, revise, its current Security Rule Policies and Procedures (“Policies and Procedures”) based on the findings of the Risk Analysis and the implementation of the Risk Management Plan to comply with the HIPAA Security Rule.
Provide certification to OCR that all laptops, flashdrives, SD cards, and other portable media devices are encrypted, together with a description of the encryption methods used (“Certification”).
Review, revise its HIPAA Security training to include a focus on security, encryption, and handling of mobile devices and out-of-office transmissions and other policies and practices require to address the issues identified in the Risk Assessment and otherwise comply with the Risk Management Plan and HIPAA train its workforce on these policies and practices.
Investigate all potential violations of its HIPAA policies and procedures and notify OCR in writing within 30 days of any violation.
Submit annual reports to OCR, which must be signed by an owner or officer of CardioNet attesting that he or she has reviewed the annual report, has made a reasonable inquiry regarding its content and believes that, upon such inquiry, the information is accurate and truthful.
Maintain for inspection and copying, and provide to OCR, upon request, all documents and records relating to compliance with the corrective action plan for six years.

Implications For Covered Entities & Business Associates

The CardioNet Resolution Agreement contains numerous lessons for other Covered entities and their business associates, including but not limited to the following.

Like many previous resolution agreements announced by OCR, the Resolution Agreement reiterates the responsibility of covered entities and business associates to properly secure their ePHI and that as part of this process, OCR expects all laptop computers and other mobile devices containing or with access to ePHI be properly encrypted and secured.
It also reminds covered entities and their business associates to be prepared for, and expect an audit from OCR when OCR receives a report that their organization experienced a large breach of unsecured ePHI.
The Resolution Agreement’s highlighting of the draft status of CardioNet’s privacy and security policies also reflects OCR expects covered entities to actually final policies, procedures and training in place for maintaining compliance with HIPAA.
The discussion and requirements in the Corrective Action Plan relating to requirements to conduct comprehensive risk assessments at least annually and in response to other events, and to update policies and procedures in response to findings of these risk assessments also drives home the importance of conducting timely, documented risk analyses of the security of their ePHI, taking prompt action to address known risks and periodically updating the risk assessment and the associated privacy and security policies and procedures in response to the findings of the risk assessment and other changing events.
The requirement in the Resolution Agreement of leadership attestation and certification on the required annual report reflects OCR’s expectation that leadership within covered entities and business associates will make HIPAA compliance a priority and will take appropriate action to oversee compliance.
Finally, the $2.5 million settlement payment required by the Resolution Agreement and its implementation against CardiNet makes clear that OCR remains serious about HIPAA enforcement.

Of course, covered entities and business associates need to keep in mind that that actions and inactions that create HIPAA liability risks also carry many other potential legal and business risks. For instance, since PHI records and data involved in such breaches usually incorporates Social Security Numbers, credit card or other debt or payment records or other personal consumer information, and other legally sensitive data, covered entities and business associates generally also may face investigation, notification and other responsibilities and liabilities under confidentiality, privacy or data security rules of the Fair and Accurate Credit Transaction Act (FACTA), the Internal Revenue Code, the Social Security Act, state identity theft, data security, medical confidentiality, privacy and ethics, insurance, consumer privacy, common law or other state privacy claims and a host of other federal or state laws. Depending on the nature of the covered entity or its business associates, the breach or other privacy event also may trigger fiduciary liability exposures for health plan fiduciaries in the case of a health plan, professional ethics or licensing investigations or actions against health care providers, insurance companies, administrative service providers or brokers, shareholder or other investor actions, employment or vendor termination or disputes and a host of other indirect legal consequences.

Beyond, and regardless of the technical legal defensibility of its actions under these and other laws, however, the most material and often most intractable consequences of a HIPAA or other data or other privacy breach report or public accusation, investigation, admission also typically are the most inevitable:

The intangible, but critical loss of trust and reputation covered entities and business associates inevitably incur among their patients, participants, business partners, investors and the community; and
The substantial financial expenses and administrative and operational disruptions of investigating, defending the actions of the organization and implementation of post-event corrective actions following a data or other privacy breach, audit, investigation, or charge.

In light of these risks, covered entities business associates and their management should use the experiences of CardioNet and other covered entities or business associates caught violating HIPAA or other privacy and security standards to reduce their HIPAA and other privacy and data security exposures. Management of covered entities and their business associates should take steps to ensure that their organizations policies, practices and procedures currently are up-to-date, appropriately administered and monitored, and properly documented. Management should ensure that their organizations carefully evaluate and strengthen as necessary their current HIPAA risk assessments, policies, practices, record keeping and retention and training in light of these and other reports as they are announced in a well-documented manner. The focus of these activities should be both to maintain compliance and position their organizations efficiently and effectively to respond to and defend their actions against a data breach, investigation, audit or accusation of a HIPAA or other privacy or security rule violation with a minimum of liability, cost and reputational and operational damages.

As the conduct of these activities generally will involve the collection and analysis of legally sensitive matters, most covered entities and business associates will want to involve legal counsel experienced with these matters and utilize appropriate procedures to be able to use and assert attorney-client privilege and other evidentiary privileges to mitigate risks associated with these processes. To help plan for and mitigate foreseeable expenses of investigating, responding to or mitigating a known, suspected or asserted breach or other privacy event, most covered entities and business associates also will want to consider the advisability of tightening privacy and data security standards, notification, cooperation and indemnification protections in contracts between covered entities and business associates, acquiring or expanding data breach or other liability coverage, or other options for mitigating the financial costs of responding to a breach notification, investigation or enforcement action.

About The Author

As a core component of her work, Ms. Stamer has worked extensively throughout her career with health care providers, health plans and insurers, managed care organizations, health care clearinghouses, their business associates, employers, banks and other financial institutions, management services organizations, professional associations, medical staffs, accreditation agencies, auditors, technology and other vendors and service providers, and others on legal and operational compliance, risk management and compliance, public policies and regulatory affairs, contracting, payer-provider, provider-provider, vendor, patient, governmental and community relations and matters including extensive involvement advising, representing and defending public and private hospitals and health care systems; physicians, physician organizations and medical staffs; specialty clinics and pharmacies; skilled nursing, home health, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing and management services organizations; consultants; investors; technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, insurers, self-insured health plans and other payers; and other health industry clients to manage and defend compliance, public policy, regulatory, staffing and other operations and risk management concerns. A core focus of this work includes work to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; dealings with JCHO and other accreditation and quality organizations; investigation and defense of private litigation and other federal and state health care industry investigations and enforcement; insurance or other liability management and allocation; process and product development; managed care, physician and other staffing, business associate and other contracting; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

In the course of this work, Ms. Stamer has accumulated extensive experience helping health industry clients manage workforce, medical staff, vendors and suppliers, medical billing, reimbursement, claims and other provider-payer relations, business partners, and their recruitment, performance, discipline, compliance, safety, compensation, benefits, and training, board, medical staff and other governance; compliance and internal controls; strategic planning, process and quality improvement; change management; assess, deter, investigate and address staffing, quality, compliance and other performance; meaningful use, EMR, HIPAA and other data security and breach and other health IT and data; crisis preparedness and response; internal, government and third-party reporting, audits, investigations and enforcement; government affairs and public policy; and other compliance and risk management, government and regulatory affairs and operations concerns.

Author of leading works on HIPAA and other privacy and data security works and the scribe leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with OCR, her experience includes extensive compliance, risk management and data breach and other crisis event investigation, response and remediation under HIPAA and other data security, privacy and breach laws. Heavily involved in health care and health information technology, data and related process and systems development, policy and operations innovation and a Scribe for ABA JCEB annual agency meeting with OCR for many years who has authored numerous highly-regarded works and training programs on HIPAA and other data security, privacy and use, Ms. Stamer also is widely recognized for her extensive work and leadership on leading edge health care and benefit policy and operational issues including meaningful use and EMR, billing and reimbursement, quality measurement and reimbursement, HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and many other concerns.

In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, MGMA, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other “nonpar,” insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Ambulatory care, Corporate Compliance, data breach, data security, Disease Management, DME, Doctor, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, Health Care, Health Care Provider, Health Insurance Exchange, Health IT, Health Plan, Health Plans, healthcare, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medical Privacy, Medical Records, OCR, Pharmaceudical, Pharmacy, Physician, Privacy, Psychiatric, Telemedicine, Uncategorized | Tagged: audit, Breach Notification, Data Breach, Data Security, healthcare, HIPAA, medical, OCR, OCR< Privacy, Privacy, Privacy Rule, Security, Security Officer, Security Rule, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Medical Clinic HIPAA Resolution Agreement Shows Need For Current Business Associate Agreements

April 24, 2017

Health care providers, health plans, health care clearinghouses and business associates must get and keep their business associate (BA) agreements (BAAs) in place, up- to-date, and readily available for inspection in accordance with the Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule, 45 C.F.R. Part 160 and Subparts A and E of Part 164 (Privacy Rule). That’s the clear message physician practices and other health care providers, health plans, health care clearinghouses (“covered entities”) and their business associates should learn about Privacy Rule compliance from an April 17, 2017 HIPAA Resolution Agreement just announced by the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) with the Center for Children’s Digestive Health (CCDH).

While the Resolution Agreement relates to breaches of the BAA requirements of a small pediatric practice, the Center for Children’s Digestive Health (CCDH), all health plans, health care providers and other covered entities and business associates should focus on the adequacy of their BAAs and their BAA recordkeeping. HIPAA compliance surveys reflect deficiencies with the BAA rules are common throughout the industry. These findings and the involvement of BAs in data breaches or other OCR enforcement activities suggest a high probability that many other covered entities and business associates may be sitting ducks for similar sanctions. See e.g., HIPAA Compliance Survey Churns Up Many Business Associate Problems (January 3, 2017).

The HIPAA Business Associate Agreement Requirements

OCR’s announcement of the CCDH Resolution Agreement is the latest in a growing series of HIPAA enforcement actions showing the growing risk covered entities and their business associates face for failing to take appropriate steps to comply with the BAA and other Privacy Rule requirements of HIPAA.

As compliance audits and surveys of covered entities and business associates suggest a high level of noncompliance with the business associate agreement requirements among covered entities and business associates, While the ever-growing list of Resolution Agreements and Civil Monetary Penalties announced by OCR cover a variety of categories of HIPAA violations, the CCDH Resolution Agreement highlights the importance of covered entities and their business associates ensuring that before the BA creates, accesses, receives, discloses, retains or destroys any PHI for the covered entity, a BAA meeting the Privacy Rule requirements is signed and retained for at least the six year period the Privacy Rule requires in a manner easily producible when and if OCR or another agency asks for a copy as part of an investigation or other compliance audit. See Privacy Rule §§ 164.502(e), 164.504(e), 164.532(d) and (e).

The Privacy Rule requires that covered entities and business associates enter into a written and signed business associate agreement that contains the elements specified in Privacy Rule § 164.504(e) before the business associate creates, uses, accesses or discloses PHI of the covered entity. Meanwhile, the Privacy Rule recordkeeping requirements require that covered entities and BAs maintain copies of these BAAs for a minimum of six years.

Violations of the Privacy Rule can carry stiff civil or even criminal penalties Pursuant to amendments to HIPAA enacted as part of the HITECH Act, civil penalties typically do not apply to violations punished under the criminal penalty rules of HIPAA set forth in Social Security Act , 42 U.S.C § 1320d-6 (Section 1177).

Under Section 1177, the criminal enforcement provisions of HIPAA authorize the Justice Department to prosecute a person who knowingly in violation of the Privacy Rule (1) uses or causes to be used a unique health identifier; (2) obtains individually identifiable health information relating to an individual; or (3) discloses individually identifiable health information to another person, punishable by the following criminal sanctions and penalties:

A fine of up to $50,000, imprisoned not more than 1 year, or both;
If the offense is committed under false pretenses, a fine of up to $100,000, imprisonment of not more than 5 years, or both; and
If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of up to $250,000, imprisoned not more than 10 years, or both.

In contrast, as amended by the HITECH Act, the civil enforcement provisions of HIPAA empower OCR to impose Civil Monetary Penalties on both covered entities and BAs for violations of any of the requirements of the Privacy or Security Rules. The penalty ranges for civil violations depends upon the circumstances associated with the violations and are subject to upward adjustment for inflation. As most recently adjusted here effective September 6, 2016, the following currently are the progressively increasing Civil Monetary Penalty tiers:

A minimum penalty of $100 and a maximum penalty of $50,000 per violation, for violations which the CE or BA “did not know, and by exercising reasonable diligence would not have known” about using “the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances;”
A minimum penalty of $1,000 and a maximum penalty of $50,000 per violation, for violations for “reasonable cause” which do not rise to the level of “willful neglect” where “reasonable cause” means the “circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the violated Privacy Rule requirement;”
A minimum penalty of $10,000 and a maximum penalty of $50,000 per violation, for violations attributed to “willful neglect,” defined as “the conscious, intentional failure or reckless indifference to the obligation to comply” with the requirement or prohibition; and
A minimum penalty of $50,000 and a maximum penalty of $1.5 million per violation, for violations attributed to “willful neglect” not remedied within 30 days of the date that the covered entity or BA knew or should have known of the violation.

For continuing violations such as failing to implement a required BAA, OCR can treat each day of noncompliance as a separate violation. However, sanctions under each of these tiers generally are subject to a maximum penalty of $1,500,000 for violations of identical requirements or prohibitions during a calendar year. For violations such as the failure to implement and maintain a required BAA where more than one covered entity bears responsibility for the violation, OCR an impose Civil Monetary Penalties against each culpable party. OCR considers a variety of mitigating and aggravating facts and circumstances when arriving at the amount of the penalty within each of these applicable tiers to impose.

While criminal enforcement of HIPAA remains relatively rare, a review of the OCR enforcement record in recent years makes clear that civil enforcement of HIPAA and the sanctions imposed is growing. See e.g., $400K HIPAA Settlement Shows Need To Conduct Timely & Appropriate Risk Assessments; $5.5M Memorial HIPAA Resolution Agreement Shows Need To Audit. For more examples, also see here.

CCDH Sanctions For Violation Of HIPAA Business Associate Agreement Rules

The CCDH Resolution Agreement arises from violations of this requirement that OCR says it discovered as a result of a compliance review conducted in response to an OCR investigation of a CCDH business associate, FileFax, Inc. According to OCR, OCR found from the compliance review of CCDH triggered by OCR’s investigation of FileFax that while CCDH began disclosing PHI to Filefax in 2003 and that Filefax stored records containing protected health information (PHI) for CCDH, neither CCDH nor Filefax could produce a signed Business Associate Agreement (BAA) covering their relationship for any period before October 12, 2015.

Based on the resulting investigation, OCR concluded:

CCDH failed to obtain a BAA providing written assurances from Filefax that it would appropriately safeguard the PHI in Filefax’s possession or control satisfactory assurances as required by Privacy Rule §164.502(e); and
Because CCDH failed to secure the required BAA, it violated the Privacy Rule by impermissibly disclosing the PHI of at least 10,728 individuals to Filefax when CCDH transferred the PHI to Filefax without obtaining the requisite BAA from Filefax (Covered Conduct).

In the Resolution Agreement, CCDH agrees to pay HHS $31,000.00 (Resolution Amount) and enter into and comply with a Corrective Action Plan (CAP) in return for OCR’s release of CCDH from liability for “any actions it may have against CCDH under the HIPAA Rules” for the Covered Conduct. The Resolution Agreement only settles the civil monetary penalty and other OCR enforcement liabilities of CCDH with respect to the Covered Conduct. Its provisions expressly state the Resolution Agreement does not affect any exposures of CCDH to CCDH to OCR civil monetary penalties or other enforcement for any HIPAA violations other than the Covered Conduct.

Perhaps even more noteworthy given the HITECH Act’s provisions coordinating the civil and criminal sanctions of HIPAA, while the Resolution Agreement provides no clear indication that the Justice Department might be considering criminally prosecuting CCDH or any other party in relation to the Covered Conduct, the Resolution Agreement also expressly states that its provisions do not affect CCDH’s potential exposure, if any, to criminal prosecution by the Justice Department for a criminal violation of the Privacy Rules under Section 1177 of the Social Security Act.

Implications For Covered Entities & Business Associates

Covered entities and their business associates should heed the CCDH Resolution Agreement as a strong message from OCR to ensure their organizations are complying with HIPAA’s BAA and other requirements. The Resolution Agreement makes clear that the starting point of this compliance effort must be obtaining and maintaining the requisite BAAs for each BA relationship.

To position their organizations to withstand potential investigation by OCR, covered entities and BAs should start by conducting a well-documented audit within the scope of attorney-client privilege both to verify that an appropriate, signed BAA is in place for each BA relationship as well as adequacy of processes for identifying business associate relationships, ensuring that signed BAAs are in effect before BAs access any PHI, and for investigating, reporting and resolving any breaches of the HIPAA Privacy or Security Rules that may arise in the course of operations.

Conducting this audit as soon as possible is particularly important in light of reported findings of widespread compliance concerns. See HIPAA Compliance Survey Churns Up Many Business Associate Problems (January 3, 2017). As the audit process could identify potential violations or other legally sensitive concerns, covered entities and business associates generally will want to arrange for this audit and evaluation to be conducted under the supervision of legal counsel experienced with HIPAA within or pursuant to processes structured with the assistance of legal counsel within the scope of attorney-client privilege.

Beyond confirming all necessary BAAs are in place, covered entities and business associates also generally will want to evaluate the adequacy of BAs’ processes and procedures for maintaining compliance with the Privacy and Security Rules as well as processes and procedures for responding to audits, investigations and complaints, reporting and addressing breaches of electronic and other PHI and other possible compliance concerns under HIPAA and other related laws. In many instances, parties may n wish to revise and strengthen existing BAAs to more specifically define these policies and procedures more specifically as well as indemnification, cyber or other liability coverage requirements and other contractual provisions for allocating potential costs and liabilities arising from breaches, audits, investigations and other expenses associated with the administration of these provisions.

About The Author

As a core component of her work, Ms. Stamer has worked extensively throughout her career with health care providers, health plans and insurers, managed care organizations, health care clearinghouses, their business associates, employers, banks and other financial institutions, management services organizations, professional associations, medical staffs, accreditation agencies, auditors, technology and other vendors and service providers, and others on legal and operational compliance, risk management and compliance, public policies and regulatory affairs, contracting, payer-provider, provider-provider, vendor, patient, governmental and community relations and matters including extensive involvement advising, representing and defending public and private hospitals and health care systems; physicians, physician organizations and medical staffs; specialty clinics and pharmacies; skilled nursing, home health, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing and management services organizations; consultants; investors; technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, insurers, self-insured health plans and other payers; and other health industry clients to manage and defend compliance, public policy, regulatory, staffing and other operations and risk management concerns. A core focus of this work includes work to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; dealings with JCHO and other accreditation and quality organizations; investigation and defense of private litigation and other federal and state health care industry investigations and enforcement; insurance or other liability management and allocation; process and product development; managed care, physician and other staffing, business associate and other contracting; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other nonpar, insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

In connection with this work, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Corporate Compliance, data breach, data security, DME, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Federal Sentencing Guidelines, Health Care, Health Care Provider, Health Insurance Exchange, Health IT, Health Plan, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, managed care, Medical Privacy, Medical Records, Mental Health, Pharmaceudical, Pharmacy, Psychiatric, Technology, Telemedicine, Uncategorized | Tagged: business associate, clinic, confidentiality, Health Care Provider, Health Plan, HIPAA, HITECH Act, Medical Privacy, Physician, Privacy, Privacy Rule | Permalink
Posted by Cynthia Marcotte Stamer

5/15 Post-Acute Care IRF/LTCH/SNF Quality Reporting Programs Submission Deadline Reminder

April 18, 2017

May 15 is the submission deadline to submit data and other reporting materials for the Inpatient Rehabilitation Facility (IRF) Quality Reporting Program (QRP), Long-Term Care Hospital (LTCH) QRP, and Skilled Nursing Facility (SNF).
For IRFs and LTCHs, data submitted to CMS via the Center for Disease Control and Prevention’s (CDC’s) National Healthcare Safety Network (NHSN) data for discharges from July-September (Q3) and from Q4 of CY 2016 are due with this submission deadline.

All data must be submitted no later than 11:59 p.m. Pacific Standard Time on May 15, 2017.

The list of measures required for this deadline can be found on the CMS QRP websites:

IRF Quality Reporting Data Submission Deadlines

LTCH Quality Reporting Data Submission Deadlines

Skilled Nursing Facility (SNF) Quality Reporting Program Measures and Technical Information

CMS recommends providers run applicable validation/output reports prior to each quarterly reporting deadline, in order to ensure that all required data has been submitted..

About The Author
Recognized by LexisNexis® Martindale-Hubbell® as a “AV-Preeminent” (Top 1%/ the highest) and “Top Rated Lawyer,” with special recognition as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Health Care,” “Labor & Employment,” “Tax: Erisa & Employee Benefits” and “Business and Commercial Law” by D Magazine, the author of this update is widely known for her 29 plus years’ of work in health care, health benefit, health policy and regulatory affairs and other health industry concerns as a practicing attorney and management consultant, thought leader, author, public policy advocate and lecturer.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Conditions of Participation, DME, Doctor, Evidence Based Medicine, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Home Health, Hospice, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medicare, Medicare Advantage, Medicare Fee Schedule, Outcomes Data, Patient Empowerment, Pharmacy, Physician, quality reporting, Reimbursement, Rural Health Care, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

New HHS Webpage Highlights HHS Administrative Actions To Ease ACA Enforcement & Burdens

April 13, 2017

The Department of Health and Human Services recently launched a new web page on HHS.gov highlighting the regulatory and administrative actions the Department is taking to relieve the burden of the current healthcare law and support a patient-centered healthcare system in response to President Trump’s January 20, 2017 Executive Order Minimizing the Economic Burden of the Patient Protection and Affordable Care Act Pending Repeal (the “Executive Order”).

In the Executive Order, President Trump among other things:

Confirmed the Trump Administration’s policy to seek the prompt repeal of the Patient Protection and Affordable Care Act (Public Law 111-148), as amended (the “ACA”); and
Announced the Trump Administration’s directivepending the planned ACA repeal to ensure that the law is being efficiently implemented, take all actions consistent with law to minimize the unwarranted economic and regulatory burdens of the ACA, and prepare to afford the States more flexibility and control to create a more free and open healthcare market.

In furtherance of these policies, the Executive Order also directed the Secretary of HHS and and the heads of all other executive departments and agencies (agencies) with authorities and responsibilities under the ACA to the maximum extent permitted by law:

To exercise all authority and discretion available to them to waive, defer, grant exemptions from, or delay the implementation of any provision or requirement of the ACA that would impose a fiscal burden on any State or a cost, fee, tax, penalty, or regulatory burden on individuals, families, healthcare providers, health insurers, patients, recipients of healthcare services, purchasers of health insurance, or makers of medical devices, products, or medications;
To exercise all authority and discretion available to them to provide greater flexibility to States and cooperate with them in implementing healthcare programs;
To encourage the development of a free and open market in interstate commerce for the offering of healthcare services and health insurance, with the goal of achieving and preserving maximum options for patients and consumers.

HHS intends to use the new web page to announce new measures as adopted by HHS in furtherance of the Executive Order with a planned emphasis in particular upon actions to

Lower costs and increase choices by providing relief from the burdensome regulations and fostering competition in insurance markets;
Work to ensure a stable transition period;
Offer states greater flexibility of their Medicaid programs to meet the needs of their most vulnerable populations; and
Increase the opportunities for patients to get the care they need when they need it.

According to statements on the new web page, HHS intends to purse these objectives by “going through every page of regulations and guidance related to the Affordable Care Act to determine whether or not they work for patients and whether or not they are making our health care system better.”

Check out and follow these developments here.

About The Author

Throughout her adult life and nearly 30-year legal career, Ms. Stamer’s legal, management and governmental affairs work has focused on helping health industry, health benefit and other organizations and their management use the law, performance and risk management tools and process to manage people, performance, quality, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer supports these organizations and their leaders on both a real-time, “on demand” basis as well as outsourced operations or special counsel on an interim, special project, or ongoing basis with strategic planning and product and services development and innovation; workforce and operations management, crisis preparedness and response as well as to prevent, stabilize and cleanup legal and operational crises large and small that arise in the course of operations. Her experience encompasses helping health industry clients manage workforce, medical staff, vendors and suppliers, medical billing, reimbursement, claims and other provider-payer relations, business partners, and their recruitment, performance, discipline, compliance, safety, compensation, benefits, and training ;board, medical staff and other governance; compliance and internal controls; strategic planning, process and quality improvement; change management; assess, deter, investigate and address staffing, quality, compliance and other performance; meaningful use, EMR, HIPAA and other data security and breach and other health IT and data; crisis preparedness and response; internal, government and third-party reporting, audits, investigations and enforcement; government affairs and public policy; and other compliance and risk management, government and regulatory affairs and operations concerns.

Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, MGMA, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A former lead consultant to the Government of Bolivia on its Pension Privatization Project with extensive domestic and international public policy and governmental and regulatory affairs experience, Ms. Stamer also is widely recognized for regulatory and policy work, advocacy and outreach on healthcare, education, aging, disability, savings and retirement, workforce, ethics, and other policies. Throughout her adult life and career, Ms. Stamer has provided thought leadership; policy and program design, statutory and regulatory development design and analysis; drafted legislation, proposed regulations and other guidance, position statements and briefs, comments and other critical policy documents; advised, assisted and represented health care providers, health plans and insurers, employers, professional. and trade associations, community and government leaders and others on health care, health, pension and retirement, workers’ compensation, Social Security and other benefit, insurance and financial services, tax, workforce, aging and disability, immigration, privacy and data security and a host of other international and domestic federal, state and local public policy and regulatory reforms through her involvement and participation in numerous client engagements, founder and Executive Director of the Coalition for Responsible Health Policy and its PROJECT COPE: the Coalition on Patient Empowerment, adviser to the National Physicians Congress for Healthcare Policy, leadership involvement with the US-Mexico Chamber of Commerce, the Texas Association of Business, the ABA JCEB, Health Law, RPTE, Tax, Labor, TIPS, International Life Sciences, and other Sections and Committees, SHRM Governmental Affairs Committee and a host of other involvements and activities.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Affordable Care Act, America's Healthy Futures Act, American's Affordable Health Choices Act, Health Care, Health Care Provider, Health Care Reform, health care reimbursement, Health Insurance Exchange, Health IT, Health Plan, Health Plans, Health Policy, healthcare, Home Health, Hospice, Hospital, Labor Law, Laws, Patient Protection and Affordable Care Act, Uncategorized | Tagged: Health Plans, healthcare, healthcare reform, HHS, Patient Empowerment, Patient Protection Act, Patient Protection and Affordable Care Act, Trump | Permalink
Posted by Cynthia Marcotte Stamer

$400K HIPAA Settlement Shows Need To Conduct Timely & Appropriate Risk Assessments

April 12, 2017

Metro Community Provider Network (MCPN), a federally-qualified health center (FQHC), must pay $400,000 and implement a corrective action plan to resolve U.S. Department of Health and Human Services, Office for Civil Rights (OCR) charges it violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule by failing to implement a security management process to safeguard electronic protected health information (ePHI). The settlement is the latest reminder to health providers, payers and their business associates to conduct timely risk assessments, implement needed security and otherwise manage HIPAA compliance.

The Resolution Agreement and Corrective Action Plan, like most others before it, resulted from an investigation opened in response to a breach report. On January 27, 2012, MCPN filed a breach report with OCR indicating that a hacker accessed employees’ email accounts and obtained 3,200 individuals’ ePHI through a phishing incident. OCR’s investigation revealed that MCPN took necessary corrective action related to the phishing incident. However, the investigation also revealed that MCPN failed to conduct a risk analysis until mid-February 2012 – well after the hacking incident reported in the breach report.

Prior to the breach incident, MCPN had not conducted a risk analysis to assess the risks and vulnerabilities in its ePHI environment, and, consequently, had not implemented any corresponding risk management plans to address the risks and vulnerabilities identified in a risk analysis.

When MCPN finally conducted a risk analysis, OCR found that risk analysis, as well as all subsequent risk analyses, were insufficient to meet the requirements of the Security Rule.

OCR made a point in announcing the Resolution Agreement of noting it considered MCPN’s status as a FQHC when balancing the significance of the violation with MCPN’s ability to maintain sufficient financial standing to ensure the provision of ongoing patient care. MCPN provides primary medical care, dental care, pharmacies, social work, and behavioral health care services throughout the greater Denver, Colorado metropolitan area to approximately 43,000 patients per year, a large majority of whom have incomes at or below the poverty level. It is likely that OCR would have imposed a much greater settlement amount had the covered entity not been a FQHC serving the poor.

About The Author

The American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting, former Vice President of the North Texas Health Care Compliance Professionals Association, past Chair of the ABA Health Law Section Managed Care & Insurance Section, past ABA JCEB Council Representative, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has worked closely with a diverse range of physicians, hospitals and healthcare systems, DME, Pharma, clinics, health care providers, managed care, insurance and other health care payers, quality assurance, credentialing, technical, research, public and private social and community organizations, and other health industry organizations and their management deal with governance; credentialing, patient relations and care; staffing, peer review, human resources and workforce performance management; outsourcing; internal controls and regulatory compliance; billing and reimbursement; physician, employment, vendor, managed care, government and other contracting; business transactions; grants; tax-exemption and not-for-profit; licensure and accreditation; vendor selection and management; privacy and data security; training; risk and change management; regulatory affairs and public policy and other concerns.
As a core component of her work, Ms. Stamer has worked extensively throughout her career with health care providers, health plans and insurers, managed care organizations, health care clearinghouses, their business associates, employers, banks and other financial institutions, management services organizations, professional associations, medical staffs, accreditation agencies, auditors, technology and other vendors and service providers, and others on legal and operational compliance, risk management and compliance, public policies and regulatory affairs, contracting, payer-provider, provider-provider, vendor, patient, governmental and community relations and matters including extensive involvement advising, representing and defending public and private hospitals and health care systems; physicians, physician organizations and medical staffs; specialty clinics and pharmacies; skilled nursing, home health, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing and management services organizations; consultants; investors; technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, insurers, self-insured health plans and other payers; and other health industry clients to establish and administer compliance and risk management policies; comply with requirements, investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry investigation, enforcement including insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.
Past Chair of the ABA Managed Care & Insurance Interest Group and, a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also has extensive health care reimbursement and insurance experience advising and defending health care providers, payers, and others about Medicare, Medicaid, Medicare and Medicaid Advantage, Tri-Care, self-insured group, association, individual and group and other health benefit programs and coverages including but not limited to advising public and private payers about coverage and program design and documentation, advising and defending providers, payers and systems and billing services entities about systems and process design, audits, and other processes; provider credentialing, and contracting; providers and payer billing, reimbursement, claims audits, denials and appeals, coverage coordination, reporting, direct contracting, False Claims Act, Medicare & Medicaid, ERISA, state Prompt Pay, out-of-network and other nonpar insured, and other health care claims, prepayment, post-payment and other coverage, claims denials, appeals, billing and fraud investigations and actions and other reimbursement and payment related investigation, enforcement, litigation and actions.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Ambulatory care, ASC, Border Health, Childrens Health Insurance Program, Civil Rights, Conditions of Participation, Consumer Driven Health Care, Corporate Compliance, data breach, data security, Disease Management, DME, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employee Benefits, Employer, Employment, ERISA, Federal Health Center, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Provider, Health Insurance Exchange, Health IT, Health Plans, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, managed care, Meaningful Use, Medical Privacy, Medical Records, Medicare Advantage, Mental Health, Mental Heatlh, OCR, Patient Empowerment, Peer Review, Pharmaceudical, Pharmacy, Physician, Physician Licensing, Prescription Drugs, Privacy, Psychiatric, public health, Rural Health Care, Technology, Telemedicine, Veterans Health, Veterans Health Administration, Veterans Health Care, Wellness | Permalink
Posted by Cynthia Marcotte Stamer

Long-Term Care Hospitals Should Review Their Latest HHS Quality Data Reports

April 6, 2017

Long-Term Care Hospitals (LTCHs) should review their quality data contained in the Department of Health & Human Services (HHS) Centers for Medicare and Medicaid Services (CMS) CASPER system here and if necessary, notify CMS of any requested corrections.

CMS announced the LTCH review and correct reports were available for provider review within the CASPER application on Tuesday, April 4. The announcement of the availability of the reports follows a recent announcement by CMS of a delay in reporting deadlines by the Trump Administration. See CMS Extends Inpatient Rehab & Long Term Care Quality Data Reporting Deadlines.

The just-made available reports contain quality measure information at the facility level based on data submitted to CMS before the applicable quarterly data submission deadlines and display whether the data correction period for a given CY quarter is “open” or “closed.” Issued pursuant to CMS’ ongoing “quality” initiatives, the LTCH quality data reports are intended to allow LTCH providers, as well as CMS and others to obtain and evaluate aggregate performance for the past four full quarters when data is available. Since this data can impact both consumer and public perception, and CMS and other reimbursement as part of the CMS quality initiative, LTCHs should carefully review the data on their facilities and submit any requested corrections as soon as possible.

About The Author

Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, MGMA, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | Consumer Driven Health Care, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Hospital, Uncategorized | Tagged: CMS, Health Care, health care quality, long-term care, Medicaid, Medicare | Permalink
Posted by Cynthia Marcotte Stamer

$5.5M Memorial HIPAA Resolution Agreement Shows Need To Audit

February 16, 2017

Memorial Healthcare Systems (MHS) has paid the U.S. Department of Health and Human Services (HHS) $5.5 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules. The nonprofit corporation which operates six hospitals, an urgent care center, a nursing home, and a variety of ancillary health care facilities throughout the South Florida area with affiliated physician offices through an Organized Health Care Arrangement (OHCA) also agreed to implement a robust corrective action plan as part of the Resolution Agreement.

The MHS Resolution sends a strong message to all health care providers, health plans health care clearinghouses (Covered Entities) and their business associates that simply adopting HIPAA policies alone is insufficient to avoid getting nailed by OCR under HIPAA; Covered Entities and their business associates also must implement, audit and enforce those policies.

The MHS Resolution Agreement resulted from an investigation initiated by the HHS Office for Civil Rights (OCR) after MHS reported to OCR that protected health information (PHI) of 115,143 individuals had been impermissibly accessed by its employees and impermissibly disclosed to affiliated physician office staff. This information consisted of the affected individuals’ names, dates of birth, and social security numbers. The login credentials of a former employee of an affiliated physician’s office had been used to access the ePHI maintained by MHS on a daily basis without detection from April 2011 to April 2012, affecting 80,000 individuals.

The investigation revealed that although MHS had workforce access policies and procedures in place, MHS failed to implement procedures with respect to reviewing, modifying and/or terminating users’ right of access, as required by the HIPAA Rules. Further, MHS failed to regularly review records of information system activity on applications that maintain electronic protected health information by workforce users and users at affiliated physician practices, despite having identified this risk on several risk analyses conducted by MHS from 2007 to 2012.

MHS’ failure to follow through to implement the controls required by its policies and audit and enforce compliance with HIPAA and its HIPAA policies was a costly mistake. Other Covered Entities should heed MHS’ painful lesson and take documented steps to ensure its HIPAA policies not only are adopted, but also implemented and monitored and audited for compliance.

Leave a Comment » | Academic medicine, Ambulatory care, ASC, Border Health, Childrens Health Insurance Program, Civil Rights, Consumer Driven Health Care, Corporate Compliance, data breach, data security, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employee Benefits, Employer, Federal Health Center, Federal Sentencing Guidelines, Genetic Information, GINA, Health Care, Health Care Provider, Health Care Quality, Health Insurance Exchange, Health IT, Health Plan, Health Plans, healthcare, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, hospitals, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Laws, Meaningful Use, Medicaid, Medical Licensure, Medical Privacy, Medical Records, Medicare Advantage | Tagged: audit, civil monetary penalty, Data Breach, healthcare, HIPAA, Hospital, Privacy | Permalink
Posted by Cynthia Marcotte Stamer

Learn From Children’s New $3.2M+ HIPAA CMP For “Knowing” Violation of HIPAA Security Rules

February 2, 2017

The just-announced $3.2 million Health Insurance Portability & Accountability Act (HIPAA) Civil Monetary Penalty (CMP) that Children’s Medical Center of Dallas (Children’s) recently paid for failing to adequately secure electronic protected health information (ePHI) and correct other HIPAA compliance deficiencies demonstrates the risks healthcare providers, health plans and insurers, healthcare clearinghouses and their business associates (“Covered Entities”) run by failing to take appropriate, well-documented actions to timely to secure ePHI on systems and mobile devices or comply with other HIPAA Privacy or Security requirements.

The Department of Health & Human Services (HHS) Office of Civil Rights (OCR) imposed the $3,217,000.00 Civil Monetary Penalty (CMP) under a January 18, 2017 Final Determination based upon findings that Children’s for years knowingly violated HIPAA by failing to encrypt or otherwise properly secure ePHI on laptops and other mobile devices and failing to comply with many other HIPAA requirements. OCR originally notified Children’s of its intention to impose the CMP based on findings of widespread violations by Children’s of HIPAA in a September 30, 2016 Notice of Proposed Determination (Proposed Determination) that OCR sent to Children’s President of System Clinical Operations, David Berry. Although the Proposed Determination included instructions for requesting a hearing on the Proposed Determination, Children’s paid the CMP rather than exercising these hearing rights.

Breach Notice Investigation Reveals Children’s Failed For Years To Secure ePHI on Mobile Devices Despite Repeated Warnings

According to the Proposed Determination, OCR uncovered widespread HIPAA violations by Children’s while investigating the HIPAA compliance of the Dallas-based pediatric health and hospital system in response to two separate notices of large breaches of ePHI that Children’s filed with OCR in response to the HIPAA Breach Notification Rule. Under the Breach Notification Rule, Covered Entities generally must provide notice of any breach of unsecured ePHI involving more than 500 individuals with OCR, subjects of the breached ePHI and the media within 60 days of receiving notice of the breach. In contrast, for breaches of unsecured ePHI involving fewer than 500 individuals, Covered Entities generally must notify subjects of the breached ePHI within 60 days, but can delay notification to OCR until filing a consolidated annual report of small breaches of ePHI.

The two breach notifications that triggered the OCR investigation leading to the CMP both involved losses of mobile devices containing ePHI that Children’s filed with OCR.

The first breach report, filed on January 18, 2010, notified OCR of the loss at the Dallas/Fort Worth International Airport on November 19, 2009 of an unencrypted, non-password protected BlackBerry device containing the ePHI of approximately 3,800 individuals.

The second reported breach report filed on July 5, 2013, reported the theft of an unencrypted laptop with the ePHI of 2,462 individuals from its premises sometime between April 4 and April 9, 2013. The OCR investigation found that although Children’s implemented some physical safeguards to the operating room storage area (e.g., badge access was required, and a security camera was present at one of the entrances), it also provided access to the area to staff who were not authorized to access ePHI. Children’s janitorial staff had unrestricted access to the area where the laptop was stored but did not provide encryption to protect the ePHI on the laptop from access by such unauthorized persons. Children’s internal investigation concluded that the laptop was probably stolen by a member of the janitorial staff.

In the course of investigating these two reported breaches, OCR took note that Children’s previously reported a small breach of unsecured ePHI on an unencrypted mobile device. In a letter dated August 22, 2011, from Children’s Vice President of Compliance and Internal Audit and Chief Compliance Officer Ron Skillens to OCR Equal Opportunity Specialist Jamie Sorley, Mr. Skillens stated that a Children’s workforce member (an unidentified medical resident) lost an iPod device in December 2010. The iPod had been synched to the resident’s Children’s email account, which resulted in the ePHI of at least 22 individuals being placed on the device. The ePHI on the iPod was not encrypted. The loss of the iPod resulted in the impermissible disclosure of ePHI by the medical resident. OCR concluded the ePHI of 22 individuals was impermissibly disclosed, because the workforce member and agent of Children’s provided access to any unauthorized person who discovered the device.

OCR found that the breaches resulted from Children’s violation of the HIPAA Security Rule by failing to encrypt laptops and other mobile devices or and implement other appropriate safeguards for the protection of ePHI on mobile devices;
Failing to appropriately document its decision to not implement encryption on mobile devices and any applicable rationale behind a decision to use alternative security measures to encryption; and
Failing to implement security measures that were an equivalent alternative to the security protection available from encryption solutions.

The Proposed Determination also reports that the OCR ’s investigation revealed that Children repeatedly over several years knowingly failed to implement and administer proper encryption and other safeguards on laptops and other mobile devices containing ePHI despite actual knowledge of the unaddressed risks to unencrypted ePHI in violation of the HIPAA Security Rule dating back to at least 2007. The Proposed Determination notes, for instance, that:

A Security Gap Analysis and Assessment conducted for Children’s December 2006-February 2007 by Strategic Management Systems, Inc. (SMS) (SMS Gap Analysis) identified the absence of risk management as a major finding and recommended that Children’s implement encryption to avoid loss of PHI on stolen or lost laptops.
A separate PricewaterhouseCoopers (PwC) analysis of threats and vulnerabilities to certain ePHI (PwC Analysis) conducted in August, 2008 for Children’s determined that encryption was necessary and appropriate. The PwC Analysis also determined that a mechanism was not in place to protect data on a laptop, workstation, mobile device, or USB thumb drive if the device was lost or stolen and identified the loss of data at rest through unsecured mobile devices as being “high” risk. PwC identified data encryption as a “high priority” item and recommended that Children’s implement data encryption in the fourth quarter of 2008.
Furthermore, in September 2012, the HHS Office of the Inspector General (OIG) issued the findings from its audit of Children’s that focused on information technology controls for devices such as smartphones and USB drives. Among other things, the report, entitled “Universal Serial Bus Control Weaknesses Found at Children’s Medical Center,” found that Children’s had insufficient controls to prevent data from being written onto unauthorized and unencrypted USB devices and that “without sufficient USB controls, there was a risk that ePHI could have been written onto an unauthorized/unencrypted USB device and taken out of the hospital, resulting in a data breach.” A copy of this report was provided to Mr. Skillens.
Despite the prior breach notifications and warnings from the SMS Gap Analysis, the PwC Analysis and the OIG audit report, Children’s failed to take the necessary steps to encrypt and otherwise safeguard its ePHI on mobile devices. Children’s still had not implemented encryption on all devices as of April 9, 2013 even though appropriate commercial encryption products were available to achieve encryption of laptops, workstations, mobile devices, and USB thumb drives in use by Children’s staff by, at least, the time of the PwC Analysis in 2008. Furthermore, while leaving these deficiencies unresolved, the Proposed Determination notes that Children’s issued unencrypted BlackBerry devices to nurses beginning in 2007 and allowed its workforce members to continue using unencrypted laptops and other mobile devices until at least April 9, 2013 despite the findings of SMS and PwC and Children’s actual knowledge about the risk of maintaining unencrypted ePHI on its devices.

Based on this evidence, OCR concluded that Children’s had “actual knowledge” of the unaddressed threats to ePHI as early as March 2007 and at least one year prior to the reported security incidents. Furthermore, OCR also found that Children’s additionally violated HIPAA by failing to implement sufficient policies and procedures governing the receipt and removal of hardware and electronic media that contain ePHI into and out of its facility, and the movement of these items within the facility prior to at least November 9, 2012. Prior to November 2012, Children’s information technology (IT) assets were inventoried and managed separately from the inventory of devices used within its Biomedical Department. Children’s IT asset policies did not apply to devices that accessed or stored ePHI that were managed by the Biomedical Department. Consequently, Children’s was unable to identify all devices to which the device and media control policy should apply prior to completing a full-scope inventory to identify all information systems containing ePHI in November 9, 2012. As Children’s did not conduct a complete inventory to identify all devices to which its IT asset policies apply to ensure that all devices were covered by its device and media control policies, the Proposed Determination concluded Children’s was out of compliance with the Security Rule at 45 C.P.R. § 164.310(d)(l).

After OCR’s investigation indicated widespread Privacy and Security Rule noncompliance by Children’s, the Proposed Determination states that OCR attempted to negotiate a resolution with Children’s through its informal resolution agreement process from approximately November 6, 2015, to August 30, 2016. When these efforts failed, OCR issued a May 10,2016 Letter of Opportunity that formally informed Children’s that since OCR had been unable to resolve its findings that Children’s violated the Privacy and Security Rules by informal means, OCR was informing Children’s of the preliminary indications of non-compliance and providing Children’s with an opportunity to submit written evidence of mitigating factors under 45 C.F.R. § 160.408 or affirmative defenses under 45 C.F.R. § 160.410 for OCR’s consideration in making a determination of a CMP pursuant to 45 C.F.R. § 160.404. The letter stated that Children’s could also submit written evidence to support a waiver of a CMP for the indicated areas of non-compliance. Each of Children’s indicated acts of noncompliance and the potential CMP for them were described in the letter. The letter was delivered to Children’s and received by Children’s agent on May 12, 2016.

Children’s responded to OCR’s letter on or about June 9, 2016. The Proposed Determination states that OCR determined that the information and arguments submitted by Children’s in its June 9, 2016 letter did not support an affirmative defense pursuant to 45 C.F.R. § 160.410 or a waiver of the CMP pursuant to 45 C.F.R. § 160.412. Accordingly, OCR notified Children’s in its September 30, 2016 Proposed Determination of OCR’s intent to implement the $3,217,000.00 CMP and procedures for appealing this planned CMP assessment. When Children’s did not file an appeal, OCR issued the Final Determination assessing the CMP. OCR reports that Children now has paid the $3,217,000.00 CMP.

Important Lessons For Other Covered Entities & Their Leaders

The Children’s CMP and underlying circumstances provide many key lessons for other Covered Entities. Obviously, the Final Decision drives home the importance of:

Proper encryption and other security and access controls of devices and systems containing ePHI; and
Proper documentation of risk assessments, audits, breach investigations and other events, compliance analysis and conclusions taken in response, and corrective actions selected and implemented in response to these events.

Beyond the importance of documented compliance with encryption and other requirements, the Children’s CMP and its associated Proposed Determination and Final Determinations also illustrate the importance of proper behavior in response to a known or suspected breach. The Proposed Determination and Final Determination make clear that beyond the breaches uncovered in the course of the investigation, OCR’s decision to implement the CMP was influenced by, among other things:

The recurrent disregard and failure by Children to act to address the HIPAA security violations over a period of years despite both repeated notifications of its noncompliance and actual breaches resulting from these compliance deficiencies; and
The failure of Children’s to cooperate with OCR to reach a voluntary resolution agreement which might have allowed Children to resolve its liability for the breaches OCR found by paying a potentially smaller settlement payment and implementing corrective actions to OCR’s satisfaction.

About The Author

Recognized by LexisNexis® Martindale-Hubbell® as a “AV-Preeminent” (Top 1%/ the highest) and “Top Rated Lawyer,” with special recognition as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, the author of this uProposed Determinationate is widely known for her 28 plus years’ of work in health care, health benefit, health policy and regulatory affairs and other health industry concerns as a practicing attorney and management consultant, thought leader, author, public policy advocate and lecturer.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting, former Vice President of the North Texas Health Care Compliance Professionals Association, past Chair of the ABA Health Law Section Managed Care & Insurance Section, past ABA JCEB Council Representative, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, Ms. Stamer’s includes nearly 30 years’ of work with a diverse range of health industry clients on an extensive range of matters.

Ms. Stamer has worked closely with health industry, managed care and insurance and other businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of staffing, human resources and workforce performance management, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

Heavily involved in health care and health information technology, data and related process and systems development, policy and operations innovation and a Scribe for ABA JCEB annual agency meeting with OCR for many years who has authored numerous highly-regarded works and training programs on HIPAA and other data security, privacy and use, Ms. Stamer also is widely recognized for her extensive work and leadership on HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns including policy design, drafting, administration and training; business associate and other contracting; risk assessments, audits and other risk prevention and mitigation; investigation, reporting, mitigation and resolution of known or suspected breaches, violations or other incidents; and defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies, other business partners, patients and others. Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

Beyond her extensive involvement advising and representing clients on privacy and data security concerns and other health industry matters, Ms. Stamer also has served for several years as a scrivener for the ABA JCEB’s meeting with OCR, the Chair of the Southern California ISSA Health Care Privacy & Security Summit, and an editorial advisory board member, author, program chair or steering committee member, and faculties for a multitude of other programs and publications regarding privacy, data security, technology and other compliance, risk management and operational concerns in the health care, health and other insurance, employee benefits and human resources, retail, financial services and other arenas.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

For more information about Ms. Stamer or her health industry and other experience and involvements, see here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press, Inc.™

Leave a Comment » | data breach, data security, Doctor, Health Care, Health Care Finance, Health Care Provider, Health Plan, Health Plans, HIPAA, HIPAA Cyber Crime, Hospital, Hospital, hospitals, Medical Privacy, Physician, Privacy, Uncategorized | Tagged: breach, children's health, Children's Medical Center, Civil Monetary Penalties, civil monetary penalty, CMP, Data, Data Breach, Data Security, EPHI, Health Care, Health Plan, HIPAA, medical, Medical Privacy, mobile device, OCR, PHI, Privacy, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Prepare For Changing IRS Tax-Exempt Org & Employee Plan Audit & Exam Info Request Rules

November 22, 2016

Health care organizations sponsoring tax-qualified employee benefit plans or operating as tax-exempt entities under the Internal Revenue (Code) should expect changes in the practices Internal Revenue Service (IRS) agents use to issue and enforce document requests (IDRs) in connection with an IRS audit or other investigation of their employee benefit plans’ tax status or compliance after March 1, 2017.

The IRS Tax Exempt and Government Entities Division (TEGE) just issued internal guidance (Guidance) outlining the new procedures its agents will use to gather information for employee benefit plan and exempt organization examinations including information requests made in connection with:

Employee Benefit Form 5500 Examination Procedures
Exempt Organizations Pre-Audit Procedures
On-Site Examinations
Tax Exempt Bonds Examinations
Indian Tribal Government Examinations and
Federal, State and Local Governments (FSLG) Examinations

The new Guidance follows other recent announcements of changes of IRS employee plan or exempt organization procedures such as recently announced changes in IRS employee plan correction procedures. See, e.g., IRS Qualified Plan Correction Procedures Changing 1/1/17.

The new procedures defined in the Guidance apply more broadly and take effect April 1, 2017. The Guidance also requires that TEGE update the following IRMs to specifically reflect the new procedures within the next two years:

IRM 4.71.1, Overview of Form 5500 Examination Procedures;
IRM 4.75.10, Exempt Organizations Pre-Audit Procedures;
IRM 4.75.11, On-Site Examination Guidelines;
IRM 4.81.5, Tax Exempt Bonds Examination Program Procedures – Conducting the Examination;
IRM 4.86.5, Conducting Indian Tribal Government Examinations; and
IRM 4.90.9, Federal, State and Local Governments (FSLG) – Procedures, Workpapers and Report Writing.

According to TEGE the new procedures set forth in the Guidance are designed to “ensure” that IRS Counsel is prepared to enforce IDRs through the issuance of a summons when necessary while also reinforcing the IRS’ commitment to the respect of taxpayer rights under the Taxpayer Bill of Rights. TEGE says the updated procedures established in the Guidance will promote these goals by:

Providing for open and meaningful communication between the IRS and taxpayers;
Reducing taxpayer burdens
Providing for consistent treatment of taxpayers;
Allowing the IRS to secure more complete and timely responses to IDRs;
Providing consistent timelines for IRS agents to review IDR responses; and
Promoting timely issue resolution.

In furtherance of these goals, the new Guidance, among other things requires:

“Active involvement” by managers of IRS examiners’ early in the process;
Taxpayers to be involved in the IDR process;
Examiners to discuss the issue being examined and the information needed with the taxpayer prior to issuing an IDR;
Examiners to ensure that the IDR clearly states the issue and the relevant information they are requesting;
If the taxpayer does not timely provide the information requested in the IDR by the agreed upon date, including extensions, examiners to issue a delinquency notice;
If the taxpayer fails to respond to the delinquency notice or provides an incomplete response, for the examiner to issue a pre-summons notice to advise the taxpayer that the IRS will issue a summons unless the missing items are fully provided; and
For a summons to be issued if the taxpayer fails to provide a complete response to the pre-summons letter by its response due date.

While it remains to be seen exactly how well the new procedures will promote the intended goals in operation, leaders, sponsors, administrators and tax advisors to employee benefit plans and exempt organizations tagged for audits after the Guidelines will need to understand these new procedures to take advantage of all available options for mitigating exposures and liability from the audit as well as to avoid unfortunate missteps that could result in forfeiture of otherwise available tax-related rights and options or otherwise increase the tax and other associated risks and liabilities of the entities or others associated with them arising from the audit.

Along with responding to these tax-related risks, leaders and advisors of health care or other tax-exempt organizations and sponsors and sponsors, fiduciaries, and administrators of tax-qualified employee benefit plans also should keep in mind and take steps to ensure the often substantial non-tax related risks that usually arise concurrently or evolve from a TEGE or other tax-related audit or investigation of their benefit programs or tax-exempt status when preparing for or responding to a TEGE audit or investigation. These often substantial tax and non-tax exposures typically makes it desirable if not necessary to involve experienced legal counsel in the process as soon as possible.

To help their entities or employee benefit plans respond appropriately to an audit and manage tax and non-tax related risks and responsibilities that the audit may trigger or enhance the entity, its responsible sponsoring entities, fiduciaries, officers and board members, or other responsible parties generally should seek legal advice within the scope of attorney-client privilege from legal counsel not only immediately upon receiving an IDR or other notice of an IRS audit or investigation, as well periodically before notification of an audit or investigation. Early involvement of legal counsel generally is necessary both to understand and manage both the tax and non-tax exposures associated with the audit, as well as to preserve and utilize the potential benefits of attorney-client privilege and other evidentiary privileges that could help to mitigate both the tax and non-tax related risks for the entity and other responsible parties. Pre-audit consultation with qualified legal counsel within the scope of attorney-client privilege also can help to prevent or resolve potential tax-qualification or other compliance concerns on a coordinated, holistic basis in advance or more efficiently in the event of an audit or investigation. Such pre-audit review and planning often can help entities and their leaders prevent or resolve problems with more flexibility and less risk for the entity and responsible leaders.

When planning for or responding to a TEGE or other audit or other investigation, tax-exemption hospitals and employee benefit plan sponsors and fiduciaries generally will want to engage qualified legal counsel to guide these activities and maximize the availability of attorney-client privileged, work product and other evidentiary privileges. While federal tax rules afford some evidentiary privileges to certain accounting professionals when providing tax representation or advice, the protective scope of such privileges generally are more limited than attorney-client privilege and work product evidentiary privileges and typically do not apply to non-tax matters. The narrower availability of evidentiary privileges generally makes it advisable to engage legal counsel at the beginning of the process to help maximize the availability of evidentiary privileges throughout the process. As a result, most entities and their leaders will want to consider involvement of legal counsel to maximize privilege protections and non-tax related exposures even if the parties plan for a qualified tax professional or other consultant to play a significant role in assisting them to prepare for and respond to the audit.

About The Author

Ms. Stamer works with health industry and other businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on these and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association; Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Gulf Coast TEGE Council Exempt Organization Coordinator; a founding Board Member and past President of the Alliance for Healthcare Excellence; former board member and Vice President of the Managed Care Association; past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; a member and advisor to the National Physicians’ Council for Healthcare Policy; current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee; current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section; Past Chair of the ABA Health Law Section Managed Care & Insurance Section; a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group; immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council; past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a former member of the Board of Directors, Treasurer, Member and Continuing Education Chair of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment, employee benefits, compensation, and other regulatory and operational risk management. Examples of her many highly regarded publications on these matters include the “Texas Payday Law” Chapter of Texas Employment Law, as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Affordable Care Act, Ambulatory care, Border Health, Consumer Driven Health Care, Corporate Compliance, DME, Employee Benefits, Employer, Employment law, Federal Sentencing Guidelines, Grants, Health Care, Health Care Finance, Health Care Provider, Health Plan, Health Plans, healthcare, Home Health, Hospice, Hospital, Indian Health, Nonprofits, public health, Tax, Tax-Exemption, Uncategorized | Tagged: 403(b), 457, 457 plan, 501(c)(3), employee benefits, foundation, Health Care, Health Plan, healthcare, indian nation, retirement plans, Tax, Tax-Exemption | Permalink
Posted by Cynthia Marcotte Stamer

2017 CMS Hospital OPPS & ACS Payment System Updates Released

November 1, 2016

On November 1, CMS issued Final Rules updating payment rates and policy changes in the Hospital Outpatient Prospective Payment System (OPPS) and Ambulatory Surgical Center (ASC) Payment System for CY 2017.

The Final Rules add new quality measures to the Hospital Outpatient Quality Reporting Program and the ASC Quality Reporting Program that CMS says focus on improving patient outcomes and experience of care. CMS estimates that the updates in the final rule would increase OPPS payments by 1.7 percent and ASC rates by 1.9 percent in 2017.The Final Rule also:

Contains provisions that seek to address physicians’ concerns regarding pain management;
Focus payments on patients rather than setting; and
Seek to Improve patient care through technology.

About Solutions Law Press Inc.™

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates including:

Leave a Comment » | Academic medicine, Ambulatory care, ASC, Doctor, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Hospital, Medicaid, Outpatient, Physician, Rural Health Care, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

$2.7M OCR Settlement Warns HIPAA Covered Entities To Clean Up Compliance

October 28, 2016

A new settlement agreement requiring Oregon Health & Science University (OHSU) to pay $2.7 million and implement a comprehensive three-year corrective action plan to resolve charges it violated the Health Insurance Portability & Accountability Act Privacy & Security Rules (HIPAA) sends a clear warning to other health care providers, health plans, healthcare clearinghouses (Covered Entities) and their business associates to encrypt devices with protected health information (PHI), have signed HIPAA-compliant business associate agreement in place before letting them access PHI and otherwise keep your HIPAA enterprise risk assessment and compliance up-to-date.

OHSU Charges

The OHSU settlement announced September 23 settled Department of Health & Human Services Office of Civil Rights (OCR) charges of multiple, long-standing, systematic HIPAA violations by OHSU uncovered by OCR as a result of investigations initiated in response to three reports of large-scale breaches of electronic protected health information (ePHI) made by OHSU.

OCR opened its HIPAA investigations at OHSU after the large public academic health center and research university centered in Portland, Oregon, submitted three HIPAA breach reports affecting thousands of individuals, including two reports involving unencrypted laptops and another large breach involving a stolen unencrypted thumb drive:

On March 23, 2013, HHS received notification from OHSU regarding a breach of its unsecured electronic protected health information (“ePHI”) resulting from a stolen laptop computer;
On July 28, 2013, HHS received notification from OHSU regarding a breach of its ePHI resulting from storing ePHI at an internet-based service provider without a business associate agreement; and.
On May I, 2013, and on November 8, 2013, HHS notified OHSU of its investigations of these breach incidents, respectively, regarding OHSU’s compliance with the HIPAA Rules.

These incidents each garnered significant local and national press coverage. OCR’s investigation uncovered evidence of widespread vulnerabilities within OHSU’s HIPAA compliance program, including the storage of the ePHI of more than 3,000 individuals on a cloud-based server without a business associate agreement. OCR found significant risk of harm to 1,361 of these individuals due to the sensitive nature of their diagnoses.

OCR found the reported breaches resulted from widespread, long-term, systematic and unresolved HIPAA violations by OHSU that OCR attributed to an inadequate commitment to and oversight of HIPAA compliance by OHSU C-level management which lead OHSU to fail to appropriately monitor and maintain its ongoing compliance and to assess and address changes in its enterprise-wide risk and compliance obligations on an ongoing basis. OHSU performed risk analyses in 2003, 2005, 2006, 2008, 2010, and 2013, but OCR’s investigation found that these analyses did not cover all ePHI in OHSU’s enterprise, as required by the Security Rule. While the analyses identified vulnerabilities and risks to ePHI located in many areas of the organization, OHSU did not act in a timely manner to implement measures to address these documented risks and vulnerabilities to a reasonable and appropriate level. OHSU also lacked policies and procedures to prevent, detect, contain, and correct security violations and failed to implement a mechanism to encrypt and decrypt ePHI or an equivalent alternative measure for ePHI maintained on its workstations, despite having identified this lack of encryption as a risk.

Based on these findings, OCR concluded that while OHSU initially adopted HIPAA Policies, the reported breaches were the result of a series of widespread and ongoing breaches of HIPAA resulted including the following:

From January 5, 2011, until July 3, 2013, OHSU disclosed the ePHI of 3,044 individuals in violation of Privacy Rules §§160.103 and 164.502(a) when workforce members disclosed the ePHI to a third-party internet-based service provider without obtaining a business associate agreement or other satisfactory assurance that the internet-based service provider would safeguard the ePHI;
From January 5, 2011 until July 3, 2013 OHSU failed to obtain a business associate agreement from an internet-based service provider that was storing ePHI on its behalf as a business associate as required by 45 C.F.R. § 164.308(b);
From January 5, 2011 until July 3, 2013 OHSU failed to implement policies and procedures to prevent, detect, contain, and correct security violations as required under Privacy Rule § 164.308(a)(1)(i);
From July 12, 2010 to present, OHSU failed to implement a mechanism to encrypt and decrypt ePHI or an equivalent alternative measure for all ePHI maintained in OHSU’s enterprise as required by Privacy Rules §§ 164.312(a)(2)(iv) and 164.306(d)(3)); and
From May 29, 2013 until July 3, 2013, OHSU failed to implement policies and procedures to address security incidents in violation of Privacy Rule § 164.308(a)(6)(i).

According to statements made by OCR Director Jocelyn Samuels in OCR’s announcement of the OHSU Settlement, the breaches should not have happened. “From well-publicized large-scale breaches and findings in their own risk analyses, OHSU had every opportunity to address security management processes that were insufficient,” said OCR Director Jocelyn Samuels. OCR’s announcement also signals that OCR views inadequate commitment and oversight by OHSU’s senior management to have played a key role in the creation and perpetuation of the OHSU violations. It quotes OCR Director Jocelyn Samuels as stating, “This settlement underscores the importance of leadership engagement and why it is so critical for the C-suite to take HIPAA compliance seriously.”

To resolve the HIPAA charges, the OHSU Settlement requires OHSU to pay OCR $2,700,000 as well as take a long series of corrective actions detailed in the Corrective Action Plan incorporated into the Settlement Agreement. The requirements of the Corrective Action Plan both seek to address the specific weaknesses that lead to the breaches of unsecured ePHI reported by OHSU in its breach notifications as well as the broader deficiencies in OHSU’s overall HIPAA compliance practice by requiring among other things that OHSU:

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI at all OHSU facilities and on all systems, networks, and devices that create, receive, maintain, or transmit ePHI;.
Develop and present to OCR for approval a comprehensive written risk managementh plan that explains OHSU’s strategy for implementing security measures sufficient to reduce the risks and vulnerabilities identified in the risk analysis to a reasonable and appropriate level based on OHSU’s circumstances as well as a comprehensive, enterprise-wide plan to implement effective oversight of OHSU workforce members to ensure their adherence to HIPAA Rules and OHSU’s internal privacy and security policies and procedures with specific timelines for their expected completion and compensating controls identified in the interim to safeguard OHSU’s ePHI;
Implement and administer the written risk management plan and other safeguards as approved by OCR;
Provide updates to OCR about OHSU’s implementation of required encryption including a Mobile Device Management (MDM) solution that ensures all OHSU- owned and personally-owned mobile devices (tablets, smart phones, and other mobile devices) that access ePHI on OHSU’s secure network are encrypted other than mobile devices for which OHSU has granted exceptions based on documented evidence of the implementation of alternative reasonable compensating controls to protect the ePHI on such devices;
Report to OCR on OHSU’s efforts to a solution to enforce encryption of ePHI on OHSU-owned and personally-owned devices (laptops, desktops, and medical equipment) connecting to OHSU’s secure wired and wireless networks except for any devices for which OHSU has granted exceptions to the encryption requirement;
Report to OCR about its implementation of policies that prohibit the transfer of data containing ePHI from OHSU-owned and personally-owned devices to unencrypted removable storage devices (USB drives and portable hard drives) and implementation of a technical solution that enforces the policies prohibiting transfers of this type when attached to the OHSU secure network, except for any removable storage devices for which OHSU has granted exceptions based on documented evidence of reasonable compensating controls that have been implemented to protect the ePHI on such devices;
Send a communication to all members of the OHSU community describing its commitment to enterprise encryption;
Prepare to the satisfaction of OCR security awareness training materials needed to implement its security management processing including specific privacy and security awareness related to a) use of internet-based information storage services; b) disclosures to third-party entities that require a business associate agreement or other reasonable assurance in place to ensure that the business associate will safeguard the protected health information (PHI) and/or ePHI; c) regarding managers, effective oversight of workforce members’ uses and disclosures of PHI, including ePHI, to ensure the workforce members’ compliance with the Privacy and Security Rules and OHSU’s internal policies and procedures; d) security incident reporting; and e) password management;
Initially train all workforce members with access to PHI and/or ePHI with 120 days of OCR’s approval of the training and thereafter ensure that new workforce members are trained with 15 days of hire and that all workforce members subsequently continue to receive training on an ongoing basis
Review the security awareness training materials annually, and, where appropriate, update the training to reflect changes in Federal law or HHS guidance, any issues discovered during audits or reviews, and any other relevant developments.
Management oversight and reporting to OCR concerning OHSU’s implementation and compliance with the Corrective Action Plan and HIPAA.

OHSU Lessons For Other Covered Entities & Business Associates & Their Management

The OHSU Settlement Agreement gives notice to all Covered Entities and business associates and their C-level management that OCR expects these organizations and their top management to get serious about HIPAA compliance. The OHSU Settlement shows Covered Entities and their business associates that they must constantly reassess their required HIPAA Privacy and Security policies and safeguards as well as risks to PHI and ePHI. In the event of a breach or audit, these organization’s leadership needs to ensure their organization can show both a strong commitment to HIPAA compliance and their actions to ensure their organization appropriately monitors events and developments that could impact the adequacy of their existing measures and timely update their systems and security, policies, procedures, training and other relevant safeguards.

The Settlement also makes clear that Covered Entities and their business associates should ensure that their organization possesses a well-documented current enterprise-wide risk assessment, as well as has in place and is administering as necessary to maintain the currency and adequacy of its risk assessment strong practices for conducting documented evaluations of their own HIPAA security, policies, practices, audits and investigations and other procedures necessary to comply with HIPAA, taking into account recent OCR guidance, its initiation of its Phase II audit program, the insights offered by OCR’s ever growing list of enforcement actions and compliance tools, as well as changes in systems, documentation, software, equipment or other occurrences within the operations of the Covered Entity or business associate’s operations that could impact the currency and adequacy of its risk assessment or otherwise raise compliance risks.

In this respect, Covered Entities and business associates are encouraged to take special note of the advisability of specifically reviewing and updating their HIPAA policies, practices, business associate agreements, training, oversight and documentation to in response to the guidance and insight that OCR provides, including:;

HIPAA Settlement Illustrates The Importance Of Reviewing And Updating, As Necessary, Business Associate Agreements (September 23, 2016); Business Associate’s Failure to Safeguard Nursing Home Residents’ PHI Leads to $650,000 HIPAA Settlement (June 29, 2016);
Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option Up to $6.50 is Not a Cap on All Fees for Copies of PHI (May 23, 2016)
Guidance On HIPAA & Cloud Computing released October 6, 2016, which provides guidance for Covered Entities and business associates about contracting and other procedures that HIPAA-regulated Covered Entities and their business associates should implement when contracting for and using Cloud Computing Services;
Joint Guidance published October 21, 2016 by the Federal Trade Commission and OCR reminding Covered Entities and their business associates of the need to ensure that in addition to fulfilling the technical content requirements of HIPAA, their HIPAA authorizations, privacy practices notices and other HIPAA notices and communications are written and presented in plan language, include required specific terms and descriptions and in a manner that does not mislead individuals about their rights or about what is happening with their PHI. Furthermore, where Covered Entities and their business associates contemplate that businesses associates may request that individuals sign HIPAA authorizations, Covered Entities and their business associates should the Covered Entity and business associate have in place a current, signed HIPAA-compliant business associate agreement that expressly authorizes the business associate to request the HIPAA authorization in light of statements in the Joint Guidance indicating that OCR views the Privacy Rules as prohibiting a business associate from asking a consumer to sign a HIPAA authorization unless its business associate contract expressly permits the business associate to do so; and
Other OCR enforcement actions, tools and guidance. See, e.g. All Covered Entities Should Learn Lessons From Mississippi Medical Center’s $2.75 Million HIPAA Resolution Agreement; Providers, Health Plans Should Confirm Copy Charges Comply With New OCR HIPAA Guidance; $2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use; Addressing Gaps in Cybersecurity: OCR Releases Crosswalk Between HIPAA Security Rule and NIST Cybersecurity Framework; HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework.

Employer and other health plan sponsors, health plan fiduciaries and business associates, and their service providers also generally will want to consider their responsibilities to provide and enforce employer certifications, as well as the fiduciary obligations health plan fiduciaries under the fiduciary responsibility rules of the Employee Retirement Income Security Act (ERISA). Among other things, wrongful disclosure of PHI to a sponsoring employer or others could violate HIPAA or other plan terms. Furthermore, Department of Labor officials have indicated stated that a fiduciary’s general fiduciary responsibilities can apply to the protection and administration of PHI and other health plan information as well as create a duty by a responsible fiduciary to prudently investigate and take steps to address breaches or other potential concerns that place PHI at risk. See, HIPAA Settlement Warns Health Plans, Sponsoring Employers & Business Associates To Manage HIPAA Risks.

Furthermore, as breaches of PHI and other violations of HIPAA also frequently give rise to responsibilities or risks under a broad range of other federal and state laws medical and financial privacy and data security, Medicare and other terms of federal program participation, medical credentialing, licensure and ethics, insurance and Employee Retirement Income Security Act fiduciary responsibilities in the case of health plans, contractual, tort and other exposures, Covered Entities and their business associates also generally are best served to take into account these other responsibilities and exposures in conjunction with the design and administration of their HIPAA compliance and risk management policies and practices.

Covered Entities and their business associates also should seek advice from legal counsel regarding the adequacy of their compliance, investigatory, training, management oversight, training, reporting, documentation, document retention and other processes and procedures that could reduce risks of HIPAA violations and position the organization to effectively and more efficiently respond to a potential breach, audit, investigation or enforcement action and mitigate the costs and potential liability exposures that increasingly attends these events. In addition, given the typically high financial, operational and legal costs typically incurred to conduct investigations, report and redress breaches, and respond to OCR audits or investigations, much less make any payments and implement any corrective actions required to settle OCR changes, most Covered Entities and their business associations will want to consider the advisability and adequacy of insurance and other sources of funding or indemnification for the often substantial costs that often attend a HIPAA breach, audit or enforcement event. Since HIPAA violations under certain circumstances also can give rise to felony criminal liability, boards of directors and other leaders of Covered Entities and business associates also will want to ensure that their HIPAA compliance policies and practices also are incorporated and monitored by management as part of their organization’s overall Federal Sentencing Guideline Compliance programs and practices.

About The Author

Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, a Fellow in the American College of Employee Benefit Counsel, past Group Chair and current Defined Contribution Plans Committee Co-Chair, Groups and Substantive Committee and Membership Committee Members, past Welfare Plans Committee Chair and Co-Chair, and former Fiduciary Responsibility Vice Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current ABA International Section Life Sciences Committee Vice Chair, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, former ABA Joint Committee on Employee Benefits Council Representative and Marketing Committee Chair and a prolific author and highly popular speaker and consultant, Ms. Stamer helps management manage.

Ms. Stamer’s legal and management consulting work throughout her nearly 30-year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

As a core component of her work, Ms. Stamer has worked extensively throughout her career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposium and chair, faculty member and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Leave a Comment » | Consumer Driven Health Care, Health Care, Health Care Provider, Health Care Quality, health care reimbursement, healthcare, HIPAA, HIPAA Cyber Crime, Hospital, hospitals, Medical Privacy, OCR, Physician, Physician Licensing, Privacy, Rural Health Care, Uncategorized | Tagged: HIPAA, HITECH, medical, Privacy, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

$2.4M+ St. Joseph Health HIPAA Settlement Teaching Lesson For Other HIPAA-Covered Entities & Business Associates

October 25, 2016

St. Joseph Health (SJH) has agreed to pay a $2.4 million plus settlement payment, conduct an enterprise-wide risk analysis and implement and administer a comprehensive correction plan under a Resolution Agreement and Corrective Action Plan (SJH Settlement) reached with the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) to settle OCR charges that SJH violated the Privacy & Security Rules of the Health Insurance Portability & Accountability Act (HIPAA) by allowing files containing electronic protected health information (ePHI) of 31,800 individuals that SJH created for its participation in the Medicare meaningful use program to be publicly accessible on the internet from February 1, 2011, until February 13, 2012. The SJH Settlement announced here by OCR on October 18, 2016 demonstrates the mounting HIPAA enforcement exposures that HIPAA-covered health care providers, health plans, healthcare clearinghouses and their business associates (Covered Entities) risk when a breach of ePHI or other prohibited use, access, destruction or disclosure of ePHI or other personal health information (PHI) results from the failure of the Covered Entity or its business associates to properly protect or secure it in accordance with HIPAA. A review of the SJH Settlement drives home the point that Covered Entities should not assume that meaningful use or other electronic recordkeeping systems containing ePHI are properly secured in accordance with HIPAA.

SJH Investigation & Charges Resulting In $2.4 Million+ Settlement

A nonprofit integrated Catholic health care delivery system sponsored by the St. Joseph Health Ministry, who through its 24,000 employees and 6,000 physicians provides a range of health care services to more than 137,000 inpatients and 3.6 million outpatients each year at SHS’ 4 acute care hospitals, home health agencies, hospice care, outpatient services, skilled nursing facilities, community clinics and physician organizations located throughout California and in parts of Texas and New Mexico.

OCR’s charges against SJH arose out of OCR’s investigation into a 2012 breach notification report SJS filed with OCR. On February 14, 2012, SJH reported to OCR that files containing electronic protected health information (ePHI) of 31,800 individuals from five of the SJH hospitals-St. Jude Medical Center, Mission Hospital, Queen of the Valley Medical Center, Santa Rosa Memorial Hospital, and Petaluma Valley Hospital that SJH created for its participation in the meaningful use program were publicly accessible on the internet from February 1, 2011, until February 13, 2012, via Google and possibly other internet search engines.

SJH’s report to OCR indicated that this public access resulted from a configuration within its network server in which PDF files containing following patient information were uploaded: patient names; BMI; blood pressure; lab results; smoking status; diagnoses lists; medication allergies; advance directive status and demographic information (language, ethnicity, race, sex, and birth date). The server SJH purchased to store the files included a file sharing application whose default settings allowed anyone with an internet connection to access them. Upon implementation of this server and the file sharing application, SJH did not examine or modify it. As a result, the public had unrestricted access to PDF files containing the ePHI of 31,800 individuals, including patient names, health statuses, diagnoses, and demographic information from February 14, 2012 until SJH blocked external access to the ePHI when it shut down the application February 13, 2012.

OCR’s investigation indicated the following potential violations of the HIPAA Rules:

From February 1, 2011 to February 13, 2012, SJH potentially disclosed the PHI of 31,800 individuals;
Evidence indicated that SJH failed to conduct an evaluation in response to the environmental and operational changes presented by implementation of a new server for its meaningful use project, thereby compromising the security of ePHI;
Although SJH hired a number of contractors to assess the risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by SJH, evidence indicated that this was conducted in a patchwork fashion and did not result in an enterprise-wide risk analysis, as required by the HIPAA Security Rule.

SJH Settlement Agreement Highlights

Under the settlement agreement with SJH that OCR announced on October 18, 2016, SJH must pay a $2,140,500 settlement payment and adopt a comprehensive corrective action plan which among other things, requires SJH to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures. SJH’s Chief Executive Officer, Annette M. Walker, is named in the Corrective Action Plan as the SJH authorized representative and contact person responsible for overseeing the CAP implementation.

Among other things, the Corrective Action Plan specifically requires that SJH:

Within 240 days, conduct an enterprise-wide analysis and provide a report to OCR which includes a complete inventory of all electronic equipment, data systems, and applications that contain or store ePHI, and prepare and deliver to OCR for review an enterprise-wide risk analysis that identifies all security risks and vulnerabilities that incorporates all electronic equipment, data systems, and applications controlled, administered, or owned by SJH, its workforce members, and affiliated staff that contains, stores, transmits, or receives electronic protected health information (ePHJ);
Revise this risk analysis plan as directed by OCR based on its review of the presented risk analysis;
Develop and implement to the satisfaction of OCR an organization-wide risk management plan to address and mitigate any security risks and vulnerabilities identified in the risk analysis;
Distribute the risk management plan as finally approved by OCR to to workforce members involved with implementation of the plan within 30 days of OCR approval;
Revise to OCR’s satisfaction, adopt and implement within 30 days of OCR’s approval compliant HIPAA policies and procedures;
Prepare for review of OCR training materials and once approved by OCR, provide initial training to required workforce members, and obtain certification of completion of that training from each required workforce member within 60 days of OCR’s approval of the training and thereafter at least annually as long as the Corrective Action Plan remains in force;
Promptly conduct a documented investigation of any information indicating a potential workforce member violation of the new HIPAA policies in the manner required by OCR and if the investigation confirms a violation (Reportable Event), notify OCR of the relevant facts, findings, corrective actions and sanctions imposed against the violating workforce member in the manner required by the Corrective Action Plan;
Submit annual report to OCR signed and attested to by an SJH officer, which contains the information and attestations of compliance with the requirements of the Corrective Action Plan in accordance with the Corrective Action Plan;
Retain for inspection and copying and provide to OCR upon request all documents and records relating to compliance with this Corrective Action Plan for six (6) years from the Effective Date of the SJH Settlement Agreement.

Take Away For Other Covered Entities & Business Associates

To help safeguard their own organizations against potential sanctions from OCR and other HIPAA enforcement risks, Covered Entities and their business associates should ensure that their organization possesses a well-documented current enterprise-wide risk assessment, as well as has in place and is administering as necessary to maintain the currency and adequacy of its risk assessment strong practices for conducting documented evaluations of their own HIPAA security, policies, practices, audits and investigations and other procedures necessary to comply with HIPAA, taking into account recent OCR guidance, its initiation of its Phase II audit program, the insights offered by the SJH and other OCR’s ever growing list of enforcement actions and compliance tools, as well as changes in systems, documentation, software, equipment or other occurrences within the operations of the Covered Entity or business associate’s operations that could impact the currency and adequacy of its risk assessment or otherwise raise compliance risks..

A series of recent OCR Resolution Agreements emphasizing the need for Covered Entities and their Business Associates to verify that have in place, and review and update as necessary business associate agreements e.g .HIPAA Settlement Illustrates The Importance Of Reviewing And Updating, As Necessary, Business Associate Agreements (September 23, 2016); Business Associate’s Failure to Safeguard Nursing Home Residents’ PHI Leads to $650,000 HIPAA Settlement (June 29, 2016)
Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option Up to $6.50 is Not a Cap on All Fees for Copies of PHI (May 23, 2016)
Guidance On HIPAA & Cloud Computing released October 6, 2016, which provides guidance for Covered Entities and business associates about contracting and other procedures that HIPAA-regulated Covered Entities and their business associates should implement when contracting for and using Cloud Computing Services;
Joint Guidance published October 21, 2016 by the Federal Trade Commission and OCR reminding Covered Entities and their business associates of the need to ensure that in addition to fulfilling the technical content requirements of HIPAA, their HIPAA authorizations, privacy practices notices and other HIPAA notices and communications are written and presented in plan language, include required specific terms and descriptions and in a manner that does not mislead individuals about their rights or about what is happening with their PHI. Furthermore, where Covered Entities and their business associates contemplate that businesses associates may request that individuals sign HIPAA authorizations, Covered Entities and their business associates should the Covered Entity and business associate have in place a current, signed HIPAA-compliant business associate agreement that that expressly authorizes the business associate to request the HIPAA authorization in light of statements in the Joint Guidance indicating that OCR views the Privacy Rules as prohibiting a business associate from asking a consumer to sign a HIPAA authorization unless its business associate contract expressly permits the business associate to do so; and
Other OCR enforcement actions, tools and guidance. See, e.g. All Covered Entities Should Learn Lessons From Mississippi Medical Center’s $2.75 Million HIPAA Resolution Agreement; Providers, Health Plans Should Confirm Copy Charges Comply With New OCR HIPAA Guidance; $2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use; Addressing Gaps in Cybersecurity: OCR Releases Crosswalk Between HIPAA Security Rule and NIST Cybersecurity Framework; HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework.

As breaches of PHI and other violations of HIPAA also frequently give rise to responsibilities or risks under a broad range of other federal and state laws medical and financial privacy and data security, Medicare and other terms of federal program participation, medical credentialing, licensure and ethics, insurance and Employee Retirement Income Security Act fiduciary responsibilities in the case of health plans, contractual, tort and other exposures, Covered Entities and their business associates also generally are best served to take into account these other responsibilities and exposures in conjunction with the design and administration of their HIPAA compliance and risk management policies and practices.

About The Author

Cynthia Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely recognized for her extensive work and pragmatic thought leadership, experience, publications and training on HIPAA and other privacy, medical records and data and other health care and health plan concerns.

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble and as among the “Best Lawyers In Dallas” in employee benefits by D Magazine; Ms. Stamer has more than 28 years of extensive proven, pragmatic knowledge and experience representing and advising health industry clients and others on operational, regulatory and other compliance, risk management, product and process development, public policy and other key concerns.

As a core component of her work as the Managing Shareholder of Cynthia Marcotte Stamer, PC, Ms. Stamer has worked extensively throughout her career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Ambulatory care, ARRA, Civil Rights, Conditions of Participation, Corporate Compliance, data breach, data security, DME, Doctor, drug treatment, Durable Medical Equipment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employee Benefits, FACTA, Federal Health Center, Federal Sentencing Guidelines, Genetic Information, GINA, Health Care, Health Care Provider, Health IT, Health Plan, Health Plans, Health Policy, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, Indian Health, Laws, managed care, Meaningful Use, Medical Malpractice, Medical Privacy, Medical Records, Medicare Advantage, Mental Health, Mental Heatlh, Outcomes Data, Pharmaceudical, Pharmacy, Privacy, Psychiatric, Public Policy, Uncategorized, Wellness | Tagged: HIPAA, Meaningful Use, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Healthcare Fraud Exposures Significant & Rising For Owners, Execs & Other Leaders

October 17, 2016

Owners, operators, and leaders of health care organizations face an ever-growing imperative to lock down compliance by the organization and its employees and agents both to protect their organizations and its investors and themselves personally against the criminal, civil and administrative sanctions that result when health care organizations or their people break the rules.

The Departmnet of Health and Human Services Office of Inspector General (OIG) and the Department of Justice (DOJ) increasingly are going after owners, operators and other leaders of healthcare organizations for participating in, failing to act to prevent or inadequately investigating and redressing fraud or other illegal conduct in their organizations or by members of their organization’s team. Leaders and owners need to learn the rules and what to do to manage their risk. Owners and leaders must get informed about their expectations and exposures and learn and take the right steps to adopt compliance plans, monitor and enforce compliance, investigate and redress concerns and deal with these responsibilities and risk

The latest slew of federal health care fraud prosecutions reported by DOJ and OIG during the first two weeks of October illustrate some of the risks owners and executives face when they, their organization or employees or agents violate these rules. DOJ and federal regulators like OIG have made clear that they construe these rules to require leaders both to abstain from violating these laws and to adopt and administer effective compliance plans, oversight and other actions to train and prevent their employees and agents from violating these rules. See, e.g., Practical Guidance for Health Care Governing Boards on Compliance Oversight.

Of course, owners and management leaders inevitably face significant financial loss and other fallout if their organizations or members of their teams are found to have violated federal or state health care fraud laws. Over the past decade, however, owners and leaders increasingly also face growing risks of personal prosecution when their organization or someone on their team breaks the rules.

Owners, executives or other leaders who may be tempted to underesktimate the significance of these warnings should note DOJ’s increasingly aggressive and heavy handed prosecution of owners, executives and other leaders who either directly participate in, or by failing to adopt or administer meaningful compliance and investigation practices, are perceived to have allowed, encouraged or facilitated employees or agents to engage in actions hat DOJ, OIG or other federal regulators consider fraudulent.

DOJ’s growing emphasis on holding health care executives accountable for health care fraud or other violations of federal health care and other laws is clearly reflected in the prosecutions and convictions it announced during the first two weeks of October clearly demonstrate the critical need for health care organization owners, officers and other leaders (executives) to safeguard themselves personally, as well as their organizations against becoming targeted or convicted of health care fraud or other violations of federal health care laws by ensuring their organization adopts and administers effective compliance programs and taking other meaningful, well-documented steps , efforts to ensure the effectiveness of these compliance efforts.

Federal criminal and civil health care fraud laws both prohibit owners, operators and executives from participating in or conspiring to violate federal anti-kickback, anti-referral, false claims and other health care fraud laws, as well as provide various mechanisms that impose liability against owners and executives that fail to adopt and administer appropriate compliance, audit and other oversight and enforcement processes and procedures. Since October 1, 2016, for instance, DOJ has announced the following healthcare charges, convictions and settlements involving owners and executives.

On October 4, 2016, a federal judge sentenced Bassem Kuran, the President and owner of Pennsylvania based a VIP Ambulance, Inc 10 months imprisonment followed by three years of supervised release, plus ordered him to pay $66,901.93 in restitution for making false statements to Medicare. See Ambulance Company Owner Sentenced To 10 Months In Prison;
On October 5, 2016, DOJ four California residents that operated Louisiana based Care Concepts, LLC, and California based Choice Home Medical Equipment and Supplies (Choice), Geoffrey and Marla Ricketts and Samuel and Sunyup Kim, are awaiting sentences of up to 10 years in prison, $250,000 fines, restitution liabilities, and three years’ supervised release for their health care fraud convictions relating to a $38 million fraud scheme centering around the distribution of “talking glucose meters” not medically needed and often not even requested. Four Californians Plead Guilty to Conspiracy to Commit Health Care Fraud;
On October 6, 2016, the owner of a medical supply company was sentenced to 60 months in prison for his role in a scheme that fraudulently billed more than $4 million to Medicare. Owner of Los Angeles Medical Supply Company Sentenced to 60 Months in Prison for Multimillion-Dollar Medicare Fraud Scheme;
On October 6, 2016. United States Attorney for the Western District of Missouri Tammy Dickinson and Missouri Attorney General Chris Koster announced the sentencing for federal health care fraud of a Springfield, Mo. man who operated four Family Medical Center clinics in southern Missouri. See Springfield Man Sentenced for Fraud Scheme to Overcharge Medicaid, Medicare at Four Clinics;
On October 6, 2016, DOJ announced the sentencing in federal court of the Los Angeles owner of a medical supply company to 5 years in prison for his role in a scheme that fraudulently billed more than $4 million to Medicare. See Owner of Los Angeles Medical Supply Company Sentenced to 60 Months in Prison for Multimillion-Dollar Medicare Fraud Scheme;
On October 7, 2016, a Tampa, Florida home health agency owner was convicted by a federal jury for her participation in a multimillion-dollar health care fraud and money laundering scheme. Owner of Florida Home Health Agency Convicted in Multimillion-Dollar Health Care Fraud Scheme;
On October 12, 2016, U.S. Attorney Josh J. Minkler announced the indictment of former Chief Executive Officer James Burkhart, former Indiana nursing home chain American Senior Communities (ASC) Chief Operating Officer Daniel Benson, for their alleged roles in a vast fraud, kickback, and money laundering scheme involving ASC. Former American Senior Communities executives indicted;
On October 13, 2016, the U.S. Attorney in Massachusetts announced the agreement of Haverhill-based skilled nursing facility operator Whittier Health Network, Inc., and its Director of Long Term Care, Leo Curtin, to pay $2.5 million to resolve allegations concerning inflated Medicare claims. See Nursing Home Operator and Director of Long Term Care to Pay $2.5 Million to Settle False Claims for Rehabilitation Therapy. See Nursing Home Operator and Director of Long Term Care to Pay $2.5 Million to Settle False Claims for Rehabilitation Therapy; and
On October 14, 2016, a federal district judge in the Northern District of Alabama sentenced the former chief executive of two non-profit health clinics for the poor and homeless to 18 years in prison for funneling millions in federal grant money to private companies he formed to contract with the clinics. See Former Non-Profit Health Clinics CEO Sentenced to 18 Years for Funneling Millions in Grant Money to Private Companies.

Of course, the costs and liabilities of federal criminal or civil investigations and prosecutions are only part of the challenges an organization and its leaders generally face when their healthcare organization or its actions are questioned under federal health care fraud or other laws. Whistleblower or other claims of employees and agents claiming to have been penalized for questioning practices, shareholder or other investor lawsuits, federal program disqualification, loss of position or reputation, the financial and other burdens of responding to and defending investigations and charges and a parade of other horribles that typically attend investigations and prosecutions also often exact a heavy toll on health care organization owners and leaders caught up in federal fraud investigations or prosecutions.

In the face of these growing risks, healthcare owners, executives and other leaders need a clear and up to date understanding of health care fraud laws and the obligations and expectations that these rules create not only for their organizations, but also increasingly them personally. Owners and other leaders need to understand the health care fraud rules, the ways that liability can attach not only to their organization but also themselves and their leaders under these rules, the burdens of proof and assumptions that create special challenges in responding to challenges or defending charges and actions and strategies they should take before, during, and after compliance issue or prosecution arises to strengthen their ability to defend or mitigate their and their organization’s liability exposures. As part of these efforts, owners and leaders not only should ensure that their organization adopt, train staff and others on and meaningfully administer up-to-date compliance programs in a manner that clearly documents the commitment of their organization and its leaders to compliance. Owners, executives and leaders also should become educated about the expectations of DOJ, HHS and other agencies and whistleblowers are likely to expect concerning their role and actions as owners and leaders both in establishing a clear expectation of compliance, as well as adopting, overseeing and enforcing practices and policies to maintain compliance, investigate and redress potential wrongdoing and otherwise maintain the compliance and culture expected and required under federal law. Owners and leaders should ensure that they and others in their organization are trained to recognize potential compliance issues, understand the steps they and their organization need to take when a potential compliance concern arises, and how to conduct and document investigations and other actions to strengthen their and their organization’s ability to defend against potential charges or other claims..

Owners, executives and other leaders also should anticipate, and prepare in advance for the likelihood that they and their organizations will need to respond investigations, suspected violations, whistleblower claims and other events that could create substantial exposure for their organizations and themselves personally. Leaders need to understand that the nature and risks associated with these potential health care fraud liabilities may make ill-advised commonly used settlement or other practices for resolving quickly disputes or other concerns. Owners and leaders bearing these responsibilities should seek specific advice and training about their responsibilities, as well as recommended strategies for investigating and responding to concerns that may carry or give rise to these risks. Most leaders also will want to ensure that their employment, shareholder and other agreements include sufficient flexibility and protections to protect the executive or other leader for termination, retaliation or other loss or injury for taking appropriate steps to investigate and respond to a compliance concern as well as plan in advance by arranging for their organization to provide indemnification, insurance or other coverage, and/or securing personally coverage to provide coverage needed to fund what often may be substantial legal fees arising out of investigation and defense of investigations, charges, or other actions and the corporate, employment and other fallout that often accompanies such events.

About The Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

Ms. Stamer’s health industry experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

Ms. Stamer also is known for her experience in HIPAA and other privacy and data security and breach concerns. The scribe for ABA JCEB annual agency meeting with OCR for many years, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Leave a Comment » | Academic medicine, Affordable Care Act, Anti-KickBack, ASC, Clinical pathway, Conditions of Participation, Controlled Substances, Corporate Compliance, data breach, Disease Management, DME, Doctor, E-Prescribing, Electronic Medical Records, Employer, Evidence Based Medicine, false claims act, Federal Health Center, Federal Sentencing Guidelines, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, Health Policy, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, hospitals, managed care, Medicaid, Medical Records, Medicare, Medicare Advantage, Medicare Fee Schedule, Money Laundering, Pharmaceudical, Pharmacy, Prospective Payment, Psychiatric, Public Policy, substance abuse treatment, Tax, Uncategorized | Tagged: Board Governance, Compliance, Directors and Officers, false claims act, Federal Sentencing Guidelines, Health Care Fraud, internal controls, Risk Management, STARK | Permalink
Posted by Cynthia Marcotte Stamer

New Rule Gives ONC More Power Over Electronic Health Record Providers

October 16, 2016

The Office of the National Coordinator for Health IT (ONC) will have more oversight over certifying electronic health records and other technologies that store, share and analyze health information for consumers and the authority to ask developers to pull noncompliant products from the market under a new Final Rule scheduled for official publication in the Federal Register on October 19, 2016. The Final Rule will give ONC power to decertify health IT products and issue a cease-and-desist notice to prevent the future sale or marketing of products that don’t comply with regulations or found to pose a risk to public health or safety. Developers of decertified products also would have to notify affected customers and providers who purchased the products.

About The Author
Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here..
About Solutions Law Press Inc.™

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates available here.

For important information about this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Academic medicine, Accreditation, ASC, Clinical pathway, data breach, data security, DME, Doctor, E-Prescribing, Electronic Health Records, Electronic Medical Records, Federal Health Center, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, Health IT, HIPAA, Home Health, Hospice, Hospital, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medical Records, Medicare Fee Schedule, Medicare Fee Schedule, Physician, Reimbursement, Rural Health Care, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

CMS Publishes Final MACRA Rule

October 14, 2016

The Centers for Medicare and Medicaid Services (CMS) has released the 2398 page final rule implementing the Medicare Access & CHIP Reauthorization Act of 2105 (MACRA) reforms that Congress has adopted to replace the Sustainable Growth Rate (SGR) rules for determining physician and other clinician payments under Medicare with the new MACRA Quality Payment Program.

Despite widespread criticism by many physicians and clinicians about the MACRA reforms generally and the proposed regulations implemented in the final rules released today, CMS says the final rule establishes the primary regulatory structure to implement the MACRA reforms in a manner that will replace the current “flawed SGR payment system” with a “Quality Payment Program,” equip clinicians with the tools and flexibility to provide high-quality, and flexibility to provide high-quality, patient-centered care.

The sweeping final rule sets the 2017 performance period as a transition year for the 2019 Merit-Based Incentive Payment System payment year. Ultimately, however, physicians and other clinicians will need to choose between one of two options are having their compensation from Medicare determined under the new Quality Payment Program based on their evaluation of which program best fits their needs based on a thorough understanding and careful evaluation of the complex rules in the final regulations and any refinement to the rules that CMS subsequently issues:

Advanced Alternative Payment Models (APMs) or
The Merit-based Incentive Payment System (MIPS)

If a Clinician decides to participate in an Advanced APM, through Medicare Part B he or she may earn an incentive payment for participating in an innovative payment model.

If the clinician decides to participate in traditional Medicare Part B, then he will participate in MIPS where he earns a performance-based payment adjustment.

In order to position themselves to timely respond to the impending changes, conduct the evaluations necessary to determine which approach is likely to best fit their interests and timely act to submit the data, make elections, implement processes and complete other steps to prepare for and timely comply with the final rule, physicians, clinicians and others impacted by these rules must begin as soon as possible to carefully and systematically become educated about the provisions and terms of the final rule, to modify their processes and procedures to capture the data and administer the billing, coding and other functions necessary to evaluate options, timely submit data and make elections and come into compliance with the requirements of the final rules as they take effect while at the same time positioning themselves to adapt these arrangements in response to additional guidance that CMS and other anticipate will be forthcoming as CMS moves forward to full implementation of MACRA.

Solutions Law Press, Inc. is working to prepare additional summaries and other updates exploring certain key details of the lengthy and highly technical provisions of the final rules, as well as monitoring developments that might impact these rules. Stay tuned here for more details.

About The Author

Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Leave a Comment » | Academic medicine, Affordable Care Act, Ambulatory care, Anti-KickBack, ASC, billing, Centers For Disease Control, Clinical pathway, Conditions of Participation, Corporate Compliance, DME, Doctor, Durable Medical Equipment, false claims act, Federal Health Center, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, health care reimbursement, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Medicaid, Medicare, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Tenet To Pay $513M For Anti-kickback Law Guilty Plea

October 3, 2016

Tenet Healthcare Corp. and two of its hospitals will pay $513 million and enter guilty pleas to resolve criminal charges and civil claims the hospitals illegally paid kickbacks for patient referrals, the U.S. Department of Justice Announce on Monday, October 2, 2016.

Atlanta Medical Center Inc. and North Fulton Medical Center Inc. were charged October 2 in a criminal information in federal court in Atlanta with conspiracy to defraud the United States by obstructing the lawful government functions of the Department of Health & Human Services (HHS) and to violate the Antikickback Statute (AKS), which, among other things, prohibits payments to induce the referral of patients for services paid for by federal health care programs.

Tenet HealthSystem Medical Inc. and its subsidiaries (collectively THSM) entered into a non-prosecution agreement (NPA) with the Criminal Division’s Fraud Section and the U.S. Attorney’s Office of the Northern District of Georgia related to the charges in the criminal information. THSM is the parent company of Atlanta Medical Center Inc., North Fulton Medical Center Inc., Spalding Regional Medical Center Inc. and Hilton Head Hospital, and employed their executives. THSM is a subsidiary of Tenet Healthcare Corporation. Under the terms of the NPA, THSM and Tenet will avoid prosecution if they, among other requirements, cooperate with the government’s ongoing investigation and enhance their compliance and ethics program and internal controls. Tenet has also agreed to retain an independent compliance monitor to address and reduce the risk of any recurrence of violations of the AKS by any entity owned in whole, or in part, by Tenet. The term of THSM’s and Tenet’s obligations under the NPA is three years, but the NPA may be extended for up to one year. the plea deal announced, the two Tenet subsidiaries have agreed to plead guilty to the charges alleged in the criminal information and will forfeit over $145 million to the United States – which represents the amount paid to Atlanta Medical Center Inc. and North Fulton Medical Center Inc. by the Medicare and Georgia Medicaid programs for services provided to patients referred as part of the scheme.

In the concurrently announced civil settlement, Tenet agreed to pay $368 million to the federal government, the state of Georgia and the state of South Carolina to resolve claims asserted in United States ex rel. Williams v. Health Mgmt. Assocs., Tenet Healthcare, et al., a lawsuit filed by Ralph D. Williams, a Georgia resident, in the Middle District of Georgia, under the federal and Georgia False Claims Acts. The acts permit whistleblowers to file suit for false claims against the government entities and to share in any recovery. The federal share of the civil settlement is $244,227,535.30, the state of Georgia will recover $122,880,339.70 and the state of South Carolina will recover $892,125. Mr. Williams’ share of the combined civil settlement amount is approximately $84.43 million.

The Tenet investigations, enforcement actions and settlement demonstrate the continuing criminal and civil risks that health care organizations, individual providers and their employees and representatives run when engaging in aggressive marketing, billing or other practices under the Anti-kickback or other Federal health care fraud laws, as well as the role that employee and other whistleblowers with inside information often play in bringing actions and behaviors that provide the basis for prosecution of these and other charges or claims against healthcare organization and the health care providers, management and other individuals participating in or responsible for managing conduct to comply with these rules.

Health care organizations, their management, providers, and others participating in the planning, administration or oversight of transactions or other activities that could become subject to scrutiny or prosecution under these and other Federal or state healthcare laws should act proactively to manage their risks by using care to adopt and administer documented effective compliance plans and processes that prevent involvement in prohibited actions, to periodically conduct documented audits and other oversight to maintain demonstrated efforts to ensure their organizations and actions in operations comply with these requirements, continuously remain on the alert for and monitor transactions and arrangements in which they are involved for signs of potential violations or other risky conduct, to take prompt, well-documented corrective action to investigate and address as appropriate potential concerns including but not limited to the monitoring and investigation of employee complaints, performance, termination and other events for evidence of potential whistleblower or other concerns.

About The Author

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Leave a Comment » | Ambulatory care, Anti-KickBack, ASC, billing, Corporate Compliance, Doctor, Employer, Federal Sentencing Guidelines, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Policy, Hospital, hospitals, Medicaid, Medicare, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Providers, Health Plans Should Confirm Copy Charges Comply With New OCR HIPAA Guidance

May 26, 2016

Healthcare providers, health plans, healthcare clearinghouses (Covered Entities) and their business associates should verify that their copying charges and other policies and practices for responding to requests of individuals for copies and other access to protected health information (PHI) comply with the Privacy and Security Rules (Privacy Rule) of the Health Insurance Portability & Accountability Act of 1996 (HIPAA) as construed in a new Frequently Asked Question (FAQ published May 24, 2016 as follow up to two other sets of guidance about HIPAA assess rights published by the Department of Health & Human Services Office of Civil Rights (OCR) since January, 2016.

New OCR Guidance Sheds New Light On HIPAA Access Rule Requirements

The OCR FAQ titled New Clarification – Up to $6.50 Flat Rate Option published May 24, 2016 is the third in a series of guidance materials OCR discussing OCR’s interpretation of individuals’ core right under HIPAA to access and obtain a copy of their PHI from Covered Entities since January, 2016 (the “Access Rule”). With OCR Enforcement Data already showing Access Rule violations among the top 5 issues in cases investigated by OCR every year since HIPAA took effect in 2003, Covered Entities can expect OCR to include Access Rule violations among the Privacy Rule violations OCR likely will target as it continues to ramp up its HIPAA audit, investigation and enforcement efforts.

As part of its sweeping requirements concerning the use, access, protection and disclosure of PHI, the Access Rule provisions of the Privacy Rule generally require Covered Entities to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the Covered Entity or its business associate. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the Covered Entity to transmit a copy to a designated person or entity of the individual’s choice as long as the Covered Entity or a business associate on its behalf maintains the PHI, regardless of the date the information was created; whether the information is maintained in paper or electronic systems onsite, remotely, or is archived; or where the PHI originated (e.g., whether the Covered Entity, another provider, the patient, etc.).

With its publication of the New Clarification FAQ on May 24, 2016, OCR now has published three pieces of guidance (the Access Guidance) about its interpretation of the Access Rule since January, 2016 that it hopes will promote greater understanding of and compliance with the Access Rule by Covered Entities:

In January, OCR published a comprehensive Fact Sheet (Fact Sheet) and the first in a series of topical frequently asked questions (FAQs) addressing patients’ right to access their medical records, which set forth requirements providers must follow in sharing medical records with patients, including that they must do so in a timely manner and in a format that works for the patient;
On March 1, OCR published a second set of FAQs accessible here addressing when Covered Entities may charge individuals to provide requested copies of their PHI, how Covered Entities must calculate these fees, when Covered Entities must send an individual’s PHI to a third party designated by the individual in its request for copies, and other issues relating to access rights guaranteed by the Privacy Rule; and
On May 24, 2016 OCR clarified this prior Access Guidance by publishing another FAQ titled New Clarification – Up to $6.50 Flat Rate Option .

Collectively, the Access Guidance addresses a broad range of questions and issues about the responsibilities of Covered Entities under the Access Rule including what PHI Covered Entities must provide as well as detailed guidance about when and how much Covered Entities can charge individuals for requested copies of their PHI or summaries of their PHI. Since the OCR Access Guidance may restrict the charge that health care providers or other Covered Entities can charge for copies or other access more than applicable state law rules, Covered Entities need to verify their practices comply with OCR’s Access Guidance in addition to any applicable state law rules. The Access Guidance makes clear that OCR expects Covered Entities and their business associates to ensure that their charges for copying or providing other access to PHI guaranteed by the Privacy Rule complies with this Access Guidance even if that practice does not violate applicable state law.

Are You Charging Too Much? Charges For Copies of PHI Must Meet OCR Privacy Rule Guidance

Concerning charges for copies of PHI requested by an individual, Privacy Rule § 164.524(c)(4) permits a Covered Entity to impose a reasonable, cost-based fee if the individual requests a copy of the PHI (or agrees to receive a summary or explanation of the information) provided that the Covered Entity properly and timely notifies the individual of the cost and properly determines the cost in accordance with OCR guidance.

Many physicians or other health care providers that use electronic health records (EHRs) certified to allow individuals to access their PHI in the system may be unaware that OCR views the availability of electronic access from the EHR affects the health care provider’s ability to charge for copies of requested PHI. OCR’s position is that the Privacy Rule prohibits a Covered Entity from charging an individual for requested copies of PHI when the request is fulfilled by the individual accessing the requested PHI using the View, Download, and Transmit functionality of the provider’s certified electronic health record.

Assuming the request for access or copies is not fulfilled through download from an HER, the Access Guidance indicates q Covered Entity must use one of three potentially applicable OCR-approved methods to calculate the fee the Covered Entity charges an individual for copies of PHI or an agreed upon summary provided that the method used takes into account only labor costs for copying or producing an agreed upon summary as defined by OCR.:

The “Actual Cost” Method;
The “Average Cost” Method; or
For electronic copies of PHI maintained electronically, the “Flat Fee” Method.

Charging a flat fee not to exceed $6.50 is an option available to those entities that do not want to go through the process of calculating actual or average costs for requests for electronic copies of PHI under either the Actual Cost or Average Cost Methods. However, by its terms, the “Flat Fee” Method is only an allowable for Covered Entities to use to avoid calculating actual or average allowable costs when a Covered Entity is providing electronic copies of PHI maintained electronically (and presumably when the access request is not fulfilled through download from an EHR). When applicable, the Flat Fee Method allows a Covered Entity to charge a flat fee for all requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage. The New Clarification – Up to $6.50 Flat Rate Option clarifies that use of the Flat Rate Method is permitted not required when a Covered Entity provides copies of PHI maintained electronically other through download directly from a certified EHR. Covered Entities that wish to charge more than the $6.50 flat rate allowed under the Flat Rate Option retain the right, if the facts and evidence warrant, to use either the Actual Cost Method or Average Cost Method to calculate the fee for providing electronic records electronically within the boundaries of what is permissible under the Privacy Rule.

Where the Flat Fee Method is inapplicable or the Covered Entity elects not to use it, the Covered Entity must use either the Actual Cost Method or the Average Cost Method to calculate the fee in accordance with OCR’s rules.

Under the “Actual Cost Method,” a Covered Entity may calculate actual labor costs to fulfill the request, as long as the labor included is only for copying (and/or creating a summary or explanation if the individual chooses to receive a summary or explanation) and the labor rates used are reasonable for such activity. The Covered Entity may add to the actual labor costs any applicable supply (e.g., paper, or CD or USB drive) or postage costs. Covered Entities that charge individuals actual costs based on each individual access request still must be prepared to inform individuals in advance of the approximate fee that may be charged for providing the individual with a copy of her PHI. An example of an actual labor cost calculation would be to time how long it takes for the workforce member of the Covered Entity (or business associate) to make and send the copy in the form and format and manner requested or agreed to by the individual and multiply the time by the reasonable hourly rate of the person copying and sending the PHI. What is reasonable for purposes of an hourly rate will vary depending on the level of skill needed to create and transmit the copy in the manner requested or agreed to by the individual (e.g., administrative level labor to make and mail a paper copy versus more technical skill needed to convert and transmit the PHI in a particular electronic format);

Under the “Average Cost” Method, in lieu of calculating labor costs individually for each request, a Covered Entity can develop a schedule of costs for labor based on average labor costs to fulfill standard types of access requests, as long as the types of labor costs included are the ones which the Privacy Rule permits to be included in a fee (e.g., labor costs for copying but not for search and retrieval) and are reasonable. Covered Entities may add to that amount any applicable supply (e.g., paper, or CD or USB drive) or postage costs. This standard rate can be calculated and charged as a per page fee only in cases where the PHI requested is maintained in paper form and the individual requests a paper copy of the PHI or asks that the paper PHI be scanned into an electronic format. However OCR’s guidance states that OCR does not consider per page fees for copies of PHI maintained electronically to be reasonable for purposes of 45 CFR 164.524(c)(4);

Whether using the Actual Cost Method or the Average Cost Method, a Covered Entity must only take into account only “reasonable labor costs associated only with the: (1) labor for copying the PHI requested by the individual, whether in paper or electronic form; and (2) labor to prepare an explanation or summary of the PHI, if the individual in advance both chooses to receive an explanation or summary and agrees to the fee that may be charged.

OCR’s guidance makes clear that the reasonability of the charges for labor must reflect the technology available for providing this access. In this respect, OCR’s guidance states that a Covered Entity cannot charge a fee under HIPAA for individuals to access the PHI from a health care provider’s EHR technology that has been certified as being capable of making the PHI accessible. OCR’s position is that where a Covered Entity fulfills an individual’s HIPAA access request by allowing the individual to access the requested PHI using the View, Download, and Transmit functionality of the provider’s certified electronic health record (CEHRT), an individual requests or agrees to access her PHI available through the View, Download, and Transmit functionality of the CEHRT, there are no labor costs and no costs for supplies to enable such access.

To the extent that access is not provided through an CEHRT, the fee a Covered Entity charges an individual to provide copies of requested PHI or an agreed upon summary may include only the cost of:

Copying the PHI; and
Preparation of an explanation or summary of the PHI, if agreed to by the individual.

As interpreted by OCR, labor for copying includes only labor for creating and delivering the electronic or paper copy in the form and format requested or agreed upon by the individual, once the PHI that is responsive to the request has been identified, retrieved or collected, compiled and/or collated, and is ready to be copied. For example, labor for copying may include labor associated with the following, as necessary to copy and deliver the PHI in the form and format and manner requested or agreed to by the individual:

Labor for copying the PHI requested by the individual, whether in paper or electronic form;

Supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media;
Postage, when the individual requests that the copy, or the summary or explanation, be mailed; and
Creating and executing a mailing or e-mail with the responsive PHI.

See 45 CFR 164.524(c)(4).

The Access Guidance states the fee may not include costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; outsourcing the function of responding to individual requests for PHI copies or other costs not listed above even if such costs are authorized by State law. See 45 CFR 164.524(c)(4).

Of course, in any case, OCR’s guidance makes clear that regardless of how a entity chooses to calculate its fee to copy PHI, the Privacy Rule requires that the Covered Entity inform the requesting individual in advance of the approximate fee that may be charged for providing the copy requested and otherwise comply with the Privacy Rule as interpreted by OCR’s latest guidance concerning providing individuals access to PHI and other requirements.

Documented, Timely Action Needed To Mitigate OCR Audit, Investigation & Enforcement Risks

Beyond operationally complying with the Access Guidance, Covered Entities and their business associates generally will want to update their policies, practices and training to position themselves to defend their calculation of any charges made for copies provided in response to a request for access protected by the Privacy Rule and other compliance with the requirements of that rule and the otherwise applicable provisions of HIPAA as well as include monitoring and enforcement of these requirements as part of their ongoing HIPAA compliance efforts.

These and other HIPAA compliance efforts are particularly critical in light of the expanding audit, investigation and enforcement activities of OCR under the Privacy Rule. OCR’s publication of the Access Guidance coincides with a surge in OCR’s HIPAA audit, investigation and enforcement activities.

OCR’s publication of the new Access Guidance comes as OCR is ramping up its interpretation, oversight and enforcement of HIPAA generally. See, Brace For OCR HIPAA Audits & Enforcement; Update Privacy Practices For New OCR HIPAA Enforcement, Security & Records Access Guidance. While continuing to offer guidance like the Access Guidance and other tools to encourage and help Covered Entities and their business to understand and comply with the Privacy Rule, OCR also increasingly now uses the expanded penalties and authority created by the HITECH Act to punish Covered Entities for violating Privacy Rule requirements. HITECH Act amendments, among other things, broadened the duties of OCR to audit, investigate and sanction HIPAA violations as well as tightened various requirements of the Privacy Rules.

The risks to Covered Entities from violating the Privacy Rules are significant and growing. Since the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) amended HIPAA, Covered Entities and their business associates face heightened risks that violations of HIPAA will trigger liability to pay a Civil Monetary Penalty (CMP) to OCR or other sanctions. The two, multimillion dollar CMPs now imposed by OCR against two different Covered Entities caught violating the Privacy Rules only reflect a small part of OCR’s CMP enforcement. Equally or perhaps more significant are the growing stream of high dollar settlement payments that an ever-growing list of Covered Entities to resolve OCR Privacy Rule violation charges that otherwise also might result in OCR’s assessment of a CMP against them. See, e.g. $2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use; Provider Pays $750K To Settle HIPAA Business Associate Rule Breach Charges; North Memorial Hit With $3.9M HIPAA Fine For HIPAA Violations; OCR’s 2nd-Ever HIPAA CMP Nails Lincare For $239,000; Lehey Pays $850K After Unencrypted Laptop Stolen.

These already substantial enforcement risks are likely to rise as OCR begins auditing the compliance of selected Covered Entities as part of its recently announced 2016 audit program. As a result of audit requirements enacted as part of the HITECH Act, Covered Entities now need to be prepared to demonstrate the adequacy of their HIPAA compliance in case their organization becomes targeted for audit under OCR’s 2016 audit program. Even if not selected for audit, however, Covered Entities and their business associates still face the risk that a complaint filed with OCR will trigger an OCR investigation of their practices for providing copies or other access or other compliance with the Privacy Rules. In light of the growing aggressiveness of OCR’s enforcement, Covered Entities and their business associates need to be prepared to demonstrate their efforts to comply. Those that cannot show adequate compliance efforts should be prepared for potentially substantial CMP or Resolution Agreement payments and other sanctions. Consequently, Covered Entities and their business associates should move quickly to review and update their practices, communications and training to comply with this new Access Guidance as well as other guidance, enforcement and other developments that might impact the adequacy of their existing practices under the Privacy Rule generally. Because of the risk that any review or investigation of the adequacy of its practices or complaints under the Privacy Rule will involve sensitive information or analysis, Covered Entities and their business associates are cautioned to consider the advisability of arranging for this analysis and review to be conducted within the scope of attorney-client privilege under the guidance of legal counsel experienced with the Privacy Rules and other related legal concerns.

About The Author

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble and as among the “Best Lawyers In Dallas” in employee benefits 2015 by D Magazine; Ms. Stamer has more than 28 years of extensive proven, pragmatic knowledge and experience representing and advising health industry clients and others on operational, regulatory and other compliance, risk management, product and process development, public policy and other key concerns.

As a core component of her work as the Managing Shareholder of Cynthia Marcotte Stamer, PC, Ms. Stamer has worked extensively throughout her nearly 30 year career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

Beyond her extensive involvement advising and defending clients on these matters, Ms. Stamer also has served for several years as the scrivener for the ABA JCEB’s meeting with OCR for many years. She returns as Chair of the Southern California ISSA Health Care Privacy & Security Summit for the third year in 2016, as well as speaks and serves on the steering committee of a multitude of other programs.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE; Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Counsel, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients, on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see www.CynthiaStamer.com, email Ms. Stamer cstamer@solutionslawyer.net or telephone her at (469) 767-8872.

About Solutions Law Press, Inc.™

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here. ©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved.

1 Comment | Electronic Health Records, Electronic Medical Records, Health Care, Health care coding, Health Care Provider, Health Care Quality, health care reimbursement, HIPAA, Hospital, Hospital, hospitals, Meaningful Use, Medical Privacy, Medical Records, Physician, Physician Licensing, Privacy, Rural Health Care, Uncategorized, Veterans Health Care | Tagged: Data Security, Electronic Health Records, EMR, Health Care, Health Plan, HIPAA, Hospital, Meaningful Use, Medical Records, Privacy, Privacy Rule | Permalink
Posted by Cynthia Marcotte Stamer

$2 Million+ HIPAA Settlement, FAQ Warn Providers Protect PHI From Media, Other Recording Or Use

April 26, 2016

Unauthorized Filming for “NY Med” Results in $2.2 Million Settlement with New York Presbyterian Hospital; New FAQ Details Requirements When Dealing With Media

Physicians, hospitals and other health care providers, health plans and health care clearinghouses (Covered Entities) and their business associates should review and tighten policies for allowing members of the media and even other staff, patients or visitors in their facilities not involved in patient care to film, photograph or otherwise observe a patient without that patient’s authorization in light of the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) just announced $2.2 million Health Insurance Portability and Accountability Act Privacy and Security Rules (HIPAA) Resolution Agreement and Corrective Action Plan (Resolution Agreement) with New York Presbyterian Hospital (NYP) for allowing unauthorized filming and photographing of patients in its facility and concurrently released new OCR guidance about the duty of Covered Entities and business associates under HIPAA to prevent unauthorized photography or filming of patients and new concurrently published guidance on HIPAA’s implications on Covered Entities’ duties when dealing with the media.

Settlements Show Duty To Control Media & Other Recording, Use Or Access To PHI

The NYP Resolution Agreement resolves charges arising from an OCR investigation of a complaint that on April 28, 2011, NYP violated HIPAA by impermissibly disclosing patients’ PHI to a film crew and other staff of “NY Med,” a television program being filmed in the hospital. According to the Resolution Agreement, OCR’s investigation revealed that NYP “blatantly” violated HIPAA when it allowed ABC film crews and staff virtually unfettered access to its health care facility. OCR says the access NYP allowed ABC effectively created an environment where patients PHI could not be protected from impermissible disclosure to the ABC film crew and staff filming the episode. While the Resolution Agreement reflects allowing the filming and other access to ABC without prior HIPAA-compliant authorization from patients in the facility itself violated HIPAA, OCR also particularly found “egregious” the facility allowing ABC film crews and staff to film a dying patient and another patient in significant distress without first obtaining a HIPAA-compliant authorization from each of those patients and even more so that NYP failed stop the filming even after a medical professional urged the crew to stop.

Based on its investigation, OCR charged NYP with violating 45 C.F.R. §§ 164.502(a) and 164.530(c) by:

Impermissibly disclosing the PHI of two identified patients to the film crew and other staff of “NY Med”; and
Failing appropriately and reasonably to safeguard its patients’ PHI from disclosure during the filming of “NY Med” on its premises; and
Failing to implement policies, procedures and practices to protect the privacy of its filming of aforementioned television show.

OCR made clear that it intends other Covered Entities to learn by example from the NYP experience in its April 21, 2016 announcement of the Resolution Agreement when it quotes OCR Director Jocelyn Samuels as stating, “This case sends an important message that OCR will not permit covered entities to compromise their patients’ privacy by allowing news or television crews to film the patients without their authorization.”

Control Unauthorized Filming, Photography Of Patients By Media, Others

OCR reinforced its clear message about the responsibility of Covered Entities and business associates under HIPAA to protect PHI against unauthorized disclosure to the media in the NYP Resolution Agreement and its announcement by concurrently publishing a new Frequently Asked Question available here that specifically discusses dealings with the media.

Among other things, the Media FAQ expressly states that except in very limited circumstances identified in the Media FAQ, HIPAA prohibits health care providers from inviting or allowing media personnel into treatment or other areas where patients or patient PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise making PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media except in a very limited set of circumstances set forth in the Media FAQ.

The Media FAQ also states, “It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients (using techniques such as blurring, pixelation, or voice alteration software) for whom an authorization was not obtained, because the HIPAA Privacy Rule does not allow media access to the patients’ PHI, absent an authorization, in the first place.

In addition, the Media FAQ states that a health care provider also must ensure that reasonable safeguards are in place to protect against impermissible disclosures or to limit incidental disclosures of other PHI that may be in the area but for which an authorization has not been obtained.

Concerning the limited circumstances when a health care provider or other Covered Entity or business associate may disclose to the media or allow unconsented filming, photographing or use of PHI to the media or other film crews, the Media FAQ also clarifies that the HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public like public waiting areas or areas where the public enters or exits the facility.

In addition, the Media FAQ states a health care provider or other Covered Entity may:

Disclose limited PHI about the incapacitated patient to the media in accordance with the requirements of 45 C.F.R. 164.510(b)(1)(ii) when, in the hospital’s professional judgment, doing so is in the patient’s best interest; or
Disclose a patient’s location in the facility and condition in general terms that do not communicate specific medical information about the individual to any person, including the media, without obtaining a HIPAA authorization where the individual has not objected to his information being included in the facility directory, and the media representative or other person asks for the individual by name as specified in 45 C.F.R. 164.510(a).

The Media FAQ also discusses circumstances where a healthcare provider or other Covered Entity may use the services of a contract film crew to produce training videos or public relations materials on the provider’s behalf if the provider ensures that the film crew acting as a business associate enters into a HIPAA compliant business associate agreement with the Covered Entity which among other things ensures that the film crew will safeguard the PHI it obtains, only use or disclose the PHI for the purposes provided in the agreement, and return or destroy any PHI after the work for the health care provider has been completed as required by 45 C.F.R. 164.504(e)(2). The Media FAQ also states that as a business associate, the film crew must comply with the HIPAA Security Rule and a number of provisions in the Privacy Rule, including the Rule’s restrictions on the use and disclosure of PHI. In addition, the Media FAQ reminds Covered Entities and business associates of the need to obtain prior authorizations from patients whose PHI is included in any materials before any of those materials are posted online, printed in brochures for the public, or otherwise publicly disseminated.

Finally, the Media FAQ states Covered Entities can continue to inform the media of their treatment services and programs so that the media can better inform the public, provided that, in doing so, the covered entity does not share PHI with the media without the prior authorization of the individuals who are the subject of the PHI.

Filming, Photography & Access By Others Beyond The Media

While the NYP Resolution Agreement and the Media FAQ specifically focus on access, filming and photography to film crews and members of the Media, a close reading of the NYP Resolution Agreement suggests that Covered Entities and their business associates also should consider reevaluating their the adequacy and advisability of their policies and practices for monitoring and controlling photography and filming by more than just members of the media and film crews within their facilities. As part of the corrective actions required under the Resolution Agreement, NYP must adopt and enforce a specific prohibition against NYP or any of its workforce members, agents or business associates permitting the use or disclosure of PHI by or to “any person or entity planning, coordinating or engaging in, for purposes not related to the provision of medical care, photography, video recording or audio recording” without the prior authorization of the patient who is the subject of the PHI sought to be disclosed. (emphasis added).

The Resolution Agreement further reinforces the breadth of a Covered Entity’s duty to protect patients from being filmed or photographed without their authorization by others not involved in the care of the patient by its requirement that NYP require that “all photography, video recording and audio recording conducted on NYP premises” be reviewed, preapproved and actively monitored by appropriate NYP representatives for compliance with the Privacy Rule and NYP’s policies.

Like discussion included in the Media FAQ about disclosures beyond those to outside media, this discussion in the NYP Resolution Agreement signals that beyond their media dealings, Covered Entities and business associates also should use care to appropriately monitor and control film, photographic, audio or other recording and other access or observation of patients or areas where patient PHI is located by not just the media, but “any third party not involved in patient care.”

Act To Manage HIPAA & Other Patient Filming, Photography & Media Risks

In response to the NYP Resolution Agreement and new Media FAQ, Covered Entities and their business associates clearly should consider conducting a well-documented assessment of their current policies, practices and workforce training on allowing media or other parties to enter, film, photograph or record within nonpublic areas of their facilities or otherwise disclosing or allowing media access to their facilities.

Furthermore, given the statements in the NYP Resolution Agreement and additional guidance in the new Media FAQ, most Covered Entities and their business associates also will want to evaluate their policies, practices, controls and workforce training about when the Covered Entity or its business associate will allow any party not involved in care of a particular patient to film, photograph, or otherwise record, observe or access areas where patients or patient PHI is or might be present without prior written consent of the patient.

When conducting this review and analysis, Covered Entities and their business associates also should use care to consider and properly accommodate other potential legal or ethical responsibilities such as medical confidentiality duties applicable to physicians and other health care providers under medical ethics, professional licensure or other similar rules, contractual responsibilities, as well as common law privacy or other related exposures.

Since this analysis and review in most cases will result in the uncovering or discussion of potentially legally or politically sensitive information, Covered Entities and their business associates generally will want to consult with experienced legal counsel to arrange to conduct this review with the guidance of legal counsel within the scope of attorney-client privilege.

About The Author

A practicing attorney and Managing Shareholder of Cynthia Marcotte Stamer, P.C., a member of Stamer│Chadwick │Soefje PLLC, Ms. Stamer’s more than 28 years’ of leading edge work as an practicing attorney, author, lecturer and industry and policy thought leader have resulted in her recognition as a “Top” attorney in employee benefits, labor and employment and health care law.

Board certified in labor and employment law by the Texas Board of Legal Specialization, a Fellow in the American College of Employee Benefit Counsel, past Chair and current Welfare Benefit Committee Co-Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, former Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, an ABA Joint Committee on Employee Benefits Council Representative and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, Ms. Stamer is recognized nationally and internationally for her practical and creative insights and leadership on HIPAA and other health and other employee benefit, human resources, and related insurance, health care, privacy and data security and tax matters and policy.

Ms. Stamer’s legal and management consulting work throughout her 27 plus year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Well known for her extensive work with health care, insurance and other highly regulated entities on corporate compliance, internal controls and risk management, her clients range from highly regulated entities like employers, contractors and their employee benefit plans, their sponsors, management, administrators, insurers, fiduciaries and advisors, technology and data service providers, health care, managed care and insurance, financial services, government contractors and government entities, as well as retail, manufacturing, construction, consulting and a host of other domestic and international businesses of all types and sizes.

As a key part of this work, Ms. Stamer uses her deep and highly specialized health, insurance, labor and employment and other knowledge and experience to help health industry, insurance and financial services and other employers and other employee benefit plan sponsors; health, pension and other employee benefit plans, their fiduciaries, administrators and service providers, insurers, and others design legally compliant, effective compliance and internal controls, risk management, human resources and other workforce performance, discipline, compensation, employee benefits and related programs, products and arrangements.

In the course of this work, Ms. Stamer has accumulated an impressive resume of experience advising and representing clients on HIPAA and other privacy and data security concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights for several years, Ms. Stamer has worked extensively with health plans, health care providers, health care clearinghouses, their business associates, employer and other sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health plans, health insurers, health care providers, banking, technology and other vendors, and others. Beyond advising these and other clients on privacy and data security compliance, risk management, investigations and data breach response and remediation, Ms. Stamer also advises and represents clients on OCR and other HHS, Department of Labor, IRS, FTC, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. She also is the author of numerous highly acclaimed publications, workshops and tools for HIPAA or other compliance including training programs on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

Ms. Stamer also is deeply involved in helping to influence the Affordable Care Act, HIPAA and other privacy and data security, federal state and local laws and regulations. She both helps her clients respond to and resolve emerging regulations and laws, government investigations and enforcement actions and helps them shape the rules through dealings with Congress and other legislatures, regulators and government officials domestically and internationally. A former lead consultant to the Government of Bolivia on its Social Security reform law and most recognized for her leadership on U.S. health and pension, wage and hour, tax, education and immigration policy reform, Ms. Stamer works with U.S. and foreign businesses, governments, trade associations, and others on workforce, social security and severance, health care, immigration, privacy and data security, tax, ethics and other laws and regulations. Founder and Executive Director of the Coalition for Responsible Healthcare Policy and its PROJECT COPE: the Coalition on Patient Empowerment and a Fellow in the American Bar Foundation and State Bar of Texas. She also works as a policy advisor and advocate to health plans, their sponsors, administrators, insurers and many other business, professional and civic organizations.

Author of the thousands of publications and workshops these and other employment, employee benefits, health care, insurance, workforce and other management matters, Ms. Stamer also is a highly sought out speaker and industry thought leader known for empowering audiences and readers. Ms. Stamer’s insights on employee benefits, insurance, health care and workforce matters in Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, Modern Healthcare, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications. Ms. Stamer also regularly serves on the faculty and planning committees for symposia of LexisNexis, the American Bar Association, ALIABA, the Society of Employee Benefits Administrators, the American Law Institute, ISSA, HIMMs, and many other prominent educational and training organizations and conducts training and speaks on these and other management, compliance and public policy concerns.

Ms. Stamer also is active in the leadership of a broad range of other professional and civic organizations. For instance, Ms. Stamer presently serves on an American Bar Association (ABA) Joint Committee on Employee Benefits Council representative; Vice President of the North Texas Healthcare Compliance Professionals Association; Immediate Past Chair of the ABA RPTE Employee Benefits & Other Compensation Committee, its current Welfare Benefit Plans Committee Co-Chair, on its Substantive Groups & Committee and its incoming Defined Contribution Plan Committee Chair and Practice Management Vice Chair; Past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and a current member of its Healthcare Coordinating Council; current Vice Chair of the ABA TIPS Employee Benefit Committee; the former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division; on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. She also previously served as a founding Board Member and President of the Alliance for Healthcare Excellence, as a Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; the Board President of the early childhood development intervention agency, The Richardson Development Center for Children; Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a member of the Board of Directors of the Southwest Benefits Association. For additional information about Ms. Stamer, see www.cynthiastamer.com, or http://www.stamerchadwicksoefje.com the member of contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested reviewing other Solutions Law Press, Inc.™ resources at www.solutionslawpress.com such as:

Leave a Comment » | Health Care, Health Care Provider, Health Care Quality, Health Care Qulity, HIPAA, HIPAA Cyber Crime, Medical Privacy, Privacy, Rural Health Care, Uncategorized, Veterans Health Care | Permalink
Posted by Cynthia Marcotte Stamer

Provider Pays $750K To Settle HIPAA Business Associate Rule Breach Charges

April 21, 2016

Health Care Providers, Health Plans, Healthcare Clearing Houses & Business Associates Should Verify Plan’s HIPAA Business Associate Rule Compliance

Health care providers as providers and as health plan sponsors, health plans and their sponsors, health care clearinghouses and their business associates should reconfirm and ensure they can prove they have all required business associate agreements in place and otherwise properly are administering all policies, practices, safeguards and procedures for handling, using and disclosing electronic and other protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules (Privacy Rule) in light of the April 20, 2016 Department of Health & Human Services Office of Civil Rights (OCR) announcement of its latest resolution agreement settling charges against a health care provider for sharing protected health information with a business associate without first implementing the required business associate agreement.

OCR Charges Brought For Business Associate Agreement Violations

HIPAA’s Privacy Rules generally apply to “covered entities,” which under HIPAA are health plans and insurers, health care providers, health care clearinghouses (Covered Entities) and “business associates,” which are individuals or entities that perform services that aid the Covered Entity to perform its duties as a Covered Entity.

The Resolution Agreement and Corrective Action Plan (Resolution Agreement) with Raleigh Orthopaedic Clinic, P.A. of North Carolina (Raleigh Orthopaedic) announced by OCR on April 20th requires Raleigh Orthopaedic to pay $750,000 to settle charges OCR it violated the Privacy Rule by handing over protected health information of approximately 17,300 patients to a potential business partner without first executing a business associate agreement.

Raleigh Orthopaedic is a provider group practice that operates clinics and a surgery center in the Raleigh, North Carolina area. OCR initiated its investigation of Raleigh Orthopaedic after receiving a breach report on April 30, 2013. OCR’s investigation indicated that Raleigh Orthopaedic violated the Privacy Rules by releasing the x-ray films and related protected health information of 17,300 patients to an entity that promised to transfer the images to electronic media in exchange for harvesting the silver from the x-ray films. Raleigh Orthopaedic failed to execute a business associate agreement with this entity before turning over the x-rays and PHI.

OCR says this sharing of the x-ray files and other protected health information by Raleigh Orthopaedic violated the Privacy Rules.

Specifically, the Privacy Rules prohibit Covered Entities and their business associates from using, accessing and disclosing protected health information except as specifically permitted in the Privacy Rules. As part of these rules, the “Business Associate” requirements of the Privacy Rule prohibit Covered Entities from disclosing or allowing business associates to use, and business associates from receiving or using protected health information unless the parties first enter into a written business associate agreement that complies with the requirements of the Privacy Rules.

The Resolution Agreement settles OCR charges that Raleigh Orthopaedic violated this Business Associate Agreement requirement by sharing the x-rays and other protected health information with the service provider without first entering a business associate agreement. Under the Settlement Agreement, Raleigh Orthopaedic must pay a $750,000 payment, as well as revise its policies and procedures to: establish a process for assessing whether entities are business associates; designate a responsible individual to ensure business associate agreements are in place prior to disclosing PHI to a business associate; create a standard template business associate agreement; establish a standard process for maintaining documentation of a business associate agreements for at least six (6) years beyond the date of termination of a business associate relationship; and limit disclosures of PHI to any business associate to the minimum necessary to accomplish the purpose for which the Covered Entity hires the business associate.

Although the Resolution Agreement only addresses charges OCR brought against the Covered Entity, Raleigh Orthopaedic, business associates need to keep in mind that both Covered Entities and business associates now are responsible for ensuring compliance with the business associate agreement requirements of the Privacy Rules since the Stimulus Bill amended HIPAA to make most provisions of the Privacy Rule directly applicable to business associates as well as Covered Entities.

Take Aways For Covered Entities & Their Business Associates

OCR’s announcement of the Resolution Agreement includes a strong message for other Covered Entities and business associates of the importance of taking seriously their responsibility under the Privacy Rule to ensure that the business associate agreement requirements of the Privacy Rule are met before business associates are allowed to receive, access or use protected health information. The announcement quotes Jocelyn Samuels, Director of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) as stating. “It is critical for entities to know to whom they are handing PHI and to obtain assurances that the information will be protected.” and “HIPAA’s obligation on covered entities to obtain business associate agreements is more than a mere check-the-box paperwork exercise.”

In light of the Business Associate Rule and Director Samuels’ comments, Covered Entities and business associates alike should review the adequacy of their documentation, policies and practices regarding dealings with service providers who are or could collect, receive or use electronic or other protected health information to propose or perform services in the capacity as a business associate. Certainly both Covered Entities and business associates to ensure that they possess and are able to produce if needed signed business associate agreements for each current business associate agreement as well as that appropriate policies, practices and procedures are in place to ensure that all required business associate agreements are implemented before any disclosure or use of protected health information to the business associate in the future. As part of these activities, both Covered Entities and business associates also should ensure their policies and practices appropriately provide for the retention of signed copies of all business associate agreements and other records, and the implementation of all other processes and procedures required to position the entity to be able to demonstrate it not only had policies requiring compliance, but appropriately implemented and administered those policies in accordance with the Privacy Rule.

When conducting this review, Covered Entities and business associates also generally should consider the advisability of also reviewing their business associate agreements and the adequacy of these arrangements in light of any other contractual confidentiality and or contractual rights and commitments, regulatory requirements and other operational and risk management concerns that impact or interrelate with the relationship between the business associate and the Covered Entity. It is important to ensure that appropriate steps are taken to evaluate and properly integrate the confidentiality and other commitments that the Privacy Rules mandate a business associate agreement include with audit, performance assessment, and other data access or disclosure, trade secrets, confidentiality, performance standards and guarantees, indemnity and other contractual obligations of other agreements that could impact or be impacted by the business associate agreements. Steps also should be taken to incorporate appropriate processes and procedures for ensuring that the Covered Entity and members of its workforce understand and consistently administer and document their use of appropriate processes to ensure that the business associate agreement and other requirements of the Privacy Rules are fulfilled. In the case of employer sponsored plans subject to the Employee Retirement Income Security Act of 1974, for instance, the selection and proper oversight of business associates and the management of plan data both are subject to the fiduciary responsibility rules of ERISA. Meanwhile, insurers, business associates and other plan vendors also generally should anticipate that beyond HIPAA, they also may be subject to data security, privacy and other mandates and exposures under state HIPAA-like rules for protected health information, as well as other obligations under insurance, data security, identity theft, breach, privacy and other state laws.

The process of evaluating the adequacy of current arrangement and considering the advisability of changes to tighten existing practices in many cases will result in the discovery and discussion of potentially sensitive information about the adequacy of current or past compliance with the Privacy Rules or other matters. For example, it is possible that in the course of review, parties may be unable to locate a signed business associate agreement governing a relationship that the Privacy Rules require be subject to a business associate agreement or in the course of review, information indicating breaches of protected health information or other Privacy Rule violations may have occurred. For this reason, most Covered Entities and their business associates will want to consider arranging for this review and analysis to be conducted within the scope of attorney-client privilege by or under the direction of qualified legal counsel with HIPAA experience that has entered into a business associate agreement with the Covered Entity or business associate.

About The Author

The author of this update,Cynthia Marcotte Stamer, is a noted Texas-based management lawyer and consultant, author, lecturer and policy advocate, recognized as among the “Top Rated Labor & Employment Lawyers in Texas” by LexisNexis® Martindale-Hubbell® and as among the “Best Lawyers In Dallas” for her work in the field of “Tax: Erisa & Employee Benefits” and “Health Care” by D Magazine who works, writes and speaks extensively about HIPAA and other data privacy and security concerns.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer’s legal and management consulting work throughout her career has focused on helping health industry, insurance and other organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, Ms. Stamer helps health industry and other organizations manage. Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce management operations and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy. Well-known for her extensive work with health care, insurance and other highly regulated entities on corporate compliance, internal controls and risk management, her clients range from highly regulated entities like employers, contractors and their employee benefit plans, their sponsors, management, administrators, insurers, fiduciaries and advisors, technology and data service providers, health care, managed care and insurance, financial services, government contractors and government entities, as well as retail, manufacturing, construction, consulting and a host of other domestic and international businesses of all types and sizes. Common engagements include internal and external workforce hiring, management, training, performance management, compliance and administration, discipline and termination, and other aspects of workforce management including employment and outsourced services contracting and enforcement, sentencing guidelines and other compliance plan, policy and program development, administration, and defense, performance management, wage and hour and other compensation and benefits, reengineering and other change management, internal controls, compliance and risk management, communications and training, worker classification, tax and payroll, investigations, crisis preparedness and response, government relations, safety, government contracting and audits, litigation and other enforcement, and other concerns.

A Fellow in the American College of Employee Benefit Counsel, Ms. Stamer also brings to the table extensive knowledge and experience to help employers and other employee benefit plan sponsors; health, pension and other employee benefit plans, their fiduciaries, administrators and service providers, insurers, and others design legally compliant, effective compensation, health and other welfare benefit and insurance, severance, pension and deferred compensation, private exchanges, cafeteria plan and other employee benefit, fringe benefit, salary and hourly compensation, bonus and other incentive compensation and related programs, products and arrangements. She is particularly recognized for her leading edge work, thought leadership and knowledgeable advice and representation on the design, documentation, administration, regulation and defense of a diverse range of self-insured and insured health and welfare benefit plans including private exchange and other health benefit choices, health care reimbursement and other “defined contribution” limited benefit, 24-hour and other occupational and non-occupational injury and accident, ex-patriate and medical tourism, onsite medical, wellness and other medical plans and insurance benefit programs as well as a diverse range of other qualified and nonqualified retirement and deferred compensation, severance and other employee benefits and compensation, insurance and savings plans, programs, products, services and activities. As a key element of this work, Ms. Stamer works closely with employer and other plan sponsors, insurance and financial services companies, plan fiduciaries, administrators, and vendors and others to design, administer and defend effective legally defensible employee benefits and compensation practices, programs, products and technology. She also continuously helps employers, insurers, administrative and other service providers, their officers, directors and others to manage fiduciary and other risks of sponsorship or involvement with these and other benefit and compensation arrangements and to defend and mitigate liability and other risks from benefit and liability claims including fiduciary, benefit and other claims, audits, and litigation brought by the Labor Department, IRS, HHS, participants and beneficiaries, service providers, and others. She also assists debtors, creditors, bankruptcy trustees and others assess, manage and resolve labor and employment, employee benefits and insurance, payroll and other compensation related concerns arising from reductions in force or other terminations, mergers, acquisitions, bankruptcies and other business transactions including extensive experience with multiple, high-profile large scale bankruptcies resulting in ERISA, tax, corporate and securities and other litigation or enforcement actions.

Throughout her career, Ms. Stamer has advised these and other clients about health care, health plan, financial information, trade secret, privacy and other related compliance, data breach response and remediation and related compliance, risk management and related concerns. In the course of this work, Ms. Stamer has accumulated an impressive resume of experience advising and representing clients on HIPAA and other privacy and data security concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights for several years, Ms. Stamer has worked extensively with health plans, health care providers, health care clearinghouses, their business associates, employer and other sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health plans, health insurers, health care providers, banking, technology and other vendors, and others.

Beyond advising these and other clients on privacy and data security compliance, risk management, investigations and data breach response and remediation and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. She also is the author of numerous highly acclaimed publications, workshops and tools for HIPAA or other compliance including training programs on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

Ms. Stamer also is deeply involved in helping to influence the Affordable Care Act and other health care, pension, social security, workforce, insurance and other policies critical to the workforce, benefits, and compensation practices and other key aspects of a broad range of businesses and their operations. She both helps her clients respond to and resolve emerging regulations and laws, government investigations and enforcement actions and helps them shape the rules through dealings with Congress and other legislatures, regulators and government officials domestically and internationally. A former lead consultant to the Government of Bolivia on its Social Security reform law and most recognized for her leadership on U.S. health and pension, wage and hour, tax, education and immigration policy reform, Ms. Stamer works with U.S. and foreign businesses, governments, trade associations, and others on workforce, social security and severance, health care, immigration, privacy and data security, tax, ethics and other laws and regulations. Founder and Executive Director of the Coalition for Responsible Healthcare Policy and its PROJECT COPE: the Coalition on Patient Empowerment and a Fellow in the American Bar Foundation and State Bar of Texas, Ms. Stamer annually leads the Joint Committee on Employee Benefits (JCEB) HHS Office of Civil Rights agency meeting and other JCEB agency meetings. She also works as a policy advisor and advocate to many business, professional and civic organizations.

Beyond these involvements, Ms. Stamer also is active in the leadership of a broad range of other professional and civic organizations. For instance, Ms. Stamer presently serves on an American Bar Association (ABA) Joint Committee on Employee Benefits Council representative; Vice President of the North Texas Healthcare Compliance Professionals Association; Immediate Past Chair of the ABA RPTE Employee Benefits & Other Compensation Committee, its current Welfare Benefit Plans Committee Co-Chair, on its Substantive Groups & Committee and its incoming Defined Contribution Plan Committee Chair and Practice Management Vice Chair; Past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and a current member of its Healthcare Coordinating Council; current Vice Chair of the ABA TIPS Employee Benefit Committee; the former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division; on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. She also previously served as a founding Board Member and President of the Alliance for Healthcare Excellence, as a Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; the Board President of the early childhood development intervention agency, The Richardson Development Center for Children; Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a member of the Board of Directors of the Southwest Benefits Association. For additional information about Ms. Stamer, see here or contact Ms. Stamer directly by email cstamer@solutionslawyer.net or by telephone at (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested reviewing other Solutions Law Press, Inc.™ resources at www.solutionslawpress.com such as:

Leave a Comment » | Doctor, Health Care, Health Care Provider, HIPAA, HIPAA Cyber Crime, Physician, Uncategorized | Tagged: Assisted Living, clinic, Data Breech, Data Security, Doctor, Health Care, Health Care Clinic, healthcare, HIPAA, Medical Privacy, Nurse, Office of Civil Rights, PHI, Physician, Privacy, Protected Health Information, Radiology, Skilled Nursing | Permalink
Posted by Cynthia Marcotte Stamer

Childcare Providers Brace For More Regulation & Enforcement

March 30, 2016

cute_school_child_design_vector_535301

By: Cynthia Marcotte Stamer

Childcare providers should prepare for greater regulation and enforcement in response to efforts by the Department of Health and Human Services (HHS) to increase regulation, oversight and enforcement against childcare providers arising from the implementation by HHS of the Child Care and Development Block Grant Act of 2014 (CCDBG). See Child Care and Development Block Grant Act (CCDBG) of 2014: Plain Language Summary of Statutory Changes.

Quality Concerns Prompting HHS To Seek Tighter Childcare Regulation & Enforcement

As part of federal efforts to mitigate the impact of childcare expenses on low income workers, the U.S. Child Care and Development Fund underwrites the care of nearly 1.5 million children from low-income families every month. In 2015, the U.S. government spent about $5.4 billion of taxpayer dollars to help states, territories and tribes subsidize child care for low-income working families. Increased federal scrutiny of these programs and their expenditures as well as reports of concerns about the quality of the child care programs they fund are prompting both additional federal regulation and oversight of these programs.

The Child Care and Development Block Grant Act (CCDBG) enacted by Congress in 2014 imposed requirements for childcare worker criminal background checks, CPR training, SIDS prevention planning and other health and safety requirements for childcare providers receiving federal subsidies. CCBDG also gave HHS authority to set caseload limits for state inspectors, conduct annual inspections and to impose other requirements to regulate, monitor and enforce quality, health and safety and other standards for subsidized child care providers. See Child Care and Development Block Grant Act (CCDBG) of 2014: Plain Language Summary of Statutory Changes. Based on audits of compliance with current state regulations and other requirements for child care providers by the HHS Office of Inspector General (OIG) now is gearing up to use this authority to tighten federal requirements for federally subsidized childcare and in anticipation of its announcement of proposed regulations, is conducting an aggressive public relations campaign to generate public support for HHS implementing regulations of the CCDBG that will substantially tighten federal requirements for subsidized childcare facilities. While HHS as of now has not published the expanded safeguards that it plans to impose, its high profile public relations campaign indicates that it plans both to substantially tighten these requirements and the required oversight and enforcement against childcare providers in light of widespread deficiencies in the compliance of federally funded childcare centers with applicable state regulations that OIG reports it uncovered in a series of OIG health and safety audits.

According to OIG, a series of audits conducted by OIG of federally funded childcare facilities uncovered what OIG considers “major health and safety violations” at many state-licensed day care providers around the country. OIG reports that 96 percent (218 out of 227) of childcare centers by OIG in unannounced site visits had at least one health and safety violation. OIG has posted results of these audits by region here, including two just released reports of findings from audits performed in Florida. See, e.g. Some Florida Childcare Centers Did Not Always Comply With State Health and Safety Licensing Requirements; Some Florida Family Childcare Homes Did Not Always Comply With State Health and Safety Requirements.

The audit reports identify a wide range of safety concerns. Some of the deficiencies OIG reports finding at these facilities included:

Childcare workers leaving children unattended;
Understaffed facilities;
Childcare workers with pending criminal charges for corruption of minors, child endangerment or other concerning criminal charges or convictions and others not background checked;
Fire hazards;
Storage of chemicals, liquor, Tree trimming saw and other lawn equipment or other unsafe items left in unlocked locations accessible by children;
Playgrounds with exposed rusty nails; and
Others.

Based on these findings, HHS is gearing up to tighten federal requirements for federal funding of childcare and is engaged in an aggressive public relations campaign to publicize its findings to engender support for tighter federal regulation. As part of this aggressive public relations outreach, OIG has posted a u-Tube video, Eye On Oversight: Childcare Safety Lapses and is conducting an aggressive public relations outreach to expand awareness of its concerns about the childcare industry and its calls for tighter regulation. In a recent editorial opinion published by CNN, Americans footing bill for substandard child care, for instance, Joanne Chiedi, HHS Principal Deputy Inspector General wrote that families whose children are cared for in childcare centers receiving federal subsidies cannot trust the safety of these environments. While conceding that some childcare facilities passed the OIG audits, Ms. Chiedi writes, “the overwhelming number of problems uncovered make it clear that conditions for the subsidized care of low-income children need to change — and quickly.”

To address these concerns, OIG has announced plans to exercise powers granted under the CCDBG of 2014 to tighten the legal requirements that the federal government states must meet to qualify for federal funding of childcare. While HHS has not yet published proposed regulations defining the requirements that it plans to impose to address these concerns, it is inviting public input and comment. In the meanwhile, Ms. Chiedi’s CNN editorial opinion provides some insight to HHS’ future plans for regulating childcare when she writes:

Until recently, the federal government gave the money to states so long as each certified that it had certain minimal health and safety requirements designed to protect the health and safety of children. States received the money whether their health and safety requirements were strict or lenient. …

Setting adequate standards is an important step, and effective oversight is necessary to ensure that providers comply. Child Care Aware of America, an organization advocating for quality child care standards, recommends that states employ one inspector for every 50 child care providers. Yet during our visits to the five states that reported their ratios, caseloads ranged from Connecticut’s 332 providers per site inspector to Pennsylvania’s 143 providers per inspector.

The 2014 law also authorized annual inspections for subsidized child care providers and established appropriate caseloads for inspectors. he Administration for Children and Families in the Department of Health and Human Services must implement the law’s new requirements to the full extent of its authority.

All states should also examine their child care requirements and oversight and make improvements where needed, with the understanding that lax requirements and unsafe conditions risk jeopardizing federal tax dollars.

Our children are precious. They should not be cared for in places that have unsecured weapons, toxic chemicals and blocked fire escapes.

Childcare Providers Should Prepare For Rising Scrutiny, Regulation & Enforcement

In light of these concerns, HHS has announced plans not only to increase federal regulation, oversight and enforcement of child care safety and other requirements but also to use its regulatory and enforcement powers and public relations pulpit to pressure states to step up their regulation and enforcement against child care providers. In light of these comments and other information impugning child care safety, child care providers across the country need to be concerned and prepare to respond to increased federal and state regulation, oversight and enforcement. In addition, child care providers also should anticipate that the HHS educational outreach will heighten awareness and sensitivity to child care health and safety in their local communities, which is likely to encourage complaints to regulators, civil law suits and other actions by families whose children they care for and others within their communities. As a result, child care providers generally not only should carefully monitor and participate strategically in the public policy and public discussion and rulemaking by HHS and other regulators and take steps to position themselves to deter or respond to these added threats by carefully managing safety and quality, as well as customer and community communications and relations.

Childcare providers obviously need to carefully monitor the HHS analysis and proposals and provide meaningful input by commenting on this analysis and proposals. However, industry input alone is not sufficient. Childcare providers concerned about the potential financial stress and liability of excessive regulation and enforcement should look for opportunities to develop strategic alliances with the families they service and other American families likely to be concerned about the effect of over-regulation on the cost or availability of childcare.

Interested persons can start monitoring and participating in HHS’ discussion on twitter at #ProtectOurKids, and can learn more on the Office of Child Care of the HHS Administration For Children & Families at www.occ-cmc.org, and can register to receive Office of Child Care updates here.

About The Author

Recognized as a “Top” attorney in employee benefits, labor and employment and health care law extensively involved in health and other employee benefit and human resources policy and program design and administration representation and advocacy throughout her career, Cynthia Marcotte Stamer is a practicing attorney and Managing Shareholder of Cynthia Marcotte Stamer, P.C., a member of Stamer│Chadwick│Soefje PLLC, author, pubic speaker, management policy advocate and industry thought leader with more than 28 years’ experience practicing at the forefront of employee benefits and human resources law.

A Fellow in the American College of Employee Benefit Counsel, past Chair and current Welfare Benefit Committee Co-Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, former Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, an ABA Joint Committee on Employee Benefits Council Representative and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, Ms. Stamer is recognized nationally and internationally for her practical and creative insights and leadership on health and other employee benefit, human resources and insurance matters and policy.

Ms. Stamer helps management manage. Ms. Stamer’s legal and management consulting work throughout her nearly 30- year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce management operations and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy. Well known for her extensive work with health care, insurance and other highly regulated entities on corporate compliance, internal controls and risk management, her clients range from highly regulated entities like employers, contractors and their employee benefit plans, their sponsors, management, administrators, insurers, fiduciaries and advisors, technology and data service providers, health care, managed care and insurance, financial services, government contractors and government entities, as well as retail, manufacturing, construction, consulting and a host of other domestic and international businesses of all types and sizes. Common engagements include internal and external workforce hiring, management, training, performance management, compliance and administration, discipline and termination, and other aspects of workforce management including employment and outsourced services contracting and enforcement, sentencing guidelines and other compliance plan, policy and program development, administration, and defense, performance management, wage and hour and other compensation and benefits, reengineering and other change management, internal controls, compliance and risk management, communications and training, worker classification, tax and payroll, investigations, crisis preparedness and response, government relations, safety, government contracting and audits, litigation and other enforcement, and other concerns.

Ms. Stamer uses her deep and highly specialized health, insurance, labor and employment and other knowledge and experience to help employers and other employee benefit plan sponsors; health, pension and other employee benefit plans, their fiduciaries, administrators and service providers, insurers, and others design legally compliant, effective compensation, health and other welfare benefit and insurance, severance, pension and deferred compensation, private exchanges, cafeteria plan and other employee benefit, fringe benefit, salary and hourly compensation, bonus and other incentive compensation and related programs, products and arrangements. She is particularly recognized for her leading edge work, thought leadership and knowledgeable advice and representation on the design, documentation, administration, regulation and defense of a diverse range of self-insured and insured health and welfare benefit plans including private exchange and other health benefit choices, health care reimbursement and other “defined contribution” limited benefit, 24-hour and other occupational and non-occupational injury and accident, expat and medical tourism, onsite medical, wellness and other medical plans and insurance benefit programs as well as a diverse range of other qualified and nonqualified retirement and deferred compensation, severance and other employee benefits and compensation, insurance and savings plans, programs, products, services and activities. As a key element of this work, Ms. Stamer works closely with employer and other plan sponsors, insurance and financial services companies, plan fiduciaries, administrators, and vendors and others to design, administer and defend effective legally defensible employee benefits and compensation practices, programs, products and technology. She also continuously helps employers, insurers, administrative and other service providers, their officers, directors and others to manage fiduciary and other risks of sponsorship or involvement with these and other benefit and compensation arrangements and to defend and mitigate liability and other risks from benefit and liability claims including fiduciary, benefit and other claims, audits, and litigation brought by the Labor Department, IRS, HHS, participants and beneficiaries, service providers, and others. She also assists debtors, creditors, bankruptcy trustees and others assess, manage and resolve labor and employment, employee benefits and insurance, payroll and other compensation related concerns arising from reductions in force or other terminations, mergers, acquisitions, bankruptcies and other business transactions including extensive experience with multiple, high-profile large scale bankruptcies resulting in ERISA, tax, corporate and securities and other litigation or enforcement actions.

Ms. Stamer also is active in the leadership of a broad range of other professional and civic organizations. For instance, Ms. Stamer presently serves on an American Bar Association (ABA) Joint Committee on Employee Benefits Council representative; Vice President of the North Texas Healthcare Compliance Professionals Association; Immediate Past Chair of the ABA RPTE Employee Benefits & Other Compensation Committee, its current Welfare Benefit Plans Committee Co-Chair, on its Substantive Groups & Committee and its incoming Defined Contribution Plan Committee Chair and Practice Management Vice Chair; Past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and a current member of its Healthcare Coordinating Council; current Vice Chair of the ABA TIPS Employee Benefit Committee; the former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division; on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. She also previously served as a founding Board Member and President of the Alliance for Healthcare Excellence, as a Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; the Board President of the early childhood development intervention agency, The Richardson Development Center for Children; Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a member of the Board of Directors of the Southwest Benefits Association. For additional information about Ms. Stamer, see CynthiaStamer.com or StamerChadwickSoefje.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc. ™ resources at Solutionslawpress.com such as:

Leave a Comment » | Child Care, Childrens Health Insurance Program, Health Care, Health Care Provider, health care reimbursement, Rural Health Care, Uncategorized | Tagged: babysitting, Child Care, Childcare, community health, Daycare, dependent care, dependent care reimbursement plan, federal child care, government regulation, HHS, OIG | Permalink
Posted by Cynthia Marcotte Stamer

North Memorial Hit With $3.9M HIPAA Fine For HIPAA Violations

March 25, 2016

Just one day after the announcement of a $1,555,000 settlement with North Memorial Health Care of Minnesota under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) announced March 17, 2016 that Feinstein Institute for Medical Research has agreed to pay $3.9 million and will undertake a substantial corrective action plan to settle charges of HIPAA violations and bring its operations into compliance. The two settlements drive home again the substantial liability that health care providers, health plans, health care clearinghouses and their business associates risk for violating HIPAA. Register for March 30, 2016 Solutions Law Press, Inc. briefing to learn the latest about this and other new regulatory and enforcement guidance impacting the HIPAA compliance obligations and risks of health care providers, health plans, health care clearinghouses and their business associates. 3/30 Webex Shares Latest On Security, Patient Access & Other HIPAA Developments.

Feinstein Settlement

Feinstein is a biomedical research institute that is organized as a New York not-for-profit corporation and is sponsored by Northwell Health, Inc., formerly known as North Shore Long Island Jewish Health System, a large health system headquartered in Manhasset, New York that is comprised of twenty one hospitals and over 450 patient facilities and physician practices.

OCR’s investigation began after Feinstein filed a breach report indicating that on September 2, 2012, a laptop computer containing the electronic protected health information (ePHI) of approximately 13,000 patients and research participants was stolen from an employee’s car. The ePHI stored in the laptop included the names of research participants, dates of birth, addresses, social security numbers, diagnoses, laboratory results, medications, and medical information relating to potential participation in a research study.

OCR’s investigation discovered that Feinstein’s security management process was limited in scope, incomplete, and insufficient to address potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the entity. Further, Feinstein lacked policies and procedures for authorizing access to ePHI by its workforce members, failed to implement safeguards to restrict access to unauthorized users, and lacked policies and procedures to govern the receipt and removal of laptops that contained ePHI into and out of its facilities. For electronic equipment procured outside of Feinstein’s standard acquisition process, Feinstein failed to implement proper mechanisms for safeguarding ePHI as required by the Security Rule.

“Research institutions subject to HIPAA must be held to the same compliance standards as all other HIPAA-covered entities,” said OCR Director Jocelyn Samuels. “For individuals to trust in the research process and for patients to trust in those institutions, they must have some assurance that their information is kept private and secure.”

The resolution agreement and corrective action plan may be found here.

The Feinstein settlement announcement follows yesterday’s announcement of a $1.5 million plus settlement with North Memorial to resolve HIPAA charges that it failed to implement a business associate agreement with a major contractor and failed to institute an organization-wide risk analysis to address the risks and vulnerabilities to its patient information. North Memorial is a comprehensive, not-for-profit health care system in Minnesota that serves the Twin Cities and surrounding communities. The settlement highlights the importance for healthcare providers, health plans, healthcare clearinghouses and their business associates to comply with HIPAA’s business associate agreement and other HIPAA organizational, risk assessment, privacy and security, and other requirements.

OCR’s announcement emphasizes the importance of meeting these requirements. “Two major cornerstones of the HIPAA Rules were overlooked by this entity,” said Jocelyn Samuels, Director of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). “Organizations must have in place compliant business associate agreements as well as an accurate and thorough risk analysis that addresses their enterprise-wide IT infrastructure.”

The settlement comes from charges filed after OCR initiated its investigation of North Memorial following receipt of a breach report on September 27, 2011, which indicated that an unencrypted, password-protected laptop was stolen from a business associate’s workforce member’s locked vehicle, impacting the electronic protected health information (ePHI) of 9,497 individuals.

OCR’s investigation indicated that North Memorial failed to have in place a business associate agreement, as required under the HIPAA Privacy and Security Rules, so that its business associate could perform certain payment and health care operations activities on its behalf. North Memorial gave its business associate, Accretive, access to North Memorial’s hospital database, which stored the ePHI of 289,904 patients. Accretive also received access to non-electronic protected health information as it performed services on-site at North Memorial.

The investigation further determined that North Memorial failed to complete a risk analysis to address all of the potential risks and vulnerabilities to the ePHI that it maintained, accessed, or transmitted across its entire IT infrastructure — including but not limited to all applications, software, databases, servers, workstations, mobile devices and electronic media, network administration and security devices, and associated business processes.

In addition to the $1,550,000 payment, North Memorial is required to develop an organization-wide risk analysis and risk management plan, as required under the Security Rule. North Memorial will also train appropriate workforce members on all policies and procedures newly developed or revised pursuant to this corrective action plan.

The Resolution Agreement and Corrective Action Plan can be found here.

Settlement Latest Reminder To Manage HIPAA Risks

Following up on OCR’s imposition of its second-ever HIPAA Civil Monetary Penalty (CMP) and the latest in an ever-growing list of settlements by Covered Entities under HIPAA, the North Memorial settlement is another example of the substantial liability that Covered Entities face for violating HIPAA. To avoid these liabilities, Covered Entities must constantly be diligent to comply with the latest guidance of OCR concerning their obligations under HIPAA. As OCR continues to issue additional guidance as well as supplement this guidance through information shared in settlement agreements like the North Memorial settlement, even if Covered Entities reviewed their practices in the last 12-months, most will want to update this review in response to new OCR guidance and enforcement actions, including new guidance on obligations to provide plan members or other subjects of protected health information with access to or copies of their records and other guidance, as well as the ever expanding list of enforcement actions by OCR.

Since the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) amended HIPAA, Covered Entities face growing responsibilities and liability for maintaining the security of ePHI. In response to HITECH, OCR continues to use a carrot and stick approach to encouraging and enforcing compliance. As demonstrated by OCR’s imposition of the second-ever HIPAA Civil Monetary Penalty (CMP) of $239,000 against Lincare and the ever-growing list of Resolution Agreements OCR announces with other Covered Entities, OCR continues to step up enforcement against Covered Entities that breach the Privacy and Security Rules. See OCR’s 2nd-Ever HIPAA CMP Nails Lincare For $239,000.

On the other hand, OCR also continues to encourage voluntary compliance by Covered Entities by sharing guidance and tools to aid Covered Entities to understand fulfill their HIPAA responsibilities such as the HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework (Crosswalk) unveiled by OCR on February 24, 2016.The crosswalk that maps the HIPAA Security Rule to the standards of the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (the Cybersecurity Framework) as well as mappings to certain other commonly used security frameworks.

While stating that the HIPAA Security Rule does not require use of the NIST Cybersecurity Framework, OCR says it hopes the Crosswalk will provide “a helpful roadmap” for HIPAA Covered Entities and their business associates to understand the overlap between the NIST Cybersecurity Framework, the HIPAA Security Rule, and other security frameworks that can help Covered Entities safeguard health data in a time of increasing risks and help them to identify potential gaps in their programs. At the same time, OCR’s announcement of its release of the Crosswalk also cautions users that “use of the Framework does not guarantee HIPAA compliance.” Rather, OCR says “the crosswalk provides an informative tool for entities to use to help them more comprehensively manage security risks in their environments.

With a USA Today report attributing more than 40 percent of data breaches to the healthcare industry over the last three years 91 percent of all health organizations having reporting breaches over the last two years, OCR has made clear that it intends to zealously investigate and enforce the Security Rules against Covered Entities that violate the Security Rules against Covered Entities that fail to take suitable steps to safeguard the security of PHI as required by the HIPAA Security Rule. To meet these requirements, the HIPAA Security Rule requires that Covered Entities conduct and be prepared to product documentation of their audit and other efforts to comply with the Security Rule Most Covered Entities will want to consider including an assessment of the adequacy of their existing practices under the Crosswalk and other requirements disclosed by OCR in these assessments to help position the Covered Entity to defend or mitigate HIPAA CMP and other liabilities in the event of a HIPAA breach or audit.

Latest Guidance Clarifies Patient Rights To Access PHI & Allowable Charges

In addition to maintaining adequate security, HIPAA also requires Covered Entities to provide individuals with the right to access and receive a copy of their health information from their providers, hospitals, and health insurance plans in accordance with the HIPAA Privacy Rule. In response to recurrent difficulties experienced by individuals in exercising these rights, OCR recently published supplemental guidance to clarify and promote better understanding and compliance with these rules by Covered Entities.

OCR started this process in January, 2015 by releasing a comprehensive fact sheet (Access fact sheet) and the first in a series of topical frequently asked questions (FAQs) addressing patients’ right to access their medical records, which set forth requirements providers must follow in sharing medical records with patients, including that they must do so in a timely manner and in a format that works for the patient.

Earlier this month, OCR followed up by publishing on March 1, 2016 a second set of FAQs addresses additional issues, including the fees individuals may be charged for copies of their health information and the right of individuals to have their health information sent directly to a third party if they so choose.

Covered entities and their business associates should move quickly to review and update their business associate agreements and other practices to comply with this new guidance as well as watch for further guidance and enforcement about these practices from OCR.

Other Key HIPAA Regulatory & Enforcement Changes Raise Responsibilities & Risks

OCR’s new guidance on access to PHI follows a host of other regulatory and enforcement activities. While the particulars of each of these new actions and guidance vary, all send a very clear message: OCR expects Covered Entities and their business associates to comply with HIPAA and is offering tools and other guidance to aid them in that process.. In the event of a breach or audit, Covered Entities and their business associates need to be prepared to demonstrate their efforts to comply. Those that cannot show adequate compliance efforts should be prepared for potentially substantial CMP or Resolution Agreement payments and other sanctions.

Register For 3/30 Webex Briefing

Solutions Law Press, Inc.™ invites to catch up on the latest guidance on the Covered Entities’ responsibility under HIPAA to provide access to patients to PHI by registering here to participate in the “HIPAA Update: The Latest On Security, Patient Access & Other HIPAA Developments” Webex briefing by attorney Cynthia Marcotte Stamer that Solutions Law Press, Inc.™ will host beginning at Noon Central Time on Wednesday, March 30, 2016. Get additional information or register here.

About The Author

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble and as among the “Best Lawyers In Dallas” in employee benefits 2015 by D Magazine; Ms. Stamer has more than 28 years of extensive proven, pragmatic knowledge and experience representing and advising health industry clients and others on operational, regulatory and other compliance, risk management, product and process development, public policy and other key concerns.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE; Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Counsel, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or the Stamer│Chadwick │Soefje PLLC or contact Ms. Stamer via email to here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here. ©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved.

Leave a Comment » | Academic medicine, ASC, Childrens Health Insurance Program, Consumer Driven Health Care, data breach, data security, Disease Management, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employer, Employment law, FACTA, Federal Health Center, Federal Sentencing Guidelines, Genetic Information, GINA, Health Care, Health Care Provider, Health Insurance Exchange, Health IT, Health Plan, Health Plans, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Labor Law, Laws, managed care, Meaningful Use, Medicaid, Medical Licensure, Medical Malpractice, Medicare, Medicare Advantage, Medicare Prescription Drug Program, Mental Health, Mental Heatlh, OCR, Outpatient, Patient Empowerment, Pharmacy, Physician, Physician Licensing, Prescription Drugs, Privacy, Psychiatric, Reproductive Rights, Rural Health Care, substance abuse treatment, Technology, Telemarketing, Telemedicine, Union, Veterans Health, Wellness | Tagged: breech, Data Breech, HIPAA, Medical Confidentiality, Medical Privacy, North Memorial, OCR, Privacy | Permalink
Posted by Cynthia Marcotte Stamer

North Memorial Health Care Pays $1.5M Plus HIPAA Settlement For Business Associate Agreement Deficiencies

March 16, 2016

North Memorial Health Care of Minnesota has agreed to pay $1,550,000 to settle charges that it potentially violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules by failing to implement a business associate agreement with a major contractor and failing to institute an organization-wide risk analysis to address the risks and vulnerabilities to its patient information. North Memorial is a comprehensive, not-for-profit health care system in Minnesota that serves the Twin Cities and surrounding communities. The settlement highlights the importance for healthcare providers, health plans, healthcare clearinghouses and their business associates to comply with HIPAA’s business associate agreement and other HIPAA organizational, risk assessment, privacy and security, and other requirements.

The Resolution Agreement and Corrective Action Plan can be found on the HHS website at: http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/north-memorial-health-care/index.html.

Settlement Latest Reminder To Manage HIPAA Risks

Latest Guidance Clarifies Patient Rights To Access PHI & Allowable Charges

Other Key HIPAA Regulatory & Enforcement Changes Raise Responsibilities & Risks

Register For 3/30 Webex Briefing

About The Author

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble and as among the “Best Lawyers In Dallas” in employee benefits 2015 by D Magazine; Ms. Stamer has more than 28 years of extensive proven, pragmatic knowledge and experience representing and advising health industry clients and others on operational, regulatory and other compliance, risk management, product and process development, public policy and other key concerns.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE; Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Counsel, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or the Stamer│Chadwick │Soefje PLLC or contact Ms. Stamer via email to here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Leave a Comment » | Academic medicine, Corporate Compliance, data breach, data security, Disease Management, DME, Doctor, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employee Benefits, Employer, Federal Health Center, Genetic Information, Health Care, Health Care Provider, Health Care Quality, Health IT, Health Plan, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, Hospital, hospitals, Inpatient Rehabilitation Facility, managed care, Medical Malpractice, Medicare, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Mental Health, OCR, Outpatient, Pandemic, Patient Empowerment, Pharmacy, Physician, Privacy, Psychiatric, Rural Health Care, Technology, Telemarketing, Telemedicine | Tagged: business associate, covered entity, Health Care, Health Plan, HIPAA, Hospital, Medical Privacy, North Memorial, OCR, Privacy | Permalink
Posted by Cynthia Marcotte Stamer

3/30 Webex Shares Latest On Security, Patient Access & Other HIPAA Developments

March 9, 2016

Solutions Law Press, Inc. ™ Invites You To A Special WebEx Briefing

HIPAA Update: The Latest On Security, Patient Access & Other HIPAA Developments

Wednesday, March 30, 2016

1:00 P.M.-2:00 P.M. Eastern | 12:00 P.M.-1:00 P.M. Central 11:00 A.M-12:00 P.M. Mountain | 10:00 A.M-11:00 A.M. Pacific

Health care providers, health plans, health care clearinghouses and their business associates (Covered Entities) face new imperatives to review and tighten their practices to ensure their practices comply with recently released guidance from the U.S. Department of Health & Human Services Office of Civil Rights (OCR)) emphasizing and clarifying the responsibilities of health care providers, health plans and the healthcare clearinghouses under the Health Insurance Portability & Accountability Act of 1996 (HIPAA) to provide access to individuals that are the subject of protected health information or “PHI” to access or copies of their PHI in accordance with HIPAA’s rules and other recent HIPAA guidance and enforcement. With OCR’s recent release of added guidance and OCR enforcement statistics continuing to show HIPAA access rule violations among the most common HIPAA violations and OCR stepping up HIPAA enforcement, health care providers, health plans, healthcare clearinghouses can expect heightened scrutiny and enforcement of these requirements. Additionally, Covered Entities also should evaluate the adequacy of their other practices in light of other recent OCR guidance and enforcement actions.

Solutions Law Press, Inc.™ invites to catch up on the latest guidance on HIPAA’s requirements to provide access to patients to PHI by registering here to participate in the Solutions Law Press, Inc.™ “HIPAA Update: The Latest On Security, Patient Access & Other HIPAA Developments” WebEx briefing from Cynthia Marcotte Stamer on Friday, March 18, 2016. During the Briefing, Ms. Stamer will provide participants with:

√ An update on OCR enforcement actiions and guidance over past 12 months

√ A detailed discussion of OCR’s new guidance about when Covered Entities must provide PHI access or copies to patients

√ Discuss rules and best practices for verifying the identity and credentials of an individual requesting PHI as a patient or personal representative of a patient

√ Share tips for contracting and dealing with business associates to facilitate administration of patient PHI access and security compliance activities

√ Share other practical considerations & best practices for compliance and risk management

√ Respond to participant questions on a time permitting basis

√ More

ABOUT THE SPEAKER

Recognized as “Legal Leader™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” and an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble, singled out as among the “Best Lawyers In Dallas” in employee benefits 2015 by D Magazine;, Cynthia Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely recognized for her more than 28 years extensive work and pragmatic thought leadership, experience, publications and training on HIPAA and other privacy, medical records and data and other health care, health plan and employee benefits, workforce and related regulatory and other compliance, performance management, risk management, product and process development, public policy and other key operational concerns.

As a core component of her work as the Managing Shareholder of Cynthia Marcotte Stamer, PC, the Co-Managing Member of Stamer Chadwick Soefje PLLC, Ms. Stamer has worked extensively throughout her nearly 30 year career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance including extensive involvement with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others. Ms. Stamer also has worked extensively domestically and internationally on public policy and regulatory advocacy on HIPAA and other privacy and data security risks and requirements as well as a broad range of other health, employee benefits, human resources, insurance, tax, compliance and other matters and representing clients in dealings with the US Congress, Departments of Labor, Treasury, Health & Human Services, Federal Trade Commission, HUD and Justice, as well as a state legislatures attorneys general, insurance, labor, worker’s compensation, and other agencies and regulators as well supports clients in defending litigation as lead strategy counsel, special counsel and as an expert witness.

Beyond her extensive involvement advising and defending clients on these matters, Ms. Stamer also has served as the scrivener for the ABA JCEB’s meeting with OCR on HIPAA for many years. She returns as Chair of the Southern California ISSA Health Care Privacy & Security Summit for the third year in 2016, as well as speaks and serves on the steering committee of a multitude of other programs.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE; Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Counsel, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients, serves on the faculty and planning committee of many workshops, seminars, and symposia, and on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or the Stamer│Chadwick │Soefje PLLC or contact Ms. Stamer via email to here or via telephone to (469) 767-8872.

REGISTRATION & PROGRAM DETAILS

Registration Fee per course is $75.00 per person. Registration Fee Discounts available for groups of three or more participants from the same organization. Limited opportunities for participation. Registration accommodated on a first come basis. Completed registration and payment required via website registration 48 hours in advance of the program. No checks or cash accepted. Persons not registered with completed payment at least 48 hours in advance will only participate subject to availability and completed registration and payment. Payment only accepted via website PayPal. Register Here!

The Webex will be conducted over the internet. Participants will receive access code and instructions for sign on to participate in the Webex and/or dial in to participate in the program via telephone after processing of completed registration. Participants must have access to a computer with internet access and to telephone access to dial in via telephone to participate in the program. Solutions Law Press, Inc. is not responsible for any interruption or interference in participation resulting from limitations in the internet connectivity, computer, telephone or other equipment used by the participant to access and participate in the program.

ABOUT SOLUTIONS LAW PRESS, INC.™

Solutions Law Press, Inc.™ provides business and management information, tools and solutions, training and education, services and support to help organizations and their leaders better anticipate legal and operational issues impacting their organization’s performance, regulatory compliance and risk management, data and information protection and risk management and other key management objectives. Solutions Law Press, Inc.™ also conducts and assist businesses and associations to design, present and conduct customized programs and training targeted to their specific audiences and needs. For additional information about upcoming programs, to inquire about becoming a presenting sponsor for an upcoming event, e-mail your request to info@Solutionslawpress.com. These programs, publications and other resources are provided only for general informational and educational purposes, the applicability of which to any particular circumstances may be impacted by legal changes, the specific facts and circumstances or other factors. Consequently, neither the distribution or presentation of these programs and materials to any party nor any statement or information provided in or in connection with this communication, the program or associated materials are not intended to or shall not be construed as establishing an attorney-client relationship, to constitute legal advice or a substitute for legal advice, or otherwise provide any assurance or expectation from Solutions Law Press, Inc., the presenter or any related parties that any participant or any other party can rely upon the information or any statements presented herein. If you or someone else you know would like to receive future Alerts or other information about developments, publications or programs or other updates, send your request to info@solutionslawpress.com. If you would prefer not to receive communications from Solutions Law Press, Inc. send an e-mail with “Solutions Law Press Unsubscribe” in the Subject to support@solutionslawyer.net. CIRCULAR 230 NOTICE: The following disclaimer is included to comply with and in response to U.S. Treasury Department Circular 230 Regulations. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN. If you are an individual with a disability who requires accommodation to participate, please let us know at the time of your registration so that we may consider your request. ©2016 Solutions Law Press, Inc.

Leave a Comment » | Academic medicine, Ambulatory care, ASC, Childrens Health Insurance Program, Clinical pathway, Conditions of Participation, Consumer Driven Health Care, data breach, data security, DEA, Disease Management, DME, Doctor, drug treatment, E-Prescribing, Electronic Health Records, Electronic Medical Records, Employee Benefits, Employer, FACTA, Federal Health Center, Federal Sentencing Guidelines, Genetic Information, GINA, Health Care, Health Care Provider, Health Care Quality, health care reimbursement, Health IT, Health Plan, Health Plans, HIPAA, HIPAA Cyber Crime, HITECH Act, Home Health, Hospice, Hospital, hospitals, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, managed care, Meaningful Use, Medicare Advantage, Mental Heatlh, OCR, Outpatient, Peer Review, Pharmacy, Physician, Privacy, Psychiatric, substance abuse treatment, Technology, Telemedicine, Wellness | Tagged: Breach Notification, Data Breech, Employer, GINA, Health Care, Health insurer, Health Plan, Health Plans, HIPAA, HIPAA Privacy, HIPAA Security, Hospital, Medical Privacy, PHI, Physician, Protected Health Information | Permalink
Posted by Cynthia Marcotte Stamer

OIG Modifies Past Ruling, Blesses Two New Medicare Co-Pay Financial Programs

January 4, 2016

Healthcare providers interested in or offering financial assistance with co-pays or other out-of-pocket charges to Medicare or Medicaid patients should review carefully two new and one modified opinion just published by the Department of Health and Human Services Office of Inspector General (OIG).

OIG generally interprets federal healthcare fraud laws as prohibiting healthcare providers from paying for or providing financial assistance with co-pay or other out-of-pocket costs for Medicare or Medicaid beneficiaries unless the arrangement Falls then an exemption approved by OIG.

In recent years the OIG increasingly has approved certain nearly defined co-pay or other financial assistance for him arrangements in a series of specific opinion letters. The three Advisory Opinions released today are the latest of these opinions. See Advisory Opinion 15-17 at http://go.usa.gov/c5ekz; Advisory Opinion 15-16 at http://go.usa.gov/c5e8C; and Modification of Advisory Opinion 06-04 http://go.usa.gov/c5e8W.

Healthcare providers reading these opinions must keep in mind the opinions only protect the parties who receive that opinion; other parties interested in offering financial assistance to Medicare or Medicaid beneficiaries with copayments or other out-of-pocket costs must get the OIG to issue them an opinion specifically blessing their proposed arrangement before moving forward to avoid risking triggering fraud enforcement.

While non parties cannot rely n opinions issued to others, health care providers offering or considering offering financial assistance carefully should review the guidance published in these opinions as a roadmap for designing and operating their own arrangements. Guidance in these opinions helps identify key criteria for qualification and enforcement.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years of experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Anti-KickBack, DME, Doctor, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, health care reimbursement, Home Health, Hospice, Hospital, Hospital, hospitals, Medicaid, Medicare, Medicare Fee Schedule, Medicare Fee Schedule, Medicare Prescription Drug Program, Money Laundering, Nonprofits, OIG, Outpatient, Pharmacy, Physician, Prescription Drugs, Stark, Uncategorized | Tagged: Fianancial Assistance, Fraud & Abuse, Health Care Fraud, OIG, Rebate, STARK | Permalink
Posted by Cynthia Marcotte Stamer

Health Care Fraud Prosecutions Target Owners, Operators & Other Leaders

December 11, 2015

Lengthy prison sentences imposed against the five former owners and operators convicted or having plead guilty to involvement in health care fraud schemes carried out by their various health care organizations in the first 10 days of December drive home the growing effectiveness of the Departments of Justice, Health & Human Services and other federal state agencies at investigating and prosecuting health care fraud. Owners, operators and other leaders of health care organizations should administer well documented health care fraud compliance and other defensive actions to avoid becoming one of these lessons as a result of their involvement with their own organizations.

Mississippi Hospice Owner Gets 36 Months

On December 4, 2015; U.S. Attorney; Northern District of Mississippi that the owner-operator of Millstone Hospice in Grenada, Mississippi, Sandra Livingston on January 25, 2016 will begin serving a 36 month prison sentence imposed by a Federal judge on December 3, 2015 as part of her punishment for her health care fraud conviction. In addition to her prison sentence, Ms. Livingston also must serve three years of supervised release and pay $1,098,639 in restitution to the Medicare program.

Ms. Livingston previously pled guilty on July 30, 2015 to conspiracy to commit healthcare fraud in violation of 18 U.S.C. §§ 1347 & 1349. Ms. Livingston admitted that while she owned and operated Milestone Hospice in Grenada, Mississippi, Millstone Hospice used patient recruiters to solicit patients that were not hospice appropriate and then received more than $1 million of Medicare payments for fraudulent charges for these services submitted to Medicare. In announcing the sentence, Donald Alway, Special Agent in Charge of the FBI in Mississippi said “This scheme is particularly sickening because the defendant charged Medicare over a million dollars in services for “treating” folks who have no idea they were on hospice because they weren’t at the end of the lives.”

Ms. Livingston’s conviction is the third conviction as part of a joint effort by the United States Attorney’s Office, the U.S. Department of Health and Human Services Office of Inspector General, the Federal Bureau of Investigation, the Mississippi Attorney General’s Medicaid Fraud Control Unit and targeting fraudulent hospice providers who have billed Medicare and Medicaid for medically unnecessary services.

Southern California Ambulance Company Owners & Management Combined 168 Months Sentence

Following the Livingston sentencing, the Justice Department on December 7, 2015 announced the sentencing of the former owner, operator and managers of a Southern California ambulance company for their role in a fraud scheme that resulted in more than $1.5 million in fraudulent claims to Medicare.

U.S. District Judge S. James Otero of the Central District of California sentenced Yaroslav Proshak, aka Steven Proshakof Valley Village, California to serve 108 months in prison. On December 2, 2015, Judge Otero sentenced Emilia Zverev of Van Nuys, California; and Sharetta Michelle Wallace of Inglewood, California, to serve 36 months and 24 months in prison, respectively. In addition to their prison terms, Judge Otero ordered Zverev and Wallace to pay restitution jointly and severally with Proshak in the amount of $804,755.

The sentences are imposed for health care fraud convictions obtained last summer. On August 18, 2015 a federal jury in Los Angeles convicted Proshak, Zverev and Wallace of one count of conspiracy to commit health care fraud and five counts of health care fraud. Zverev and Wallace worked for ProMed Medical Transportation, an ambulance transportation company owned and operated by Proshak in the greater Los Angeles area that provided non-emergency services to Medicare beneficiaries, many of whom were dialysis patients. Zverev was the billing manager and Wallace supervised the ProMed EMTs.

The evidence at trial showed that between May 2008 and October 2010, the defendants conspired to bill Medicare for ambulance transportation services for individuals that did not need such services. The defendants also instructed ProMed EMTs to conceal the patients’ true medical conditions by altering paperwork and creating fraudulent documents to justify the services. During the course of the conspiracy, ProMed submitted at least $1.5 million in false and fraudulent claims to Medicare for medically unnecessary transportation services; Medicare paid at least $804,755 on those claims.

Pharmacy Owner Gets 108 Months Sentence

Subsequently on December 10, 2015, the Justice Department announced that U.S. District Judge Donald M. Middlebrooks sentenced Daniel Suarez to 108 months in prison, followed by three years of supervised release and ordered Suarez to pay $20,988,632 in restitution for pleading guilty to one count of conspiracy to commit health care fraud and wire fraud, in violation of Title 18, United States Code, Section 1349.

According to the court record, Suarez and his co-conspirators were the owners of eight separate pharmacies that submitted and caused the submission of false and fraudulent claims to Medicare that they provided pharmaceutical drugs pursuant to properly written prescriptions when, in fact, such items were not properly prescribed or actually provided to Medicare beneficiaries. This fraud was accomplished in part by the use of a number of patient recruiters who received kickbacks in return for referring Medicare Part D beneficiaries to the eight separate pharmacies that Suarez controlled. These patient recruiters then purchased the prescriptions for the medically unnecessary pharmaceutical items that the pharmacies billed to Medicare. Suarez placed the pharmacies he controlled in the names of co-conspirator family members. In total, Suarez and his co-conspirators submitted and caused the submission of more than $20 million in false claims to the Medicare Part D program. Suarez used the fraudulently obtained proceeds to benefit himself and his family, including the purchase of luxury automobiles (i.e.: a Rolls Royce Ghost, Bentley, Range Rover and Mercedes Benz S63 AMG).

Like the lengthy and ever growing list of convictions and sentencings of other owners, operators, management, marketing representatives and others charged with involvement in health care fraud, these sentences drive home the commitment and effectiveness of the Justice Department, the Department of Health & Human Resources Office of Inspector General, and other federal and state agencies to investigating and prosecuting health care organizations and their leaders or others acting on their behalf to inappropriately bill or otherwise defraud Medicare, Medicaid or other federal health care programs. These convictions and settlements are intended to and should send a strong message to other health care organizations and their owners, leaders and other representatives about the need to exercise care to avoid wrongful or questionable billing for health care services. As reflected in these prosecutions and sentences, health care organizations found guilty of engaging in health care fraud can expect crippling if not fatal restitution requirements, Medicare and other federal program participation exclusion and other serious consequences. However, these stiff organizational sanctions pale to the prison sentences, program exclusion, restitution and other punishment that individual owners, operators, management, and marketing or other staff generally incur when convicted of these schemes. In light of the heavy handed interpretation and enforcement of federal and state health care fraud rules, health care organization owners, operators, and others involved in the marketing, billing, delivery, recruitment or other elements of health care billed to Medicare, Medicaid or other public or private health care programs should exercise care both to verify that their practices comply with applicable requirements and that they carefully preserve the necessary documentation and other evidence to defend the actions of themselves and their organizations.

With health care fraud enforcement a key component of the federal government’s efforts to bring down health care costs and the continuing success of federal and state health care fraud investigation and enforcement efforts like those already achieved by the Justice Department against the 12 defendants that already pleaded guilty, health care providers providing substance abuse or other treatments reimbursed by federal or state programs should must ensure that their care and billings are appropriately delivered and documented to withstand almost inevitable government scrutiny of their operations and activities.

For More Information Or Assistance

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

Examples of some of these recent health care related publications include:

Leave a Comment » | Anti-KickBack, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Home Health, Hospice, Hospital, hospitals, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Excluded Nurse, Husband Face Decades Imprisonment on $80M Home Health Fraud Convictions

November 17, 2015

The November 12, 2015 jury verdict followed a more than four week trial in the U.S. District Court for the District of Columbia during which Federal prosecutors charged Mr. & Mrs. Bikundi raided the Medicaid program of $80 million through massive and systematic fraud of a four year period and used the proceeds of this fraud to finance a lavish lifestyle, including a million-dollar home, a $140,000 Land Rover, a $120,000 Porsche, and a $75,000 Mercedes Benz.

According to evidence presented at trial, Ms. Bikundi, a former nurse, and her husband owned Global Healthcare, Inc. According to the government’s evidence, Ms. Bikundi not entitled to take part in the Medicaid program under her maiden name of Florence Igwacho but concealed that exclusion and fraudulently got approval as a provider by using her married name to apply for participation. Then, the government’s evidence showed, she and her husband led a scheme to bill Medicaid for services that never were provided – recruiting others, including family members, into the scam, and creating fraudulent paperwork to hide the illegal activity.

The D.C. Medicaid program is funded jointly by District of Columbia tax dollars and federal tax dollars. Medicaid provides for home care services to be performed by personal care aides, working for eligible home care agencies. Doctors or advanced practice registered nurses must examine beneficiaries and authorize them to receive these services. The aides are to follow a plan of care and assist Medicaid beneficiaries in performing activities of daily living, such as getting in and out of bed, bathing, dressing, keeping track of medication, and so forth.

In 1999, Ms. Bikundi went by her maiden name of Florence Igwacho. In August 1999, the Virginia Board of Nursing revoked the nursing license of Florence Igwacho. In March 2000, the U.S. Department of Health and Human Services, Office of Inspector General notified Florence Igwacho in writing that she was excluded from participation in Medicare, Medicaid, and all federal health care programs due to the revocation.

Florence Bikundi subsequently concealed her past – namely, the Medicaid exclusion and the revocation of her nursing license – when she applied for a Medicaid provider number for Global Healthcare in June 2009 using the name of Florence Bikundi. She also used three forged signatures on her Medicaid provider application. Florence Bikundi married Michael Bikundi in September 2009.

From August 2009 through February 2014, Florence and Michael Bikundi used Global HealthCare to carry out a massive fraud, the government’s evidence showed. Year after year, the D.C. Medicaid program was billed for personal home health aide services that were not provided to Medicaid beneficiaries. Phony time sheets, patient files and employment files were created. Global Healthcare generated increasing amounts of payments as the years continued, going from roughly $1.35 million in 2009 to $14.27 million in 2011 to $27.16 million in 2013.

According to the government’s evidence, the Bikundis used the proceeds to finance a lavish lifestyle. In just over three years, they spent $1.3 million to purchase and renovate a newly built home. They also used the proceeds for a $140,000 Land Rover, a $120,000 Porsche, a $75,000 Mercedes Benz, a $70,000 Cadillac and a $36,000 BMW.

The Bikundis were among 25 people charged in February 2014 after a wide-ranging investigation conducted by the FBI’s Washington Field Office; the U.S. Department of Health and Human Services, Office of Inspector General; the U.S. Secret Service; the Medicaid Fraud Control Unit of the District of Columbia’s Office of the Inspector General; the Internal Revenue Service-Criminal Investigation; the U.S. Immigration and Customs Enforcement (ICE) Office of Homeland Security Investigations (HSI); the Office of Labor Racketeering and Fraud Investigations, Office of Inspector General, Department of Labor; the Social Security Administration, Office of Inspector General, and the Medicaid Fraud Control Unit of the Maryland Attorney General’s Office with the assistance of the District of Columbia’s Department of Health Care Finance and other agencies uncovered what the Justice Department describes as “numerous, separate schemes involving fraud, kickbacks, and false billings in the growing field of home care services for D.C. Medicaid beneficiaries.” So far, 23 defendants including Florence Bikundi’s son, and Florence Bikundi’s two sisters as well as others who worked as personal care aides in the home care industry, patient recruiters who demanded money for access to Medicaid beneficiaries or in other capacities have either pled guilty or been found guilty of charges.

For More Information Or Assistance

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

Examples of some of these recent health care related publications include:

Leave a Comment » | Health Care Finance, Health Care Provider, health care reimbursement, Medicaid, Medicare, Uncategorized | Tagged: excluded provider, Health Care Fraud, Medicaid | Permalink
Posted by Cynthia Marcotte Stamer

Practitioners Act Now To Request Review of 2016 Value Modifiers Now

November 10, 2015

The Center for Medicare & Medicaid Services (CMS) announced today that’s the for requesting in formal review of the 2016 Value Modifier is open now and ends November 23, 2015.

The 2014 Annual Quality and Resource Use Reports (QRURs) are now available for every group practice and solo practitioner nationwide. Groups and solo practitioners are identified in the QRURs by their Taxpayer Identification Number (TIN). The QRURs are also available for groups and solo practitioners that participated in the Medicare Shared Savings Program, the Pioneer Accountable Care Organization (ACO) Model, or the Comprehensive Primary Care initiative in 2014, and to those TINs consisting only of non-physician EPs.

The 2014 Annual QRURs show how groups and solo practitioners performed in 2014 on the quality and cost measures used to calculate the 2016 Value Modifier. For groups with 10 or more EPs that are subject to the 2016 Value Modifier, the QRUR shows how the Value Modifier will apply to physician payments under the Medicare Physician Fee Schedule (PFS) for physicians who bill under the group’s TIN in 2016. For all other groups and solo practitioners, the QRUR is for informational purposes only and will not affect their payments under the Medicare PFS in 2016.

Authorized representatives of group and solo practitioners can access the 2014 Annual QRURs on the CMS Enterprise Portal using an Enterprise Identify Data Management (EIDM) account with the correct role. For more information on how to access the 2014 Annual QRURs, visit How to Obtain a QRUR.

Additional information about the 2014 QRURs and how to request an informal review is available on the 2014 QRUR website and through the QRUR Help Desk at pvhelpdesk@cms.hhs.gov or 888-734-6433 (select option 3).

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here.THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Doctor, Evidence Based Medicine, Health Care Finance, Health Care Provider, Health Care Quality, Medicare, Medicare Advantage, Medicare Fee Schedule, Physician, Reimbursement, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Tex Docs Urged To Support Medical Board Reforms

May 5, 2015

The Association of Physicians and Surgeons is urging Texas physicians and others concerned about facing a potential licensing board disciplinary action in Texas to urge the Texas Legislature to enacted SB 1813, which would end confidential complaints against physicians and provide access to other information.
SB 1813 would amend the required notice requirements for licensing board actions by the Texas Medical Board to require that the Board:
Notify a physician subject to a Board complaint of the filing of the complaint
Provide the physician a full copy of the complaint, without redaction, and a statement of the alleged violation in plain language

Require the Board to deliver a copy of the preliminary and final reports, including any dissenting or minority report, to the physician who is the subject of the review.
Provide the name and medical credentials of each physician who files an expert report to the physician under review.
Although opposed by the Texas Medical Association and Texas Hospital Association, the majority of the Texas Senate Health & Human Services Committee voted in favor of S.B. 1813.

Expanding medical regulation and expectations are driving up the standards physicians are expected to meet. Meanwhile reimbursement is declining and competition is increasing. These and other changes make physicians at risk not only for discipline for legitimate quality issues as well as allegations of billing fraud, disruptive conduct and a host of other highly subjective charges. Frequently these charges are made by competitors or others with agendas other than traditional quality. Not being able to identify and confront their accuser is viewed by many physicians as a major impediment to defending themselves.

Effective defense is critical. The Texas Medical Board is known for its heavy handed investigation and discipline. Discipline by a licensing board or peer review organization results among other things in reports to the Health Care Quality Data Bank, loss or restrictions on privileges, licenses, employment or a combination of these, great expense, lost income, embarrassment and more.

Timely access to information and records is viewed by many as one small piece of the puzzle that many physicians believe would help doctors understand and defend against charges. Physicians or others that support this change should communicate their support to their elected representatives and others in the Texas Legislature as soon as possible.

Leave a Comment » | Evidence Based Medicine, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Qulity, Hospital, Licensing, Peer Review, Physician, Physician Licensing, Uncategorized | Permalink
Posted by Cynthia Marcotte Stamer

Former National Quality Forum Committee Co-Chair Pays $1M, Excluded From Medicare In Fraud Settlement

March 5, 2015

A former National Quality Forum Committee Safe Practices Co-Chair landed in hot water under the False Claims Act for receiving compensation to use his influence and position to influence safety practices standards. Patient safety consultant Dr. Charles Denham, will pay $1 million to settle Justice Department allegations that he violated the False Claims Act by soliciting and accepting kickbacks while he co-chaired the Safe Practices Committee 2009 and 2010, according to a Justice Department announcement. The consulting company Health Care Concepts Inc. and the research organization Texas Medical Institute of Technology, operated by Denham both also are parties to the settlement.

With physicians and other health care organizations increasingly stepping up involvement in credentialing organizations and government advisory and other task forces, the enforcement action highlights another area where health care organizations and their people need to be careful to avoid violations of the False Claims Act or other laws. The settlement illustrates both the need for health care providers participating in HHS or other government advisory or other consulting roles to carefully evaluate their compensation and other arrangements for illegal remuneration or other prohibited elements in light of the continuing emphasis on and success of the Departments of Health & Human Services (HHS) and Justice in investigating and prosecuting arrangements they view as health care fraud under the Health Care Fraud Prevention and Enforcement Action Team (HEAT) initiative announced in 2009.

The charges against Denham resolved by the settlement stem from payments he and his companies received while he co-chaired the Safe Practices Committee. The Safe Practices Committee reviews, endorses and recommends standardized healthcare performance measures and practices. The settlement resolves allegations that, under agreements entered into in 2008, Denham received monthly payments from CareFusion Corporation while serving as the co-chair of the Safe Practices Committee. The Justice Department charged that Denham did not disclose to the committee, or any other individual or component of the National Quality Forum, that he was receiving payments from CareFusion while co-chairing the Committee and that Denham solicited and received these payments in exchange for influencing the recommendations of the National Quality Forum and for recommending, promoting and/or arranging for the purchase of CareFusion’s product, ChloraPrep, in violation of the Federal Anti-Kickback Statute. The United States alleged that this conduct caused the submission of false or fraudulent claims for ChloraPrep to federal health care programs.

In addition to paying $1 million to the United States, Dr. Denham and his two businesses will be excluded from Medicare, Medicaid and all federal health programs as part of the settlement.

The settlement highlights another example of the widespread success HHS, the Justice Department and other agencies participating in the HEAT initiative in using the False Claims Act against doctors, hospitals and other health care providers and organizations. Since January 2009, the Justice Department reports recovery of more than $23.8 billion through False Claims Act cases, with more than $15.2 billion of that amount recovered in cases involving fraud against federal health care programs. With HHS and the Justice Department claiming it recovers an average return of $8 for each $1 invested in health care fraud enforcement, the enforcement initiative is a key player in Federal efforts to control and reduce federal health care expenditures. The Obama Administration tout the success of these efforts to fuel Congressional and public support for continuation and expansion of these and other health care fraud enforcement efforts by HHS, the Justice Department and other agencies.

“Kickback schemes undermine the integrity of medical decisions, subvert the health marketplace and waste taxpayer dollars,” said Acting Assistant Attorney General Benjamin C. Mizer of the Justice Department’s Civil Division. “Doctors and other health care professionals who accept illegal inducements undermine the public’s trust in federal health care programs and will continue to be the focus of our enforcement efforts

Given the success of the programs and the HEAT agencies commitment to continuing their heavy-handed enforcement efforts, physicians, hospitals, skilled nursing, home health, durable medical equipment, and other health care providers and their leaders should stay ever diligent in their efforts to maintain compliance and other necessary defenses in anticipation of government scrutiny of their operations and activities. As part of these efforts, health care providers and organizations serving on advisory task forces or committees to government agencies or to credentialing or standard settling organizations that provide input on regulatory, standard setting or other activities need to use special care to ensure that any potential conflicts of interest are properly identified and disclosed and that the arrangements otherwise are structured and conducted to avoid violations of both the Anti-Kickback and other health care fraud laws and lobbying, conflict of interest and other laws, regulations and policies applicable to those activities.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here.THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

1 Comment | Academic medicine, Accreditation, ADA, ASC, Corporate Compliance, Disability Discrimination, Discrimination, DME, Doctor, Durable Medical Equipment, Employer, Employment, Employment law, Federal Health Center, Health Care, Health Care Provider, Home Health, Hospital, Hospital, Medicare, Medicare Advantage, Medicare Fee Schedule, Mental Heatlh, OCR, Physician, Rehabilitation Act, Veterans Health | Tagged: Anti-Kickback, Health Care Fraud, HEAT, HHS, Illegal Remuneration, Medicare Exclusion, National Quality Forum, Physician | Permalink
Posted by Cynthia Marcotte Stamer

State Exchange Problems Added ACA Threat Regardless of SCOTUS Decision In King v. Burwell

March 3, 2015

While most Americans are familiar with the well-publicized issues and higher than projected premium costs of coverage offered to Americans enrolling in health care coverage through the federal healthcare marketplace Healthcare.gov created under the health care reforms of the Patient Protection & Affordable Care Act (ACA), many Americans are just beginning to recognize the growing problems and concerns emerging with state exchanges in those states that elected to enact their own exchange. As the Supreme Court prepares to hear arguments in the challenge to the payment of ACA subsidies to individuals in states that elected not to adopt a state-run health care exchangeto pay for coverage purchased through the federal healthcare.gov marketplace in King v. Burwell on Wednesday, March 4, 2015, the growing evidence of rapidly emerging funding and other challenges affecting state-run exchanges raise concerns about the solvency and reliability of coverage promised and purchased through those state-run exchanges. These state exchange funding difficulties create concerns not only for state lawmakers, but also for the health care providers and patients that are relying upon adequate funding to ensure that patients can receive promised care and coverage and the health care providers caring for these patients will receive promised payment for these services.

During the Congressional debates leading up to the enactment of ACA, for instance, ACA advocates touted the Massachusetts health care mandates and reform law of Massachusetts as part of the model for ACA and evidence of the potential benefits offered by enactment of ACA. Now Massachusetts officials are blaming ACA for serious underfunding and other problems in their state’s health care connector.

Massachusetts Governor Charlie Baker recently cited the Health Connector and its challenges in enrolling Massachusetts residents in health insurance plans as part of the Affordable Care Act that forced the state to temporarily transition hundreds of thousands of state residents into the commonwealth’s Medicaid program as a primary reason for the state’s projected $1.5 billion budget deficit. He now has asked for the resignations of four Massachusetts Health Connector board members: MIT professor Jonathan Gruber, Covered California actuarial consultant John Bertko; Massachusetts Nonprofit Network CEO Rick Jakious and Spring Insurance Group CEO George Conser.

The Massachusetts experience is not unique. Other states also are experiencing significant funding and other problems dealing with the ACA mandates and implementation. See, e.g., Funding Woes Imperil Future of State Run Exchanges; State Insurance Exchanges Face Challenges In Offering Standardized Choices Alongside Innovative Value-Based Insurance.

This mounting evidence of serious cost, financing and other concerns in state-run exchanges creates new reason for concern about the future of ACA’s health care reforms even for those citizens of states whose eligibility for subsidies is not challenged by the King v. Burwell Supreme Court challenge. These state exchange funding difficulties create concerns not only for state lawmakers, but also for the health care providers and patients that are relying upon adequate funding to ensure that patients can receive promised care and coverage and the health care providers caring for these patients will receive promised payment for these services.These and other budget overruns and operational challenges raise serious questions about the ability of the federal government or the states to fund the promises currently made by ACA in its present form. Congress and state governments almost certainly will be forced to deal with these broader challenges regardless of the outcome of King v. Burwell. As American leaders continue to struggle to deal with these and other mounting problems impacting the U.S. health care system, the input of individual Americans and businesses and community leaders is more critical than ever. Get involved in helping to shape improvements and solutions to the U.S. health care system and the Americans it cares for by sharing your ideas and input through the Coalition For Responsible Health Care Policy and exchanging information and ideas for helping American families deal with their family member’s illnesses, disabilities and other healthcare challenges through Project COPE: Coalition for Patient Empowerment here.

About Project COPE: The Coalition On Patient Empowerment & Coalition on Responsible Health Policy

Do you have ideas or experiences to share about medical debit, ACA or other health care challenges? Have ideas for helping improve ACA and other health care policies impacting the US health care system, helping Americans cope with these and other health care challenges or other health care matters? Know other helpful resources or experiences that you are willing to share? Are you concerned about health care coverage or other health care and disability issues or policy concerns? Join the discussion and share your input by joining Project COPE: Coalition for Patient Empowerment here.

Sharing and promoting the use of practical practices, tools, information and ideas that patients and their families, health care providers, employers, health plans, communities and policymakers can share and offer to help patients, their families and others in their care communities to understand and work together to better help the patients, their family and their professional and private care community plan for and manage these needs is the purpose of

The Coalition and its Project COPE arise and operate on the belief that health care reform and policy must be patient focused, patient centric and patient empowering. The best opportunity to improve access to quality, affordable health care for all Americans is for every American, and every employer, insurer, and community organization to seize the opportunity to be good Samaritans. The government, health care providers, insurers and community organizations can help by providing education and resources to make understanding and dealing with the realities of illness, disability or aging easier for a patient and their family, the affected employers and others. At the end of the day, however, caring for people requires the human touch. Americans can best improve health care by not waiting for someone else to step up: Step up and help bridge the gap when you or your organization can. Speak up to help communicate and facilitate when you can. Building health care neighborhoods filled with good neighbors throughout the community is the key.

The outcome of this latest health care reform push is only a small part of a continuing process. Whether or not the Affordable Care Act makes financing care better or worse, the same challenges exist. The real meaning of the enacted reforms will be determined largely by the shaping and implementation of regulations and enforcement actions which generally are conducted outside the public eye. Americans individually and collectively clearly should monitor and continue to provide input through this critical time to help shape constructive rather than obstructive policy. Regardless of how the policy ultimately evolves, however, Americans, American businesses, and American communities still will need to roll up their sleeves and work to deal with the realities of dealing with ill, aging and disabled people and their families. While the reimbursement and coverage map will change and new government mandates will confine providers, payers and patients, the practical needs and challenges of patients and families will be the same and confusion about the new configuration will create new challenges as patients, providers and payers work through the changes.

We also encourage you and others to help develop real meaningful improvements by joining Project COPE: Coalition for Patient Empowerment here by sharing ideas, tools and other solutions and other resources. The Coalition For Responsible Health Care Policy provides a resource that concerned Americans can use to share, monitor and discuss the Health Care Reform law and other health care, insurance and related laws, regulations, policies and practices and options for promoting access to quality, affordable healthcare through the design, administration and enforcement of these regulations.

You also may be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here such as:

You also can find out about how you can arrange for training for you, your employees or other communities to participate in training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include employers and their health and other employee benefit plans, public and private health care providers, health insurers, plan fiduciaries and service providers, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here.THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Health Care Employer’s Discrimination Triggers Medicare, EEOC Prosecutions

March 2, 2015

Health care employers and organizations should review and tighten their employment and other discrimination policies and risk management in light of recent employment discrimination enforcement actions targeting health care organization staffing decisions by the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) and the Equal Employment Opportunity Commission.

OCR Race Discrimination Medicare Action

A new OCR Voluntary Resolution Agreement with Shiawassee County Medical Facility reminds health care providers of the frequently underappreciated Medicare/Medicaid program participation risks of certain types of employment discrimination to be careful not to allow patient preferences to lead them into the trap of violating the prohibition against race, color, and national origin under Title VI of the Civil Rights Act of 1964 or other federal nondiscrimination laws when making patient staffing assignments.

Title VI of the Civil Rights Act prohibits discrimination in the administration of any federally-funded program based on race, color, or national origin. OCR’s longstanding “Guidelines for Compliance of Hospitals with Title VI of the Civil Rights Act of 1964,” make clear that OCR interprets Title VI prohibits assignment of hospital staff based on the racial preference of the patient.

A newly announced OCR investigation and Resolution Agreement Shiawassee County Medical Care Facility, a 136-bed Medicare and Medicaid certified skilled nursing facility, illustrates the need for Medicare and Medicaid certified health care providers of all types to ensure their compliance with Title VI and, in particular, to refrain from making any staff assignments based on racial considerations.

The Resolution Agreement between OCR and Shiawassee, a 136-bed Medicare and Medicaid certified skilled nursing facility, resolved charges that the facility violated Title VI by giving a nursing staff instruction to not assign African-American staff to a Caucasian Resident. Based on an investigation, OCR found Shiawassee needed to change its policies and procedures to bring them into full compliance with Title VI. To implement fully the prohibition against consideration of race in staff assignments, Shiawassee signed a with OCR which calls for the appointment of a Title VI Coordinator to oversee Shiawassee’s overall compliance with Title VI including special responsibilities for the investigation and adjudication of any Title VI complaints filed internally with Shiawassee. In addition, Shiawassee must train its workforce on Title VI, and submit reports to OCR regarding compliance.

The Shiawassee charges and Resolution agreement follow a similar Agreement in August 2014 between OCR and Hurley Medical Center in Flint, Michigan , which also resolved OCR charges arising from that facilities staff assignment based on a patient’s racial preference. Read the Hurley Agreement here.

Phoenix EEOC ADA Discrimination Action

The HHS against Shiawassee enforcement action coincides with an Equal Employment Opportunity Commission (EEOC) announcement of its filing of disability discrimination lawsuit under the Americans With Disabilities Act (ADA) against another health care provider, ValleyLife of Phoenix, Arizona. EEOC charges that ValleyLife engaged in illegal disability discrimination in violation of the ADA when it allegedly fired employees with disabilities instead of providing them with reasonable accommodations when their eligibility for family leave ended under the Family & Medical Leave Act ended and allegedly failed to keep employees’ medical records confidential. See EEOC v. ValleyLife, Civil Action No. 2:15-cv-00340-GMS (N.Az).

In EEOC v. ValleyLife, the EEOC charges that ValleyLife fired employees with disabilities rather than provide them with reasonable accommodations due to its inflexible leave policy. The policy compelled the termination of employees who had exhausted their paid time off and/or any unpaid leave to which they were eligible under the Family Medical Leave Act (FMLA). According to the EEOC, ValleyLife fired supervisor, Glenn Stephens, due to his need for further surgery when his FMLA leave eligibility ended. EEOC claims this termination violated the ADA because ValleyLife did not engage in any interactive process to determine whether any accommodations (including additional leave) were possible. Stephens had worked for ValleyLife for over ten years at the time of his termination. The EEOC contends that ValleyLife’s failure to offer extended leave or other accommodation to Stephens when his leave eligibility ended violated the ADA, which protects workers from discrimination based upon disability and requires employers to provide reasonable accommodations to the known physical or mental impairments of disabled employees unless doing so would cause an undue hardship.

The suit also alleges that ValleyLife commingled medical records in employee personnel files and failed to maintain these medical records confidential in violation of the medical record confidentiality requirements of the ADA, which requires employees’ to keep medical documents confidential and separate from other personnel records.

The lawsuit seeks lost wages and compensatory and punitive damages for the alleged victims, as well as appropriate injunctive relief to prevent discriminatory practices in the future.

Prepare Employment Discrimination Defenses

The OCR action against Shiawassee and the EEOC suit against ValleyLife remind health industry employers of the need to use care to monitor and manage employment discrimination risks. Health care organizations should avoid the temptation to assume that their organizations can rely upon patient preferences or other common industry concerns to defend against claims of disability, race or other discrimination. Instead, health care organizations should review and update their policies and practices to ensure that they properly comply with applicable employment and other federal and state disability discrimination law and are operationalized in a manner to create and keep appropriate documentation to defend staffing decisions against potential claims of illegal discrimination under the ADA, Civil Rights, or other laws that could adversely impact their organization’s eligibility to participate in Medicare, Medicaid or other federal programs, trigger judgments or penalties, or both.

Health care organizations also need to exercise care to ensure that their patient access, care and other policies also comply and are administered to withstand scrutiny under Medicare terms of participation, the ADA, the Civil Rights Act and other federal discrimination laws. These health industry employers should both evaluate their existing policies and practices, as well as their processes for conducting and documenting investigations and other activities associated with the administration of FMLA or other disability accommodation, patient and other staffing and other activities to position their organization to identify potential exposures and position themselves to defend their decisions against OCR, EEOC or other government agency investigations, private plaintiff claims or both.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here.THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Academic medicine, Accreditation, ADA, ASC, Corporate Compliance, Disability Discrimination, Discrimination, DME, Doctor, Durable Medical Equipment, Employer, Employment, Employment law, Federal Health Center, Health Care, Health Care Provider, Home Health, Hospital, Hospital, Medicare, Medicare Advantage, Medicare Fee Schedule, Mental Heatlh, OCR, Physician, Rehabilitation Act, Veterans Health | Permalink
Posted by Cynthia Marcotte Stamer

Health Care Providers, Provide ACO, Reimbursement Reform Input To HHS

March 2, 2015

Physicians, nurses, hospitals and other health care providers, patients and others concerned about health care reimbursement and other health care reforms in the United States should sign up and participate in the new Health Care Payment Learning and Action Network (“Network”) the Department of Health and Human Services (HHS) is creating to help shape ongoing reform of the US health care delivery system to promote better care, smarter spending, and healthier people through the expansion of new health care payment models and other reforms. HHS is inviting private payers, employers, providers, patients, states, consumer groups, consumers, and other partners within the health care community to register here to participate in the Network activities including kickoff event scheduled for Wednesday, March 25, 2015.

HHS hopes cooperation through the Network will help the entire U.S. health care system match and exceed the following HHS goals for Medicare:

Tying 30 percent of payments to quality or value through alternative payment models, such as Accountable Care Organizations (ACOs) or bundled payment arrangements by the end of 2016, and
Tying 50 percent of payments to alternative payment models by the end of 2018. The Network will also support the broader goal of tying the vast majority of payments in the health care system to quality or value.

As HHS moves forward to promote ACOs and other reforms, it is particularly important that providers and patients provide feedback and input about the goals and ideas HHS is promoting as solutions for “improving” health care. While HHS often touts consolidation of care into ACOs and other reimbursement strategies using government generated standards of quality as the best means of improving quality and cost-effectiveness, many patients, providers and others worry that HHS ACO and other reimbursement reforms as presently implemented or contemplated by HHS cut costs at the expense of patients by denying reimbursement or other access for effective care options based on cost or ignore other patient needs in the name of cost savings. Active, consistent participation in these and other opportunities for input is critical for those concerned about these and other issues to question and shape the goals, assumptions and actions HHS, Congress and others take to change the U.S. health care system.

HHS says most Network meetings will occur virtually by teleconference or webinar. In-person meetings will occur in the Washington D.C. area. HHS plans to hold the first live streaming of the kickoff event on Wednesday, March 25, 2015. HHS will share details through e-mails to those registered online to participate in the network. Individuals and organizations concerned about ACO and other HHS-lead health care reforms are urged to register and participate in the Network as one of the ways to help monitor and shape health care reform as lead by HHS.

About Project COPE: The Coalition On Patient Empowerment & Coalition on Responsible Health Policy

Do you have feedback or other experiences to share about medical debit, ACA or other health care challenges? Have ideas for helping improve our system, helping Americans cope with these and other health care challenges or other health care matters? Know other helpful resources or experiences that you are willing to share? Are you concerned about health care coverage or other health care and disability issues or policy concerns? Join the discussion and share your input by joining Project COPE: Coalition for Patient Empowerment here.

The Coalition and its Project COPE are founded and operate based on the belief that health care reform and policy must be patient focused, patient centric and patient empowering. The best opportunity to improve access to quality, affordable health care for all Americans is for every American, and every employer, insurer, and community organization to seize the opportunity to be good Samaritans. The government, health care providers, insurers and community organizations can help by providing education and resources to make understanding and dealing with the realities of illness, disability or aging easier for a patient and their family, the affected employers and others. At the end of the day, however, caring for people requires the human touch. Americans can best improve health care by not waiting for someone else to step up: Step up and help bridge the gap when you or your organization can. Speak up to help communicate and facilitate when you can. Building health care neighborhoods filled with good neighbors throughout the community is the key.

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources.

Examples of some of these recent health care related publications include:

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 26 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here.THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Leave a Comment » | Academic medicine, Affordable Care Act, Ambulatory care, Anti-KickBack, ASC, Border Health, Centers For Disease Control, Conditions of Participation, Consumer Driven Health Care, Disease Management, DME, Doctor, Durable Medical Equipment, Electronic Medical Records, Employer, Evidence Based Medicine, false claims act, FDA, Federal Health Center, Health Care, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Care Reform, Health Insurance Exchange, Health IT, Health Plan, Health Policy, Home Health, Hospital, Hospital, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Meaningful Use, Medicaid, Medical Licensure, Medical Malpractice, Medicare, Medicare Advantage, Medicare Fee Schedule, Medicare Fee Schedule, Medicare Prescription Drug Program, OIG, Outcomes Data, Patient Empowerment, Pharmacy, Physician, Prospective Payment, Public Policy, Rural Health Care, Stark, Telemedicine | Permalink
Posted by Cynthia Marcotte Stamer

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

HIPAA Update: The Latest On Security, Patient Access & Other HIPAA Developments

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Recent Posts

Archives

About Cynthia Marcotte Stamer

Share this blog

Archives

Solutions Law Press Health Care Update