retaliation |

One Door for Criminal Health Care Fraud Disclosures: DOJ’s Fraud Division and HHS-OIG Consolidate Self-Disclosure—and Close the SDP to Criminal Conduct

November 11, 2026

Health care providers, suppliers, manufacturers, Medicare Advantage organizations, and other participants in Federal health care programs that uncover potentially criminal billing, kickback, or excluded-person conduct inside their own operations now face a materially different—and less forgiving—self-disclosure roadmap.

On October 15, 2026, the Justice Department’s National Fraud Enforcement Division (“Fraud Division”) and the HHS Office of Inspector General (“HHS-OIG”) issued a joint Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters (the Policy), and HHS-OIG simultaneously updated its Health Care Fraud Self-Disclosure Protocol (“SDP”). See also the DOJ press release (Oct. 15, 2026).

The government touts the consolidation as offering simplification: a single qualifying voluntary self-disclosure to the Fraud Division’s Health Care Fraud Section now earns the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and the HHS-OIG SDP, with no duplicate submission through the OIG portal. The less-advertised—but arguably more consequential—change runs the other way. HHS-OIG has expressly closed the SDP to disclosure of Federal crimes, and a disclosure made only to HHS-OIG generally will not qualify as a voluntary self-disclosure to DOJ or support a CEP declination. For organizations that historically treated the SDP as the default first call, the choice of which door to knock on first now carries real criminal-exposure consequences.

What the Joint Policy Does

The Policy establishes the following core rules:

One disclosure, two sets of benefits. A company that makes a voluntary self-disclosure to the Health Care Fraud Section “within the meaning of the CEP,” relating to conduct involving a Federal health care program as defined in 42 U.S.C. § 1320a-7b(f), receives the benefits of the HHS-OIG SDP. Only one disclosure is required to obtain both CEP and SDP benefits. (Policy § I, ¶ 1; § III.A).
DOJ forwards the disclosure to OIG. The Health Care Fraud Section will promptly provide HHS-OIG a copy of the disclosure upon receipt. (Policy § III.B).
OIG-only disclosure generally does not count with DOJ. Consistent with footnote 5 of the CEP, a disclosure made only to HHS-OIG under the SDP generally does not qualify as a voluntary self-disclosure to the Fraud Division and generally will not satisfy the criteria for a Part I CEP declination. Such a disclosure may still be considered as part of a company’s cooperation and remediation credit. (Policy § I, ¶ 2; § III.C).
Good-faith disclosure to another DOJ component still qualifies. Quoting the CEP, the Policy confirms that good-faith disclosure to one DOJ component, where the matter is later brought to another appropriate component, also qualifies. (Policy n.3).
Effective date. The Policy applies to voluntary self-disclosures of potential criminal violations affecting one or more Federal health care programs made to the Fraud Division on or after October 15, 2026. (Policy § III.A).
Submission channel. DOJ directs self-disclosures to corporate.enforcement@usdoj.gov. (DOJ press release).

Important Limits Buried in the Footnotes

Several qualifications in the Policy should temper any expectation that a DOJ disclosure resolves everything:

Mandatory exclusion is not covered. The SDP benefits conferred through a DOJ disclosure do not include resolution of mandatory exclusion under 42 U.S.C. § 1320a-7(a). (Policy n.4). Organizations whose conduct could result in a conviction triggering mandatory exclusion must plan for that exposure separately.
Declination remains discretionary. Fraud Division prosecutors retain discretion to recommend a declination after weighing the severity of the circumstances against the company’s self-disclosure, cooperation, and remediation. (Policy n.5).
No enforceable rights. The Policy expressly disclaims creating any right or benefit enforceable at law or in equity. (Policy n.1).
The CEP’s definition controls. A disclosure qualifies only if it is made to the Fraud Division (or another qualifying DOJ component) and satisfies every element of the CEP’s definition of voluntary self-disclosure. (Policy § II.A; CEP).

What Changed in the Updated HHS-OIG SDP

HHS-OIG’s October 15, 2026 SDP update implements the Policy and makes several operational changes providers should note:

Federal crimes are now expressly ineligible. The SDP adds a fifth category of ineligible conduct: it is not available for disclosure of Federal crimes, which should be disclosed to DOJ. Any criminal disclosure that does come through the SDP will be referred to DOJ for resolution. (SDP §§ 2.C, 6).
The 90-day clock now runs from submission. Disclosing parties expected to complete their internal investigation and damages calculation now have 90 days from the date of the initial submission—not from acceptance into the SDP, as before. (SDP §§ 1.B, 3.A). This effectively front-loads the investigation and damages work before filing.
Benefits for qualifying civil/administrative matters remain. These include a presumption against requiring integrity agreement obligations in exchange for a release of permissive exclusion, a general minimum multiplier of 1.5 times single damages, and suspension of the 60-day overpayment report-and-return obligation under 42 U.S.C. § 1320a-7k(d) upon OIG’s acknowledgment of a timely submission (see 42 C.F.R. § 401.305(b)(2)(i)). (SDP § 1.B).
Minimum settlements are unchanged. OIG continues to require a $100,000 minimum settlement for kickback-related submissions and $20,000 for all others. (SDP § 8).
Physician self-referral-only conduct still goes to CMS. Arrangements implicating only the physician self-referral law, without accompanying Anti-Kickback Statute (AKS) exposure, remain outside the SDP and belong in CMS’s Self-Referral Disclosure Protocol. (SDP §§ 2.C, 7).

The Parallel Civil Track: The DOJ–HHS FCA Self-Disclosure Pilot Program

The Policy does not stand alone. DOJ’s Civil Division and HHS (the Office of the General Counsel, OIG, and CMS) have also launched a Healthcare Self-Disclosure Pilot Program (FCA SDPP), announced October 22, 2026, for potential False Claims Act violations previously unknown to the government (HHS press release (Oct. 22, 2026)). Key features include a coordinated civil release with no factual admissions; a repayment of 1.25–1.6 times a “Base Self-Disclosure Repayment”; no Corporate Integrity Agreement as part of any resolution of OIG’s permissive exclusion authorities; and CMS’s agreement not to impose civil monetary penalties or seek revocation in pilot resolutions. Submissions must be made to FCA-SDPP@usdoj.gov by 11:59 p.m. on April 22, 2027; late or partial submissions will not be reviewed. (FCA SDPP §§ II–III).

The FCA SDPP dovetails with the criminal Policy: it is limited to potentially civil conduct, routes potentially criminal conduct to the Fraud Division, and provides that a company that has made a qualifying criminal disclosure to the Fraud Division need not make a duplicative FCA SDPP submission, with supplementation requested only as needed if the company also seeks a civil FCA release. (FCA SDPP n.1).

Why the Timing Matters: A Rapidly Escalating Enforcement Environment

The Policy is one piece of a deliberate build-out. DOJ created the Fraud Division on April 7, 2026 (DOJ press release). On October 1, 2026, Assistant Attorney General Colin M. McDonald issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Then, on October 20, 2026, DOJ launched the Fraud Whistleblower Incentive Program (WHIP), which pays tipsters $10,000 to $30,000 upon the filing of criminal charges—rather than after final resolution—for information relating to Federal health care offenses and fraud on specified Federal programs. For health care, WHIP prioritizes hospice, home health care, day care, and special services fraud. (WHIP press release; WHIP terms).

The practical message is unmistakable: employees, contractors, and business partners now have a faster financial incentive to go directly to DOJ, while the window in which an organization can still claim a voluntary disclosure is shrinking. Delay spent debating where to disclose—or defaulting to an OIG-only filing for conduct that may be criminal—can forfeit declination eligibility altogether.

Analysis: The Hard Part Is the Triage

The Policy simplifies where to file once an organization concludes conduct may be criminal. It does not simplify the threshold judgment itself. The same arrangement—an illegal remuneration arrangement, billing for medically unnecessary services, or employment of an excluded person—can support criminal, civil FCA, and administrative CMP theories simultaneously, and the government’s own documents describe these as overlapping. Organizations should expect the following pressure points:

Criminal versus civil characterization. The AKS is a criminal statute that also triggers CMP and FCA liability. An organization that characterizes knowing kickback conduct as purely civil and files only with OIG risks losing CEP credit if DOJ later views the conduct as criminal.
Required admissions. The SDP requires disclosing parties to acknowledge a potential violation and identify the specific laws implicated; equivocal statements can lead to removal. (SDP § 2.B). Counsel must coordinate these acknowledgments with criminal exposure analysis before anything is filed with any agency.
Individuals are not protected by the entity’s disclosure. The Policy and CEP address corporate resolutions. Executives, physicians, and employees involved in the conduct may have separate and divergent interests, which raises Upjohn-warning, separate-counsel, and indemnification/advancement questions.
Employment-law crosscurrents. Internal reporters may simultaneously be WHIP tipsters or potential qui tam relators. Discipline or termination decisions involving anyone connected to the reported conduct must be reviewed for retaliation exposure, including under the FCA’s anti-retaliation provision, 31 U.S.C. § 3730(h).
The 60-day overpayment suspension may not travel with a DOJ-first disclosure. CMS’s regulation suspends the Medicare Part A/B report-and-return deadline only when (i) OIG acknowledges receipt of an SDP submission, (ii) CMS acknowledges receipt of a Self-Referral Disclosure Protocol submission, (iii) the provider requests an extended repayment schedule, or (iv) the provider is conducting a timely, good-faith investigation of related overpayments—a suspension that ends no later than 180 days after the initial overpayment was identified. (42 C.F.R. § 401.305(b)(2)–(3)). A disclosure to DOJ is not among the listed triggers. Neither the Policy nor the updated SDP addresses how the suspension applies when the Health Care Fraud Section forwards a disclosure to OIG and no SDP submission is made; the SDP continues to describe the suspension as arising when OIG acknowledges receipt of an SDP submission. (SDP § 1.B). When CMS adopted the regulation, it reportedly declined commenters’ requests to extend the suspension to disclosures made to DOJ or Medicaid Fraud Control Units. (81 Fed. Reg. 7654 (Feb. 12, 2016)). [verify pin cite for the DOJ/MFCU comment response in the 2016 preamble] The regulation also covers only Medicare Parts A and B; the statutory 60-day obligation for Medicaid overpayments under 42 U.S.C. § 1320a-7k(d) has no corresponding regulatory suspension. Until DOJ, OIG, or CMS speaks to the question, a DOJ-first discloser should not assume the SDP’s overpayment suspension attaches automatically.
Precaution: As of November 11, 2026, we found no DOJ, HHS-OIG, or CMS guidance on whether the 60-day overpayment suspension applies when a disclosure goes to DOJ first. As written, the regulation does not cover that route. (42 C.F.R. § 401.305(b)(2)). Organizations disclosing to the Fraud Division should not assume the suspension applies and should plan for the 60-day report-and-return obligation accordingly.

Action Items by Stakeholders

Boards and senior leadership should:

Obtain training or education about Federal Sentencing Guidelines organizational and person exposure for criminal actions and best practices for preventing and mitigating these risks.
Confirm that the organization’s disclosure-decision framework assigns clear authority and timelines for deciding whether, when, and where to disclose, and that it reflects the DOJ-first rule for potentially criminal conduct.
Require periodic reporting on hotline volume, investigation aging, and disclosure decisions, recognizing that WHIP compresses the time available to act voluntarily.

Compliance Officers should:

Update self-disclosure policies, investigation protocols, and escalation matrices that currently direct federal program issues to the OIG SDP by default.
Build a documented triage step that screens every substantiated matter for potential criminal exposure before choosing among the Fraud Division, the OIG SDP, the CMS SRDP, the FCA SDPP, or a routine contractor refund.
Refresh exclusion screening (including full-workforce LEIE screening, which the SDP requires before disclosing an excluded-person matter) and AKS arrangement reviews, particularly in hospice, home health, and day care service lines that WHIP prioritizes. (SDP § 3.C).

General Counsel should work with qualified outside counsel to:

Tighten compliance controls and documentation.
Structure internal investigations under privilege from the outset, with criminal-exposure assessment by counsel experienced in DOJ health care fraud matters.
Calendar the FCA SDPP’s April 22, 2027 deadline for potentially civil-only matters, and evaluate whether any pending matters should be routed through the Fraud Division to capture both CEP and SDP benefits.
Assess mandatory-exclusion risk separately, as the Policy does not resolve it.
For DOJ-first disclosures involving quantified Medicare or Medicaid overpayments, request written confirmation from the Health Care Fraud Section and HHS-OIG at the time of disclosure as to whether OIG will treat the forwarded disclosure as an acknowledged SDP submission for purposes of 42 C.F.R. § 401.305(b)(2)(i). Absent confirmation, track the 180-day investigation suspension and evaluate, in coordination with the government, whether to return quantified overpayments through the MAC or an extended repayment schedule; OIG credits pre-resolution refunds toward settlement but is not bound by amounts repaid outside the SDP. (SDP § 10).

Human Resources should work with employment counsel experienced with health care and other Federal Sentencing Guidelines risk management to:

Strengthen training and compliance oversight and enforcement.
Tighten internal reporting channels and non-retaliation messaging so employees see internal reporting as credible and safe.
Route any adverse employment action involving a reporter, witness, or implicated employee through legal review before implementation, and ensure investigation interviews include appropriate Upjohn warnings.
Review separation, confidentiality, and release templates to confirm they do not purport to restrict reporting to government agencies.

Billing, Revenue Cycle, and Finance leaders should:

Preserve claims, payment, and arrangement data needed to support the SDP’s damages methodologies (including statistically valid sampling of at least 100 items) or the FCA SDPP’s Base Self-Disclosure Repayment. (SDP § 3.B; FCA SDPP § II).
Coordinate any overpayment refunds with counsel before processing, since repayments outside the SDP do not bind OIG and may affect the disclosure strategy. (SDP § 10).

Bottom Line

For potentially criminal health care conduct, the default first call is now DOJ’s Fraud Division, not HHS-OIG. The Policy reduces duplication for organizations that get the triage right, but it raises the cost of getting it wrong. Health care organizations should update their disclosure frameworks now, before a hotline report or a WHIP tip forces the decision on a compressed timeline.

For Help or More Information

The author of this update, Cynthia Marcotte Stamer has decades of experience advising and assisting health industry clients to design, audit, and defend their organizations and practices including conducting audits and investigations, designing and updating compliance and risk management programs, responding to government investigations, conducting transaction, governance, and other due diligence, and assisting with other legal and operational compliance and risk management and legislative and regulatory affairs. She is available to assist your organization in assessing the impact of these developments and navigating the compliance and strategic steps that follow. For more information about these or other health care, managed care and other health benefits, or other health industry laws or concerns, contact Ms. Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

Peer recognized as “Top Rated Lawyer” and “LEGAL LEADER™ “Top Rated Lawyer” and “Best Lawyer” for her work in Health Care Law, Labor and Employment Law; ERISA & Employee Benefits,” and “Business and Commercial Law,” Cynthia Marcotte Stamer is an A Martindale-Hubble “AV-Preeminent” (Top 1%) attorneys board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on PBM, pharmacy and pharmaceutical and other health care, managed care, insurance, and insured and self-insured contracting, design, administration and regulation..

Author of numerous highly regarded works on health care fraud and other compliance, risk management and operations, Chair of the Tort Trial and Insurance Practice Section Medicine and Law Committee, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, the ABA International Section Life Sciences Committee and the former Group Chair and Welfare Benefit Committee Co-Chair of the ABA RPTE Employee Benefits & Other Compensation Group, Ms. Stamer is widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health industry legal, public policy and operational concerns.

Ms. Stamer’s work throughout her career has focused heavily on working with hospitals, health care systems, long term care, rehabilitation, home health, hospice, clinics, and other health care organizations; physician and other provider organizations and practitioners; accreditation, medical staff, peer review, and quality committees and organizations; billing, audit, practice management, utilization management, EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors and services organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; DME; health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations; consultants; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies on billing and reimbursement, government investigations and enforcement, and other legal and operational compliance and risk management, performance and workforce management, regulatory and public policy, and other legal and operational concerns.

Author of a multitude of highly regarded publications and presentations, Ms. Stamer is widely recognized for her thought leadership on these and other health care, managed care and other health plan,and other health industry matters. In addition, Ms. Stamer contributes her time and leadership to numerous policy, professional, civil and other organizations including service as the, the American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations. For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2026 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Leave a Comment » | Academic medicine, Anti-KickBack, ASC, Conditions of Participation, Controlled Substances, Corporate Compliance, DEA, Durable Medical Equipment, Employer, Employment law, FDA, Federal Sentencing Guidelines, Government contractor, Grant recipients, Grants, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Plans, healthcare, Heath Care Exchange, HHS, HIPAA Cyber Crime, Hospice, Hospital, Hospital, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, laboratory testing, Laboratory tests, Life Sciences, long-term care, Medicaid, Medicaid Advantage, Medicaid Advantage, medical devices, Medicare, Medicare Advantage, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Money Laundering, nursing home, OIG, Pharmaceudical, pharmaceutical, Pharmacy, Prescription Drugs, Psychiatric, Reimbursement, retaliation, Stark, Veterans Health, Veterans Health Care, Whistleblower | Permalink
Posted by Cynthia Marcotte Stamer

Banner Health Pays $1.25 Million To Settle Cybersecurity Breach Impacting Nearly 3 Million Individuals

February 3, 2023

Phoenix-based nonprofit health system Banner Health and its affiliates (“Banner Health”) paid $1.25 million and agreed to take corrective actions to resolve its exposure to potentially much greater Health Insurance Portability and Accountability Act (HIPAA) Security Rule civil monetary penalty exposure for a 2016 cyber hacking breach that compromised the personal health information of 2.81 million consumers. OCR used its February 2 announcement of the Banner Health settlement to warn health care providers, health plans, health care clearinghouses (“covered entities”) and business associates covered by HIPAA to guard their own systems containing protected health information against breach by cyber hacking.

Banner Health Settlement

Banner Health is one of the largest non-profit health systems in the country, with over 50,000 employees and operating in six states. Banner Health is the largest employer in Arizona and one of the largest in northern Colorado.

In November 2016, OCR initiated an investigation of Banner Health following the receipt of a breach report stating that a threat actor had gained unauthorized access to electronic protected health information, potentially affecting millions. The hacker accessed protected health information that included patient names, physician names, dates of birth, addresses, Social Security numbers, clinical details, dates of service, claims information, lab results, medications, diagnoses and conditions, and health insurance information.

OCR’s investigation found evidence of long-term, pervasive noncompliance with the HIPAA Security Rule across Banner Health’s organization, a serious concern given the size of this covered entity. Organizations must be proactive in their efforts to regularly monitor system activity for hacking incidents and have measures in place to sufficiently safeguard patient information from risk across their entire network.

The potential violations OCR identified specifically included:

A lack of an analysis to determine risks and vulnerabilities of electronic protected health information across the organization;
Insufficient monitoring of its health information systems’ activity to protect against a cyber-attack;
Failure to implement an authentication process to safeguard its electronic protected health information; and
Failure to have security measures in place to protect electronic protected health information from unauthorized access when it was being transmitted electronically.

Under the Resolution Agreement and Corrective Action Plan negotiated to resolve these potential violations, Banner Health paid $1,250,000 to OCR. Banner Health also agreed to implement a corrective action plan, which identifies steps Banner Health will take to resolve these potential violations of the HIPAA Security Rule and protect the security of electronic patient health information that will be monitored for two years by OCR to ensure compliance with the HIPAA Security Rule. Under the corrective action plan, Banner has agreed to take the following steps:

Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic patient/system data across the organization
Develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI
Develop, implement, and distribute policies and procedures for a risk analysis and risk management plan, the regular review of activity within their information systems, an authentication process to provide safeguards to data and records, and security measures to protect electronic protected health information from unauthorized access when it is being transmitted electronically, and
Report to HHS within thirty (30) days when workforce members fail to comply with the HIPAA Security Rule.

OCR Warns Other HIPAA-Covered Entities

In the health care sector, hacking is now the greatest threat to the privacy and security of protected health information. OCR’s announcement of the settlement reports 74 percent (74%) of the breaches reported to OCR in 2021 involved hacking/IT incidents.

The announcement also notes OCR offers an array of resources to help health care organizations bolster their cybersecurity posture and comply with the HIPAA Rules,

The settlement and OCR’s announcement warn other covered entities and business associates to use these and other necessary resources to protect their systems with protected health information from cyber hacking and other breaches.

In conjunction with reminding other covered entities of these resources, the settlement announcement quotes OCR Director Melanie Fontes Rainer as a warning, “Hackers continue to threaten the privacy and security of patient information held by health care organizations, including our nation’s hospitals, … It is imperative that hospitals and other covered entities and business associates be vigilant in taking robust steps to protect their systems, data, and records, and this begins with understanding their risks, and taking action to prevent, respond to and combat such cyber-attacks. … Cyber security is on all of us, and we must take steps to protect our health care systems from these attacks.”

OCR’s enforcement record confirms these are not idyl threats. Breaches of the Security or Breach Notification Rules often result in significant civil monetary penalty assessments or negotiated settlements to mitigate civil liability exposures arising out of such breaches. See e.g., Clinical Laboratory Pays $25,000 To Settle Potential HIPAA Security Rule Violations (May 25, 2021); Health Insurer Pays $5.1 Million to Settle Data Breach Affecting Over 9.3 Million People (January 15, 2021); Aetna Pays $1,000,000 to Settle Three HIPAA Breaches(October 28, 2020); Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People (September 25, 2020); HIPAA Business Associate Pays $2.3 Million to Settle Breach Affecting Protected Health Information of Over 6 million Individual – (September 23, 2020); Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach (July 27, 2020); Small Health Care Provider Fails to Implement Multiple HIPAA Security Rule Requirements (July 23, 2020).

Alerts issued by OCR regarding heightened security risks in recent months and a growing tide of highly publicized breaches send a strong warning to other covered entities and their business associates to reconfirm the adequacy of their own HIPAA privacy, security, breach notification and other procedures and protections by among other things:

Reviewing and monitoring on a documented, ongoing basis the adequacy and susceptibilities of existing practices, policies, safeguards of their own organizations, as well as their business associates and their vendors within the scope of attorney-client privilege taking into consideration data available from OCR, data regarding known or potential susceptibilities within their own operations as well as in the media, and other developments to determine if additional steps are necessary or advisable.
Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility.
Renegotiating and enhancing service provider agreements to detail the specific compliance, audit, oversight and reporting rights, workforce and vendor credentialing and access control, indemnification, insurance, cooperation and other rights and responsibilities of all entities and individuals that use, access or disclose, or provide systems, software or other services or tools that could impact on security; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; and other relevant matters.
Verifying and tightening technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information and systems.
Conducting well-documented training as necessary to ensure that members of the workforce of each covered entity and business associate understand and are prepared to comply with the expanded requirements of HIPAA, understand their responsibilities and appropriate procedures for reporting and investigating potential breaches or other compliance concerns, and understand as well as are prepared to follow appropriate procedures for reporting and responding to suspected
violations or other indicia of potential security concerns.
Tracking and reviewing on a systemized, well-documented basis actual and near-miss security threats to evaluate, document decision-making and make timely adjustments to policies, practices, training, safeguards and other compliance components as necessary to identify and resolve risks.
Establishing and providing well-documented monitoring of compliance that includes board-level oversight and reporting at least quarterly and sooner in response to potential threat indicators.
Establishing and providing well-documented timely investigation and redress of reported
violations or other compliance concerns.
Establishing contingency plans for responding in the event of a breach.
Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and requirements.
Preparing and maintaining a well-documented record of compliance, risk, investigation and other security activities.
Pursuing other appropriate strategies to enhance the covered entity’s ability to demonstrate its compliance commitment both on paper and in operation.

Because of susceptibilities in systems, software and other vendors of business associates, suppliers and other third parties, covered entities and their business associates should use care to assess and manage business associate and other vendor-associated risks and compliance as well as tighten business associate and other service agreements to promote the improved cooperation, coordination, management and oversight required to comply with the new breach notification and other HIPAA requirements by specifically mapping out these details.

Beyond these HIPAA exposures, breaches and other HIPAA noncompliance carries other liability risks. Leaders of covered entities or their business associates also are cautioned that while HIPAA itself does not generally create any private right of action for victims of breach under HIPAA, breaches may create substantial liability for their organizations or increasingly, organizational leaders. For instance, the Department of Health & Human Services has warned health care providers participating in Medicare or other federal programs and Medicare Advantage health plans that HIPAA compliance is a program term of participation.

Health care providers and health insurers can face liability under state data privacy and breach, negligence or other statutory or common laws. In addition, physicians and other licensed parties may face professional discipline or other professional liability for breaches violating statutory or ethical standards.

Health plans also face a myriad of other exposures from failing to use appropriate cyber safeguards. Plan fiduciaries of employment-based health plans covered by the Employee Retirement Income Security Act (“ERISA”) risk liability under ERISA’s fiduciary responsibility rules. The Department of Labor Employee Benefit Security Administration (“EBSA”) now audits the adequacy of the cybersecurity and other HIPAA compliance of health plans and their third-party administrators and other business associates as part of EBSA’s oversight and enforcement of ERISA. Department of Labor Assistant Secretary for EBSA Lisa Gomez confirmed audit and enforcement of cybersecurity obligations is a key priority in EBSA’s current work plan in her February 4, 2023 comments to the American Bar Association.

Meanwhile, the Securities and Exchange Commission has indicated that it plans to pursue enforcement against leaders of public health care or other public companies that fail to use appropriate care to ensure their organizations comply with privacy and data security obligations.

Furthermore, appropriate cyber security practices also may be advisable elements for organizations to include in their Federal Sentencing Guideline Compliance Programs to mitigate potential organization liability risks under federal electronic crime and related laws.

In the face of these risks and warnings, all covered entities and their business associates should reassess and confirm the adequacy of their and their business associates’ cyber security defenses and breach response preparations.

More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely-known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on health and managed care and employer benefits legal, public policy and operational concerns in the healthcare, employer benefits, and insurance and financial services industries. She speaks and publishes extensively on HIPAA and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication.

Leave a Comment » | Cyber crime, data breach, data security, DME, Doctor, Employer, ERISA, Federal Sentencing Guidelines, Health Care Finance, Health Care Provider, Health Insurance, Health IT, Health Plan, Health Plans, HHS, HIPAA, HIPAA Cyber Crime, HITECH Act, home health, Hospice, Hospital, hospitals, Licensing, Meaningful Use, Medicaid, Medicaid Advantage, Medical Licensure, Medical Malpractice, Medical Privacy, Medical Records, Medicare, Medicare Advantage, OCR, Peer Review, Physician Licensing, retaliation, Technology, Telemedicine, Whistleblower | Tagged: ARRA, Breach Notification, CMS, Compliance, Corporate Compliance, Data Breach, Data Security, Doctor, DOJ, EHR, Electronic Health Records, Employer, false claims act, Federal Sentencing Guidelines, Health Care, Health Care Compliance, Health Care Fraud, Health Care Provider, Health Care Reimbursement, Health Insurance, Health IT, Health Plan, Health Plans, HHS, HIPAA, HIPAA Privacy, HITECH Act, Hospital, Hospitals, licensure, Medicaid, Medical Privacy, Medicare, OCR, Office of Civil Rights, OIG, PHI, Physician, Physicians, Privacy, Protected Health Information | Permalink
Posted by Cynthia Marcotte Stamer

Criminal IV Tampering Charges Against Anesthesiologist Highlight Exposures Providers And Their Facilities Can Face From Team Members Retaliatory or Other Misdeeds

September 15, 2022

The arrest and criminal charges against Dallas anesthesiologist Raynaldo Rivera Ortiz Jr. (“Dr. Ortiz”) announced September 15, 2022 highlight the advisability of health care facilities and providers to use care to use appropriate monitoring and other safeguards to protect patients and other critical operations against potential retaliatory misconduct during professional peer review or other investigation or discipline of health care professionals or other members of their workforces.

Dr. Ortiz was arrested in Plano, Texas on Wednesday, September 14, 2022 and is scheduled to make his initial court appearance on Friday, September 16, 2022 on federal felony criminal charges that he caused the death of a patient and surgical emergencies of other patients by intentionally tampering with a consumer product and intentional drug alteration.

According to the by Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division, and U.S. Attorney for the Northern District of Texas Chad E. Meacham, Dr. Ortiz was arrested and charged via criminal complaint with tampering with a consumer product causing death and intentional drug adulteration.

According the criminal complaint, on June 21, 2022, a 55-year-old female coworker of Dr. Ortiz, experienced a medical emergency and died immediately after treating herself for dehydration using an IV bag of saline taken from a Baylor Scott & White operated surgical center. An autopsy report revealed that she died from a lethal dose of bupivacaine, a nerve blocking agent that is rarely abused but is often used during the administration of anesthesia.

Two months later, on August 24, 2022, an 18-year-old male patient experienced a cardiac emergency during a routine sinus surgery. The teen was intubated and transferred to a local ICU. Chemical analysis of the fluid from a saline bag used during his surgery revealed the presence of bupivacaine, epinephrine (a stimulant), and lidocaine, drugs that could have caused the patient’s sudden symptoms.

According to the complaint, surgical center personnel concluded that the incidents involving both patients suggested a pattern of intentional adulteration of IV bags used at the surgical center.

The surgical center personnel also identified 10 additional unexpected cardiac emergencies that occurred during otherwise unremarkable surgeries between May and August 2022, which the criminal complaint alleges is an exceptionally high rate of complications over such a short period of time. According to the criminal complaint, medical personnel in each of those additional 10 cases only were able to stabilize the patient through use of emergency measures. Most of the incidents occurred during longer surgeries that used more than one IV bag, including one or more bags retrieved mid-surgery from a stainless steel bag warmer.

Surveillance video from the center’s operating room hallway allegedly also shows Dr. Ortiz placing IV bags into the stainless-steel bag warmer shortly before other doctors’ patients experienced cardiac emergencies. The complaint alleges that in one instance captured in the surveillance video, agents observed Dr. Ortiz walk quickly from an operating room to the bag warmer, place a single IV bag inside, visually scan the empty hallway, and quickly walk away. Just over an hour later, according to the complaint, a 56-year-old woman suffered a cardiac emergency during a scheduled cosmetic surgery after a bag from the warmer was used during her procedure. The complaint also states that in another instance, agents observed Dr. Ortiz exit his operating room carrying an IV bag concealed in what appeared to be a paper folder, swap the bag with another bag from the warmer, and walk away. Roughly half an hour later, a 54-year-old woman suffered a cardiac emergency during a scheduled cosmetic surgery after a bag from the warmer was used during her procedure.

According to the complaint, none of the cardiac incidents occurred during Dr. Ortiz’s surgeries, and that the series of emergencies began just two days after Dr. Oritz was notified of a disciplinary inquiry stemming from an incident during which he allegedly “deviated from the standard of care” during an anesthesia procedure when a patient experienced a medical emergency. The complaint alleges that all of the incidents occurred around the time Dr. Ortiz performed services at the facility, and no incidents occurred while Dr. Ortiz was on vacation.

The complaint further alleges that Dr. Ortiz, who had a history of disciplinary actions against him, expressed concern to other physicians over the disciplinary action at the facility and complained the center was trying to “crucify” him. A nurse who worked on one of Dr. Ortiz’s surgeries allegedly told law enforcement that Dr. Ortiz refused to use an IV bag she retrieved from the warmer, physically waving the bag off.

“Our complaint alleges this defendant surreptitiously injected heart-stopping drugs into patient IV bags, decimating the Hippocratic oath,” said U.S. Attorney Chad E. Meacham in the Department of Justice announcement of the charges. The criminal charges stemmed from these findings.

The Justice Department announcement reminds readers that a criminal complaint is merely an allegation of criminal conduct, not evidence. Dr. Ortiz is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law. If convicted, however, Dr. Ortiz faces a maximum penalty of life in prison.

Both Dr. Ortiz and the surgical facility are exposed to potential liability as a result of the alleged charges. Aside from the pending criminal charges, Dr. Ortiz also almost certainly could face potential peer review and licensing board disciplinary investigation, as well as civil lawsuits.

In addition to these liability exposures for Dr. Ortiz, the surgical facility and other providers also could face civil or potentially even criminal liability.

It seems almost inevitable that the facility and potentially some other providers might be drawn into civil lawsuits brought by affected patients and their families allegedly injured or place at risk by the alleged actions by Dr. Ortiz, as well as licensing and/or accreditation investigation arising from the alleged events.

Because Dr. Ortez’s alleged Actions constitute federal felonies, the Federal Sentencing Guidelines sentencing and organizational liability rules apply. The Sentencing Guidelines will apply to determine the sentence imposed if Dr. Ortez ultimately is convicted. In addition, the Sentencing Guidelines organizational liability provisions also raise a risk of criminal charges against the facility or other parties with knowledge or other imputed responsibility. Under the organizational guidelines, organizations can have imputedliability for the criminal acts committed by the members of their workforce. However whether criminal charges will be pursued against the organization and the level of culpability and resulting liability is determined based upon both whether the organization took appropriate steps to prevent the misconduct before it happened and the extent to which the organization acted promptly in its investigation and redress of the conduct. The apparent actions of the surgical center and its leader ship to investigate, report, and cooperate in the investigation with federal officials are likely to mitigate if not resolve their criminal exposure.

Organizations and their leaders should treat the charges against Dr. Ortiz as a reminder, at minimum carefully to credential and monitor team members including doctors or other non-employer actors working in or with their facilities, to establish appropriate safeguards to prevent and identify quickly mistakes or intentional conduct, to monitor and enforce those safeguards, and to take appropriate prompt action to investigate concerns and redress and if necessary report misconduct with the advice of counsel.

When dealing with position performance and discipline concerns, facilities typically must carefully negotiate applicable contractual and workforce issues as well as the procedural and due process requirements of applicable medical staff bylaws and federal and state peer review and discipline statutes and regulations and medical staff discipline rules.

When a medical staff member protected by peer review or other procedural safeguards commits behaviors that raise a material and continuing threat to the health and safety of patients or the public, summary suspension may be necessary. When considering or taking an action to summarily suspend a healthcare provider, however, facilities and their medical staff leaders should document both the grounds for the patient safety concerns and need for immediate action and scrupulously follow the summary suspension procedures.

Along with seeking to prevent and mitigate these legal risks, Facilities and other providers also need to consider white reporting obligations they may bear under applicable statutes, regulations and contracts.

While managing these legal risks, facilities and other involved parties also need to anticipate media and public concern about the occurrences. Facilities and their leaders should anticipate and be prepared to work in conjunction with qualified legal counsel and experienced qualified public relations experts to decide when, what, and how to communicate with the public in the media about these types of events to avoid is there a bold minefield of traps created by privacy laws, evidentiary and other legal risk management concerns, and the management of relationships with other members of the medical staff and workforce, business partners, insurance, and the public.

More Information

We hope this update is helpful. For more information about the these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Vice Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health and managed care industry legal, public policy and operational concerns.

Ms. Stamer’s work throughout her 35 plus year career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. In the course of this work, she has worked extensively on workforce and medical staff credentialing, management, investigation, peer review and discipline, and reporting and remediation of criminal or other activity to regulatory officials.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access of this publication.

Leave a Comment » | Academic medicine, Ambulatory care, Anethesiology, Conditions of Participation, Corporate Compliance, Credentialing, Doctor, Employer, Employment law, FDA, Federal Sentencing Guidelines, Fiduciary Responsibility, Health Care, Health Care Provider, Health Care Quality, Home Health, home health, Hospice, Hospital, hospitals, nursing home, OIG, Physician, Physician Licensing, physician licensure, Prescription Drugs, quality repoting, retaliation, Skilled Nursing Facility, Whistleblower | Tagged: ortiz | Permalink
Posted by Cynthia Marcotte Stamer

Justice Department COVID & Other Health Care Fraud Enforcement Thriving Despite Pandemic Emergency

November 23, 2021

Federal health care fraud prosecution continues to thrive despite the ongoing COVID-19 health care emergency.

Recently announced prosecutions and other enforcement actions include Fraud & Abuse, False Claims Act and other health care fraud prosecutions commonly pursued by the Justice Department in recent decades as well as a host of new prosecutions of abuses of Covid-19 relief programs. Examples include:

These and other actions send a clear message to health care and life science organizations to continue vigorous health care fraud compliance and risk management activities as well as stay vigilant for signs of new audit and enforcement activities.

More Information

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

Past Board President of the Richardson Development Program for Children ECE and Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, Vice Chair of the ABA International Section Life Sciences Committee, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and the ABA RPTE Employee Benefits & Other Compensation Group, Ms. Stamer is most widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health industry legal, public policy and operational concerns.

Ms. Stamer’s work throughout her 30 plus year career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

As a part of this work, she has continuously and extensively worked with domestic and international health plans, their sponsors, fiduciaries, administrators, and insurers; managed care and insurance organizations; hospitals, health care systems, clinics, skilled nursing, long term care, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; EHR, claims, payroll and other technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies.

This involvement encompasses helping health care systems and organizations, schools, ECEs, group and individual health care providers, health plans and insurers, health IT, life sciences and other health industry clients prevent, investigate, manage and resolve sexual assault, abuse, harassment and other organizational, provider and employee misconduct and other performance and behavior; manage Section 1557, Civil Rights Act and other discrimination and accommodation, and other regulatory, contractual and other compliance; vendors and suppliers; contracting and other terms of participation, medical billing, reimbursement, claims administration and coordination, Medicare, Medicaid, CHIP, Medicare/Medicaid Advantage, ERISA and other payers and other provider-payer relations, contracting, compliance and enforcement; Form 990 and other nonprofit and tax-exemption; fundraising, investors, joint venture, and other business partners; quality and other performance measurement, management, discipline and reporting; physician and other workforce recruiting, performance management, peer review and other investigations and discipline, wage and hour, payroll, gain-sharing and other pay-for performance and other compensation, training, outsourcing and other human resources and workforce matters; board, medical staff and other governance; strategic planning, process and quality improvement; meaningful use, EHR, HIPAA and other technology, data security and breach and other health IT and data; STARK, ant kickback, insurance, and other fraud prevention, investigation, defense and enforcement; audits, investigations, and enforcement actions; trade secrets and other intellectual property; crisis preparedness and response; internal, government and third-party licensure, credentialing, accreditation, HCQIA and other peer review and quality reporting, audits, investigations, enforcement and defense; patient relations and care; internal controls and regulatory compliance; payer-provider, provider-provider, vendor, patient, governmental and community relations; facilities, practice, products and other sales, mergers, acquisitions and other business and commercial transactions; government procurement and contracting; grants; tax-exemption and not-for-profit; privacy and data security; training; risk and change management; regulatory affairs and public policy; process, product and service improvement, development and innovation, and other legal and operational compliance and risk management, government and regulatory affairs and operations concerns. to establish, administer and defend workforce and staffing, quality, and other compliance, risk management and operational practices, policies and actions; comply with requirements; investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry actions: regulatory and public policy advocacy; training and discipline; enforcement; and other strategic and operational concerns.

Author of a multitude of health industry and other highly regarded publications and presentations, the American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Leave a Comment » | Academic medicine, American Rescue Plan Act of 2021, Anti-KickBack, ASC, Centers For Disease Control, Conditions of Participation, Coronavirus, Corporate Compliance, Covid, COVID-19, Electronic Health Records, Employer, false claims act, Health Care, Health care coding, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, healthcare, HHS, Home Health, home health, Hospice, Hospital, hospitals, Life Sciences, long-term care, Medicaid, Medicaid Advantage, Medicare, Medicare Advantage, Mental Heatlh, Money Laundering, OIG, Pandemic, Pharmacy, Physician, physician licensure, Reimbursement, retaliation, Skilled Nursing Facility, Stark, substance abuse treatment | Permalink
Posted by Cynthia Marcotte Stamer

New Texas Law Requiring Anti-Retaliation Policies For Nonprofit Healthcare Org’s Takes Effect 1/1

December 27, 2019

Nonprofit health organizations must develop anti-retaliation policies for doctors and submit biennial reports to the Texas Medical Board in response to a House Bill 1532 mandate that takes effect January 1, 2020.

Passed by the Texas Legislature on September 1, 2019, the Bill also amends the Medical Practice Act to require the Texas Medical Board to accept and process complaints against a certified nonprofit health organization in the same manner it would handle complaints against a health professional.

For More Information

We hope this update is helpful. For more information about this or other labor and employment developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

Scribe for the ABA JCEB Annual Agency Meeting with OCR, Vice Chair of the ABA International Section Life Sciences Committee, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and the ABA RPTE Employee Benefits & Other Compensation Group, Ms. Stamer’s work throughout her 30 plus year career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services, public and private primary, secondary, and other educational institutions, and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. As a part of this work, she has recurrently worked extensively with public school districts and public and private primary and secondary schools, colleges and universities, academic medical, and other educational institutions, insured and self-insured health plans; domestic and international hospitals, health care systems, clinics, skilled nursing, long term care, rehabilitation and other health care providers and facilities; medical staff, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, employers; and federal and state legislative, regulatory, investigatory and enforcement bodies and agencies on health care, education, and other data privacy, security, use, protection and disclosure; disability and other educational rights; workforce, and a host of other risk management and compliance concerns.

Ms. Stamer is most widely recognized for her decades-long leading edge work, scholarship and thought leadership on health and other privacy and data security and other health industry legal, public policy and operational concerns. This involvement encompasses helping health care systems and organizations, group and individual health care providers, health plans and insurers, health IT, life sciences and other health industry clients prevent, investigate, manage and resolve sexual assault, abuse, harassment and other organizational, provider and employee misconduct and other performance and behavior; manage Section 1557, Civil Rights Act and other discrimination and accommodation, and other regulatory, contractual and other compliance; vendors and suppliers; contracting and other terms of participation, medical billing, reimbursement, claims administration and coordination, Medicare, Medicaid, CHIP, Medicare/Medicaid Advantage, ERISA and other payers and other provider-payer relations, contracting, compliance and enforcement; Form 990 and other nonprofit and tax-exemption; fundraising, investors, joint venture, and other business partners; quality and other performance measurement, management, discipline and reporting; physician and other workforce recruiting, performance management, peer review and other investigations and discipline, wage and hour, payroll, gain-sharing and other pay-for performance and other compensation, training, outsourcing and other human resources and workforce matters; board, medical staff and other governance; strategic planning, process and quality improvement; meaningful use, EMR, HIPAA and other technology, data security and breach and other health IT and data; STARK, ant kickback, insurance, and other fraud prevention, investigation, defense and enforcement; audits, investigations, and enforcement actions; trade secrets and other intellectual property; crisis preparedness and response; internal, government and third-party licensure, credentialing, accreditation, HCQIA and other peer review and quality reporting, audits, investigations, enforcement and defense; patient relations and care; internal controls and regulatory compliance; payer-provider, provider-provider, vendor, patient, governmental and community relations; facilities, practice, products and other sales, mergers, acquisitions and other business and commercial transactions; government procurement and contracting; grants; tax-exemption and not-for-profit; privacy and data security; training; risk and change management; regulatory affairs and public policy; process, product and service improvement, development and innovation, and other legal and operational compliance and risk management, government and regulatory affairs and operations concerns. to establish, administer and defend workforce and staffing, quality, and other compliance, risk management and operational practices, policies and actions; comply with requirements; investigate and respond to Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry actions: regulatory and public policy advocacy; training and discipline; enforcement; and other strategic and operational concerns.

Author of leading works on HIPAA and a multitude of other health care, health plan and other health industry matters, the American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations. For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc. disclaim, and have no responsibility to provide any update or otherwise notify anyone any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

©2019 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

1 Comment | Corporate Compliance, Doctor, Employer, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, healthcare, Home Health, Hospice, Hospital, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, Licensing, managed care, Nonprofits, participating provider, Peer Review, Physician, Physician Licensing, Provider contracting, retaliation, Uncategorized, Whistleblower | Permalink
Posted by Cynthia Marcotte Stamer

One Door for Criminal Health Care Fraud Disclosures: DOJ’s Fraud Division and HHS-OIG Consolidate Self-Disclosure—and Close the SDP to Criminal Conduct

What the Joint Policy Does

Important Limits Buried in the Footnotes

What Changed in the Updated HHS-OIG SDP

The Parallel Civil Track: The DOJ–HHS FCA Self-Disclosure Pilot Program

Why the Timing Matters: A Rapidly Escalating Enforcement Environment

Analysis: The Hard Part Is the Triage

Action Items by Stakeholders

Bottom Line

For Help or More Information

About the Author

About Solutions Law Press, Inc.™

Banner Health Pays $1.25 Million To Settle Cybersecurity Breach Impacting Nearly 3 Million Individuals

Banner Health Settlement

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Criminal IV Tampering Charges Against Anesthesiologist Highlight Exposures Providers And Their Facilities Can Face From Team Members Retaliatory or Other Misdeeds

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Justice Department COVID & Other Health Care Fraud Enforcement Thriving Despite Pandemic Emergency

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

New Texas Law Requiring Anti-Retaliation Policies For Nonprofit Healthcare Org’s Takes Effect 1/1

Recent Posts

Archives

About Cynthia Marcotte Stamer

Share this blog

Archives

Solutions Law Press Health Care Update

One Door for Criminal Health Care Fraud Disclosures: DOJ’s Fraud Division and HHS-OIG Consolidate Self-Disclosure—and Close the SDP to Criminal Conduct

What the Joint Policy Does

Important Limits Buried in the Footnotes

What Changed in the Updated HHS-OIG SDP

The Parallel Civil Track: The DOJ–HHS FCA Self-Disclosure Pilot Program

Why the Timing Matters: A Rapidly Escalating Enforcement Environment

Analysis: The Hard Part Is the Triage

Action Items by Stakeholders

Bottom Line

For Help or More Information

About the Author

About Solutions Law Press, Inc.™

Share this:

Banner Health Pays $1.25 Million To Settle Cybersecurity Breach Impacting Nearly 3 Million Individuals

Banner Health Settlement

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Share this:

Criminal IV Tampering Charges Against Anesthesiologist Highlight Exposures Providers And Their Facilities Can Face From Team Members Retaliatory or Other Misdeeds

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Share this:

Justice Department COVID & Other Health Care Fraud Enforcement Thriving Despite Pandemic Emergency

More Information

About the Author

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Share this:

New Texas Law Requiring Anti-Retaliation Policies For Nonprofit Healthcare Org’s Takes Effect 1/1

Share this:

Recent Posts

Archives

About Cynthia Marcotte Stamer

Share this blog

Archives

Solutions Law Press Health Care Update