10 HIPAA Violations to Watch Out for While Working Remotely

Most improper disclosures are caused by complacency, poor training, or lack of attention. These kinds of lists are good reminders of some of the biggest types of violations. Of course, Covered Entities should provide this, and more, to employees and business associates.

From Security Boulevard:

1. Unsecure internet access. Transmitting e-PHI over unsecured networks, such as Wi-Fi networks at a coffee shop, internet cafe, or even at home, can increase the risk of patient data becoming accessible to hackers.

2. Improper handling of paper-based PHI. Paper-based procedures are still commonly used for some elements of a healthcare organization’s operations. This may result in unauthorized access to PHI. For example, if a remote employee prints out patient information from their family printer, the household may access these files.

3. Improper disposal of files. Improper disposal includes disposing of files, physical or electronic, in a way that information can still be read or accessed by unauthorized individuals. …

4. Unauthorized devices. HIPAA rules require all devices that use, gather, store, or transfer e-PHI to be safeguarded by specific security controls. Employees often use multiple devices to complete their daily tasks, so it is possible to use a device their organization did not authorize unintentionally. …

5. Insufficient compliance training program. Business associates and covered entities are required to renew their HIPAA certifications annually through compliance training programs. All staff, including remote employees, must complete compliance training.

6. Lost or stolen records. The HIPAA Security Rule outlines security and safeguards to ensure minimal risk of unauthorized access to PHI. …

7. Incorrect filing of PHI. Incorrect filing can result in unauthorized access to PHI. For example, if a health care provider sends digital X-ray results to the wrong physician or patient information to the wrong patient …

8. Phishing scams. Phishing scams are a common way cybercriminals trick individuals into accidentally revealing passwords and other sensitive information by sending them communications that appear to come from a reputable source. Refresher courses for all employees on cybersecurity awareness can help reduce these risks. …

9. Unencrypted data. With most communication occurring through text, email, and other messaging platforms, it’s easy to forget how vulnerable that information is. If PHI is not encrypted appropriately, there is an increased risk of cyberattacks, threats, and data breaches. …

10. Lack of physical security. For example, leaving paper PHI unattended in communal rooms of the house or on the table at a coffee shop increases the risk of theft or unauthorized access to these files.

Source: 10 HIPAA Violations to Watch Out for While Working Remotely – Security Boulevard

Toolkit: Analyzing Telehealth Claims to Assess Program Integrity Risks

This toolkit provides detailed information on methods to analyze telehealth claims to identify program integrity risks associated with telehealth services. It is based on the methodology that OIG developed for the report Medicare Telehealth Services During the First Year of the Pandemic: Program Integrity Risks , which identified Medicare providers whose billing for telehealth services poses a high risk to Medicare. This toolkit is intended to assist public and private sector partners—such as Medicare Advantage plan sponsors, private health plans, State Medicaid Fraud Control Units, and other Federal health care agencies—in analyzing their own telehealth claims data to assess program integrity risks in their programs.

Source: Toolkit: Analyzing Telehealth Claims to Assess Program Integrity Risks

Supreme Court Preserves Access to Abortion Pill Mifepristone

The Supreme Court preserves access to the abortion pill mifepristone while the appeals play out. The case goes back to the 5th Circuit, where the FDA will pursue a full appeal of Kacsmaryk’s preliminary injunction. The agency and the anti-abortion groups will both have a chance to file briefs, and the case is scheduled to be argued before a three-judge panel on May 17. That appeal process could last months. The losing party could petition for rehearing with all judges of the 5th Circuit, known as en banc rehearing, and ultimately petition the Supreme Court once again. A final resolution could be months or years away.

Source: AP News: Supreme Court preserves access to abortion pill mifepristone

Supreme Court Pauses Abortion-Pill Case: What Next?

U.S. Supreme Court Justice Samuel Alito has temporarily stayed until Wednesday a Texas federal court order imposing restrictions on the distribution of the abortion drug mifepristone while they consider a request by the Biden administration to block the restrictions.

Brendan Pierson, writing for Reuters, discusses What Happens Next?

Whether or not the Supreme Court decides to stay Kacsmaryk’s order, it will not decide the merits of the case. Rather, the court will determine whether and how mifepristone can be distributed while the case is pending.

…

Whichever way the Supreme Court rules, it will send the case back to the 5th Circuit, where the FDA will pursue a full appeal of Kacsmaryk’s preliminary injunction. The agency and the anti-abortion groups will both have a chance to file briefs, and the case is scheduled to be argued before a three-judge panel on May 17.

That appeal process could last months. The losing party could petition for rehearing with all judges of the 5th Circuit, known as en banc rehearing, and ultimately petition the Supreme Court once again.

…

A final resolution could be months or years away. Once it does come, the losing side will again have the chance to appeal to the 5th Circuit and, eventually, the Supreme Court.

Hospice in 2023: Dying and the Dollars

Interesting statistics on hospice care, its growth, and fraud from Deborah Abrams Kaplan, writing for Managed Healthcare Executive:

Hospice care really started to take hold after Medicare started covering it in 1985. With Medicare paying the bills, hospice gained traction over time. Medicare spending on hospice nearly doubled from 2010 to 2020, increasing from $12.9 billion to $22.4 billion, according to the Medicare Payment Advisory Commission (MedPAC), an independent group that advises Congress on Medicare. During that period, the number of organizations that provide hospice care grew by 44%, from 3,498 in 2010 to 5,058 in 2020.
With the growth in hospice care has come a growth in fraudulent practices. Hospice fraud is rampant and has gotten more sophisticated, especially in four areas: (1) improper admission, (2) improper retention, (3) improper classification, and (4) kickbacks.
Hospice care in the U.S. was originally provided almost exclusively by nonprofit organizations, but now the providers are predominately for-profit organizations and an increasing number of them are backed by private equity. In 2010, 1,958 of the 3,498 hospices (or about 56%) in the U.S. were run by for-profit companies, according to MedPAC. By 2020, the number of hospices had grown by 44%, to 5,047, and 73% of them were owned by for-profit companies, according to MedPAC.

Office for Civil Rights Reminder HIPAA Flexibilities End May 2023

HHS Office of Civil Rights confirmed that that four Notifications of Enforcement Discretion (“Notifications”) will expire upon expiration of the COVID-19 PHE, which is currently scheduled for 11:59 p.m. on May 11, 2023.

OCR’s notice applies to four Notifications of Enforcement Discretion of HIPAA related to the following circumstances:

COVID-19 Community-Based Testing Sites during the PHE (available here);
Telehealth Remote Communications during the PHE (available here);
Uses and Disclosures of PHI by Business Associates for Public Health and Health Oversight Activities (available here); and
Online or Web-Based Scheduling Applications for Scheduling COVID-19 Vaccination Appointments (available here).

Source: Notice of Expiration of Certain Notifications of Enforcement Discretion Issued in Response to the COVID-19 Nationwide Public Health Emergency

HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care

HHS Office of Civil Rights has proposed changes to HIPAA’s Privacy Rule which would prohibit disclosures to law enforcement related to obtaining or providing abortions.

The current Privacy Rule permits covered entities to disclose Protected Health Information (PHI) about an individual for law enforcement purposes “pursuant to process and as otherwise required by law”, under certain conditions.

The proposed rule would prohibit covered entities from disclosing to law enforcement PHI related to abortions.

Per HHS:

After Dobbs, the Department has heard concerns that civil, criminal, or administrative investigations or proceedings have been instituted or threatened on the basis of reproductive health care that is lawful under the circumstances in which it is provided. The threat that PHI will be obtained and used in such an investigation or proceeding is likely to chill individuals’ willingness to seek lawful treatment or to provide full information to their health care providers when obtaining that treatment.

…

[T]he Department believes it is necessary to provide heightened protections for another especially sensitive category of health information—PHI sought for the purposes of conducting a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided. These proposed modifications would provide heightened protections for individuals’ health information privacy under the defined circumstances; foster an open and honest exchange of information between the individual and health care provider, who—with that information—could employ evidence-based clinical practice guidelines; and increase access to high-quality, lawful health care.

Source: HIPAA Privacy Rule to Support Reproductive Health Care Privacy

Supreme Court’s False Claims Case Alleges Overbilling of Medicare and Medicaid

Violations of the False Claims Act require a requisite state of “knowledge” a claim’s falsity. To violate the statute, one must have “actual knowledge,” “deliberate ignorance” or “reckless disregard of the truth or falsity” of the claim. Any of those broad levels of knowledge is sufficient to support a False Claims Act violation.

But knowledge in retrospect looks different than knowledge prosectively. Is the “usual and customary” price of a drug the price that cash customers pay in cash, or is it the price negotiated by insurance companies or set by Medicare?

This week, the United States Supreme Court will consider the issue in U.S. ex rel. Proctor v. Safeway, Inc.

Nina Totenberg for NPR explains:

The case essentially began in 2006, when Walmart upended the retail pharmacy world by offering large numbers of frequently used drugs at very cheap prices — $4 for a 30-day supply — with automatic refills. That left the rest of the retail pharmacy industry desperately trying to figure out how to compete.

The pharmacies came up with various offers that matched Walmart’s prices for cash customers, but they billed Medicaid and Medicare using far higher prices, not what are alleged to be their usual and customary prices.

Walmart did report its discounted cash prices as usual and customary, but other chains did not. Even as the discounted prices became the majority of their cash sales, other retail pharmacies continued to bill the government at the previous and far higher prices.

For example, between 2008 and 2012, Safeway charged just $10 for almost all of its cash sales for a 90-day supply of a top-selling drug to reduce cholesterol. But it did not report $10 as its usual and customary price. Instead, Safeway told Medicare and Medicaid that its usual and customary price ranged from $81 to $109.

DOJ Settlements Are a Stark Reminder

Arrangements with referring physicians are common in healthcare, but they can be very danagerous if not structured properly. Too often they are used to obfuscate the purpose of payments to physicians.

The Department of Justice for the Eastern District of Michigan announced three civil settlements which serve as good reminders of the types of arrangements that can get providers into trouble:

The health system had contracts with several physicians to serve as medical directors, and none of these arrangements satisfied any exceptions to the Stark Law or the AKS, such that referrals these physicians made to the health system violated the False Claims Act.
The health system employed a physician and this financial relationship did not satisfy any exception to the Stark Law, such that referrals for designated healthcare services were prohibited and violated the False Claims Act.
The health system rented office space to a physician and forgave rent payments, constituting remuneration paid in exchange for referrals from that physician in violation of the AKS and the False Claims Act, and creating a financial relationship that did not meet any exception to the Stark Law, also violating the False Claims Act.
The health system permitted a group of referring physicians to secure an equipment lease through non-arm’s-length negotiations, in order to induce referrals of patients from these physicians, in violation of the AKS and the False Claims Act.

Widespread Third-Party Tracking On Hospital Websites Poses Privacy Risks For Patients And Legal Liability For Hospitals

Web tracking technology has been in the news a lot lately. Most websites use such tools to track users as they navigate through a particular site and around the web. Nothing new here. But in doing so, user data gets transferred from one site to another, or actively collected, posing privacy risks for healthcare providers.

A new study, published in Health Affairs, indicates that 99% of hospital websites use third-party tracking code on their sites, creating privacy risks for patients and legal liability for hospitals:

We found that third-party tracking is present on 98.6 percent of hospital websites, including transfers to large technology companies, social media companies, advertising firms, and data brokers. Hospitals in health systems, hospitals with a medical school affiliation, and hospitals serving more urban patient populations all exposed visitors to higher levels of tracking in adjusted analyses. By including third-party tracking code on their websites, hospitals are facilitating the profiling of their patients by third parties. These practices can lead to dignitary harms, which occur when third parties gain access to sensitive health information that a person would not wish to share. These practices may also lead to increased health-related advertising that targets patients, as well as to legal liability for hospitals.