Author: WadeEmmert

Categories
Health Law Highlights

Patient Privacy: Preventing Data Leakage in Healthcare

From Security Boulevard, by Chantel Rodrigues:

  • Tracking pixels are tiny, invisible images or code snippets embedded in web pages, emails, or mobile apps. They can be used for legitimate purposes, such as monitoring website traffic, measuring user engagement, and improving user experience.
  • They can also lead to data leakage and privacy breaches, which can constitute HIPAA violations if they compromise patient privacy or security.
  • Identify all pixels and trackers on your web pages and remove the ones that are unnecessary or could be reading sensitive data.
  • Implement JavaScript security controls throughout both the development and Application Security (AppSec) lifecycles.
  • If you do use tracking technologies, ensure they only use and share protected health information (PHI) following HIPAA Privacy Rule guidelines.
  • If you use technology vendors, establish a robust business associate agreement (BAA) to protect PHI.
Categories
Health Law Highlights

Federal Judge Rules Government Must Demonstrate “But-For” Causation for Anti-Kickback Statute Claims

From ArentFox Schiff LLP, by D. Jacques Smith , Randall A. Brater , Michael F. Dearington , Nadia Patel , Heather M. Zimmer:

  • Chief Judge Dennis Saylor of the US District Court for the District of Massachusetts ruled that the federal government must demonstrate but-for causation in order to prove that Regeneron Pharmaceuticals, Inc., the manufacturer of the drug Eylea, submitted false claims resulting from violations of the Anti-Kickback Statute (AKS).
  • The 2010 amendments provide that any Medicare claim that includes items or services resulting from a violation of the AKS constitutes a false or fraudulent claim for purposes of the FCA.
  • The government urged that the court to adopt the “exposure” theory of causation set forth in United States ex rel. Greenfield v. Medco Health Sols., Inc., 880 F.3d 89, 96-98 (3d Cir. 2018) — that once the government has proven an AKS violation occurred, to demonstrate causation, it need only prove a causal link that (1) a patient has been “exposed to an illegal recommendation or referral” and (2) that the provider has submitted a reimbursement claim for that patient.
  • In contrast, Regeneron argued for the stricter “but-for causation standard — that the government must demonstrate that an AKS violation occurred and that the remuneration actually caused the provider to provide different medical treatment and thus caused the false claims.
  • The court held that the adoption by Congress of the ‘resulting from’ language in the AKS statute required a finding that the appropriate standard is but-for causation.
Categories
Health Law Highlights

U.S. Supreme Court Declines to Clarify Key Provisions of the False Claims and Anti-kickback Statutes

From Stevens & Lee, by Charles Honart:

  • The Supreme Court declined to resolve a circuit court split on the issue of causation, to wit, when a provider’s claim for reimbursement results from a violation of the Anti-kickback Statute (“AKS”) for purposes of liability under the False Claims Act (“FCA”).
  • Remuneration: A hospital’s decision not to hire an ophthalmologist in return for a general commitment of continued surgery referrals from another ophthalmologist was not “remuneration” covered by the AKS.
  • Causation: The term “resulting from” means that there must be “but-for” causation, *i.e.*, the claim for reimbursement would not have been submitted but-for the violation of the AKS.
  • This ruling is consistent with the Eighth Circuit in United States ex rel. Cairns v. D.S. Med. LLC, 42 F.4th 828 (8th Cir. 2022), but contrasts with the Third Circuit’s opinion in United States ex rel. Greenfield v. Medco Health Sols., Inc., 880 F.3d 89 (3d Cir. 2018), where the court held there must only be a “link” between the AKS violation and the filing of the claim.
Categories
Health Law Highlights

Healthcare AI and HIPAA Compliance

From AI in Healthcare by Dave Pearson:

  • AI can accumulate a large amount of data from many sources. Using large datasets, AI can realistically re-identify previously de-identified healthcare data.
  • Under the HIPAA de-identification safe harbor, even if you remove the 18 specific identifiers, you cannot have actual knowledge that the information could be used alone or in combination with other information to identify patients. Is it possible to meet that standard in the age of AI?
  • This is an evolving area. These issues and others will continue to develop for years to come.
Categories
Health Law Highlights

HHS-OIG Says Anatomic Pathology Lab’s Purchased Service Arrangement Could Violate Anti-Kickback Statute

From Barnes & Thornburg, LLP, by Jason D. Schultz, Anne B. Compton-Brown, Mary Elizabeth “Lizzie” Ford:

  • U.S. Department of Health and Human Services issued an unfavorable opinion addressing an anatomic pathology laboratory that purchases services at fair market value from other labs, and bills commercial payors for such services
  • Even though the proposed arrangement carved out services reimbursed by Federal healthcare programs, the agency determined the arrangement posed a risk of fraud and abuse under the Anti-Kickback Statute
  • The opinion reiterates the HHS-OIG’s long-standing position against arrangements that “carve out” Federal healthcare program business, but still result in increased referrals of Federal healthcare program business outside of the arrangement
Categories
Around the Web

Surprise… No Surprises Act Arbitration Is Too Expensive

Kirk Davis, Danielle Gordet, writing for Akerman:

In December of 2022, the Departments had increased the fee from $50 to $350, effective January 1, 2023, to address “the rising volume of disputes and additional expenditures associated with the Departments’ enhanced role in 2023 in conducting pre-eligibility reviews to address the backlog of disputes.” Thereafter, the Texas Medical Association (TMA) brought suit against the Departments arguing that the $350 administrative fee was prohibitive for providers with small-value claims. On August 3, 2023, the U.S. District Court for the Eastern District of Texas found in favor of TMA (See Opinion and Order).

In response to the court’s decision, the Departments announced on August 11, 2023, that the administrative fee amount for any disputes initiated on or after August 3, 2023, will be $50 per party per dispute. However, for disputes initiated on or after January 1, 2023 through August 2, 2023, where a party had “paid” the administrative fee to a certified IDR entity, the administrative fee remains $350 and refunds will not be issued.

Categories
Around the Web

Texas Amends Data Breach Notification Law

Julia K. Kadish, writing for SheppardMullin:

Texas recently enacted an amendment to its data breach notification law. As of September 1, 2023, there are two changes to the requirements when notifying the Texas Attorney General. In Texas, breaches of 250 residents or more must be reported to the Attorney General. Now, as amended, this will need to be done so as soon as practicable, and not later than 30 days from determination of the breach (previously, it was 60 days). Texas joins Colorado, Florida, and Washington in requiring notice within a 30-day time frame. Notification in Texas must also be submitted electronically using a form on the AG’s website.

Categories
Around the Web

The Evolution of Telehealth and What’s Next

James Tekippe, CFA, writing for VMG Health:

For those in the healthcare industry, telemedicine has been viewed as a way to increase access to healthcare, while mitigating the challenges of limited resources of physicians and healthcare providers. Although the use of telehealth has steadily grown over the past two decades, the challenges presented by the COVID-19 pandemic supercharged this growth. As the United States and the world move beyond the worst months and years of the pandemic, telemedicine usage will continue to change within the industry. This article will explore the state of telehealth immediately prior to and during the early years of the pandemic to provide context for the question, “What will be the next stage of telemedicine in the U.S. healthcare system?”

Categories
Around the Web

New Texas Medical Billing Requirements Can Leave Hospitals and Other Health Care Facilities Unable to Collect for Services Provided

Joe Lecroy, Tracie Bedeauxm, writing for Katton:

Starting September 1, 2023, health care facilities in Texas will have to make changes to their billing practices to comply with a newly passed law requiring greater transparency in medical billing …

A health care provider that requests payment from a patient after providing a health care service or related supply shall provide a written, itemized bill sufficiently describing the cost of each service and supply provided to the patient. This itemized bill must be submitted within 30 days after the provider receives a final payment on the provided service or supply from a third party, including payors. The itemized bill may be submitted to the patient in writing, or electronically through a patient portal on the provider’s website. Further, the provider must provide this bill on request at any time following the issuance of the original itemized bill.

Categories
Around the Web

It’s a Long Way From Here to There: Advanced Healthcare Practitioners, EMTALA’s Call Coverage Requirements, and Rural Hospitals

Nick Healey, writing for HuschBlackwell | Healthcare Law Insights:

In an attempt to fill out the call schedule, however, some rural hospitals list advanced healthcare practitioners (AHP’s) with specialized training (such as psychiatric nurse practitioners, or certified nurse midwives) on the physician call schedule for those specialties. This practice, although well-intentioned, could lead a hospital to unintentionally violate EMTALA, since EMTALA specifically requires the hospital to maintain a list of physicians who are on-call.

In addition, CMS’ guidance specifically states that only physicians, and not AHP’s, can be listed as the “first call” for the ED; if a physician is listed as “on-call”, the ED must first contact that physician, not an AHP designated by that physician. CMS does allow, on a case-by-case basis, the on-call physician to send an AHP to respond to the ED in the physician’s place, but only after consultation between the ED and the on-call physician, and only if the ED agrees. Listing an AHP on the physician call schedule for a specialty, or allowing an AHP to take the “first call” when the physician is listed as on-call, could potentially violate EMTALA.