Author: WadeEmmert

Categories
Alert

Office for Civil Rights Reminder HIPAA Flexibilities End May 2023

HHS Office of Civil Rights confirmed that that four Notifications of Enforcement Discretion (“Notifications”) will expire upon expiration of the COVID-19 PHE, which is currently scheduled for 11:59 p.m. on May 11, 2023.

OCR’s notice applies to four Notifications of Enforcement Discretion of HIPAA related to the following circumstances:

  1. COVID-19 Community-Based Testing Sites during the PHE (available here);
  2. Telehealth Remote Communications during the PHE (available here);
  3. Uses and Disclosures of PHI by Business Associates for Public Health and Health Oversight Activities (available here); and
  4. Online or Web-Based Scheduling Applications for Scheduling COVID-19 Vaccination Appointments (available here).

Source: Notice of Expiration of Certain Notifications of Enforcement Discretion Issued in Response to the COVID-19 Nationwide Public Health Emergency

Categories
Alert

HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care

HHS Office of Civil Rights has proposed changes to HIPAA’s Privacy Rule which would prohibit disclosures to law enforcement related to obtaining or providing abortions.

The current Privacy Rule permits covered entities to disclose Protected Health Information (PHI) about an individual for law enforcement purposes “pursuant to process and as otherwise required by law”, under certain conditions.

The proposed rule would prohibit covered entities from disclosing to law enforcement PHI related to abortions.

Per HHS:

After Dobbs, the Department has heard concerns that civil, criminal, or administrative investigations or proceedings have been instituted or threatened on the basis of reproductive health care that is lawful under the circumstances in which it is provided. The threat that PHI will be obtained and used in such an investigation or proceeding is likely to chill individuals’ willingness to seek lawful treatment or to provide full information to their health care providers when obtaining that treatment.

…

[T]he Department believes it is necessary to provide heightened protections for another especially sensitive category of health information—PHI sought for the purposes of conducting a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided. These proposed modifications would provide heightened protections for individuals’ health information privacy under the defined circumstances; foster an open and honest exchange of information between the individual and health care provider, who—with that information—could employ evidence-based clinical practice guidelines; and increase access to high-quality, lawful health care.

Source: HIPAA Privacy Rule to Support Reproductive Health Care Privacy

Categories
Around the Web

Supreme Court’s False Claims Case Alleges Overbilling of Medicare and Medicaid

Violations of the False Claims Act require a requisite state of “knowledge” a claim’s falsity. To violate the statute, one must have “actual knowledge,” “deliberate ignorance” or “reckless disregard of the truth or falsity” of the claim. Any of those broad levels of knowledge is sufficient to support a False Claims Act violation.

But knowledge in retrospect looks different than knowledge prosectively. Is the “usual and customary” price of a drug the price that cash customers pay in cash, or is it the price negotiated by insurance companies or set by Medicare?

This week, the United States Supreme Court will consider the issue in U.S. ex rel. Proctor v. Safeway, Inc.

Nina Totenberg for NPR explains:

The case essentially began in 2006, when Walmart upended the retail pharmacy world by offering large numbers of frequently used drugs at very cheap prices — $4 for a 30-day supply — with automatic refills. That left the rest of the retail pharmacy industry desperately trying to figure out how to compete.

The pharmacies came up with various offers that matched Walmart’s prices for cash customers, but they billed Medicaid and Medicare using far higher prices, not what are alleged to be their usual and customary prices.

Walmart did report its discounted cash prices as usual and customary, but other chains did not. Even as the discounted prices became the majority of their cash sales, other retail pharmacies continued to bill the government at the previous and far higher prices.

For example, between 2008 and 2012, Safeway charged just $10 for almost all of its cash sales for a 90-day supply of a top-selling drug to reduce cholesterol. But it did not report $10 as its usual and customary price. Instead, Safeway told Medicare and Medicaid that its usual and customary price ranged from $81 to $109.

Categories
Alert

DOJ Settlements Are a Stark Reminder

Arrangements with referring physicians are common in healthcare, but they can be very danagerous if not structured properly. Too often they are used to obfuscate the purpose of payments to physicians.

The Department of Justice for the Eastern District of Michigan announced three civil settlements which serve as good reminders of the types of arrangements that can get providers into trouble:

  • The health system had contracts with several physicians to serve as medical directors, and none of these arrangements satisfied any exceptions to the Stark Law or the AKS, such that referrals these physicians made to the health system violated the False Claims Act.
  • The health system employed a physician and this financial relationship did not satisfy any exception to the Stark Law, such that referrals for designated healthcare services were prohibited and violated the False Claims Act.
  • The health system rented office space to a physician and forgave rent payments, constituting remuneration paid in exchange for referrals from that physician in violation of the AKS and the False Claims Act, and creating a financial relationship that did not meet any exception to the Stark Law, also violating the False Claims Act.
  • The health system permitted a group of referring physicians to secure an equipment lease through non-arm’s-length negotiations, in order to induce referrals of patients from these physicians, in violation of the AKS and the False Claims Act.
Categories
Around the Web

Widespread Third-Party Tracking On Hospital Websites Poses Privacy Risks For Patients And Legal Liability For Hospitals

Web tracking technology has been in the news a lot lately. Most websites use such tools to track users as they navigate through a particular site and around the web. Nothing new here. But in doing so, user data gets transferred from one site to another, or actively collected, posing privacy risks for healthcare providers.

A new study, published in Health Affairs, indicates that 99% of hospital websites use third-party tracking code on their sites, creating privacy risks for patients and legal liability for hospitals:

We found that third-party tracking is present on 98.6 percent of hospital websites, including transfers to large technology companies, social media companies, advertising firms, and data brokers. Hospitals in health systems, hospitals with a medical school affiliation, and hospitals serving more urban patient populations all exposed visitors to higher levels of tracking in adjusted analyses. By including third-party tracking code on their websites, hospitals are facilitating the profiling of their patients by third parties. These practices can lead to dignitary harms, which occur when third parties gain access to sensitive health information that a person would not wish to share. These practices may also lead to increased health-related advertising that targets patients, as well as to legal liability for hospitals.

Categories
Around the Web

OIG Approves Gift Cards to Promote Patient Compliance with a Preventive Screening Measure

OIG has approved the use of gift cards to incentivize patients to return sample collection kits, provided there are certain safeguards in place:

  • Mailing the gift cards only to those patients who return the kits by the deadline specified in the reminder letter.
  • Advising patients that they may not use the gift cards on items or services provided by the requestors.
  • Limiting patients to one gift card every 36 months, which is consistent with Medicare’s coverage period for the screening test.
  • Implementing processes to ensure patients who received a gift card during the 36-month period do not receive another one during that period.
  • Refraining from patient-focused promotional activities that advertise the availability of the gift card.
  • Prohibiting advertising or marketing the proposed arrangement to healthcare providers who may order the test.
  • Excluding tests ordered by healthcare providers through the requestors’ website from the proposed arrangement.

Dee Harleston, Stewart Kameen, Jinnifer Michael, and Danielle Sloane, for Bass Berry & Sims:

The U.S. Department of Health and Human Services Office of Inspector General (OIG) recently issued Advisory Opinion 23-03, approving a proposal by the manufacturer of a colorectal cancer screening test and its wholly owned laboratory to provide gift cards to certain patients to encourage them to return the sample collection kits. While limited in scope, this favorable opinion is noteworthy because OIG typically disfavors arrangements under which providers or suppliers distribute gift cards to incentivize patients to obtain federally reimbursable services. Although OIG approved the proposed arrangement at issue in Advisory Opinion 23-03, the agency also pointedly warned entities against structuring arrangements that differ from the facts of the proposed arrangement.

OIG Advisory Opinion 23-03

Categories
Alert

Can Actions Be Considered Remuneration Under the Anti-Kickback Statute?

When discussing the Anti-Kickback Statute (AKS), it’s common to say that “remuneration” can be “anything of value.” That board definition has been called into question by the Sixth Circuit in United States ex rel. Martin v. Hathaway et al., No. 22-1463. In that case, a qui tam relator (physician) alleged that a small-town hospital refused to hire her in exchange for a physician group to continue to send the hospital referrals. The “value” then was the not hiring a physician in exchange for referrals. The AKS does not define “remuneration.”

The Sixth Circuit determined that a careful examination of the meaning of “remuneration” and context shows that this term is limited to “payments and other transfer of value,” not “any act that may be valuable to another.” Thus the act of not hiring the physician is not remuneration.

Further, even if remuneration was present, the court stated that False Claims Act liability “resulting from” an AKS violation requires showing but-for causation. In other words, an FCA plaintiff must show “that the referrals would not have been made without the remuneration, and that the claims would not have been submitted to the government without those referrals.” Here, the qui tam physician was unable to point to any specfic Medicare claims that would not have been submitted as a result of the hospital’s decision not to hire the physician.

Categories
Around the Web

FDA to Refuse Medical Device Submissions For Cybersecurity Reasons Beginning in October

Jill McKeon, for Health IT Security:

Effective immediately, the US Food and Drug Administration (FDA) will require medical device manufacturers to provide cybersecurity information in their premarket device submissions. Additionally, beginning October 1, the FDA will exercise its authority to refuse submissions for cybersecurity reasons.

…

Key Medical Device Security Requirements Included in Omnibus Bill
HSCC Publishes Guidance On Managing Legacy Medical Tech Security
Outdated Operating Systems Remain Key Medical Device Security Challenge
For any submission after March 29, manufacturers must include a “plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures,” the FDA stated.

In addition, manufacturers must develop and maintain procedures that provide a reasonable assurance that the device and systems are cybersecure and incorporate plans to patch and update the device and related systems at the postmarket stage.

Lastly, manufacturers are required to provide a software bill of materials (SBOM) for their devices, including commercial, open-source, and off-the-shelf software components. The FDA issued an accompanying FAQ document to help manufacturers determine their obligations.

FDA: Cybersecurity in Medical Devices Frequently Asked Questions (FAQs)

Categories
Around the Web

FDA Cybersecurity Requirements for Medical Devices Now in Effect

From the HIPAA Journal:

On Wednesday, March 29, 2023, the medical device cybersecurity requirements of the $1.7 trillion omnibus spending bill – The Consolidated Appropriations Act, 2023 – took effect and the FDA now requires all regulatory submissions for medical devices to include information about the cybersecurity measures that have been implemented for the devices. Section 3305 of the Omnibus bill — Ensuring Cybersecurity of Medical Devices — amended the Federal Food, Drug, and Cosmetic Act (FD&C Act) by adding section 524B, Ensuring Cybersecurity of Devices. This requirement took effect 90 days after the enactment of the Act on December 29, 2022, which means premarket submissions submitted to the FDA after March 29, 2023, require information to be included about the cybersecurity of medical devices.

Categories
Around the Web

A Federal Judge Suspends FDA’s Longtime Approval of an Abortion Pill, but Gives the Government 7 Days to Appeal

Medication abortions typically use two drugs taken together: Mifepristone and Misoprostol. This ruling only affects Mifepristone. The other drug, Misopostol, is still available, but its use has always required the physician to prescribe it “off-label,” meaning it is not FDA-approved for abortions. It is FDA-approved only for use to prevent stomach ulcers while taking NSAIDs.

Chloe Atkins writing for NBC News:

In an unprecedented move, U.S. District Judge Matthew Kacsmaryk on Friday suspended the Food and Drug Administration’s longtime approval of key abortion pill mifepristone, though he gave the government a week to appeal his decision. If the ruling does eventually go into effect, it would curtail access to the standard regimen for medication abortion nationwide.

The FDA approved mifepristone more than 20 years ago to be used in combination with a second drug, misoprostol, to terminate pregnancies at up to 10 weeks. Over half of U.S. abortions are done by medication abortion, according to the Guttmacher Institute, a research group that supports abortion rights.

…

If the stay on the FDA’s mifepristone approval goes into effect, the drug would no longer be available anywhere in the U.S. That would leave a surgical procedure or off-label use of misoprostol on its own as the only options in states where abortion is legal.