Skip to the contentAntitrust
- The US antitrust agencies have withdrawn the Antitrust Guidelines for Collaboration Among Competitors, directing businesses to rely on case law instead of formal guidelines. This action follows the 2023 removal of healthcare-related enforcement policy statements, creating a guidance vacuum for businesses seeking to comply with antitrust laws. The DOJ and FTC now refer companies to select court cases as examples, though these cases demonstrate wide variation in their specifics. Companies are advised to seek antitrust reviews, implement compliance policies, and conduct regular training.
Data Breaches
- UT Southwestern Medical Center experienced a data breach in late-2024 that exposed 43,048 patients’ data through unauthorized access to a third-party calendar tool, marking their sixth breach since 2020. The exposed data included sensitive information such as names, dates of birth, Social Security numbers, medical records, diagnoses, and insurance information. UTSW’s breach occurred due to improper use of a calendar management tool without a business associate agreement. UTSW has taken remedial action, including implementing stronger security measures and notifying affected individuals.
- A significant cyberattack on Texas Tech University Health Sciences Centre (TTUHSC) and its El Paso campus between September 17-29, 2024, compromised sensitive data of approximately 1.4 million individuals, with the Interlock ransomware group claiming responsibility for stealing 2.1 million files totaling 2.6 terabytes. The breached data included personal information such as names, Social Security numbers, financial details, and health-related records, prompting TTUHSC to offer complimentary credit monitoring services and establish a toll-free assistance line for affected individuals. The incident follows a pattern of major healthcare sector cyberattacks in 2024, including the Change Healthcare breach affecting 100 million individuals ($22 million ransom), MediSecure in Australia, and Synnovis in London’s NHS hospitals. TTUHSC discovered the breach in mid-September, reported it to authorities, and is implementing enhanced security measures while working with cybersecurity specialists. The organization is directly notifying affected individuals and advising them to monitor their credit reports, financial statements, and healthcare billing records, with access to free annual credit reports from Equifax, Experian, and TransUnion.
Fraud & Abuse
- A Medicare fraud and kickback scheme led to the conviction of a hospice owner and marketer , with fraud totaling $3.2 million. The owner, who was previously banned from Medicare, concealed her ownership of the hospice through her daughter in 2025, created fake patient charts, and paid the marketer $6,000 monthly for patient referrals, resulting in 12 counts of healthcare fraud and 16 counts of kickback violations. While awaiting trial, the hospice owner took control of three additional hospices and submitted approximately $4.8 million in fraudulent claims. Many enrolled patients were not terminally ill or unaware of their hospice enrollment, with the marketer deliberately misrepresenting hospice eligibility requirements to prospective patients.
- The Seventh Circuit Court of Appeals is considering a landmark case that could redefine what constitutes a “referral” under the Federal Anti-Kickback Statute (AKS). The case centers on Mark Sorensen, owner of SyMed Inc., who was convicted and sentenced to 42 months in prison, ordered to pay nearly $2 million in forfeiture, and fined $25,000 for an arrangement where his company paid marketing firms to find patients needing orthopedic braces and secure orders from healthcare providers. The government argues that non-healthcare professionals can make referrals under the AKS when steering patients to specific providers, while Sorensen’s defense contends the marketing activities were passive and administrative, similar to services like 1-800 Contacts. The court’s pending decision will have significant implications for healthcare marketing practices, potentially expanding AKS prosecution to include marketing professionals and clarifying when promotional activities cross the line into illegal referrals. The case was argued on December 4, 2024, with the Circuit Court’s opinion expected to provide crucial guidance for healthcare entities engaging in marketing activities.
- Recent amendments to the Stark Law have introduced significant changes affecting healthcare real estate transactions. The law, which governs physician self-referral for Medicare and Medicaid patients, has been updated with new definitions of fair market value (FMV) and general market value specifically tailored to healthcare transactions. These modifications directly impact how lease and service agreements are structured under the Stark Law exceptions, while the regulations, including the Anti-Kickback Statute, continue to present operational challenges and potential pitfalls for real estate decisions in healthcare settings.
HIPAA
- The North American EHR market is projected to reach $14.72 billion in 2024 with a 2.84% CAGR through 2030, serving 88.6% of American physicians in small practices. HIPAA, enacted in 1996, serves as the cornerstone of patient data protection in the U.S., with a clear distinction between HIPAA compliance (an ongoing legal requirement) and HIPAA certification (completion of educational courses). Healthcare organizations must prioritize partnerships with HIPAA-certified experts to ensure proper data handling and security, while focusing on meaningful metrics like script lifts rather than just impressions. The digital transformation of healthcare, while promising improved patient outcomes through AI-powered EHRs and predictive models, requires careful balance between technological advancement and maintaining patient data security.
- The U.S. Department of Health and Human Services has finalized key information blocking exceptions . The first rule establishes the Trusted Exchange Framework and Common Agreement (TEFCA) Manner Exception, which allows participants to limit electronic health information exchange to other TEFCA members, with full implementation targeted for late 2025 into 2026. The second rule, HTI-3, finalizes the Protecting Care Access exception, which provides protection for healthcare providers when handling reproductive health information and must be implemented by December 23, 2024. The rules include provisions for privacy protection, information segmentation, and a good faith standard that does not require providers to conduct legal research to support their decisions to withhold information. Healthcare providers must now update their policies, train staff, and implement new procedures to comply with these exceptions while maintaining documentation of their application.
- The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has proposed the first update to the HIPAA Security Rule since 2013, requiring healthcare organizations to implement stronger cybersecurity measures for protected health information. The new requirements include written risk assessments, network segmentation, vulnerability scanning every six months, and penetration testing every 12 months. From 2018 to 2023, healthcare data breaches increased by 102%, affecting 167 million individuals in 2023 alone. The proposed changes address the evolution of healthcare delivery, increased cyber threats, and compliance issues observed by OCR. The current Security Rule remains in effect while HHS proceeds with the rulemaking process.
- A Texas federal court has issued a preliminary injunction blocking the enforcement of the 2024 HIPAA Reproductive Privacy Rule against Dr. Carmen Purl and her clinic, which was set to require compliance by December 23, 2024. The rule, which went into effect on June 24, 2024, aimed to strengthen privacy protections for reproductive health care information, but Dr. Purl and the State of Texas filed separate lawsuits challenging its validity. The court determined that the rule conflicts with child abuse reporting laws and would cause irreparable harm to the plaintiffs through compliance costs and potential violations of Texas law. The court has requested additional briefings on constitutional questions and the definition of reproductive health care, while noting that existing HIPAA rules already protect reproductive healthcare information.
Hospitals and Hospices
- Medicare hospice utilization rebounded to 51.7% in 2023, reaching pre-pandemic levels, with total Medicare hospice payments hitting $25.7 billion and serving more than 1.7 million beneficiaries. The total number of hospice providers exceeded 6,500 in 2023, marking a 10% increase primarily driven by for-profit companies, with significant growth in Arizona, California, Nevada, Texas, and Georgia – states that have become hotspots for Medicare fraud concerns. Financial performance varied significantly between provider types, with for-profit hospices achieving 16% margins while non-profits saw only 0.3% margins. CMS implemented enhanced oversight measures in August 2023 for new hospices in four of these five states, including medical review of claims before payment. Based on the positive utilization trends and providers’ access to capital, MedPAC recommended eliminating the base payment rate increase for 2026.
- Tweener hospitals, which are too large for critical access status but too small for financial security, face closure risks with 21 hospitals closing in 2024 and 700 rural facilities at risk. These facilities struggle with cost increases outpacing reimbursement, provider shortages affecting 66% of rural areas, third-party payer denials, loss of pandemic funding, and cybersecurity threats. The closures impact healthcare access and community economics, as these hospitals serve as major employers. Congress created the Rural Emergency Hospital designation in 2020 as a solution, with 18 states enacting legislation and 30 hospitals converting to this status.
Marketing
- The Federal Trade Commission issued warning letters to 21 healthcare marketing companies on December 10, 2024, during the open enrollment period for healthcare plans. The letters address potential violations related to misrepresenting benefits, costs, and incentives in healthcare plan marketing, and emphasizing the need for honest marketing practices. The FTC referenced past enforcement actions against companies like Simple Health and Benefytt Technologies as examples of consequences for violations. While no specific wrongdoing was alleged, the FTC urged recipients to review their advertisements for compliance and warned of continued monitoring of the marketplace. The agency’s warning targets companies involved in marketing Affordable Care Act Marketplace insurance and healthcare-related products, including limited benefit plans and medical discount programs.
Mergers & Acquisitions
- The DOJ’s M&A Safe Harbor policy allows companies to voluntarily disclose misconduct discovered during mergers and acquisitions within six months of closing, potentially avoiding prosecution if they remediate issues within 12 months. The policy offers benefits including reduced penalties, improved reputation, and streamlined remediation, but also carries risks such as expanded investigations, reputational damage, and increased regulatory scrutiny. Companies must evaluate several key factors when considering self-disclosure, including the nature and severity of misconduct, its widespread nature, risk of discovery, remediation feasibility, and reputational impact. Expert Amanda Johnston from Gardner Law characterizes the policy as a “double-edged sword” that requires careful consideration of specific circumstances and potential consequences. The article is part of a 5-part series focused on due diligence in FDA-regulated industries.
- The Justice Department’s Antitrust Division and FTC withdrew their 2000 Antitrust Guidelines for Collaborations Among Competitors on December 11, 2024, citing several key reasons including outdated court precedents, reliance on withdrawn policy statements, problematic safe harbors, and failure to address modern business technologies like AI and algorithmic pricing. The withdrawal was approved by a 3-2 FTC vote, with Commissioners Holyoak and Ferguson dissenting, arguing that removing guidance without replacement leaves businesses uncertain and questioning the timing given an upcoming administration change. The withdrawal does not affect other guidance documents, such as cybersecurity information sharing policies, nor does it specify how antitrust issues will be analyzed going forward. Commissioner Ferguson was noted to have been appointed by President-Elect Trump to replace Lina Khan as FTC Chairperson.
- A comprehensive study published in the Journal of the American College of Surgeons reveals that hospital mergers and acquisitions rarely deliver on their promised benefits. The systematic review, analyzing studies from 2000-2024, found that 77% showed either reduced quality or no improvement in care quality after integration, while 93% of cases resulted in increased hospital charges. Nearly 70% of U.S. hospitals are now part of larger health systems, yet more than half of the reviewed studies (54%) demonstrated a negative net impact on healthcare value.
OIG Advisory
- New OIG Advisory Opinion No. 24-10 addresses a medical and dental supplies distributor’s proposed expansion of their customer loyalty program, where members earn points on dental-related purchases that can be redeemed for discounts on future purchases. The program includes a tiered membership system based on annual spending, offering benefits like priority scheduling, extended warranties, and service discounts, with points worth $0.005 each and redeemable for up to 50% of purchase prices. The program would cover approximately 200,000 dental-related products, including both federally reimbursable and non-reimbursable items, with points earned equally regardless of product type and membership available to smaller customers like dental practitioners, specialists, laboratories, and local dental service organizations. While the arrangement would technically generate prohibited remuneration under the Federal anti-kickback statute, the OIG concluded it poses low risk of fraud and abuse due to its structure, transparency, and limitations, and therefore would not impose administrative sanctions. The program includes safeguards such as points being non-transferable, having no cash value, requiring partial payment for all purchases, and maintaining transparency through a points dashboard managed by a third-party vendor.
- New OIG Advisory Opinion No. 24-11 addresses a pharmaceutical manufacturer’s program to provide free meningococcal vaccinations to patients prescribed their drugs, which carry a high risk of meningococcal infections (1,000-2,000 times greater than healthy individuals). The program aims to remove barriers to vaccination access and includes both the vaccines themselves and administration through either a third-party vendor or healthcare providers, with Medicare Part D enrollees exempt from out-of-pocket costs for these vaccines as of January 1, 2023. While the arrangement technically constitutes remuneration under the Federal anti-kickback statute, the OIG determined the fraud risk is low since it primarily enhances safety protocol compliance rather than inducing drug purchases, and healthcare providers can only bill for a nominal administration fee (approximately $20). The OIG concluded they would not impose sanctions under the Federal anti-kickback statute or the Beneficiary Inducements CMP, as the arrangement primarily serves to address FDA safety concerns and doesn’t significantly influence provider selection or medical decision-making.
- New OIG Advisory Opinion No. 24-12 evaluates a pharmaceutical company’s arrangement to provide free genetic testing and counseling services for patients with specific kidney-related conditions, particularly focusing on an ultra-rare genetic condition affecting only 3 in 1,000,000 people. The arrangement includes three types of genetic testing panels offered through Quest Diagnostics’ subsidiary Blueprint Genetics, along with optional genetic counseling services, all provided at no cost to eligible patients who meet specific medical criteria. The pharmaceutical company manufactures a drug approved for treating one subtype of the condition (Subtype 1), but the arrangement prohibits sharing identifiable patient data with the company and prevents any direct marketing of the drug through the program. The OIG concluded that while the arrangement technically generates prohibited remuneration under both the Federal anti-kickback statute and Beneficiary Inducements CMP, they would not impose administrative sanctions due to the low risk of fraud and abuse, given the narrow eligibility criteria, lack of marketing connection to the drug, and various safeguards in place. The arrangement includes specific limitations, such as applying only to the requesting company and requiring all material facts to be fully and accurately presented for the opinion to remain valid.
- New OIG Advisory Opinion No. 24-13 evaluates a pharmaceutical company’s arrangement to provide financial assistance for travel, lodging, meals, and associated expenses to patients receiving a specific cell therapy product. The arrangement was intended to support patients who need to travel to specialized treatment centers for a potentially curative T-cell immunotherapy, especially those who have tried and failed other treatment options. The OIG concluded that while the arrangement could potentially be seen as providing prohibited remuneration under the Federal anti-kickback statute, it would not impose administrative sanctions. The OIG found the risk of fraud and abuse to be low because the arrangement helps remove barriers to accessing necessary medical care without promoting overutilization or inappropriate use of services. The arrangement also ensures that patients and their caregivers receive support only when other assistance is unavailable, thereby reducing the risk of it being used as a marketing tool to influence treatment decisions. Furthermore, the OIG determined that the arrangement does not violate the Beneficiary Inducements CMP because it meets the “Promotes Access to Care Exception.” This exception applies when the remuneration improves a patient’s ability to obtain medically necessary services without increasing costs or compromising patient safety and quality of care.
Pharma
- The 340B Program in 2024 experienced major changes as pharmaceutical manufacturers introduced rebate models requiring entities to pay non-340B prices upfront and request rebates afterward, leading to legal challenges from Johnson & Johnson, Eli Lilly, and Bristol-Myers Squibb against HHS. At least 37 manufacturers continued restricting 340B pricing for contract pharmacy arrangements, while eight states enacted laws to protect contract pharmacy access, with the 8th Circuit Court upholding Arkansas’s law. The 340B SUSTAIN Act gained momentum in Congress, proposing to formalize contract pharmacy arrangements and establish a centralized clearinghouse for claims processing. HRSA issued a revised Alternative Dispute Resolution process and continued audits based on sub-regulatory guidance, despite ongoing challenges to its enforcement authority.
Real Estate and Leases
- Letters of Intent are vital for health care leases. Though typically non-binding, the LOI serves as a roadmap for lease negotiations and should address terms including initial and renewal periods, operating expenses, assignment rights, maintenance obligations, holdover provisions, tenant improvements, exclusivity rights, and default terms. The document must include specific details about permitted use, square footage, parking rights, and signage rather than deferring details to the final lease. Senior Counsel Allison Zangrilli and Zlata Fayer from Epstein Becker Green’s Health Care and Life Sciences Group provide this guidance based on their experience in commercial lease negotiations. The article emphasizes that comprehensive LOI terms reduce negotiation time and prevent costly disputes during the lease drafting process.
- In a significant ruling from the U.S. Bankruptcy Court for the Western District of Pennsylvania, the Guardian Elder Care case established that assisted living and nursing facilities qualify as residential properties under Section 365(d)(3) of the Bankruptcy Code, allowing more flexibility in post-petition rent payments during Chapter 11 proceedings. The court applied a “totality of circumstances” test to determine the property classification, considering factors such as long-term occupancy and the facilities’ purpose as homes for residents. The decision aligns with legislative history from 1984, which initially created the residential/nonresidential distinction primarily to protect shopping center landlords. The ruling provides relief for healthcare facilities facing financial challenges after the reduction of pandemic-era federal support, while still maintaining protections for landlords through administrative expense priority and stay relief options.
Transgender Care
- A federal appeals court ruled that two Texas doctors lack standing to sue over the Biden administration’s transgender health discrimination policy. The unanimous decision by the 5th U.S. Circuit Court of Appeals reversed a lower court ruling, finding that doctors Susan Neese and James Hurly faced no enforcement threat under the Department of Health and Human Services’ 2021 policy interpreting the Affordable Care Act to prohibit discrimination based on gender identity. The doctors had claimed they risked losing federal funding if they refused to provide treatments they didn’t support, but the court determined they had valid, non-discriminatory reasons for their medical practices. In 2022, HHS issued a formal rule barring gender identity discrimination in healthcare, which was later put on hold amid challenges from Republican states, and the incoming Trump administration could potentially roll back these protections.