Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
Report HIPAA Breaches Without Delay
/in HIPAAby Kim Stanger
If you experience a HIPAA breach, make sure you investigate and report the breach “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach” or you may be subject to HIPAA fines. (45 CFR 164.404(b)). The Office for Civil Rights just settled for $475,000 its first case against a covered entity for unreasonable delay in reporting a HIPAA breach.
On October 22, 2013, Presence St. Joseph Medical Center (“Presence Health”) discovered that its paper-based operating schedules were missing from its surgery center. The schedules contained protected health information of 836 persons, including names, birthdates, procedure information, and medical record information. Because the breach involved more than 500 persons, Presence Health was required to report the breach to HHS and local media at the time it notified affected individuals. However, due to a miscommunication between its workforce members, Presence Health did not report breach to HHS until January 31, 2014 (101 days after the breach was discovered); did not notify affected individuals until February 3, 2014 (104 days after the breach was discovered); and did not notify the media until February 5, 2014 (105 days after the breach was discovered). The HIPAA Breach Notification Rule requires that covered entities notify individuals and, if the breach involves more than 500 persons, report breaches to HHS and local media without unreasonable delay and in no event later than 60 calendar days after discovery of the breach. (45 CFR 164.404-.410). A separate HIPAA violation occurs for each day the covered entity fails to report the breach beyond the deadline. Presence Health settled the alleged violations for $475,000. A copy of the OCR’s press release is available here. Read more
Idaho Peer Review Privilege
/in Medical Staff, Credentialing, and Corrective Actionby Kim Stanger
Idaho has enacted a broad privilege that protects the confidentiality of credentialing, quality improvement, and similar peer review activities by Idaho hospitals and other health care entities. The statute encourages participation and protects the integrity of such peer review activities by ensuring that peer review communications and proceedings remain confidential, and that participants are immune from liability.
Application. The privilege applies to “peer review” activities conducted by “healthcare organizations”. (I.C. § 39-1392).
“Health care organization” means a hospital, in-hospital medical staff committee,1 medical society, managed care organization, licensed emergency medical service, group medical practice, or skilled nursing facility.
(I.C. § 39-1392a(3)).
“Peer review” means the collection, interpretation and analysis of data by a health care organization for the purpose of bettering the system of delivery of health care or to improve the provision of health care or to otherwise reduce patient morbidity and mortality and improve the quality of patient care. Peer review activities by a health care organization include, without limitation:
(a) Credentialing, privileging or affiliating of health care providers as members of, or providers for, a health care organization;
(b) Quality assurance and improvement, patient safety investigations and analysis, patient adverse outcome reviews, and root-cause analysis and investigation activities by a health care organization; and
(c) Professional review action, meaning an action or recommendation of a health care organization which is taken or made in the conduct of peer review, that is based on the competence or professional conduct of an individual physician or emergency medical services personnel where such conduct adversely affects or could adversely affect the health or welfare of a patient or the physician’s privileges, employment or membership in the health care organization or in the case of emergency medical services personnel, the emergency medical services personnel’s scope of practice, employment or membership in the health care organization.
(I.C. § 39-1392a(11)). Read more
Requiring Referrals from Employees and Contractors
/in Fraud and Abuseby Kim Stanger
Many providers mistakenly believe that the federal Stark law prohibits hospitals and other employers from requiring employed or contracted physicians to refer healthcare services to the employer. Stark actually allows a hospital or other employer to require contracted physicians to refer items or services to the hospital if the items or services relate to the physician’s services under the contract and certain additional conditions are satisfied.
Stark Regulations. Stark’s “special rules on compensation” state:
A physician’s compensation from a bona fide employer … or other arrangement for personal services may be conditioned on the physician’s referrals to a particular provider, practitioner, or supplier, provided that the compensation arrangement meets all of the following conditions. The compensation arrangement:
(i) Is set in advance for the term of the arrangement.
(ii) Is consistent with fair market value for services performed (that is, the payment does not take into account the volume or value of anticipated or required referrals).
(iii) Otherwise complies with an applicable exception under [42 CFR] §411.355 or §411.357.
(iv) Complies with both of the following conditions:
(B) The requirement to make referrals to a particular provider, practitioner, or supplier does not apply if the patient expresses a preference for a different provider, practitioner, or supplier; the patient’s insurer determines the provider, practitioner, or supplier; or the referral is not in the patient’s best medical interests in the physician’s judgment.
(v) The required referrals relate solely to the physician’s services covered by the scope of the employment, the arrangement for personal services, or the contract, and the referral requirement is reasonably necessary to effectuate the legitimate business purposes of the compensation arrangement. In no event may the physician be required to make referrals that relate to services that are not provided by the physician under the scope of his or her employment, arrangement for personal services, or contract.
Read more
New Safe Harbors for Transportation Programs, Certain Cost-Sharing Waivers, and Gap Discount Programs
/in ProvidersBy Kim Stanger
The OIG has issued new regulatory safe harbors that allow healthcare providers to offer government program beneficiaries certain valuable items without running afoul of the federal Anti-Kickback Statute (“AKS”). (81 F.R. 88368 (12/7/16), available here). The AKS generally prohibits offering or giving remuneration to induce or reward referrals for items or services covered by federal healthcare programs unless the transaction fits within a regulatory safe harbor. Violation of the AKS is a felony, and may result in criminal, civil and administrative penalties; accordingly, it is important to structure transactions with federal program beneficiaries and other referral sources to fit within a regulatory safe harbor if possible. Read more
OIG Increases Limit on Gifts to Government Beneficiaries
/in Healthcare LawBy Kim Stanger
As discussed in our recent client alert, the Civil Monetary Penalties Law generally prohibits providers from offering gifts to Medicare and Medicaid patients or other program beneficiaries if such gifts would induce the patient to receive care from a particular provider; however, the OIG allows gifts of “nominal value.” The OIG just issued a policy statement increasing the limit from $10 to $15 per item, and from $50 to $75 in the aggregate per patient on an annual basis. The items may not be cash or cash equivalents. Providers may want to modify their policies accordingly. Happy holidays from the OIG!
For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.