Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
Liability for Non-Employees: Beware Apparent Authority
/in Hospitals & Health Systems, Physician Practicesby Kim Stanger
As a general rule, hospitals and other healthcare providers are not liable for the acts of non-employed medical staff members, independent contractors or vendors; instead, each party is responsible for its own actions or those of its employees or agents who are acting within the scope of their employment or agency. However, courts are sometimes willing to hold a hospital or provider vicariously liable for the acts of non-employees under the doctrine of “apparent authority”.
Apparent Authority. In Jones v. Healthsouth Treasure Valley, for example, the Idaho Supreme Court held that a hospital might be liable for the acts of an independent contractor if: (1) the hospital’s conduct would lead a plaintiff to reasonably believe that another person acts on the hospital’s behalf (i.e., the hospital held out that other person as the hospital’s agent); and (2) the plaintiff reasonably believes that the putative agent’s services are rendered on behalf of the hospital (i.e., the plaintiff is justified in believing that the actor is acting as the agent of the hospital). (147 Idaho 109, 206 P.3d 473 (2009)). The Idaho Supreme Court recently reaffirmed the apparent authority theory in Navo v. Bingham Memorial Hospital, 160 Idaho 363, 373 P.3d 681 (2016). Read more
Beware Gifts to Providers, Patients or Other Referral Sources
/in Fraud and AbuseBy Kim Stanger, Holland & Hart LLP
At this time of year, healthcare providers may want to give gifts to referring providers, patients or other sources of business; however, such gifts may violate federal and state fraud and abuse laws and result in fines—or worse—to both the giver and recipient. Here are some guidelines to ensure your gift giving does not get you in trouble with the government.
1. Gifts To Referral Sources. The federal Anti-Kickback Statute (“AKS”) prohibits soliciting, offering, giving, or receiving remuneration in exchange for referrals for items or services covered by federal healthcare programs (e.g., Medicare and Medicaid) unless the arrangement fits within a regulatory exception. (42 USC 1320a-7b(b)). AKS violations are felonies, and may result in criminal and civil penalties, False Claims Act liability, and exclusion from Medicare and Medicaid programs. The AKS is violated if “one purpose” of the remuneration is to induce federal program referrals, including gifts to referring practitioners or program beneficiaries to encourage or reward their business. (OIG Adv. Op. 12-14). Significantly, the AKS applies to both the giver and recipient; thus, soliciting or receiving gifts from vendors or other providers may expose the recipient to liability. The OIG has suggested that “nominal” gifts would not create much AKS risk, but offers no guidance as to what is “nominal”. (65 FR 59441). The AKS does not expressly apply to referrals for private pay business, but the OIG has warned that offering remuneration to obtain private pay referrals may also induce federal program business and thereby violate the AKS. (OIG Adv. Op. 12-06). In addition, offering gifts to induce or reward private pay business may violate state laws, including state laws prohibiting kickbacks, rebates, or fee splitting. (See, e.g., Idaho Code 41-348 and 54-1814). In short, you should not give or accept gifts to or from referral sources (especially those referring federal program business) unless the gift is truly nominal, is clearly and completely unrelated to past or future referrals, or is very unlikely to influence referrals. Read more
Responding to Negative Internet Reviews: Beware HIPAA
/in HIPAABy Kim Stanger, Holland & Hart LLP
As a healthcare provider, you may log onto the internet one day only to discover a negative review from a disgruntled patient or family member. Undoubtedly, the review contains inaccurate, incomplete, or downright defamatory information. Your first impulse may be to post a response online, but doing so may subject you to HIPAA fines, adverse licensure action, or privacy lawsuits.
HIPAA generally prohibits healthcare providers from using or disclosing a patient’s protected health information without the patient’s authorization. (45 CFR 164.502). “Protected health information” includes information that “[r]elates to the past, present, or future physical or mental health or condition of an individual [or] the provision of health care to an individual, and … that [i]dentifies the individual, or [w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” (45 CFR 160.103). Thus, posting any information that identifies the individual as a patient likely violates HIPAA even if specific medical information is not disclosed; a patient does not waive their HIPAA rights by posting his or her own information, and there is no HIPAA exception that allows a healthcare provider to disclose information in response to a negative review. In 2013, Shasta Regional Medical Center paid $275,000 to settle claims that it violated HIPAA when it disclosed a patient’s health information to the media in response to a negative newspaper article. (See Press Release). ProPublica recently published a report identifying numerous HIPAA violations resulting from providers’ ill-considered responses to negative internet reviews. (See article).
Read more
Conduct a Thorough HIPAA Risk Analysis or Pay Big Fines
/in HIPAAby Kim Stanger, Romaine Marshall, and C. Matt Sorensen, Holland & Hart LLP
St. Joseph Health recently agreed to pay $2.14 million to settle allegations by the Department of Health and Human Services Office for Civil Rights Office (“OCR”) that its data security was inadequate.
In its investigation of St. Joseph’s handling of a 2012 data breach that exposed 31,800 patient medical records, OCR claimed St. Joseph did not change the default settings on a new server, which allowed members of the public to access via search engines the personal health information of 31,800 patients for a full year. By failing to switch off its servers’ default setting, St. Joseph potentially violated the HIPAA Security Rule’s requirement to conduct a technical and nontechnical evaluation of any operational changes that might affect the security of ePHI.
In addition to paying $2.14 million, St. Joseph Health agreed to implement a corrective action plan that requires it to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures. St. Joseph had conducted an enterprise-wide risk analysis in 2010, but the OCR deemed that to be inadequate because the analysis did not include an evaluation of the technical specifications of St. Joseph’s servers. Read more
Office of the National Coordinator for Health Information Technology Issues Formal Guidance for Selecting and Negotiating Contracts with Electronic Health Record Vendors
/in Health Informationby Teresa Locke, Holland & Hart LLP
On September 26, 2016, the U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health Information Technology (ONC) released a practical and straightforward tool to assist health care providers as they select and negotiate the acquisition of an electronic health record system (EHR). The document’s title accurately encapsulates the content of the 53-page guide: “EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.” The guide can be found at https://www.healthit.gov/sites/default/files/EHR_Contracts_Untangled.pdf. The new contract guide explains important concepts in EHR contracts and includes example contract language to help providers and health administrators in planning to acquire an EHR system and negotiating contract terms with vendors. Read more