July 1, 2013

Checklist for HIPAA Business Associate Agreements

by Kim Stanger, Holland & Hart LLP

In the wake of the HITECH Act and recent Omnibus Rule changes, business associates1 of covered entities must comply with most of the HIPAA Privacy and Security Rules applicable to covered entities or face penalties of $100 to $50,000 per violation.2 Among other things, covered entities and business associates must execute agreements whereby the business associate agrees to comply with certain Privacy and Security Rule provisions affecting protected health information (“PHI”).3 The Omnibus Rules will require most covered entities and business associates to review and update their business associate agreements (“BAAs”) by September 23, 2013.4 The Omnibus Rules will also require covered entities to execute BAAs with certain entities that were not considered business associates in the past, including data storage companies and entities that provide data transmission services and require access to the data on a routine basis.5 To see a decision tree for determining business associate status, click here.

Checklist for BAA Compliance. Under the HIPAA Privacy and Security Rules, BAAs generally must contain the following terms.6 To the extent the business associate enters a BAA with its subcontractors, those subcontract BAAs should also contain equivalent terms.7

  1. Establish the permitted and required uses and disclosures of PHI by the business associate.8 The BAA may not authorize the business associate to use or further disclose the PHI in a manner that would violate the Privacy Rule if done by the covered entity, except that the BAA may but is not required to:
    1. Permit the business associate to use and disclose PHI for the proper management and administration of the business associate.
    2. Permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.
    3. Permit the business associate to disclose PHI for the foregoing purposes if (1) the disclosure is required by law, or (2)(i) the business associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and (ii) the person notifies the business associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.
  2. Provide that the business associate will:9
    1. Not use or further disclose the PHI other than as permitted or required by the BAA or as required by law.
    2. Use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by the BAA.
    3. Where applicable, comply with Security Rules with respect to electronic PHI.
    4. Report to the covered entity any security incidents or use or disclosure of PHI not provided for by the BAA of which it becomes aware, including breaches of unsecured PHI as required by § 164.410.
    5. Ensure that any subcontractors that receive, maintain or transmit PHI on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such PHI. Business associates may do so by requiring the subcontractors to execute a BAA with the business associate.
    6. Make available PHI consistent with the patient’s right to access PHI as set forth in § 164.524.
    7. Make available PHI for amendment and incorporate any amendments to PHI in accordance with
      § 164.526.
    8. Make available the information required to provide an accounting of disclosures in accordance with
      § 164.528, including certain information concerning disclosures of PHI in violation of the Privacy Rule.
    9. To the extent the business associate is to carry out a covered entity’s obligation under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to the covered entity in the performance of such obligation. [Note: this is a new requirement under the Omnibus Rule].
    10. Make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary of HHS for purposes of determining the covered entity’s compliance with the Privacy Rule.
  3. Include appropriate termination provisions10 , i.e.:
    1. At termination of the contract, if feasible, the business associate must return or destroy all PHI received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such PHI.
    2. If such return or destruction of PHI is not feasible, extend the protections of the BAA to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.
    3. Authorize termination of the BAA by the covered entity if the covered entity determines that the business associate has violated a material term of the BAA.

Additional Terms. The OCR has published sample BAA language at its website, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html. However, the OCR’s sample language may not include additional terms that covered entities and business associates may want to include in their agreements. For example, while not required by HIPAA, covered entities may want to:

  1. Confirm that the business associate is acting as an independent contractor and not as the agent of the covered entity.
  2. Require business associates and subcontractors to carry appropriate insurance to cover HIPAA violations.
  3. Require business associates and subcontractors to defend and indemnify the covered entity for violations of HIPAA or the BAA.
  4. Require business associates, at their own cost, to respond to any potential HIPAA violation and provide any notice of privacy breaches or security incidents as mandated by the Privacy, Security or Breach Notification Rules.
  5. Impose time limits or other conditions on the business associate’s performance so long as such conditions do not establish an agency relationship as discussed below.
  6. Coordinate the BAA with the underlying services agreement.
  7. Include additional term or termination provisions.
  8. Authorize termination of the underlying services agreement if the BAA is terminated.
  9. Allow for amendment of the BAA as necessary to accommodate changes to the HIPAA Rules.
  10. Include choice of law and venue provisions.

Business associates may want to include additional or alternative terms that minimize their exposure, such as:

  1. Prohibit covered entities from asking the business associate to take any action that would violate the HIPAA Rules if done by the covered entity.
  2. Prohibit covered entities from agreeing to restrictions on the use or disclosure of PHI that might adversely affect the business associate, or notify the business associate of such restrictions.
  3. Authorize termination of the BAA if the covered entity agrees to restrictions that materially affect the business associate’s ability to perform or costs of performance.
  4. Allow the business associate to recover costs associated with such additional restrictions or requirements.
  5. Eliminate or limit any insurance or indemnification agreement otherwise requested by the covered entity.
  6. Waive or limit damages for which the business associate may be liable under the BAA.

Liability for Business Associate’s Action. The HIPAA Privacy and Security rules confirm that a covered entity violates HIPAA if the covered entity knew of a pattern of activity or practice of a business associate that constituted a material breach or violation of the BAA unless the covered entity took reasonable steps to cure the breach, end the violation, or terminate the contract.11 In addition, a covered entity may be vicariously liable for the business associate’s misconduct if the business associate was acting as the agent of the covered entity.12 The same rules apply to a business associates with respect to their subcontractors.13 Accordingly, covered entities and business associates should ensure that their BAAs:

  1. Confirm the business associate or subcontractor is acting as an independent contractor, and not as the agent of the covered entity or business associate; and
  2. Confirm that the BAA does not give the covered entity or business associate such control over operational activities so as to make the business associate the agent of the covered entity, or the subcontractor the agent of the business associate.

Effect of No BAA. Covered entities and business associates violate HIPAA if there is no required BAA in place; however, business associates must still comply with the relevant HIPAA Rules even if there is no BAA.

Additional Resources. If you have questions about these or other issues, the Office of Civil Rights maintains a helpful website on HIPAA issues, http://www.hhs.gov/ocr/privacy/. In addition, Holland & Hart has prepared sample HIPAA forms for its clients, including sample business associate and subcontractor agreements. If you are interested in obtaining such forms, please contact me at kcstanger@hollandhart.com.

1Under HIPAA, “business associates” are generally defined as those entities outside of the covered entity’s workforce who create, receive, maintain or transmit PHI on behalf of a covered entity to perform certain enumerated functions, including claims processing; data analysis; utilization review; quality assurance; patient safety activities; billing; benefit management; practice management; legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services; data transmission services if routine access to data is required; and subcontractors of business associates. 45 CFR § 160.103.
2Id. at §§ 164.402 and .404.
3Id. at §§ 164.308(b) and .502(e)(1)-(2).
4The Omnibus Rule extends the deadline to September 23, 2014, if (1) the BAA complied with HIPAA rules as they existed before January 25, 2013, and (2) the BAA is not renewed or modified prior to September 23, 2014. See id. at
§ 164.532(e).
5Id. at § 164.103.
6A covered entity need not execute a BAA if the covered entity disclosed only a limited data set (as defined by HIPAA) to the business associate and the covered entity has a data use agreement with the business associate that complies with §§ 164.514(e)(4) and 164.314(a)(1), if applicable. See id. at § 164.504(e)(3)(iv). If the covered entity and business associate are both governmental entities, the BAA may contain certain alternative or additional provisions. See id. at
§ 164.504(e)(3).
7Id. at §§ 164.314(a)(2)(iii) and .504(e)(5).
8Id. at § 164.504(e)(2)(i) and (4)(i)-(ii).
9Id. at §§ 164.504(e)(2)(ii) and .314(a)(2)
10Id. at § 164.504(e)(2)(ii)(J) and (iii). The covered entity may omit the provision authorizing termination if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate. See id.
at § 164.504(e)(3)(iii).
11Id. at § 164.504(e)(1)(ii).
12Id. at § 160.402(c).
13Id. at §§ 160.402(c) and 164.504(e)(1)(iii).

For questions regarding this update, please contact
Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

May 22, 2013

Idaho University to Pay $400,000 for HIPAA Violations: Lessons Learned and Resources to Avoid Penalties

by Kim Stanger, Holland & Hart LLP

This week, Idaho State University agreed to pay $400,000 to settle HIPAA Security Rule violations that allegedly left the electronic health information of 17,500 patients accessible for at least 10 months. According to the Office of Civil Rights (“OCR”):

  • ISU disabled firewall protections that would have otherwise protected the information on its servers.
  • ISU’s risk analyses and assessments of its affiliated clinics were inadequate.
  • ISU failed to apply proper security measures and policies to address risks to the information.
  • ISU did not have procedures for routine review of its system which could have detected the firewall breach much sooner.

All of these items were required by the Security Rule. The OCR’s press release is located here.

This case offers several lessons for all providers and their business associates:

  1. The OCR is serious about Security Rule compliance. Like most of the recent reported cases in which penalties were imposed, this case arose from the violation of the Security Rule. Many if not most providers have ignored or do not understand the specific, technical requirements of the Security Rule. This is the second time the OCR has imposed penalties on Idaho providers for Security Rule violations this year; even larger penalties have been imposed on entities in other states. The message is clear: providers must take Security Rule compliance seriously.
  2. Business associates beware. In addition to providers, HIPAA now applies directly to business associates of providers. Business associates are those entities who create, maintain, receive or transmit protected health information on behalf of providers. Business associates must also comply with Security Rule requirements. Many business associates may not understand their HIPAA obligations.
  3. Perform and document a proper risk assessment. The Security Rule requires covered entities and business associates to perform, document, and periodically update a risk assessment of their information systems to ensure they have adequate policies and procedures to protect electronic health information. The OCR has published a guide for conducting appropriate risk assessments, which is available here.
  4. Implement the required Security Rule policies and procedures. The Security Rule requires providers and business associates to implement specific administrative, physical and technical safeguards set forth in 45 CFR § 164.300 et seq. Implementing and documenting such safeguards are keys to avoiding HIPAA violations and, if violations occur, HIPAA penalties. The OCR has published a series of guides to help providers and business associates implement the Security Rule; the guides are found here.
  5. Respond immediately if you discover a potential breach. Responding immediately may help avoid or mitigate security breaches. In addition, providers and business associates can avoid penalties altogether if (1) the violation did not result from willful neglect, and (2) they correct the problem within 30 days. It behooves providers and business associates to ensure they have the required safeguards in place and respond immediately to potential breaches, including making any necessary reports to individuals or HHS.

Holland & Hart HIPAA Resources. Holland & Hart has prepared resources to help clients and contacts comply with the HIPAA rules, including the following:

  1. A redlined copy of the Security, Privacy and Breach Notification Rules which shows the changes made by the recent HIPAA Omnibus Rule. Click here to view.
  2. Checklists of required HIPAA polices. Security checklist | Privacy checklist.
  3. Sample HIPAA Privacy Rule policies and forms. For information concerning the policies and forms, contact kcstanger@hollandhart.com.
  4. Articles offering suggestions for complying with HIPAA, including the new HIPAA Omnibus Rule requirements. The articles may be downloaded at http://www.hollandhart.com/healthcare/.
  5. HIPAA training webinar. This hour-long webinar was originally presented as part of our Health Law Basics series. The recording may help entities satisfy HIPAA training requirements. The recording is available for download here.

We hope these resources will help our clients and friends comply with HIPAA and avoid the penalties.

For questions regarding this update, please contact
Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

April 18, 2013

OIG Issues Revised Self-Disclosure Protocol

by Patricia (Pia) Dean, Holland & Hart LLP

On April 17, 2013, the Department of Health and Human Services Office of Inspector General released a revised provider self-disclosure protocol (SDP) that supersedes and replaces the 1998 Federal Register Notice and the Open Letters to Health Care Providers issued in 2006, 2008, and 2009. The SDP reaffirms the obligation on all members of the health care industry to take measures to detect and prevent fraudulent and abusive activities, and establishes new reporting requirements and guidance on calculating penalty multipliers.

Importance of Voluntary Self-Disclosure

The new SDP reaffirms the importance of self-disclosure, including OIG’s position that individual and entities that use the SDP and cooperate with OIG during the SDP process deserve to pay a lower multiplier on single damages than would normally be required. For the first time, the SDP states OIG’s general practice of requiring a minimum multiplier of 1.5 times the single damages, although the specific multiplier accepted may vary depending on the facts of each case.

CMS 60-Day Report and Repay Rule

The new protocol addresses CMS’s proposed 60-day “report and repay” rule. The Affordable Care Act generally requires that providers report and return Medicare or Medicaid overpayments within 60 days of the date the overpayment is first identified. Failure to report and repay within 60 days may create liability under the Civil Monetary Penalties Law (CMPL) and False Claims Act. CMS issued its proposed rule implementing the 60-day repayment obligation in February 2012. (77 FR 9179). The proposed rule would suspend the obligation to report overpayments when OIG acknowledges receipt of a submission on the SDP, provided the submission is timely made. In return for suspending the 60-day requirement, the new SDP states that OIG expects disclosing parties to disclose with a good-faith willingness to resolve all liability within the CMPL’s six-year statute of limitations. OIG has indicated it will provide additional guidance regarding the 60-day obligation and SDP process after CMS releases a final rule.

Eligibility Criteria and Guidance

The SDP provides greater guidance on how to investigate potentially fraudulent conduct, quantify damages, and report the conduct to OIG. According to the SDP, over the past 15 years, it has resolved over 800 disclosures, resulting in recoveries of more than $280 million to Federal health care programs. The SDP states that all health care providers, suppliers, or other individuals or entities that are subject to OIG’s civil monetary penalty authority are eligible to use the SDP. Accordingly, the SDP is not limited to any particular industry, medical specialty, or type of service. By way of example, the SDP states that a pharmaceutical or medical device manufacturer may use the SDP to disclose potential violations of the Federal anti-kickback statute (AKS) because such violations trigger CMP liability.

In addition, the new protocol delineates conduct that is not eligible for the SDP, including (1) matters that do not involve potential violations of Federal criminal, civil, or administrative law for which civil monetary penalties are authorized, such as one exclusively involving overpayments or errors, (2) requests for opinions from OIG regarding whether an actual or potential violation has occurred, and (3) disclosure of an arrangement that involves only liability under the physician self-referral law (Stark) without accompanying potential liability under the AKS for the same arrangement. Conduct that only involves Stark violations should be disclosed to CMS through CMS’s Self-Referral Disclosure Protocol.

Among other requirements, the SDP requires that the disclosing parties explicitly identify the laws that were potentially violated, and not just refer broadly to federal laws, rules and regulations. The SDP provides details for the content of all submissions as well as the specific requirements for conduct involving false billing, excluded persons, and the anti-kickback statute and physician self referral law.

The revised SDP is available here.

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

March 22, 2013

New OSHA Webpage for Health Care Clinicians

By Susan Woods

If you’ve ever struggled with how to handle a work-related health and safety issue, you are in luck.  The Occupational Safety and Health Administration (OSHA) recently launched a webpage specifically designed to help clinicians address safety concerns and ensure a safe and healthy workplace.

Physicians, nurses, paramedics and other health care professionals encounter hazardous situations and exposures at work almost every day.  Hospital administrators and medical office managers are left to untangle the web of regulatory and clinical issues to reduce, report and respond to those situations effectively.  This new webpage can be a valuable resource to get you pertinent information quickly and easily.

One-Stop Resource for OSHA’s Medical and Occupational Health Information

OSHA’s new Clinician’s webpage gathers important information related to health care employers and their responsibility to develop and enforce health and safety standards and practices.  Topics covered on the webpage include:

  • evaluating occupational exposures and injuries;
  • medical screening and surveillance;
  • legal and confidentiality requirements for medical records;
  • recordkeeping – the OSHA 300 log;
  • setting up a safe outpatient office; and
  • protocols for an occupational health practice.

In addition, the webpage offers quick links to OSHA standards on bloodborne pathogens, hazardous waste and emergency response, occupational noise exposure and respiratory protection.  Additional information from governmental, academic, clinical and professional resources are included, such as a new educational resource on healthcare worker and patient safety from The Joint Commission, the Health Hazard Evaluation Program from the National Institute for Occupational Safety and Health (NIOSH) and toxicological profiles on substances from the Agency for Toxic Substances and Disease Registry (ATSDR).

You never know when a workplace safety question will come up so check out OSHA’s new webpage and bookmark it for future use.

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

March 15, 2013

May our group offer free screenings?

by Kim Stanger, Holland & Hart LLP

As with other free or discounted items or services, offering free screenings can violate (1) the federal Anti-Kickback Statute (“AKS”) if one purpose of the free screening is induce referrals for items or services payable by federal healthcare programs (42 USC § 1320a-7b), and/or (2) the federal Civil Monetary Penalties Law (“CMP”) if the physician knows or should know that the free screening is likely to induce a federal program beneficiary to purchase items or services covered by federal healthcare programs (42 USC § 1320a-7a).  There are several potentially relevant CMP exceptions, most of which focus on whether the screening is tied to the provision of other services payable by federal healthcare programs.  In Advisory Opinion 09-11, the OIG approved a hospital’s free blood pressure screening program where (1) the free screening was not conditioned on the use of any other goods or services from the hospital; (2) the patient receiving the screening was not directed to any particular provider; (3) the hospital did not offer the patient any special discounts on follow-up services; and (4) if the screening was abnormal, the patient as advised to see their own health care professional.  Under these circumstances, the OIG concluded that the test was not improperly tied to the provision of other services by the hospital.

For more information, see the OIG’s Special Advisory Bulletin:  Offering Gifts and Other Inducements to Beneficiaries (August 2002), available at https://oig.hhs.gov/fraud/docs/alertsandbulletins/SABGiftsandInducements.pdf.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

March 1, 2013

HIPAA Omnibus Rule: Checklist for Compliance

by Kim Stanger, Holland & Hart LLP

The new HIPAA omnibus rule modifies the privacy and security rules for covered entities (including health care providers and health plans), and their business associates. Although the new rules are effective March 26, 2013, covered entities and business associates generally have until September 23, 2013 to comply.1 Before then, covered entities and business associates need to do the following:

  1. Business Associates: Implement HIPAA Policies, Procedures and Safeguards. The HIPAA privacy and security rules now apply directly to business associates of covered entities.2 “Business associates” are those outside entities that create, receive, maintain or transmit protected health information in the course of performing functions on behalf of a covered entity, including contractors, consultants, data storage companies, health information organizations, and subcontractors of business associates.3 Business associates must now implement many of the same policies, procedures and safeguards that have been required of covered entities for years, including the following:
    1. Security Rule. Business associates will need to conduct and document a risk assessment of their information technology systems and implement the specific administrative, technical and physical safeguards specified in the Security Rule.4 The Office of Civil Rights’ website contains helpful guidance for Security Rule compliance: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityruleguidance.html.
    2. Privacy Rule. Most of the privacy rule provisions do not apply directly to business associates, but because business associates cannot use or disclose protected health information in a manner contrary to the limits placed on covered entities,5 business associates will need to implement many of the same policies and safeguards that the Privacy Rule mandates for covered entities, including rules governing uses and disclosure of protected health information and patient rights concerning their information.6 Those are typically outlined in the business associate’s agreement with the covered entity. Since business associates are now directly liable for HIPAA violations, they should ensure they understand and train their employees concerning HIPAA Privacy and Security Rule requirements.
    3. Breach Notification. If a business associate becomes aware of a breach of unsecured health information, they must notify the covered entity and assist the covered entity in responding to the breach.7
  2. Identify New Business Associates and Execute Agreements. Covered entities are required to have business associate agreements with their business associates before allowing them to use or disclose protected health information. The omnibus rule expanded the definition of “business associates” to include entities that provide data transmission services and require routine access to information such as health information organizations.8 Covered entities should identify any such business associates and execute appropriate agreements with them. Business associates must execute appropriate business associate agreements with their own subcontractors if the subcontractor creates, receives, maintains or transmits protected health information for the business associate.9
  3. Review and, If Necessary, Amend Business Associate Agreements. Covered entities and business associates must ensure that their existing and future agreements contain the elements required by 45 CFR § 164.314(a) and .504(e). In addition to previous requirements, the agreement must require the business associate to:
    1. Comply with the security rule.
    2. Execute business associate agreements with their subcontractors.
    3. To the extent the business associate carries out on obligation of a covered entity, comply with any HIPAA rule applicable to such obligation.
    4. Report breaches of unsecured protected health information to the covered entity.

    The OCR has published updated sample business associate language at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html. The omnibus rule confirms that covered entities are liable for the misconduct of business associates if the business associate is acting as the agent of the covered entity.10 To minimize their exposure, covered entities and business associates should ensure their agreements confirm that their business associates and subcontractors are acting as independent contractors and not as the agents of the covered entity or business associate, and that the agreements do not give the covered entity too much control over day-to-day operations of the business associate.11 Covered entities may also want to include indemnification or similar clauses to protect themselves. Covered entities have up to September 22, 2014 to modify business associate agreements if (1) the agreement they had in place on January 25, 2013, complied with the HIPAA rules as of that date, and (2) the agreement does not expire or renew (other than through evergreen clauses) prior to September 22, 2014.12

  4. Update Privacy Policies. Covered entities should update their privacy policies to comply with the new omnibus rules, including the following as applicable to the covered entity:
    1. Deceased Persons. Covered entities may now disclose protected health information to family members or others who were involved in the decedent’s health care or payment for their care prior to the decedent’s death so long as the disclosure is relevant to the person’s involvement and is not inconsistent with the decedent’s prior expressed wishes.13
    2. Patient Access to Electronic Information. If a patient requests an electronic copy of their information, covered entities must generally produce it in the form requested if readily producible.14 If the patient directs the covered entity in writing to transmit a copy of the electronic information to another person, the covered entity must generally comply.15
    3. Response to Request for Access. Covered entities must generally respond to a patient’s request to access their information within 30 days; the omnibus rule eliminated the provision that gave covered entities extra time to respond if records were maintained offsite.16
    4. Limits on Disclosures to Insurers. Covered entities cannot disclose information about a patient’s care to an insurer if (1) the insurer seeks the information for treatment or payment purposes; (2) the patient or someone on the patient’s behalf paid for the care to which the information pertains; and (3) the patient requests that the information be withheld from the insurer.17 Good luck implementing this requirement. Developing a workable solution may take some advance preparation. Fortunately, the limit only applies if a patient requests nondisclosure; most patients will not request this restriction unless asked, so covered entities should not raise the issue with the patient. If a patient does request nondisclosure, covered entities should require that such requests be directed to a central person who can coordinate the efforts among billing, medical records, IT, and other relevant departments to ensure the protected data is sequestered.
    5. School Immunizations. Covered entities may now disclose information about immunizations to a school if (1) state law requires such information for school enrollment; and (2) the patient or their personal representative consents to the disclosure. The consent may be oral.18
    6. Sale of Information. Covered entities must obtain written authorization to sell a patient’s information, and the authorization must disclose that the sale will result in remuneration to the covered entity.19
    7. Marketing. Covered entities must obtain written authorization to use the patient’s information for marketing purposes, including most non-face-to-face communications for treatment purposes if the covered entity receives financial remuneration to make the communication.20 If remuneration is involved, the marketing authorization must disclose that fact.
    8. Fundraising. The new rule allows covered entities to disclose more information to institutionally related foundations to assist with fundraising, but fundraising communications must explain how the recipient may opt out of receiving such communications and the opt out method cannot be burdensome.21
    9. Research. If the covered entity engages in research, it should review new standards applicable to research as described in 45 CFR § 164.508(b).
  5. Update Breach Notification Policies. The omnibus rule modified the standard for reporting breaches of unsecured health information. Under the new standard, the unauthorized acquisition, access use or disclosure of protected health information in violation of the Privacy Rule is presumed to be a reportable breach unless (1) the covered entity or business associate demonstrates there is a low probability that the information has been compromised based on a risk assessment of certain factors, or (2) the breach fits within certain exceptions.22 Covered entities must ensure that their policies incorporate and that they apply this new, arguably lower standard. For more information about the breach notification standard, see my recent Healthcare Update at http://www.hollandhart.com/pubs/uniEntity.aspx?xpST=PubDetail&pub=2094. Given the lower standard, covered entities and business associates may want to consider encrypting records to the extent possible to avoid reportable breaches.
  6. Modify Notice of Privacy Practices. Covered entities must update their notices of privacy practices to add the following:
    1. A description of the types of information that require an authorization, i.e., psychotherapy notes, marketing, and sale of information.23
    2. A statement that other uses or disclosures not described in the notice will require an authorization.24
    3. A statement that the recipient of fundraising materials may opt out.25
    4. A description of the individual’s right to limit disclosures to insurers if the patient paid for the relevant care.26
    5. A statement that the covered entity must notify the patient of a breach of unsecured protected health information.27
  7. Train Employees. Covered entities and business associates must train their employees concerning the new rules.28
  8. Review HIPAA Compliance. Given the new, lower breach notification standard, covered entities will likely to be required to self-report more breaches. Those reports may result in more patient complaints and government investigations. Accordingly, it is a good time to review and, as necessary, improve your compliance with all the HIPAA rules, not just the new omnibus rules. Doing so may help you avoid reportable breaches and, if a breach occurs, sidestep HIPAA penalties, which can range from $100 to more than $50,000 per violation. Having the required policies and safeguards in place coupled with prompt action to correct any breach will likely establish an affirmative defense to any penalties. For suggested steps to avoid penalties, see my recent Healthcare Update at http://www.hollandhart.com/pubs/uniEntity.aspx?xpST=PubDetail&pub=1898.

Resources. To assist clients in complying with the new omnibus rule and HIPAA in general, I have prepared sample Privacy Rule policies, forms, and agreements. If you would like to obtain a set of the sample documents, please contact me at kcstanger@hollandhart.com.

145 CFR § 160.105
2Id. at § 164.104(b)
3Id. at § 164.103
4Id. at §§ 164.302 to .316
5Id. at § 164.502(a)(3)
6Id. at § 164.502 to .528
7Id. at § 164.410
8Id. at § 164.103
9Id. at § 164.314(a)(2) and .502(e)(1)
10Id. at § 164.402(c)
11See 78 FR 5581
1245 CFR § 164.532(e)
13Id. at § 164.510(b)(5)
14Id. at § 164.524(c)(2)(ii)
15Id. at § 164.524(c)(3)(ii)
16Id. at § 164.524
17Id. at § 164.522(a)(1)(vi)
18Id. at § 164.512(b)(1)(vi)
19Id. at § 164.502(a)(5)(ii) and .508(a)(4)
20Id. at § 164.501 and .508(c)
21Id. at § 164.514(f)
22Id. at § 164.402
23 Id. at § 164.520(b)(1)(ii)(E)
24Id. at § 164.520(b)(1)(ii)(E)
25Id. at § 164.520(b)(1)(iii)
26Id. at § 164.520(b)(1)(iv)(A)
27Id. at § 164.520(b)(1)(V)(A)
28 Id. at § 164.530(b)

For questions regarding this update, please contact
Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

January 18, 2013

HHS Issues New HIPAA Omnibus Rule

by Kim Stanger, Holland & Hart LLP

HHS issued the new HIPAA omnibus rule yesterday. The new rule contains important changes for health care providers and their business associates. For example, the new rule:

  • Modifies the standard for reporting breaches to patients and HHS. HHS replaced the former “no harm, no foul” rule with a new standard: a breach is presumed unless the covered entity can demonstrate a low probability that the protected health information has not been compromised. This requires an assessment of specified factors and will likely increase the number of reportable breaches.
  • Confirms HIPAA requirements for business associates and their subcontractors. Business associates are subject to HIPAA penalties if they fail to comply. The definition of “business associates” was expanded to include entities that provide data transmission services for protected health information and require routine access to the information.
  • Confirms providers are liable for their business associate’s violations if the business associate is acting as the agent for the provider. The rule’s commentary contains a helpful analysis for determining whether an agency relationship exists.
  • Makes it easier for family members to obtain information about decedents. The rule also confirms that HIPAA does not apply to information 50 years after the decedent’s death.
  • Expands patients’ right to obtain electronic copies of their records.
  • Prohibits providers from disclosing information to health insurers if the patient pays for the treatment and requests that the information not be disclosed to insurers. Implementation will create significant practical problems for practitioners.
  • Prohibits the sale of protected health information unless certain conditions are satisfied.
  • Imposes additional requirements for the use of protected health information for marketing or fundraising. Among other things, an authorization is required to disclose information for treatment purposes if the provider is receiving remuneration for the disclosure.
  • Requires new provisions to be added to providers’ Notice of Privacy Practices, including a description of disclosures that require authorizations and notice of a patient’s right to receive notice of HIPAA breaches.

The new rules take effect March 23, 2013, but covered entities and business associates will have until September 23, 2013 to comply. Before then, providers will need to take certain actions to remain compliant, including:

  • Modify their Notice of Privacy Practices.
  • Update and/or execute new business associate contracts, including contracts for subcontractors and health information organizations. Existing compliant contracts do not need to be modified until September 2014.
  • Revise privacy, security and breach notification policies to incorporate the new requirements.
  • Modify authorizations and other forms as necessary to track the new rules.
  • Ensure their electronic medical records programs have the functionality to address the new regulatory requirements.
  • Take even greater care to protect patient information given the new standard for evaluating whether breaches are reportable.

Business associates will also need to implement HIPAA privacy and security policies and safeguards applicable to business associates. HHS estimates that complying with the new requirements will cost affected parties a total of $114 million to $225 million during the first year. The new rule can be accessed at: http://www.ofr.gov/OFRUpload/OFRData/2013-01073_PI.pdf. HHS’s press release can be accessed at www.hhs.gov/news/press/2013pres/01/20130117b.html.

For questions regarding this update, please contact
Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

January 15, 2013

Who May Consent to Health Care under Idaho Law?

by Kim Stanger, Holland & Hart LLP

I am frequently asked how an Idaho health care provider may determine whether a person is competent to consent to their own healthcare.  Idaho Code § 39-4503 establishes the general standard for medical consents:

Persons who may consent to their own care. Any person who comprehends the need for, the nature of and the significant risks ordinarily inherent in any contemplated hospital, medical, dental, surgical or other health care, treatment or procedure is competent to consent thereto on his or her own behalf. Any health care provider may provide such health care and services in reliance upon such a consent if the consenting person appears to the health care provider securing the consent to possess such requisite comprehension at the time of giving the consent.

(Emphasis added).  If the health care provider believes that an adult patient currently lacks the requisite comprehension, the provider should determine whether the patient executed an advance directive or otherwise conveyed his or her wishes while competent.  (See I.C. § 39-4509).  If there is no such prior direction from the patient or if the patient is an unemancipated minor, the healthcare provider should generally obtain consent from one of the persons identified in Idaho Code § 39-4504(1), i.e., in decreasing order of priority:  a court-appointed guardian; person with durable power of attorney for healthcare; spouse; adult child; parent; person identified in delegation of parental authority; other appropriate relative; or other person who is responsible for the patient’s care.  With limited statutory exceptions, the general rule is that unemancipated minors probably lack capacity to consent to their own health care.  (See I.C. § 39-4504(1)).  Idaho Code § 39-4504(3) generally protects providers who, in good faith, obtain consent from a person who appears to have the requisite authority to give consent.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

January 14, 2013

Hospital Faces Religious Discrimination Claims for Firing Vegan Employee Who Refused a Flu Shot

by Kim Stanger, Holland & Hart LLP

Cincinnati Children’s Hospital, like many others around the nation, has adopted a policy requiring employees to get a flu shot. A federal court in Ohio just decided that the religious discrimination lawsuit brought by a vegan employee should go forward, at least for now. The ruling allows former employee, Sakile Chenzira, to proceed with her case against the Hospital alleging that the Hospital discriminated against her based on her religious beliefs when it discharged her for refusing a flu vaccination. Chenzira v. Cincinnati Children’s Hosp. Med. Ctr., No. 1:11-CV-00917 (S.D. Ohio Dec. 27, 2012).

Refusing vaccine leads to termination. Chenzira had worked as a customer service representative for the Hospital for more than ten years. As a practicing vegan, Chenzira does not ingest any animal or animal by-products. Chenzira claims that prior to 2010, the Hospital accommodated her request not to receive flu vaccinations because they contained animal by-products. In December of 2010, however, the Hospital terminated Chenzira for refusing the flu vaccine.

Vegan Files Lawsuit Alleging Religious Discrimination and Wrongful Discharge. Chenzira alleges that the Hospital discharged her based on her religious and philosophical convictions as a vegan. She filed a lawsuit in federal court in Ohio asserting three claims, including religious discrimination in violation of Title VII of the Civil Rights Act of 1964.

Hospital Argues Veganism is Not a Protected Religion. The Hospital asked the Court to dismiss Chenzira’s claims in their entirety. As to the religious discrimination claims, the Hospital argued that veganism is not a religion and therefore, cannot be the basis for a discrimination claim. In the Hospital’s view, veganism is a dietary preference or social philosophy. In fact, it found no other cases in which veganism was the basis for a religious discrimination claim. Chenzira, however, argued that her vegan practice constituted a moral and ethical belief that she sincerely held with the strength of traditional religious views. On a motion to dismiss, Chenzira was not required to “prove” her case, but only allege a claim that was plausible on its face. The Court ruled that it was plausible that Chenzira could believe in veganism to the extent necessary to equate to a traditional religious belief. The Court denied the Hospital’s request to throw out the religious discrimination claims.

Defense of Religious Discrimination Claims Will Proceed. The Hospital may have lost the first battle on the religious discrimination claims but it hasn’t lost the war. Chenzira must actually establish that her belief in vegan practices rises to the level of a traditional religious belief. In addition, as the Court pointed out, the Hospital may justify its termination of Chenzira based on patient safety or other overriding reasons. The Court’s ruling, however, keeps Chenzira’s religious discrimination claims based on her veganism alive – at least for now.Hospitals and other health care employers have regularly defeated employee lawsuits challenging mandatory immunization policies, primarily because the employers have carefully crafted those policies to recognize religious and disability-based exceptions. We will continue to watch the Cincinnati Children’s case and let you know if veganism gets a shot in the arm from this federal court.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

November 13, 2012

Paying for Call Coverage

by Kim Stanger, Holland & Hart LLP

Hospitals increasingly pay physicians and other practitioners to participate in call coverage for emergency services. Last week, the Office of Inspector General (“OIG”) issued Advisory Opinion No. 12-15, which reminds providers of fraud and abuse parameters applicable to call coverage agreements.

Permissible Arrangements. Federal law does not require compensation for call coverage, nor does it prohibit paying for call so long as the compensation is not offered to improperly induce referrals for federal healthcare program business. The OIG recognizes that paying for call may be necessary to obtain services that may otherwise be unavailable because of, e.g., the lack of specialty services in an area or local physicians’ reluctance to take call because of practice demands, time commitments, or the probability of rendering uncompensated care. The key is to ensure that any call compensation paid (1) represents fair market value for actual and necessary services, (2) does not take into account the volume or value of referrals or other business generated between the parties, and (3) was not intended to maintain or generate future referrals from the physician for non-emergency patients. Common payment structures include hourly or “per diem” payments to be available for call, payment for time or services actually provided in response to call in exchange for assignment of the physician’s professional fees, etc.

 

Problematic Arrangements. Call compensation that exceeds fair market value or pays physicians for unnecessary or illusory services may amount to illegal kickbacks and/or Stark law violations. According to the OIG, suspect arrangements include:

  • “lost opportunity” or similarly designed payments that do not reflect bona fide lost income;
  • payment structures that compensate physicians even though no identifiable services are provided;
  • aggregate on-call payments that are disproportionately high compared to the physician’s regular medical practice income;
  • payment structures that compensate physicians for professional services for which the physician receives separate payments from patients or third party payors, thereby resulting in duplicate payment for the same services; or
  • payments made in response to threats that the physician will refuse to continue to use the hospital or refer non-emergency patients to the hospital unless call payments are provided.

Regulatory Compliance. Whatever its terms, the arrangement must be structured to satisfy Stark and Anti-Kickback Statute (“AKS”) technical requirements. For example, if the compensation is to be paid to a physician who is not employed by the hospital, the arrangement must satisfy the following:

  • The agreement must be documented in a written contract fully executed by the parties before any payments are made.
  • The compensation must represent fair market value for legitimate, needed services actually provided, and not offered to maintain, induce or reward the physician’s referrals to the hospital.
  • The compensation must not vary with the volume or value of referrals or other business generated by the physician except for services personally performed by the physician.
  • The compensation formula must be set in advance and be objectively verifiable.
  • Compensation-related terms may not change during the first year of the arrangement. If the agreement is terminated within a year, the parties may not enter a new agreement with different compensation terms within that year.
  • To avoid unintentional lapses, it is usually wise to include an auto-renewal or “evergreen” clause so that the agreement automatically renews unless terminated by the parties.

(See 42 C.F.R. §§ 411.357(d) and (l), and 1001.952(d)). Most call coverage arrangements will not satisfy an applicable AKS safe harbor because, e.g., the aggregate compensation is not set in advance. It is important that the parties consider and document the legitimate reasons for the call coverage arrangement, e.g., the hospital’s need for the contracted services, the financial or professional burden on physicians absent call compensation, and the physician’s reluctance to provide needed coverage absent call compensation that reflects fair market value for services actually provided.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.