October 5, 2012

Employee Education Subsidies: Tax Implications

By Kevin Selzer, Holland & Hart LLP

Educational reimbursement programs are a common employee benefit among health care organizations. Programs can be established to assist employees in paying for tuition, books and fees in the pursuit of continuing education while on the job. If your organization sponsors such an arrangement, is it getting the best bang for its buck? If structured correctly, these arrangements can provide tax-favored benefits from both an employee and employer perspective.

Generally, if an organization pays for an expense on behalf of an employee, the tax rules require the employee be taxed on the amount paid by the organization. If an educational assistance program meets certain requirements, however, the benefits may be tax free to the individual and the employer can avoid paying FICA and FUTA taxes on the value of the expense. There are currently two tax-favored structures available to health care organizations regarding educational assistance.

The first is a formal educational assistance program, often called a 127 plan, named after the section of the Internal Revenue Code which gives it beneficial tax treatment. Generally, a 127 plan must:

have a written plan document;
provide only educational assistance (i.e. no choice between cash or benefits);
limit the amount of tax-free benefits paid on a calendar year basis to $5,250; and
not discriminate in favor of highly compensated employees.

Educational coursework reimbursed under a 127 plan does not have to be work-related but sports, games or hobby-related courses are generally not eligible (unless part of a degree program). Both graduate and undergraduate programs are currently eligible under a 127 plan. In addition, there may be other important provisions that should be included in the written plan to reflect the mutual understanding of the terms between the parties, although not necessarily required from a tax perspective.

The second tax-favored arrangement is an educational reimbursement working condition fringe benefit. Unlike a 127 plan, this type of arrangement does not require a written plan document, does not have an annual dollar limitation and discrimination is not an issue, but the types of eligible activities are narrower in scope. The educational course is required to be job-related and either (1) expressly required by the employer or by law to remain in the occupation, or (2) maintains or improves job skills for the occupation.

Note that the employer-provided tax benefits under Section 127 are slated to expire on December 31, 2012 unless Congress acts to extend Section 127 as it has done for many years (sometimes retroactively).

If you would like more information on implementation of or compliance with these programs, or would like to discuss the specifics of your organization’s arrangements and ways to make them more tax favorable, please contact the Holland & Hart Employee Benefits Practice Group at 303-295-8094, or alternatively at kaselzer@hollandhart.com.

For questions regarding this update, please contact
Kevin Selzer
Holland & Hart, 555 17th Street, Suite 3200, Denver, CO 80202
email: kaselzer@hollandhart.com, phone: 303-295-8094

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

September 24, 2012

Carving Out Federal Programs Does Not Preclude Anti-Kickback Liability

by Kim C. Stanger, Holland & Hart LLP

The federal Anti-Kickback Statute (“AKS”) prohibits offering, paying, soliciting or receiving remuneration to induce referrals for items or services payable by federal health care programs unless the transaction fits within a regulatory safe harbor. 42 U.S.C. § 1320a-7b. AKS violations are felonies, resulting in penalties of $25,000 per violation and up to 5 years in prison in addition to civil penalties. AKS violations are now also False Claims Act violations, resulting in additional civil penalties.

To avoid AKS concerns, some transactions have been structured to carve out federal health care programs, e.g., remuneration is paid for non-Medicare or Medicaid business, but the remunerative arrangement does not apply to items or services payable by Medicare or Medicaid. The theory is that because the remuneration does not apply to federal healthcare programs, the AKS does not apply.

The Office of Inspector General (“OIG”) recently reaffirmed that such “carve out” arrangements do not necessarily protect the participants from AKS liability:

The OIG has a long-standing concern about arrangements under which parties “carve out” Federal health care program beneficiaries or business generated by Federal health care programs from otherwise questionable financial arrangements. Such arrangements implicate, and may violate, the anti-kickback statute by disguising remuneration for Federal health care program business through the payment of amounts purportedly related to non-Federal health care program business.

OIG Advisory Opinion No. 12-06 at p.6-7. Accordingly, the OIG declined to render a favorable opinion as to an arrangement that would have allowed certain payments for only those patients referred for non-federal program business.

Unless the transaction can fit within one of the AKS regulatory safe harbors in 42 C.F.R. § 1001.952, the test for an AKS violation remains whether “one purpose” of a transaction is to induce referrals for items or services payable by Medicare, Medicaid or other federal health care programs. United States v. Greber, 760 F.2d 68 (3d Cir. 1985), cert. denied, 474 U.S. 988 (1985). While carving out federal programs may help, it does not insulate participants from AKS violations. Healthcare providers and other potential referral sources or recipients may want to review any “carve out” arrangements to ensure that they truly satisfy the AKS.

For questions regarding this update, please contact
Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

September 18, 2012

Restrictive Covenants in Idaho

by Kim C. Stanger, Holland & Hart LLP

In this time of healthcare consolidation, many if not most employment or contractor agreements with healthcare professionals contain clauses that prevent the professional from competing with or soliciting patients from the employer for a certain period of time after termination. The status of such non-competition or non-solicitation clauses (“restrictive covenants”) is somewhat ill-defined in Idaho.

Unlike some states, restrictive covenants involving physicians and other healthcare professionals are not per se illegal in Idaho, but they must satisfy the requirements for a valid non-competition clause. Intermountain Eye & Laser Centers, P.L.L.C. v. Miller, 142 Idaho 218, 127 P.3d 121 (2005). Traditionally,

Covenants not to compete … are ‘disfavored’ and ‘strictly construed’ against the employer. Non-competition provisions must be reasonable, which is to say they must not be more restrictive than necessary to protect a legitimate business interest, must not be unduly harsh and oppressive to the employee, and must not be injurious to the public.

Id. 142 Idaho at 224, 127 P.3d at 127. Non-competition clauses may not be enforced if doing so would unduly restrict access to needed health care. Dick v. Geist, 107 Idaho 931, 693 P.2d 1133 (Ct. App. 1985).

In 2008, Idaho enacted a statute intended to define the parameters of enforceable restrictive covenants. Under the statute:

may enter into a written agreement or covenant that protects the employer’s legitimate business interests and prohibits the key employee or key independent contractor from engaging in employment or a line of business that is in direct competition with the employer’s business after termination of employment, and the same shall be enforceable, if the agreement or covenant is reasonable as to its duration, geographical area, type of employment or line of business, and does not impose a greater restraint than is reasonably necessary to protect the employer’s legitimate business interests.

I.C. § 44-2701. “Legitimate business interests” include, but are not limited to:

an employer’s goodwill, technologies, intellectual property, business plans, business processes and methods of operation, customers, customer lists, customer contacts and referral sources, vendors and vendor contacts, financial and marketing information, and trade secrets…

Id. at § 44-2702(2). Section 44-2704 creates a rebuttable presumption that a non-competition or non-solicitation agreement is reasonable and enforceable if (1) it only restricts competition in the line of business conducted by the key employee while working for the employer, (2) it has a term of eighteen months or less, and (3) it is restricted to the geographic areas in which the key employee provided services or had a significant presence or influence. Id. at § 44-2704(2)-(5). Terms in excess of 18 months require additional compensation. See id. at § 44-2701.

Although the statute sets forth general parameters, it does not definitively resolve the validity of any particular restrictive covenant. By its express terms, compliance with the statutory standards only creates a presumption of validity. Theoretically, a party could rebut the presumption by establishing that a particular restrictive covenant is unreasonable as to duration, geography or scope, or that it otherwise “impose[s] a greater restraint than is reasonably necessary to protect the employer’s legitimate business interests.” Id. at § 44-2701. Conversely, the status of non-compliant covenants is unclear. Since compliance with the statutory standard creates a statutory presumption of validity, does non-compliance create a presumption that the restrictive covenant is unenforceable? Although that would seem to be the logical result, it is not clear how courts would apply the standard.

Traditionally, Idaho courts have been remarkably hesitant to modify (i.e., “blue pencil”) an unreasonable restrictive covenant to make it enforceable, opting instead to forego enforcing unreasonable covenants. See, e.g., Insurance Ctr., Inc. v. Taylor, 94 Idaho 896, 899, 499 P.2d 1252, 1255 (1972); Pinnacle Performance, Inc. v. Hessing, 135 Idaho 364, 370, 17 P.3d 308, 315 (App. 2001). However, § 44-2703 now expressly authorizes courts to “blue pencil” unreasonable agreements. It is not clear whether the newly confirmed authority contained in § 44-2703 will motivate courts to modify overly-broad restrictive covenants so as to make them enforceable.

Finally, § 44-2701 applies to employment or contractor agreements. It is not clear to what extent a court might apply it to restrictive covenants in other types of arrangements, e.g., purchase agreements for practices. In the past, courts have been more willing to enforce broader restrictive covenants in purchase agreements given the nature of the transaction.

Until we receive further clarification from a court, employers who wish to maximize the chances that the restrictive covenant will be enforced should structure their restrictive covenants in services contracts to comply with the § 44-2704 standards.

Endnotes

¹Per the statute,

“Key employees” and “key independent contractors” shall include those employees or independent contractors who, by reason of the employer’s investment of time, money, trust, exposure to the public, or exposure to technologies, intellectual property, business plans, business processes and methods of operation, customers, vendors or other business relationships during the course of employment, have gained a high level of inside knowledge, influence, credibility, notoriety, fame, reputation or public persona as a representative or spokesperson of the employer, and as a result, have the ability to harm or threaten an employer’s legitimate business interests.

I.C. § 44-2702(1).

September 10, 2012

Health Care Transactions: Beware Stark, Kickbacks, and More

by Kim C. Stanger, Holland & Hart LLP

Anytime you structure a transaction involving healthcare providers, you must beware federal and state statutes unique to the healthcare industry, including laws prohibiting illegal kickbacks or referrals. Those laws may affect any transactions between health care providers, including employment or service contracts, group compensation structures, joint ventures, leases for space or equipment, professional courtesies, free or discounted items or services, and virtually any other exchange of remuneration. Violations may result in significant administrative, civil and criminal penalties. The Affordable Care Act (“ACA”) dramatically increased exposure for violations by expanding the statutory prohibitions, increasing penalties, and imposing an affirmative obligation to repay amounts received in violation of the laws.¹ The following are some of the more relevant traps for the unwary.

Anti-Kickback Statute (“AKS”). The federal AKS prohibits anyone from knowingly and willfully soliciting, offering, receiving, or paying any form of remuneration to induce referrals for any items or services for which payment may be made by any federal health care program unless the transaction is structured to fit within a regulatory exception.² An AKS violation is a felony punishable by a $25,000 fine and up to five years in prison.³ Thanks to the ACA, violation of the AKS is an automatic violation of the federal False Claims Act⁴, which exposes defendants to additional civil penalties of $5,500 to $11,000 per claim, treble damages, and private qui tam lawsuits⁵. The AKS is very broad: it applies to any form of remuneration, including kickbacks, items or services for which fair market value is not paid, business opportunities, perks, or anything else of value offered in exchange for referrals. The statute applies if “one purpose” of the transaction is to generate improper referrals⁶. It applies to any persons who make or solicit referrals, including health care providers, managers, program beneficiaries, vendors, and even attorneys⁷. Despite its breadth, the AKS does have limitations. First, it only applies to referrals for items or services payable by government health care programs such as Medicare or Medicaid⁸. If the parties to the arrangement do not participate in government programs or are not in a position to make referrals relating to government programs, then the statute should not apply. Second, the statute does not apply if the transaction fits within regulatory exceptions⁹. For example, exceptions apply to employment or personal services contracts, space or equipment leases, investment interests, and certain other relationships so long as those transactions satisfy specified regulatory requirements¹⁰. Third, interested persons who are concerned about a transaction may obtain an Advisory Opinion from the Office of Inspector General (“OIG”) concerning the proposed transaction. Past Advisory Opinions are published on the OIG’s website, www.hhh.oig.hhs.gov/fraud. Although the Advisory Opinions are binding only on the parties to the specific opinion, they do provide guidance for others seeking to structure a similar transaction.

Ethics in Patient Referrals Act (“Stark”). The federal Stark law prohibits physicians from referring patients for certain designated health services to entities with which the physician (or a member of the physician’s family) has a financial relationship unless the transaction fits within a regulatory safe harbor¹¹. Stark also prohibits the entity that receives an improper referral from billing for the items or services rendered per the improper referral¹². Unlike the AKS, Stark is a civil statute: violations may result in civil fines ranging up to $15,000 per violation and up to $100,000 per scheme in addition to repayments received for services rendered per improper referrals¹³. Repayments can easily run into thousands or millions of dollars. Stark is a strict liability statute; it does not require intent, and there is no “good faith” compliance¹⁴. Stark applies only to financial relationships with physicians, i.e., M.D.s, D.O.s, podiatrists, dentists, chiropractors, and optometrists¹⁵, or with members of such physicians’ families; it does not apply to transactions with other health care providers. Finally, unlike the AKS, Stark applies only to referrals for certain designated health services, (“DHS”), payable by Medicare;¹⁶ it does not apply to referrals for other items or services. If triggered, Stark applies to any type of direct or indirect financial relationship between physicians or their family members and a potential provider of DHS, including any ownership, investment, or compensation relationship¹⁷. Thus, the statute applies to everything from ownership or investment interests to compensation among group members to contracts, leases, waivers, discounts, professional courtesies, medical staff benefits, or any other transaction in which anything of value is shared between the parties. If Stark applies to a financial relationship, then the parties must either structure the arrangement to fit squarely within one of the regulatory safe harbors¹⁸ or not refer patients to each other for DHS covered by the statute and regulations.

Civil Monetary Penalties Law (“CMP”). The federal CMP prohibits certain transactions that have the effect of increasing utilization or costs to federally funded health care programs or improperly minimizing services to beneficiaries¹⁹. For example, the CMP prohibits offering or providing inducements to a Medicare or Medicaid beneficiary that are likely to influence the beneficiary to order or receive items or services payable by federal health care programs, including free or discounted items or services, waivers of copays or deductibles, etc²⁰. This law may affect health care provider marketing programs as well as contracts or payment terms with program beneficiaries²¹. The CMP also prohibits hospitals from making payments to physicians to induce the physicians to reduce or limit services covered by Medicare²². Thus, the CMP usually prohibits so-called “gainsharing” programs in which hospitals split cost-savings with physicians.²³ Finally, the CMP prohibits submitting claims for federal health care programs based on items or services provided by persons excluded from health care programs.²⁴ As a practical matter, the statute prohibits health care providers from employing or contracting with persons or entities who have been excluded from participating in federal health care programs.²⁵ Violations of the CMP may result in administrative penalties ranging from $2,000 to $50,000 per violation.²⁶

State Anti-Kickback, Self-Referral, or Fee Splitting Statutes. Many states have their own versions of anti-kickback²⁷ or self-referral laws²⁸ that must also be considered. State versions vary widely; they may or may not parallel federal versions. In addition, most states also prohibit fee splitting or giving rebates for referrals, which might also apply to some transactions between referral sources.²⁹ Providers should check their own state statutes to ensure compliance.

Medicare Reimbursement Rules. The Centers for Medicare & Medicaid Services (“CMS”) has promulgated volumes of rules and manuals governing reimbursement for services provided under federal health care programs. The rules govern such items as when a health care provider may bill for services provided by another entity, supervision required for such services, and the location in which such services may be performed to be reimbursable. In addition, the amount of government reimbursement may differ depending on how the transaction is structured, e.g., whether it is provided through an arrangement with a hospital or by a separate clinic or physician practice. The rules concerning reimbursement and reassignment should be considered in structuring health care transactions if the entities intend to bill government programs for services or maximize their reimbursement under such programs.

Corporate Practice of Medicine Doctrine (“CPOM”). Some states impose the so-called “corporate practice of medicine” doctrine by statute or case law, i.e., only certain licensed health care professionals (e.g., physicians) may practice medicine; corporations may not employ physicians to practice medicine due to the risk that such an arrangement would improperly influencing medical judgment.³⁰ There are often statutory exceptions, e.g., professional corporations or employment by hospitals or managed care organizations. In those states that apply or enforce the CPOM, transactions may need to be structured around the CPOM, including services contracts with physicians or other healthcare providers.

Certificates of Need (“CON”). Finally, to avoid over-saturation and resulting overcharges, some states require that providers obtain a certificate authorizing the construction or expansion of certain types of facilities, e.g., hospitals, ambulatory surgery centers, or skilled nursing facilities.³¹

Conclusion. The foregoing is only a brief summary of some of the more significant laws and regulations that may affect common health care transactions. As in all cases, the devil is in the details (as well as the Code of Federal Regulations and CMS Medicare Manuals). Providers and their advisors should review the relevant laws and regulations whenever structuring a health care transaction, especially if that transaction involves potential referral sources or implicates federal health care programs.

Endnotes
¹ 42 U.S.C. § 1320a-7k.
² 42 U.S.C. § 1320a-7b(b).
³ 42 U.S.C. § 1320a-7b(b)(2)(B).
⁴ Patient Protection and Affordable Care Act Pub L. No. 111-148 § 6402(f)(1), 124 Stat. 119 (2010); see 31 U.S.C. § 3729 et seq.
⁵ See, e.g., 42 U.S.C. § 1320a-7a(5); 42 U.S.C. § 1320a-7(b)(7); 31 U.S.C.§ 3729-3733; United States ex rel. Thompson v. Columbia/HCA Healthcare Corp., 20 F. Supp. 2d 1017 (S.D. Tex. 1998).
⁶ United States v. Kats, 871 F.2d 105 (9th Cir. 1989); United States v. Greber, 760 F.2d 68 (3d Cir.), cert. denied 474 U.S. 988 (1985).
⁷ United States v. Anderson, Case No. 98-20030- 01/07 (D. Kan. 1998).
⁸ See 42 U.S.C. § 1320a-7b(b)(2)(B).
⁹ 42 U.S.C. § 1320a-7b(3); 42 C.F.R. § 1001.952.
¹⁰ 42 U.S.C. § 1320a-7b(3); 42 C.F.R. § 1001.952.
¹¹ 42 U.S.C. § 1395nn; 42 C.F.R. § 411.351 et seq.
¹² 42 C.F.R. § 411.353(b).
¹³ 42 U.S.C. § 1395nn.
¹⁴ See 42 C.F.R. § 411.353(a)-(b).
¹⁵ Id. at § 411.351.
¹⁶ The “designated health services” covered by Stark include clinical laboratory services; physical therapy, occupational therapy and speech-language pathology services; radiology and other imaging services; radiation therapy; durable medical equipment and supplies; prosthetics, orthotics, prosthetic devices and supplies; home health services; outpatient prescription drugs; inpatient and outpatient hospital services; and parenteral and enteral nutrients. Id. at § 411.351.
¹⁷ Id. at § 411.351.
¹⁸ Id. at § 411.355 to 411.357.
¹⁹ 42 U.S.C. § 1320a-7a.
²⁰ 42 U.S.C. § 1320a-7a(a)(5).
²¹ See OIG Special Advisory Bulletin, “Offering Gifts and Other Inducements to Beneficiaries” (August 2002); OIG Special Fraud Alert, “Routine Waiver of Part B Co-Payments/Deductibles” (May 1991).
²² 42 U.S.C. § 1320a-7a(b).
²³ See, e.g., OIG Special Fraud Alert, “Gainsharing Arrangements and CMPs for Hospital Payments to Physicians to Reduce or Limit Services to Beneficiaries” (July 1999).
²⁴ 42 U.S.C. § 1320a-7a(a)(1)(C) and (2).
²⁵ OIG Special Advisory Bulletin, “The Effect of Exclusion from Participation in Federal Health Care Programs (Sept. 1999). ²⁶ See id. at § 1320a-7a(a) and (b).
²⁷ See, e.g., Colorado Revised Statutes (“CRS”) § 25.5-4-305; Idaho Code (“IC”) § 41-348(1); Nevada Revised Statutes (“NRS”) 439B.420; New Mexico Statutes Annotated (“NSMA”) §§ 30-41-1 to -3, and 30-44-7(A)(1); Utah Code § 26-20-4.
²⁸ See, e.g., CRS § 25.5-4-414; NRS. 439B.425; New Mexico Administrative Code (“NMAC”) 439B.5205-.5408; NMSA §§ 24-1-5.8(C)(6); NMAC 7.7.2.8(B)(3) and 7.7.2.8(N); Utah Code §§ 58-67-801, 58-68-801, 58-69-805.
²⁹ See, e.g., CRS §§ 12-36-125 and 12-36-126; IC § 54-1814(8)-(9); NMSA §§ 61-6-15(D).
³⁰ See, e.g., CRS §§ 12-36-117(m) and 6-18-301 et seq.; Worlton v. Davis, 73 Idaho 217, 221, 249 P.2d 810 (1952).
³¹ See, e.g., NRS 439A and NAC 439A.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

August 22, 2012

ACA Supreme Court Webinar Update

On August 9th, one of our healthcare partners Pia Dean presented a 1 hour webinar entitled “The Affordable Care Act Supreme Court Ruling and What Your Company Should Know”. If you missed this presentation and would like to view it online, please click here.

August 22, 2012

Obama Administration Announces Fraud Prevention Partnership

By Bill Mercer

Last month, Secretary Sebelius and Attorney General Holder announced a new collaboration with health insurance companies to provide both government and private payer claims data to a third-party to detect overpayments and fraud.

http://www.hhs.gov/news/press/2012pres/07/20120726a.html

http://www.justice.gov/opa/pr/2012/July/12-ag-926.html

By pooling claims data and having the third-party analyst look for suspicious billing patterns, the federal government and participating insurers believe outliers would be readily identifiable. Claims data which appear to suggest the existence of fraud or overpayments would be referred to federal law enforcement for further investigation.

By commingling claims information from private insurers, Medicaid, and Medicare, the Administration believes it could detect, for example, a provider who bills all payers for more than 24 hours in a day or bills the same claims to multiple insurers. Attorney General Holder’s statement [http://www.justice.gov/iso/opa/ag/speeches/2012/ag-speech-120726.html] refers to the prospect of detecting claims made to multiple public and/or private insurance plans for the same patient on the same day in more than one city.

A number of private sector participants have volunteered to participate in the partnership, including:

America’s Health Insurance Plans

Amerigroup Corp.

Blue Cross and Blue Shield Association

Blue Cross and Blue Shield of Louisiana

Humana Inc.

Independence Blue Cross

Travelers

Tufts Health Plan

UnitedHealth Group

WellPoint Inc.

Significant details necessary to the creation of a functional partnership have yet to be resolved. According to the HHS press release, the Executive Board and two committees will meet for the first time next month. The initial work plan is also a work-in-progress.

The partnership received support from Senator Coburn and Senator Hatch, who wrote to the Acting Administrator of CMS that “this is an effort which is long overdue.” [http://www.coburn.senate.gov/public/index.cfm?a=Files.Serve&File_id=b3d5048d-a395-49af-b4ac-2c2b65b9a4a0] The lack of detail in the Administration’s rollout of the initiative generated a series of follow-up questions from Senators Coburn and Hatch. They have asked for responses on the following issues by the end of August:

“Specifics regarding exactly how this collaboration will work including what entities will be involved, whether HHS/CMS or another entity will be overseeing the effort and a timeline for expected key milestones of the effort.

A step-by-step explanation of how the information will be shared (e.g., what systems will be used to transmit the data), what authorities allow the exchange of information, what impediments exist to sharing information (e.g., statutory language) and where the information will be stored/analyzed.

A description of the third party who will be analyzing the data, as well as an explanation of how that entity will be selected and what their capabilities are to integrate and analyze such a large amount of information.

Specifics regarding what will happen when leads are identified, how that information will be disseminated, and what the process will be for following up on those leads.”

July 11, 2012

HIPAA Compliance: Security Rule Enforcement on the Rise

Most healthcare providers are acutely aware of and generally comply with the HIPAA Privacy Rule; however, they and their business associates may be less familiar with and likely fail to satisfy HIPAA Security Rule requirements. The Privacy Rule generally prohibits covered entities from using or disclosing a patient’s protected health information (“PHI”) without authorization. (45 C.F.R. § 164.500 et seq.). In contrast, the Security Rule applies to electronic health information (“e-PHI”). It requires covered entities and their business associates to implement specific administrative, technical, and physical safeguards to protect the integrity, availability, and confidentiality of e-PHI, e.g., by ensuring that computers and other electronic devices satisfy regulatory standards pertaining to passwords, firewalls, backups, transmission security, etc. (45 C.F.R. § 164.300 et seq.).

In the past, the Office of Civil Rights (“OCR”) seemed not to actively enforce the Security Rule, but that is changing:

In March, Blue Cross Blue Shield of Tennessee (“BCBS”) agreed to pay $1.5 million for security rule violations arising out of the theft of unencrypted laptops. Among other things, BCBS failed to conduct the required security assessment and implement access controls required by the Security Rule.
In April, a Phoenix cardiology group agreed to pay $100,000 for, among other things, failing to designate a security officer, conduct the required security assessment, implement safeguards required by the Security Rule, or execute business associate agreements with vendors who stored or accessed e-PHI.
In June, the Alaska Department of Health and Social Services (“DHSS”) agreed to pay $1.7 million after a USB hard drive was stolen. The OCR’s investigation showed that DHSS did not have adequate policies and procedures in place to safeguard ePHI, and had not completed the required risk analysis, implemented sufficient risk management measures, completed security training for its workforce members, implemented device and media controls, or addressed device and media encryption as required by the Security Rule.

These actions sound a wake up call to all providers and business associates—large, small, or public—who have ignored or become lax with Security Rule compliance. As OCR Director Rodriguez stated, “We hope that health care providers pay careful attention to [these] resolution agreement[s] and understand that the HIPAA Privacy and Security Rules have been in place for many years, and OCR expects full compliance no matter the size of a covered entity.” The OCR is now required to impose mandatory penalties of $10,000 to $50,000 per violation if a provider is determined to have acted with willful neglect. Based on the recent cases, failing to implement safeguards required by the Security Rule may evidence willful neglect.

If they have not done so recently, providers and their business associates should review their Security Rule compliance. Among other things, they should conduct a security assessment to determine their system vulnerabilities, and implement the safeguards specified in the Security Rule regulations. To obtain a checklist for Security Rule compliance, please click here. In addition, the OCR has published several tools to help entities comply:

The OCR’s recently published HIPAA Audit Protocol is a good roadmap for compliance; it is available at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/protocol.html.
The OCR’s Final Guidance on Risk Analysis is available at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalintro.html.
The OCR’s series of technical guides for implementing the security rule is available at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityruleguidance.html.

Putting in place the required policies and practices and documenting appropriate training will go a long way to avoiding Security Rule penalties. More importantly, they will help providers avoid potentially devastating consequences of a security failure, system crash, or the loss of electronic data which the Security Rule is designed to protect. In that regard, Security Rule compliance is not just a regulatory mandate; it is a prudent business practice.

June 29, 2012

Affordable Care Act Upheld in a Nuanced Opinion

In a dramatic and narrowly reasoned 5-4 ruling yesterday, the Supreme Court upheld the Patient Protection and Affordable Care Act (ACA).

Chief Justice Roberts started his summary of the decision by announcing that the Constitution’s Commerce Clause could not support the law’s controversial provision that most individuals purchase health insurance or pay a penalty – the so-called “individual mandate.” To observers, this appeared to signal that a key piece of the President’s signature legislation would be struck down. However, Justice Roberts went on to explain that the individual mandate may be upheld on the basis of Congress’s authority under the Taxing Clause. The Court reasoned that the Commerce Clause allows Congress to regulate commerce, not compel it. On the other hand, the Court determined the individual mandate can be upheld as a tax for three main reasons: the payment is not so high that it leaves no real choice except to buy health insurance, the payment is not limited to willful violations (as penalties for unlawful acts are), and the payment is collected exclusively by the IRS through normal means of taxation.

In an unexpected turn, Justice Kennedy, widely considered to be the swing vote, joined the dissent in objecting to the individual mandate on any grounds. Chief Justice Roberts, appointed by President George W. Bush, ultimately swung the Court’s decision in holding that the individual mandate is constitutional under Congress’s taxing authority. Ironically, the Court ruled that the mandate was not a “tax” for purposes of being able to decide the case without violating the Anti-Injunction Act (which holds that a tax cannot be challenged in court until some time after the tax is due in the spring of 2015), but was a tax for purposes of upholding the law.

The other major provision of the law that had been challenged is the expansion of Medicaid. Again, the Court held that the Medicaid expansion violates the Constitution by threatening States with the loss of their existing Medicaid funding if they decline to comply with the expansion. The Court, however, provided careful guidance to remedy the violation by holding that the Medicaid expansion is constitutional so long as the Secretary of Health and Human Services is precluded from withdrawing existing Medicaid funds for failure to comply with the requirements set out in the expansion.

The result of today’s opinion is that the ACA is considered constitutional. Accordingly, those provisions of the ACA already in place will continue. These include:

Children may remain on their parents’ health insurance until age 26;
Insurers are prohibited from dropping coverage if an individual gets sick or makes an unintentional mistake on his/her application for insurance coverage;
Insurers are prohibited from denying children up to age 19, who have pre-existing conditions, access to health insurance;
Insurers are required to establish a simplified appeals process for coverage and denials of claims;
States are required to begin laying the groundwork for health insurance exchanges. The exchanges will make available to everyone, including individuals purchasing insurance on their own and those working for small businesses, the same economies of scale of administration, marketing, and risk pooling available to workers in large businesses, thereby making insurance more affordable to all;
States are required to create a temporary “high-risk pool” to provide coverage until 2014, when the exchanges become operational, for eligible individuals who have been denied health care coverage on the basis of pre-existing conditions;
Medicaid beneficiaries will receive free preventative services;
Insurance providers are required to cover some preventative services and eliminate co-pays;
Insurers will be required to limit the ratio of premiums spent on administrative costs compared to medical costs (called the medical loss ratios, or MLRs); and
Small businesses may be entitled to tax credits that make it easier to provide coverage to workers, while also reducing premiums.

Likewise, provisions of the ACA scheduled to be implemented in the future will go forward as planned, unless Congress moves to eliminate or delay those provisions. These include the major expansion and reform provisions of the ACA that will take effect in 2014, including:

Individuals must purchase insurance or pay a tax penalty;
States must possess operational health insurance exchanges by 2014;
Insurers will be prohibited from denying coverage on the basis of pre-existing conditions, regardless of age, and will be prohibited from charging higher premiums without adequate justification;
Insurance companies will be prohibited from imposing lifetime dollar limits on essential benefits;
State Medicaid programs will be required to expand coverage to all eligible non-pregnant, non-elderly legal residents with incomes up to 133% of federal poverty guidelines. The federal government will initially cover all costs for this group, with the federal matching percentage decreasing to 90% by 2020;
States will be required to maintain their current Children’s Health Insurance Program (CHIP) structure through 2019, and provide federal CHIP payments through 2015 (a two-year extension on CHIP funding);

The ACA contains numerous cost containment and financing provisions. While the ultimate cost of the ACA is the subject of much debate, the ACA is designed to offset the costs associated with the expansion of coverage by slowing the rate of growth of federal health care spending and increasing revenues through taxes and penalties. The largest share of revenues will come from additional Medicare payroll taxes on those with incomes over $200,000 for single individuals and $250,000 for married couples. The ACA also creates an excise tax on high-cost plans, limits annual contributions to flexible spending accounts (FSAs) and excluding over-the-counter medications (with the exception of insulin) from reimbursement by FSAs and other health savings accounts.

The Congressional Budget Office (CBO) estimates that the direct spending and revenue effects of the ACA will reduce the federal deficits by $143 billion over a ten-year period (2010-2019) and that, by 2019, will result in 94% of the non-elderly, population of legal U.S. residents being insured. In actual numbers, this means that the ACA will reduce the number of uninsured by an estimated 32 million people, leaving approximately 23 million uninsured by 2019.

While the Supreme Court’s actions today resolve the constitutionality of the ACA, the controversy surrounding the law and challenges to it will continue. Mitt Romney has vowed, if elected, to repeal the ACA on the first day of his term by sending out waivers to all 50 states to keep them from having to pursue the law. With only 132 days to the election, the Supreme Court’s decision is only one volley in a greater debate. We at Holland & Hart LLP will continue to follow all health care issues that affect our clients and communities, and to provide timely updates as they develop.

For questions regarding this update, please contact

Kim C. Stanger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: kcstanger@hollandhart.com, phone: 208-383-3913

June 8, 2012

Medical Staff Member on Hospital Boards: Limits in New CoPs

Last month, CMS issued new conditions of participation (“CoPs”) for hospitals and critical access hospitals (“CAHs”) to be effective July 16, 2012. (77 F.R. 29034, dated 5/16/12). Among others, 42 CFR § 481.12 will require that the hospital’s governing board “must include a member, or members, of the hospital’s medical staff.” We have confirmed with CMS, however, that there are limits to this new requirement.

1. Does Not Apply to CAHs. The new requirement only appears in the hospital CoPs, not in the corresponding CAH CoPs. (See 42 CFR 485.627). The new requirement for physician participation on the hospital’s governing body was not intended to apply to CAHs.

2. Does Not Apply Where State Law Establishes Board Membership. In some cases, state or local laws may control board membership. For example, state law may require that board members of county hospitals or hospital districts are elected or appointed by another government agency. The new CoPs were not intended to preempt such laws. In such cases, the CoPs regarding medical staff representation on the governing body would not apply, and CMS would expect the hospital to follow the laws of its particular locality.

3. The Physician May Serve in a Non-Voting Capacity. Even where they do apply, the new CoPs do not specify how hospitals should choose the medical staff representative, nor do they specify the particular role that the medical staff representative should fill on the governing body. CMS intends that hospitals have flexibility in addressing these issues. For example, the hospital may appoint the physician to the board in a non-voting or ex officio capacity. Limiting the physician board member’s voting rights may be appropriate given conflicts of interest that a physician board member may have since many board decisions will directly impact the physician’s practice.

We understand that CMS may be taking action to clarify these issues for providers.

May 7, 2012

Changes to Idaho Health Care Consent Law

Effective July 1, 2012, amendments to Idaho’s health care consent statutes, Idaho Code § 39-4501 et seq., take effect. The changes resolve some concerns, but raise others. The following summarizes the more significant changes.

1. Application of consent statutes. The amended statute expressly confirms that it applies to all forms of health care, not just medical or dental care. (I.C. § 39-4503).

2. Capacity to consent. As amended, “any person who comprehends the need for, the nature of and the significant risks ordinarily inherent in” the contemplated health care may consent to or refuse their own care. (I.C. § 39-4503). The change removes the additional condition that the person must have “ordinary intelligence and awareness”, which created ambiguity and potentially unwarranted discrimination in applying the standard.

3. Surrogate decision makers. The amendment clarifies the authority of “surrogate decision makers” to make health care decisions for persons who lack capacity to make their own decisions. Surrogates may make decisions for minors and other persons who are not capable of giving consent. As amended, the statute establishes the following hierarchy for surrogates:

A court-appointed guardian of the patient.
A person named in a living will or durable power of attorney, but only if the conditions in the living will or power of attorney that authorized the agent to act have been satisfied.
The spouse of the patient.
An adult child of the patient.
A parent of the patient.
A person named in a delegation of parental authority executed per I.C. § 15-5-104.
Any relative of the patient who represents himself or herself as appropriate to act under the circumstances.
Any other competent person who represents himself or herself as responsible for the patient’s health care.

(I.C. § 39-4504(1)). Importantly, the amendment clarifies that the surrogate decision maker must themselves have sufficient capacity under § 39-4503 to make their own health care decisions before they can make decisions for others. In addition, the surrogate cannot trump the prior wishes of the patient expressed while the patient was competent, e.g., through a POST, advance directive, or other method. (I.C. § 39-4504(1)).

4. Responsibility for obtaining consent. The amendment confirms that the health care provider upon whose order or at whose direction the contemplated care is rendered is responsible for ensuring that sufficient consent is obtained, either by themselves or by their agents. (I.C. § 39-4508).

5. Advance directives. The old statute contemplated certain forms of advance directives, e.g., a living will, durable power of attorney for health care, or physician’s orders for scope of treatment (“POST”). Questions sometimes arose concerning other forms of advance directives, or the validity of a directive that did not contain the statutory elements required for a living will, durable power of attorney, or POST. The amended statute confirms that any advance directive ought to be honored, including any “document which represents a competent person’s authentic expression of [the] person’s wishes concerning his or her health care.” (I.C. § 39-4502(8); see also I.C. §§ 39-4509(3) and 39-4514(6)).

6. POSTs. The amended statute broadens the availability of POSTs. The former statute made POSTs “appropriate” if the patient had an incurable or irreversible injury, disease, illness or condition, or if such conditions were anticipated. The amended statute removes that condition, making POSTs possible for all patients. (See I.C. § 39-4512A). The amended statute also expands the persons who may execute a POST. In addition to physicians, the new statute allows advanced practice nurses or physician assistants to execute POSTs on behalf of the provider. (I.C. § 39-4512A). Similarly, in addition to the patient, the new statute allows surrogate decision makers to execute POSTs on behalf of the patient so long as the POST is not contrary to the patient’s last known expressed wishes. (I.C. § 39-4512A(1)). The amendment allows a provider or person to suspend a POST for a period of time, although such suspension is not automatic. (I.C. § 39-4512A(2)). For example, contrary to some providers’ belief, POSTs and other advance directives are not automatically suspended during surgery.

7. DNRs. When enacted, the former version of the statute removed the laws that authorized “do not resuscitate orders” (“DNRs”), apparently intending POSTs to replace DNRs. The amended statute expressly allows hospitals and other health care providers to continue to use DNRs, provided that if the patient presents a POST, they must accept the POST and not require a separate DNR to validate the POST. (I.C. §§ 39-4512B(3) and 39-4514).

8. Withdrawal or denial of treatment. A new section was added to limit a provider’s ability to withdraw or deny certain forms of treatment requested by the patient or surrogate. As amended, assisted feeding or artificial nutrition and hydration may not be withdrawn or denied if such care is requested by the patient or surrogate decision maker. Other forms of treatment cannot be withdrawn or denied if requested by the patient or surrogate decision maker unless the treatment that medically is inappropriate or futile. (I.C. § 39-4514(3)). Unfortunately and unlike other amendments, this section is poorly drafted and may inappropriately limit a provider’s professional judgment. For example, under both the former and amended law, the consent statute shall not be construed “to require medical treatment that is medically inappropriate or futile”; however, the new law expressly states that this limitation “does not authorize any violation” of the new withdrawal of care provisions described above, i.e., the requirement that requested treatment must be provided unless futile. (I.C. § 39-4514(3) and (6)). The limitation on withdrawal or denial of care does not reference medically inappropriate treatment. (I.C. § 39-4514(3)). The net effect appears to be that a provider may not withdraw or deny requested treatment even if medically inappropriate unless the treatment is also futile, which result defies logic and cannot be what was intended. At the very least, the amendment creates ambiguity concerning the proper response to treatment that is requested but is medically inappropriate.

9. Futile care. As amended, the statute only permits the withdrawal or denial of requested treatment if the treatment is futile. The statute now defines “futile care” as a course of treatment:

For a patient with a terminal condition, for whom, in reasonable medical judgment, death is imminent within hours or at most a few days whether or not the medical treatment is provided and that in reasonable medical judgment will not improve the patient’s condition; or
The denial of which in reasonable medical judgment will not result in or hasten the patient’s death.

(I.C. § 39-4514(6)). This definition of “futility” only considers the length of a patient’s life without considering qualitative factors, including the pain or suffering that an incompetent patient may be forced to endure simply to preserve life or the fact that a patient may be in a permanent comatose state. It is inconsistent with Idaho’s “Baby Doe” regulations which also factor in the humanity of a patient’s care. (See IDAPA 16.06.05.004.10). In some cases, the provider may deem continued treatment to be unethical or unconscionable if not “futile” as defined in the statute, in which cases the provider’s alternative is to withdraw as the treating provider after making a good faith effort to transfer care to another provider pursuant to I.C. §§ 39-4513(2) or 18-611. That may be a viable alternative for a physician or other individual health care provider, but it is more difficult for a hospital or other health care facility. The practical effect is that it is even more important for providers and facility ethics committees to come to an agreement with patients or surrogate decision makers concerning the appropriate course of treatment or withdrawal thereof.

10. Minor consents. The amended statute does not explicitly resolve whether mature minors may consent to their own care. Section 39-4503 states that “any person” with sufficient comprehension may consent to their own care, not any “adult” person. Similarly, § 39-4509 was amended to define “competent person” to mean any person who meets the standard in § 39-4503, not just adults or emancipated minors. On the other hand, § 39-4504(1) states that surrogate decision makers may consent for minors. Until clarified by a court, the conservative approach would be to require surrogate consent for minors unless another statute grants the minor authority to make their own health care decisions or the minor is clearly deemed to be emancipated under Idaho law.

Conclusion. The amended consent statute resolves some of the concerns that have bothered providers in recent years; however, the new “withdrawal of treatment” provisions may prove problematic in some cases. Redlined copies of the amended statute may be accessed at http://www.legislature.idaho.gov/legislation/2012/S1294E1.pdf and http://www.legislature.idaho.gov/legislation/2012/S1348E1.pdf.

If you have questions concerning these or other legal issues, please contact Kim Stanger at kcstanger@hollandhart.com or (208) 383-3913, or visit Holland & Hart’s website at www.hollandhart.com