Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
Liability of Business Associates for HIPAA Penalties
/in Data Privacy, Health Information, HIPAAThe HITECH Act extended certain HIPAA obligations to business associates, including those entities that create, receive, maintain or transmit protected health information (“PHI”) on behalf of covered entities. Business associates who fail to comply with their HIPAA obligations may be directly liable for HIPAA penalties ranging from $114 to $57,0511 per violation.
Read moreCMS Issues DRAFT Guidance for Hospital Co-location with Other Hospitals or Healthcare Facilities
/in MedicareBy Cory Talbot
Earlier this month, the Centers for Medicare & Medicaid Services (“CMS”) issued draft “Guidance for Hospital Co-location with Other Hospitals or Healthcare Facilities” (the “Draft Guidance”) intended to change earlier CMS guidance, which prohibited hospital co-location with other hospitals or healthcare facilities. The Draft Guidance plainly states that “[h]ospitals can be co-located with other hospitals or other healthcare entities”1 and is designed to clarify how CMS and surveyors “will evaluate a hospital’s space sharing or contracted staff arrangements with another hospital or health care entity when assessing the hospital’s compliance with”2 the Medicare Conditions of Participation (the “CoPs”) for shared space, contracted services, and emergency services.3 Read more
Despite Increased Awareness and Employee Training, Ransomware Is Still the Healthcare Industry’s No. 1 Threat
/in HIPAABy Claire Rosston
Ransomware accounted for more than 1 in 10 healthcare data breaches reported to the government during the last three years, according to analysis by Bloomberg Law. Cybercriminals capitalize on lack of employee training by sending emails with malicious attachments to gain access to healthcare providers’ and business partners’ networks. With this access, the ransomware typically encrypts all of the data within the organization’s network that cannot be recovered until the ransom is paid for the decryption key. Read more
HHS Reduces the Annual Cap for Most HIPAA Penalties
/in HIPAAby Kim Stanger
HIPAA penalties vary depending on the type of conduct involved. (45 CFR § 160.404). Under HHS’s prior interpretation, the types of violations were all subject to an annual maximum penalty of $1,500,000 for identical types of violations. (Id.).
Read moreKey Terms for Provider Contracts
/in Fraud and AbuseBy Kim Stanger
A good contract with an employed or contracted physician or other practitioner may help you avoid regulatory violations and future disputes. Here is a brief summary of some terms or issues that you should consider in your provider agreements.
Regulatory Compliance. If the practitioner will be performing or referring items or services payable by government healthcare programs, you should generally structure the contract to satisfy applicable safe harbors under the federal Anti-Kickback Statute (“AKS”), 42 CFR 1001.952(d) or (i). If the contract involves a physician, the contract must be structured to satisfy the Ethics in Patient Referrals Act (“Stark”), 42 CFR 411.355 or 411.357(c), (d) or (l). For information concerning these regulatory requirements, see our Client Alert, Stark Requirement for Physician Contracts. In addition, the federal Civil Monetary Penalties Law generally prohibits hospitals from offering inducements to physicians to limit medically necessary services payable by government programs. (42 USC 1320a-7a(b)(1)). If the employer is a tax-exempt entity, you will also want to ensure the compensation reflects fair market value to avoid 501(c)(3) tax issues. If your state recognizes the corporate practice of medicine doctrine, you may need to structure your arrangement to fulfill any unique requirements applicable to your state.
Read more