Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
Despite Increased Awareness and Employee Training, Ransomware Is Still the Healthcare Industry’s No. 1 Threat
/in HIPAABy Claire Rosston
Ransomware accounted for more than 1 in 10 healthcare data breaches reported to the government during the last three years, according to analysis by Bloomberg Law. Cybercriminals capitalize on lack of employee training by sending emails with malicious attachments to gain access to healthcare providers’ and business partners’ networks. With this access, the ransomware typically encrypts all of the data within the organization’s network that cannot be recovered until the ransom is paid for the decryption key. Read more
HHS Reduces the Annual Cap for Most HIPAA Penalties
/in HIPAAby Kim Stanger
HIPAA penalties vary depending on the type of conduct involved. (45 CFR § 160.404). Under HHS’s prior interpretation, the types of violations were all subject to an annual maximum penalty of $1,500,000 for identical types of violations. (Id.).
Read moreKey Terms for Provider Contracts
/in Fraud and AbuseBy Kim Stanger
A good contract with an employed or contracted physician or other practitioner may help you avoid regulatory violations and future disputes. Here is a brief summary of some terms or issues that you should consider in your provider agreements.
Regulatory Compliance. If the practitioner will be performing or referring items or services payable by government healthcare programs, you should generally structure the contract to satisfy applicable safe harbors under the federal Anti-Kickback Statute (“AKS”), 42 CFR 1001.952(d) or (i). If the contract involves a physician, the contract must be structured to satisfy the Ethics in Patient Referrals Act (“Stark”), 42 CFR 411.355 or 411.357(c), (d) or (l). For information concerning these regulatory requirements, see our Client Alert, Stark Requirement for Physician Contracts. In addition, the federal Civil Monetary Penalties Law generally prohibits hospitals from offering inducements to physicians to limit medically necessary services payable by government programs. (42 USC 1320a-7a(b)(1)). If the employer is a tax-exempt entity, you will also want to ensure the compensation reflects fair market value to avoid 501(c)(3) tax issues. If your state recognizes the corporate practice of medicine doctrine, you may need to structure your arrangement to fulfill any unique requirements applicable to your state.
Read moreWhat Healthcare Providers Need to Know About EKRA
/in Healthcare LawBy Eric Maxfield
In October 2018, the President signed the SUPPORT for Patients and Communities Act, a portion of which is known as the “Eliminating Kickbacks in Recovery Act of 2018” or “EKRA.” EKRA, aimed at the ongoing opioid crisis, is meant to prevent patient brokering, referrals, and kickbacks related to drug recovery and substance abuse treatment centers. EKRA’s language, however, is very broad and goes well beyond the opioid crisis to deal with “patient brokering,” which is when a substance abuse facility or provider pays a third party for referring or directing potential patients. EKRA violations carry significant penalties, including fines upwards of $200,000 per “occurrence,” as well as significant prison time.
While EKRA’s purpose is to address kickbacks related to the broader issues surrounding opioids, it is not limited exclusively to treatment centers per se. Instead, EKRA precludes the solicitation or receipt of value for referrals to recovery homes, clinical treatment centers, or laboratories. EKRA applies to public and – importantly – private commercial health benefit programs. This is effectively an expansion of the Federal Anti-Kickback Statute’s prohibition on kickbacks involving individuals covered by federal programs like Medicare, Medicaid, or TRICARE.
Read moreCommon Stark Concerns for Hospitals
/in Compliance, Fraud and Abuseby Kim Stanger
Unless structured properly, a hospital’s financial relationship with referring physicians or other providers may violate the federal Ethics in Patient Referrals Act (“Stark”) and Anti-Kickback Statute (“AKS”), resulting in civil and criminal fines, penalties, and repayments. Under Stark, if a hospital has a financial relationship with a physician, the physician may not refer patients to the hospital for certain designated health services1 payable by Medicare or Medicaid unless the arrangement fits within a regulatory safe harbor. (42 USC § 1395dd; 42 CFR § 411.353). The AKS generally prohibits knowingly offering, paying, soliciting or receiving remuneration to induce referrals for items or services payable by federal healthcare programs unless the arrangement fits within a regulatory safe harbor. (42 USC § 1320a-7b(b); 42 CFR § 1001.952). Below are some of the top compliance concerns arising from relationships with referring providers:
1. No Written Agreement. Except for employment arrangements, Stark and the AKS generally require that financial arrangements are documented in writing and signed by the parties, including arrangements involving the payment for services, sale or lease of space or equipment, recruitment subsidies, etc. (See, e.g., 42 CFR §§ 411.357(a), (b), (d), (e), (l), (p), (y), and 1001.952(b)-(d)). CMS has confirmed that a single formal contract is not necessarily required; instead, “a collection of documents, including contemporaneous documents evidencing the course of conduct between the parties, may satisfy the writing requirement…” (80 FR 71315).
Read more