Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
HIPAA and Records of Deceased Persons
/in HIPAAby Kim C. Stanger, Holland & Hart LLP
The HIPAA privacy and security rules generally apply to protected health information of deceased persons as well as the living. Providers may generally use or disclose such information as follows:
1. Treatment, Payment, or Operations. As with living persons, HIPAA allows providers to use or disclose protected health information of deceased persons for purposes of treatment, payment, or the provider’s healthcare operations, unless the provider has agreed otherwise. (See 45 CFR 164.506 and 164.522(a)). This may include treatment of other living relatives. As the Office for Civil Rights (OCR) explained, “disclosures of protected health information for treatment purposes—even the treatment of another individual—do not require an authorization; thus, a covered entity may disclose a decedent’s protected health information, without authorization, to the health care provider who is treating the surviving relative.” (OCR FAQ, available here). Read more
HIPAA: Disclosing Exam Results to Employers
/in HIPAAPhysicians and other providers are often paid by employers to conduct drug tests, fitness-for-duty or return-to-work exams, or employment physicals for employees. In such circumstances, the physician may mistakenly assume that they may disclose the test and exam results to the employer without the patient’s authorization, but that is not correct.
As with any other protected health information, physicians and other providers generally need the patient’s written, HIPAA-compliant authorization to disclose exam results to the employer. (45 CFR 164.508(a); see also 65 FR 82592 and 82640). However, unlike other treatment situations, a provider may condition the performance of an employee physical or test on the patient’s provision of an authorization, i.e., the provider may refuse to perform the exam unless the patient executes a valid authorization. (45 CFR 164.508(b)(4)(iii); 65 FR 82516 and 82658). In addition, the employer may condition the employee’s continued employment on the provision of the exam results (at least under HIPAA), thereby creating an incentive for the employee to execute the authorization. (65 FR 82592 and 82640). The foregoing rules also apply when the health care provider is the employer, e.g., when a hospital employee receives treatment or tests at the hospital. In those situations, the hospital/employer generally may not access or use the patient/employee’s health information for employment-related purposes without the patient’s written authorization. (67 FR 53191-92). Read more
Physician Contract Checklist
/in Contracts & Transactions, Physician Practicesby Kim C. Stanger, Holland & Hart LLP
Regulatory Compliance. If the physician will be performing or referring items or services payable by government healthcare programs, you should generally structure the contract to satisfy applicable safe harbors under the federal Ethics in Patient Referrals Act (“Stark”), 42 CFR 411.355 or 411.357(c), (d) or (l), and the Anti-Kickback Statute (“AKS”), 42 CFR 1001.952(d) or (i). For information concerning those regulatory requirements, see our Client Alert, Stark Requirement for Physician Contracts. In addition, the federal Civil Monetary Penalties Law generally prohibits hospitals from offering inducements to physicians to limit services payable by government programs. (42 USC 1320a-7a(b)(1); 42 CFR 1003.102). If you are a tax-exempt entity, you will also want to ensure the compensation reflects fair market value to avoid 501(c)(3) tax issues. If your state recognizes the corporate practice of medicine doctrine, you may need to structure your arrangement to fulfill any unique requirements applicable to your state.
Written Agreement. Stark and AKS safe harbors generally require current written contracts for independent contractors. Although written contracts are not required for the employee safe harbors, it is usually a good idea to document the arrangement to avoid disputes, especially if there are special compensation requirements, employment is other than “at-will”, or you wish to include a restrictive covenant. Read more
Medical Record Retention
/in Hospitals & Health Systems, Physician Practicesby Kim C. Stanger, Holland & Hart LLP
I am often asked how long a practice must maintain medical records. The answer depends on the type of provider you are and your risk tolerance. Providers should generally consider the following in establishing their record retention policies:
1. Patient care. The primary consideration should be patient care. Some practices (e.g., oncology) may want to retain medical records longer than the relevant regulatory requirement or statute of limitations period because the records may be important to future patient care. If your electronic records program allows, you may want to retain the records permanently.
2. Statutory or Regulatory Requirements. State and federal regulations require hospitals and certain other institutional providers to maintain medical records for specified periods, but those laws usually do not apply directly to physicians or physician groups. There are numerous guides online. For example, HealthIT.gov published a 50-state survey of record retention requirements at http://www.healthit.gov/sites/default/files/appa7-1.pdf. The Idaho Department of Health and Welfare published a helpful but incomplete summary of federal record retention regulations, which may be accessed at http://healthandwelfare.idaho.gov/Portals/0/Medical/LicensingCertification/RecordRetentionReqs.pdf. CMS published a MedLearn article on record retention at https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNMattersArticles/downloads/SE1022.pdf. AHIMA is usually a good source for online guidance about record retention laws and regulations. Read more
Recruiting Physicians: Beware Stark, Anti-Kickback Statutes, and IRS Rules
/in Fraud and Abuseby Kim C. Stanger, Holland & Hart LLP
Hospitals and other entities that offer incentives to recruit physicians must ensure their arrangements comply with federal and state laws governing financial relationships with physicians, including the the Ethics in Patient Referrals Act (“Stark”), Anti-Kickback Statute (“AKS”), and the IRS’s 501(c)(3) requirements. Recruitment arrangements usually need to fit within one of the following safe harbors:
1. Employment Arrangements. If you are going to hire the physician as an employee and pay him or her no more than fair market value, you can structure the deal to fit within Stark’s bona fide employment safe harbor, which requires the following:
(42 CFR 411.357(c)). Under the employment safe harbor, you are not required to have a written agreement or establish the compensation formula in advance, but it is generally a good idea to do so to avoid misunderstandings. Complying with the foregoing Stark parameters should also satisfy the AKS and 501(c)(3) rules. (See 42 CFR 1001.952(i); IRS Healthcare Provider Reference Guide, 2004 EO CPE Text at p.18). If you need to pay more than fair market value or provide additional incentives to recruit the physician, you will likely need to structure the deal to satisfy the Stark recruitment safe harbor described below. Read more