- On January 6, 2025, the U.S. Food & Drug Administration (FDA, or the Agency) issued a final guidance ,“Action Levels for Lead in Processed Food Intended for Babies and Young Children: Guidance for Industry” which aims to regulate lead levels in processed foods for infants and toddlers under two years old.
- As we have previously blogged, in 2021, FDA initiated its Closer to Zero policy which identified actions the Agency will take to reduce exposure to toxic elements, including lead, to as low as possible while maintaining access to nutritious foods.
- As part of this initiative, FDA has also evaluated mercury, cadmium, and arsenic in foods intended for babies and young children, as well as lead in juices. Under this initiative, FDA has prioritized babies and young children as they are especially vulnerable to lead exposure, which accumulates in the body over time.
- Lead is naturally present in the environment, but human activities have also released elevated levels of lead, contaminating soil, water, and air. This contamination can affect crops used in food production.
- Lead exposures can lead to developmental harm to children by causing learning disabilities, behavioral difficulties, lowered IQ, and may be associated with immunological, cardiovascular, and reproductive and or/developmental effects.
- To address this concern, FDA established the following action levels in the final guidance for processed foods intended for babies and young children:
- 10 parts per billion (ppb) for fruits, vegetables (excluding single-ingredient root vegetables), mixtures (including grain- and meat-based mixtures), yogurts, custards/puddings, and single-ingredient meats;
- 20 ppb for single-ingredient root vegetables; and
- 20 ppb for dry infant cereals.
- If a processed food intended for babies and young children reaches or exceeds the aforementioned levels of lead, the product will be considered adulterated within the meaning of section 402(a)(1) of the Federal Food, Drug, and Cosmetic Act (FD&C Act).
- After publishing the final action levels, the Agency will establish a timeframe for assessing industry’s progress toward meeting the action levels and resume research to determine whether the scientific data supports efforts to further adjust the action levels.
Category: Health
OCR Proposed Tighter Security Rules for HIPAA Regulated Entities, including Business Associates and Group Health Plans
As the healthcare sector continues to be a top target for cyber criminals, the Office for Civil Rights (OCR) issued proposed updates to the HIPAA Security Rule (scheduled to be published in the Federal Register January 6). It looks like substantial changes are in store for covered entities and business associates alike, including healthcare providers, health plans, and their business associates.
According to the OCR, cyberattacks against the U.S. health care and public health sectors continue to grow and threaten the provision of health care, the payment for health care, and the privacy of patients and others. In 2023, the OCR has reported that over 167 million people were affected by large breaches of health information, a 1002% increase from 2018. Further, seventy nine percent of the large breaches reported to the OCR in 2023 were caused by hacking. Since 2019, large breaches caused by successful hacking and ransomware attacks have increased 89% and 102%.
The proposed Security Rule changes are numerous and include some of the following items:
- All Security Rule policies, procedures, plans, and analyses will need to be in writing.
- Create, maintain a technology asset inventory and network map that illustrates the movement of ePHI throughout the regulated entity’s information systems on an ongoing basis, but at least once every 12 months.
- More specificity needed for risk analysis. For example, risk assessments must be in writing and include action items such as identification of all reasonably anticipated threats to ePHI confidentiality, integrity, and availability and potential vulnerabilities to information systems.
- 24 hour notice to regulated entities when a workforce member’s access to ePHI or certain information systems is changed or terminated.
- Stronger incident response procedures, including: (I) written procedures to restore the loss of certain relevant information systems and data within 72 hours, (II) written security incident response plans and procedures, including testing and revising plans.
- Conduct compliance audit every 12 months.
- Business associates to verify Security Rule compliance to covered entities by a subject matter expert at least once every 12 months.
- Require encryption of ePHI at rest and in transit, with limited exceptions.
- New express requirements would include: (I) deploying anti-malware protection, and (II) removing extraneous software from relevant electronic information systems.
- Require the use of multi-factor authentication, with limited exceptions.
- Require review and testing of the effectiveness of certain security measures at least once every 12 months.
- Business associates to notify covered entities upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.
- Group health plans must include in plan documents certain requirements for plan sponsors: comply with the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.
After reviewing the proposed changes, concerned stakeholders may submit comments to OCR for consideration within 60 days after January 6, by following the instructions outlined in the proposed rule. We support clients with respect to developing and submitting comments they wish to communicate to help shape the final rule, as well as complying with the requirements under the rule once made final.
FTC Closely Monitoring Healthcare Lead Generators As Open Enrollment Begins
The Federal Trade Commission is watching the healthcare lead generation industry closely.
On December 10, 2024, the Federal Trade Commission announced that it has sent warning letters to 21 companies that market or generate leads for healthcare plans. The letters were sent as open enrollment season for healthcare plans is ongoing. They provide guidance and provide about deceptive or unfair claims that likely violate laws enforced by the FTC.
The letters were sent to companies that provide marketing or advertising, including lead generation, related to Affordable Care Act Marketplace health insurance and healthcare-related products, such as limited benefit plans and medical discount programs.
“It is critical for consumers’ health and financial well-being that marketers of health plans be honest about the plans they and their partners are offering,” said FTC lawyer Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC has been watching this important sector closely, especially during open enrollment season, and these warning letters put companies on notice that unlawfully marketing or advertising health plans to consumers can result in serious legal consequences.”
Based on information collected by FTC staff and the agency’s enforcement experience in this area, the types of claims FTC staff has warned about include those that may:
- misrepresent the benefits included in a healthcare plan, including any insurance benefits;
- misrepresent that a healthcare plan is major or comprehensive medical health insurance or the equivalent of such health insurance;
- misrepresent the costs of healthcare plan; and
- falsely claim that consumers who enroll in a healthcare plan will receive free offers, cash rewards, rebates, or other incentives.
Consult with a season FTC defense lawyer if you are a lead generator or marketer of health insurance leads in order to minimize risk of government scrutiny.
The letters provide examples of prior relevant FTC actions against marketers and lead generators that operate in this field, including Simple Health, Benefytt Technologies, Partners in Healthcare Association, and Consumer Health Benefits Association.
While the letters do not allege any wrongdoing by any of the recipients, they encourage the companies to conduct a thorough review of their advertisements to ensure they are complying with applicable laws and rules, and the letters note that the FTC is closely monitoring this marketplace for unlawful conduct that is harming consumers.
OIG Releases Special Fraud Alert About Suspect Payments in Marketing Arrangements Related to Medicare Advantage and Providers
On December 11, 2024, the Office of Inspector General for the U.S. Department of Health and Human Services (“OIG”) issued a special fraud alert warning about certain marketing schemes that involve questionable payments and referrals between Medicare Advantage (“MA”) health plans, health care professionals, and third-party marketers (e.g., agents and brokers) and that can mislead MA enrollees into choosing specific health plans or providers that may not be in the MA enrollees’ best interests or meet their needs (“MA Marketing Alert”). As we have previously advised, special fraud alerts are few and far between—OIG has only issued six in the past 20 years. The importance of the MA Marketing Alert, like its predecessors, should not be taken for granted because it may be instructive as to subsequent enforcement action taken by OIG and/or the U.S. Department of Justice (“DOJ”).
In the MA space, historical enforcement actions taken by both OIG, under their administrative authorities, and DOJ, under the False Claims Act (“FCA”), have related to alleged MA risk adjustment payment inflation schemes. See, e.g., DaVita, Sutter Health, Beaver Medical, Martin’s Point, and Cigna. While allegations of this nature continue to be a focus area (e.g., in OIG’s work plans), a light is also now being shone on inappropriate marketing schemes that could violate the Federal anti-kickback statute (“AKS”). And, based on historical empirical data connecting DOJ’s enforcement actions taken subsequent to OIG’s issuance of special fraud alerts, that light may broaden and brighten.
For example, in July 2022, OIG issued a special fraud alert about arrangements involving telemedicine companies. In a footnote, OIG provided three enforcement actions resolved under the FCA as examples of allegedly problematic arrangements. After providing the footnote examples, OIG described bullet-pointed “Suspect Characteristics” that tracked the allegedly inappropriate characteristics of the footnote examples. Since the alert’s issuance, DOJ has recovered millions under the FCA and also criminally charged and convicted many individuals and entities for allegedly submitting or causing the submission of more than $3.1 billion (in 2023 and 2024 pursuant to DOJ’s nationwide takedowns) in allegedly fraudulent Medicare claims resulting from telemedicine schemes.
While the MA Marketing Alert provides footnotes of only two enforcement actions resolved under the FCA as examples of allegedly problematic arrangements, the bullet point list of “Suspect Characteristics” is broader than and reaches beyond the footnote examples. This may signal OIG’s awareness of and current investigations into allegedly inappropriate arrangements relating to “Suspect Characteristics” that have yet to be settled or resolved.
It is possible that there may be forthcoming enforcement actions in these areas. And they may follow the same trend of enforcement actions taken by DOJ relating to telemedicine schemes after OIG’s July 2022 special fraud alert. We also note that the MA Marketing Alert aligns with the Centers for Medicare & Medicaid Services’ recently finalized regulatory updates relating to MA health plan marketing arrangements with agents, brokers, and Third-Party Marketing Organizations, which will be effective January 1, 2025, and prohibit such parties from creating direct or indirect incentives “that would reasonably be expected to inhibit an agent or broker’s ability to objectively assess and recommend which plan best fits the health care needs of a beneficiary.” Proskauer’s Health Care Group will continue to monitor these developments in and provide updates about these areas of scrutiny and enforcement.
OSHA Issues Final Rule on Personal Protective Equipment for Construction Workers, but It Could Start Back at Square One
On December 11, 2024, the Occupational Safety and Health Administration (OSHA) issued a statement that it had finalized a rule amending 29 C.F.R. 1926.95(c) to require construction employers to make personal protective equipment (PPE) available that “properly fits” their employees.
- On December 11, 2024, OSHA finalized a rule requiring construction employers to provide properly fitting PPE, effective January 13, 2025, though it faces potential rollback due to political opposition.
- The new OSHA rule aims to address PPE fit issues, particularly for smaller workers and women, but lacks clear guidance on defining “properly fitting” PPE, causing industry concern.
- Despite OSHA’s assertion that the term “properly fits” is sufficiently clear, industry feedback highlights the need for more detailed regulatory text and clarification on compliance.
The regulation was published in the Federal Register on December 12, 2024. The added language to the construction standard mirrors the current PPE fit requirements found in the general industry and shipyard standards. In OSHA’s notice of proposed rulemaking (NPRM) issued on July 20, 2023, the agency set a comment period on the proposal through September 18, 2023. During that period, comments from industry skeptics and supporters alike mirrored those previously seen.
OSHA reiterated its primary claim that PPE that does not properly fit is an issue for “smaller construction workers,” particularly women, and that implementation of the standard could increase productivity and expand the market for differently sized PPE. Many supporters of the regulatory change submitted comments reflecting that female employees praised the change and bemoaning instances of working with improperly fitting PPE. The preamble highlighted instances in which female employees had created improvised PPE when their PPE did not properly fit.
The industry’s comments acknowledged the essential nature of PPE for all employees while also continuing to express concern about the lack of clarity and guidance on how this rule would be actually implemented by employers. The core of the industry’s concern remained that the rule creates a requirement that an employee’s PPE must “fit properly” but it does not provide an explanation for how “properly fitting” PPE will be defined. Many comments highlighted this hole would create a significant opportunity for employees to complain about whether the provided PPE “properly fit” them if the PPE was simply uncomfortable. There is also no guidance on what factors employers or OSHA’s investigators should consider when evaluating whether PPE properly fits and employee and is therefore compliant with the standard.
OSHA previously dismissed this issue, stating that “employers in general industry have had no issue understanding the phrase ‘properly fits’ with regard to PPE.” The preamble reflects that several commentors requested more detailed regulatory text and clarification of responsibilities and some included recommendations. The American Industrial Hygiene Association (AIHA) recommended an operational definition for compliance, while the National Institute for Occupational Safety and Health (NIOSH) agreed with OSHA but noted the term was not universally understood. Other comments highlighted the need to consider how the body changes during pregnancy in the determination of whether PPE “properly fits” but did not suggest a specific definition for the phrase.
Ultimately, OSHA came to the same conclusion as before that the phrase “‘properly fits’ provides employers with enough information that they can select PPE for their workers that will adequately protect them from the hazards of the worksite without creating additional hazards.” OSHA pointed to the minimal confusion in other sectors and few citations for improperly fitting PPE as a suggestion that most employers can comply with the standard using the phrase “properly fits” without a definition.
We previously warned that this lack of clarity would mean that employers would still have to determine whether the range of sizes they offer would comply with the requirement for properly fitting PPE. One question to resolve is whether the “universal fit” of the PPE would assist with compliance. OSHA did note in a footnote in the preamble that one comment included an objection to the term “universal fit” arguing that “[n]o PPE is universal fit, even the most adjustable PPE may not fit workers on the extremes of anthropometric data.”. In light of this comment, OSHA acknowledged that:
[A]t the tail ends of the distribution of human variation, some adjustable PPE will not fit. For the purposes of this analysis, however, OSHA maintains that some items of PPE that come in standard, adjustable sizes will fit nearly all individuals working in the construction industry and so maintains this designation for a limited number of items in this analysis.
While this does mean employers can use the “universal fit” as a blanket mode of compliance with the standard, OSHA’s comment indicates that use of “universal fit” should allow compliance with “nearly all individuals working in the construction industry[.]”
Ultimately, while this rule remains a likely rollback priority for the second Trump administration, employers should still be mindful of the January 13, 2025, effective date.
Diagnosing Health Care: Health Policy Update: Impact of the 2024 U.S. Elections [Podcast]
New from the Diagnosing Health Care Podcast: The recent 2024 elections resulted in a new Trump administration and a Republican-controlled House and Senate.
From policymakers to stakeholders across the industry, everyone is wondering what health policy will look like in 2025 and beyond.
On this episode, Epstein Becker Green attorneys Ted Kennedy Jr., Leslie Norwalk, Philo Hall, and Alexis Boaz discuss the results of the 2024 elections and their impact on the health policy space. What will a second Trump administration look like? How might the election results affect the health care policies addressed during Congress’s 2024 lame-duck session?
You See Health, Whistleblower Saw Fraud: Uncovering a $23 Million Healthcare Fraud Scheme
A whistleblower’s vigilance has led to the revelation of alleged Medicare and TRICARE fraud involving UCHealth, a healthcare system with locations throughout the state of Colorado. University of Colorado Health agreed to a $23 million settlement to resolve allegations of improper coding for emergency room visits subsequently billed to government-funded healthcare programs. The qui tam provisions of the False Claims Act empower whistleblowers—individuals with non-public knowledge of fraud against the government—to file a lawsuit on behalf of the government. The qui tam whistleblower in this case will receive $3.91 million or 17% of the settlement.
Summary of the Allegations
According to court documents, from November 1, 2017, through March 31, 2021, certain UCHealth hospitals allegedly engaged in a fraudulent practice concerning Evaluation & Management (E/M) emergency department facility claims. These claims, submitted to both Medicare and TRICARE, are intended to compensate hospitals for resources associated with patient visits, including medical evaluations and management.
UCHealth’s alleged fraudulent activity centered around the misuse of Current Procedural Terminology (CPT) codes, specifically CPT 99285. This code represents the “highest level of severity” in emergency department visits and requires comprehensive medical evaluations and examinations, and high-complexity decision-making. However, UCHealth reportedly manipulated the coding process by automatically assigning the highest severity code, CPT 99285, based on the frequency of vital sign monitoring rather than the actual severity of the patient’s condition or resource utilization. According to the settlement agreement, employees had complained about the overuse of the highest severity code, and the hospital system had been flagged by the Centers for Medicare & Medicaid Services (CMS) as being a “High Outlier” for that CPT code as well.
Upcoding Fraud Scheme
Upcoding and improper billing to Medicare and TRICARE are forms of healthcare fraud that involve misrepresenting the services provided to obtain higher reimbursements than justified. Upcoding occurs when a healthcare provider submits claims for more expensive services or procedures than were actually performed, such as billing for a comprehensive exam when only a basic consultation was provided. Improper billing includes practices such as double billing for the same service, billing for services not rendered, or charging for medically unnecessary procedures. These fraudulent activities exploit government-funded programs, increasing costs for taxpayers and undermining the integrity of healthcare systems.
The Whistleblower’s Journey
The case began when Timothy Sanders, a concerned individual, filed a qui tam lawsuit on April 28, 2021, under the False Claims Act. This legal action initiated an investigation into UCHealth’s billing practices. Whistleblowers are integral in exposing fraudulent activities within healthcare systems, as they possess insider knowledge that can lead to substantial recoveries for the government. By filing a qui tam lawsuit, individuals, such as the healthcare fraud whistleblower in this case, can bring fraudulent activities to light, potentially leading to significant financial repercussions for the involved parties. With whistleblowers, as the Principal Deputy Assistant Attorney General said, “We will pursue health care providers that defraud the taxpayers by knowingly submitting inflated or unsupported claims.”
Holy Hemp: New Jersey Court Partially Invalidates Hemp Law
On Oct. 10, 2024, a New Jersey Federal District Court made a big decision on hemp. The Court largely invalidated New Jersey’s recent attempt to tighten controls on “intoxicating hemp products” like Delta-8 and Delta-10, which were previously sold in gas stations, smoke shops, and convenience stores without much oversight. The state had put forward amendments aimed at restricting these products to those over 21 and regulating them like cannabis. New Jersey argued that it was time to clamp down on these sales, citing public health concerns and the rising number of minors getting their hands on these potent, unregulated products.
NJ Gov. Phil Murphy had signed off on these amendments despite admitting the law wasn’t perfect. For him, protecting minors was the priority. And today, the Court shared that sentiment—partially. It kept in place only the part that prevents the sale of these products to minors.
As for the rest of the amendment? The Court struck it down. The reason? It found that New Jersey’s approach violated federal law, essentially treating hemp products from out-of-state differently from those produced locally under the New Jersey Cannabis Regulatory Commission’s new process. This selective control crossed the line, according to the Dormant Commerce Clause of the Constitution and provisions in the Federal Farm Act, which stops states from blocking the transport of hemp products.
The Court’s decision made it clear that New Jersey does have the power to regulate these sales, but the amendments need legislative fine-tuning to meet federal standards. So, while New Jersey’s push to regulate intoxicating hemp is on pause, this is far from over.
Here’s where the decision makes things complicated for sellers: By Oct. 12, shops were supposed to pull these hemp products from the shelves, including Delta-8 drinks and THC-A gummies. That means, until New Jersey’s Cannabis Regulatory Commission issues new rules, those products are off-limits.
For anyone in the hemp or cannabis business in New Jersey, it’s a loud reminder—stay compliant, stay updated, and be ready to adapt quickly to changes.
by: Benjamin Sheppard of Norris McLaughlin P.A.
©2024 Norris McLaughlin P.A., All Rights Reserved
For more news on Hemp Legality, visit the NLR Biotech, Food, & Drug section.
Affordable Care Act Proposed Rule Would Broaden Access to Over-the-Counter Contraception Without Cost Sharing
Employer-sponsored health plans would be required to cover over-the-counter contraception, including condoms and emergency contraception, without a prescription and without cost sharing under newly proposed Affordable Care Act (ACA) regulations
Quick Hits
- Proposed rules issued by the DOL, HHS, and Treasury are designed to increase coverage for over-the-counter contraceptives, such as condoms, spermicides, and emergency contraception, without a prescription.
- If finalized, the proposed rules would be the first time that male contraceptives will be covered under the ACA preventive care requirements.
- The public has until December 27, 2024, to submit comments on the proposed rules.
Fully insured and self-insured health plans would have to cover every Food and Drug Administration (FDA)-approved contraceptive drug or drug-led combination product without cost sharing, unless the plan or insurer covers a therapeutic equivalent without cost sharing, under rules proposed by the U.S. Departments of Health and Human Services, Labor, and Treasury.
Employer-sponsored health plans and insurers also would have to tell participants that over-the-counter contraception without a prescription is covered at no cost, under the proposed rules published October 28, 2024, in the Federal Register.
The ACA requires most group health plans to cover preventive care at no cost to patients. Preventive care under the ACA includes FDA-approved contraceptives for women, such as birth control pills, injectable contraceptives, contraceptive patches, implantable rods, intrauterine devices, diaphragms, sponges, vaginal rings, emergency contraception medication, and sterilization procedures for women. In 2022, the Health Resources and Services Administration (HRSA) issued updated guidelines that define which healthcare services are considered preventive for women.
Without a prescription, over-the-counter products were not included in the ACA’s coverage requirement. The proposed rule would change that.
In guidance issued earlier this year, the departments noted that they are still identifying plans that are out of compliance with the contraceptive care requirements. Employers that violate the ACA mandate can be fined $100 for each day in the noncompliance period for each affected employee. At first, the ACA granted exemptions to churches and other religious organizations that hold instilling religious values as their purpose and primarily employ people who share their religious beliefs. The criteria to qualify for an exemption were broadened later. Without an exemption, nongovernmental employers can use a self-certification form to instruct their health insurer to exclude contraceptive coverage from the group health plan and provide payments to patients for contraceptive services separate from the health plan.
In July 2020, the Supreme Court of the United States ruled that private employers with religious or moral objections can be exempt from the contraceptive mandate.
Seven states—California, Colorado, Maryland, New Jersey, New Mexico, New York, and Washington—already have laws requiring state-regulated health insurance policies to cover certain over-the-counter contraceptives without a prescription and without cost sharing.
Next Steps
Employers may want to review the coverage of contraceptives under their medical plans both to ensure that no improper restrictions are put on them currently and also to clarify how their coverage would need to expand if these proposed rules became final in a substantially similar form.
This article was co-authored by Leah J. Shepherd, who is a writer in Ogletree Deakins’ Washington, D.C., office.
Federal District Court in Florida Holds FCA’s Qui Tam Provisions Unconstitutional
Earlier this year, several defendants in a non-intervened qui tam lawsuit in the Middle District of Florida took up the challenge. The qui tam, styled United States ex rel. Zafirov v. Florida Medical Associates, LLC et al., involves allegations of Medicare Advantage coding fraud. After several years of litigation, the defendants moved for judgment on the pleadings, arguing the relator’s qui tam action was unconstitutional, citing Justice Thomas’s dissent in Polansky.
The defendants’ motion prompted a statement of interest from the United States and participation as amici by the U.S. Chamber of Commerce and the Anti-Fraud Coalition. The Court also asked for supplemental briefs on Founding-era historical evidence regarding federal qui tam enforcement.
On September 30, 2024, Judge Kathryn Kimball Mizelle granted the defendants’ motion, agreeing the relator was unconstitutionally appointed and dismissing her complaint. Judge Mizelle, who clerked for Justice Thomas, held a private FCA relator exercises significant authority that is constitutionally reserved to the executive branch, including the right to bring an enforcement action on behalf of the United States and recover money for the U.S. Treasury. In doing so, a relator chooses which claims to prosecute, which theories to raise, which defendants to sue, and which arguments to make on appeal, resulting in precedent that binds the United States. Yet, a relator is not appointed by the president, a department head, or a court of law under Article II, making the qui tam device unconstitutional.
Judge Mizelle distinguished historical qui tam statutes, which were largely abandoned early in our nation’s history, on the ground that few gave a relator the level of authority the FCA does. And while the FCA itself dates back to the Civil War, the statute largely remained dormant (aside from a flurry of use in the 1930s and 40s) until the 1986 amendments set off a new wave of qui tam litigation.
The ruling is significant for the future of the FCA. As Judge Mizelle’s opinion explains, most FCA actions are brought by relators as opposed to the government itself. If the decision is upheld on appeal, a number of outcomes are possible. If the FCA is to continue as a significant source of revenue generation for the government, the DOJ must devote more resources to bringing FCA actions directly. Congress may also consider amending the FCA’s qui tam provisions to limit relators’ authority to conduct FCA litigation, thereby maintaining the statute as a viable avenue for whistleblowing.
One thing is almost certain, however. FCA defendants across the country will likely raise similar arguments in light of Judge Mizelle’s ruling. Whether in Zafirov or another case, it appears the Supreme Court will get to decide the constitutionality of the FCA’s qui tam provisions sooner rather than later.