Budget Deal Alters Reimbursement to Off-Campus Hospital-Owned Facilities

Prior to the Act, covered out-patient department (“OPD”) services included services provided by facilities meeting the complex hospital-based rules, even if the facility was not physically-located on the campus of the hospital. Subject to the grandfather provision discussed below, the Act adds a specific exclusion to the definition of covered OPD services, making services furnished by an off-campus outpatient department of a hospital ineligible. The Act provides that a facility is “off-campus” if it is not within 250 yards of the hospital’s main buildings (including for this purpose, a “remote location of a hospital,” meaning a separate in-patient campus of the hospital, which is a helpful clarification in an otherwise problematic law). Facilities deemed “off-campus” are ineligible for Medicare reimbursement at the hospital outpatient rate.

The inclusion of a grandfather provision will mitigate some of the Act’s impact, as facilities currently treated as “hospital-based” will not be impacted by the change in law. Only facilities that are not billing as “hospital-based” as of the date of enactment will be ineligible for reimbursement at the hospital outpatient rate. It is unclear whether a conveyance of an off-campus grandfathered facility would eliminate the grandfathered status and the ability of the buyer to bill for the services as “hospital-based.” The Congressional Budget Office (“CBO”) forecasts that the government will reap significant cost savings from the lower rates that will apply; an October 28, 2015 analysis from the CBO projects that the change in reimbursement policy will provide $9.3 billion in relief by 2025.

© 2015 Proskauer Rose LLP.

Bipartisan Budget Act of 2015 – Potential Impact on Hospitals

House Republican leaders introduced legislation on Monday, finalizing a two-year budget agreement between Congressional leaders and the White House. This legislation is currently being considered and may be up for a vote as early as Wednesday on the bipartisan budget deal.

Hospitals should note the language in Section 603 (which is on pages 35-39 of the draft bill) codifies the definition of a “provider-based off-campus hospital outpatient department” (PBD HOPD) as a location that is not on the main campus of a hospital and is located more 250 yards from the main campus.  The section defines a “new” PBD HOPD as an entity that executes a CMS provider agreement after the date of enactment of the Act and that any NEW PBD HOPD executing a provider agreement after the date of enactment would not be eligible for reimbursements from CMS’ Outpatient Prospective Payment System (PPS).

Bipartisan Budget Act of 2015

Section-by-Section Summary

©2015 Epstein Becker & Green, P.C. All rights reserved.

Age and Sex Differences in Working Memory after Mild Traumatic Brain Injury: Functional MR Imaging Studies

A new study published in Radiology evaluated the age effect on working memory performance and functional activation after mild traumatic brain injury. According to the abstract, researchers at Taipei Medical University-Shuang-Ho Hospital in Taiwan compared a group of thirteen individuals between the ages of 21-30 (with a mean age of 26.2 years) to a group of thirteen older patients who had an age range between 51-68 years (with a mean age of 57.8 years). Both groups had sustained mild traumatic brain injuries (MTBI). The researchers compared these twenty-six patients with twenty-six age- and sex-match control subjects. Functional MR images were obtained within one month after injury and six weeks after the initial study. Researchers performed group comparison and regression analysis among post concussion symptoms, neuropsychological testing and working memory activity in both groups.

The results showed different manifestations of post concussion symptoms at functional MR imaging between younger and older patients, which confirmed the important role of age in activation, modulation and allocation of working memory processing resources after mild traumatic brain injuries. The researchers concluded that these findings also supported the observation that younger patients have a better neural plasticity and clinical recovery than older patients.

David Yen-Ting Chen, the lead author of the study, stated in a press release, “old age has been recognized as an independent predictor of worse outcome from concussion, but most previous studies were performed on younger adults.” Dr. Chen went on to state, “taken together these findings provide evidence for differential neural plasticity across different ages, with potential prognostic and therapeutic implications. The results suggested MTBI might cause a more profound and lasting effect in older patients.”

The researchers also looked at the differences between men and women. They found that female patients with MTBI had lower digit span scores than did female control subjects, and functional MR imaging depicted sex differences in working memory functional activation; hypoactivation with non recovery of activation change at follow-up studies may suggest a worse working memory outcome in female patients with MTBI.

Again, this is just another example that refutes defense allegations that mild TBI always goes on to uneventful healing and recovery with 3-6 months.  If you or your family was injured and sustained traumatic brain injuries, it is encouraged that you seek experienced legal counsel.

Article By Bruce H. Stern of Stark & Stark

COPYRIGHT © 2015, STARK & STARK

HHS Launches Portal Seeking Questions from Mobile Health Application Developers

On October 5, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services launched a new platform to enable developers of mobile health technology, as well as others “interested in the intersection of health information technology and HIPAA privacy protection.” OCR notes that there is currently “an explosion of technology using data about the health of individuals in innovative ways to improve health outcomes.” The platform allows for individuals to both submit and review questions on the HIPAA implications of these mobile health applications.

The platform invites mobile health developers to submit questions and topics for future guidance. The portal asks:

What current provisions leave you scratching your heads? How should this guidance look in order to make it more understandable, more accessible? Use this page to submit your questions about HIPAA. Or present a use case. Look at what your peers are discussing, comment on it and vote on which topics or use cases would be the most helpful or important to your work.

As of now, the platform features questions (though no answers yet) regarding:

  • what entities are covered by HIPAA;

  • the application of HIPAA to cloud computing;

  • what aspects of the application (environment) must be HIPAA compliant;

  • the content of business associate agreements;

  • the flow of patient-generated data; and

  • the use of audit logging by developers.

Anyone can browse the site, but users who wish to submit questions must register. Registered users may also offer comments on other submissions or vote on the relevance of a topic. The portal represents that the entities and email addresses associated with posts by registered users will be anonymous to OCR. OCR also states that posting or commenting on a question on the portal will not subject anyone to enforcement action. While OCR will moderate comments posted by users, it will not vouch for the accuracy of these comments. Thus, users must pay close attention as to whether guidance appearing on by the portal is endorsed by OCR before taking action in reliance on this guidance.

The release of the portal comes at a time of particular uncertainty for medical application developers. HHS has acknowledged that existing HIPAA guidance has not addressed all of the questions raised by emerging technologies and has said that it plans to seek guidance from mobile application developers themselves. Depending on the timeliness of, and level of detail contained in, OCR’s responses to questions, the portal could prove a useful resource to a quickly evolving industry.

© 2015 Covington & Burling LLP

Wearables, Wellness and Privacy

Bloomberg BNA recently reported that this fall the Center for Democracy & Technology (CDT) will be issuing a report on Fitbit Inc.’s privacy practices. Avid runners, walkers or those up on the latest gadgets likely know about Fitbit, and its line of wearable fitness devices. Others may know about Fitbit due to the need to measure progress in their employers’ wellness programs, or even whether they qualify for an incentive. When participating in those programs, employees frequently raise questions about the privacy and security of data collected under such programs, a compliance issue for employers. Earlier this month, FitBit reported that its wellness platform is HIPAA compliant.

fitbit, charge HR, wearable technology, fitness tech, exercise, step counter, weight loss deviceFitBit’s Charge HR (the one I use) tracks some interesting data in addition to the number of steps: heart rate, calories burned, sleep activity, and caller ID. This and other data can be synched with a mobile app allowing users to, among other things: create a profile with more information about themselves, to track progress daily and weekly, and to find and communicate with friends also using a similar device.

Pretty cool stuff, and reasons why FitBit is the most popular manufacturer of wearables with nearly 25 percent of the market, as noted by Bloomberg BNA. But, of course, FitBit is not the only player in the market, and the same issues have to considered with the use of wearables regardless of the manufacturer.

According to Bloomberg BNA’s article, one of the concerns raised by CDT about FitBit and other wearables is that the consumer data collected by the devices may not be protected by federal health privacy laws. However, CDT’s deputy director of the Consumer Privacy Project stated to Bloomberg BNA that she has “a real sense that privacy matters” to FitBit. This is a good sign, but the laws that apply to the use of these kinds of devices depend on how they are used.

When it comes to employer-sponsored wellness programs and health plans, a range of laws may apply raising questions about what data can be collected, how it can be used and disclosed, and what security safeguards should be in place. At the federal level, the Health Insurance Portability and Accountability Act (HIPAA), the Americans with Disabilities Act (ADA), and the Genetic Information Nondiscrimination Act (GINA) should be on every employer’s list. State laws, such as California’s Confidentiality of Medical Information Act, also have to be taken into account when using these devices in an employment context.

Recently issued EEOC proposed regulations concerning wellness programs and the ADA address medical information confidentiality. If finalized in their current form, among other safeguards, the regulations would require employers to provide a notice informing employee about:

  • what medical information will be obtained,

  • who will receive the medical information,

  • how the medical information will be used,

  • the restrictions on its disclosure, and

  • the methods that will be used to prevent improper disclosure.

Preparing these notices for programs using wearables will require knowing more about the capabilities of the devices and how data is accessed, managed, disclosed and safeguarded.

But is all information collected from a wearable “medical information”? Probably not. The number of steps a person takes on a given day, in and of itself, seems unlikely to be medical information. However, data such as heart rate and other biometrics might be considered medical information subject to the confidentiality rule. Big data analytics and IoT may begin to play a greater role here, enabling more detailed pictures to be developed about employees and their activities and health through the many devices they use.

Increasingly wellness programs seek to incentivize the household, or at least employees and their spouses. Collecting data from wearables of both employee and spouse may raise issues under GINA which prohibits employers from providing incentives to obtain genetic information from employees. Genetic information includes the manifestation of disease in family members (yes, spouses are considered family members under GINA). The EEOC is currently working on proposed regulations under GINA that we are hoping will provide helpful insight into this and other issues related to GINA.

HIPAA too may apply to wearables and their collection of health-related data when related to the operation of a group health plan. Employers will need to consider the implications of this popular set of privacy and security standards including whether (i) changes are needed in the plan’s Notice of Privacy Practices, (ii) business associate agreements are needed with certain vendors, and (iii) the plan’s risk assessment and policies and procedures adequately address the security of PHI in connection with these devices.

Working through plans for the design and implementation of a typical wellness program certainly must involve privacy and security; moreso for programs that incorporate wearables. FitBits and other devices likely raise employees’ interest and desire to get involved, and can ease administration of the program, such as in regard to tracking achievement of program goals. But they raise additional privacy and security issues in an area where the law continues to develop. So, employers need to consider this carefully with their vendors and counselors, and keep a watchful eye for more regulation likely to be coming.

Until then, I need to get a few more steps in…

Article By Joseph J. Lazzarotti of Jackson Lewis P.C.

HIPAA: Disclosing Exam Results to Employers

Physicians and other providers are often paid by employers to conduct drug tests, fitness-for-duty or return-to-work exams, or employment physicals for employees. In such circumstances, the physician may mistakenly assume that they may disclose the test and exam results to the employer without the patient’s authorization, but that is not correct.HIPAA

As with any other protected health information, physicians and other providers generally need the patient’s written, HIPAA-compliant authorization to disclose exam results to the employer. (45 CFR 164.508(a); see also 65 FR 82592 and 82640). However, unlike other treatment situations, a provider may condition the performance of an employee physical or test on the patient’s provision of an authorization, i.e., the provider may refuse to perform the exam unless the patient executes a valid authorization. (45 CFR 164.508(b)(4)(iii); 65 FR 82516 and 82658). In addition, the employer may condition the employee’s continued employment on the provision of the exam results (at least under HIPAA), thereby creating an incentive for the employee to execute the authorization. (65 FR 82592 and 82640). The foregoing rules also apply when the health care provider is the employer, e.g., when a hospital employee receives treatment or tests at the hospital. In those situations, the hospital/employer generally may not access or use the patient/employee’s health information for employment-related purposes without the patient’s written authorization. (67 FR 53191-92).

An employee who receives an unfavorable test or exam result may attempt to block disclosure by revoking their authorization. Although patients are generally entitled to revoke their authorization by submitting a written revocation, HIPAA contains an exception that limits revocation if and to the extent that the provider has taken action in reliance on the authorization. (45 CFR 164.508(b)(5)). That exception should apply when the provider has conditioned and provided the test or exam in reliance on the patient’s authorization.

There are very limited exceptions to the authorization requirement. As in other situations, a provider may disclose protected health information to an appropriate entity if necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public (45 CFR 164.512(j)), or if the disclosure is otherwise required by law. (Id. at 164.512(a)). HIPAA contains a specific exception that allows disclosures to employers if the exam was performed as part of a medical surveillance of the workplace and the employer needs the information to report work-related injuries as required by OSHA, MSHA, or similar state laws. (Id. at 164.512(b)(v)). Finally, HIPAA allows providers to disclose protected health information as authorized by and to the extent necessary to comply with workers compensation laws. (Id. at 164.512(l)).

The bottom line: if you are a physician or other provider who conducts employment physicals, tests, or exams, be sure you obtain the patient’s written, HIPAA-compliant authorization before conducting the exam and/or disclosing test or exam results to the employer.

Copyright Holland & Hart LLP 1995-2015.

UK Government Launches Cybersecurity Service For Healthcare Organizations

The UK government has announced a new national service providing expert cybersecurity advice to entities within the National Health Service (NHS) and the UK’s broader healthcare system.  The project, called CareCERT (Care Computing Emergency Response Team), is aiming for a full go-live in January 2016.

Acording to recent press releases, CareCERT will:

  • “Provide incident response expertise for the management of cyber security incidents and threats across health and care system”;

  • “Broadcast potential cyber threats and necessary actions to take across the sector, to ensure cyber threats are safely dealt with”;

  • “Be a central source of security intelligence for health and care by working with cross government monitoring partners such as GovCertUK and CERT-UK”;

  • “Support the analysis of emerging and future threats through unique analysis tools and reporting”; and

  • “Be a trusted source of security best practice and guidance”.

CareCERT will be run by the Health and Social Care Information Centre (HSCIC).  The HSCIC is an important offshoot of the UK Department of Health, overseeing information assurance and patient privacy within the NHS as part of its broader role in setting health IT standards, assisting IT rollout throughout the NHS, and managing the release of healthcare statistics for the NHS.

CareCERT is expected to be a natural evolution of HSCIC’s existing function and expertise.  In particular, under the HSCIC/Department of Health’s data breach reporting policy (imposed on NHS bodies and their suppliers through contract), HSCIC is already one of the bodies notified and involved in the event of serious data breaches in the public healthcare sector.  The creation of CareCERT will enhance the HSCIC’s incident response capabilities, and will give NHS suppliers an increased opportunity to engage with HSCIC proactively (for guidance and threat alerts), rather than only after serious incidents take place.

Article by Mark Young & Philippe Bradley-Schmieg of Covington & Burling

© 2015 Covington & Burling LLP

FDA Flunks Mylan’s India Facilities, Finds cGMP Violations

When we open our medicine cabinet, we take for granted that the drugs we find there are safe and properly labeled. Many physicians privately worry, however, about the safety and efficacy of prescription drugs.

About 85% of the prescription drugs sold in the United States are manufactured offshore. Many of those offshore drugs are made by generic companies, foreign contract manufacturing companies and sometimes, offshore facilities owned by the so-called “big pharma” manufacturers themselves. Wherever manufactured, drugs distributed in the United States must meet certain current good manufacturing practices or cGMP standards.

Recently the Food and Drug Administration (FDA) began ramping up inspections of offshore manufacturing facilities and the results are shocking. Although cGMP violations have been found worldwide, experts are particularly worried about drugs made in China and India.

Earlier this month the FDA cited three facilities in Bangalore, India that manufacture drugs for Mylan. Headquartered in the U.K., Mylan is the second largest generic and specialty pharmaceutical company in the world. With approximately 30,000 employees worldwide and revenues of $7.72 billion (USD), Mylan certainly qualifies as big pharma.

The FDA says it inspected three of Mylan’s Indian plants between August of 2014 and February of this year. It found “significant” cGMP violations at all three facilities.

Worse, the FDA says that in all three instances Mylan’s response to the three inspections lacked “sufficient corrective actions.”

cGMP standards are in place throughout the manufacturing process to insure the potency and quality of the finished pharmaceuticals. The FDA wants to insure that there are no contaminants in the finished product as well as insuring the finished product is neither stronger nor weaker than advertised.

As a result of the inspections, the FDA concluded a likelihood that the finished drugs from all three plants were adulterated. Those findings are certainly bad news for consumers. It’s also bad for physicians as well. It’s hard for doctors to get dosages correct or monitor for side effects if a drug has inconsistent potency or the presence of contaminants.

In the case of Mylan’s Bangalore, India facilities, the violations were numerous and included:

  • gloves and sterile gowns for use in aseptic environments had holes and tears

  • personal sanitation violations

  • clean room violations

  • discolored injection vials

  • lots with failed assays or contaminants

At least one of the facilities had similar violations dating back to a 2013 inspection.

Overall, the FDA noted, “These items found at three different sites, together with other deficiencies found by our investigators, raise questions about the ability of your current corporate quality system to achieve overall compliance with CGMP. Furthermore, several violations are recurrent and long-standing.”

The FDA declared that continued noncompliance could result in drugs from these facilities being blocked from importation and distribution within the United States.

Mylan has had previous problems with U.S. regulators. In 2000 Mylan paid a $147 million fine to settle charges that the company raised the price of generic lorazepam by 2,6000% and generic clorazepate by 3,200%. The FTC had charged that the company raised the price of lorazepam, the generic equivalent of the brand name antianxiety medication Ativan, from $7 per bottle to $190. Although Mylan agreed to the payment of the fine, it denied any wrongdoing.

Only the FDA can punish drug companies for cGMP violations but if there is proof of an adulterated product entering the commerce stream, the federal False Claims Act can come into play. That law allows private individuals to file a lawsuit against a wrongdoer and receive a percentage of whatever is recovered by the government. Last year the Justice Department paid $635 million in whistleblower awards under the False Claims Act.

Whistleblowers in cGMP cases have received tens of millions of dollars. Dinesh Thakur, a former Ranbaxy executive, received $48 million for information about adulterated generic drugs.

To qualify for a whistleblower award, one must possess inside, “original source” information about a cGMP violation resulting in an adulterated drug or under / over potency medication being approved for sale by Medicaid, Medicare or Tricare. (Most drugs are approved.)

While we believe that contaminated drugs are relatively rare, industry sources tell us that potency issues are rampant. That means the drugs in your medicine cabinet may have little or no active ingredients.

Article By Brian Mahany of Mahany Law

© Copyright 2015 Mahany Law

Medical Record Retention

I am often asked how long a practice must maintain medical records. The answer depends on the type of provider you are and your risk tolerance. Providers should generally consider the following in establishing their record retention policies:

1. Patient care. The primary consideration should be patient care. Some practices (e.g., oncology) may want to retain medical records longer than the relevant regulatory requirement or statute of limitations period because the records may be important to future patient care. If your electronic records program allows, you may want to retain the records permanently.

2. Statutory or Regulatory Requirements. State and federal regulations require hospitals and certain other institutional providers to maintain medical records for specified periods, but those laws usually do not apply directly to physicians or physician groups. There are numerous guides online. For example, HealthIT.gov published a 50-state survey of record retention requirements. The Idaho Department of Health and Welfare published a helpful but incomplete summary of federal record retention regulations. CMS published a MedLearn article on recordretention. AHIMA is usually a good source for online guidance about record retention laws and regulations.

3. Accreditation, payer or other contract requirements. Some provider contracts, payer requirements, or accreditation standards may require providers to keep records for a certain time. For example, Idaho’s Medicaid Provider Handbook requires providers to maintain records to support claims for five years. Check your relevant contracts to ensure your record retention policies comply with any such requirements. You may also want to check with your liability insurer to determine if they have any record retention requirements or suggestions.

4. Statute of limitations. If there are no more paramount concerns, physicians should generally retain medical records for at least the applicable statute of limitations period to ensure the practice has the records necessary to defend its care or charges if challenged. In most cases, maintaining the records for ten (10) years should get you past relevant state or federal limitations periods, including those for malpractice, contract, or fraud and abuse claims. Beware that many states toll the statute of limitations period for claims by minors; if so, you may want to keep records of minors until the later of either (i) six years after the date of treatment, or (ii) three years after the minor reaches the age of majority, depending on your applicable state statute of limitations for malpractice claims.

If your records are subject to a pending claim or investigation, you should retain the records through the resolution of the claim or investigation. Destroying records that are subject to pending claims or investigations may result in liability under state or federal laws; common law claims for destruction of evidence; or adverse judgments because you lack the evidence to defend yourself.

Copyright Holland & Hart LLP 1995-2015.

Amarin Ruling Solidifies Off-Label Marketing Options but Raises Questions About False Claims Act Enforcement Action

The Southern District of New York recently ruled in Amarin Pharma, Inc. et al. v. Food and Drug Administration, et al. that a drug company may engage in “truthful and non-misleading speech” about off-label uses of an approved drug without the threat of a misbranding action under the Federal Food, Drug, and Cosmetic Act. No. 1:15-cv-03588 (S.D.N.Y., Aug. 7, 2015). This important decision—which arose out of Amarin’s constitutional challenge seeking to make certain statements about unapproved uses of a triglyceride-lowering drug, Vascepa—builds on recent Second Circuit precedent that allows drug makers more regulatory latitude, at minimum in the Second Circuit, to provide truthful and non-misleading scientific information about unapproved uses for their products. However, the ruling also serves as a reminder of potential False Claims Act (FCA) liability associated with off-label marketing of pharmaceuticals and devices.

Amarin filed its complaint against the Food and Drug Administration (FDA) after the company received a Complete Response Letter (CRL) from the FDA in connection with its application for approval of a new indication. The CRL indicated that, while clinical studies revealed that Vascepa reduced triglyceride levels, based on its data review, the FDA advised that additional clinical data would be needed before it could approve the drug for additional uses beyond the original approval for “very” high levels of triglycerides. Despite the fact that Amarin sought to make truthful and non-misleading statements about its product to “sophisticated healthcare professionals,” including the physicians who joined Amarin in the lawsuit, the FDA concluded there was insufficient support for approval of the supplemental application for a new indication and stated that any communications about off-label uses of Vascepa could result in enforcement action.

While the FDA described Amarin’s First Amendment claims as a “frontal assault on the framework for new drug approval that Congress created in 1962,” the court rejected all of the government’s counterarguments. Relying on the Second Circuit’s decision in United States v. Caronia, 703 F.3d 149 (2d Cir. 2012), the court held that Amarin could engage in the following activity:

  • Distribute summaries and reprints of the relevant studies in a manner or format other than that specified by the FDA

  • Articulate, in connection with Vascepa, the off-label claim permissible for use on chemically similar dietary supplements

  • Make proactive truthful statements and engage in a dialogue with doctors regarding the off-label use

While the Amarin decision is welcome news for the industry, drug manufacturers must still take care to analyze promotional statements to ensure that the content can be successfully defended as “truthful” and “non-misleading” speech. As the Amarin court acknowledged, manufacturers not only face potential criminal exposure for “false” or “misleading” misbranding, but the promotion of off-label use can give rise to civil claims under the FCA. FCA enforcement in off-label cases—which proceed on a theory that a company caused false claims to be submitted to government health care programs for non-covered and non-FDA-approved uses—have been a huge source of FCA recoveries in recent years. In FY2014, for example, the Department of Justice (DOJ) recovered over $2.2 billion in FCA actions against pharmaceutical and medical device companies stemming from off-label promotion. Regulatory enforcers and qui tam whistleblowers will not hesitate to allege FCA violations where circumstances, for example, allow the inference that narrowly couched promotional statements may have been “truthful” but still factually incomplete and, thus, misleading. The Amarin decision highlights the fact-specific nature of the risk analysis. Amarin relied on truthful statements about Vascepa’s off-label use that were largely derived from an FDA-approved study and writings from the FDA itself on the subject. Rather than shooting from the marketing “hip,” Amarin appears to have invested in building a defensible factual scientific record and preemptively sought an FDA opinion regarding the off-label use of Vascepa before engaging in those communications.

While it remains unclear whether the FDA will appeal the Amarin decision to the Second Circuit, the agency’s decision to let Caronia stand without further appeal suggests that there may be reluctance on the part of regulators to risk a higher court expanding the reach of the Caronia holding across the country. Pharmaceutical and device manufacturers should still proceed cautiously as the FDA determines how it will respond following the Amarin ruling. For example, the FDA updated its draft guidance regarding the dissemination of scientific and medical journal articles following the Caronia decision in February 2014 and agreed in June 2014 to conduct a “comprehensive review [of its] regulatory regime governing communications about medical products,” with the intent of issuing new guidance by June 2015. As the Amarin court noted, this revised guidance is still forthcoming and may be further revised in light of this decision.

© 2015 McDermott Will & Emery