FDA Requests Comments on WHO Recommendation to Classify Two Common Industrial Solvents as Psychotropic Substances

Beveridge & Diamond PC environmental and energy law firm

On January 27, 2015, the Food and Drug Administration (“FDA”) requested comments on a recommendation by the World Health Organization (“WHO”) to classify two common industrial solvents – gamma-butyrolactone (“GBL”) and 1,4-butanediol (“BDO”) – as psychotropic substances under Schedule I of the 1971 Convention on Psychotropic Substances (“Psychotropic Convention”). See 80 Fed. Reg. 4283.  The comments will be used by the Secretary of Health and Human Services (“HHS”) to prepare a recommendation on the WHO proposal to the Secretary of State, which will be binding on the U.S. representative to the upcoming 58th Session of the UN Commission on Narcotic Drugs (“CND”) in Vienna, Austria, on March 9-17, 2015.  At the Vienna meeting, CND may accept the WHO recommendations, reject the recommendations, or decide to control the chemicals in another way (i.e., under a different Schedule of the Convention).

FDA notes that if either chemical – or any of the other chemicals that are also recommended for listing, but are not addressed here because they have few, if any, legitimate industrial uses – are added by CND to Schedule I of the Psychotropic Convention, the U.S. will have to impose additional controls on the chemical(s) under the Controlled Substances Act (“CSA”) administered by the Drug Enforcement Administration (“DEA”).  Although FDA does not elaborate on what those controls might consist of, they would likely include additional restrictions on manufacture, distribution, import, and export of the chemicals, as well as enhanced recordkeeping and reporting requirements. For example, Article 2(7)(a)(i) of the Psychotropic Convention states that parties shall require licenses for manufacture, trade, and distribution of Schedule I substances.  Moreover, Article 7(a) provides that parties must “[p]rohibit all use [of Schedule I substances] except for scientific and very limited medical purposes by duly authorized persons,” although Article 2(7)(a) allows individual parties to notify the UN that they cannot do so as a result of “exceptional circumstances,” in which case the party need only “take into account” the prohibition “as far as possible.”

It is worth noting that GBL is already regulated under the CSA as a precursor to gamma-hydroxybutyric acid (“GHB”), which is a commonly abused central nervous system depressant drug that is currently regulated under Schedule II of the Psychotropic Convention and Schedule I of the CSA.  In particular, GBL is classified under the CSA as a “List I” precursor (not to be confused with a CSA Schedule I or other controlled substance), and thus is already subject to significant DEA controls.  In addition, some U.S. states and authorities in some other countries already regulate GBL directly as a controlled substance or its equivalent.  Nevertheless, the addition of GBL to Schedule I of the Convention would likely require new and more stringent controls in most jurisdictions.  Additional information on the basis for the WHO recommendation for GBL (including the chemistry of the chemical, abuse potential, legitimate uses, and current regulation around the world) can be found in the 2014 GBL Critical Review Report of the WHO Expert Committee on Drug Dependence.

BDO is also a precursor to GHB, but is not currently regulated under the CSA.  It is regulated in several U.S. states and other countries as a precursor or controlled substance equivalent.  Once again, however, if it is added to Schedule I of the Psychotropic Convention, it will likely become subject to substantial additional restrictions.  Additional information on the basis for the WHO recommendation for BDO can be found in 2014 BDO Critical Review Report of the WHO Expert Committee on Drug Dependence.

FDA will accept written comments on the WHO recommendations until February 26, 2015.  Requests for a public meeting will be accepted until February 6, 2015.

ARTICLE BY

OF

Federal Government to Receive a $75 Million Settlement from CHSPSC in Alleged Medicaid Fraud Scheme: Community Health Systems Professional Services Corp.

Tycko & Zavareei LLP

On February 2, 2015, the Department of Justice (DOJ) announced that Community Health Systems Professional Services Corporation (CHSPSC) and three of its CHS affiliated hospitals in New Mexico, agreed to pay the government $75 million to settle allegations that it violated the False Claims Act (FCA) when it manipulated the Medicaid funding program by making illegal donations to New Mexico county governments in order to receive higher federally funded Medicaid payments.  The alleged improper donations from CHS were made to Chaves, Luna and San Miguel counties in the state of New Mexico.

The Sole Community Provider Program (SCP) is a federal and state funded program that is specifically designed to reimburse SCP hospitals for medical expenses incurred by uninsured and indigent patients.  Payments received by SCP hospitals are processed under New Mexico’s federal and state Medicaid Plan.  Under the SCP, the federal government will share 75 percent of patient claims incurred by SCP hospitals contingent on New Mexico’s state and local government’s ability to pay the remaining 25 percent under the matching share of the SCP.  One of the stipulations for receiving the funds is that the state and county government’s 25 percent share has to consist of state or county funds, and not impermissible “donations” from private hospitals.

According to the qui tam lawsuit filed by Robert Baker, a former CHSPSC revenue manager, on behalf of the government, between 2001 and 2010, CHS hospitals in the state of New Mexico filed claims to recover uninsured or indigent medical expenses under the SCP program.  However, the funds used to pay the state and local counties 25 percent share were donated by CHS.  This ongoing alleged illegal practice by CHS violated the FCA, and caused the state of New Mexico to present false claims to the United States for payments made to CHS under the SCP program.  In addition, the government also alleged that CHS concealed the true nature of these donations to avoid detection by federal and state authorities, and as a result of its scheme, received SCP payments which were funded by the United States in the amount of three times CHS’ “donations.”  The whistleblower, Mr. Baker, will receive approximately $18.6 million as his reward for having disclosed the fraud to the government under the False Claims Act.

OF

Filthy Pharma – Whistleblowers and Current Good Manufacturing Practices

Mahany Law Firm

Last year a federal appeals court in Richmond, Virginia upheld the dismissal of a whistleblower suit alleging violations of current good manufacturing practices, known in the industry as “cGMP.” Filed under the federal False Claims Act, the whistleblower claimed that his former employer, Omnicare, violated a series of cGMP safety regulations requiring that penicillin and non-penicillin drugs be manufactured in complete isolation from one another. The regulations are designed to prevent cross contamination.

Because Omnicare’s drugs were not manufactured in isolation, the whistleblower claimed that they were not eligible for reimbursement under Medicare and Medicaid programs. A judge in Baltimore dismissed the suit saying that this particular alleged cGMP was not one that could be prosecuted privately by a whistleblower.

The case was appealed and ultimately upheld by a three judge appeals panel last year. (United States ex. rel Barry Rostholder vs. Omnicare) Is this the end for “filthy pharma” cases under cGMP and the False Claims Act? No!

The Justice Department and Food and Drug Administration (FDA) support whistleblower filings for cGMP violations. In the aftermath of the Omnicare decision, however, it is prudent to have more than a mere allegation that products were not manufactured in properly segregated facilities.

In April 2013, the Justice Department announced that it would be taking “an especially hard look” at cGMP violations. Jeffrey Steger, deputy director of the Justice Department’s consumer protection unit, said the agency’s priority was to “identify and prosecute the most serious instances of food, drug and medical device violations… and in general [protect] consumers from adulterated or misbranded products…”

Notwithstanding the big loss for whistleblowers in Omnicare, the court did not slam shut the door on all cGMP violations. The court appears to have left the door open for cGMP violations that are significant and substantial and give rise to actual discrepancies in the functioning of the product.

What does this mean in practical terms? Merely claiming that a drug wasn’t manufactured properly may no longer be enough. To qualify for a whistleblower award, one should show both bad practices and that the product is tainted, adulterated, mislabeled, diluted or contaminated.

People with inside knowledge of adulterated drugs and cGMP violations may qualify for cash awards under state and federal False Claims Acts. Last year the federal government alone paid out $635 million to whistleblowers. Under the federal law, companies can be assessed triple damages and fined up to $11,000 per violation. Whistleblowers can receive up to 30% of whatever the government collects. (The average award is closer to 20%.)

ARTICLE BY

OF

Mergers and Acquisitions and the Affordable Care Act

Giordano Halleran Ciesla Logo

As most employers already know, the Affordable Care Act (a/k/a ObamaCare or the ACA) now imposes health care insurance coverage requirements upon certain employers which have a certain number of full time and full time equivalent employees (“FTEs”).  Therefore, it is imperative that consideration be given to whether parties involved in any merger or other acquisition transaction are currently subject to the requirements of the ACA (and if so, whether they are in compliance with such requirements), or will otherwise be subject to the requirements of the ACA following the consummation of the transaction.

If the buyer or seller company is a “small business,” meaning the company has less than 50 FTEs, it should not be subject to the ACA.   However, a determination has to be made as to whether or not individuals who are treated as independent contractors are, for the purposes of the ACA, truly independent contractors, or rather are deemed to be employees.  While the ACA makes reference to certain federal statutes with respect to this determination, it is clear that the Obama administration has uniquely and aggressively interpreted the ACA to accomplish its objectives.  In those circumstances where the seller or buyer company is below 100 FTEs for the year 2015, the company will be exempt from the requirements of the ACA for the year 2015, but subject to the ACA thereafter.  Even in those circumstances where companies clearly are subject to the ACA, the question then becomes whether or not all of the individuals who provide services to that company are classified appropriately (employees v. independent contractors), and whether the requirements of the ACA have been complied with regarding those individuals.

A new level of complexity has been added in this area by a relatively recent interpretation of the National Labor Relations Board (NLRB) in a franchise case dealing with the classification issue, in which the NLRB found that the various employees of the franchisees were also employees of the franchisor.  This could automatically create, for any national franchise, a situation where the local franchisee meets the large employer threshold of the ACA, and therefore would be liable to comply with the requirements of the ACA.  Obviously, the position taken by the NLRB will be contested and is a long way off from being established as binding law upon all employers.  Notably, this very issue has already been addressed in various state courts.  For instance, in contrast to the NLRB decision, the California State Supreme Court recently determined in a 4 to 3 decision that the employees of a franchisee are also not employees of the franchisor.

While the ACA references certain federal statutes for determining whether or not an individual is an employee, in the recent case of Sam Hargrove, et al. v. Sleepy’s, LLC , the New Jersey Supreme Court has advised the Third Circuit that for the purposes of the wage and hour laws, the interpretation should follow New Jersey case law, which provides a much stricter definition for independent contractors than the federal law.  Only time and litigation will tell what interpretation will be made under the ACA for the purposes of determining whether an individual is an employee or an independent contractor with respect to the determination as to whether the employer is a small business subject to the ACA and whether or not an individual is entitled to health care coverage.

In summary, careful consideration must be made in any merger or acquisition transaction as to whether the seller company in an asset purchase or equity purchase is, or the combined company in any merger, consolidation or similar combination will be, subject to the onerous requirements of the ACA based on the number of FTEs of the company.   In order to make such a determination, further consideration will need to be made into applicable case law as to whether or not individuals who are designated as independent contractors of the company are truly independent contractors, or rather should be deemed to be employees of the company for purposes of the ACA.  However, because the law in this area is not entirely settled and continues to evolve, companies involved in merger or acquisition transactions and companies contemplating merger or acquisition transactions will need to stay informed on these issues.

ARTICLE BY

OF

Hospital Antitrust Skirmish Over Economist

IMS_expert_blktype-transparent

Antitrust law is designed to help the Davids of the world maintain a level playing field with the Goliaths. That objective was realized when Boise, Idaho-based hospital operator St. Alphonsus Health System, Inc. (“St. Al’s”) sued rival St. Luke’s Health System, Ltd. (“St. Luke’s”), to block St. Luke’s acquisition of the Saltzer Medical Group (“Saltzer”), one of Idaho’s largest and oldest independent medical groups.

St. Al’s argued that St. Luke’s acquisition of Saltzer would give St. Luke’s such a dominant market share of the adult primary care market in Nampa, Idaho that it could raise prices and block referrals to St. Al’s by having Saltzer steer patients to St. Luke’s. St. Al’s fears certainly seemed well-founded: Saltzer accounted for 43% of the adult primary care physicians, and about 90% of the pediatric physicians in the Nampa market. Since St. Luke’s accounted for about 24% of the primary care physicians in Nampa, the combined entity would have about 67% of the adult primary care physicians in Nampa.

The Federal Trade Commission (FTC) and Idaho Attorney General (AG) launched their own investigations and ultimately joined St. Al’s lawsuit. Things didn’t go well initially for St. Al’s as the judge refused to preliminarily enjoin the acquisition, concluding that St. Al’s was unlikely to suffer irreparable harm before a trial could be held in the case. St. Luke’s proceeded to complete the transaction.

However, in January 2014, after a bench trial, the judge concluded that the deal would have anti-competitive effects in terms of raising health care costs due to the increased negotiating leverage of the combined entity. The judge directed St. Luke’s to unwind the transaction, and divest itself of Saltzer’s assets. St. Luke’s has appealed to the Ninth Circuit. At oral argument, St. Luke’s contended that the trial court had failed to adequately consider the deal’s benefits.

Along the way, the trial court had an opportunity to decide a motion by the FTC and Idaho AG to exclude the testimony of St. Luke’s economist, Dr. Alain Enthoven, concerning the quality-related benefits of the acquisition. Saint Alphonsus Med. Ctr. – Nampa, Inc. v. St. Luke’s Health Sys., Ltd., No. 1:12-CV-00560-BLW, 2013 WL 5637743 (D. Idaho Oct. 15, 2013). A major thrust of the objection was that Dr. Enthoven had not read any of St. Luke’s physician service agreements (“PSA’s”), and therefore could not credibly testify as to “whether the acquisition creates the requisite integration to achieve the purportedly greatest benefits of integrated patient care.”

The Court denied the motion. After reviewing the facts shared in the decision, the argument seems like a stretch and we feel the Court reached the right result. As the Court observed, despite not having read the PSA’s, Dr. Enthoven interviewed six top executives from St. Luke’s and Saltzer, and reviewed thirty depositions. The Court believed this effort enabled Dr. Enthoven to testify credibly concerning the quality-enhancing benefits of moving away from the fee-for-service model of compensation and toward the quality-based model of compensation.

The judge also rejected the FTC’s contention that Dr. Enthoven was unqualified to testify regarding how the use of health information technology, such as electronic medical records, promotes higher quality care in light of Dr. Enthoven’s admission at his deposition that he was not a “healthcare IT expert.” Observing that Dr. Enthoven was testifying as an economist, not a programmer, the judge ruled that Dr. Enthoven was qualified to explain how various healthcare IT tools promoted higher  quality care even if he didn’t understand the mechanics of how those tools worked. This conclusion also seems correct, and not really a close call at all.

Do you agree with our conclusion that the Court made the right call in denying the motion to exclude Dr. Enthoven’s expert testimony?

ARTICLE BY

OF

New Jersey Pharmaceutical Company Agrees to Pay $39 Million to Settle Alleged Anti-Kickback Violations

tz logo 2

On January 9, 2015, the Department of Justice (DOJ) announced that pharmaceutical company Daiichi Sankyo, headquartered in New Jersey, agreed to pay the Government $39 million to settle claims that it violated the Anti-Kickback Statue and the False Claims Act (FCA) by allegedly incentivizing physicians to prescribe Daiichi drugs by providing kickbacks to those doctors.  The drugs prescribed as a result of those alleged kickbacks were billed under the Medicare or Medicaid Program, and thus paid for, at least in part, by the government.  This lawsuit was filed by former Daiichi sales representative Kathy Fragoules under the qui tam whistleblower provision of the FCA.  Fragoules will receive an award of $6.1 million, which represents approximately 15 percent of the settlement amount, for exposing Daiicho Sankyo’s alleged illegal practices.

The qui tam lawsuit, originally filed on behalf of the government by Fragoules, claims that for a period of six years, from January 1, 2005 to March 31, 2011, Daiichi Sankyo allegedly devised a scheme to promote several of its drug products by offering monetary kickbacks to physicians that prescribed Daiichi drugs to their patients.  The Physician Self-Referral Statue and the Anti-Kickback Statue prohibit anyone from knowingly and willfully offering, paying, soliciting, or receiving remuneration in order to induce business reimbursed under the Medicare or Medicaid programs.  However, according to the government, Daiichi allegedly orchestrated kickback compensation to physicians in the form of speaker fees by allegedly funneling payment to health care providers through the Daiichi’s Physician Organization and Discussion programs known as PODs.  In doing so, the government claims that Daiichi knowingly and willfully violated the FCA.

Physician drug ordering and prescribing decisions continue to be influenced by the drug industry.  Last year, the DOJ reported billions in settlements in connection with the pharmaceutical industry arising out of violations of the Physician Self-Referral Statue and the Anti-Kickback Statue.  The government also paid out millions in awards to individuals and whistleblowers that exposed these alleged illegal practices through the filing of qui tam lawsuits under the FCA.  A whistleblower who files a case against a company that has committed fraud against the government, may receive compensation of up to 30 percent of the amount ultimately recovered by the government.

ARTICLE BY

OF

Nation’s Highest Court Schedules Oral Arguments in King v. Burwell re: Affordable Care Act

Sheppard Mullin Law Firm

A Supreme Court of the United States (SCOTUS) spokesperson announced on December 22, 2014, that the Court will hear oral arguments in King v. Burwell on March 4, 2015. This means that not only could the highest court soon resolve the circuit split on the case’s key issue, but that the future course of the landmark Affordable Care Act (ACA) could be decided as soon as June 2015.

At issue in King is whether a May 2012 IRS rule should be upheld or stricken.[1] The rule provides that health insurance premium tax credits are available to all U.S. taxpayers, irrespective of whether they obtain coverage through a state or federal exchange. Challengers to the IRS rule contend that the plain language of the ACA restricts the availability of the tax credits to health insurance policies purchased through state exchanges and not through the federal exchange. Reading the ACA statutory language strictly, challengers note that there is no alternative interpretation to the words noting that premium tax credits are available for plans obtained “through an Exchange established by the State under section 1311” of the Act.[2] (italics added).

The government has countered that other provisions of the ACA support the legislative intent of Congress—that the premium tax credits are meant to be made available for all taxpayers nationwide, including those who purchase plans on the federal exchange. It has noted that the IRS rule should not be invalidated because of a simple drafting error.

Earlier this year in July, the U.S. Court of Appeals for the Fourth Circuit had unanimously concluded in King that the ACA was ambiguous on the question of whether the tax credits applied to plans purchased through the federal exchange. Because of this, it allowed for the government to have a “reasonable interpretation” of the ACA via the IRS rule.[3]This decision directly conflicted with the July 2014 U.S. Court of Appeals (District of Columbia) decision in Halbig v. Burwellon the same issue.

The D.C. Court sided with the plain language interpretation and restricted the tax credits to plans purchased through the state exchanges. The Court subsequently vacated the decision and is not expected to render its opinion until Spring 2015.

If SCOTUS resolves the circuit split in favor of the challengers, there are several potential implications that could leave millions of Americans without health insurance:

  • Coverage would be less affordable for those on the federal exchange;

  • Without the tax credit, individuals would be exempt from the individual mandate;[4] and

  • The ACA employer “pay-or-play” provision would not apply to as many employers.

The latter implication is likely due to the fact that pay-or-play penalties are triggered only if a covered employer fails to offer health insurance coverage and an employee takes advantage of a tax subsidy by purchasing an exchange plan.  Without premium tax credits or subsidies available through the federal exchange, fewer employers would be penalized for failure to provide coverage in the first place.

The Supreme Court’s decision in the summer of 2015 may set the tone for the longevity of the ACA in light of the most recent mid-term elections.

ARTICLE BY


[1] See 26 C.F.R. § 1.36B–1(k); Health Insurance Premium Tax 7 Credit, 77 Fed.Reg. 30,377, 30,378 (May 23, 2012) (collectively the “IRS Rule”).

[2] See ACA § 1401(a), codified at 26 U.S.C. § 26B(c)(2)(A)(i).

[3] The Fourth Circuit U.S. Court of Appeals opinion can be found here.

[4] As a matter of law, health insurance would be “unaffordable” and the individual mandate would be waived. See 26 U.S.C. § 5000A.

The Affordable Care Act—Countdown to Compliance for Employers, Week 1: Going Live with the Affordable Care Act’s Employer Shared Responsibility Rules on January 1, 2015

Mintz Levin Law Firm

Regulations implementing the Affordable Care Act’s (ACA) employer shared responsibility rules including the substantive “pay-or-play” rules and the accompanying reporting rules were adopted in February.  Regulations implementing the reporting rules in newly added Internal Revenue Code Sections 6055 and 6056 came along in March. And draft reporting forms (IRS Forms 1094-B, 1094-C, 1095-B and 1095-C) and accompanying instructions followed in August.

With these regulations and forms, and a handful of other, related guidance items (e.g., a final rule governing waiting periods), the government has assembled a basic—but by no means complete—compliance infrastructure for employer shared responsibility. But challenges nevertheless remain. Set out below is a partial list of items that are unresolved, would benefit from additional guidance, or simply invite trouble.

1.  Variable Hour Status

The ability to determine an employee’s status as full-time is a key regulatory innovation. It represents a frank recognition that the statute’s month-by-month determination of full-time employee status does not work well in instances where an employee’s work schedule is by its nature erratic or unpredictable. We examined issues relating to variable hour status in previous posts dated April 14July 20, and August 10.

An employee is a “variable hour employee” if—

Based on the facts and circumstances at the employee’s start date, the employer cannot determine whether the employee is reasonably expected to be employed on average at least 30 hours of service per week during the initial measurement period because the employee’s hours are variable or otherwise uncertain.

The final regulations prescribe a series of factors to be applied in making this call. But employers are having a good deal of difficulty applying these factors, particularly to short-tenure, high turnover positions. While there are no safe, general rules that can be applied in these cases, it is pretty easy to identify what will not work: classification based on employee-type (as opposed to position) does not satisfy the rule. Thus, it is unlikely that a restaurant that classifies all of its hourly employees, or a staffing firm that classifies all of its contract and temporary workers, as variable hour without any further analysis would be deemed to comply. But if a business applies the factors to, and applies the factors by, positions,  it stands a far greater chance of getting it right.

2.  Common Law Employees

We addressed this issue in our post of September 3, and since then, the confusion seems to have gotten worse. Clients of staffing firms have generally sought to take advantage of a special rule governing offers of group health plan coverage by unrelated employers without first analyzing whether the rule is required.

While staffing firms and clients have generally been able to reach accommodation on contractual language, there have been a series of instances where clients have sought to hire only contract and temporary workers who decline coverage in an effort to contain costs. One suspects that, should this gel into a trend, it will take the plaintiff’s class action bar little time to respond, most likely attempting to base their claims in ERISA.

3.  Penalties for “legacy” HRA and health FSA violations

A handful of promoters have, since the ACA’s enactment, offered arrangements under which employers simply provided lump sum amounts to employees for the purpose of enabling the purchase of individual market coverage. These schemes ranged from the odd to the truly bizarre. (For example, one variant claimed that the employer could offer pre-tax amounts to employees to enroll in subsidized public exchange coverage.) In a 2013 notice, the IRS made clear that these arrangements, which it referred to as “employer payment plans,” ran afoul of certain ACA insurance market requirements. (The issues and penalties are explained in our June 2 post.) Despite what seemed to us as a clear, unambiguous message, many of these schemes continued into 2014.

Employers that offered non-compliant employer-payment arrangements in 2014 are subject to penalties, which must be self-reported. For an explanation of how penalties might be abated, see our post of April 21.

4.  Mergers & Acquisitions

While the final employer shared responsibility regulations are comprehensive, they fail to address mergers, acquisitions, and other corporate transactions. There are some questions, such as the determination of an employer’s status as an applicable large employer, that don’t require separate rules. Here, one simply looks at the previous calendar year. But there are other questions, the answers to which are more difficult to discern. For example, in an asset deal where both the buyer and seller elect the look-back measurement method, are employees hired by the buyer “new” employees or must their prior service be tacked? The IRS invited comments on the issue in its Notice 2014-49.

Taking a page from the COBRA rules, the IRS could require employers to treat sales of substantial assets in a manner similar to stock sales, in which case buyers would need to carry over or reconstruct prior service. While such a result might be defensible, it would also impose costly administrative burdens. Currently, this question is being handled deal-by-deal, with the “answers” varying in direct proportion to the buyer’s appetite for risk.

5.  Reporting

That the ACA employer reporting rules are in place, and that the final forms and instructions are imminent should give employers little comfort. These rules are ghastly in their complexity. They require the collection, processing and integration of data from multiple sources—payroll, benefits admiration, and H.R., among others. What is needed are expert systems to track compliance with the ACA employer shared responsibility rules, populate and deliver employee reports, and ensure proper and timely delivery of employee notices and compliance with the employer’s transmittal obligations. These systems are under development from three principal sources: commercial payroll providers, national and regional consulting firms, and venture-based and other start-ups that see a business opportunity. Despite the credentials of the product sponsors, however—many of which are truly impressive—it is not yet clear in the absence of actual experience that any of their products will work. It is not too early for employers to contact their vendors and seek assurances about product delivery, reliability, and performance.

Just in Time for the Holidays: Another HIPAA Settlement

Mcdermott Will Emery Law Firm

On December 2, 2014, the Office for Civil Rights (OCR) and Anchorage Community Mental Health Services, Inc., (ACMHS) entered into a Resolution Agreement and Corrective Action Plan (CAP) to settle alleged violations of the HIPAA Security Rule, which governs the safeguarding of electronic protected health information (ePHI).  OCR initiated an investigation into ACMHS’s compliance with HIPAA after receiving a March 2, 2012 notification from the provider regarding a breach of unsecured ePHI affecting 2,743 individuals.  The breach resulted from malware that compromised ACMHS’s information technology resources.

OCR’s investigation found that ACMHS (1) had never performed an accurate and thorough risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by ACMHS; (2) had never implemented Security Rule policies and procedures; and (3) since 2008, had failed to implement technical security measures to guard against unauthorized access to ePHI transmitted electronically, by failing to ensure that appropriate firewalls were in place and regularly updated with available patches.

ACMHS agreed to pay $150,000 and to comply with the requirements set forth in the CAP to settle the allegations.  The CAP has a two-year term and obligates ACMHS to take the following actions:

  • Revise, adopt and distribute to its workforce updated Security Rule policies and procedures that have been approved by OCR

  • Develop and provide updated security awareness training (based on training materials approved by OCR) to applicable workforce members, and update and repeat the training annually

  • Conduct annual risk assessments of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by ACMHS, and document the security measures implemented to reduce the risks and vulnerabilities to a reasonable and appropriate level

  • Investigate and report to OCR any violations of its Security Rule policies and procedures by workforce members

  • Submit annual reports to OCR describing ACMHS’s compliance with the CAP

In announcing the settlement, OCR Director Jocelyn Samuels said, “[s]uccessful HIPAA compliance requires a common sense approach to assessing and addressing the risks to ePHI on a regular basis.  This includes reviewing systems for unpatched vulnerabilities and unsupported software that can leave patient information susceptible to malware and other risks.”  A copy of the Resolution Agreement and CAP can be found here.

The settlement is another reminder that covered entities and business associates should ensure that they have taken steps necessary and appropriate to safeguard the ePHI in their possession.  Conducting regular ePHI risk assessments, addressing any identified security vulnerabilities, implementing and updating comprehensive HIPAA policies and procedures, and appropriately training workforce members who have access to ePHI are all steps that covered entities and business associates must take to comply with HIPAA and protect ePHI.

HIPAA Considerations In The Event Of Employee Death or Incapacitation

McBrayer NEW logo 1-10-13

The Health Insurance Portability and Accountability Act of 1996, otherwise known as HIPAA, acts in part to provide federal protection for identifiable health information retained by covered entities, which includes most businesses that offer company health plans. While many employers have policies and procedures in place to ensure HIPAA compliance in routine, every day matters relating to the management of employee health data, few employers have developed policies or even considered how to manage protected health information in the unfortunate event of employee death or incapacitation.

Employee Benefits Folder

Importantly, HIPAA’s protection of identifiable health information does not expire in the event of incapacitation or even the death of an employee. In fact, HIPAA continues to protect identifiable health information for 50 years after death. Consequently, it is important for employers to know to whom protected health information may be disseminated during this time period in order to continue to ensure compliance and avoid the assessment of steep penalties and fines.

Covered health information for the deceased or incapacitated employee during this time may be released to their legal representative under state law. In most instances involving a diseased employee, this would be the appointed administrator of the deceased’s estate. It is permissible to release protected health information to non-representative family members, including but not limited to spouses, domestic partners, parents, children, or siblings, unless doing so is inconsistent with any prior expressed preference that is known to the covered entity. However, the information released to a non-representative family member must be limited to that information which is relevant to that person’s involvement in the decedent’s or incapacitated employee’s care or payment for care. The regulations leave the determination of this relevancy up to the entity’s “professional judgment.” 45 CFR 164.510(b)(5).

The Department of Health and Human Services gives the following example of what could be released: “For example, a covered health care provider could describe the circumstances that led to an individual’s death with the decedent’s sister who is asking about her sibling’s death. In addition, a covered health care provider or pharmacy could disclose billing information or records to a family member of a decedent who is assisting with closing a decedent’s estate. However, in both cases, a provider generally should not share information about past, unrelated medical problems.” (Click here to directed to The Department of Health and Human Services website.)

Consequently, unless protected information is requested by the legal representative of the deceased’s estate, or the information requested is directly related to the requestor’s involvement in the deceased’s care prior to death or payment for the deceased’s care prior to death, a signed HIPAA release by the legal representative is required prior to release of the protected information. Other exceptions allowing the release of protected health information covering special situations are also available, including the allowance of release to law enforcement to assist in a criminal investigation.

Medical History Questionnaire with Pen

It is important that employers understand their responsibilities to protect identifiable health information covered by HIPAA and develop policies to ensure compliance.

ARTICLE BY

OF