Fair Market Value Defensibility Analysis: Why is It Different from a Fair Market Value Opinion?

Fair market value is a pinnacle issue for compliance under the Stark Law and Anti-Kickback Statute. Compensation arrangements that are required to be representative of fair market value under Stark/AKS include employment, independent contractor, medical directorships, exclusive service arrangements, call coverage, quality reviews, medical staff officer stipends, etc.

Many consulting firms provide fair market value opinions relying extensively on the application of benchmark data. Based upon CMS’s statements in the Stark Law Final Rules, although application of benchmark data is a resource that can be utilized, fair market value can and should include the application of market/service area issues (i.e., deficiency of specialty) or physician-specific issues (i.e., expertise, productivity).

Commercial reasonableness is a separate concept from fair market value under Stark/AKS. Commercial reasonableness also entails whether the application of benchmark/market factors are defensible.

When analyzing the defensibility of compensation arrangements, it is important to view fair market value and commercial reasonableness as if advocating the facts and circumstances of the proposed compensation arrangement before a governmental entity (i.e., CMS, OIG, DOJ). When an attorney is rendering a fair market value defensibility analysis, not only will the analysis be protected under the attorney-client privilege, but the analysis will also include references and attachments to all of the applicable documentation and relevant information in case the compensation arrangement is ever required to be defended.

Copyright ©2022 Nelson Mullins Riley & Scarborough LLP

FDA Launches Study on the Role of Seafood Consumption in Child Development

  • On October 11, the FDA announced the launch of an independent study, “The Role of Seafood in Child Growth and Development,” by the National Academies of Science, Engineering, and Medicine (NASEM) on the state of scientific evidence in nutrition and toxicology associations between seafood consumption and child growth and development. The purpose of the study is to obtain the most up-to-date understanding of the science on fish consumption in a whole diet context, which will support the goals of the FDA’s Closer to Zero Action Plan for reducing the exposure of babies and young children to mercury, arsenic, lead, and cadmium from foods.

  • As part of the study, an ad hoc committee of the NASEM will:

    • Evaluate dietary intake and seafood composition data provided by the sponsors (i.e., Department of Commerce, HHS, EPA, and USDA’s Agricultural Research Service);

    • Conduct systematic reviews of the scientific literature covering the areas of seafood nutrition and toxicology associated with seafood consumption and child growth and development;

    • Review existing sources of evidence on maternal and child seafood consumption and child growth and development; and

    • Develop an approach to synthesize the scientific evidence, and utilize that strategy to develop its findings and conclusions (quantitative and/or qualitative) about associations between seafood consumption and child growth and development.

  • FDA intends for the study to help inform whether any updates are needed for the current Advice about Eating Fish for children and those who might become or are pregnant or breastfeeding, and also hopes to gain a better understanding of the science on mercury exposure from food.

  • The FDA is partnering with the National Oceanic and Atmospheric Administration, U.S. Department of Agriculture, and U.S. Environmental Protection Agency on the study, and NASEM will publish the committee’s report after the study is complete in approximately 18 months. The FDA intends to use the study findings to advance policies and programs that support healthy child growth and development.

For more Food and Drug Law News, click here to visit the National Law Review

© 2022 Keller and Heckman LLP

OCR Announces $300,000 Settlement Related to Improper Disposal of Physical PHI

On August 23, 2022, the U.S. Department of Health & Human Services, Office for Civil Rights (“HHS”) announced that it had settled a case involving the disposal of physical protected health information (“PHI”).

OCR alleged that, on March 31, 2021, a specimen containing PHI was found by a third-party security guard in the parking lot of the New England Dermatology and Laser Center (“NEDLC”). The PHI included patient name, patient date of birth, date of sample collection, and the name of the provider who took the specimen, in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

As part of the settlement, NEDLC agreed to pay HHS $300,640. According to NEDLC’s Resolution Agreement and the Corrective Action Plan, there were two potential violations by NEDLC. First, NEDLC allegedly failed to maintain appropriate safeguards to protect the privacy of PHI,” as required by 45 C.F.R. § 164.530(c). Second, NEDLC allegedly permitted the impermissible disclosure of PHI, in violation of Rule 45 C.F.R. § 164.502(a). The Corrective Action Plan requires NEDLC to develop, maintain and appropriately revise written policies and procedures in accordance with HIPAA.

Several highlights of the settlement include:

  1. Changes to Policies and Procedures. NEDLC must develop, maintain and revise, as necessary, its written HIPAA policies and procedures, and provide such policies and procedures to HHS for review and approval. NEDLC also must assess, update and revise, as necessary, such policies and procedures at least annually, or as needed, and seek HHS’s approval of the revised policies and procedures.
  2. Designation of Privacy Official. NEDLC must designate a privacy official who is responsible for the development and implementation of NEDLC’s HIPAA policies and procedures, and a contact person or office who is responsible for receiving relevant complaints.
  3. Training Requirements. NEDLC must provide HHS with training materials for its workforce members and seek HHS’s approval of such training materials. NEDLC must also distribute the HIPAA policies and procedures to its workforce members and relevant business associates, and obtain a written compliance certification from all such individuals. NEDLC must provide HIPAA training for new workforce members, and all workforce members at least every 12 months. Each workforce member must certify, in electronic or written form, that they received training. NEDLC must review the training at least annually, and update the training where appropriate. NEDLC must promptly investigate, review, report to HHS, and sanction any workforce member that does not comply with its HIPAA policies and procedures.
  4. Implementation Report and Annual Report.  NEDLC is required to submit to HHS a written report summarizing the status of its implementation of the requirements provided set forth in the settlement, and annual compliance reports.

For more Health Care legal news, click here to visit the National Law Review.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

Whistleblower Receives $11 Million for Reporting Pharmaceutical Fraud

September 16, 2022.  The United States Department of Justice settled a case against the pharmaceutical manufacturer Bayer Corporation.  Under the terms of the settlement, Bayer paid $40 million.  A former employee in the pharmaceutical company’s marketing department filed two qui tam lawsuits alleging violations of the False Claims Act.  For reporting fraud, the whistleblower received approximately $11 million, and they pursued both cases after the Department of Justice (DOJ) declined to intervene.

According to the allegations, the pharmaceutical company was paying kickbacks to healthcare providers to “induce them to utilize the drugs Trasylol and Avelox, and also marketed these drugs for off-label uses that were not reasonable and necessary.”  This lawsuit was filed in the District of New Jersey and alleged that the because of these kickbacks, the pharmaceutical company caused submission of false claims to Medicare and Medicaid.  The lawsuit that was transferred to the District of Minnesota entailed the pharmaceutical company knowingly misrepresenting the safety and efficacy of Baycol, a statin drug, and also renewing contracts with the Defense Logistics Agency based on these misrepresentations.  To settle these allegations, Bayer paid $38,860,555 to the United States and $1,139,445 to the Medicaid Participating States.  The Principal Deputy Assistant Attorney General remarked about this settlement, “Today’s recovery highlights the critical role that whistleblowers play in the effective use of the False Claims Act to combat fraud in federal healthcare programs.”

The False Claims Act incentivizes private citizens to report fraud against the government and holds accountable companies that financially benefit from participation in government contracts and government-sponsored programs.  The Department of Justice needs whistleblowers to the be the antidote to pharmaceutical fraud.

© 2022 by Tycko & Zavareei LLP

EMTALA in the Post-Dobbs World

The Emergency Medical Treatment and Labor Act (EMTALA) requires hospitals with emergency departments and participating in Centers for Medicare and Medicaid Services (CMS) programs to provide medical screening, treatment and transfer for patients with emergency medical conditions (EMCs) or women in labor.1 EMTALA, which was enacted in 1986 to address concerns about patient dumping, went unnoticed for many years, but has garnered heightened attention as a result of the COVID-19 pandemic, and more recently, the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization (Dobbs).2

EMTALA is a federal law and expressly preempts state laws with which it directly conflicts. After the Dobbs decision was officially published in June, a number of states implemented laws that prohibited or restricted access to reproductive care. Many of these laws include potential civil sanctions and criminal liability for healthcare providers offering or performing these services regardless of the circumstances, including emergency situations. The Biden Administration, in contrast, has taken action to preserve access to reproductive care through a number of executive and federal agency actions. These actions are intended by the federal government to apply in all states, including those states where restrictions have been put in place. Following this activity, litigation between the federal government and several states has ensued to address potential conflicts between federal laws requiring the provision of access and state laws that prohibit or restrict access to reproductive health services. A summary of the current EMTALA landscape is set forth below.

EMTALA Requirements

Under EMTALA, hospitals with emergency departments (EDs) must provide a medical screening examination to any individual who comes to the ED, regardless of insurance status. EMTALA prohibits hospitals with EDs from refusing to examine or treat individuals with an EMC. Upon provision of a medical screening examination, hospitals must provide necessary stabilizing treatment for EMCs and labor within the hospital’s capability. If the hospital is unable to properly treat or stabilize the patient, the hospital must provide an appropriate transfer to another medical facility.

Under EMTALA, an EMC includes “a medical condition manifesting itself by acute symptoms of sufficient severity (including severe pain) such that the absence of immediate medical attention could reasonably be expected to result in:

(i) placing the health of the individual (or, with respect to a pregnant woman, the health of the woman or her unborn child) in serious jeopardy,

(ii) serious impairment to bodily functions, or

(iii) serious dysfunction of any bodily organ or part…”3

Many common pregnancy-related complications, such as preeclampsia or ectopic pregnancies, qualify as EMCs. However, certain state anti-abortion laws prohibit or criminalize abortions regardless of the existence of an EMC under federal law, which creates a potential conflict when an abortion is necessary to stabilize an EMC under EMTALA. As a result of this friction between state and federal law, EMTALA has received renewed attention at a federal and state level in recent months.

Executive Order on Protecting Access to Reproductive Healthcare Services

On July 8, 2022, after the Dobbs decision was officially issued, President Biden issued Executive Order 14076 (Executive Order), which directed the Department of Health and Human Services (HHS) to submit a report identifying steps to ensure all patients, including pregnant women and women experiencing pregnancy loss, receive the full protections offered by EMTALA. The Executive Order also directed HHS to consider updates to guidance on obligations under EMTALA.

CMS Memorandum and HHS Letter to Healthcare Providers

On July 11, 2022, in response to the Executive Order, CMS published a memorandum to State Survey Agency Directors to restate existing guidance for hospital staff and physicians in light of new state laws that prohibit or restrict access to abortion (Memorandum). The Memorandum reinforced CMS’ view that:

  • EMTALA mandates that all patients who come to a EDs and request examination or treatment must receive an appropriate medical screening examination, stabilizing treatment, and transfer regardless of any state law restrictions about specific procedures,

  • Only physicians and qualified medical personnel may make the determination of an EMC,

  • Hospitals should ensure that all staff who interact with patients presenting to the ED are aware of the hospital’s obligations under EMTALA,

  • Hospitals may not cite state law or practice as the basis for transfer,

  • Physicians’ professional and legal duties under EMTALA preempt any conflicting state law or mandate,

  • If a physician believes that abortion is the stabilizing treatment necessary to resolve an EMC, the physician must provide that treatment, and

  • State law is preempted by EMTALA when it prohibits abortion and does not include an exception for the life and health of the pregnant person or has a more restrictive definition of EMC.

The Memorandum also clarified that pregnant patients may experience EMCs including, but not limited to, ectopic pregnancy, complications of pregnancy loss, or emergent hypertensive disorders, such as preeclampsia with severe features and that stabilizing treatment encompasses both medical and surgical interventions, such as methrotrexate therapy or dilation and curettage.

The Secretary of HHS also published on July 11, 2022 a letter to healthcare providers reminding them of their obligation to provide stabilizing medical treatment to their pregnant patients in accordance with EMTALA, regardless of the state in which the provider practices (Letter). The Letter also reiterated that:

  • any state laws or mandates which employ a more restrictive definition of EMC are preempted by EMTALA statute, and

  • the course of necessary stabilizing treatment is under the physician’s or other qualified medical personnel’s purview.

The State of Texas Sues the Biden Administration

On July 14, 2022, the Texas Attorney General brought suit against HHS and CMS to challenge the Memorandum and Letter relating to federal law obligations for pregnant patients.4 The complaint alleged that EMTALA does not preempt state law when state law prohibits abortion and does not include an exception for the life of the pregnant person or draws the exception more narrowly than the definition of EMC under EMTALA. Specifically, Texas sought to enforce a state statute, the Human Life Protection Act, which would ban and criminalize abortions unless a woman “has a life-threatening physical condition arising from pregnancy that places her ‘at risk of death or poses a serious risk of substantial impairment of a major bodily function unless the abortion is performed”(emphasis added).5 The complaint also alleged that EMTALA does not require a healthcare provider to perform an abortion if it is the stabilizing treatment necessary to resolve an EMC. On August 23, 2022, the United States District Court for the Northern District of Texas (Lubbock Division) blocked enforcement of the Memorandum and Letter in the State of Texas on the basis that federal guidance did not preempt state law, exceeded the authority of EMTALA, and was issued without a proper notice and comment period. The Court found that, because EMTALA is silent regarding abortion and “how stabilizing treatments must be provided when a doctor’s duties to a pregnant woman and her unborn child possibly conflict,” “there is no direct conflict” between federal and Texas law with the end result that “EMTALA leaves it to the states”.6

The Biden Administration Sues the State of Idaho

On August 2, 2022, the Department of Justice (DOJ) sued the State of Idaho, alleging violation of EMTALA. Under Idaho’s proposed abortion law, which was slated to go into effect on August 25th, the performance of all abortions are criminalized regardless of the reason for which they may be performed including to prevent the death of the pregnant woman.7 Instead, the law permits physicians to raise two affirmative defenses to avoid criminal liability:

(i) The physician determined, in h/her good faith medical judgment and based on the facts known to the physician at the time, that the abortion was necessary to prevent the death of the pregnant woman, and

(ii) Prior to the performance of the abortion, the pregnant woman reported the act of rape or incest to a law enforcement agency and provided a copy of such report to the physician.8

The DOJ’s complaint alleged that  Idaho’s law does not provide a defense when the health of the pregnant patient is at stake, which is considered to fall within the definition of an EMC under EMTALA. In addition, the DOJ asserted that the fear of criminal prosecution may lead providers to avoid performing abortions even when it is a medically necessary treatment to prevent severe risk to the patient’s health. On August 24, 2022, the United States District Court for the District of Idaho found that Idaho’s law conflicted with EMTALA and granted the federal government a preliminary injunction blocking the enforcement of Idaho’s proposed abortion law.9 In contrast to the Northern District of Texas Court’s interpretation of the conflict between state law and EMTALA, the District Court of Idaho noted that found that Idaho’s criminal abortion statute deterred abortions given that it provided for an affirmative defense rather than an exception for the provision of emergency care and, therefore, obstructed EMTALA’s purpose.10

Looking to the Future

While EMTALA has been in place for decades, its applications in the post-Dobbs world continue to evolve and will be at the forefront in states with abortion restrictions, particularly where the scope of federal law obligations to provide stabilizing treatment for conditions that threaten the health of the pregnant patient conflict with state law exceptions or affirmative defenses.

The law, policy and regulatory climate surrounding the Dobbs decision is complex and quickly developing. The information included in this article is current as of writing, but it does not address all potential legal issues or jurisdictional differences, and the information presented may no longer be current. Readers should consult counsel regarding their specific situation.


FOOTNOTES

1 42 U.S.C. §1395dd.

For additional information regarding the Dobbs decision, please refer to the following resources: Supreme Court Decision in Dobbs v. Jackson Women’s Health Organization Overturns 50 Years of Precedent on Abortion Laws and Rights | Healthcare Law Blog (sheppardhealthlaw.com)WHLC Dobbs Series Part 1 Where are we now?: Sheppard Mullin Webinar.

42 U.S.C. §1395dd(e)(1).

4 State of Tex. v. Becerra, et al., No. 5:22-cv-185 (N.D. Tex. Jul. 14, 2022).

Tex. Health & Safety Code § 170A.

State of Tex. v. Becerra, et al., No. 5:22-cv-185 (N.D. Tex. Jul. 14, 2022), Memorandum Opinion and Order at 49.

7 Idaho Code § 18-622.

8  Idaho Code § 18-622(3).

9 U.S. v. Idaho, No. 1:22-cv-00329-BLW.

10 U.S. v. Idaho, No. 1:22-cv-00329-BLW, Memorandum Decision and Order at 26-31.

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.

It’s Time To Review Your Online Patient-User Interface: DOJ Issues New Federal Guidance on Telemedicine and Civil Rights Protections

As online digital health services continue to enjoy broader use and appeal, federal regulators are concerned some telemedicine online patient-user interfaces fail to accommodate persons with disabilities and limited English proficiency. Such failures in “product design” can violate federal civil rights laws and the Americans with Disabilities Act (ADA), according to new policy guidance jointly issued by the U.S. Department of Health and Human Services (HHS) and Department of Justice (DOJ).

The document, Nondiscrimination in Telehealth, is specifically directed to companies offering telemedicine services and instructs such covered entities to immediately take specific steps to comply with the various “accessibility duties” under federal civil rights laws. The guidance focuses on ensuring accessibility for two populations of users: 1) people with disabilities and 2) people with Limited English Proficiency (LEP).

Who is Subject to these Rules?

The guidance refers to “covered entities” subject to these rules. Under the rules, “covered entities” are any health programs and activities receiving federal financial assistance (in addition to programs and activities administered by either a federal executive agency or an entity created by Title I of the Affordable Care Act). While the guidance does not define what constitutes “receiving federal financial assistance”, HHS has historically held that providers who receive federal dollars solely under traditional Medicare Part B were not covered entities. However, a recently-proposed rule suggests HHS will significantly expand the scope of covered entities, and soon. Telemedicine providers should be prepared to comply with these federal laws.

People with Disabilities

The guidance explains that no person with a disability shall – because of the disability – be excluded from participation in or be denied the benefits of the services, programs, or activities of a covered entity, or otherwise be subjected to discrimination by a covered entity. The requirements in the guidance is supported by several federal laws, including the Americans With Disabilities Act, the Affordable Care Act Section 1557, and the Rehabilitation Act Section 504.

Applying these federal civil rights protections to telemedicine services, the guidance states companies must make reasonable changes to their policies, practices, or procedures in order to provide “additional support to patients when needed before, during, and after a virtual visit.”

DOJ and HHS provided the following as examples of such “additional support” obligations:

  • A dermatology practice that typically limits telehealth appointments to 30 minutes may need to schedule a longer appointment for a patient who needs additional time to communicate because of their disability.

  • A doctor’s office that does not allow anyone but the patient to attend telehealth appointments would have to make reasonable changes to that policy to allow a person with a disability to bring a support person and/or family member to the appointment where needed to meaningfully access the health care appointment.

  • A mental health provider who uses telehealth to provide remote counseling to individuals may need to ensure that the telehealth platform it uses can support effective real-time captioning for a patient who is hard of hearing. The provider may not require patients to bring their own real-time captioner.

  • A sports medicine practice that uses videos to show patients how to do physical therapy exercises may need to make sure that the videos have audio descriptions for patients with visual disabilities.

People with LEP

The second area of the guidance is protections for LEP individuals under Title VI of the Civil Rights Act of 1964 (Title VI). Under Title VI, no person shall be discriminated against or excluded from participation in or be denied the benefits of services, programs, or activities receiving federal financial assistance on the basis of race, color, or national origin.

For telemedicine services, the guidance states that the prohibition against national origin discrimination extends to LEP persons. Namely, telemedicine companies must take reasonable steps to ensure meaningful access for LEP persons. Such “meaningful access” includes providing information about the availability of telehealth services, the process for scheduling telehealth appointments, and the appointment itself. In many instances, HHS states, language assistance services are necessary to provide meaningful access and comply with federal law.

These language assistance services can include such measures as oral language assistance performed by a qualified interpreter; in-language communication with a bilingual employee; or written translation of documents performed by a qualified translator

DOJ and HHS provided the following as examples of such “meaningful access” obligations:

  • In emails to patients or social media postings about the opportunity to schedule telehealth appointments, a federally assisted health care provider includes a short non-English statement that explains to LEP persons how to obtain, in a language they understand, the information contained in the email or social media posting.

  • An OBGYN who receives federal financial assistance and legally provides reproductive health services, using telehealth to provide remote appointments to patients, provides a qualified language interpreter for an LEP patient. The provider makes sure that their telehealth platform allows the interpreter to join the session. Due to issues of confidentiality and potential conflicts of interest (such as in matters involving domestic violence) providers should avoid relying on patients to bring their own interpreter.

What if Making These Changes is Expensive?

While not directly addressed in the guidance, the cost for implementing accessibility measures generally falls on the company itself. Federal ADA regulations prohibit charging patients extra for the cost of providing American Sign Language (ASL) interpreters or similar accommodations. In fact, a covered entity may be required to provide an ASL interpreter even if the cost of the interpreter is greater than the fee received for the telemedicine service itself. With respect to LEP interpreters, HHS issued separate guidance stating it is not sufficient to use “low-quality video remote interpreting services” or “rely on unqualified staff” as translators.

However, companies are not required to offer an aid or service that results in either an undue burden on the company or requires a fundamental alteration in the nature of the services offered by the company. This is an important counterbalance in the law. Yet, the threshold for what constitutes an “undue burden” on a company or a “fundamental alteration” to the nature of the services is not bright line and requires a fact-specific assessment under the legal requirements.

Conclusion

Telemedicine companies subject to the guidance should heed the government’s warning and look inward on patient-facing elements. The first step is to simply have the website and app platform reviewed (most particularly the patient online user interface) by a qualified third party to determine if its design and features are sufficiently accessible for people with disabilities, as well as LEP persons. That time is also a prudent opportunity to review the user interface to confirm it complies with state telemedicine practice standards, e-commerce rules, electronic signatures or click-sign laws, and privacy/security requirements. Because these laws have undergone rapid and extensive changes during the Public Health Emergency, it is recommended to conduct these assessments on a periodic/annual basis.

If a company believes the expense of making these product design changes to ensure accessibility would be prohibitively expensive, it should check with experienced advisors to determine if the changes would constitute an “undue burden” or “fundamental alteration.” Otherwise, federal guidance is clear that refusing to make reasonable changes can be a violation of federal civil rights laws.

© 2022 Foley & Lardner LLP

Medical Staff Leaders: 10 Things Your Lawyers Want You to Know

Whether you are new to medical staff leadership or have served in the past and have been called to serve again, there are times when you will need to consult a lawyer who specializes in medical staff matters. While there is nothing simple about medical staff affairs, there are some basic guidelines and protections that your lawyers would like you to know that will make your term easier and make you more effective.

Understand that hospitals and medical staffs are highly regulated organizations with a myriad of laws and standards that must be followed. As a medical staff leader, advisor or medical staff professional, you are leading and advising the professionals responsible for practitioner competence and conduct within the organization. Medical staff law has evolved from the lawyer in the office who would return your call in a week, or fax you a letter, to a specialty area where your lawyer is your partner and there to assist in all aspects of medical staff affairs.

We hope you will benefit from and find the following 10 recommendations make your term or role more informed and manageable.

10. Keep Your Governance Documents Up to Date and Reflective of Actual Practice.

We don’t suggest you must read every page of your governance documents, but you should be sure you know where to look and how to use them. Governance documents include the medical staff bylaws, credentialing manual, hearing plan, rules and regulations, policies and other documents approved by the medical staff and designed to set and guide medical staff processes. Too often we have found the documents will conflict or are missing critical passages. Your medical staff bylaws or medical staff governance committee can be one of the strongest committees in the organization. This is the committee that will annually review the documents and make sure they are internally consistent, reflect actual practice and are relevant to your organization’s practice and clinical services. Remember the medical staff bylaws set the overall guiding principles for the medical staff organization. All other governance documents flow from the foundation of the medical staff bylaws and must be consistent with their principles and mission. Undoubtedly, there will be some inconsistencies but look at those inconsistencies as opportunities to reexamine the principles and consider what is best for your organization. All governance documents should be reviewed in the context of the laws and regulations that require these documents. State and federal laws and regulations set out the basic requirements for the contents of the documents, as do many of the accreditation standards. It is far better to review and revise your governance documents regularly, rather than learn they are deficient during an unannounced survey or regulatory proceeding.

9. Use Your Committees Effectively.

There are two types of committees: those with authority to act and those that are advisory. The committees with authority are generally the Medical Executive Committee (“MEC”) and clinical department committees. All other committees are advisory to the MEC. Advisory committees can develop and recommend policies, rules and clinical practices. Authoritative committees approve policies and rules, take disciplinary action and make recommendations to the MEC. The MEC is the final medical staff authority that submits recommendations for final approval to the governing body. Knowing which committees to use and when is key to leadership success.

8. Know the Scope of Your Authority.

As a leader, you are an agent of the medical staff and the spokesperson for the committee/ department you chair. There are times when you will need to act without the benefit of input from your committee/department. Medical staff bylaws will generally identify the circumstances under which you can act alone and when your action(s) will need to be ratified by the committee. As the chair, you are acting on behalf of the committee/ department between meetings. Do what is needed when needed, within the scope of your authority, but report your actions to the committee/department on a regular basis and be sure your actions are properly recorded in the appropriate minutes. If summary or urgent action is needed, do not hesitate to call a special meeting. You are better off to have the protection of a committee action than to be acting alone or without ratification.

7. Know the Peer Review Protections of HCQIA, Your State and Organization.

Many, if not most, of your actions and the actions of your committees will be covered by federal, state and organizational protections. The Healthcare Quality Improvement Act (“HCQIA”) provides protection from liability for members of a professional review body/ medical staff, who take a professional review action (a) in the reasonable belief the action was in furtherance of quality health care, (b) after a reasonable effort to obtain the facts, (c) after adequate notice and hearing and (d) in the reasonable belief that the action was warranted by the facts. In addition to this federal protection, many states have laws that similarly protect peer review participants, and often, your organization will have an indemnification policy or provision that further protects you and your committee members from damages. Remind your committee participants and members on a regular basis of these protections and that they were specifically designed to encourage peer review by allowing free discussions aimed at improving patient care.

6. Know Your Reporting Obligations.

The National Practitioner Data Bank (“NPDB”) defines the circumstances under which a physician or dentist must be reported. Those include (a) when a professional review action adversely affects their clinical privileges for 30 days or longer or (b) when a physician surrenders clinical privileges while under investigation or in exchange for not conducting an investigation. The failure to report when required to do so can result in the loss of immunities under HCQIA for up to three years, along with a monetary fine. There are many nuances to reporting to the NPDB and we recommend you consult a medical staff attorney who can assist with identifying when to report and what to say. Additionally, each state may have reporting requirements for professional review actions to the state licensing board that exceed the NPDB’s requirements. The state licensing board may also have defined penalties for failure to report. In one state, the knowing failure of a physician leader to report a practitioner to the state licensing board can be considered unprofessional conduct, which can subject the physician leader to state board action.

5. Understand Confidentiality and Peer Review Privilege Protections.

A best practice at the beginning of each meeting is to remind committee members of the importance of maintaining confidentiality. State peer review privileges and protections are often dependent on maintaining confidentiality of the records and proceedings. The failure to maintain confidentiality can act as a waiver of the privilege and permit the introduction of confidential peer review documents and testimony in litigation in the future. Peer review privileges and protections are designed to promote candor in the peer review process. This permits free discussion and identification of opportunities to improve patient care. Without confidentiality and the corresponding privileges and protections, committee members would be reluctant to analyze and frankly discuss areas for improvement in a peer’s clinical care. Obtain information about your state’s peer review privilege and protections and fully understand the circumstances that may cause a waiver, which would permit confidential peer review information to be discussed in open court and stifle important, free-flowing discussion of quality of care at peer review meetings.

4. Know Your Options.

Every professional competence or conduct situation you face will be different. A sound guideline to generally follow is selecting the least restrictive action that will protect patients. Keep in mind that the goal of all peer review is education and remediation. For example, if a practitioner is having complications with robotic surgery, evaluate whether the complications are the result of technical skill, which can be remediated with more practice, or if the complications are the result of poor clinical judgment, which reaches into all areas of performance. In the first case, proctoring, monitoring or an additional educational course may correct the problem. But with the second, the cause of poor judgment is more challenging and may require a further workup, including a fitness for duty evaluation, retrospective review of cases, or an external expert review. Work with your committee and medical staff lawyer to identify all the facts and options to address the problem that has been brought to your attention. In some cases, it may be appropriate to have the issue addressed by the individual’s department or interdisciplinary peer review committee, but in others, the nature of the problem may require the immediate attention of the MEC. In some cases, a discrete referral to your organization’s well-being committee may be appropriate. Regardless, each matter must be carefully and thoughtfully analyzed in light of all the available facts. Then, with all appropriate actions on the table, an informed determination may be made.

3. Act When Indicated but Don’t Shortcut the Process.

. The law and your medical staff bylaws provide for the ability to take emergency action against a practitioner’s privileges when there is a concern of imminent threat to patients or others. What constitutes an “imminent” threat or danger is often the source of hours of discussion and analysis by medical staff lawyers throughout the country. Your legal team is invaluable in working through the facts of a given matter and determining whether a decision for summary suspension is legally sound. If there is a circumstance where emergency intervention via summary suspension is necessary to avoid patient harm after an initial evaluation of the matter, do not hesitate! Take the action to summarily suspend and remove an errant practitioner from the bedside. Afterward, there is time to re-examine the basis for the action and analyze whether continued suspension is necessary to protect patients or others. At that time, it is important to call on your MEC and legal team for their analysis and determination of whether the summary suspension should be upheld.

There are also times when summary suspension will be considered prospectively to address a chronic problem that is rising to an acute stage. The practitioner whose disruptive, bullying and retaliatory conduct has been tolerated may have reached a level where the cumulative effect creates the potential for patient harm because staff, for example, are afraid to call the physician at night about a patient’s health condition, seek clarification of an order, or question whether a procedure is being done on the right side or on the correct patient. Following the medical staff bylaws investigation process will allow for a careful analysis of the reported conduct, which will provide a solid framework for later defense, should it be necessary. That process will almost always involve a committee evaluation of the facts, interview of the practitioner, and a determination of the appropriate next steps. Each of these steps, if followed, will support the action when later scrutinized by a court or jury.

2. Do What is Right for the Patients.

Always put the patients first. There may be procedural missteps during a disciplinary process as the healthcare organization balances the need to protect patients with providing a practitioner due process. However, if the peer review being conducted is based in the foundation of improving patient care and patient safety, courts will generally consider the health care organization’s goals before making a determination that would go against the organization and potentially place patients in harm’s way.

1. Utilize Internal or External Counsel to Navigate Medical Staff Law so You Can Focus on Improving Patient Care.

I (Erin) was asked recently what possible motivation there would be for a physician to enter leadership in a medical staff organization if their role consisted solely of consulting with a medical staff lawyer. In response, I reminded this physician that medical staff leadership and medical staff lawyers work together on challenging matters and daily operations with the lawyer recommending limitations and guardrails and advising on how to avoid legal missteps and pitfalls. This advice from the lawyer enables the leader to focus on monitoring the business of the organization and improving patient care.

Final Take-Aways

Our medical staff organizations need people who are willing to serve as leaders during challenging times when caregivers are stretched thin, suffering burnout and subjected to daily difficulties that can be demoralizing. Strong leaders who are reassured of their legal protections can perform their leadership responsibilities without fear of reprisal when following the advice of their legal counsel. We encourage you to reach out and make your lawyer an integral part of your team so that they can understand your organization and business and provide you the best available advice that will reassure you and other leaders in the organization of the legal protections and immunities.

© Polsinelli PC, Polsinelli LLP in California

Do I Have to Sign Over All My Assets when I Enter a Long-Term Care Facility?

I get asked some version of this question fairly frequently. I generally reassure clients that most facilities simply require you to pay month-to-month, and you can leave at any time. Now I may have to change my response, as news broke this week that a New Jersey woman allegedly had all her assets stolen by the very entity she trusted to care for her.

The woman entered a facility for a short-term rehab stay with every intention of returning home. Apparently the facility thought otherwise, as they enlisted a financial company to “assist” the woman in liquidating her assets to pay for her facility care and spend down to apply for Medicaid. I and other elder lawyers, along with several consumer protection agencies in the state, have long warned consumers about nonlawyer Medicaid advisors. These entities work closely with the nursing home industry, often having the same ownership and leadership. In this case, the POA is both an officer with the facility and the principal of the Medicaid advisor company that was hired to make the resident Medicaid eligible without her knowledge.

Some facilities require or coerce residents to hire these Medicaid advisors to prepare Medicaid applications for them. Unfortunately, they are not lawyers, and their allegiance is clearly to the facilities and not the residents or their families. Therefore, they fail to advise residents of opportunities to protect assets or income. Even worse, in many cases they failed to complete or submit the application or did so in a negligent manner, resulting in the application being denied. But unlike when an attorney messes up, there is no recourse for families, as these entities do not carry malpractice insurance. Sometimes the Medicaid advisor will simply close up shop and disappear – only to resurface later with a different organization.

There have been prior reports of facilities and the Medicaid advisors they work with requiring residents to sign POAs and even accessing resident accounts through questionable means. These latest allegations, however, bring this situation to a new level. It is alleged that the resident was forced to sign a POA when she did not have the capacity to do so due to medications she was prescribed. It was further alleged that Future Care Consultants liquidated the resident’s assets without her knowledge, and the funds were not returned when she left the facility. The family also alleges they were prevented from visiting or communicating with the resident.

The allegations are reminiscent of the movie I Care a Lot, which I have previously criticized as being completely unrealistic. However, in recent months, I have had clients report they were threatened by facilities if they used the services of an attorney. It is essential that consumers know their rights. You cannot be required to sign a POA. You cannot be forced to hire anyone to file your Medicaid application. And you cannot be prevented from using an attorney if you wish to do so.

©2022 Norris McLaughlin P.A., All Rights Reserved

Biden Administration Seeks to Clarify Patient Privacy Protections Post-Dobbs, Though Questions Remain

On July 8, two weeks following the Supreme Court’s ruling in Dobbs v. Jackson that invalidated the constitutional right to abortion, President Biden signed Executive Order 14076 (E.O.). The E.O. directed federal agencies to take various actions to protect access to reproductive health care services,[1] including directing the Secretary of the U.S. Department of Health and Human Services (HHS) to “consider actions” to strengthen the protection of sensitive healthcare information, including data on reproductive healthcare services like abortion, by issuing new guidance under the Health Insurance and Accountability Act of 1996 (HIPAA).[2]

The directive bolstered efforts already underway by the Biden Administration. A week before the E.O. was signed, HHS Secretary Xavier Becerra directed the HHS Office for Civil Rights (OCR) to take steps to ensure privacy protections for patients who receive, and providers who furnish, reproductive health care services, including abortions.[3] The following day, OCR issued two guidance documents to carry out this order, which are described below.

Although the guidance issued by OCR clarifies the privacy protections as they exist under current law post-Dobbs, it does not offer patients or providers new or strengthened privacy rights. Indeed, the guidance illustrates the limitations of HIPAA regarding protection of health information of individuals related to abortion services.

A.  HHS Actions to Safeguard PHI Post-Dobbs

Following Secretary Becerra’s press announcement, OCR issued two new guidance documents outlining (1) when the HIPAA Privacy Rule may prevent the unconsented disclosure of reproductive health-related information; and (2) best practices for consumers to protect sensitive health information collected by personal cell phones, tablets, and apps.

(1) HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care

In the “Guidance to Protect Patient Privacy in Wake of Supreme Court Decision on Roe,”[4] OCR addresses three existing exceptions in the HIPAA Privacy Rule to the disclosure of PHI without an individual’s authorization and provides examples of how those exceptions may be applied post-Dobbs.

The three exceptions discussed in the OCR guidance are the exceptions for disclosures required by law,[5]  for purposes of law enforcement,[6] or to avert a serious threat to health or safety.[7]

While the OCR guidance reiterates that the Privacy Rule permits, “but does not require” disclosure of PHI in each of these exceptions,[8] this offers limited protection that relies on the choice of providers whether to disclose or not disclose the information. Although these exceptions are highlighted as “protections,” they expressly permit the disclosure of protected health information. Further, while true that the HIPAA Privacy Rule itself may not compel disclosure (but merely permits disclosure), the guidance fails to mention that in many situations in which these exceptions apply, the provider will have other legal authority (such as state law) mandating the disclosure and thus, a refusal to disclose the PHI may be unlawful based on a law other than HIPAA.

Two of the exceptions discussed in the guidance – the required by law exception and the law enforcement exception – both only apply in the first place when valid legal authority is requiring disclosure. In these situations, the fact that HIPAA does not compel disclosure is of no relevance. Certainly, when there is not valid legal authority requiring disclosure of PHI, then HIPAA prohibits disclosure, as noted as in the OCR guidance.  However, in states with restrictive abortion laws, the state legal authorities are likely to be designed to require disclosure – which HIPAA does not prevent.

For instance, if a health care provider receives a valid subpoena from a Texas court that is ordering the disclosure of PHI as part of a case against an individual suspected of aiding and abetting an abortion, in violation of Texas’ S.B. 8, then that provider could be held in contempt of court for failing to comply with the subpoena, despite the fact that HIPAA does not compel disclosure.[9] For more examples on when a covered entity may be required to disclose PHI, please see EBG’s prior blog: The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe.[10]

Notably, the OCR guidance does provide a new interpretation of the application of the exception for disclosures to avert a serious threat to health or safety. Under this exception, covered entities may disclose PHI, consistent with applicable law and standards of ethical conduct, if the covered entity, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. OCR states that it would be inconsistent with professional standards of ethical conduct to make such a disclosure of PHI to law enforcement or others regarding an individual’s interest, intent, or prior experience with reproductive health care. Thus, in the guidance, OCR takes the position that if a patient in a state where abortion is prohibited informs a health care provider of the patient’s intent to seek an abortion that would be legal in another state, this would not fall into the exception for disclosures to avert a serious threat to health or safety.  Covered entities should be aware of OCR’s position and understand that presumably OCR would view any such disclosure as a HIPAA violation.

(2) Protecting the Privacy and Security of Individuals’ Health Information When Using Personal Cell Phones or Tablets

OCR also issued guidance on how individuals can best protect their PHI on their own personal devices. HIPAA does not generally protect the privacy or security of health information when it is accessed through or stored on personal cell phones or tablets. Rather, HIPAA only applies when PHI is created, received, maintained, or transmitted by covered entities and business associates. As a result, it is not unlawful under HIPAA for information collected by devices or apps – including data pertaining to reproductive healthcare – to be disclosed without consumer’s knowledge.[11]

In an effort to clarify HIPAA’s limitation to protect such information, OCR issued guidance to protect consumer sensitive information stored in personal devices and apps.[12] This includes step-by-step guidance on how to control data collection on their location, and how to securely dispose old devices.[13]

Further, some states have taken steps to fill the legal gaps to varying degrees of success. For example, California’s Confidentiality of Medical Information Act (“CMIA”) extends to “any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information.”[14] As applied, a direct-to-consumer period tracker app provided by a technology company, for example, would fall under the CMIA’s data privacy protections, but not under HIPAA. Regardless, gaps remain as the CMIA does not protect against a Texas prosecutor subpoenaing information from the direct-to-consumer app. Conversely, Connecticut’s new reproductive health privacy law,[15] does prevent a Connecticut covered entity from disclosing reproductive health information based on a subpoena, but Connecticut’s law does not apply to non-covered entities, such as a period tracker app. Therefore, even the U.S.’s most protective state privacy laws do not fill in all of the privacy gaps.

Alongside OCR’s guidance, the Federal Trade Commission (FTC) published a blog post warning companies with access to confidential consumer information to consider FTC’s enforcement powers under Section 5 of the FTC Act, as well as the Safeguards Rule, the Health Breach Notification Rule, and the Children’s Online Privacy Protection Rule.[16] Consistent with OCR’s guidance, the FTC’s blog post reiterates the Biden Administration’s goal of protecting reproductive health data post-Dobbs, but does not go so far as to create new privacy protections relative to current law.

B.  Despite the Biden Administration’s Guidance, Questions Remain Regarding the Future of Reproductive Health Privacy Protections Post-Dobbs

Through E.O. 14076, Secretary Becerra’s press conference, OCR’s guidance, and the FTC’s blog, the Biden Administration is signaling that it intends to use the full force of its authorities – including those vested by HIPAA – to protect patient privacy in the wake of Roe.

However, it remains unclear how this messaging will translate to affirmative executive actions, and how successful such executive actions would be. How far is the executive branch willing to push reproductive rights? Would more aggressive executive actions be upheld by a Supreme Court that just struck down decades of precedent permitting access to abortion? Will the Biden Administration’s executive actions persist if the administration changes in the next Presidential election?

Attorneys at Epstein Becker & Green are well-positioned to assist covered entities, business associates, and other companies holding sensitive reproductive health data understand how to navigate HIPAA’s exemptions and interactions with emerging guidance, regulations, and statutes at both the state and Federal levels.

Ada Peters, a 2022 Summer Associate (not admitted to the practice of law) in the firm’s Washington, DC office and Jack Ferdman, a 2022 Summer Associate (not admitted to the practice of law) in the firm’s Boston office, contributed to the preparation of this post. 



[1] 87 Fed. Reg. 42053 (Jul. 8, 2022), https://bit.ly/3b4N4rp.

[2] Id.

[3] HHS, Remarks by Secretary Xavier Becerra at the Press Conference in Response to President Biden’s Directive following Overturning of Roe v. Wade (June 28, 2022), https://bit.ly/3zzGYsf.

[4] HHS, Guidance to Protect Patient Privacy in Wake of Supreme Court Decision on Roe (June 29, 2022),  https://bit.ly/3PE2rWK.

[5] 45 CFR 164.512(a)(1)

[6] 45 CFR 164.512(f)(1)

[7] 45 CFR 164.512(j)

[8] Id.

[9] See Texas S.B. 8; e.g., Fed. R. Civ. Pro. R.37 (outlining available sanctions associated with the failure to make disclosures or to cooperate in discovery in Federal courts), https://bit.ly/3BjX4I2.

[10] EBG Health Law Advisor, The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe (June 17, 2022), https://bit.ly/3oPDegl.

[11] A 2019 Kaiser Family Foundation survey concluded that almost one third of female respondents used a smartphone app to monitor their menstrual cycles and other reproductive health data. Kaiser Family Foundation, Health Apps and Information Survey (Sept. 2019), https://bit.ly/3PC9Gyt.

[12] HHS, Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone1 or Tablet (last visited Jul. 26, 2022), https://bit.ly/3S2MNWs.

[13] Id.

[14] Cal. Civ. Code § 56.10, Effective Jan. 1, 2022, https://bit.ly/3J5iDxM.

[15] 2022 Conn. Legis. Serv. P.A. 22-19 § 2 (S.B. 5414), Effective July 1, 2022, https://bit.ly/3zwn95c.

[16] FTC, Location, Health, and Other Sensitive Information: FTC Committed To Fully Enforcing the Law Against Illegal Use and Sharing of Highly Sensitive Data (July 11, 2022), https://bit.ly/3BjrzNV.

©2022 Epstein Becker & Green, P.C. All rights reserved.

Medicare CERT Audits and How to Prepare for Them

CERT audits are an unfortunate part of doing business for healthcare providers who accept Medicare. Failing the audit can mean the provider has to pay back overcharges and be subjected to increased scrutiny in the future. 

The best way to be prepared for a CERT audit is to have a compliance strategy in place and to follow it to the letter. Retaining a healthcare lawyer to craft that strategy is essential if you want to make sure that it is all-encompassing and effective. It can also help to hire independent counsel to conduct an internal review to ensure the compliance plan is doing its job.

When providers are notified of a CERT audit, hiring a Medicare lawyer is usually a good idea. Providers can fail the audit automatically if they do not comply with the document demands.

What is a CERT Audit?

The Comprehensive Error Rate Testing (CERT) program is an audit process developed by the Centers for Medicare and Medicaid Services (CMS). It is administered by private companies, called CERT Contractors, which work with the CMS. Current information about those companies is on the CMS website.

The CERT audit compares a sampling of bills for Medicare fee-for-service (FFS) payments, which were sent by the healthcare provider to its Medicare Administrative Contractor (MAC), against medical records for the patient. The audit looks at whether there is sufficient documentation to back up the claim against Medicare, whether the procedure was medically necessary, whether it was correctly coded, and whether the care was eligible for reimbursement through the Medicare program.

Every year, the CERT program audits enough of these FFS payments – generally around 50,000 per year – to create a statistically significant snapshot of inaccuracies in the Medicare program.

The results from those audits are reported to CMS. After appropriately weighing the results, CMS publishes the estimated improper payments or payment errors from the entire Medicare program in its annual report. In 2021, the CMS estimated that, based on data from the CERT audits, 6.26 percent of Medicare funding was incorrectly paid out, totaling $25.03 billion.

The vast majority of those incorrect payments, 64.1 percent, were marked as incorrect because they had insufficient documentation to support the Medicare claim. Another 13.6 percent were flagged as medically unnecessary. 10.6 percent was labeled as incorrectly paid out due to improper coding. 4.8 percent had no supporting documentation, at all. 6.9 percent was flagged as incorrectly paid for some other reason.

The CERT Audit Process

Healthcare providers who accept Medicare will receive a notice from a CERT Contractor. The notice informs the provider that it is being CERT audited and requests medical records from a random sampling of Medicare claims made by the provider to its MAC.

It is important to note that, at this point, there is no suspicion of wrongdoing. CERT audits examine Medicare claims at random.

Healthcare providers have 75 days to provide these medical records. Failing to provide the requested records is treated as an audit failure. In 2021, nearly 5 percent of failed CERT audits happened because no documentation was provided to support a Medicare claim.

Once the CERT Contractor has the documents, its team of reviewers – which consists of doctors, nurses, and certified medical coders – compares the Medicare claim against the patient’s medical records and looks for errors. According to the CMS, there are five major error categories:

  • No documentation

  • Insufficient documentation

  • Medical necessity

  • Incorrect coding

  • Other

Errors found during the CERT audit are reported to the healthcare provider’s MAC. The MAC can then make adjustments to the payments it sent to the provider.

Potential Repercussions from Errors Found in a CERT Audit

CERT audits that uncover errors in a healthcare provider’s Medicare billings lead to recoupments of overpayments, future scrutiny, and potentially even an investigation for Medicare fraud.

When the CERT audit results are brought to the MAC’s attention, the MAC will adjust the payments that it made to the provider. If the claims led to an overpayment, the MAC will demand that money back.

But Medicare Administrative Contractors (MACs) can go further than just demanding restitution for overpayments. They can also require prepayment reviews of all of the provider’s future Medicare claims, and can even suspend the provider from the program, entirely.

Worse still, CERT audits that uncover indications of Medicare fraud may be reported to a law enforcement agency for further review. This can lead to a criminal investigation and potentially even criminal charges.

Appealing a CERT Audit’s Results

With penalties so significant, healthcare providers should seriously consider hiring a lawyer to appeal the results of a CERT audit.

Appeals are first made to the MAC, requesting a redetermination of the audit results. The request for redetermination has to be made within 120 days of receiving notice of the audit results. However, if the provider wants to stop the MAC from recouping an overpayment in the meantime, it has to lodge the request within 30 days.

Providers can appeal the results of the redetermination, as well. They can request a reconsideration by a Qualified Independent Contractor within 180 of the redetermination, or within 60 days to stop the MAC’s recoupment process.

Providers who are still dissatisfied can appeal the case to an administrative law judge, then to the Medicare Appeals Council, and finally to a federal district court for review.

How to Handle a CERT Audit

The best way to handle and to prepare for a CERT audit is to hire Medicare audit attorneys to guide you through the process. It would also help to start internal audits within the company.

For providers who have been notified that they are under an audit, getting a lawyer on board immediately is essential. An experienced healthcare attorney can conduct a thorough internal investigation of the claims being audited. This can uncover potential problems before the audit points them out, giving the healthcare provider the time it needs to prepare its next steps.

Providers who are not currently being audited can still benefit from an attorney’s guidance. Whether by drafting a compliance plan that will prepare the provider for an inevitable CERT audit or by conducting an internal investigation to see how well a current compliance plan is performing, a lawyer can make sure that the provider is ready for an audit at a moment’s notice.

Taking these preventative steps soon is important. CMS put the CERT audit program on halt for the coronavirus pandemic, but that temporary hold was rescinded on August 11, 2020. While the CMS has reduced the sample sizes that will be used for its 2021 and 2022 reports, it will likely go back to the original numbers after that. Healthcare providers should prepare for this increased regulatory oversight appropriately.

Oberheiden P.C. © 2022