It’s Time To Review Your Online Patient-User Interface: DOJ Issues New Federal Guidance on Telemedicine and Civil Rights Protections

As online digital health services continue to enjoy broader use and appeal, federal regulators are concerned some telemedicine online patient-user interfaces fail to accommodate persons with disabilities and limited English proficiency. Such failures in “product design” can violate federal civil rights laws and the Americans with Disabilities Act (ADA), according to new policy guidance jointly issued by the U.S. Department of Health and Human Services (HHS) and Department of Justice (DOJ).

The document, Nondiscrimination in Telehealth, is specifically directed to companies offering telemedicine services and instructs such covered entities to immediately take specific steps to comply with the various “accessibility duties” under federal civil rights laws. The guidance focuses on ensuring accessibility for two populations of users: 1) people with disabilities and 2) people with Limited English Proficiency (LEP).

Who is Subject to these Rules?

The guidance refers to “covered entities” subject to these rules. Under the rules, “covered entities” are any health programs and activities receiving federal financial assistance (in addition to programs and activities administered by either a federal executive agency or an entity created by Title I of the Affordable Care Act). While the guidance does not define what constitutes “receiving federal financial assistance”, HHS has historically held that providers who receive federal dollars solely under traditional Medicare Part B were not covered entities. However, a recently-proposed rule suggests HHS will significantly expand the scope of covered entities, and soon. Telemedicine providers should be prepared to comply with these federal laws.

People with Disabilities

The guidance explains that no person with a disability shall – because of the disability – be excluded from participation in or be denied the benefits of the services, programs, or activities of a covered entity, or otherwise be subjected to discrimination by a covered entity. The requirements in the guidance is supported by several federal laws, including the Americans With Disabilities Act, the Affordable Care Act Section 1557, and the Rehabilitation Act Section 504.

Applying these federal civil rights protections to telemedicine services, the guidance states companies must make reasonable changes to their policies, practices, or procedures in order to provide “additional support to patients when needed before, during, and after a virtual visit.”

DOJ and HHS provided the following as examples of such “additional support” obligations:

  • A dermatology practice that typically limits telehealth appointments to 30 minutes may need to schedule a longer appointment for a patient who needs additional time to communicate because of their disability.

  • A doctor’s office that does not allow anyone but the patient to attend telehealth appointments would have to make reasonable changes to that policy to allow a person with a disability to bring a support person and/or family member to the appointment where needed to meaningfully access the health care appointment.

  • A mental health provider who uses telehealth to provide remote counseling to individuals may need to ensure that the telehealth platform it uses can support effective real-time captioning for a patient who is hard of hearing. The provider may not require patients to bring their own real-time captioner.

  • A sports medicine practice that uses videos to show patients how to do physical therapy exercises may need to make sure that the videos have audio descriptions for patients with visual disabilities.

People with LEP

The second area of the guidance is protections for LEP individuals under Title VI of the Civil Rights Act of 1964 (Title VI). Under Title VI, no person shall be discriminated against or excluded from participation in or be denied the benefits of services, programs, or activities receiving federal financial assistance on the basis of race, color, or national origin.

For telemedicine services, the guidance states that the prohibition against national origin discrimination extends to LEP persons. Namely, telemedicine companies must take reasonable steps to ensure meaningful access for LEP persons. Such “meaningful access” includes providing information about the availability of telehealth services, the process for scheduling telehealth appointments, and the appointment itself. In many instances, HHS states, language assistance services are necessary to provide meaningful access and comply with federal law.

These language assistance services can include such measures as oral language assistance performed by a qualified interpreter; in-language communication with a bilingual employee; or written translation of documents performed by a qualified translator

DOJ and HHS provided the following as examples of such “meaningful access” obligations:

  • In emails to patients or social media postings about the opportunity to schedule telehealth appointments, a federally assisted health care provider includes a short non-English statement that explains to LEP persons how to obtain, in a language they understand, the information contained in the email or social media posting.

  • An OBGYN who receives federal financial assistance and legally provides reproductive health services, using telehealth to provide remote appointments to patients, provides a qualified language interpreter for an LEP patient. The provider makes sure that their telehealth platform allows the interpreter to join the session. Due to issues of confidentiality and potential conflicts of interest (such as in matters involving domestic violence) providers should avoid relying on patients to bring their own interpreter.

What if Making These Changes is Expensive?

While not directly addressed in the guidance, the cost for implementing accessibility measures generally falls on the company itself. Federal ADA regulations prohibit charging patients extra for the cost of providing American Sign Language (ASL) interpreters or similar accommodations. In fact, a covered entity may be required to provide an ASL interpreter even if the cost of the interpreter is greater than the fee received for the telemedicine service itself. With respect to LEP interpreters, HHS issued separate guidance stating it is not sufficient to use “low-quality video remote interpreting services” or “rely on unqualified staff” as translators.

However, companies are not required to offer an aid or service that results in either an undue burden on the company or requires a fundamental alteration in the nature of the services offered by the company. This is an important counterbalance in the law. Yet, the threshold for what constitutes an “undue burden” on a company or a “fundamental alteration” to the nature of the services is not bright line and requires a fact-specific assessment under the legal requirements.

Conclusion

Telemedicine companies subject to the guidance should heed the government’s warning and look inward on patient-facing elements. The first step is to simply have the website and app platform reviewed (most particularly the patient online user interface) by a qualified third party to determine if its design and features are sufficiently accessible for people with disabilities, as well as LEP persons. That time is also a prudent opportunity to review the user interface to confirm it complies with state telemedicine practice standards, e-commerce rules, electronic signatures or click-sign laws, and privacy/security requirements. Because these laws have undergone rapid and extensive changes during the Public Health Emergency, it is recommended to conduct these assessments on a periodic/annual basis.

If a company believes the expense of making these product design changes to ensure accessibility would be prohibitively expensive, it should check with experienced advisors to determine if the changes would constitute an “undue burden” or “fundamental alteration.” Otherwise, federal guidance is clear that refusing to make reasonable changes can be a violation of federal civil rights laws.

© 2022 Foley & Lardner LLP

Medical Staff Leaders: 10 Things Your Lawyers Want You to Know

Whether you are new to medical staff leadership or have served in the past and have been called to serve again, there are times when you will need to consult a lawyer who specializes in medical staff matters. While there is nothing simple about medical staff affairs, there are some basic guidelines and protections that your lawyers would like you to know that will make your term easier and make you more effective.

Understand that hospitals and medical staffs are highly regulated organizations with a myriad of laws and standards that must be followed. As a medical staff leader, advisor or medical staff professional, you are leading and advising the professionals responsible for practitioner competence and conduct within the organization. Medical staff law has evolved from the lawyer in the office who would return your call in a week, or fax you a letter, to a specialty area where your lawyer is your partner and there to assist in all aspects of medical staff affairs.

We hope you will benefit from and find the following 10 recommendations make your term or role more informed and manageable.

10. Keep Your Governance Documents Up to Date and Reflective of Actual Practice.

We don’t suggest you must read every page of your governance documents, but you should be sure you know where to look and how to use them. Governance documents include the medical staff bylaws, credentialing manual, hearing plan, rules and regulations, policies and other documents approved by the medical staff and designed to set and guide medical staff processes. Too often we have found the documents will conflict or are missing critical passages. Your medical staff bylaws or medical staff governance committee can be one of the strongest committees in the organization. This is the committee that will annually review the documents and make sure they are internally consistent, reflect actual practice and are relevant to your organization’s practice and clinical services. Remember the medical staff bylaws set the overall guiding principles for the medical staff organization. All other governance documents flow from the foundation of the medical staff bylaws and must be consistent with their principles and mission. Undoubtedly, there will be some inconsistencies but look at those inconsistencies as opportunities to reexamine the principles and consider what is best for your organization. All governance documents should be reviewed in the context of the laws and regulations that require these documents. State and federal laws and regulations set out the basic requirements for the contents of the documents, as do many of the accreditation standards. It is far better to review and revise your governance documents regularly, rather than learn they are deficient during an unannounced survey or regulatory proceeding.

9. Use Your Committees Effectively.

There are two types of committees: those with authority to act and those that are advisory. The committees with authority are generally the Medical Executive Committee (“MEC”) and clinical department committees. All other committees are advisory to the MEC. Advisory committees can develop and recommend policies, rules and clinical practices. Authoritative committees approve policies and rules, take disciplinary action and make recommendations to the MEC. The MEC is the final medical staff authority that submits recommendations for final approval to the governing body. Knowing which committees to use and when is key to leadership success.

8. Know the Scope of Your Authority.

As a leader, you are an agent of the medical staff and the spokesperson for the committee/ department you chair. There are times when you will need to act without the benefit of input from your committee/department. Medical staff bylaws will generally identify the circumstances under which you can act alone and when your action(s) will need to be ratified by the committee. As the chair, you are acting on behalf of the committee/ department between meetings. Do what is needed when needed, within the scope of your authority, but report your actions to the committee/department on a regular basis and be sure your actions are properly recorded in the appropriate minutes. If summary or urgent action is needed, do not hesitate to call a special meeting. You are better off to have the protection of a committee action than to be acting alone or without ratification.

7. Know the Peer Review Protections of HCQIA, Your State and Organization.

Many, if not most, of your actions and the actions of your committees will be covered by federal, state and organizational protections. The Healthcare Quality Improvement Act (“HCQIA”) provides protection from liability for members of a professional review body/ medical staff, who take a professional review action (a) in the reasonable belief the action was in furtherance of quality health care, (b) after a reasonable effort to obtain the facts, (c) after adequate notice and hearing and (d) in the reasonable belief that the action was warranted by the facts. In addition to this federal protection, many states have laws that similarly protect peer review participants, and often, your organization will have an indemnification policy or provision that further protects you and your committee members from damages. Remind your committee participants and members on a regular basis of these protections and that they were specifically designed to encourage peer review by allowing free discussions aimed at improving patient care.

6. Know Your Reporting Obligations.

The National Practitioner Data Bank (“NPDB”) defines the circumstances under which a physician or dentist must be reported. Those include (a) when a professional review action adversely affects their clinical privileges for 30 days or longer or (b) when a physician surrenders clinical privileges while under investigation or in exchange for not conducting an investigation. The failure to report when required to do so can result in the loss of immunities under HCQIA for up to three years, along with a monetary fine. There are many nuances to reporting to the NPDB and we recommend you consult a medical staff attorney who can assist with identifying when to report and what to say. Additionally, each state may have reporting requirements for professional review actions to the state licensing board that exceed the NPDB’s requirements. The state licensing board may also have defined penalties for failure to report. In one state, the knowing failure of a physician leader to report a practitioner to the state licensing board can be considered unprofessional conduct, which can subject the physician leader to state board action.

5. Understand Confidentiality and Peer Review Privilege Protections.

A best practice at the beginning of each meeting is to remind committee members of the importance of maintaining confidentiality. State peer review privileges and protections are often dependent on maintaining confidentiality of the records and proceedings. The failure to maintain confidentiality can act as a waiver of the privilege and permit the introduction of confidential peer review documents and testimony in litigation in the future. Peer review privileges and protections are designed to promote candor in the peer review process. This permits free discussion and identification of opportunities to improve patient care. Without confidentiality and the corresponding privileges and protections, committee members would be reluctant to analyze and frankly discuss areas for improvement in a peer’s clinical care. Obtain information about your state’s peer review privilege and protections and fully understand the circumstances that may cause a waiver, which would permit confidential peer review information to be discussed in open court and stifle important, free-flowing discussion of quality of care at peer review meetings.

4. Know Your Options.

Every professional competence or conduct situation you face will be different. A sound guideline to generally follow is selecting the least restrictive action that will protect patients. Keep in mind that the goal of all peer review is education and remediation. For example, if a practitioner is having complications with robotic surgery, evaluate whether the complications are the result of technical skill, which can be remediated with more practice, or if the complications are the result of poor clinical judgment, which reaches into all areas of performance. In the first case, proctoring, monitoring or an additional educational course may correct the problem. But with the second, the cause of poor judgment is more challenging and may require a further workup, including a fitness for duty evaluation, retrospective review of cases, or an external expert review. Work with your committee and medical staff lawyer to identify all the facts and options to address the problem that has been brought to your attention. In some cases, it may be appropriate to have the issue addressed by the individual’s department or interdisciplinary peer review committee, but in others, the nature of the problem may require the immediate attention of the MEC. In some cases, a discrete referral to your organization’s well-being committee may be appropriate. Regardless, each matter must be carefully and thoughtfully analyzed in light of all the available facts. Then, with all appropriate actions on the table, an informed determination may be made.

3. Act When Indicated but Don’t Shortcut the Process.

. The law and your medical staff bylaws provide for the ability to take emergency action against a practitioner’s privileges when there is a concern of imminent threat to patients or others. What constitutes an “imminent” threat or danger is often the source of hours of discussion and analysis by medical staff lawyers throughout the country. Your legal team is invaluable in working through the facts of a given matter and determining whether a decision for summary suspension is legally sound. If there is a circumstance where emergency intervention via summary suspension is necessary to avoid patient harm after an initial evaluation of the matter, do not hesitate! Take the action to summarily suspend and remove an errant practitioner from the bedside. Afterward, there is time to re-examine the basis for the action and analyze whether continued suspension is necessary to protect patients or others. At that time, it is important to call on your MEC and legal team for their analysis and determination of whether the summary suspension should be upheld.

There are also times when summary suspension will be considered prospectively to address a chronic problem that is rising to an acute stage. The practitioner whose disruptive, bullying and retaliatory conduct has been tolerated may have reached a level where the cumulative effect creates the potential for patient harm because staff, for example, are afraid to call the physician at night about a patient’s health condition, seek clarification of an order, or question whether a procedure is being done on the right side or on the correct patient. Following the medical staff bylaws investigation process will allow for a careful analysis of the reported conduct, which will provide a solid framework for later defense, should it be necessary. That process will almost always involve a committee evaluation of the facts, interview of the practitioner, and a determination of the appropriate next steps. Each of these steps, if followed, will support the action when later scrutinized by a court or jury.

2. Do What is Right for the Patients.

Always put the patients first. There may be procedural missteps during a disciplinary process as the healthcare organization balances the need to protect patients with providing a practitioner due process. However, if the peer review being conducted is based in the foundation of improving patient care and patient safety, courts will generally consider the health care organization’s goals before making a determination that would go against the organization and potentially place patients in harm’s way.

1. Utilize Internal or External Counsel to Navigate Medical Staff Law so You Can Focus on Improving Patient Care.

I (Erin) was asked recently what possible motivation there would be for a physician to enter leadership in a medical staff organization if their role consisted solely of consulting with a medical staff lawyer. In response, I reminded this physician that medical staff leadership and medical staff lawyers work together on challenging matters and daily operations with the lawyer recommending limitations and guardrails and advising on how to avoid legal missteps and pitfalls. This advice from the lawyer enables the leader to focus on monitoring the business of the organization and improving patient care.

Final Take-Aways

Our medical staff organizations need people who are willing to serve as leaders during challenging times when caregivers are stretched thin, suffering burnout and subjected to daily difficulties that can be demoralizing. Strong leaders who are reassured of their legal protections can perform their leadership responsibilities without fear of reprisal when following the advice of their legal counsel. We encourage you to reach out and make your lawyer an integral part of your team so that they can understand your organization and business and provide you the best available advice that will reassure you and other leaders in the organization of the legal protections and immunities.

© Polsinelli PC, Polsinelli LLP in California

Do I Have to Sign Over All My Assets when I Enter a Long-Term Care Facility?

I get asked some version of this question fairly frequently. I generally reassure clients that most facilities simply require you to pay month-to-month, and you can leave at any time. Now I may have to change my response, as news broke this week that a New Jersey woman allegedly had all her assets stolen by the very entity she trusted to care for her.

The woman entered a facility for a short-term rehab stay with every intention of returning home. Apparently the facility thought otherwise, as they enlisted a financial company to “assist” the woman in liquidating her assets to pay for her facility care and spend down to apply for Medicaid. I and other elder lawyers, along with several consumer protection agencies in the state, have long warned consumers about nonlawyer Medicaid advisors. These entities work closely with the nursing home industry, often having the same ownership and leadership. In this case, the POA is both an officer with the facility and the principal of the Medicaid advisor company that was hired to make the resident Medicaid eligible without her knowledge.

Some facilities require or coerce residents to hire these Medicaid advisors to prepare Medicaid applications for them. Unfortunately, they are not lawyers, and their allegiance is clearly to the facilities and not the residents or their families. Therefore, they fail to advise residents of opportunities to protect assets or income. Even worse, in many cases they failed to complete or submit the application or did so in a negligent manner, resulting in the application being denied. But unlike when an attorney messes up, there is no recourse for families, as these entities do not carry malpractice insurance. Sometimes the Medicaid advisor will simply close up shop and disappear – only to resurface later with a different organization.

There have been prior reports of facilities and the Medicaid advisors they work with requiring residents to sign POAs and even accessing resident accounts through questionable means. These latest allegations, however, bring this situation to a new level. It is alleged that the resident was forced to sign a POA when she did not have the capacity to do so due to medications she was prescribed. It was further alleged that Future Care Consultants liquidated the resident’s assets without her knowledge, and the funds were not returned when she left the facility. The family also alleges they were prevented from visiting or communicating with the resident.

The allegations are reminiscent of the movie I Care a Lot, which I have previously criticized as being completely unrealistic. However, in recent months, I have had clients report they were threatened by facilities if they used the services of an attorney. It is essential that consumers know their rights. You cannot be required to sign a POA. You cannot be forced to hire anyone to file your Medicaid application. And you cannot be prevented from using an attorney if you wish to do so.

©2022 Norris McLaughlin P.A., All Rights Reserved

Biden Administration Seeks to Clarify Patient Privacy Protections Post-Dobbs, Though Questions Remain

On July 8, two weeks following the Supreme Court’s ruling in Dobbs v. Jackson that invalidated the constitutional right to abortion, President Biden signed Executive Order 14076 (E.O.). The E.O. directed federal agencies to take various actions to protect access to reproductive health care services,[1] including directing the Secretary of the U.S. Department of Health and Human Services (HHS) to “consider actions” to strengthen the protection of sensitive healthcare information, including data on reproductive healthcare services like abortion, by issuing new guidance under the Health Insurance and Accountability Act of 1996 (HIPAA).[2]

The directive bolstered efforts already underway by the Biden Administration. A week before the E.O. was signed, HHS Secretary Xavier Becerra directed the HHS Office for Civil Rights (OCR) to take steps to ensure privacy protections for patients who receive, and providers who furnish, reproductive health care services, including abortions.[3] The following day, OCR issued two guidance documents to carry out this order, which are described below.

Although the guidance issued by OCR clarifies the privacy protections as they exist under current law post-Dobbs, it does not offer patients or providers new or strengthened privacy rights. Indeed, the guidance illustrates the limitations of HIPAA regarding protection of health information of individuals related to abortion services.

A.  HHS Actions to Safeguard PHI Post-Dobbs

Following Secretary Becerra’s press announcement, OCR issued two new guidance documents outlining (1) when the HIPAA Privacy Rule may prevent the unconsented disclosure of reproductive health-related information; and (2) best practices for consumers to protect sensitive health information collected by personal cell phones, tablets, and apps.

(1) HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care

In the “Guidance to Protect Patient Privacy in Wake of Supreme Court Decision on Roe,”[4] OCR addresses three existing exceptions in the HIPAA Privacy Rule to the disclosure of PHI without an individual’s authorization and provides examples of how those exceptions may be applied post-Dobbs.

The three exceptions discussed in the OCR guidance are the exceptions for disclosures required by law,[5]  for purposes of law enforcement,[6] or to avert a serious threat to health or safety.[7]

While the OCR guidance reiterates that the Privacy Rule permits, “but does not require” disclosure of PHI in each of these exceptions,[8] this offers limited protection that relies on the choice of providers whether to disclose or not disclose the information. Although these exceptions are highlighted as “protections,” they expressly permit the disclosure of protected health information. Further, while true that the HIPAA Privacy Rule itself may not compel disclosure (but merely permits disclosure), the guidance fails to mention that in many situations in which these exceptions apply, the provider will have other legal authority (such as state law) mandating the disclosure and thus, a refusal to disclose the PHI may be unlawful based on a law other than HIPAA.

Two of the exceptions discussed in the guidance – the required by law exception and the law enforcement exception – both only apply in the first place when valid legal authority is requiring disclosure. In these situations, the fact that HIPAA does not compel disclosure is of no relevance. Certainly, when there is not valid legal authority requiring disclosure of PHI, then HIPAA prohibits disclosure, as noted as in the OCR guidance.  However, in states with restrictive abortion laws, the state legal authorities are likely to be designed to require disclosure – which HIPAA does not prevent.

For instance, if a health care provider receives a valid subpoena from a Texas court that is ordering the disclosure of PHI as part of a case against an individual suspected of aiding and abetting an abortion, in violation of Texas’ S.B. 8, then that provider could be held in contempt of court for failing to comply with the subpoena, despite the fact that HIPAA does not compel disclosure.[9] For more examples on when a covered entity may be required to disclose PHI, please see EBG’s prior blog: The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe.[10]

Notably, the OCR guidance does provide a new interpretation of the application of the exception for disclosures to avert a serious threat to health or safety. Under this exception, covered entities may disclose PHI, consistent with applicable law and standards of ethical conduct, if the covered entity, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. OCR states that it would be inconsistent with professional standards of ethical conduct to make such a disclosure of PHI to law enforcement or others regarding an individual’s interest, intent, or prior experience with reproductive health care. Thus, in the guidance, OCR takes the position that if a patient in a state where abortion is prohibited informs a health care provider of the patient’s intent to seek an abortion that would be legal in another state, this would not fall into the exception for disclosures to avert a serious threat to health or safety.  Covered entities should be aware of OCR’s position and understand that presumably OCR would view any such disclosure as a HIPAA violation.

(2) Protecting the Privacy and Security of Individuals’ Health Information When Using Personal Cell Phones or Tablets

OCR also issued guidance on how individuals can best protect their PHI on their own personal devices. HIPAA does not generally protect the privacy or security of health information when it is accessed through or stored on personal cell phones or tablets. Rather, HIPAA only applies when PHI is created, received, maintained, or transmitted by covered entities and business associates. As a result, it is not unlawful under HIPAA for information collected by devices or apps – including data pertaining to reproductive healthcare – to be disclosed without consumer’s knowledge.[11]

In an effort to clarify HIPAA’s limitation to protect such information, OCR issued guidance to protect consumer sensitive information stored in personal devices and apps.[12] This includes step-by-step guidance on how to control data collection on their location, and how to securely dispose old devices.[13]

Further, some states have taken steps to fill the legal gaps to varying degrees of success. For example, California’s Confidentiality of Medical Information Act (“CMIA”) extends to “any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information.”[14] As applied, a direct-to-consumer period tracker app provided by a technology company, for example, would fall under the CMIA’s data privacy protections, but not under HIPAA. Regardless, gaps remain as the CMIA does not protect against a Texas prosecutor subpoenaing information from the direct-to-consumer app. Conversely, Connecticut’s new reproductive health privacy law,[15] does prevent a Connecticut covered entity from disclosing reproductive health information based on a subpoena, but Connecticut’s law does not apply to non-covered entities, such as a period tracker app. Therefore, even the U.S.’s most protective state privacy laws do not fill in all of the privacy gaps.

Alongside OCR’s guidance, the Federal Trade Commission (FTC) published a blog post warning companies with access to confidential consumer information to consider FTC’s enforcement powers under Section 5 of the FTC Act, as well as the Safeguards Rule, the Health Breach Notification Rule, and the Children’s Online Privacy Protection Rule.[16] Consistent with OCR’s guidance, the FTC’s blog post reiterates the Biden Administration’s goal of protecting reproductive health data post-Dobbs, but does not go so far as to create new privacy protections relative to current law.

B.  Despite the Biden Administration’s Guidance, Questions Remain Regarding the Future of Reproductive Health Privacy Protections Post-Dobbs

Through E.O. 14076, Secretary Becerra’s press conference, OCR’s guidance, and the FTC’s blog, the Biden Administration is signaling that it intends to use the full force of its authorities – including those vested by HIPAA – to protect patient privacy in the wake of Roe.

However, it remains unclear how this messaging will translate to affirmative executive actions, and how successful such executive actions would be. How far is the executive branch willing to push reproductive rights? Would more aggressive executive actions be upheld by a Supreme Court that just struck down decades of precedent permitting access to abortion? Will the Biden Administration’s executive actions persist if the administration changes in the next Presidential election?

Attorneys at Epstein Becker & Green are well-positioned to assist covered entities, business associates, and other companies holding sensitive reproductive health data understand how to navigate HIPAA’s exemptions and interactions with emerging guidance, regulations, and statutes at both the state and Federal levels.

Ada Peters, a 2022 Summer Associate (not admitted to the practice of law) in the firm’s Washington, DC office and Jack Ferdman, a 2022 Summer Associate (not admitted to the practice of law) in the firm’s Boston office, contributed to the preparation of this post. 



[1] 87 Fed. Reg. 42053 (Jul. 8, 2022), https://bit.ly/3b4N4rp.

[2] Id.

[3] HHS, Remarks by Secretary Xavier Becerra at the Press Conference in Response to President Biden’s Directive following Overturning of Roe v. Wade (June 28, 2022), https://bit.ly/3zzGYsf.

[4] HHS, Guidance to Protect Patient Privacy in Wake of Supreme Court Decision on Roe (June 29, 2022),  https://bit.ly/3PE2rWK.

[5] 45 CFR 164.512(a)(1)

[6] 45 CFR 164.512(f)(1)

[7] 45 CFR 164.512(j)

[8] Id.

[9] See Texas S.B. 8; e.g., Fed. R. Civ. Pro. R.37 (outlining available sanctions associated with the failure to make disclosures or to cooperate in discovery in Federal courts), https://bit.ly/3BjX4I2.

[10] EBG Health Law Advisor, The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe (June 17, 2022), https://bit.ly/3oPDegl.

[11] A 2019 Kaiser Family Foundation survey concluded that almost one third of female respondents used a smartphone app to monitor their menstrual cycles and other reproductive health data. Kaiser Family Foundation, Health Apps and Information Survey (Sept. 2019), https://bit.ly/3PC9Gyt.

[12] HHS, Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone1 or Tablet (last visited Jul. 26, 2022), https://bit.ly/3S2MNWs.

[13] Id.

[14] Cal. Civ. Code § 56.10, Effective Jan. 1, 2022, https://bit.ly/3J5iDxM.

[15] 2022 Conn. Legis. Serv. P.A. 22-19 § 2 (S.B. 5414), Effective July 1, 2022, https://bit.ly/3zwn95c.

[16] FTC, Location, Health, and Other Sensitive Information: FTC Committed To Fully Enforcing the Law Against Illegal Use and Sharing of Highly Sensitive Data (July 11, 2022), https://bit.ly/3BjrzNV.

©2022 Epstein Becker & Green, P.C. All rights reserved.

Medicare CERT Audits and How to Prepare for Them

CERT audits are an unfortunate part of doing business for healthcare providers who accept Medicare. Failing the audit can mean the provider has to pay back overcharges and be subjected to increased scrutiny in the future. 

The best way to be prepared for a CERT audit is to have a compliance strategy in place and to follow it to the letter. Retaining a healthcare lawyer to craft that strategy is essential if you want to make sure that it is all-encompassing and effective. It can also help to hire independent counsel to conduct an internal review to ensure the compliance plan is doing its job.

When providers are notified of a CERT audit, hiring a Medicare lawyer is usually a good idea. Providers can fail the audit automatically if they do not comply with the document demands.

What is a CERT Audit?

The Comprehensive Error Rate Testing (CERT) program is an audit process developed by the Centers for Medicare and Medicaid Services (CMS). It is administered by private companies, called CERT Contractors, which work with the CMS. Current information about those companies is on the CMS website.

The CERT audit compares a sampling of bills for Medicare fee-for-service (FFS) payments, which were sent by the healthcare provider to its Medicare Administrative Contractor (MAC), against medical records for the patient. The audit looks at whether there is sufficient documentation to back up the claim against Medicare, whether the procedure was medically necessary, whether it was correctly coded, and whether the care was eligible for reimbursement through the Medicare program.

Every year, the CERT program audits enough of these FFS payments – generally around 50,000 per year – to create a statistically significant snapshot of inaccuracies in the Medicare program.

The results from those audits are reported to CMS. After appropriately weighing the results, CMS publishes the estimated improper payments or payment errors from the entire Medicare program in its annual report. In 2021, the CMS estimated that, based on data from the CERT audits, 6.26 percent of Medicare funding was incorrectly paid out, totaling $25.03 billion.

The vast majority of those incorrect payments, 64.1 percent, were marked as incorrect because they had insufficient documentation to support the Medicare claim. Another 13.6 percent were flagged as medically unnecessary. 10.6 percent was labeled as incorrectly paid out due to improper coding. 4.8 percent had no supporting documentation, at all. 6.9 percent was flagged as incorrectly paid for some other reason.

The CERT Audit Process

Healthcare providers who accept Medicare will receive a notice from a CERT Contractor. The notice informs the provider that it is being CERT audited and requests medical records from a random sampling of Medicare claims made by the provider to its MAC.

It is important to note that, at this point, there is no suspicion of wrongdoing. CERT audits examine Medicare claims at random.

Healthcare providers have 75 days to provide these medical records. Failing to provide the requested records is treated as an audit failure. In 2021, nearly 5 percent of failed CERT audits happened because no documentation was provided to support a Medicare claim.

Once the CERT Contractor has the documents, its team of reviewers – which consists of doctors, nurses, and certified medical coders – compares the Medicare claim against the patient’s medical records and looks for errors. According to the CMS, there are five major error categories:

  • No documentation

  • Insufficient documentation

  • Medical necessity

  • Incorrect coding

  • Other

Errors found during the CERT audit are reported to the healthcare provider’s MAC. The MAC can then make adjustments to the payments it sent to the provider.

Potential Repercussions from Errors Found in a CERT Audit

CERT audits that uncover errors in a healthcare provider’s Medicare billings lead to recoupments of overpayments, future scrutiny, and potentially even an investigation for Medicare fraud.

When the CERT audit results are brought to the MAC’s attention, the MAC will adjust the payments that it made to the provider. If the claims led to an overpayment, the MAC will demand that money back.

But Medicare Administrative Contractors (MACs) can go further than just demanding restitution for overpayments. They can also require prepayment reviews of all of the provider’s future Medicare claims, and can even suspend the provider from the program, entirely.

Worse still, CERT audits that uncover indications of Medicare fraud may be reported to a law enforcement agency for further review. This can lead to a criminal investigation and potentially even criminal charges.

Appealing a CERT Audit’s Results

With penalties so significant, healthcare providers should seriously consider hiring a lawyer to appeal the results of a CERT audit.

Appeals are first made to the MAC, requesting a redetermination of the audit results. The request for redetermination has to be made within 120 days of receiving notice of the audit results. However, if the provider wants to stop the MAC from recouping an overpayment in the meantime, it has to lodge the request within 30 days.

Providers can appeal the results of the redetermination, as well. They can request a reconsideration by a Qualified Independent Contractor within 180 of the redetermination, or within 60 days to stop the MAC’s recoupment process.

Providers who are still dissatisfied can appeal the case to an administrative law judge, then to the Medicare Appeals Council, and finally to a federal district court for review.

How to Handle a CERT Audit

The best way to handle and to prepare for a CERT audit is to hire Medicare audit attorneys to guide you through the process. It would also help to start internal audits within the company.

For providers who have been notified that they are under an audit, getting a lawyer on board immediately is essential. An experienced healthcare attorney can conduct a thorough internal investigation of the claims being audited. This can uncover potential problems before the audit points them out, giving the healthcare provider the time it needs to prepare its next steps.

Providers who are not currently being audited can still benefit from an attorney’s guidance. Whether by drafting a compliance plan that will prepare the provider for an inevitable CERT audit or by conducting an internal investigation to see how well a current compliance plan is performing, a lawyer can make sure that the provider is ready for an audit at a moment’s notice.

Taking these preventative steps soon is important. CMS put the CERT audit program on halt for the coronavirus pandemic, but that temporary hold was rescinded on August 11, 2020. While the CMS has reduced the sample sizes that will be used for its 2021 and 2022 reports, it will likely go back to the original numbers after that. Healthcare providers should prepare for this increased regulatory oversight appropriately.

Oberheiden P.C. © 2022

Supreme Court Signals Move Away from Judicial Deference to Administrative Agencies

KEY TAKEAWAYS

In a unanimous decision on June 15, 2022, the Court in American Hospital Association v. Becerra[2] examined a Medicare reimbursement formula reduction that affected certain hospitals. While rejecting the DHHS agency interpretation of the reimbursement statute, the Court made no mention of Chevron deference even though the parties extensively briefed this doctrine. Instead, the Court focused solely on the relevant language of the statute. In particular, the Court held that the “text and structure” of the statute demonstrated that the Medicare reimbursement cut was not consistent with the statute.

In a 5-4 decision a few weeks later, the Court in Becerra v. Empire Health Foundation[3] again made no mention of Chevron deference even though the majority noted that the underlying statute’s “ordinary meaning … [did] not exactly leap off the page.” Despite its initial conclusion that the ordinary meaning of the statutory language was unclear, the Court continued its recent pattern of (a) choosing to not apply Chevron deference directly and (b) instead performing textural and structural analysis of its own. Based on this statutory analysis, the Court in Empire Health concluded that the statute was “surprisingly clear” if read as technical provisions for specialists and that the language of the statute supported the agency’s implementing regulation.

Finally, in West Virginia v. EPA,[4] the Supreme Court in a 6-3 decision again refused to give any deference to the EPA’s interpretation of a Clean Air Act provision which the EPA claimed as the statutory basis to regulate greenhouse gas emissions by power plants. The Court concluded that the EPA had violated the “Major Questions” Doctrine when the EPA used this provision to regulate carbon emissions. Under the “Major Questions” Doctrine, an agency cannot make decisions of vast economic and political significance without Congress expressly giving the agency the power to do so. Since the EPA’s effort to regulate greenhouse gases by making industry-wide changes was a decision of “vast economic and political significance,” the Court concluded that the EPA lacked the authority to do so in light of the overall nature and structure of the statute. Thus, even though there was some textual support for the EPA’s position, the Court again refused to defer to the agency and its interpretation of a statute.

Read together, these three decisions show an increased skepticism by the Court of agency interpretations of statutes and signal that going forward, the federal courts will more closely scrutinize administrative agency decisions in general. Businesses that have, to date, relied on an administrative agency interpretation may need to reassess their reliance if the interpretation relies on a broad or strained reading of a statute. Conversely, businesses currently restrained by agency interpretations which were shown deference by courts may now have an opening to challenge those interpretations.


FOOTNOTES

[1] Chevron, U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837 (1984).

[2] Am. Hosp. Ass’n v. Becerra, 142 S. Ct. 1896 (2022).

[3] Becerra v. Empire Health Found., for Valley Hosp. Med. Ctr., 142 S. Ct. 2354 (2022).

[4] W. Virginia v. Env’t Prot. Agency, 142 S. Ct. 2587 (2022).

© 2022 Miller, Canfield, Paddock and Stone PLC

U.S. Supreme Court Agrees with HHS Payment Methodology for Disproportionate Share Hospitals

The fight about how Medicare compensates disproportionate share hospitals (“DSH”) is one of the longest-running reimbursement disputes of recent years, and it has generated copious work for judges around the country.  In a 5-4 decision, the U.S. Supreme Court settled one piece of the conflict:  the counting of “Medicare-entitled” patients in the Medicare fraction of the “disproportionate-patient percentage.”  Becerra v. Empire Health Found., 597 U.S. ___ (2022) (slip op.).  The Supreme Court concluded that the proper calculation, under the statute, counts “individuals ‘entitled to [Medicare] benefits[,]’ . . . regardless of whether they are receiving Medicare payments” for certain services.  Id. (slip op., at 18) (emphasis added).

DSH payments are made to hospitals with a large low-income patient mix.  “The mark-up reflects that low-income individuals are often more expensive to treat than higher income ones, even for the same medical conditions.”  Id. (slip op., at 3).  The federal government thus gives hospitals a financial boost for treating a “disproportionate share” of the indigent population.

The DHS payment depends on a hospital’s “disproportionate-patient percentage,” which is basically the sum of two fractions: the Medicare fraction, which reflects what portion of the Medicare patients were low-income; and the Medicaid fraction, which reflects what portion of the non-Medicare patients were on Medicaid.  Historically, HHS calculated the Medicare fraction by including only patients actually receiving certain Medicare benefits for their care.  In 2004, however, HHS changed course and issued a new rule.  It counted, in the Medicare fraction, all patients who were eligible for Medicare benefits generally (essentially, over 65 or disabled), even if particular benefits were not actually being paid.  For most providers, that change resulted in a pay cut.

The new rule sparked several lawsuits.  Hospitals challenged HHS’s policy based on the authorizing statutory language.  These hospitals essentially argued in favor of the old methodology.  Appeals led to a circuit split, with the Sixth and D.C. Circuits agreeing with HHS, and the Ninth Circuit ruling that HHS had misread the statute.

The Supreme Court has now resolved the issue.  The majority opinion, authored by Justice Kagan, sided with HHS.  The majority concluded that, based on the statutory language, “individuals ‘entitled to [Medicare] benefits’ are all those qualifying for the program, regardless of whether they are receiving Medicare payments for part or all of a hospital stay.”  Id. (slip op., at 18).  The majority also explained that if “entitlement to benefits” bore the meaning suggested by the hospital, “Medicare beneficiaries would lose important rights and protections . . . [and a] patient could lose his ability to enroll in other Medicare programs whenever he lacked a right to [certain] payments for hospital care.”  Id. (slip op., at 11).

Justice Kavanaugh dissented, joined by Chief Justice Roberts and Justices Gorsuch and Alito.  The dissent argued that those lacking certain Medicare coverage should be excluded from HHS’s formula, based on “the most fundamental principle of statutory interpretation: Read the statute.”  Id. (Kavanaugh, J., dissenting) (slip op., at 2).  According to the dissent, the majority’s ruling will also restrict hospitals’ ability to provide care to underprivileged communities.  “HHS’s misreading of the statute has significant real-world effects: It financially harms hospitals that serve low-income patients, thereby hamstringing those hospitals’ ability to provide needed care to low-income communities.”  Id. (slip op., at 4).

There was one point of agreement among the majority and dissenting justices: the complexity of the statutory language for DSH payments.  Echoing the thoughts often held by healthcare advisors, Justice Kagan found the statutory formula to be “a mouthful” and “a lot to digest.”  Id. (majority opinion) (slip op., at 4).  And in his dissent, Justice Kavanaugh called the statute “mind-numbingly complex,” and resorted to an interpretation that he found “straightforward and commonsensical”: that patients cannot be “simultaneously entitled and disentitled” to Medicare benefits.  Id. (Kavanaugh, J., dissenting) (slip op., at 1, 3).

© Copyright 2022 Squire Patton Boggs (US) LLP

Abortion-Related Travel Benefits Post-Dobbs

Immediately following the Supreme Court decision in Dobbs v. Jackson returning the power to regulate abortion to the states, a number of large employers announced that they would offer out-of-state travel benefits for employees living in states where abortion-related medical care is unavailable. Employers considering offering abortion-related travel benefits have several key considerations to keep in mind. The law currently allows health plans to provide reimbursement for travel primarily for and essential to medical care. Although this area of the law is evolving, employers with self-funded medical plans may amend their existing medical plans to provide abortion-related travel benefits while those with fully insured medical plans may face more obstacles in providing such benefits.

In Dobbs v. Jackson, an abortion clinic challenged a Mississippi law that would ban abortion after 15 weeks of pregnancy, with limited exceptions. In establishing the constitutional right to abortion in Roe v. Wade, the Supreme Court restricted states in their ability to limit or ban abortions before viability of the fetus, or 24 weeks from the time of conception. In upholding the Mississippi law, the Supreme Court overturned Roe and held that the protection or regulation of abortion is a decision for each state.

Alabama, Arkansas, Kentucky, Missouri, Oklahoma and South Dakota have already banned or made abortion illegal pursuant to trigger laws which went into effect as of the Supreme Court decision on June 24, 2022.  Also, a number of additional states are expected to soon have similar legislation in effect, either by virtue of expected legislative action or trigger laws with slightly delayed effective dates.  In response, a number of employers have announced that they will reimburse all or a portion of abortion-related travel expenses for employees in states where abortions are banned or otherwise not available.

Under Section 213(d) of the Internal Revenue Code, the definition of “medical care” includes transportation that is both “primarily for and essential to” the medical care sought by an individual. These types of travel benefits have historically been utilized in connection with certain specialized medical treatments, such as organ transplants.  However, Section 213(d) is not limited to particular types of procedures, and thus forms the framework for providing abortion-related travel benefits through existing medical plans.

Although Code Section 213(d) applies to both self-insured and insured medical plans, the substantive coverage provisions of insured medical plans will generally be governed by the state insurance code of the state in which the insurance policy is issued.  Coverage for abortion services or any related travel benefits may not be permitted under the insurance code of the state in which the policy is issued, or an insurer may not offer a travel benefit for such services even if permitted to do so.  Self-insured plans, by contrast, provide employers more flexibility in plan design, including control, consistent with existing federal requirements, over the types and levels of benefits covered under the plan. As noted above, existing plans may already cover travel-related benefits for certain types of medical procedures.

Employers with high-deductible health plans tied to health savings accounts (HSAs) will need to consider the impact of adding abortion-related travel benefits to such plans.  Travel-related benefits of any type would not appear to be eligible for first dollar coverage, and thus may be of minimal benefit to participants enrolled in high-deductible health plans.

Employers with fully insured medical plans that do not cover abortion-related travel benefits may be able to offer a medical travel reimbursement program through an integrated health reimbursement arrangement (HRA).  An integrated HRA is an employer-funded group health plan from which employees enrolled in the employer’s traditional group medical insurance plan are reimbursed for qualifying expenses not paid by the traditional plan.

Another potential option for employers with fully insured medical plans may be to offer a stipend entirely outside of any established group health plan. Such reimbursement programs may result in taxable compensation for employees who receive such reimbursements. Also, employers would need to be sensitive to privacy and confidentiality considerations of such a policy, which should generally be minimized if offered in accordance with the existing protections of HIPAA through a medical plan and under which claims are processed by an insurer or third-party administrator rather than by the employer itself.

Additionally, some state laws may attempt to criminalize or otherwise sanction so-called aiding and abetting actions related to the procurement of abortion services in another state.  This is an untested area of the law, and it is unclear whether any actions brought under such statutes would be legally viable.  In this regard, Justice Kavanaugh stated as follows in his concurring opinion in Dobbs:  “For example, may a State bar a resident of that State from traveling to another State to obtain an abortion? In my view, the answer is no based on the constitutional right to interstate travel.” (Kavanaugh Concurring Opinion, page 10.)  This is an area that will require continual monitoring by employers who offer abortion-related travel benefits.

© 2022 Vedder Price

Update: In Opioid Liability Ruling for Doctors, SCOTUS Deals Blow to DOJ

On June 27, 2022, the United States Supreme Court ruled that doctors who act in subjective good faith in prescribing controlled substances to their patients cannot be convicted under the Controlled Substance Act (“CSA”).  The Court’s decision will have broad implications for physicians and patients alike.  Practitioners who sincerely and honestly believe – even if mistakenly – that their prescriptions are within the usual course of professional practice will be shielded from criminal liability.

The ruling stemmed from the convictions of Dr. Xiulu Ruan and Dr. Shakeel Kahn for unlawfully prescribing opioid painkillers.  At their trials, the district courts rejected any consideration of good faith and instructed the members of the jury that the doctors could be convicted if they prescribed opioids outside the recognized standards of medical practice. The Tenth and Eleventh Circuits affirmed the instructions.  Drs. Ruan and Kahn were sentenced to 21 and 25 years in prison, respectively.

The Court vacated the decisions of the courts of appeals and sent the cases back for further review.

The question before the court concerned the state of mind that the Government must prove to convict a doctor of violating the CSA.  Justice Breyer framed the issue: “To prove that a doctor’s dispensation of drugs via prescription falls within the statute’s prohibition and outside the authorization exception, is it sufficient for the Government to prove that a prescription was in fact not authorized, or must the Government prove that the doctor knew or intended that the prescription was unauthorized?”

The doctors urged the Court to adopt a subjective good-faith standard that would protect practitioners from criminal prosecution if they sincerely and honestly believed their prescriptions were within the usual course of professional practice.  The Government argued for an objective, good-faith standard based on the hypothetical “reasonable” doctor.  The Court took it one step further.

Justice Breyer delivered the opinion of the Court.  He said that for purposes of a criminal conviction under the CSA, “the Government must prove beyond a reasonable doubt that the defendant knowingly or intentionally acted in an unauthorized manner.”  To hold otherwise “would turn a defendant’s criminal liability on the mental state of a hypothetical ‘reasonable’ doctor” and “reduce culpability on the all-important element of the crime to negligence,” he explained.  The Court has “long been reluctant to infer that a negligence standard was intended in criminal statutes,” wrote Justice Breyer.

Justice Samuel Alito wrote a concurring opinion, which Justice Clarence Thomas joined and Justice Amy Coney Barrett joined in part.  Although Justice Alito would vacate the judgments below and remand for further proceedings, he would hold that the “except as authorized” clause of the CSA creates an affirmative defense that defendant doctors must prove by a preponderance of the evidence.

The Court’s decision will protect patient access to prescriptions written in good faith.  However, for the government, the Court’s decision means prosecutors face an uphill battle in charging, much less convicting, physicians under the CSA.  Indeed, the Court’s decision may have a chilling effect on the recent surge in DOJ prosecutions of medical practitioners and pain clinics.

© 2022 Dinsmore & Shohl LLP. All rights reserved.

Preparing Corporate Messaging in the Wake of Dobbs

The United States Supreme Court (“SCOTUS”), in Dobbs v. Jackson Women’s Health Organization, has held that there is no constitutional right to abortion, overruling Roe v. Wade and Casey v. Planned Parenthood.

Employers, who increasingly are finding themselves on the front lines of many societal issues, will need to decide quickly whether and how they might address the Dobbs decision, as public reaction has been and is likely to remain strong. Board members, employees, and shareholders may advocate for corporations to take a visible stand on the issue of abortion and reproductive rights. And employees may want to speak up themselves (possibly via employer social media accounts).

It is important to remember that company communication decisions and actions regarding the Dobbs ruling, as well as other political and social issues, can have practical and legal implications.

The first question is whether your company will comment on Dobbs. If you decide to comment, there are many factors to consider. Your message is an important starting point. Who is your intended audience? Will your employees consider it an opportunity to join in the conversation? What will you say? Even if your message is internal, keep in mind that it may not stay that way, given the nature of social media. And before you think, “I’ll just stay out of it,” remember that some will view silence or neutrality as a statement in and of itself. If you choose not to speak, are you prepared to deal with any potential reaction from customers, employees, or shareholders?

Internally, employees may have questions about health benefits or other terms and conditions of employment because of Dobbs. It will be important to arm all key stakeholders, including leadership, corporate communications, and human resources, with tools to consistently manage these communications and responses.

Whether it’s internal or external communications, expect feedback! How that feedback is handled is as important as the initial communication (or lack thereof).

Certain industries, like healthcare and insurance, may also feel compelled to make an affirmative statement if the Dobbs decision has a direct impact on services and/or products. In those cases, the need to consider all implications is even more pressing.

In thinking through these decisions, employers should also consider who may need to approve any messaging. The board of directors, senior executives, legal, and marketing and communications teams are among the key stakeholders who may need to be consulted. And don’t forget that your public-facing employees may bear the brunt of your response. Are they prepared?

Employers should also keep in mind various laws that may govern their reaction, including those they might otherwise not consider. For example, the National Labor Relations Act protects employees’ rights to collectively discuss terms and conditions of employment at work and off duty – and that applies to employers with and without a unionized workforce. The current Biden-appointed General Counsel of the National Labor Relations Board has taken an expanded view of topics that are connected to the workplace. Moreover, some states, including California and New York, have enacted off-duty conduct laws that prohibit employers from disciplining employees for lawful conduct outside of work, which may include political advocacy. There may also be anti-discrimination laws and potential civil and criminal liability associated with your statements, depending on their wording.

Reactions to the Dobbs decision may vary. Some reaction may be comparable to what we’ve seen with respect to other recent political and/or social justice movements, such as Black Lives Matter and #MeToo; others may react differently, or not at all. In these rapidly changing times, companies — particularly publicly traded and consumer-facing ones — need to be make informed decisions. Clear, consistent messaging is key to establishing confident and consistent responses to potential concerns by employees and other stakeholders.

©2022 Epstein Becker & Green, P.C. All rights reserved.