Protests of the Medicaid Managed Assistance ITN Recommended Awards

POSTED BY STEVEN GRIGAS AND BRUCE PLATT ON OCTOBER 10, 2013

Pursuant to Section 409.966, Florida Statutes, traditional Medicaid services are to be provided to Florida recipients through a limited number of Managed Care Organizations ("MCOs") in the 11 Regions of the state.  The Agency released Invitations to Negotiate ("ITNs)" for each of the Regions inviting MCOs to submit proposals to provide coverage to Medicaid recipients in that Region.  The proposals were submitted and evaluated, and on September 27, the Florida Agency for Health Care Administration ("AHCA") released the list of recommended awards to MCOs in the 11 Regions.

Section 409.966 limits the number of MCOs that can operate in each Region, and therefore many MCOs were not awarded Regions for which they had submitted proposals.  MCOs had to submit notice of intent to challenge within 72 hours of the award; with their formal protest filed by close of business October 7  However, several of the MCOs that submitted notices of intent to protest did not submit formal protests.  The following MCOs met the filing deadline and have filed formal protests for the regions indicated:

•    Molina Healthcare of Florida, Inc.
     [Regions  1,4,5,6,7, 9,10,11]

•    First Coast Advantage, LLC – PSN.
     [Region 3]

•    Wellcare of Florida, Inc. d/b/a /Staywell Health Plan of Florida.
      [Regions 4, 9, 10]

•    South Florida Community Care Network– PSN.
     [Region 10]

•    Care Access PSN, LLC – PSN.
     [Region 11]

•    Integral Health Plan, Inc. d/b/a Integral Quality Care – PSN.
     [Region 1]

•    Prestige Health Choice, LLC – PSN.
     [Region 8]

•    Simply Healthcare Plans, Inc.
     [Regions 5, 11]

•    Coventry Health Care of Florida, Inc.
     [Regions 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]

AHCA is currently evaluating the protests filed for legal sufficiency and appropriate further action.  The MCOs whose protests are deemed legally sufficient will have an opportunity in the next seven days to meet with the Agency and resolve the protest(s) by mutual agreement (we believe, but have not been able to confirm, that some MCOs have already begun meeting with AHCA).  If unresolvable, the Agency will refer the protest(s) to the Division of Administrative Hearings for an administrative hearing before an administrative law judge. 

Akerman is pleased to be able to offer this timely update and stands willing to discuss the matter further should you need additional information.

Florida's New Med-Mal Law is Pre-empted by HIPAA and is Voided by Federal Judge

POSTED BY JULIE GALLAGHER ON OCTOBER 7, 2013

A new part of Florida's medical malpractice law has been voided by a federal judge on the grounds that it is pre-empted by HIPAA.

The law, passed during the 2013 legislative session and effective only on July 1 2013, requires, as a pre-condition to filing a malpractice claim, an aggrieved patient to sign an authorization that allows the potential defendant physician, the defendant's counsel, and the defendant's insurer to speak with the patient's treating physicians without notice or the presence of the patient or patient's counsel. Judge Robert L. Hinkle (Northern District of Florida) noted that HIPAA requires such third party interviews or information to be obtained only with the patient's proper authorization, or a court or administrative order issued after an opportunity to be heard on the propriety of the disclosures. The authorization obtained under Florida's law to allow such ex parte interviews is not a proper authorization as contemplated by HIPAA, but, rather, only "mandated compliance with state law," according to Judge Hinkle. "The authorization is a charade; the only entity granting authority, in any meaningful sense, is the state itself, not the patient," according to Judge Hinkle's ruling.

The Judge further commented that, although proponents of the law may be correct in their position that the law provides important benefits, it was not his job to evaluate the competing policy arguments. His task was simply to follow the federal rules. In this case, federal law trumped Florida' statute because Florida's law weakened protections provided under HIPAA. 

Plaintiff's attorneys were not surprised by the ruling as they claimed "there was no way to reconcile the Florida statute with HIPAA's very straightforward requirements that put control over private health information in the hands of the patient absent a court order where there was an opportunity to object." The Florida Medical Association, which lobbied in favor of adoption of the Florida statute, vowed to appeal the decision. The defendant, Dr. Adolfo C. Dulay did just that on Monday, September 30th when an appeal was filed with the Eleventh Circuit Court of Appeals.

Tags: , ,

Minimum Wage and Overtime Pay Extended to Certain Direct Home Care Workers

POSTED BY VENUS CARUSO ON OCTOBER 3, 2013

Home health care workers and companions employed by agencies will no longer be exempt under federal overtime laws beginning in January 2015. As a result of the Department of Labor's adoption on September 17, 2013 of a Final Rule revising its regulations to eliminate the Fair Labor Standards Act (FLSA) exemption for agency-employed direct care workers, home health agencies will be exposed to significant new wage and hour liability.

On September 17, 2013, the U.S. Department of Labor's Wage and Hour Division announced a final rule extending the FLSA's minimum wage and overtime protections to cover certain direct care workers such as certified nursing assistants, home health aides, personal care aides, caregivers and other companions who provide essential home care assistance to elderly people and people with illnesses, injuries, or disabilities. The new rule will take effect January 1, 2015.

Since 1974, the FLSA has covered workers who perform a "domestic service" – i.e., services of a household nature performed by a worker in or about a private home, whether permanent or temporary. This term includes services performed by companions, babysitters, cooks, waiters, maids, housekeepers, nannies, nurses, janitors, caretakers, handymen, gardeners, home health aides, personal care aides, and family chauffeurs, among others. However, the FLSA also provides for a Companionship Services Exemption, exempting certain domestic service workers from minimum wage and overtime protection including, but not limited to, casual babysitters and domestic service workers employed to provide "companionship services" for an elderly person or a person with an illness, injury, or disability if they meet certain regulatory requirements described below.

The amended regulations narrow the Companionship Services Exemption in two ways. First, they narrow the definition of "companionship services". Second, they provide that the exemption may only be claimed by the individual, family, or household using the services.

Under the revised regulations, the term "companionship services" means the provision of "fellowship" and "protection" for an elderly person or a person with an illness, injury, or disability who requires assistance in caring for himself or herself. "Companionship services" also include the provision of care, such as assisting a person with activities of daily living, provided that that such care requires no more than 20 percent of the employee's time worked for the person during the workweek. "Companionship services" do not include the performance of medically related services or household work not performed primarily for the elderly person or person with an illness, injury or disability who requires assistance, or household services. Also, under the revised regulations, the Companionship Services Exemption is only available to the individual, family, or household solely or jointly employing the worker, and only if the companionship services duties test is met. Third party employers of direct care workers, such as home care staffing agencies, are not permitted to claim this exemption, even when the employee performs companionship services and is jointly employed by the third party employer and the individual, family, or household using the services. As such, third party employers must pay their workers the Federal minimum wage for all hours worked and overtime pay at time and one-half of the regular rate of pay for all hours worked over 40 in a workweek.

Tags:

Topics:  

Failure to Comply with Physician Supervision Requirements Can Be Costly

POSTED BY MARSHALL R. BURACK ON OCTOBER 1, 2013

The Department of Justice recently announced two large settlement agreements with provider organizations and individual physicians based on failure to provide proper physician  supervision for diagnostic imaging and radiation therapy procedures.

In the first settlement, announced on August 27, 2013, Imagimed, LLC, a New York based diagnostic testing company, and certain individuals formerly associated with the company agreed to pay the government $3.57 million to settle charges that, between 2001 and 2008, the company submitted false claims for MRI scans to Medicare, Medicaid and Tricare. 

Federal regulations require that MRI procedures involving contrast injections must be directly supervised by a qualified physician, so that care is immediately available in the event the patient experiences anaphylactic shock or other adverse side effects.  Imagimed failed to provide the appropriate physician supervision for MRI scans with contrast.

Less than three weeks later, on September 13, 2013, the Justice Department announced a similar settlement with a number of northwest Florida providers and physicians -- Gulf Region Radiation Oncology Centers, Inc., Gulf Region Radiation Oncology MSO, LLC, Sacred Heart Health System, Inc., West Florida Medical Center Clinic, P.A., Emerald Coast Radiation Oncology Center LLC, and two individual physicians.  The parties agreed to pay $3.5 million to the federal government and the state of Florida to settle charges that they billed for radiation oncology services that were not properly supervised by a physician.  The government had strong evidence to support its case:  records indicated that between 2007 and 2011, when the improper billing occurred, the physicians were often away on vacation or were working at another facility at times they were supposed to be on-site supervising radiation oncology services.

These two settlements are examples of how important it is to comply with applicable federal requirements governing supervision of diagnostic imaging, radiation oncology, and other procedures, and how costly failure to comply with such requirements can be.

These settlements provide a sharp contrast to a court decision issued earlier this year, in which a federal appeals court reversed an $11.1 million verdict obtained by the Department of Justice against a provider of imaging services based on failure to provide proper physician supervision.  See, U.S. ex rel Hobbs v. Medquest Associates, Inc. (6th Dist., April 1, 2013).  The court held that the supervision regulations which Medquest violated were conditions of participation in the Medicare program, not conditions of payment, and thus did not warrant the remedy of recoupment under the False Claims Act, but, rather, were addressable by administrative sanctions, including expulsion from the Medicare program.  (This case was discussed in a Health Law Rx Blog posted April 9, 2013).

 

FDA Launches Medical Device ID Requirement

POSTED BY SHERYL D. ROSEN ON SEPTEMBER 30, 2013

On September 24, 2013, the Food and Drug Administration (FDA) finalized a new rule requiring medical devices to bear special ID numbers. The numbers, called Unique Device Identifiers or UDIs, will identify the manufacturer, the specific model of a device, and other information such as batch or lot codes, serial numbers, and expiration dates. The UDIs are intended to improve accuracy of adverse event reports, reduce medical errors by more precisely identifying devices, and make product recalls more effective. The FDA will also use the UDIs to create a centralized database in which consumers can look up information about specific devices.

For medical device manufacturers, this means new labeling requirements. Manufacturers have differing deadlines to comply depending on the type of device they market.  Manufacturers of class III (high risk) devices must apply UDIs to their product labels within 1 year of the new rule (by September 24, 2014). Class II medical devices must comply within 3 years (by September 24, 2016), and Class I devices must comply within 5 years (by September 24, 2018).  

However, many products are exempt from the UDI requirement, including:

  • Devices already manufactured and labeled on the compliance date for that class of device;
  • Individual, single-use, non-implantable devices not intended for individual sale;
  • Devices solely for research or teaching;
  • Investigational devices;
  • Veterinary devices; and
  • Devices intended for export from the U.S.

In addition to marking the labels of products, devices that are intended for multiple use and are reprocessed between uses must bear the UDI as a permanent marking on the device itself, although different deadlines apply than those for marking labels. See the chart here for reference. Manufacturers should read the new rule, determine their deadline for compliance, and formulate a plan to ensure their products comply.

Tags: , ,

Meaningful Use Attestation Deadline Approaching: What You Need To Know

POSTED BY ARI H. GERSTIN ON SEPTEMBER 24, 2013

As the end of the federal fiscal year rapidly approaches, so does the attestation deadline for hospitals participating in the Medicare Electronic Health Record (EHR) Incentive Program.

Each year, hospitals are required to show that they are “meaningfully using” their EHRs in order to receive their incentive payment and avoid any adjustment. They demonstrate such meaningful use by meeting certain objectives established by CMS. The attestation deadline for hospitals participating in the Medicare EHR incentive program is November 30, 2013.

For hospitals reporting on their first year of participation, the performance period is 90 days, while hospitals in their second or third year of participation are required to report using a full fiscal year of data. In order to benefit fully from the EHR incentive program, hospitals paid under the inpatient prospective payment system must attest to meaningful use by fiscal year 2013.

Participants in Medicare and Medicaid’s EHR incentive programs have been under increasing scrutiny as auditors are now seeking documentation to substantiate compliance with program requirements at the time of attestation. As previously reported, some providers that have been unable to produce screen shots to document their compliance have been asked to return incentive payments.

In today’s heighted enforcement environment, all providers, including hospitals and physicians, should maintain detailed records relating to their implementation and meaningful use of EHR technology. These records should include screen shots on the date of attestation that demonstrate compliance, so that this information is readily available in the event of a future audit. Hospitals that are not able to document compliance risk losing all or a portion of their EHR incentive payments.

Tags: ,

HHS Makes Good on Its Promise: Releases HIPAA Guidance for Refill Reminder Programs

POSTED BY MARTIN R. DIX ON SEPTEMBER 23, 2013

As previously reported, HHS announced earlier this month that it would be providing clarification on the HIPAA Privacy Rule as it relates to marketing and prescription refill reminder programs.  On September 19, 2013, HHS made good on that promise when the Office for Civil Rights announced guidance on when refill reminders and other communications about drugs currently being prescribed for an individual do not constitute "marketing" and thus do not require prior patient authorization.  

The announcement provides a test for when refill reminders will not be considered marketing (“refill reminder exception”).  The test focuses on two questions:   First, is the communication about a currently prescribed drug or biologic?  Second, if there is remuneration for the communication, is it reasonable?   

The announcement also contains the following guidance for applying the test and a number of FAQs dealing with specific situations:  

1. Is the Communication about a Currently Prescribed Drug or Biologic?

WITHIN EXCEPTION:

Communications that are:

  • Refill reminders;
  • About a recently lapsed prescription (one that has lapsed within the last 90 calendar days);
  • About generic equivalents of a drug being prescribed;
  • Adherence communications encouraging individuals to take prescribed medicines as directed; or
  • About all aspects of the drug delivery system for a prescribed a self-administered drug.

NOT WITHIN EXCEPTION:

Communications:

  • About specific new formulations of a currently prescribed medicine;
  • About specific adjunctive drugs related to the currently prescribed medicine; or
  • Encouraging an individual to switch from a prescribed medicine to an alternative medicine.

2.  Does the Communication Involve Financial Remuneration, and If So, Is It Reasonable?

WITHIN EXCEPTION:

Communications:

  • That do not involve remuneration;
  • Involving only non-financial or in-kind remuneration, such as supplies, computers, or other materials;
  • Involving only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.

Remuneration:

  • Involving payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs; or  
  • Involving payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services.  The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.

NOT WITHIN EXCEPTION

  • Communication involves financial remuneration other than as described above.

As reported in the earlier post, HHS will not enforce the restrictions on remunerated refill reminders and other communications until November 7, 2013.

Tags: ,

It's Never too Late to Give Guidance: OCR Starts Releasing HIPAA Omnibus Rule Guidance in Anticipation of September 23 Compliance Deadline

POSTED BY  ADAM R. MAINGOT AND RICHARD T. JONES AND ELIZABETH F. HODGE ON SEPTEMBER 20, 2013

This has been a busy week for the Department of Health and Human Services / Office for Civil Rights (HHS/OCR).  It has started releasing guidance on various provisions of the Omnibus HIPAA final rule (the "Final Rule") in advance of the September 23, 2013 compliance date.  The guidance includes:

1. Model Notices of Privacy Practices

A significant provision of the Final Rule requires covered entities to update their Notices of Privacy Practices ("NPP") to conform with new requirements under HITECH.  On September 16, 2013 , OCR released a set of model NPPs (the "Forms") for both health care providers and health plans both in editable .pdf and text formats.

The Forms include key revisions to the NPP required by the Final Rule including:

  1. the patient's right to restrict disclosures to a health plan when a procedure is paid for out of pocket and to receive notice if there has been a breach of the patient's protected health information ("PHI"); 

  2. a description of the types of uses and disclosures that require  authorization,  including uses and disclosures for certain marketing activities and for the sale of PHI by a covered entity; 

  3. the individual’s right to opt out of certain fundraising disclosures; 

  4. the health plan's inability to use or disclose a person's genetic information for underwriting purposes; and

  5. if there is a material change to the NPP, the health plan's obligation to post the revised NPP on the plan's website or provide a notice of revision to plan participants within sixty (60) days.

While the Forms can serve as the baseline for covered entities to come into compliance with the new requirements by September 23, 2013, health care providers and health plans should also consider applicable state law and their particular operations.

2. Delay in Enforcement of NPP Requirement for Certain CLIA and CLIA-Exempt Labs

On September 19, 2013, HHS announced that it was delaying enforcement of the requirement that labs that are subject to the Clinical Laboratory Improvement Amendments of 1988 ("CLIA") or exempt from CLIA and that are not required to provide an individual with access to his or her laboratory results under the HIPAA Privacy Rule.  HHS  issued the enforcement delay because it anticipates publishing an amendment to the HIPAA Privacy Rule and the CLIA regulations regarding the right of individuals to receive their test results directly from CLIA and CLIA-exempt labs.  The enforcement delay will relieve CLIA and CLIA-exempt labs from potentially having to revise their NPPs twice within a relatively short time and the associated burdens that would impose.

3. Guidance on Decedents and Student Immunizations

On September 19, 2013, OCR released guidance on uses and disclosures of PHI of decedents and disclosures of student immunization records.  In addition to the guidance, OCR published FAQs addressing both topics.

Under the Omnibus Rule, PHI of decedents is protected for 50 years following the date of death of the individual.  After that, the information is no longer subject to HIPAA protections.  During the 50-year period of protection, the personal representative of the decedent, can exercise the rights under the Privacy Rule to protect the health information of the decedent.  Covered entities may also release to family members and others involved in the person's healthcare PHI that is relevant to that involvement.  The guidance and FAQs address issues that may arise in implementing this new requirement.

The Omnibus Rule also explicitly permits covered entities to disclose student immunization information directly to a school that is required by state or other law to have proof of required immunizations before admitting the student.  The covered entity needs only agreement (and not written authorization) from a parent, guardian, or the emancipated minor to make the disclosure.  While the agreement does not need to be in writing, the health care provider must document the agreement to disclosure.  The new guidance and FAQs address what is suitable documentation and other issues that may arise.

4. What's next?

OCR has also released clarification on prescription drug refill reminder programs (to be addressed in a separate Akerman Health Law Rx Blog).  More guidance is sure to follow so….stay tuned!

 

HHS to Revamp Limits on Payments to Pharmacies for Refill Reminder Programs

POSTED BY MARTIN R. DIX ON SEPTEMBER 13, 2013

The HIPAA Privacy Regulations have long required covered entities to seek a patient authorization in order to use or disclose protected health information ("PHI") for marketing purposes. However, the Office for Civil Rights made it clear in its Q and A on its website that pharmacies were allowed to provide refill reminders to patients without an authorization as this was generally considered to be part of "Treatment" and a covered entity can use or disclose PHI for treatment purposes.

Many of the drug companies have developed refill reminder programs with retail pharmacies to help assure that their drugs are being adhered to. Generally, the drug companies or a company on their behalf, paid the pharmacy for providing the refill reminders. These refill reminder programs have become an important revenue source for pharmacies. However, a question remained as to whether it was "marketing" when a pharmacy receives remuneration for sending these refill reminder letters to patients. 

The HITECH Act, enacted in 2009 to amend certain HIPAA provisions, provides that, with limited exceptions, a covered entity could not, directly or indirectly, receive remuneration in exchange for PHI without a valid authorization. However, the HITECH Act also states that a communication which would otherwise be marketing could be a "health care operation",  "if such communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication", and the communication is made by the covered entity pursuant to a signed authorization or by a business associate pursuant to a business associate agreement. It is not clear why Congress required an authorization if the covered entity provided the communication, but not if the communication is made by the business associate.

There was a further requirement in the HITECH Act that the remuneration be "reasonable in amount" as described by the Secretary in regulations. The 2013 amendments to the HIPAA Privacy Regulations included a change to the definition of "Marketing" which provided further direction on what the term "reasonable in amount" meant:

(2) Marketing does not include a communication made: 

(i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.  45 CFR 164.501.

The payments to pharmacies under these refill reminder programs generally exceed the cost of making the communication and if remuneration is limited to the pharmacy's cost of sending a refill reminder letter, there is no economic incentive for the pharmacies to send the communications (other than possible increased drug purchases and drug regimen adherence). Adheris, Inc., a company that works with drug manufacturers to provide refill programs to pharmacies, brought suit to enjoin HHS from enforcing the above language contending that the regulation's language limiting the allowed reimbursement to "the covered entity's cost of making the communication" violated its first amendment rights.  Adheris, Inc. vs. Sebelius, D.D.C., No. 1:13-cv-1342  In a recently filed joint motion, HHS has indicated that the HHS Secretary has decided “not to enforce the restrictions on remunerated refill reminders and other communications” until November 7, 2013 and plans to issue guidance on what remuneration is allowed to pharmacies by September 23, 2013. Presumably, this new rule will provide bright line guidance on when reimbursement paid to a pharmacy for refills is marketing and when it is not. Stay tuned.

Tags: ,

New Proposed ACA Rules Aimed at Easing "Employer-Mandate" Requirements

POSTED BY MICHAEL GENNETT ON SEPTEMBER 12, 2013

Late last week, the IRS issued proposed rules intended to ease the reporting requirements that employers will face once the "employer-mandate" portion of the Affordable Care Act ("ACA") becomes effective in 2015. The employer-mandate requires that employers with 50 or more full-time employees offer health coverage to those employees or pay a fine. If employers do not provide coverage and have at least one full-time worker receiving government tax credits to buy health insurance, they will be fined $2,000 per full-time worker, excluding the first 30 workers. Even though the employer-mandate has been delayed until 2015, the requirement that all individuals have health insurance still becomes effective on January 1, 2014. 

The proposed rules are aimed, in part, at addressing concerns that reporting procedures for employers are overly complex. The proposed rules would, among other things, relieve employers from having to determine whether employees are full-time so long as adequate coverage is offered to all "potentially full-time employees." They would allow employers to report healthcare information on their employees' W-2 tax forms, rather than requiring a separate form. Employers would also have to report costs for providing health insurance only if the cost is above a specific threshold dollar amount. The proposed rules are subject to public comment, and may be changed when ultimately finalized. Comments are due by November 8, 2013 and can be posted electronically.

Tags:

Florida Board of Pharmacy Approves the Centralized Prescription Filling Rule (Central Fill Pharmacy) for Hospital Pharmacies

POSTED BY MARTIN R. DIX ON SEPTEMBER 9, 2013

On August 14, 2013 the Florida Board of Pharmacy voted to approve central fill pharmacy in a hospital setting. Centralized prescription filling or "central fill" is where two pharmacies separate the duties and responsibilities of dispensing a prescription. Generally, one pharmacy will receive the prescription and send it to, or share it with, another pharmacy with which it has an ownership or contractual relationship. The second pharmacy will then fill the prescription.

The draft rule was brought before the Board earlier this year by Akerman attorneys on behalf of Adventist Health System with support of several hospitals and the Florida Society for Health-System Pharmacists. The rule, to be published as an amendment to the existing central fill rule (Rule 64B16-28.450, FAC), will allow the hospitals to formulate a policy and procedure manual addressing the central fill arrangement. The existing requirements of the centralized prescription filling statute, including common ownership or a contractual relationship, still apply. The draft rule must complete the rulemaking process before it is adopted and becomes effective, but so far there has been no opposition to the draft rule, and it is expected that the rule will be adopted.

The approval of the rule language allowing central fill has a long history. The statute allowing central fill pharmacy, Section 465.0265, FS, was enacted in 2002 and does not differentiate among the types of pharmacies that can engage in central fill. However, the primary impetus for the passage of the statute and the initial rule was to allow community pharmacies to engage in centralized prescription filling. In discussions with Board of Pharmacy staff in late 2010, they would not say whether the Board interpreted the statute such that hospital pharmacies could engage in central fill, and they asked that the issue be brought before the Board. For that reason, Akerman filed a petition for declaratory statement later that year requesting that the Board formally approve a hospital central fill arrangement proposed by Orlando Health.

In 2011, the Board heard the petition, but indicated that it was unwilling to approve it; primarily because the Board's rule at that time was focused on central fill in a community pharmacy setting and did not specifically address the hospital situation. The Board agreed to undertake rulemaking on hospital central fill. Therefore, Orlando Health withdrew its petition such that the Board could proceed by way of rulemaking. The Board appointed a committee to address the rule and was provided a draft rule to begin this process.  For reasons not entirely clear, the Board never went forward with this project in 2011.

Finally in 2013, the above referenced rule was brought before the Board, assigned to the Rules Committee for review, and approved by both the Rules Committee and the Full Board. We expect that it will be adopted by the end of the year.

 

Beyond Advance Directives: States Consider New Model for End-of-Life Decision Making

POSTED BY SHERYL D. ROSEN ON SEPTEMBER 3, 2013

Sixteen states around the country have implemented a new model of advance directives – the Physician Orders for Life Sustaining Treatment (POLST) paradigm – while 27 more states are considering doing the same.  (View a map here.)  POLST provides health care providers with more concrete guidance when determining whether to provide medical interventions to critically ill patients.  Current advance directives are generally documents executed by the patient, while in the POLST model, the physician sets out the patient's wishes for end-of-life care in a written medical order with greater specificity regarding treatment options.  Because of the physician involvement, it is likely that POLSTs will be created for more patients than currently achieved with advance directives.  

Each state may implement a different POLST form to accomplish these goals.  Many are modeled after the POLST form implemented in Oregon, a leader in the development of POLST. 

Legal changes necessary to implement POLST may vary from state to state.  Implementation could come in the form of new state statutes specifically authorizing POLST, new state regulations, or, as suggested by advocates in Florida, obtaining feedback from relevant state agencies as to whether or not existing state statutes or state constitutions already allow physicians to implement POLST forms.

Tags: , ,

Leased Office Equipment Results in $1.2 million HHS Settlement to Resolve Possible HIPAA Violations

POSTED BY TOM RANGE ON AUGUST 20, 2013

Leasing office equipment can provide businesses with many benefits, such as flexibility, favorable tax treatment, and access to the latest technology. However, leasing can also present an unexpected source of liability for entities covered by the HIPAA Privacy and Security Rules. A recent $1.2 million settlement between the U.S. Department of Health and Human Services (HHS) and a New York non-profit managed care plan highlights the importance of conducting a thorough review of the security risks and vulnerabilities of electronic equipment and systems.

A television network purchased a photocopier that had been previously leased by Affinity Health Plan. The network notified Affinity that the copier’s hard drive contained protected health information (PHI), which was apparently not deleted when Affinity returned the copier to its leasing agent. As required under the HITECH Breach Notification Rule, Affinity filed a breach report with the HHS Office of Civil Rights (OCR) and estimated that almost 350,000 individuals may have been affected by the breach.

As detailed in the August 7, 2013 Resolution Agreement, the OCR’s investigation found that Affinity impermissibly disclosed PHI by failing to erase the hard drives when the health plan returned multiple leased copiers. It also found that Affinity’s security analysis failed to take into account the information on the hard drives and that Affinity neglected to implement policies and procedures to prevent the disclosure of PHI when returning the leased copiers. Although the settlement was not an admission of liability, Affinity agreed to pay HHS $1,215,780 and implement a corrective action plan, which in part required Affinity to use its “best efforts” to locate all the hard drives in the leased copiers it returned and safeguard the PHI on the hard drives.

Equipment that is designed to retain electronic information presents special challenges when it comes to HIPAA compliance. It is readily apparent that laptop computers, smart phones, and flash drives are all devices that can store PHI, but it is probably much less obvious that a copier falls in the same category. This settlement provides an additional 1.2 million reasons to motivate a covered entity to perform a thorough security analysis to identify the risks of impermissible disclosures of PHI and to implement and follow appropriate policies, such as encryption or deletion, to protect against such disclosures. In light of the ever-increasing role that computer technology plays in their daily operations, covered entities need to be increasingly vigilant to ensure that protected health information is not unwittingly released.

Tags:

Topics:  

U.S. Supreme Court tells Hospitals to Say: "Sorry Officer, I need a warrant to draw that patient's blood."

POSTED BY RICHARD T. JONES AND ADAM R. MAINGOT ON AUGUST 19, 2013

On April 17, 2013, the U.S. Supreme Court in Missouri v. McNeely ruled that in drunk-driving investigations where Law Enforcement Officers ("LEOs") can reasonably obtain a warrant before a blood sample can be drawn, the Fourth Amendment mandates they do so.

A.  The Fourth Amendment Protects Against Unreasonable Searches and Seizures

The Fourth Amendment to the U.S. Constitution states it is the "right of the people to be secure in their persons … against unreasonable searches and seizures."  

According to the Court, a warrantless blood draw is reasonable only if it falls within a recognized exception. Unfortunately for LEOs, the mere dissipation of alcohol in the blood stream is not a recognized exception. 

Therefore, LEOs who either: (a) bring a suspected drunk driver to the hospital; or (b) request a blood draw from a patient in emergency room, will need to: 

(1)  provide the hospital staff with evidence of a search warrant; or 

(2)  provide evidence that an exception to the warrant requirement exists. 

B.  What is a Valid Exception to the Warrant Requirement?

According to the Court, a valid exception to the warrant requirement involves in each case the existence of some additional "special facts," such as:

(1)  the LEO was delayed by the need to investigate an accident and transport an injured suspect to the hospital;  or

(2)  a judge cannot be contacted/reached for a warrant; or

(3)  there is some other life or death situation.

C.  How can a Hospital Comply?

Hospitals must review and revise any "legal blood draw" policies to require:

(1)  that someone in charge of the emergency department request to see (and document the existence of) a warrant for the blood draw; or  

(2)  someone in charge of the emergency department speak with a supervisor of the LEO to verify the existence of the "special facts" showing no warrant is needed; and 

(3)  the emergency department supervisor contact the risk management/legal services department or outside legal counsel to determine whether the "special facts" qualify for an exception to the Warrant Requirement.

Not complying with the new requirements is not an option. The time is now to review and revise policies and staff structure in the emergency department.

Tags: ,

EHR Meaningful Use Audits Come to Florida

POSTED BY ELIZABETH F. HODGE AND ARI H. GERSTIN ON AUGUST 15, 2013

As previously reported, the Office of Inspector General (OIG) for the Department of Health and Human Services (HHS) plans to audit healthcare providers that received incentive payments to adopt electronic health record (EHR) technology.  

We have now received reports confirming that certain provider entities have been audited in Florida regarding these EHR incentive payments.  The OIG targets payments made to providers under both the Medicare and Medicaid incentive programs.

The Medicaid auditors are requesting, among other information:

- Basic licensing and enrollment information;

- Excerpts from cost report worksheets and pages;

- Supporting documentation for EHR incentive payments received; 

- EHR Technology and Security Plan for Safeguarding Technology and Patient Information; and,

- Certification information for EHR software.

In addition, the auditors expect that providers have documented their compliance with program requirements via screen shots taken at the time of the provider’s attestation.  We have confirmed that auditors have asked some physicians to return incentive payments if such documentation is not available.  

What can providers do?

1.  Maintain detailed records relating to the implementation of EHR technology (and updates), including all documentation that supports data submitted in connection with the EHR incentive program.

2.  Periodically check the list of certified EHR products to confirm that your EHR technology is still certified.  Some products have been decertified.

3.  Work with compliance counsel to have your compliance program pre-audited to avoid surprises down the road.

 

Tags: ,

Useful Resources