Dorsey Health Law

The United States government has an arsenal of agencies and civil and criminal statutes at its disposal to choose from in investigating and combating healthcare fraud.  A recent federal indictment discussed below exemplifies just how multifaceted government investigations and prosecutions can be.  And organizations need to be prepared to respond to such investigations. Last week, the Department of Justice (DOJ) charged fifteen residents of southern Florida in a kickback and bribery scheme involving two VA Medical Centers (West Palm Beach and Miami).  According to DOJ, ten of the defendants worked in the VA medical centers’ logistics departments and had distinct roles in the scheme to defraud.  DOJ also alleged some of the VA-employee defendants would place fake or inflated orders with supply vendors.  Other VA-employee defendants would then allegedly approve the fake orders and still other VA-employee defendants would allegedly falsely enter the supplies as having been received into the VA computer system.  Once paid by the government, the defendant supply vendors allegedly would send a portion of the ill-gotten proceeds to the VA-employee defendants as  kickbacks.  Four individual supply vendors were charged in the scheme.  And although not directly related to the kickback scheme, another individual supply vendor defendant was charged for making false statements in connection with VA application for companies seeking designation as a “Service Disabled Veteran Owned Small Business” (SDVOSB). The charges against the fifteen individuals and supply vendors illustrate not only how seriously DOJ takes allegations of fraud in the healthcare and government-contracting arena, but also some of the statutory tools Congress has given DOJ to fight such fraud in the healthcare system.  Federal statutes specifically criminalize healthcare fraud and conspiracy to commit healthcare fraud, which generally consists of knowingly and willfully executing (or conspiring to execute) a scheme to “defraud any health care benefit program” or to obtain “any of the money or property owned by, or under the custody or control of, any health care benefit program” by false or fraudulent pretenses.  18 U.S.C. §§ 1347, 1349.  The VA is a “health care benefit program,” 18 U.S.C. § 24(b), and the Anti-Kickback Statute provides stiff penalties, including fines and prison time, for fraud involving “federal health care programs” like the VA, see 42 U.S.C. § 1320a-7b.  Civil fines under the Anti-Kickback Statute also can be imposed per violation, potentially exposing organizations to millions of dollars in liability.  Also the government could have invoked—and may well still invoke—the False Claims Act, 31 U.S.C. § 3729, and its remedy provisions, including treble damages and statutory penalties for each claim submitted by the vendors. Those working in or with the VA system (or healthcare or the U.S. government in general) should take particular care to deter and detect fraud and bribery in their organizations.  In this case, for example, ten employees within the Florida VA medical centers alone are alleged to have participated in the scheme.  Such widespread misconduct may have been prevented—or detected sooner—with adequate policies and reporting procedures, better employee training, or regular and systematic audits.  Regular audits, for example, comparing supply inventory as recorded in VA systems with the actual supply inventory received might have deterred or detected the false purchase orders.  Organizations should regularly review their policies and procedures, as well as internal compliance with those policies and procedures, with legal counsel.  Likewise, annual employee training and certification also would serve to educate employees about the applicable laws, rules and regulations and changes to them, how to spot red flags, the obligation to report and the mechanism for reporting suspected activity and the serious consequences for failure to comply.  Organizations should also review with counsel whether their current practices do or can be adapted to meet one of the many “safe harbors” provided for under the Anti-Kickback Statute regulations. Additionally, the charges for making false statements related to the SDVOSB application are yet another example of the breadth of DOJ investigations and enforcement tools.  Federal law broadly criminalizes making certain misrepresentations or omissions “in any matter within the jurisdiction of the executive, legislative, or judicial branch,” see 18 U.S.C. § 1001, which includes government-contracting applications submitted to executive branch agencies like the VA.  So even where a government contractor may not have participated in the criminal conduct being directly investigated (which, here, was the alleged kickback scheme), the scope of DOJ’s investigation can creep into other areas (such as representations on government-contracting applications) which place that government contractor in serious legal jeopardy.  Government contractors should therefore seek legal counsel before and while participating in any DOJ investigations.  Government contractors should also, as a preventative measure, seek legal counsel related to the representations they make on government applications so that they do not make misrepresentations in the first place. Staying compliant with the laws, rules and regulations governing healthcare providers, vendors, and suppliers requires diligence and vigilance.  In this ever changing and complex landscape companies and their employees must be pro-active in their efforts to combat fraud and to respond to governmental inquiries and investigations.

Following the passage of the Affordable Care Act (“ACA”), which placed new limits on physician-owned hospitals, St. Luke’s Health System (“System”) took action to change one of its hospital’s ownership structures through a buy-out of the physicians’ partnership interests pursuant to the Texas Securities Act (“TSA”). The TSA allows rescission for the original price paid for a security, plus interest, in exchange for a release of potential liability under TSA. Three of the physician-owners, who resisted the System’s attempt to rescind their ownership interests, sued the System and other defendants in connection with the buy-out alleging state-law violations and violations of the Anti-Kickback Statute, and by extension, the False Claims Act. To read the full article, view our FCA Now blog, linked here:  

On September 5, 2019, the Centers for Medicare & Medicaid Services (“CMS”) issued a final rule (“Final Rule”) effective November 4, 2019, which increases disclosure requirements for the provider and supplier enrollment and revalidation process. The Final Rule is aimed at increasing the information provided to CMS in enrollment and revalidation to identify fraud, waste, and abuse, and expanding CMS’s authority to deny, revoke, or delay a provider’s or supplier’s ability to participate in Medicare, Medicaid and CHIP based on a provider’s or supplier’s relationship with previously sanctioned entities.  The Final Rule revises several existing regulations and adds an onerous regulation titled “disclosure of affiliations,” at 42 C.F.R. § 424.519. This new disclosure requirement mandates that, at the time of reenrollment or revalidation, each provider and supplier must list all “disclosable events” for each “affiliation” within the past five (5) years, even if the provider/supplier is not affiliated with such person/entity at the time of enrollment or revalidation. This new requirement is greatly expanded from the previous disclosure requirement, where providers/suppliers were only required to disclose their own adverse actions. A provider or supplier must disclose its affiliations that have one of the following “disclosable events”: Currently has an uncollected debt to Medicare, Medicaid or CHIP; Has been or is subject to a payment suspension under a federal health care program; Has been or is excluded by the Office of the Inspector General from participation in Medicare, Medicaid, or CHIP; or Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated. 42 C.F.R. § 424.502. Note that on the last disclosable event, the Final Rule could be interpreted to require disclosure of any enrollment denial, including billing privileges and arguably denials of Change of Ownership or Change of Location requests. Moreover, CMS articulated a broad definition of “affiliations” which means, in relation to the provider/supplier, any individual or entity that holds: A five (5) percent or greater direct or indirect ownership interest; A general or limited partnership interest (regardless of the percentage); An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization regardless of an employment relationship; An officer or director position; or Any reassignment relationship (e.g., reassignment of billing rights). 42 C.F.R. § 424.502.   CMS may revoke privileges if a provider or supplier knew or reasonably should have known about an affiliate’s disclosable events. CMS declined to provide an objective standard to such a knowledge requirement, but provided that a provider/supplier must make a “sufficient effort” when evaluating whether an affiliate has a disclosable event that such provider/supplier must report.  Such an effort could  include the provider/supplier directly contacting the affiliate, and potentially mining historical data, not just publically available data. In the context of complex legal structures including publicly owned companies or private equity-backed providers, CMS’s definition of affiliation can quickly result in a time-consuming process of review.  The disclosure requirements in the Final Rule apply to all providers and suppliers, but only at time of initial enrollment and revalidation, which is a significant improvement from the proposed rule (which, if adopted, would have required disclosures for change of ownership and change of information filings). Once an affiliation is disclosed to CMS, CMS will require additional information about the affiliate, the relationship, and the disclosed adverse information, and will conduct an analysis of whether such affiliation presents an “undue risk” of fraud, waste, and abuse to the Medicare Program, such that the disclosing provider/supplier’s billing privileges should be denied or revoked. Recognizing that compliance with this Final Rule will be an arduous task for a large number of providers and suppliers, CMS adopted a “phased in” approach. First, CMS will require disclosure of affiliations only when specifically requested by CMS. CMS will then implement new CMS-855 forms (which will also go through a separate notice and comment period), and will issue subregulatory guidance on the new forms and disclosure requirements. Only then will providers and suppliers be required to comply with the disclosure requirements during initial enrollment and revalidation.  It is expected that the “phased-in” approach could extend over the course of the next few years, and in the second phase, may initially only require compliance by certain providers/suppliers. Even though the immediate impact of the disclosure requirements is limited, providers and suppliers should understand the extensive scope of the new requirement and understand what steps will need to be taken to review in detail their affiliations, both past and present, once the complete scope of the disclosure requirements are officially implemented.   If you have further questions about this Final Rule, please contact the authors or your regular Dorsey attorney.   The Final Rule on the new disclosure requirements can be found on the website of the Federal Register here.    

In the calendar year 2020 Medicare physician fee schedule final rule (“PFS”), which was published in the Federal Register on November 15, 2019 (available here), CMS finalized changes to the advisory opinion process under the federal physician self-referral law (“Stark Law” or “Stark”).  CMS also published its annual update to CPT/HCPCS codes used to identify certain categories of Stark designated health services (or “DHS”).  These regulatory changes and annual code update both go into effect on January 1, 2020. Finalized Changes to Stark Advisory Opinion Regulations Under the CMS advisory opinion process, the regulations for which are found at 42 C.F.R. §§ 411.370–389, parties can seek an advisory opinion from CMS as to whether a referral for DHS (other than clinical laboratory services) is prohibited under the Stark Law.  CMS determines in the opinion whether an arrangement constitutes a “financial relationship” that would implicate the Stark Law’s referral prohibition and whether the arrangement or the referred service qualifies for a Stark Law exception.  CMS issued a Request for Information (“RFI”) in June 2018 as part of the “Regulatory Sprint to Coordinated Care” about ways CMS could modify the Stark Law regulations in order to reduce barriers to patient care coordination and value-based arrangements and to reduce the regulatory burden of complying with the Stark Law generally, which we wrote about here.  CMS did not specifically solicit comments regarding the Stark advisory opinion process in the RFI, but CMS received a number of comments about ways that the Stark advisory opinion process could be improved.  CMS explains in preamble to the PFS that it “undertook a fresh review” of the advisory opinion process in light of the comments it received to “identify limitations and restrictions that may be unnecessarily serving as an obstacle to a more robust advisory opinion process.” CMS also recently issued sweeping proposed Stark Law regulatory changes as part of the Regulatory Sprint to Coordinated Care on topics related to the RFI, which we wrote about in a white paper available here.  While the changes to the advisory opinion regulations do not directly relate to the shift to a value-based health care delivery system, CMS acknowledges in preamble to the PFS that “a faster and more robust advisory opinion process facilitates the shift to value-based care arrangements by providing more guidance for parties trying to understand how the physician self-referral law applies in an evolving and innovative marketplace. This will help to reduce provider burden by providing insight into what does and does not comply with the law, which encourages innovation.” Since the initial advisory opinion regulations were issued in 1998, CMS has only issued 16 advisory opinions, which are available here.  (CMS also issued 15 advisory opinions from 2004-2005 during the 18-month moratorium on physician ownership and investment interests in specialty hospitals that was in effect at that time, which are available here.)  In contrast, the Department of Health and Human Services (“HHS”) Office of Inspector General (“OIG”), which has a separate advisory opinion process for the federal anti-kickback statute (“AKS”) and certain other laws, issued 14 advisory opinions in calendar year 2018 alone (available here).  In preamble to the PFS, CMS recognizes the importance of an accessible advisory opinion process and acknowledges that the current advisory opinion process has not been widely used.  An accessible advisory opinion process is particularly important in the context of the Stark Law, since it is a strict liability statute, and there is a great need for certainty because, as CMS acknowledges, “parties that act in good faith may nonetheless face significant financial exposure if they misunderstand or misapply the law’s exceptions.” We anticipate that the changes to the advisory opinion process may indeed help to make the process more meaningful and accessible to entities that are seeking to understand if their arrangement complies with the Stark Law, particularly due to CMS’s broadening of how advisory opinions can be relied upon (as described below).  If you are interested in submitting an advisory opinion request, or for advice on whether and how you can rely on a published advisory opinion in assessing an arrangement for compliance with the Stark Law, please contact the authors or your regular Dorsey attorney. The most notable changes to the advisory opinion regulations in the PFS are the following: Reliance on an Advisory Opinion: Under existing Stark regulations, only the individual or entity that requested the advisory opinion may rely on the opinion. In the PFS, CMS finalizes revisions to regulations to specify the following:An advisory opinion is binding on the Secretary of HHS, and a favorable advisory opinion means that sanctions will not be imposed under the Stark Law with respect to individuals/entities that are parties to the arrangement upon which the opinion was issued (as well as the individuals/entities that requested the opinion). The Secretary of HHS will not pursue sanctions under the Stark Law “against any party to an arrangement that CMS determines is indistinguishable in all its material aspects from an arrangement with respect to which CMS issued a favorable advisory opinion.” Parties can submit an advisory opinion request to determine whether CMS would view their arrangement as “indistinguishable in all material aspects” from another arrangement that has received a favorable opinion, which will be issued by CMS on an expedited basis (as explained below). Individuals/entities can rely on advisory opinions “as non-binding guidance that illustrates the application of the physician self-referral law and regulations to the specific facts and circumstances described in the advisory opinion.” CMS acknowledges that stakeholders already use advisory opinions to inform their decision-making, and this change is intended to make clear that “such reliance is permissible and reasonable.” Timeline for Issuing an Advisory Opinion:Under existing regulations, CMS currently has a 90-day timeframe to issue an advisory opinion. CMS finalizes its proposed changes to the regulatory text to shorten this to 60 “working days” (where “working day” excludes weekends and holidays) after the request has been formally accepted.  CMS maintains the discretion it has in existing regulations to extend this time period when a request involves “complex legal issues of first impression or highly complicated fact patterns” and to suspend the time period in certain circumstances. CMS finalizes revisions to regulations to provide for expedited review of advisory opinion requests that relate to whether an arrangement is “indistinguishable in all material aspects” from an arrangement that was the subject of a favorable advisory opinion. The expedited review period will be 30 working days. Fees for the Cost of Advisory Opinions: CMS finalizes revisions to regulations to revise the fee structure for advisory opinions. Specifically, the $250 initial fee is removed and a $220 hourly rate is implemented. In the PFS, CMS also finalizes its proposed changes to the advisory opinion regulations in the following areas (among others): Matters Subject to Advisory Opinions:CMS finalizes revisions to regulations to allow CMS to consider advisory opinion requests that “relate to” existing or planned arrangements, rather than requests that “involve” them, which is intended to capture the scope of appropriate advisory opinion requests. CMS explains that it remains its position that advisory opinion requests cannot be regarding only “hypothetical facts or general questions of interpretation,” but must be about a specific referral, physician, financial relationship and facts/circumstances. CMS does acknowledge, however, that there is some confusion over what is a planned arrangement versus a hypothetical arrangement, so is removing this language from the advisory opinion regulations.  It also revised the regulatory text to reflect its view that a request for an advisory opinion would not be accepted if the claim could not be billed to Medicare for some reason unrelated to the Stark Law. CMS finalizes revisions to regulations to allow CMS more flexibility related to advisory opinion requests that involve conduct that is “substantially similar to conduct that is under investigation or is the subject of a law enforcement proceeding.” Certification Requirement: CMS finalizes revisions to regulations to allow for any authorized officer of the corporation to sign the certification statement, in addition to the Chief Executive Officer. Rescission: CMS finalizes revisions to regulations related to when CMS may rescind an advisory opinion, which is when CMS determines that there is good cause to do so. “Good cause” exists when “(i) there is a material change in the law that affects the conclusions reached in an opinion; or (ii) a party that has received a negative advisory opinion seeks reconsideration based on new facts or law.”  CMS declines to adopt a minimum wind-down period in regulatory text for arrangements that are the subject of a rescinded advisory opinion, and states that it will work with parties affected by a rescinded opinion to determine a reasonable wind down period.  CMS also finalizes regulatory changes to provide for an advance notice to the requestor and the public of a rescinded opinion. 2020 DHS Code List and CPI-U Updates The PFS also includes the annual update to the list of CPT/HCPCS codes used to identify certain categories of DHS (the “Code List”).  As we explained in prior posts (such as this one), the Stark Law regulations at 42 C.F.R. § 411.351 specify that the following four categories of DHS are defined by reference to the Code List: (1) clinical laboratory services; (2) physical therapy, occupational therapy, and outpatient speech-language pathology services; (3) radiology and certain other imaging services; and (4) radiation therapy services and supplies.  The Code List is updated annually to reflect changes in the most recent CPT and HCPCS Level II publications. Further, items and services that may qualify for either of two Stark Law exceptions—the exception for preventive screening tests, immunizations and vaccines at 42 C.F.R. § 411.355(h) and the exception for EPO and other dialysis-related drugs at 42 C.F.R. § 411.355(g)—are identified by reference to the Code List.  The Code List included the annual updates to the codes eligible for the preventive screening tests, immunizations and vaccines exception.  However, as in previous years, the Code List does not include any codes eligible for the EPO and other dialysis-related drugs exception (for reasons explained by CMS in the rule).  The PFS rule includes tables showing the additions and deletions to the Code List.  We expect that, as per usual, the complete list will be posted before the end of the year to the CMS Stark website dedicated to the Code List, found here. We also expect that the CPI-U Updates page of the CMS Stark website, found here, will be updated before the end of the year to reflect the new compensation limits for the nonmonetary compensation exception (at 42 C.F.R. § 411.357(k)) and medical staff incidental benefits exception (at 42 C.F.R. § 411.357(m)), which are both updated annually for inflation.

The Centers for Medicare and Medicaid Services (CMS) has issued a final rule to require every hospital licensed in the United State to make public a robust set of standard charges for every item or service that the hospital bills.  In addition, CMS and other agencies have issued a proposed rule to require group health plans and health insurance issuers to: (1) disclose in-network negotiated rates and out-of-network allowed amounts for every health care item or service; and (2) offer a real-time tool to provide a plan enrollee with an estimate of cost-sharing and out-of-pocket expenses associated with plan covered items and services. The hospital price disclosure rule is effective January 1, 2021.  Hospitals and hospital trade associations have stated that they will bring a legal challenge against the final rule as exceeding CMS’ legal authority. The rule will require every licensed hospital to provide two separate sets of standard charge lists: (1) a list of standard charges for at least 300 “shoppable” hospitals services that a consumer can schedule in advance; and (2) a comprehensive list of standard charges for all items and services for which the hospital establishes a charge.  Both lists must be updated at least annually and placed on a publicly-accessible website.  Only hospitals are regulated under the final rule; ambulatory surgery centers or other clinics or facilities that may provide items and services that are also performed in hospitals are not required to report pricing. For the comprehensive charge list the hospital must report seven data elements for each item or service: (1) description; (2) code used to bill the item or service; (3) hospital’s gross charge; (4) negotiated rate with every third party payer (linked by name to the third party payer and plan); (5) highest charge the hospital has negotiated with any third party payer; (6) lowest charge the hospital has negotiated with any third party payer; and (7) charge applicable to an individual who pays cash.  The “shoppable” charge list must include similar data elements, with the addition of the hospital location(s) at which the “shoppable” service is provided.   The resulting report will be an exceedingly dense data set of hundreds of thousands of line items for a typical hospital. The biggest change the final rule would effect is that payment rates that a hospital negotiates with third party payers would no longer be confidential or proprietary, and would in fact be public information under the final rule. CMS made clear that a hospital must report data on all items or services the hospital provides and charges, including the professional services of its employed physicians or other clinicians.  This appears to apply only to the hospital itself (presumably identified by NPIs associated with the hospital) and not to separate corporate entities, formed for the purpose of operating physician group, that do not operate the hospital but may be owned by the same entity (or corporate affiliate) that operates the hospital. The health plan proposed rule would require every group health plan or health insurance issuers to make available on a website a negotiated rate file that lists: (1) the name and Employer Identification Number (EIN) or Health Insurance Oversight System (HIOS) identifier for each plan option or coverage offered; (2) codes and plan language description for each item or service; and (3) negotiated rate for each item or service furnished by every in-network provider (linked by National Provider Identifier (NPI) to each in-network provider) along with the last date of contract term for that rate.  A separate file that lists out-of-network allowed amounts for each items or service furnished by out-of-network providers must also be posted.  These lists must be updated monthly under the proposed rule. In addition, health plans must offer a tool to allow plan enrollees to obtain real-time information about cost-sharing information with regard to specific items or services. Unless halted by courts, hospitals will need to begin the considerable work of compiling and formatting the data files required under the final rule.  And, although it is unclear how the hospital pricing data will be analyzed and used (and by whom), hospitals should analyze their own pricing data and begin anticipating and preparing for the questions and critiques that will arise.

This post is an update from our earlier blog post, available here, on the bellwether federal opioids trial in the Northern District of Ohio.  Just hours prior to the start of the trial in a consolidated case involving two plaintiff counties in Ohio, all of the remaining defendants in the case, except Walgreens, reached a settlement.  In the settlement, distributors, McKesson, Cardinal Health and AmerisourceBergen (distributors of approximately 90% of all prescription medications) will pay $215M to Cuyahoga and Summit Counties in Ohio.  A manufacturer, Teva, will pay $20M in cash over three years and will donate $25M worth of Suboxone, an addiction treatment medication.  Several manufacturers who were originally named defendants in these two consolidated cases previously settled out of the cases.  Judge Polster, the federal judge who has overseen the multi-district litigation (“MDL”), announced that Walgreens would face a separate trial focusing on its role as a dispenser.  There are more than 2,000 cases filed in the MDL by states, counties, cities and tribes which Judge Polster has been overseeing for more than two years.  The remaining cases involve manufacturers, distributors and large pharmacy chains.  Lawyers involved in the cases have expressed hope that the recent settlement could encourage other cases in the MDL to settle as well, although one of the most significant hurdles has been a dispute about how any settlement money would be distributed among the plaintiffs, as well as who would control the use of the settlement funds going forward.

In the last several years, thousands of cities and counties, as well as most states, have sued various combinations of pharmaceutical manufacturers, retailers, and distributors for damages allegedly caused by the opioid epidemic.  Nearly 2,000 of those cases have been consolidated into a multi-district litigation (“MDL”) in the Northern District of Ohio. Until very recently, defendants in the MDL had not revealed how they intended to argue against the charge that they caused or contributed to the opioid crisis.  But with the first trial set to begin on October 21, 2019, the defendants recently submitted their trial briefs, which provide a sneak peek at the factual and legal arguments they intend to raise at trial.  Among other alleged causes, defendants have pointed to corrupt doctors, criminal cartels, and even local governments. For example, one drugmaker stated that it “fully recognizes the opioid crisis that exists in this country” but suggested that alternative causes such as public policy failures and illicit drug use drove the opioid crisis.  More specifically, the defendant stated: [P]ervasive diversion and abuse of oxycodone and hydrocodone pills, unscrupulous doctors and internet pharmacies operating as drug-trafficking organizations, foreign criminal cartels that flooded the country with heroin and fentanyl illegally made in clandestine labs, and state and federal governments that struggled to ensure patients had access to necessary medications while addressing long-known problems of abuse, misuse, diversion, and overdose. (Doc. No. 2633 at 8.) Another drugmaker alleged that rather than blaming defendants, the plaintiffs—i.e., two counties in Ohio—“should be examining their own actions and inaction—which directly contributed to the opioid abuse problem in the United States.”  (Doc. No. 2669 at 9.)  As an example, the defendant argued that “the Counties continue to reimburse for opioid prescriptions for chronic pain today, thereby influencing what gets prescribed and dispensed to patients—and confirming (against their very own foundational theory in this case) that opioid prescriptions may be appropriate for chronic pain.”  (Id.) Similarly, an opioid distributor believes the opioid crisis was caused by “innumerable actors not before the Court, ranging all the way from well-intentioned prescribing doctors to criminal drug dealers and heroin traffickers.”  (Doc. No. 2643 at 4-5.) Another distributor suggested that plaintiffs in the MDL overlook the “role of criminal drug cartels and other actors in the illegal opioid market.”  (Doc. No. 2659 at 4.) Finally, yet another distributor argued that alternative causes of the opioid crisis preclude recovery in the MDL.  This defendant argued that under City of Cleveland v. Ameriquest Mortg. Secs., Inc., 615 F.3d 496 (6th Cir. 2010), the presence of “independent actors between the alleged misconduct and the alleged injury” compel the conclusion that plaintiffs’ claims here are “too indirect to warrant recovery.”  Ameriquest, 615 F.3d at 506.  The defendant attempted to distance itself from defendants occupying other roles in the chain of distribution by stating that it “does not make opioids available to patients,” and instead, a “patient can obtain opioids only after a doctor makes an independent decision to write a prescription and a pharmacist makes the independent decision to fill the prescription.”  (Doc. No. 2667 at 8.) All the finger-pointing between and among plaintiffs and defendants emphasizes what has been increasingly clear as the first MDL cases approach trial; it will take a Herculean effort by the courts (and juries) to sort through the medical, social, political, and economic issues that are intertwined with the opioid crisis.  The breadth of the problem even raises the question of whether jury trials are the right tools to address social crises of this magnitude and complexity.  Indeed, some studies place the national economic burden of the opioid crisis at $78.5 billion, with over 35,000 people dying annually for drug overdoses related to opioids. U.S. District Judge Dan Polster, who presides over the MDL cases, bluntly emphasized these complex challenges in recent comments: [E]veryone shares some of the responsibility, and no one has done enough to abate it.  That includes the manufacturers, the distributors, the pharmacies, the doctors, the federal government and state government, local governments, hospitals, third-party payers and individuals.  Just about everyone we’ve got on both sides of the equation in this case. The federal court is probably the least likely branch of government to try and tackle this, but candidly, the other branches of government, federal and state, have punted.  So it’s here.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Joseph Lynyak, Robert Cattanach, Jamie Nafziger and Erin Bryan for the following e-newsletter update: 1. Introduction On October 11, 2019, the California Attorney General (the “California AG”) issued draft regulations (the “Draft Regulations”) pursuant to his authority under the California Consumer Privacy Act of 2018 (“CCPA”).1 The publication of the Draft Regulations commences the public comment period during which numerous interpretative issues relating to the implementation of the CCPA hopefully will be addressed and resolved. Unfortunately, the California AG chose to limit the Draft Regulations to basic process issues relating to the overall structure of the CCPA, and elected not to address many of the more difficult compliance problems identified by industry participants. More troubling is the inclusion of additional procedural steps that a covered “business”2 must follow when complying with “requests” for “personal information”3 (“PI”). (If ultimately adopted, several of these additional compliance obligations could likely create technical and unintended violations of the CCPA.)4 This Alert provides an initial analysis of the approach taken by the Draft Regulations, as well as suggestions for participating in the rule-making process.5 2. Discussion Analysis of the Draft Regulations The Draft Regulations were issued by the California AG pursuant to authority delegated to him by Section 1798.185 of the CCPA. Notwithstanding the fact that the Draft Regulations are proposals and not yet final, the Draft Regulations establish a “backbone” based upon which covered businesses may begin to evaluate whether their implementation and compliance programs appear reasonable. The Draft Regulations are comprised of seven “Articles”; Articles 1 and 7 contain definitions and a severability clause, whereas Articles 2 through 6 are the implementing provisions of the CCPA, and address: The notification process by covered business to California “consumers” of their rights under the CCPA6 The processing of “verifiable consumer requests”7 The verification of identify for consumer requests8 Special rules for minors’ PI,9 and Determining value to comply with the anti-discrimination provisions of the CCPA Articles 2 through 6 of the Draft Regulations will be addressed separately below. A. General In numerous provisions scattered across Articles 2 through 6, the Draft Regulations establish varying degrees of care that must be exercised by a business when dealing with a consumer, including identifying the consumer, evaluating the sensitivity of a consumer’s request, and responding in a manner that protects a request for data or to delete PI.10 In addition, borrowing from federal consumer law that consumer disclosures be “clear and conspicuous,” among other things required notices must be easily understood, formatted, and accessible to consumers, and provided in the languages in which a business interacts with consumers.11 From a drafting perspective, the Draft Regulations intentionally conflate non-internet-based business operations with partial or sole internet contact between businesses and consumers by interrelating and cross-referencing CCPA obligations. This approach (which may be necessary for brevity’s sake yet nevertheless complicated) will require businesses to carefully parse through the Draft Regulations’ compliance mandates in order to identify various subcategories of business models that might apply and may require differing compliance obligations. B. The Notification Process of a Consumer’s Rights Article 2 sets forth several disclosures that have to be prepared and provided by a business to a consumer. It is by far the most instructive of the five Articles, and indicates the content that must be included in disclosures provided to consumers. Article 2 of the Draft Regulations sets forth general principles when providing a disclosures of how a business collects PI, and indicates that a notice must contain the following information: A list of the categories of PI about consumers to be collected, For each category of PI, the business or commercial purpose(s) for which it will be used, If the business sells PI, the link titled “Do Not Sell My Personal Information” or “Do Not Sell My Info,” and A link to the business’s privacy policy.12 Article 2 imposes an expanded disclosure requirement when describing categories of PI, including a requirement that a business explain the business or commercial purpose for which PI will be collected. Further, a specific prohibition states that if a business intends to expand the scope of PI being collected, it must first provide a new disclosure to the consumer (which confirms that a new disclosure process must be undertaken by a business).13 Article 2 addresses several subcategories of notices that must be provided. For example, Article 2 addresses the notice that has to be provided regarding the right of a consumer to “opt-out” of the sale of PI (assuming an exception does not apply).14 Depending upon the nature of the contact between the business and the consumer, a notice of a consumer’s opt-out right must include the following: A description of the consumer’s right to opt-out of the sale of their PI, The web-based form by which the consumer can submit their request to opt-out online (or, if the business does not operate a website, the offline method by which the consumer can submit their request to opt-out), Instructions for any other method by which the consumer may submit their request to opt-out, Any proof required when a consumer uses an authorized agent to exercise their right to opt-out, and A link or the URL to the business’s privacy policy (or, in the case of a printed form containing the notice, the URL of the webpage where consumers can access the privacy policy).15 Another subcategory of notice and disclosure is a notice of financial incentives that describes the incentive being offered, the material terms of the financial incentives and the right of the consumer to withdraw at any time. Finally, Section 999.308(b) the Draft Regulations requires a detailed and expanded description of a businesses’ privacy policy. The privacy policy must be posted on a business’s website (or posted in a conspicuous place if the business dose not operate a website), and must include: The right to know about the collection, disclosure and sale of PI, The right to request deletion of PI, The right to opt-out of the sale of PI, The right to non-discrimination for the exercise of a consumer’s CCPA rights, The use of an authorized agent, A contact for additional information, The date the business’ privacy policy was last updated, and If Section 999.317(g) of the Draft Regulations applies, the metrics required or a link to it.16 C. The Processing of Verified Consumer Requests by Covered Business Article 3 of the Draft Regulations contains a somewhat complicated set of requirements that vary depending upon the mode of conducting business between a business and a consumer. As an initial matter, the Draft Regulations indicate that a business must provide two or more methods for submitting requests to know about PI, which must include a toll-free telephone number, along with several other acceptable methods that may be employed. However, while a request to delete PI must include two permissible methods of making the request, a toll-free number (while permissible) is not mandatory.17 Importantly, any method for making a request must “reflect the manner in which the business primarily interacts with a consumer.”18 If a consumer makes a request that is not a designated methodology selected by the business, the business may choose to treat the request as having been made through a proper channel, or else must contact the consumer and provide specific directions to submit a request properly.19 Following the receipt of a request to know or a request to delete, the Draft Regulations add a new procedural step that is not included in the statutory language of the CCPA—which is a requirement within 10 days of the receipt of a request the business must notify the consumer that the request has been received and how the request will be processed. (It appears that this new 10-day notice falls within the CCPA statutory deadline of 45 days to respond and up to a maximum of 90 days20.)21 The Draft Regulations contain detailed instructions for responding to requests to know and request to delete—the emphasis is placed on verification of the identification of the consumer. If verification is not possible, a business may decline to respond to the request, but must notify the consumer that the denial was based upon the failure to properly identify the consumer. In the instance in which the consumer has a password-protected account with a business, the business may provide a secure portal for retrieving the requested data. In regard to a request to opt-out, a business must provide two alternative methods to submit a request to opt-out, including a mandatory interactive web-based form using a link entitled “Do Not Sell My Personal Information,” or “Do Not Sell My Info” on the business’s website or mobile application.22 (Other alternative methods include a toll-free number, a designated email address, a form submitted in person, or an electronic mechanism to indicated the consumer’s choice to opt-out.) A business may offer a consumer the option to opt-out of sale of certain categories of PI, provided that the opt-out of the sale of all information is more prominently displayed. A request to opt-out must be acted upon within 15 days of the business’s receipt of the request.23 Record retention for compliance is set at 24 months (although retention of requests may by necessity be longer if an exemption is asserted, such as the retention of PI based upon the length of an applicable statute of limitations or threat of litigation being brought against a business for non-compliance). D. Verification Alternatives for Properly identifying a Consumer Article 4 of the Draft Regulations create a sliding scale of consumer verification standards based upon the sensitivity of PI being requested. Factors include: The type, sensitivity, and value of the PI collected and maintained about the consumer (i.e., sensitive or valuable PI requires more stringent verification processes), The risk of harm to the consumer posed by any unauthorized access or deletion, The likelihood that fraudulent or non-authorized individuals are seeking the PI, Whether the PI is sufficiently robust to protect against fraudulent requests or being spoofed or fabricated, The manner in which the business interacts with the consumer, and The availability of technology for verification. In the case of a customer that holds a password-protected account with a business, the business may require the customer to verify the customer’s identity through the account. However, if a request is made, the business must also require that the customer reverify the customer’s identification before disclosing or deleting PI.24 The Draft Regulations establish a sliding scale of verification steps depending upon whether a request is made for categories of PI or specific items of PI. In the case in which a consumer has a password-protected account with a business, the business may employ its existing verification procedures when responding to a consumer’s request. In the case of a request to identify categories of PI when a consumer either does not have a password-protected account or no account with a business, the a business must identify a consumer with a “reasonable degree of certainty”—which is defined to mean matching a consumer with at least two data points of identification. In the case a consumer either does not have a password-protected account or no account with a business and specific items of PI are requested, the standard for verification is a “reasonably high degree of certainty”—which is defined to mean at least three pieces of PI provided by the consumer plus a verification signed by the consumer under penalty of perjury.25 Article 4 also identifies several steps that a business should undertake to verify a consumer’s identity, based upon the factual matter whether the consumer has an account with the business. This combination of qualitative and quantitative factors may require individual attention to a consumer’s request, and in any event may present challenges for developing automated response applications.26 In the case of a request to delete PI, the Draft Regulations would require that the standard and verification methodology would vary depending upon the sensitivity of the PI and the risk of harm to the consumer. Finally, when a consumer employs an agent to make a request, the business may require that the authorization be made in writing and that the consumer verify his/her identity directly with the business. E. Protection of Minors and Their PI Article 4 of the Draft Regulations is relatively straightforward in regard to a business obtaining the consent of a parent of a child for the child’s PI below the age of 13, but requires that the parent (or guardian) adequately verify the status of the parent or guardian. Verification alternatives include: Providing a consent form to be signed by the parent or guardian under penalty of perjury and returned to the business by postal mail, facsimile, or electronic scan, Requiring a parent or guardian, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder, Having a parent or guardian call a toll-free telephone number staffed by trained personnel, Having a parent or guardian connect to trained personnel via video-conference, Having a parent or guardian communicate in person with trained personnel, and Verifying a parent or guardian’s identity by checking a form of government-issued identification against databases of such information.27 Unfortunately, Article 5 is silent in regard to any process by which a business might reasonably identify that a minor is communicating with the business. Whether the business can rely upon parental oversight of a minor’s use of the internet is not addressed.28 F. Complying with the anti-discrimination provisions of the CCPA Section 1798.125 of the CCPA prohibits a business from discriminating against a consumer because the consumer exercised a privacy right conferred by the CCPA, such as by opting-out from the sale of PI. However, a business may offer a price or service differential for not exercising CCPA rights if it is reasonably related to the value of the consumer’s PI. Article 6 of the Draft Regulations requires that, when setting a price differential, a business must use one of the following valuation methodologies: The marginal value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data, The average value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data, Revenue or profit generated by the business from separate tiers, categories, or classes of consumers or typical consumers whose data provides differing value, Revenue generated by the business from sale, collection, or retention of consumers’ PI, Expenses related to the sale, collection, or retention of consumers’ PI, Expenses related to the offer, provision, or imposition of any financial incentive or price or service difference, Profit generated by the business from sale, collection, or retention of consumers’ PI, or Any other practical and reliable method of calculation used in good-faith.29 The quantification and justification of a value may prove to be problematic to businesses when used to support differing pricing between consumers exercising or not exercising CCPA rights. For example, in the case of a business that employs voluminous data sets, revenue generated by individual consumers may be difficult to correlate a pricing differential that is more than nominal. Further, whether supportive economic evidence is necessary may present a cost factor that smaller businesses may find unrealistic. Providing Input During the Public Comment Period When issuing the Draft Regulations for public comment, the California AG announced that his office would be holding hearings December 2nd in Sacramento, December 3 in LA, December 4th in San Francisco and on December 5th in Fresno. Comments on the Draft Regulations can be provided at those hearings, via mail or via e-mail. Observations The Draft Regulations add new obligations and varying qualitative standards for compliance that  may present practical compliance difficulties to covered businesses. Although the process and disclosure clarifications provide a clearer roadmap when preparing a project plan for compliance, efforts will have to be undertaken to ensure that a business’s policies and procedures include the numerous compliance obligations set forth in the Draft Regulations analyzed herein. While as noted above the Draft Regulations attempt to provide a compliance structure for CCPA notices and processing of requests from consumers, the primarily failure of the Draft Regulations is the failure to address reliable interpretations of unresolved issues set forth in the CCPA, such as the various exemptions contained in the CCPA. This may mean that businesses seeking to make use of exemptions or partial exemptions will be forced to submit focused interpretative requests to the California AG. (Whether the California AG will be responsive to requests for interpretations remains to be seen.) The proposed inclusion of non-statutory response times and qualitative standards discussed herein are particularly problematic and could be the subject of a challenge by industry stakeholders that may determine that compliance with these additional requirements is unrealistic and beyond the delegated authority of the California AG.  Additionally, industry stakeholders are likely to raise concerns about the proposed requirement that businesses treat user-enabled anti-tracking privacy controls as equivalent to a verifiable opt-out request. Finally, as is frequently the case, completely new regulatory schemes that are initially finalized and issued are rarely modified until their effectiveness is evaluated—which in the case of the Draft Regulations may mean extended period of time. We strongly recommend that businesses consider submitting comment letters to the California AG—either directly or through intermediaries. (Of course, attorneys at Dorsey are available to assist in this task.) *       *       * Please note that this Alert is an initial analysis of the issues and concerns raised by the Draft Regulations, but is not intended to constitute a comprehensive identification of concerns that businesses will face in their compliance efforts. It is likely that covered businesses will identify other significant compliance issues, and those concerns should be addressed wither through the comment or interpretative administrative processes. We are available to discuss any questions or comments. 1 Section 1798.100 et seq. of the California Civil Code. 2 Section 1798.140(c) of the CCPA. 3 Section 1798(o) of the CCPA. 4 As stated in the Draft Regulations, a violation of the Draft Regulations will be deemed a violation of the statutory requirements of the CCPA. See, Section 999.300(b) of the Draft Regulations (available at: https://oag.ca.gov/privacy/ccpa). 5 https://oag.ca.gov/privacy/ccpa. 6 Section 1798.140(g) defines a “consumer” as a California resident. (Note, however, that AB 25, which was signed by the California Governor, for a 1-year period temporarily exempts most employee-related data from coverage under the CCPA. 7 Section 1798.140(y) of the CCPA. 8 Section 1798.185(a)(7) of the CCPA. 9 Section 1798.120(c) of the CCPA. 10 The Draft Regulations generally use the defined terms a “request to know” and a “request to delete” to mean a communication from a consumer relating to PI and the exercise of the consumer’s privacy rights. See, Sections 999.301(n) and (o) of the Draft Regulations. 11 Disclosures must be readily available with individuals with disabilities, which in the internet world has created significant litigation risk for non-compliance. See, Section 999.305(d) of the Draft Regulations. 12 Section 999.305(b) of the Draft Regulations. 13 Section 999.305(a)(4) of the Draft Regulations. 14 Unfortunately, the Draft Regulations completely ignore how the exercise and disclosure of the various exceptions contain in the CCPA should be handled. 15 Section 999.306(c) of the Draft Regulations. 16 It should be noted that these categories contain numerous items of required disclosure; a business preparing its privacy policy should ensure that it has included all required items. 17 A request to delete must entail a two-step process: first, a request to delete PI, and second, a separate confirmation that deletion of PI has been requested. 18 Section 999.312(c) of the Draft Regulations. 19 Section 999.312(f) of the Draft Regulations. (For large businesses, this latter requirement could present considerable training challenges.) 20 Section 999.313(a) of the Draft Regulations. Compare with, Section 1798.130(a)(2) of the CCPA. 21 This shortening of the response time may be particularly burdensome to large businesses that elect to centralize their CCPA responses. 22 The Draft Regulations are notably silent when differentiating between internet websites and mobile applications; compliance with both alternative communication modes could present technology challenges to businesses if more than a link to a website is required in the case of a mobile application. 23 Section 999.315(e) of the Draft Regulations.  In a clear change from the statutory requirements of the CCPA, Section 999.315(h) indicates that a request to opt-out need not meet the standard of a verified consumer request, which may complicate compliance and training policies and procedures. 24 Section 999.324(a) of the Draft Regulations. 25 Sections 999.324 and 999.325 of the Draft Regulations. 26 Sections 999.323, 999.324 and 999.325 of the Draft Regulations. 27 "(b) When a business receives an affirmative authorization pursuant to subsection (a) of this section, the business shall inform the parent or guardian of the right to opt-out at a later date and of the process for doing so on behalf of their child pursuant to section 999.315.” Section 999.330 of the Draft Regulations. 28 Article V of the Draft Regulations. This likely means that the default language is that contained in the CCPA, which imposes special opt-in requirements for minors when a business has “actual knowledge that a consumer is less than 16 years of age.” 29 Section 999.337(b) of the Draft Regulations.

Today, the Centers for Medicare & Medicaid Services (CMS) and the Department of Health and Human Services (HHS) Office of Inspector General (OIG) each released their long-anticipated proposed rules to revise the federal self-referral law (or “Stark Law”) regulations, the safe harbors under the federal anti-kickback statute (AKS), and the civil monetary penalty law (CMP) for beneficiary inducements.  The proposed rules are part of HHS’s “Regulatory Sprint to Coordinated Care,” which seeks to remove regulatory obstacles to care coordination and a value-based healthcare delivery system. The HHS press release regarding the proposed rules is available here,  and includes links to each of the CMS and OIG proposed rules.  For our prior posts on the Regulatory Sprint to Coordinated Care, see here and here. Relatedly, the Substance Abuse and Mental Health Services Administration (SAMHSA) published proposed rules to revise privacy rules for substance use disorder records on August 26, and CMS published proposed rules to revise the Stark Law advisory opinion regulations on August 14 (as part of the Medicare Physician Fee Schedule proposed rule). We are reviewing the proposed rules and will post an in-depth analysis shortly.

Medicare reimbursement for remote patient monitoring has taken a number of steps forward throughout this year. New and proposed rules from the Centers for Medicare and Medicaid Services both expand the billing options available to health care providers and also build in additional flexibility in the provision of remote patient monitoring in order to further the health industry’s push to value-based care. Remote patient monitoring (“RPM”) is a form of digital health in which medical data from individual patients is collected in one location and electronically transmitted to health care providers in a different location for assessment and recommendations. RPM differs from other digital health services in that there is not necessarily a live, or “real-time”, interaction between the patient and their health care provider. Instead, RPM is used by health care providers to monitor various aspects of their patient’s vital signs, including: weight, blood pressure, blood sugar, heart rate, and oxygen levels. RPM is not only a useful tool for health care providers to use during a patient’s hospitalization, but it is also useful in reducing the number of hospitalizations altogether. For example, RPM can be used to allow older or disabled individuals to live at home longer and avoid having to move into skilled nursing facilities, since their vitals can be monitored without having to see a health care provider in person. Until this year, Medicare reimbursement for RPM services was difficult to come by. While Medicare previously offered reimbursement for RPM services billed under CPT code 99091, the code did not take current technology and staffing models into account (likely because the language from the code dates back roughly 16 years). In order to address this issue and further incentivize health care providers to use RPM, the Centers for Medicare and Medicaid Services (“CMS”) finalized three new RPM billing codes that were effective January 1, 2019 (“Final Rule”). The new codes are titled, “Chronic Care Remote Physiologic Monitoring” and included the following descriptions: CPT code 99453: “Remote monitoring of physiologic parameter(s) (e.g., weight, blood pressure, pulse oximetry, respiratory flow rate), initial; set-up and patient education on use of equipment.” CPT code 99454: “Remote monitoring of physiologic parameter(s) (e.g., weight, blood pressure, pulse oximetry, respiratory flow rate), initial; device(s) supply with daily recording(s) or programmed alert(s) transmission, each 30 days.” CPT code 99457: “Remote physiologic monitoring treatment management services, 20 minutes or more of clinical staff/physician/other qualified healthcare professional time in a calendar month requiring interactive communication with the patient/caregiver during the month.” Finalization of these new codes did not come without fair criticism and disparate interpretations of the level of required supervision. In creating the codes, CMS stated that RPM could not be delivered “incident to” a practitioner’s professional services. Therefore, RPM services could not be reimbursed if the services were furnished by auxiliary personnel (individuals acting under the supervision of a physician). Following backlash of this conclusion, CMS issued a technical correction to the Final Rule on March 14, 2019, that allows “incident to” billing of RPM services by auxiliary personnel if they are under direct supervision. This was overall a win for RPM reimbursement; however, through separate codes (CPT 99487, 99489, and 99490), CMS allows reimbursement for Chronic Care Management under general supervision. The difference being that general supervision does not require a physician to be in the same building at the same time as the auxiliary personnel delivering the services. This contradictory treatment resulted in commentators arguing that CMS’s approach hinders, rather than increases, a patient’s access to digital health services by limiting where a physician may be located during the supervision of such services. CMS seems to be addressing this concern in the proposed 2020 Physician Fee Schedule that was published August 14, 2019 (“Proposed Rule”). The Proposed Rule would allow “incident to” RPM services to be reimbursed under general supervision rather than limiting reimbursement to direct supervision. By way of example, this means RPM could be reimbursed when the auxiliary personnel use RPM with patients who are in a hospital while the auxiliary personnel are supervised via other telemedicine modalities by a physician at their home. This change would greatly improve a patient’s access to RPM by enabling physicians to bill for such services delivered in a more flexible manner. In addition to this change, the Proposed Rule revises CPT code 99457 and adds yet another code to allow for additional reimbursement for each 20-minute interval that RPM services are provided.  This is in contrast to the Final Rule’s version of CPT code 99457, which allowed only one reimbursement for RPM services delivered for 20 minutes or more. CMS is accepting comments on the Proposed Rule until September 27, 2019. If you would like to submit comments or have any questions, one of the authors or your regular Dorsey attorney would be happy to assist you.    

From Robert Cattachach, a Dorsey Partner with our Regulatory Affairs Group: I am pleased to announce that Dorsey has launched web-based CCPA Screening and Assessment Tools to help organizations in preparing for the California Consumer Privacy Act (CCPA), which goes into effect on January 1, 2020. Companies can determine whether the CCPA will apply to their operations by using the screening tool available on Dorsey’s website. This free tool is available to all organizations and typically takes less than five minutes to complete. It parses the CCPA into four threshold questions, and upon completion of the questionnaire, the tool provides a free report on whether the act applies to the organization based on the answers provided. The online tool can be found here. If the CCPA applies, Dorsey also offers a more comprehensive online Assessment Tool to help companies evaluate their current CCPA compliance status. Existing Dorsey clients will have immediate access to our online Assessment Tool. Please email us if you would like to receive the link to send to a client. For companies that are not current clients of the firm, but you think might like access to the Assessment Tool, please email one of our CCPA assessment professionals. Dorsey can offer clients legal services ranging from individualized advice on discrete issues to fixed-fee suites of services for CCPA-related compliance projects. This new law marks a dramatic sea change in American privacy law, as it imposes significant new burdens on organizations that collect, use or share data on California residents. In addition to imposing significant statutory penalties for non-compliance, the CCPA creates an unprecedented right for consumers to bring class actions if their data is compromised in a breach, even if there are no actual damages. By imposing automatic statutory penalties for each affected consumer if a company fails to implement reasonable security practices and procedures, the CCPA is expected to create potentially enormous class action liability for companies suffering a breach. Dorsey continues to publish timely CCPA updates on its website. Updates can be accessed here.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Divya Gupta and Cody Wamsley for the following e-news letter update: With the California Consumer Privacy Act (“CCPA”) set to take effect on January 1, 2020, and the resulting looming specter of statutory damages and data breach class action litigation for failure to implement “reasonable security” on the near horizon, reducing or mitigating the harms that result from such cyber-attacks is more important than ever.  Since 2015, more than three in five Californians have been a victim of a data breach, making implementation of reasonable security controls now a critical and necessary component of CCPA compliance.1  While the retail industry has had record breaking breaches from malware and hacking, especially with card data, no industry is risk free when it comes to adequate data security. Managing or mitigating risk, however, requires implementing “reasonable security,” which derives from the Center for Internet Security's Top 20 Critical Security Controls (CSC 20) per then California Attorney General in 2016, Kamala Harris.  In California’s 2016 Data Breach Report, Harris stated that “[The CSC 20] are the priority actions that should be taken as the starting point of a comprehensive program to provide reasonable security.”2  Recommendation 1 of the same report is more explicit: The 20 controls in the Center for Internet Security's Critical Security Controls identify a minimum level of information security that all organizations that collect or maintain personal information should meet. The failure to implement all the Controls that apply to an organization's environment constitutes a lack of reasonable security. (emphasis added). Based on these statements, the CSC 20 likely comprise a defensive list to detect, prevent, respond to, and mitigate security incidents, and are designed to address various domains of information security to provide organizations with a roadmap to achieve resiliency.  Whether the CSC 20 will become the explicit standard for “reasonable security” is still an open question, but given the California AG’s previous statements, these controls should be top-of-mind for any organization that seeks to avoid significant liability under the CCPA. The CSC 20 is broken down into three main categories of controls:  Basic, Foundational, and Organizational.  The total scope of the CSC 20 is beyond the scope of this article, but suffice it to say that an organization may be hard-pressed to assert that it has “reasonable security” in place if it does not at least adhere to the Basic controls.  The Basic controls consist of the following 6 items: Inventory and Control of Hardware Assets Inventory and Control of Software Assets Continuous Vulnerability Management Controlled Use of Administrative Privileges Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers Maintenance, Monitoring and Analysis of Audit Logs Of these 6 Basic controls, #3, Continuous Vulnerability Management, stands out as one of the most important for an organization to focus on to prevent data breaches.  According to a recent study, nearly 60% of recent data breaches were the result of unpatched vulnerabilities.3  Indeed, the California AG stated that “patching newly discovered security vulnerabilities is critical” while citing the related CSC 20 control.  In the last few years, the importance of vulnerability management has become more apparent and this control has risen to become the #3 control in the CSC 20. Vulnerability management's main purpose is to identify and remedy software vulnerabilities as quickly as possible.  It often doesn't take any significant skill on an attacker's part to exploit published vulnerabilities and so once a software vendor releases a patch, knowledge of its associated vulnerability quickly becomes widespread and the race is on between organizations deploying patches and attackers attempting to exploit the vulnerability.  Organizations that do not scan for and proactively address vulnerabilities are at great risk for a breach. Patching software security is a no-brainer, or so you’d think.  Well, the challenge lies in the scale of the organization, the effect a patch could have on other organization systems, and the attacker’s ability to quickly weaponize ahead of scheduled patch rollouts, among other things.  To properly implement vulnerability management may not be as easy as we'd like, but it is critical and low-hanging fruit on the CSC 20 tree. The European Union deems privacy a fundamental human right, and is taking enforcement seriously -- think Marriott and British Airways GDPR fines.  We expect to see similar, if not greater, liability for organizations that violate the upcoming CCPA.  Organizations that haven’t yet automated the process to monitor for and remediate vulnerabilities on networks and systems should do so now and should institute vulnerability and patch management policies.  While all of the CSC 20 controls are important, perhaps the most effective solution to prevent a major data breach for any organization lies in assessing and managing known vulnerabilities.  Modernizing vulnerability management programs should be a focus in the short term run up to January 1, 2020 effective date. Dorsey’s Cybersecurity and Privacy Team has developed a catalog of security practices and procedures to help achieve operational resilience and defend companies from the forthcoming wave of data breach litigation.  Notably, Dorsey has partnered with leading technical security industry organizations to offer full service advice.4 Additional references: https://www.us-cert.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-VM.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r3.pdf https://www.sans.org/reading-room/whitepapers/threats/implementing-vulnerability-management-process-34180 1 See California’s 2016 Data Breach Report, available at https://oag.ca.gov/sites/all/files/agweb/pdfs/dbr/2016-data-breach-report.pdf. 2 https://oag.ca.gov/sites/all/files/agweb/pdfs/dbr/2016-data-breach-report.pdf. 3 https://www.darkreading.com/vulnerabilities---threats/unpatched-vulnerabilities-the-source-of-most-data-breaches/d/d-id/1331465. 4 https://www.dorsey.com/services/cybersecurity-privacy-social-media.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Jamie Nafziger and Divya Gupta for the following e-newsletter update: Businesses may receive a bit of breathing room as a result of two amendments to the California Consumer Privacy Act (CCPA) passed on Friday, September 13, 2019, by the California Legislature.  The Legislature gave businesses a one-year moratorium on two significant aspects of the law:  its application to employees, job applicants, owners, officers, directors, medical staff members, and contractors; and its application to business-to-business transactions.  The Governor has until October 13, 2019, to sign or reject the amendments.  Although the amendments provide some of the needed clarifications and error corrections and a significant break from needing to respond to certain data subject requests from employees and B2B contacts, businesses will still need to complete their data mapping (even for these categories of consumers) and will still need to be prepared to offer the rights not exempted on January 1, 2020, even if these amendments are signed by the Governor. For those following the process, five bills passed the Legislature: AB 25, AB 874, AB 1146, AB 1355, and AB 1564.  Proposed amendment AB 846 on loyalty programs was shelved.  In addition to the two widely applicable amendments about employees and business-to-business transactions discussed in detail below, the Legislature also passed a number of minor or narrowly applicable amendments.  The amendments amount to 98 pages of printed material.  We will cover only the more significant of them in this article. The employment-related amendments in AB 25 exempt businesses from many of the CCPA’s requirements for one year when applied to employees, job applicants, owners, officers, directors, medical staff members, and contractors “to the extent that the natural person’s personal information is collected and used by the business solely within the context of the natural person’s role or former role as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or a contractor of that business” (emphasis added).  The amendment also covers certain use of personal information in the context of emergency contact information and benefits administration. If AB 25 is signed by the Governor, two CCPA requirements will still apply to these types of individuals when collected and used in this context:  (1) the requirements to inform them about the categories of personal information collected and the purposes for which the personal information will be used in 1798.100(b) and (2) the right to sue in a private right of action after a data breach in 1798.150.  This would mean the other consumer rights to deletion, access, opt-out of selling, and no price discrimination would not apply in this context for one year (until January 1, 2021).  This will be a welcome change to most businesses, to the extent it gives them a break from the experience EU businesses have had responding to data subject requests from employees, ex-employees and job applicants in Europe since the General Data Protection Regulation (GDPR) became effective. Unfortunately, even if this amendment becomes law, businesses will still need to complete their data mapping and draft disclosures in connection with the information of employees, job applicants, owners, officers, directors, medical staff members, and contractors. The business-to-business (B2B) moratorium in AB 1355 would exempt businesses from many of the CCPA’s requirements for one year when applied to “personal information reflecting a written or verbal communication or a transaction between the business and the consumer, where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency and whose communications or transaction with the business occur solely within the context of the business conducting due diligence regarding, or providing or receiving a product or service to or from such company, partnership, sole proprietorship, nonprofit or government agency” (emphasis added). The B2B moratorium would not apply to collection or use of personal information outside of the context described in this amendment, to the right to opt-out of “selling” in 1798.120, to the price discrimination provisions of 1798.125, or to the right to sue in a private right of action after a data breach in 1798.150.  If this amendment is signed into law, businesses will have a break until January 1, 2021, in the requirements of notice, deletion, access, information about onward disclosures, the opt-out link and the means for exercising consumer rights when it comes to B2B diligence or product/service provision or receipt.  This means businesses would still need to complete their data inventories of information received in a B2B context, be prepared to respond to opt-out requests, and apply all other sections of the CCPA to uses of B2B personal information outside of the diligence or transaction itself (such as marketing uses). Other important amendments include: Clarifications regarding authentication of data subject requests in AB 25; Changes to language regarding methods for submitting data subject requests in AB 1564; Changes to exempt certain vehicle-related information from the right to opt-out from selling in AB 1146; Changes to exempt certain warranty and product recall information from the right to deletion in AB 1146; Changes to the definition of “personal information” in connection with the reasonability of associating information with a particular consumer or household, with the definition of “publicly available,” and with the applicability to deidentified or aggregate consumer information in AB 874; Correction of errors in the price discrimination section 1798.120 about “value provided to the consumer” versus “value provided to the business” in AB 1355; Clarification regarding impact of encrypting and redacting personal information on civil right of action in AB 1355; Changes to the exemption regarding consumer credit and related information in AB 1355; and Error corrections in 1798.110(c) regarding privacy notice requirements and in 1798.115(a)(2) regarding right to know in AB 1355. If these amendments are signed by Governor Newsom by October 13, 2019, they will provide a one-year extension in connection with some provisions of the CCPA.  However, the majority of the provisions related to consumer privacy will still be in effect.  No fundamental rights have been removed from the CCPA.  Businesses will need to continue their compliance efforts with focused intensity over the next several months.  We will provide updates regarding the Governor’s actions and the California Attorney General’s regulatory guidance as they become available. The completed legislative session gives businesses a clearer understanding of the CCPA’s obligations (subject of course to signature by Governor Newsom).  For those companies not previously required to comply with the European Union’s GDPR, this may pose significant operational and technical challenges.  Dorsey has developed fixed fee packages to help clients on their CCPA compliance journey, a simple screening tool which is publicly available to help companies understand whether the CCPA affects them, and a more comprehensive online self-assessment tool for our clients, which can be requested by emailing Dorsey at CCPA.Assessment@dorsey.com.

As reported here in February, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) released two new significant proposed regulations that would have had a transformative effect on the drug discount and rebate arrangements that are commonplace between pharmaceutical manufacturers and Medicare Part D Plans and Medicaid Managed Care Organizations (and the pharmacy benefit managers (PBMs) acting on their behalf). The Administration’s goal with these proposed regulations was to reduce prescription drug prices.  However, in July, the Administration abandoned these proposed regulations (as shown on the Office of Management and Budget website) out of concern that they would actually have the opposite effect and result in increased drug prices.  President Trump reportedly became concerned after the proposals received significant support from the pharmaceutical companies. The proposals would have eliminated the current federal anti-kickback statute (AKS) safe harbor protection relied upon by manufacturers and PBMs for the rebates paid by manufacturers to PBMs for certain drugs.  In its place, the OIG proposed a much more narrow safe harbor that would have only applied if the reduced price from the manufacturer was fixed in advance and disclosed to the plan, the full value of the price reduction was disclosed to the pharmacy through a chargeback to ensure that the total payment to the pharmacy for the drug was no less than what the health plan (or PBM on its behalf) paid to the manufacturer for the drug, and the reduction in the drug’s price was completely applied to the price charged to the patient at the point of sale. At the same time, the OIG also proposed a new PBM service fee AKS safe harbor that would have protected payments by manufacturers to PBMs for certain services provided by PBMs, but with strict requirements for the manufacturer and PBM to have a written agreement for the services which set the compensation for the services in advance at a rate that is consistent with fair market value and not based on the volume or value of any referrals or other business generated between the parties or the health plan.  The proposed service fee safe harbor would have also required the PBM to annually disclose such arrangements, services and compensation to the health plans and to the Secretary of HHS upon request. The Administration has been vocal about its goal of reducing drug prices for patients.  So, we expect alternative action in the future which could take the form of legislation rather than the rule-making process. We are continuing to closely monitor changes in the area.

The Eliminating Kickbacks in Recovery Act of 2018 (EKRA) became law on October 24, 2018, and is codified at 18 U.S.C. § 220.  As part of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment (SUPPORT) for Patients and Communities Act, EKRA was enacted in response to a concern that the federal Anti-Kickback Statute (AKS) was not broad enough to cover certain abusive payment arrangements related to opioid addiction treatment centers, since the AKS only applies to federal health care programs.  EKRA has considerable similarities to the AKS, but is notably distinct from the AKS in that it applies to all payors rather than just federal health care programs and has an exception for employment compensation that is much narrower than the AKS’s employment safe harbor.  Further, EKRA relates to arrangements with recovery homes, clinical treatment facilities, and laboratories (the “Subject Entities”).  With respect to laboratories, even though EKRA was enacted in response to the opioid crisis, it applies to all laboratories, not just laboratories that perform testing related to substance abuse (e.g., toxicology screening). We set forth below an overview of EKRA, exceptions to the law’s prohibitions, and recommendations to ensure compliance. Overview EKRA subjects to criminal penalties anyone who, with respect to services covered by any health care benefit program (whether federal or private), knowingly and willfully: solicits or receives any remuneration in return for referring a patient or patronage to a Subject Entity; or pays or offers any remuneration: to induce a referral of an individual to a Subject Entity; or in exchange for an individual using the services of that Subject Entity. Penalties for each occurrence of violating the law are a fine of not more than $200,000 (which is double the possible fine per violation of the AKS), imprisonment for not more than 10 years, or both. EKRA defines the Subject Entities as follows: Recovery home: “a shared living environment that is, or purports to be, free from alcohol and illicit drug use and centered on peer support and connection to services that promote sustained recovery from substance use disorders.” Clinical treatment facility: “a medical setting, other than a hospital, that provides detoxification, risk reduction, outpatient treatment and care, residential treatment, or rehabilitation for substance use, pursuant to licensure or certification under State law.” Laboratories: defined by reference to CLIA, which means that all laboratories are subject to EKRA. EKRA does not apply to conduct that is prohibited by the AKS, and EKRA does not “occupy the field” in which any state law may be more stringent related to the same subject matter. Exceptions Similar to AKS statutory exceptions and regulatory safe harbors, EKRA provides a number of exceptions to its prohibitions, including exceptions for payments made under employment arrangements, personal services and management contracts, waivers or discounts of any coinsurance or copayment, and certain other exceptions that meet specified parameters (some of which are similar to and some of which are different from the parameters under the parallel AKS exceptions/safe harbors).  EKRA also has an exception for remuneration made pursuant to certain alternative payment models, a parallel of which is not present in AKS exceptions/safe harbors. Of note, the EKRA exception for payments made by an employer is much narrower than the AKS safe harbor for employment.  Specifically, while the AKS safe harbor permits any payments to an employee as long as there is a bona fide employment relationship, the EKRA exception requires that the payment not vary based on the number of individuals referred, tests or procedures performed, or amounts billed to or received from the health care benefit program from the individuals referred.  This means that employment arrangements that would not be prohibited under the AKS, such as those with sales and marketing personnel that include commission-based compensation, appear to be prohibited under EKRA and thus need to be carefully evaluated for compliance with this new law.  (The EKRA employment exception applies to payments made by an employer both to employees and independent contractors (rather than just to employees), even though EKRA has a separate exception for personal services and management contracts.) EKRA provides that the Attorney General, in consultation with the Secretary of Health and Human Services, may promulgate regulations to clarify the exceptions described in the statute. Recommendations for Complying with EKRA The Subject Entities need to: Ensure existing and future compensation arrangements fit within EKRA exceptions, particularly for employment compensation due to the narrower parameters of the EKRA employment exception as compared to the AKS employment safe harbor, and to the extent certain of such arrangements would not otherwise be analyzed for compliance with the AKS because they do not involve payment under any federal health care program. Update policies and procedures related to financial arrangements with referral sources and related to patient copay and coinsurance waivers to address compliance with EKRA. Further, entities that are not themselves a Subject Entity but that do business with a Subject Entity should evaluate their relationships with Subject Entities to ensure that such relationships are in compliance with EKRA, since the law applies to parties on both sides of the prohibited arrangement (i.e., the law prohibits both the payment or offering of referral/inducement fees, but also the soliciting or receiving of such remuneration).  Policies and procedures of non-Subject Entities who have such business relationships should also be updated to address EKRA compliance. We will continue to closely monitor the state of EKRA for guidance, revisions to the law and enforcement. Further, it is important to also understand that several states, such as Florida, Utah and California, have passed their own state level “patient brokering” laws which prohibit similar conduct and arrangements as addressed by EKRA.  These laws can also be implicated and we are monitoring their development as well.   Summer Associate Monica Delgado provided substantial assistance researching and drafting this blog post.

Any casual reader of healthcare news in recent years has taken note of the upheaval and financial uncertainty facing healthcare providers. Take for example a recent Bloomberg story detailing the closure of Hahnemann University Hospital in Philadelphia – “Philadelphia Hospital Collapse Highlights Healthcare ‘Anarchy’”. Anarchy or not, closures, consolidations, and financial restructuring are all too common for healthcare providers across the care continuum. To get a better sense of how financial restructuring is impacting healthcare providers and what options a provider facing a restructuring may have, Kristen Barlow, a Dorsey Health Strategies consultant, recently spoke to Annette Jarvis, a Partner with Dorsey’s Finance & Restructuring Group. Annette is a national expert in insolvency and one of the nation’s leading bankruptcy and restructuring lawyers. Kristen: Annette, are there particular segments of the healthcare industry that you think are especially vulnerable to financial restructuring – and if so, why? Annette: While all healthcare providers face financial challenges, some providers face particular challenges. For example, hospitals in rural areas have lower profit margins and may serve more uninsured patients than their urban counterparts. These rural hospitals are more at risk for closure – the Government Accountability Office recently reported that in the five years through 2017, 64 rural hospitals closed compared to 49 hospitals located in urban areas. Another segment of the healthcare industry particularly vulnerable to financial restructuring is post-acute and long-term care providers. Recent years have seen the bankruptcies of a number of large skilled nursing facility providers and many long-term acute care hospitals. Expensive overhead, reductions in Medicare reimbursement rates, and pressure to invest in care quality improvements all help create an environment that puts post-acute and long-term care providers at particular risk for financial restructuring. Annette: Kristen, from your perspective, how have you seen providers change and adapt their strategic plans to respond to these financial pressures? Kristen: Annette, providers are absolutely trying to change and adapt their strategic plans to succeed in a more financially constrained environment. One strategic response providers may pursue is to find financial security through increased scale. The rise of M&A activity for healthcare providers is well documented – a recent Commonwealth Fund report found that the vast majority of provider markets (~90%) are either highly concentrated or super concentrated. Providers may find that consolidation permits them to gain negotiating leverage with insurers and realize efficiencies through economies of scale – all considerations that make consolidation an attractive strategy in the face of a financially worrisome outlook. Kristen: Annette, consolidation is just one strategic response providers may have to financial pressures – what other strategies have you seen providers pursue? Annette: Other strategies I have seen implemented include the reduction of services in rural hospitals or the roll up of certain services into larger hospital systems.  This can occur through distressed acquisitions in or out of receiverships or bankruptcies or through less traditional combinations allowing sharing of services and patient care. Kristen: Annette, how would you advise a company that may be worried about their financial outlook to think about their options? Annette: Providers may want to remember that hospitals and other facilities are, by their nature, capital intensive. Often, by deferring capital investments (and unless their loan documents have covenants that are tripped by early substandard performance), the company can put off facing financial problems by deferring capital investments until a cash crisis hits.  Then the options for saving the business are more limited.  Facing financial problems early and getting professional help are essential for restructuring. Kristen: Annette, are there common mistakes that companies facing a financial restructuring should avoid? Annette: Facing financial problems early means providers must often come to terms with a scary and uncertain future. The most common mistake I see is avoiding facing problems, including changes that are necessary for long term financial viability, as soon as they arise. Early intervention is important for maximizing all potential solutions. By working with counsel and financial advisors experienced in restructuring, the company may be able to take care of a number of problematic issues outside of bankruptcy. The company will quite frankly be better off for approaching financial issues early with a proactive mindset and the appropriate legal and financial advice.   If you would like additional information on how Dorsey can assist healthcare organizations facing financial restructuring, please contact the authors directly at jarvis.annette@dorsey.com or barlow.kristen@dorsey.com or your regular attorney at Dorsey & Whitney.  

In a much anticipated decision, a federal judge ruled this week that the Trump Administration’s rule requiring drug manufacturers to list drug prices in television advertisements exceeds the agency’s authority. Back in May 2018, the Trump administration spoke on drug pricing and published its “Blueprint to Lower Drug Prices and Reduce Out-of-Pocket Costs”. One of the specific strategies outlined in the President’s speech at the time included requiring drug manufacturers to state the drug list price in television advertisements (read our previous article on this topic here). Since the President’s speech in 2018, the U.S. Department of Health and Human Services (“HHS”) published a final rule that required drug manufacturers to disclose, in any television advertisement, the list price of a thirty day supply (or a typical course of treatment) of prescription drugs and biological products (excluding prescription drugs or biological products that have a list price of less than $35 per month for a thirty day supply or typical course of treatment). See 84 Fed. Reg. 20,732 (May 10, 2019) (“Final Rule”). Commenters to the Final Rule raised concern that the proposal was “beyond the authority of CMS to promulgate these regulations under a reasonable interpretation of sections 1102 and 1871 of the Social Security Act.” 84 Fed. Reg. 20,735-36 (May 10, 2019). HHS stated that it disagreed with the commenters because these two provisions “confer broad discretion upon the Secretary to determine the regulations that are necessary to the efficient administration of the functions with which he or she is charged under the Social Security Act (in the case of section 1102), and the administration of Medicare (in the case of section 1871”. Shortly thereafter, a lawsuit was brought by three pharmaceutical companies and a marketing association. In the lawsuit, the industry not only opposed CMS’ authority to promulgate the Final Rule, but also argued that it violated the First Amendment, as the disclosure of the list price was compelled speech that did not pass the intermediate scrutiny standard outlined in various U.S. Supreme Court Cases. See Merck & Co, Inc v. United States Department of Health and Human Services, Case No. 19-cv-01738 (AMP) (U.S. Dist. Columbia, July 8, 2019) (available here). In its decision published on July 8, 2019, U.S. District Judge Amit Mehta ruled that the Final Rule exceeds the rulemaking authority Congress granted HHS under the Social Security Act. Id. at 12. The Court found that “the basic power that Congress gave to the Secretary was to establish the rules and regulations for ‘running’ or ‘managing’ the federal public health insurance programs through CMS [, but that] HHS seeks to do more than that here. It has adopted a rule that regulates the conduct of market actors that are not direct participants in the Medicare or Medicaid program.” Id. at 13. Given that the Court found HHS’ rulemaking authority was exceeded, it did not decide the Plaintiff’s First Amendment challenge. Id. at 2. The New York Times reported that Caitlin Oakley, a spokeswomen for HHS said that “the administration was disappointed and consulting with the Justice Department on what to do next.” Katie Thomas and Katie Rogers, Judge Blocks Trump Rule Requiring Drug Companies to List Prices in TV Ads, N.Y. Times, July 8, 2019, available at https://www.nytimes.com/2019/07/08/health/drug-prices-tv-ads-trump.html. Given the Trump Administration’s continued focus and action on drug pricing, including news last week that the Administration was preparing an executive order that would declare a “favored nations clause” for drug prices, it is safe to expect many more legal challenges and appeals with respect to these issues in the near future, although the long-term impact to the industry is still questionable. Stephanie Armour, Trump Plans Order to Tie Drug Prices to Other Nations’ Cost, Wall St. J., July 5, 2019, available at https://www.wsj.com/articles/trump-plans-order-to-tie-drug-prices-to-other-nations-costs-11562348629.

On May 22, 2019, Minnesota Governor Tim Walz signed a significant new assisted living licensure bill into law. Previously in Minnesota, assisted living facilities were required to register with the Minnesota Department of Health (the “Department”) but were not subject to facility licensure. The new law requires assisted living facilities to be licensed, with special licensing requirements for assisted living facilities with dementia care. The new law also provides broader consumer protections to the residents of assisted living facilities. The licensing requirements go into effect on August 1, 2021. Some of the consumer protections go into effect on August 1, 2019 and others go into effect on January 1, 2020. Below is a highlight of some of the requirements from the new law. I.    Licensing Requirements       A.   Assisted Living Facilities Under the new law, assisted living facilities must be licensed by August 1, 2021 and must pay a licensing fee of $2000 plus $75 per resident for initial license application and each annual renewal, subject to potential adjustments of up to 10% based on the proportion of residents receiving certain home and community-based waiver services in the prior year. In addition to providing information regarding the operations of the facility, in order to be granted a license, managerial officials and owners of assisted living facilities must successfully undergo a background study. New applicants must first apply for a provisional license that lasts one year. During that time, the Department will complete a survey of the facility. If the facility is in substantial compliance with the survey requirements, then the Department will issue a license to the facility. The license must be renewed every year. In addition to the requirements under the old law to be registered as an assisted living facility, the new minimum requirements for assisted living facilities include: Distributing to residents the assisted living bill of rights Using person-centered planning and service delivery Giving residents the ability to furnish and decorate their unit Permitting residents access to food at any time, with meals and snacks meeting certain minimum nutritional requirements Giving residents the right to choose their visitors and the times of visits Giving residents the right to choose their roommate if sharing a unit Giving residents the right to have and use a lockable door to the resident’s unit Some of these and other requirements may be restricted in certain circumstances if appropriate for the particular resident and documented in their service plan. Assisted living facilities must at least have a temporary service plan for each resident in place prior to a resident moving in, must assess and implement a service plan within fourteen days of beginning to provide services to a resident, and must regularly reassess and revise the service plan thereafter. Assisted living facilities must also have assisted living contracts in place with residents that meet certain requirements, must retain records for each resident who is receiving services, and must provide orientation and training to all staff on the licensing requirements and regulations. Both licensed and unlicensed staff are required to meet certain minimum requirements, and the assisted living facilities must ensure that minimum supervision and availability requirements are met. If an assisted living facility is offering medication management services or treatment and therapy management services, additional requirements apply. These are just highlights of some of the requirements, of which there are many specified in the new law.       B.   Assisted Living Facilities with Dementia Care All assisted living facilities with dementia care must be licensed by August 1, 2021. The licensing fee for an assisted living facility with dementia care is $3000 plus $100 per resident for initial license application and each annual renewal, subject to potential adjustments of up to 10% based on the proportion of residents receiving certain home and community-based waiver services in the prior year. Assisted living facilities with dementia care must comply with the previously mentioned requirements of assisted living facilities in addition to other requirements. Each facility must demonstrate that it has the ability to provide services to residents with dementia either by showing the facility has experience managing residents with dementia or showing its compliance history in operating a care facility that is licensed or registered under federal or state law. If the facility does not have the necessary experience, they must employ a consultant with expertise in providing care for residents with dementia for the first six months of operation. The director of an assisted living facility with dementia care must complete at least ten hours of continuing education per year related to the care of individuals with dementia. Additionally, special requirements related to staffing, training, policies, and resident services must all be met for assisted living facilities with dementia care. II.   Consumer Protections The new assisted living law in Minnesota offers broad consumer protections to the residents of assisted living facilities. Beginning on August 1, 2021, all residents must receive a copy of the assisted living bill of rights. These rights include a right to: Appropriate care and services Refuse care and services Participate in care and service planning Courteous treatment Freedom from maltreatment Individual autonomy Confidentiality of records Furnish and decorate Choose roommate Access food Access counsel and advocacy services The new law allows residents or their representatives to place an electronic monitoring device in a resident’s unit. Residents must notify the facility and receive the consent of their roommate (if they have one) before placing an electronic monitoring device. However, a resident may place an electronic monitoring device without notifying the facility for up to fourteen days. This provision goes into effect on January 1, 2020.   Additionally, the new law prohibits assisted living facilities from retaliating against a resident or an employee for filing a complaint, making an inquiry, or asserting a right. The retaliation provision goes into effect on August 1, 2019. The new assisted living facility law marks a new era of regulation for assisted living facilities in Minnesota, bound to have significant effects on entities and individuals operating assisted living facilities as well as residents living in them. If you have further questions about his new law, please contact the authors or your regular Dorsey attorney. The text of the new assisted living licensure law can be found on the website of the Minnesota Office of the Revisor of Statutes here.   Summer Associate Laura Kvasnicka provided substantial assistance researching and drafting this blog post.  

The United States Department of Justice this month released a revised and consolidated set of guidelines for determining cooperation credit for organizations facing exposure under the False Claims Act.  The consolidated guidelines identify the main factors that the DOJ will consider when assessing the maximum “credit” parties will get for (1) voluntarily self-disclosing misconduct; (2) proactively cooperating with FCA investigations; and (3) taking effective remedial measures. The guidelines define “credit” as, typically, “reducing the penalties or damages multiple sought by the Department.”  The guidance aims to consolidate and add uniformity to how these issues will be addressed—something that historically could vary considerably.  And while much of the guidance is common knowledge among experienced FCA practitioners, it is nonetheless DOJ’s most concise statement of how cooperation credit plays out in the specific context of the False Claims Act. 1. Voluntary Self Disclosure DOJ continues to focus on the importance of voluntary disclosures.  Companies and individuals that discover false claims and make a “proactive, timely, and voluntary self-disclosure” to the DOJ will receive credit. Such parties will also qualify for credit for disclosing “additional misconduct going beyond the scope of the known concerns” uncovered during an internal investigation. Partial credit is available to defendants who “meaningfully assist” the DOJ’s investigations after failing to self-disclose the underlying conduct. And the DOJ will not give credit to any entity or individual that “conceals involvement in the misconduct by members of senior management or the board of directors, or to an entity or individual that otherwise demonstrates a lack of good faith to the government during the course of its investigation.” Voluntary disclosure, the DOJ guidelines caution, does not include disclosure of information required by law or in responding to a subpoena, investigative demand, or other compulsory process.  Nor does it include the disclosure of information under an imminent threat of discovery or investigation. 2. Proactive Cooperation Individuals and entities under investigation can also receive credit for taking steps to cooperate with the DOJ. Steps that would qualify for credit include: identifying individuals substantially involved in or responsible for the misconduct; disclosing relevant facts and identifying opportunities for the DOJ to obtain evidence not in the possession of the entity or individual or not otherwise known to the government; preserving, collecting, and disclosing relevant documents and information beyond existing business practices or legal requirements; identifying individuals who are aware of relevant information or conduct, including an entity’s operations, policies, and procedures; making company employees with relevant information available for meetings, interviews, examinations, or depositions; disclosing relevant facts gathered during the entity’s independent investigation (not to include information subject to attorney-client privilege or work product protection), including attribution of facts to specific sources rather than a general narrative of facts, and providing timely updates on the organization’s internal investigation into the government’s concerns, including rolling disclosures of relevant information; providing facts relevant to potential misconduct by third-parties; providing technological expertise and assistance to the government in their review of relevant information; admitting liability or accepting responsibility for the wrongdoing or relevant conduct; and assisting in the determination or recovery of the losses caused by the organization’s misconduct. DOJ will determine the value of any self-disclosure and cooperation by considering the following factors: the timeliness and voluntariness of the assistance; the trustfulness, completeness and reliability of information provided; the nature and extent of the assistance; and the significance and usefulness of the cooperation. 3. Effective Remedial Measures Remedial actions taken by an entity in response to an FCA violation that would receive credit include: analyzing the root cause of the underlying misconduct and how to address it; implementing or improving an effective compliance program designed to ensure the misconduct does not reoccur; disciplining or replacing those responsible for the misconduct (including supervisors) either through direct participation or failure in oversight; and any additional steps that demonstrate that the entity recognizes how serious the misconduct is, accepts responsibility for it, and will implement preventative measures to make sure it doesn’t reoccur. Although the guidelines do not significantly alter existing DOJ policy, they provide a clearer and concise set of guidelines to the AUSAs and Civil Frauds trial attorneys who will evaluate an organization’s cooperation and self-disclosure.  For organizations seeking to understand their own obligations and potential options, understanding the Government’s playbook has never been more important.  

For years, CMS has informally applied restrictions for hospitals which share space, equipment, staff or services in the same physical location (i.e., “co-locate”) with other hospitals or health care entities.  Although these sub-regulatory interpretations by CMS were not formal guidance, the penalties were so severe that many hospitals unwound the co-location or shared services arrangements they had in place with physician groups or other health care providers.  The American Hospital Association and others have urged CMS to develop and publish its co-location policy in order to provide clarity for hospitals- in particular out of concern for increasing access to care and improving care coordination in rural parts of the country. On May 3, 2019, CMS finally issued draft guidance to State Survey Agency Directors to use when evaluating hospital co-location arrangements.  CMS is seeking comments from stakeholders on the draft guidance by no later than July 2, 2019. In the draft guidance, CMS emphasizes that co-location of public areas and pathways is permitted as long as each entity demonstrates separate, independent compliance with the Medicare Conditions of Participation.  For a hospital, this means that the hospital must have distinct spaces (including clinical spaces) and maintain control over those spaces at all times.  The parties to the co-location arrangement can share public lobbies, waiting rooms, reception areas, restrooms, staff lounges, elevators, main entrances to a building, and main corridors through non-clinical spaces.  CMS has, however, outlined restrictions regarding the sharing of physical space, contractual arrangements with entities that are co-located with a hospital, the sharing of staffing and staff contracts, and the provision of emergency services in spaces that are co-located with hospitals. We are monitoring the developments of this draft guidance closely and will provide updates as they are published from CMS. If you have any questions about how the draft co-location guidance could impact your organization, please contact the author or your regular Dorsey & Whitney attorney.  

On April 22, 2019, the Centers for Medicare and Medicaid Services (CMS) announced two sweeping new payment innovation models under the Primary Cares Initiatives. The models will seek to incentivize primary care and other providers to take on greater responsibility and risk for the lives of covered beneficiaries. Both new models are scheduled to be effective for a first performance year of 2020. Read on for key details of the models, projected impact on the Medicare patient population, and our key takeaways for providers. Primary Care First Model provides simplified payments with performance-based adjustments The first model is Primary Care First (PCF), and include two options: PCF – General. Participating practices will assume financial risk for aligned beneficiaries and, in exchange, the practices will have reduced administrative burdens and will be eligible for performance-based payments or downside risk. PCF - High Needs Populations. Participating practices will assume financial responsibility for high-need, seriously ill beneficiaries who lack a primary care provider or effective care coordination, and, in exchange, the practices will have higher payment amounts as well as eligibility for performance-based payments or downside risk. PCF – General will provide payment to practices through a simplified payment structure that will provide a population-based payment along with a flat primary care visit fee and a performance-based adjustment providing an upside of up to 50% of revenue as well as a small downside (10% of revenue) incentive to reduce costs and improve quality. The performance-based adjustment will be assessed and paid on a quarterly basis. PCF – High Needs Population will set higher payment amounts to reflect the high-need, high-risk nature of the population as well as a yet-to-be-specified increase or decrease in payment based on quality measures. PCF is open to a range of eligible applicants, including primary care practitioners certified in internal medicine, general medicine, geriatric medicine, family medicine, and hospice and palliative care medicine. Applications for both PCF options will open soon- in Spring 2019, and the model will launch in 26 regions in the U.S. beginning in 2020 and will continue for five years. Direct Contracting Model permits providers to take on greater shared savings/shared losses up to full risk The second model is Direct Contracting (DC), and includes three options: DC – Professional. Providers will bear risk for 50% of shared savings/shared losses on the total cost of care (all Part A and B services) for aligned beneficiaries. Participants will receive Primary Care Capitation, a capitated, risk-adjusted monthly payment for enhanced primary care services equal to seven percent of the total cost of care for enhanced primary care services. DC – Global. Participating entities will bear risk for 100% of shared savings/shared losses on the total cost of care (all Part A and B services) for aligned beneficiaries. Participants may receive Primary Care Capitation as described above or may choose to receive Total Care Capitation, a capitated, risk-adjusted monthly payment for all services provided by participants and preferred providers with whom the participant has an agreement. DC – Geographic. Participating entities will bear risk for 100% of shared savings/shared losses on the total cost of care (all Part A and B services) for aligned beneficiaries in a target region. Participants will be selected as part of a competitive application process and commit to providing CMS a specified discount amount off of the total cost of care for the defined target region. This option will offer a Total Care Capitation payment as well, where CMS will continue to pay claims for services furnished by providers outside of the participants, including outside the target regions. Alternatively, participants can assume full financial risk while having CMS continue to make fee-for-service claims payments to all providers in the target region. The DC model is open to a broad range of entities, including health plans, health care technology companies, ACOs, and others operating under a common governance structure. The DC model will start in January 2020 with an initial alignment year for organizations that want to align beneficiaries to meet the minimum beneficiary requirements. Performance periods will begin in 2021 and continue for five years. CMS has issued a request for information (RFI seeking public comment on the DC-Geographic model, but nonetheless plans to launch the model in 2021. CMS anticipates shifting a quarter of beneficiaries out of fee-for-service (FFS) under the new models CMS anticipates that together, PCF and DC will: Shift over 25% of all Medicare FFS beneficiaries out of FFS and into value-based care arrangements; Offer new participation and payment options and opportunities for 25% of primary care practitioners and other providers; and Create new coordinated care opportunities for a large portion of the 11-12 million dual eligible beneficiaries in the U.S., specifically those in Medicaid managed care and Medicare FFS. Key Takeaways As we wait for additional details from CMS about the structure and payment mechanisms under both PCF and DC models, the following are a few key takeaways to keep in mind: CMS is committed to voluntary risk-based payment models. After experimenting with mandatory risk-based payment under the Comprehensive Care for Joint Replacement (CJR) bundled payment model and the proposed, but ultimately cancelled, Episode Payment Models (EPMs) for cardiac and orthopedic bundles, CMS has moved away (for now) from mandatory risk for providers. However, it appears that voluntary risk-based programs are here to stay. As these voluntary payment models are introduced, participants have opportunities to receive substantial gains (the full risk models of DC – Global and DC-Geographic, for example) if they have the appetite to bear the concurrent substantial downside risk. CMS’s pace indicates more reform likely to come. The Primary Cares Initiative announcement comes on the heels of the Pathways to Success model, an overhaul of the ACO program which was finalized in December 2018, and the BPCI Advanced bundled payment program, which launched in October 2018. In short, CMS is evaluating its existing models, creating new models, and the pace of change is faster than it has been since the slate of mandatory bundled payment programs were announced in 2016 through 2017. Going forward, the industry should expect this pace of new and revised payment models to continue, not lessen. In fact, Adam Boehler, the director of Centers for Medicare and Medicaid Innovation (CMMI), the part of Medicare that develops and administers payment reform programs, gave a speech in early April 2019 that raised the prospect of a new bundled payment program focused on post-acute care providers, which would be a first of its kind and one that those in the post-acute industry are anxiously awaiting. Physicians are increasingly the “owners” of the transition to value. For many, there’s long been a debate about who should “own” the transition away from fee-for-service toward value-based care. While CMS certainly has targeted acute-care providers for this ownership under ACOs and bundled payment models, physicians have of course been a crucial participant in those programs. Notably, the Primary Care Initiatives place the physician front and center of owning responsibility for the cost and quality of their patients’ care – an acknowledgement from CMS that primary care providers and close patient interaction are linchpins for sustained success in transitioning toward better outcomes for the health of a population. The focus on chronic and serious illness highlights a persistent problem for Medicare in controlling spending. As the population ages, success in controlling spending overall may ultimately come down to targeted efforts to better support and manage the chronically and seriously ill patient populations. While just 17% of Medicare patients live with six or more chronic conditions, they account for half of all spending on Medicare beneficiaries with chronic disease. Moreover, a full quarter of all Medicare spending is spent on Medicare beneficiaries in their last year of life. Including hospice and palliative care physicians in the PCF model, and having an entire model option dedicated to the seriously ill patient population, are clear signs from Medicare that they want to focus on programs and models that may move the dial on this patient population whose health care is notoriously difficult to manage. To learn more about this model, or to discuss how it may impact your organization, please contact the authors directly at barlow.kristen@dorsey.com or smith.alissa@dorsey.com or your regular attorney at Dorsey &Whitney.

Today, the Federal Government announced enforcement actions against 60 defendants in eleven federal districts, including 31 doctors, seven pharmacists, eight nurse practitioners, and seven other licensed medical professional for allegedly prescribing and distribution opioids and other dangerous narcotics and for health care fraud schemes. (DOJ Press Release, April 17, 2019). The charges involve over 350,000 controlled substances prescriptions and over 32 million pills. The unsealed indictments against the defendants can be found here. The enforcement action was led by the Appalachian Regional Prescription Opioid (ARPO) Strike Force. The ARPO Strike Force was formed in December and includes a team of federal agents and prosecutors to combat the opioid epidemic in the worst hit area of the country. The Strike Force analyzed a variety of databases to identify suspicious prescribing activity; investigators then used confidential and undercover agents to document medical professionals’ prescribing and dispensing of opioids in exchange for sex and cash. Sari Horwitz & Scott Higham, Doctors in seven states charged with prescribing pain killers for cash, sex, Wall St. J. (Apr. 17, 2019, 1:36 PM), https://www.washingtonpost.com/world/national-security/doctors-in-five-states-charged-with-prescribing-pain-killers-for-cash-sex/2019/04/17/7670d20e-607e-11e9-9ff2-abc984dc9eec_story.html?utm_term=.7ae448f3b507. In one case, a doctor allegedly prescribed combinations of opioids and benzodiazepine, sometimes in exchange for sexual favors; in total, the doctor is alleged to have prescribed approximately 500,000 hydrocodone pills, 300,000 oxycodone pills, 1,500 fentanyl patches and more than 600,000 benzodiazepine pills. In another case, a pharmacist was charged with allegedly dispensing large amounts of opioids outside the usual scope of professional practice and for no legitimate medical purpose. A dentist was also charged for alleged conduct that included writing prescriptions for opioids that had no legitimate medical purpose, removing teeth unnecessarily, scheduling unnecessary follow-up appointments and incorrect billing practices. While there has been an intense focus through litigation across the country on the role of manufacturers and distributors in the opioid crisis, recent initiatives have focused on prescribers and dispensers. Since June 2018, over 650 individuals have been excluded from participation in Medicare, Medicaid and all other Federal health care programs for conduct related to opioid diversion and abuse. For law-abiding prescribers and dispensers, it may be easy to dismiss today’s headline news as “not applicable”. However, all prescribers and dispensers should take notice of the increased number of investigations against their fellow licensees. The increased scrutiny of providers’ opioid prescribing and dispensing across the country could mean that even innocent providers are caught up in an investigation. Federal and state resources are being devoted in record numbers to investigations of prescribers and dispensers. There are regional DEA and DOJ task forces in place, dedicated funding streams for U.S. Attorneys, focused attention by state Medicaid agencies and Medicaid Fraud Control Units, and enforcement actions by state Boards of Medicine and Pharmacy. Cases against prescribers and dispensers are more likely today than in the past to include both civil and criminal penalties related to opioid prescribing and dispensing. As evidenced by today’s announcement, the government has become sophisticated in the use of data mining to identify outliers who will be the next targets of government investigations. Outliers in the number and dosages of prescriptions, the numbers of pain patients, the combinations of drugs prescribed, and failure to check and report to state prescription drug monitoring programs or report significant loss or theft to the DEA, can all trigger an investigation. In order to reduce risk of becoming the target of an investigation, prescribers and dispensers of opioids should ensure that they stay abreast of all State specific guidelines and standards of care for prescribing and dispensing opioids; review CMS guidance on opioid prescribing; review CDC Guidelines for prescribing opioids for chronic pain; and utilize their state’s prescription drug monitoring programs. Prescribers and dispensers should also focus on appropriate recordkeeping and documentation and inventory counts to reduce theft and unexplained inventory shortages. Dispensers should also ensure they know and verify the prescribers of prescriptions and document how any red flags in opioid prescriptions are resolved.   If you have any questions about these topics, please contact the authors or your regular attorney at Dorsey & Whitney.

Last week, the Centers for Medicare and Medicaid Services (“CMS”) announced increased flexibility for Medicare Advantage health insurance plans to offer supplemental benefits (those benefits not covered under Medicare Parts A or B). Beginning in 2020, Medicare Advantage plans may offer chronically ill enrollees supplemental benefits that are not necessarily health-related but are reasonably expected to improve or maintain health or overall function. These changes are incorporated into the 2020 Medicare Advantage and Part D Rate Announcement and Final Call Letter. New Explanation of Previously Expanded Health-Related Supplemental Benefits Last year, CMS expanded what Medicare Advantage plans may cover as supplemental health care benefits. We previously addressed the expansion of health-related supplemental benefits here. The move redefined “primarily health related” supplemental benefits to include items or services with a primary purpose to “diagnose, prevent, or treat an illness or injury, compensate for physical impairments, act to ameliorate the functional/psychological impact of injuries or health conditions, or reduce avoidable emergency and healthcare utilization.” A supplemental benefit is not primarily health related if it is solely or primarily used for cosmetic, comfort, or general use purposes. This week, while responding to requests for clarification, CMS provided the following examples of supplemental benefits that would qualify as primarily health related: Compression garments as part of an over-the-counter benefit Cooking classes as part of a nutritional/dietary or health education benefit Fall prevention kits as part of home & bathroom safety devices Implantable hearing aids, such as middle ear implants as part of a hearing benefit CMS noted that such primarily health related supplemental benefits should be entered and briefly described in the plan benefit package. New Supplemental Benefits for the Chronically Ill The Bipartisan Budget Act of 2018 introduced new categories of supplemental benefits for the chronically ill. Special supplemental benefits for the chronically ill (“SSBCI”) include benefits that are not primarily health related and may be offered non-uniformly[1] to eligible enrollees. According to the new law, a chronically ill person: (1) has one or more comorbid and medically complex chronic conditions that is life threatening or significantly limits the overall health or function of the enrollee, (2) has a high risk of hospitalization or other adverse health outcomes, and (3) requires intensive care coordination.[2] For 2020, CMS will consider any enrollee with a condition identified as a chronic condition in section 20.1.2 of Chapter 16b of the Medicare Managed Care Manual to meet the statutory criterion (1) above, which would include approximately 73 percent of the Medicare Advantage population. Medicare Advantage plans must document their determinations that enrollees meet all three criterion above before providing SSBCI. In addition to being limited to chronically ill enrollees, SSBCI must “have a reasonable expectation of improving or maintaining the health or overall function of the enrollee as it relates to the chronic condition or illness.” CMS explained that SSBCI could be provided to enrollees with degenerative conditions whose health worsen over time, even though this may apparently contradict the requirement that SSBCI improve or maintain the health or function of individuals. The SSBCI need only improve or maintain the health or overall function of an enrollee while the enrollee is using said supplemental benefit. Permissible examples of SSBCI include: Meals furnished to the enrollee beyond a limited basis Transportation for non-medical needs such as grocery shopping Pest control Indoor air quality equipment and carpet shampooing to reduce irritants that may trigger asthma attacks Benefits to address social needs Capital or structural improvements, e.g., permanent ramps, and widening hallways or doorways Medicare Advantage plans must still incur a non-zero direct medical cost for supplemental benefits. CMS stated that, for SSBCI, such incurred cost should be a non-administrative cost even if it is not necessarily paid to a medical provider. For example, a plan may contract with a community-based organization such as a meal delivery service. For any questions about this increased flexibility, please your contact the authors or your regular attorney at Dorsey & Whitney.   [1] CMS is waiving uniformity requirements with respect to SSBCI, as authorized by Section 1852(a)(3)(D)(ii) of the Social Security Act. [2] Section 1852(a)(3)(D)(ii) of the Social Security Act.

The Centers for Medicare & Medicaid Services (CMS) is “actively working” on updates to regulations under the federal physician self-referral law (or “Stark Law”), according to CMS Administrator Seema Verma during a March 4, 2019 speech. Verma stated that the updated regulations will be issued later this year, and “will represent the most significant changes to the Stark law since its inception.” Verma explained in her remarks that the Stark Law, when enacted in 1989, made sense in a fee-for-service context, but as health care transitions to a value-based system where providers take on risk and payment is for outcomes rather than individual services, “we don’t have nearly as much need to interfere with who’s getting paid for what service.” According to Verma, CMS hopes that Stark Law regulatory changes “will help spur better care coordination and help support our work to remove barriers to innovation while continuing to provide appropriate safeguards for our programs.” Verma stated that the updated regulations will include “clarifying the regulatory definitions of volume or value, commercial reasonableness and fair market value; addressing issues such as lack of signature, incorrect dates or other areas of technical noncompliance; and updating the regulation to address a world in which there are cybersecurity and electronic health records requirements.” These Stark Law regulatory reforms are part of the “Regulatory Sprint to Coordinated Care” launched by the Department of Health and Human Services (HHS). Under this initiative, various HHS agencies have issued requests for information (RFIs) to solicit feedback from stakeholders on removing regulatory obstacles to care coordination. CMS published an RFI on June 25, 2018 soliciting comments regarding Stark Law reforms (as we described in our post here), which received 392 comments before the close of the comment period. We anticipate that CMS will summarize and respond to many of the comments that it received in preamble to the proposed Stark Law regulations to be issued later this year, as well as incorporate suggestions from stakeholders in the proposed regulations themselves. Also as part of the Regulatory Sprint, the HHS Office of Inspector General (OIG) published an RFI on August 27, 2018 soliciting comments on reforms to the anti-kickback statute and beneficiary inducements civil monetary penalty (as we described in our post here), which received 359 comments before the close of the comment period. Additionally, the HHS Office for Civil Rights (OCR) published an RFI on December 14, 2018 soliciting comments on reforms to the Health Insurance Portability and Accountability Act (HIPAA) privacy and security regulations, on which the comment period closed last month. The fourth and final area of focus of the Regulatory Sprint (according to an HHS press release) is 42 CFR Part 2, which relates to the confidentiality of substance use disorder patient records. An RFI under the Regulatory Sprint for this regulation has not been published by the Substance Abuse and Mental Health Services Administration (SAMHSA, which is the agency that administers this regulation). We will provide information about regulatory reform developments under these other areas of the Regulatory Sprint as they become available.

The U.S. Department of Health and Human Services Center for Medicare and Medicaid Innovation (“CMS Innovation Center”) issued a press release on February 14, 2019, announcing the Emergency Triage, Treat, and Transport Model (the “ET3”). The ET3 is a five-year payment model that will test two new Medicare ambulance supplier and provider payments for: Treatment “on-the-scene” or through telehealth; and Emergency transport to alternative destinations such as a primary care office or urgent care clinic. Currently, Medicare only authorizes payment for emergency ambulance services when they transport patients to hospitals, critical access hospitals, skilled nursing facilities, and dialysis centers. As such, ambulance suppliers and providers often bring Medicare beneficiaries to a hospital emergency department, even if there is a more convenient and appropriate setting available. There are many instances where treatment could be provided either on-the-scene or at a lower-acuity destination, but those options are not payable under Medicare and thus largely ignored. Both new payment options offer the opportunity for ambulance suppliers and providers to deliver care to Medicare beneficiaries in ways not typically considered in the past. Ambulance suppliers and providers can expand their partnerships beyond hospitals to include primary care doctors’ offices, urgent care clinics, or any number of other lower-acuity destinations. Additionally, ambulance suppliers and providers can partner with qualified health care practitioners to provide telehealth services in order to increase their participation in the growing digital health industry. The goal is to help reduce unnecessary emergency department visits and improve the efficiency and quality of care. The ET3 summary provides three means by which the ET3 will “reduce expenditures and preserve or enhance quality of care": Providing person-centered care, such that beneficiaries receive the appropriate level of care delivered safely at the right time and place while having greater control of their health care through the availability of more options; Encouraging appropriate utilization of services to meet health care needs effectively; and Increasing efficiency in the EMS system to more readily respond to, and focus on, high-acuity cases, such as heart attacks and strokes. As stated in the press release, ET3 is another step in the larger effort towards a value-based health care system that aims to deliver the right care, from the right provider, at the right price. The CMS Innovation Center anticipates that payments made through the ET3 will begin January 1, 2020, and end December 31, 2024. Moving forward, the CMS Innovation Center will begin accepting applications from Medicare-enrolled ambulance suppliers and providers in summer 2019. Once participants are selected to test the ET3, the CMS Innovation Center will begin contracting with local governments or other entities that operate 911 dispatches in locations where participating ambulance suppliers and providers serve. These contracts will help develop medical triage lines that will screen 911 callers before ambulance launch. If you would like to explore these opportunities further, please contact anyone in Dorsey’s Healthcare practice or your regular Dorsey attorney.

This month the Department of Justice rough a "first of its kind" action against two pharmacies, their owner, and three pharmacists for allegedly dispensing and billing Medicare for prescriptions in violation of both the Controlled Substances Act and the False Claims Act. For more on information on this, visit our FCA Now blog, linked here: https://dorseyfca.com/doj-levels-false-claims-act-at-pharmacies-to-combat-opioid-crisis/

The Office of Inspector General of the Department of Health and Human Services (“OIG”) released a proposed rule to eliminate safe harbor protection under the anti-kickback statute for drug price reductions that pharmaceutical manufacturers pay to Medicare and Medicaid plan sponsors and their pharmacy benefit managers (“PBMs”). The OIG proposed replacing the current safe harbor protection for drug price discounts and rebates with a new safe harbor to protect only those drug price reductions that are set in advance and are applied fully to the price of the product charged to the Medicare or Medicaid beneficiary at the point of sale. In addition, the OIG proposed a new safe harbor to protect compensation from pharmaceutical manufacturers to PBMs for services provided to the manufacturer, but only if those payments are fixed, fair market value payments not tied to volume or value, and the PBM discloses such payments to its health plan customers. The OIG’s proposals could have a significant impact on the drug discount and rebate arrangements that are commonly in place between manufacturers and Medicare Part D plans/Medicaid managed care organizations (and PBMs acting on behalf of these plans). The OIG’s proposals would also impact Medicare and Medicaid beneficiaries who would be entitled to receive any such discounts directly at the point of sale. The proposed rule release can be found here and is expected to be published in the Federal Register on February 6. The proposed effective date of the new rules is January 1, 2020, with an earlier effective date of 60 days after the final rule is published, for the new point of sale safe harbor.           I.        Discount Safe Harbor – Changes to Focus on Point-of-Sale Reductions in Drug Prices   The federal anti-kickback statute (Social Security Act § 1128B(b)) makes it a criminal offense for anyone knowingly and willfully to pay, solicit, or receive anything of value to induce referrals of items or services that are reimbursable under any federal health care program. Violation of the statute is a felony, and can carry civil fines, imprisonment, exclusion from federal health care programs, and be the basis for liability under the False Claims Act. An existing safe harbor protects from anti-kickback statute liability discounts and rebates on drug prices that pharmaceutical manufacturers pay to health plans or their PBMs. The OIG’s proposal would revise the discount safe harbor to exclude from protection any reduction in price or other compensation in any form paid from a pharmaceutical manufacturer to a Medicare Part D or Medicaid managed care organization or their PBM in connection with the sale or purchase of a prescription drug. The proposal reflects OIG’s concern that the current manner in which drug price discounts and rebates are structured does not result in lower drug costs to federal programs and federal program beneficiaries, and in fact may be a cause of rising drug costs, and may be contrary to the purposes of the anti-kickback statute. In its place, the OIG proposes to add a new safe harbor focused narrowly on point-of-sale reductions in prescription drug prices. That safe harbor would protect reductions in the price charged by a manufacturer for drug products that are payable by a Medicare Part D or Medicaid managed care organization or their PBM, but only if that price reduction meets three conditions (the “Point of Sale Safe Harbor”): First, the reduced price must be set in advance. OIG intends this to mean that the terms of the price reduction are fixed and disclosed in writing to the plan sponsor by the time of the initial purchase. Second, the sale may not involve a rebate unless the full value of the price reduction is provided to the dispensing pharmacy through chargebacks. This means that when a pharmacy dispenses a drug to a beneficiary, the total payment to the pharmacy (including the beneficiary co-payment, payment from the health plan, and any chargeback payment from the manufacturer) must be no less than the drug price agreed between the manufacturer and the health plan sponsor or their PBM. Lastly, the reduction in price must be completely applied to the price charged to the beneficiary at the time of sale. This means that the drug price to which the beneficiary’s cost-sharing obligations apply at the point of sale must be the same price (taking into account all discounts) that the manufacturer charges to the plan sponsor or their PBM. The OIG also noted that the discount safe harbor would continue to not apply if a manufacturer offered a price reduction to payors other than Medicare and Medicaid payors (i.e., situations in which parties “carve out” referrals of federal health care program beneficiaries or business from otherwise “questionable” financial arrangements). The OIG is especially concerned with these “carve out” arrangements if the offer of a discount on products would serve as an inducement for the purchase of products that are reimbursable by federal healthcare programs (e.g., offering a discount to a private health plan that is conditioned, even implicitly, on a product’s favorable formulary placement in the health payor’s Part D plans).            II.        New PBM Service Fee Safe Harbor   In addition, the OIG proposed a new safe harbor to protect compensation from pharmaceutical manufacturers to PBMs for services rendered to the manufacturers that relate to PBMs’ arrangements to provide PBM services to health plans (the “PBM Service Fee Safe Harbor”). The OIG did propose three specific conditions that must be met in order for compensation to be protected under the PBM Services Fee Safe Harbor. The first proposed condition of the safe harbor would require the PBM and the pharmaceutical manufacturer to have a written agreement that covers all of the services the PBM provides to the manufacturer in connection with the PBM’s arrangements with health plans for the term of the agreement, and specifies each of the services to be provided by the PBM and the compensation for such services. Notably, the OIG declined to propose a specific definition for PBM services but did provide a list of examples of services that it generally considers to be PBM services, including: contracting with a network of pharmacies; establishing payment levels for network pharmacies; negotiating rebate arrangements; developing and managing formularies, preferred drug lists, and prior authorization programs; performing drug utilization review; and operating disease management programs. The second proposed condition requires that compensation paid to the PBM must: (i) be consistent with fair market value in an arm’s-length transaction; (ii) be a fixed payment, not based on a percentage of sales; and (iii) not be determined in a manner that takes into account the volume or value of any referrals or business otherwise generated between the parties, or between the manufacturer and the PBM’s health plans, for which payment may be made in whole or in part under Medicare, Medicaid, or other Federal health care programs. Finally, the Department proposes that the PBM disclose in writing to each health plan with which it contracts at least annually, and to the Secretary upon request, the services it rendered to each pharmaceutical manufacturer that are related to the PBM’s arrangements with that health plan and the associated costs for such services. Other than the proposed revisions to the discount safe harbor, and the new PBM Service Fee Safe Harbor, the OIG did not propose to modify any other existing safe harbors which PBMs may use to protect payments from manufacturers. The OIG specifically noted the possibility that certain types of remuneration that manufacturers might pay to PBMs could continue to be protected under another existing safe harbor. For example, PBMs could presumably continue to rely on the Group Purchasing Organization (GPO) safe harbor to protect certain administrative fees paid by drug manufacturers to PBMs for GPO services, even if those fees are based on the total prescription volumes of health plans on behalf of which the PBM contracts with the manufacturers.          III.        Conclusion   The OIG proposal reflects a clear intent to substantially alter many of the current drug discount and services compensation practices among pharmaceutical manufacturers and Part D/Medicaid MCO payers and their PBMs. The proposal also reflects the OIG’s skepticism that current drug discount and compensation practices among manufacturers and PBMs are sufficiently transparent to health plans to ensure that all appropriate cost reductions and value is passed through to health plans and reflected in lower health plans costs and lower premiums for beneficiaries. The proposal to exclude drug price reductions to Part D and Medicaid MCO health plan sponsors and PBMs is proposed to be effective on January 1, 2020. The OIG is also proposing that the new Point-of-Sale Safe Harbor will take effect in a shorter time frame of sixty (60) days after the rule is finalized. Comments to the proposed rule may be submitted 60 days after publication in the Federal Register. There are a number of steps that parties to the type of arrangements covered by the proposed rule should take, including reviewing their current discount and rebate agreements to determine whether there will need to be amendments to these contracts in order to comply with the proposed rule, if it is finalized. Parties will also need to evaluate what compliance measures are needed in order to operationalize the changes in these arrangements to ensure compliance with the new safe harbor requirements. Finally, in light of the attention OIG is giving to these type of arrangements, now would be an opportune time to review arrangements for compliance with the current safe harbor restrictions, such as the carve out restriction described above. If you have further questions about this proposed rule, please contact the authors or any other health care transaction and regulatory attorneys at Dorsey & Whitney.

Today, the Centers for Medicare and Medicaid Services (“CMS”) released additional tips regarding submitting Open Payments data.[1] A quick refresher: Submitting data through CMS’s application, Open Payments, is the means to fulfill the Sunshine Act, a federal regulatory requirement that applicable manufacturers, group purchasing organizations (“GPOs”), and health care providers disclose: a) certain transfers of value given to physicians and teaching hospitals, as well as b) any ownership or investment interest physicians, or their immediate family members, may have in their company. As previous Open Payments reporting entities know all too well, submitting data in the Open Payments system requires careful attention to detail, and can often be a time-consuming, painstaking process. CMS’s notice included a new document, “Open Payments Submissions Suggestions,” highlighting, among other things, two key issues for reporting entities to be aware of heading into this year’s submission period: Accuracy is important. While users may submit data in the appropriate field and format, if the content of the submission contains errors – even minor errors such as stray punctuation – the content of the submission will not be valid. Takeaway for reporting entities: Carefully reviewing and validating submissions, and ensuring enough time during the process to do so, is key to a smooth and stress-free Open Payments submission process. Note that even extra spaces at the tail end of a field will cause your submission to error out – one must scrutinize that closely. Submit early in the reporting period. While reporting entities have until March 31, 2019 to report data, CMS reminded users that the system becomes busy towards the end of the reporting period – we have, in fact, seen the system hang as the submission deadline nears. Should reporting entities uncover problems, they may find themselves scrambling to meet the reporting deadline. Takeaway for reporting entities: Allotting enough time to review and validate data well in advance of the March 31, 2019 deadline ensures that any uncovered issues can be addressed without becoming major obstacles to meeting the reporting deadline. We recommend that you complete your data formatting and input no later than six weeks prior to the deadline (roughly mid-Feb.) to allow time for initial submission, clean-up of errors, and correction of those errors for final submission. We hope this notice was helpful, and we are happy to answer further questions.  Dorsey Health Strategies has extensive experience in preparing and submitting Open Payments submissions on behalf of our clients, and we’d be pleased to help your organization with this year’s submission. If you’d like to learn more about how we can support you, please contact us at 612.492.6418. [1] Note that the Open Payments submission window is fast approaching, opening on February 1, 2019.

The Justice Department announced in a recent press release that it obtained more than $2.8 billion in settlements and judgments from cases involving fraud and false claims against the government. For more information, visit our FCA Now Blog: https://dorseyfca.com/for-fy2018-justice-department-touts-nearly-3-billion-in-false-claims-act-recoveries-mostly-from-qui-tams-and-alleged-healthcare-frauds/  

On December 20, 2018, CMS announced the first part of its two-part advance notice to implement changes to the Medicare Advantage (“MA”) risk adjustment methodology for 2020 (the “Advance Notice”), which can be found here. A key element of the CMS proposal in the Advance Notice is to incorporate into the risk adjustment methodology the number of conditions an individual beneficiary may have, making an adjustment as the number increases. This proposal is intended to meet a risk adjustment requirement added by the 21st Century Cures Act (42 U.S.C. 1395w-23(a)(1)(I)(i)(I)). As a matter of background, in order to mitigate against the risk of only the healthiest Medicare beneficiaries being targeted to participate in the MA program, federal payments to MA plans are adjusted to reflect how sick their members are. The sicker a member is, the higher the payment to the member’s MA plan is supposed to be. Under the current risk adjustment model, the member’s level of sickness or “risk score” is determined in large part by identifying certain health conditions the member has that are included in the model, i.e., “payment conditions.” The proposed risk adjustment model in the Advance Notice would make a further adjustment as the number of payment conditions the member has increases, up to a maximum of 10 conditions. In addition, what constitutes payment conditions in the proposed model would expand to include categories for mental health, substance use disorder, and chronic kidney disease. As an alternative to the proposed model described above, the Advance Notice presents another payment condition count for public comment. This alternative model supplements the proposed model mentioned above by adding categories for pressure ulcers and dementia as payment conditions. CMS intends to phase-in implementation of one version of these new risk adjustment models beginning with 2020 payments, which payments are proposed to be a 50/50 blend of the current model and the new model. The 21st Century Cures Act requires full implementation of the new risk adjustment model by 2022. The Advance Notice also includes a proposal to phase-in a change how CMS calculates an MA member’s risk score. For 2020, CMS proposes that half of the risk score be calculated using diagnoses from encounter data (i.e., treatment information from a clinician), Risk Adjustment Processing System (“RAPS”) inpatient diagnoses, and fee-for-service (“FFS”) diagnoses, and that half of the risk score will be calculated with diagnoses from RAPS and FFS diagnoses. This proposal would result in increased importance of encounter data to establish a member’s risk score. The second part of CMS’s Advance Notice regarding MA capitation rates and final payment policies for 2020 has not yet been released. Comments on the risk adjustment methodology modifications proposed in the first part are due February 19, 2019 and can be submitted here. CMS will publish the final 2020 MA rate announcement on or before April 1, 2019.