Healthcare & Life Sciences

Despite widespread vaccine availability and the corresponding optimism about returning to “normal,” the coronavirus pandemic continues to spawn hundreds of employment and health-related lawsuits.  Many of these lawsuits have been aimed at employers in the healthcare sector and relate to workplace safety, retaliation, and wrongful termination or wrongful denial of leave.  In fact, since our last update on this topic (available here), the healthcare sector has increased its relative share of coronavirus lawsuits compared to other industries.  In December 2020, approximately 20 percent of lawsuits alleging labor and employment violations related to coronavirus arose from the healthcare industry; today, that number is approximately 25 percent. The total number of coronavirus lawsuits has also increased dramatically.  At the end of 2020, 1,235 total lawsuits had been filed against employers related to the coronavirus.  Today, that number has more than doubled; there have been 2,560 lawsuits, including 200 class actions.  States with the most filings include California (666), New Jersey (293), Florida (198), New York (184) and Ohio (156). Whether brought in California, Iowa, or elsewhere, coronavirus lawsuits most commonly assert that employers violated federal and state mandates, guidelines, and regulations regarding employee safety.  One such federal mandate was the Families First Coronavirus Response Act (FFCRA), passed by Congress in March 2020 (and, with certain exceptions, expired in December 2020).  While operative, the FFCRA required employers with fewer than 500 workers to provide employees with a certain amount of compensated time off for various reasons linked to COVID-19, including if employees become ill.  Importantly, however, the FFCRA provided that certain employees—i.e., “health care providers and emergency responders”—may be excluded from entitlement to both emergency family leave and emergency paid sick leave.  In addition to FFCRA cases, employees have also filed lawsuits alleging that their employers violated the federal WARN Act (or similar state laws), which in certain circumstances requires that employers with 100 or more employees provide at least 60 days’ notice before conducting a mass layoff. Even though there are fewer lawsuits involving COVID-19 related issues in states like Iowa, the recently filed Iowa cases are representative of the types of cases occurring across the country.  In one case, an employee of a hospital asserts that she was terminated after she raised concerns about the lack of available personal protective equipment and about staff failing to wear masks correctly.  She also claims that she raised concerns about an social event where staff were attending without masks and without adhering to social distancing guidelines.  Another case involves claims by a food manufacturer’s nurse supervisor asserting her employer’s lack of preparedness for COVID-19 and her resulting firing after she raised safety concerns. Although other employment-related cases in Iowa have been filed against employers outside the health care industry, similar cases could be filed against those in the health care industry in the future.  These cases include allegations that employers denied leaves of absence for an individual with high risk conditions and failure to implement proper screening, social distancing and other protective measures, which in one case resulted in deaths from COVID-19.  On the flip side, Iowa has also seen recent litigation filed with an individual asserting a civil rights violation for requiring students to wear a mask to school. A recent development that may impact future coronavirus litigation is the updated federal guidance on mask mandates.  On May 13, 2021, the U.S. Centers for Disease Control and Prevention (“CDC”) revised its guidance to reflect that “fully vaccinated” individuals no longer need to wear masks, whether indoors or outdoors, except in limited circumstances.  And while there is a caveat for “local business and workplace guidance,” OSHA is advising employers to follow CDC guidelines for fully-vaccinated employees.  Accordingly, employers across the nation now face the practical challenge of maintaining a safe and compliant workplace in an increasingly open environment, while at the same time minimizing their risk for legal liability. While many states have enacted legislation that limits the liability of healthcare providers for actions or omissions during the pandemic, most of the legislation leaves openings for plaintiff’s lawyers to argue that their clients’ claims are not prohibited, especially with respect to employment-related claims.  For example, Iowa enacted the “COVID-19 Response and Back-to-Business Limited Liability Act”.  Under the Iowa Act, providers cannot be held civilly liable for various actions, which include, but are not limited to screening, assessing, diagnosing, caring for or treating individuals with COVID-19. The Act also provides protection for acts or omissions relating to non-COVID-19 patients, if those acts or omissions result from supporting the state’s response to COVID-19. This may include acts such as providing treatment outside the premises of a health care facility or using equipment and supplies outside their normal use.  As seen by the lawsuits described above, the Iowa Act does not prevent the filing of employment-related claims and notably, liability can still be established even in non-employment related contexts if the provider acted recklessly or engaged in willful misconduct. Navigating the highly dynamic landscape of federal, state, and local coronavirus rules and policies presents numerous challenges for employers.  But healthcare providers can still employ a number of proactive steps to reduce their potential exposure. Providers should understand their obligations under relevant federal and state law and provide employees protected leave as appropriate. When in doubt, we recommend that employers err on the side of granting the requested leave. Providers should revise company policies as necessary to incorporate the new regulations that apply to COVID-19 exposure and sick leave. To the extent feasible, providers should consider offering teleworking opportunities for eligible employees. Providers should implement a system for recording employees’ requests for leave and the reasons supporting those requests, i.e., an employee’s symptoms and the date for a test or doctor’s appointment. However, providers should not require employees to provide further documentation, such as certification that the employee sought a diagnosis or treatment from a healthcare provider. Providers should be mindful of the risks of taking personnel actions that could lead to discrimination or retaliation lawsuits by workers who requested or took applicable leave. As always, providers should properly document their termination decisions. Providers should carefully consider whether and how they will ask employees to provide proof of vaccination, and they must be aware of relevant legal considerations if making those inquires. Several jurisdictions have implemented laws banning employers from requiring so-called “vaccine passports” or other methods of requiring individuals to provide proof of vaccination to gain access, entry, or service. Providers may initially want to strongly encourage employees to get vaccinated—with the caveat that it may be mandatory in the future—and only require vaccination in the future if absolutely necessary.

In 2018, the U.S. Department of Health and Human Services (“HHS”) launched the “Regulatory Sprint to Coordinated Care” to accelerate a transformation of the healthcare system, with a focus on removing “unnecessary obstacles” to coordinated care (the “Regulatory Sprint”). Several HHS agencies requested comments and information from the public and have published new or proposed regulations as part of the Regulatory Sprint on areas that have historically been viewed as barriers to innovative care coordination arrangements—namely, healthcare fraud and abuse and health information privacy. On November 20, 2020, the HHS Office of Inspector General (“OIG”) and Centers for Medicare & Medicaid Services (“CMS”) each issued a sweeping set of final regulations that introduced significant new value-based terminology, safe harbors and exceptions, as well as clarifications of existing requirements, under the federal anti-kickback statute (“AKS”) and federal physician self-referral law (“Stark Law”), respectively. Additionally, the OIG issued final regulations related to modernizing the civil monetary penalty law governing inducements provided to Medicare and Medicaid beneficiaries (the “CMPL”).  The final OIG and CMS rules are effective on January 19, 2021, with the exception of changes to the Stark “group practice” definition, which do not go into effect until January 1, 2022.  There are hundreds of pages of preamble guidance and revised regulation text setting forth these sweeping changes to the Stark Law, AKS and CMPL regulations from CMS and OIG.  To help you digest these materials, a team of attorneys from Dorsey & Whitney’s Healthcare Transactions and Regulations Practice Group has published two white papers, which are available at the links below.  In addition, we have posted at a link below the playback of a webinar we hosted about the final rules on January 6, 2021.  The white papers and webinar playback provide an in-depth summary of the changes to these regulations, including key provisions from CMS and OIG preamble guidance.  Finally, we have posted below redlines comparing the existing Stark Law, AKS and CMPL regulations to the revised version of each of these regulations in the final rules. With respect to health information privacy, the HHS Office for Civil Rights (“OCR”) issued a Notice of Proposed Rulemaking (“NPRM”) on December 10, 2020 which proposes changes to the Health Insurance Portability and Accountability Act (“HIPAA”) and to the Health Information Technology for Economic and Clinical Health Act (“HITECH”) Privacy Rule.  Additionally, the HHS Substance Abuse and Mental Health Services Administration (“SAMHSA”) published final rules to revise regulations related to the privacy of substance use disorder treatment records in July 2020. These changes in federal regulations are anticipated to make a significant impact on healthcare providers and other stakeholders that may have been reticent to initiate certain care coordination arrangements because of perceived regulatory barriers and lack of regulatory clarity.  In addition, clarifications to existing regulations impact stakeholders beyond their involvement in care coordination arrangements. The team of attorneys in Dorsey & Whitney’s Healthcare Transactions and Regulations Practice Group will continue to closely monitor these changes, and post updates and analysis below as new information becomes available. Stark Regulatory Changes Effective January 1, 2022 Require Modifying Certain Group Practice Compensation Methodologies | News & Resources Webinar Playback: Final Stark and Anti-Kickback Statute Rules: What You Need to Know White Paper: Understanding the Final Rules to Revise the Stark Law Regulations White Paper: Understanding the Final Rules to Revise the Anti-Kickback Statute and Beneficiary Inducement Civil Monetary Penalty Regulations The Regulatory Sprint Catches up to HIPAA: New Proposed HIPAA Rules Redline of Final AKS Regulatory Text Redline of Final CMP Regulatory Text Redline of Final Stark Regulatory Text effective 1.1.2022 - 411.352(i) only Redline of Final Stark Regulatory Text effective 1.19.2021 Much-Anticipated Final Rules to Revise Stark Law, Anti-Kickback Statute, Beneficiary Inducement CMP Regulations Released under “Regulatory Sprint to Coordinated Care” CMS Finalizes Changes to the Stark Advisory Opinion Regulations; 2020 DHS Code List and CPI-U Updates Sweeping Proposals Issued by CMS to Revise Stark Law Regulations  Sweeping Proposals Issued By OIG To Make Changes To The Anti-Kickback Statute Safe Harbors And Add An Exception To The Civil Monetary Penalty Law Governing Beneficiary Inducements A Massive Number of New Health Law Regulatory Proposals as Part of the “Regulatory Sprint to Coordinated Care”: Proposed Changes to the Stark Law, Anti-Kickback Statute, Beneficiary Inducement CMP, Privacy Laws Governing Substance Use Disorder Records, and the Stark Law Advisory Opinion Process CMS "Actively Working" on Stark Law Reforms to be Issued Later this Year; "Regulatory Sprint to Coordinated Care" Continues OIG Seeks Public Input on Anti-Kickback Statute and Beneficiary Inducements CMP as part of the “Regulatory Sprint to Coordinated Care” Calls for Modernizing the Stark Law Continue; CMS Seeks Public Input on Stark Law Reforms

On January 1, 2022, changes to the federal physician self-referral law (“Stark Law” or “Stark”) group practice definition special compensation rule go into effect.  Among other things, these changes revise the rule related to overall profits to prohibit pooling and distributing profits from designated health services (“DHS”) on a service-by-service basis, which is sometimes referred to as “split pooling.”  As of that date, profits from all the DHS of the practice, or a component of the practice that consists of at least five physicians (a “5+ physician pod”), must be aggregated before distribution.  Group practices that use split pooling need to modify their compensation methodologies to account for this change by January 1.  Because of the time and effort involved in modifying physician compensation methodologies, now is the time for physician practices to evaluate whether any modifications to their compensation methodologies are needed in order to comply with this change. Physician practices also need to be aware of important commentary from the Centers for Medicare & Medicaid Services (“CMS”) on the special rule that clarifies CMS’s intentions regarding permissible DHS profit sharing and additional revisions to the regulation text that impact profit sharing, which may also necessitate (or, in some cases, permit) changes to certain group practice compensation methodologies. These changes and commentary, which are described in detail below, are part of a sweeping set of final rules issued last fall by CMS to revise the Stark regulations, which were part of the “Regulatory Sprint to Coordinated Care” (the “Final Rules”).  This white paper summarizes the Final Rules, and more information about the Regulatory Sprint can be found here.  Most of the Final Rules went into effect on January 19, 2021, but changes to the group practice definition will not become effective until January 1, 2022.  The revised version of the group practice definition that will be in effect as of January 1 is available here, and a redline comparing the version that is currently in effect to the revised version is available here. Read more here.

“Granny cams” or family-placed electronic monitoring in a nursing facility have become more commonplace.  Cameras are easier to obtain and set up and can easily be linked to one or more family member’s cell phones.  With COVID visiting restrictions making it more difficult for families to visit their loved ones in person, more and more people will be considering their options for keeping an eye on their family member living in a long term care facility. Some states have passed legislation to establish certain regulations or parameters around the use of granny cams in the long term care setting.  Others, including Iowa, are considering such legislation. Most states, however, do not have any statutory or regulatory requirements and thus, long term care facilities must determine how to deal with use of such cameras. The first question a long term care facility must ask is whether it is advisable to have a written policy.  If you are in a state with a statute or regulation on granny cams, you likely should have – and may be required to have – a written policy to comply with those requirements.  If you are in a state without any statutory or regulatory provisions on electronic monitoring in long term care, your initial reaction may be that having a policy provided to residents and family members will only encourage them to obtain cameras.  However, a resident or family member who wants a camera will likely place one anyway, and you may be better off to at least have a set of ground rules for everyone to follow with respect to such cameras. There are numerous considerations for handling the use of family-placed electronic monitoring in your facility: Is the resident competent to decide if he or she wants a camera in the room? If not, who can make the decision for the resident as to whether a camera can be placed in the room?  Financial and medical power of attorneys do not expressly cover the ability to consent to being videotaped, but such consent arguably falls under some of the broad powers generally given to a medical power of attorney.  The decision-maker question gets messier if there is no designated medical power of attorney or if there are joint medical power of attorneys who do not agree. Does the resident have a roommate? If so, the roommate has privacy rights that must be considered and protected.  A policy can provide restrictions on the direction the camera is pointing and also require that a roommate must give consent.  The policy can also address the resident’s options when a roommate does not consent to having the camera in the shared room. Should you require that the family disclose the existence of the camera to you? Any policy should require such disclosure so that proper signage could be placed on the doors to the room alerting people that they may be videotaped while in the room. This disclosure and signage will help reduce or eliminate liability to you (and the family) for possible illegal, covert recordings that may violate state or federal wiretapping and/or communication interception laws. Will the recording be video only or will it include audio? The inclusion of audio increases the complications and issues involved, because it may “pick up” discussions that are confidential or private in nature regarding the resident’s roommate or other discussions that may occur in the hallway or near the room. This issue should be assessed in light of federal and state-specific laws regarding the recording of verbal conversations. Who is responsible for the camera set up and operation and the resulting video? A policy should clarify that the family is responsible for the camera, its operation and the videos that are created by it.  If the facility were to take possession of the recordings, it unleashes a whole host of regulatory issues including HIPAA protections and possible self-reporting or disclosure requirements. The policy should place certain restrictions upon the camera, such as requiring a proper electrical connection (i.e., not using an extension cord or draping a cord across a room), where and how it can be mounted or placed and/or generally requiring that the camera be placed in a safe manner that will not cause safety or fire hazards.  A facility may also consider whether the use of its private Wi-Fi (and any associated cost) versus public Wi-Fi would be allowed for cameras requiring an internet connection.  The policy should also address what happens when the camera malfunctions.  For example, if it goes off (like a fire alarm) due to low battery or other complications, can it simply be turned off?  Does the family need to be notified when such issues occur?  The best bet is to have the facility take little to no responsibility for the actual operation of the camera or its resulting video and rather simply provide parameters around its placement and safe use. What are the evidentiary rules and issues with the camera footage? While this question is not likely something that you can fully address or avoid with a policy, you should consider the possible uses of the video and inform your staff to be aware of these possibilities.  Videos could be submitted to the state survey agency and used to confirm or dispute that certain cares were provided, they could be used in criminal actions, and they could be used in civil actions for malpractice.  While every state’s evidentiary rules and case law may differ and the facts of how the video was captured and maintained will impact its admissibility, everyone should be aware that their actions may be recorded.  Hopefully, this awareness will encourage everyone to do better and at the end of the day, improve the cares that are provided to your residents. If you are operating an assisted living facility, the considerations are slightly different in that the space in which the camera is situated is usually considered more like a personal home and is typically subject to landlord tenant laws.  However, some of the same considerations – especially those involving whether the camera is capturing video and audio, ensuring that use of the camera is compliant with federal and state wiretapping and communication interception laws and avoiding fire and other safety hazards with the camera – will need to be addressed. While these are difficult issues that can vary from state to state, facilities should not avoid this discussion.  Granny cameras will likely only increase in use, especially as technology improves and as families tend to live further away from their parents or grandparents who are now living in your facility.  A clear policy and transparent communications with families on this issue can actually result in a positive relationship. Families will realize that a facility who is willing to allow them to place a camera must feel confident about the good care that will be provided to their loved ones, and everyone will understand the “rules of the game” when using such cameras.

On January 18, 2021, a lawsuit was filed against the U.S. Department of Health and Human Services (“HHS”) and the Centers for Medicare and Medicaid Services (“CMS”) challenging a CMS policy change dating back to 2017.  The plaintiffs, the National Consumer Voice for Quality Long-Term Care and the California Advocates for Nursing Home Reform, are non-profit consumer advocacy groups for long-term care.  The policy at the heart of the lawsuit concerns a change CMS made as to how civil monetary penalties (“CMP”) are imposed against nursing facilities. As a bit of background, under the Nursing Home Reform Act of 1987 (NHRA), Congress created a scheme whereby CMS and the states shared responsibility for ensuring states meet federal quality and safety standards of resident care for residents in nursing facilities.  Under this scheme, state agencies regularly evaluate a nursing facility’s compliance with the requirements by conducting periodic surveys, often unannounced. The survey findings would then be reported to the CMS regional offices (“RO”) with recommended enforcement actions.  Acting on the survey results and the recommendation from the state agency, the ROs would then impose per-day CMPs on facilities for past noncompliance with federal standards. The 2017 change, however, made clear that ROs, regardless of findings and recommendations from state survey agencies, are to impose a CMP for past noncompliance based only on each instance of noncompliance that occurred but was corrected before the state survey is conducted.  “Past noncompliance” is a statutorily defined term which means those situations in which a state finds that a nursing facility meets all of the federal requirements “but, as of a previous period, did not meet such requirements.”  With this 2017 policy change, if a facility has corrected that noncompliance just before the survey team shows up at the facility, even if the noncompliance had lasted months, then the facility would not be penalized for each day of noncompliance but rather, would receive a “per instance” CMP. The plaintiffs in the recently filed litigation argue that, by announcing to the state survey agencies that its ROs will assess CMPs only for each instance of past noncompliance and not for each day of past noncompliance, CMS’ policy change effectively contravenes Congress’ express intent to give the states the direction to recommend (and CMS the discretion to impose) a per-day CMP for past noncompliance. The complaint alleges that the plaintiffs have been adversely impacted by this change. Per instance CMPs currently range in amount, as adjusted for inflation, from a minimum of $2,233 to a maximum of $22,320 for each instance of noncompliance. 42 C.F.R. § 488.438(a)(2); 45 C.F.R. § 102.3. Taking the example of a non-immediate jeopardy deficiency, the maximum per-instance CMP that a nursing facility faces for this type of deficiency is $22,320, regardless of whether the facility has allowed the deficiency to remain uncorrected for one day, one week, or one month. By contrast, the maximum per day CMP for this type of deficiency begins to exceed, and quickly dwarfs, the maximum per instance CMP whenever the facility has allowed the deficiency to remain uncorrected for four or more days (4 x $6,695 = $26,780). The plaintiffs argue that the imposition of only per instance CMPs for past noncompliance will thus encourage nursing facilities to knowingly allow deficiencies to linger for days, weeks, or even months, until the next state survey, because the penalty will be the same regardless of whether the deficiency persisted for a day or a month.  As long the facility remedies the deficiency before the next survey (usually 12-15 months apart), the facility can only be fined the per instance maximum of $22,320. The human impact of this, as argued in the lawsuit, is that for each day a facility permits a deficiency to persist, whether it be for one week or a number of months, the residents at that facility may be endangered by the deficiency. As a result, the plaintiffs assert that if facilities do not fear the monetary penalties, they will be less inclined to make their facilities safe for residents. Certainly, nursing facilities across the country will see it very differently from the plaintiffs in the litigation.  Because surveys are unannounced, facilities do not “let down their guard” and intentionally allow the facilities to become less safe simply because they know they will be assessed a per instance penalty instead of a per day penalty.  Rather, the possibility of getting a per instance CMP (as opposed to a per day penalty) would be an incentive for nursing facilities to identify and correct issues immediately so that such issues will be identified as past noncompliance when the state survey agency does come knocking.  While there may be some bad actors out there, most nursing facilities are doing all that they can to avoid noncompliance. In other words, facilities’ actions and decisions are not based upon whether they would rather have a per day versus a per instance penalty. It is also notable that, while the litigation mentions the COVID-19 pandemic, it does not mention the enhanced CMPs that are now available for infection control violations.  CMS has been aggressively using these enhanced CMPs to impose large per instance and large per day CMPs for relatively low-level transgressions. For example, having one employee make an error on his/her mask wearing or daily documentation regarding COVID-19 symptoms (even if it does not lead to any adverse consequences) can result in a $15,000 CMP if the facility had any infection control deficiency in the last two years.  A surveyor may see a staff member not following the requirements every time (e.g. not wiping down the face shield after they sit it down for a few seconds, letting their mask fall below their nose, etc.) and may assess severe penalties as a result.  While most facilities would agree that infection control is important, these penalties are excessive, especially taking into account they are assessed for some of the more minor and isolated events that may occur. Facilities should be cognizant of this litigation and the views expressed by the organizations seeking to change the CMP landscape to be harsher than it is now.  CMS has already shown its willingness to increase the CMP levels for infection control purposes, and they may seek to expand such penalties on a more permanent basis. If you have any questions about any of the topics addressed in this post, please contact the authors or any member of the Dorsey & Whitney Health Transactions & Regulations Practice Group.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s FCA Now blog for today's post.  

In just two weeks, on January 19, 2021, a sweeping set of changes to the federal physician self-referral law (or “Stark Law”) and anti-kickback statute (“AKS”) regulations go into effect.  These changes, which are part of the U.S. Department of Health and Human Services (“HHS”) “Regulatory Sprint to Coordinated Care,” are the most significant changes to the Stark Law and AKS in a decade.  There are hundreds of pages of preamble guidance and revised regulation text setting forth these sweeping changes from the Centers for Medicare & Medicaid Services (“CMS”) and HHS Office of Inspector General (“OIG”). To help you digest these materials, a team of attorneys from Dorsey & Whitney’s Healthcare Transactions and Regulations Practice Group has published two white papers, which are available at the following links: White Paper: Understanding the Final Rules to Revise the Stark Law Regulations White Paper: Understanding the Final Rules to Revise the Anti-Kickback Statute and Beneficiary Inducement Civil Monetary Penalty Regulations These white papers provide an in-depth summary of the changes to these regulations, including key provisions from CMS and OIG preamble guidance.  Please contact the authors or your regular Dorsey attorney if you would like assistance with understanding how the final rules impact your organization.

Health and retirement benefit plans subject to the Employee Retirement Income Security Act (“ERISA”) have troves of personal information regarding plan participants and their beneficiaries—e.g., participants’ age, marital status, personal assets, medical and prescription drug claim data, and medical history. Although the Health Insurance Portability & Accountability Act (“HIPAA”) regulates treatment of protected health information, ERISA does not expressly address how plan fiduciaries may have a responsibility with respect to participants’ personal data or personally identifiable information (“PII”). Nevertheless, one emerging trend in ERISA litigation is lawsuits arguing that ERISA’s duties of loyalty and prudence, among other ERISA duties, impose a duty to protect participants’ privacy. These lawsuits often argue that participants’ data is a “plan asset” that, when used or disclosed improperly, gives rise to claims for breach of fiduciary duties and other claims under ERISA. Plan sponsors and fiduciaries should pay attention to this developing area of law and be proactive to ensure that their actions do not put participants’ personal information at risk, and be able to demonstrate that reasonable steps have been taken to protect such data. I. ERISA Duties Regarding Plan Assets ERISA imposes several duties on plan fiduciaries with respect to their use of plan assets. ERISA requires that plan fiduciaries act for the “exclusive purpose” of providing benefits to participants and beneficiaries. 28 U.S.C. § 1104(a)(1)(A). ERISA requires that fiduciaries act “with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent man acting in a like capacity and familiar with such matters would use . . .” Id. § 1104(a)(1)(B). ERISA also prohibits plan fiduciaries from engaging in certain prohibited transactions, including transactions between the plan and certain related parties, also known as parties in interest, which the fiduciary knows constitute a direct or indirect transfer to, or use by or for the benefit of, a party in interest, of any assets of the plan. 29 U.S.C. § 1106(a)(1). II. ERISA Liability for Fraudulent Distributions of Plan Assets When participants’ money is fraudulently withdrawn from their’ benefit accounts, they have sued plan fiduciaries for breach of fiduciary duty. For example, in Leventhal v. MandMarblestone Grp., LLC, a law firm partner brought an ERISA fiduciary breach claim against a plan administrator for approving fraudulent distributions from his 401(k) account. 2019 U.S. Dist. LEXIS 74123, at *7-17 (E.D. Pa. May 1, 2019). The court ruled that the claim survived dismissal because the plaintiff sufficiently alleged that the defendant failed “to act with the requisite prudence and diligence” when it did not alert plaintiff or institute other safeguards to protect against the fraudulent withdrawal requests. Id. at *15-17. A similar claim against the operator of a plan’s benefit center and website survived dismissal in Bartnett v. Abbott Labs., 2020 U.S. Dist. LEXIS 182645, at *18-19 (N.D. Ill. Oct. 2, 2020). These cases follow a familiar trend—lawsuits seeking to recover money that was stolen as a result of a data or cybersecurity lapse. Recent case law, however, suggests that fiduciaries may face ERISA claims for the improper use or disclosure of participant data itself, regardless of whether that data is used to make a subsequent fraudulent distribution. III. Is Participant Data Itself a “Plan Asset”? ERISA does not specifically define “plan assets,” but states that “’plan assets’ means plan assets as defined by such regulations as the Secretary [of Labor] may prescribe.” Those regulations define certain categories of “plan assets”—for example, “plan investments” (See 29 C.F.R. §§ 2510.3-101(a)(2)—but the Department of Labor has stated that “in situations outside the scope of the plan assets-plan investments regulation (29 C.F.R. § 2510.3-101), the assets of a plan generally are to be identified on the basis of ordinary notions of property rights under non-ERISA law.” See, e.g., Advisory Opinion 1993-14A. The question, therefore, is whether participant data is a plan asset under those “ordinary notions of proper rights.” Whether participant data is a plan asset is currently the subject of debate. On one hand, two recent court-approved settlements suggest that participant data may be viewed as plan asset. In Cassell v. Vanderbilt Univ., the university paid $14.5 million to settle breach of fiduciary duty and prohibited transactions claims premised on the plan’s recordkeeper’s use of participant data to market and sell additional services to the plaintiffs. See Second Amend. Compl., ¶¶ 279-82, No. 16-cv-02086 (M.D. Tenn. June 6, 2018), ECF No. 102. The settlement required the plan’s current recordkeeper to refrain from using participant data to market or sell products or services to plan participants. See Class Action Settlement Agreement § 10.6, No. 16-cv-02086 (M.D. Tenn. April 23, 2019), ECF No. 147-1. Another lawsuit alleging similar claims settled for $14 million and the settlement agreement contained a similar prohibition on the use of participant data to cross sell other products. See Class Action Settlement Agreement § 10.8, Kelly v. Johns Hopkins Univ., No. 16-cv-02835 (D. Md. Aug. 6, 2019), ECF No. 84-2. On the other hand, at least one court has ruled that participant data is not a “plan asset.” In Divane v. Northwestern Univ., plan participants alleged that the university breached its fiduciary duties and engaged in prohibited transactions when it allowed the plans’ recordkeeper to access participant data and use it to sell products to them. 2018 U.S. Dist. LEXIS 87645, at *36-37 (N.D. Ill. May 25, 2018), aff’d on other grounds, 953 F.3d 980 (7th Cir. 2020). The court rejected those claims, ruling that although “a compilation of the information [the recordkeeper] has on participants has some value . . . the Court cannot conclude that it is a plan asset under ordinary notions of property rights.” Id. at *38-39. The court emphasized that no court has yet recognized such a right, and that participant data was not “property the plan could sell or lease in order to fund retirement benefits.” Id. While Divine may have been the first court to rule on the issue, it will not be the last. The issue of whether participant data constitutes a plan asset is also pending in Harmon v. Shell Oil, Co., a case before the United States District Court for the Southern District of Texas. There, plaintiffs allege that the plan recordkeeper used (or could use) participant data to convince them to move their funds into higher cost, lower performing investments rather lower cost, better performing investments. See generally Am. Compl., 20-cv-00021 (S.D. Tex. May 21, 2020), ECF No. 84. According to the plaintiffs, that conduct amounts to a breach of fiduciary duties and prohibited transactions. In opposing dismissal, plaintiffs argue that participant data is an “asset” because it amounts to “intimate knowledge of financial and personal information combined with insider knowledge of exploitable triggering events,” such as retirement and marital status. Opp’n to Defs.’ Mot. to Dismiss at 14-15, 20-cv-00021 (S.D. Tex. June 6, 2020), ECF No. 93. Further, Plaintiffs argue that since this information “is collected by the Plan for the exclusive purpose of administering the Plan and providing benefits to participants,” it is a plan asset. Id. Plaintiffs also argue that the definition of “plan asset” includes participant data. Id. at 15-17. These cases are likely only the opening salvo of litigation regarding ERISA fiduciaries’ duties with respect to participant data. While the cases have primarily involved retirement benefit plans, they have implications for fiduciaries of health benefit plans regulated by ERISA as well. In addition to potential ERISA claims arising from data breaches or cybersecurity lapses, health plans may face ERISA claims regarding their use of participant data. Although the law in this area is still emerging, to minimize exposure ERISA fiduciaries should ensure that they are taking appropriate steps to protect participant data. There are many steps ERISA fiduciaries can take to safeguard participant data, including: Develop cybersecurity policies, including both procedures to prevent improper use or disclosure of participant data as well as an Incident Response Plan to execute in the event of a breach; Review agreements with third-party service providers to ensure they appropriately limit the use of participant data and mandate proper cybersecurity practices; Improve data security protocols to minimize the likelihood of unauthorized access to or use of participants’ data; and Consider obtaining cybersecurity insurance that will provide coverage in the event of a breach or other improper use of participant data. It may be too much to expect that participant data can be perfectly protected under all circumstances, especially given the almost ubiquitous attacks by cyber criminals, but ERISA fiduciaries would be well served to be able to demonstrate that reasonable steps were taken to provide data security, and that procedures were in place to respond to any unauthorized disclosure.

Among its many impacts, the coronavirus pandemic has already spawned hundreds of employment and health-related lawsuits, with even more litigation likely as businesses continue to bring back workers and increase operations.  Many of these lawsuits have been aimed at employers in the healthcare sector and relate to workplace safety, retaliation, and wrongful termination or wrongful denial of leave.  In fact, over 20 percent of the lawsuits alleging labor and employment violations related to the coronavirus arise from the healthcare industry. A recent lawsuit filed by a fired nursing assistant serves as a good example of the types of claims health care providers may soon face.  On April 1, 2020, Za’Taya Ballard was hired as a nursing assistant by Highland Park Care Center, a nursing home located in Pittsburgh.  On May 16, Ballard learned she had “prolonged close contact” with a person who had the virus.  Ballard was not wearing personal protective equipment at the time of the exposure.  Thereafter, Ballard notified the nursing home of her exposure and was removed from the upcoming work schedule so she could self-isolate for 14 days.  However, Ballard alleges that two days later, she was fired for missing work. On October 20, Ballard filed suit against the nursing home in Pennsylvania state court.  The case is Ballard v. Highland Park Care Center LLC, Case No. GD-20-011291, in the Court of Common Pleas of Allegheny County, Pennsylvania.  In her Complaint, Ballard brings a single count for “wrongful discharge in violation of public policy.”  According to Ballard, guidelines promulgated by the Centers for Disease Control, the Pennsylvania Department of Health, and the Governor of Pennsylvania evidence a “clearly-defined public policy” “for individuals who had prolonged exposure to confirmed cases of COVID-19 without protective gear to isolate themselves in an effort to prevent the virus’s spread.”  By purportedly firing her due to her request to quarantine, Ballard alleges the nursing home violated “a clear mandate of Pennsylvania and United States public policy.”  Ballard seeks back pay, compensatory damages, and punitive damages. Claims like those brought by Ballard are on the rise.  During the first five months of the pandemic, 459 lawsuits were filed against employers due to alleged labor violations related to the coronavirus.  During the next four months, 776 lawsuits were filed.  In the first half of November alone, 158 complaints were filed.  Of the 1,235 total lawsuits, 116 are class actions.  For example, in September, workers in California, Michigan, and Georgia filed unrelated lawsuits in which they claimed they were fired for quarantining after contracting COVID-19. Whether brought by an individual plaintiff or on behalf of a purported class, these lawsuits most commonly assert that employers violated federal and state mandates, guidelines, and regulations regarding employee safety.  One such federal mandate is the Families First Coronavirus Response Act (FFCRA), passed by Congress in March.  The FFCRA requires employers with fewer than 500 workers to provide employees with a certain amount of compensated time off for various reasons linked to COVID-19, including if employees become ill.  Importantly, however, the FFCRA provides that certain employees—i.e., “health care providers and emergency responders”—may be excluded from entitlement to both emergency family leave and emergency paid sick leave.  Please see our e-alert on this topic, available here. In addition to FFCRA cases, employees have also filed lawsuits alleging that their employers violated the federal WARN Act (or similar state laws), which in certain circumstances requires that employers with 100 or more employees provide at least 60 days’ notice before conducting a mass layoff. Although lawsuits focused on COVID-19 largely remain at the early stages of litigation, health care providers can employ a number of proactive steps to reduce their potential exposure. Providers should understand their obligations under relevant federal and state law and provide employees protected leave as appropriate. When in doubt, we recommend that employers err on the side of granting the requested leave; Providers should revise company policies as necessary to incorporate the new regulations that apply to COVID-19 exposure and sick leave; To the extent feasible, providers should consider offering teleworking opportunities for eligible employees; Providers should implement a system for recording employees’ requests for leave and the reasons supporting those requests, i.e., an employee’s symptoms and the date for a test or doctor’s appointment. However, providers should not require employees to provide further documentation, such as certification that the employee sought a diagnosis or treatment from a healthcare provider; and Providers should be mindful of the risks of taking personnel actions that could lead to discrimination or retaliation lawsuits by workers who requested or took applicable leave. As always, providers should properly document their termination decisions.

Today, the Department of Health and Human Services’ (“HHS”) Office for Civil Rights (“OCR”) issued a Notice of Proposed Rulemaking (“NPRM”) which proposes significant changes to the Health Insurance Portability and Accountability Act (“HIPAA”) and to the Health Information Technology for Economic and Clinical Health Act (“HITECH”) Privacy Rule (the “Privacy Rule”).  The NPRM includes numerous changes to the Privacy Rule that are part of HHS’ Regulatory Sprint to Coordinated Care which is intended to eliminate administrative barriers to a health care delivery system that fosters care coordination and value-based care for patients.  OCR also issued a fact sheet about this NPRM, which is available here. This NPRM comes nearly two years after OCR issued a Request for Information (“RFI”) in December 2018 calling for information from the public regarding ways that HIPAA regulations could be modernized to support coordinated, value-based care. These changes in federal regulations are anticipated to make a significant impact on healthcare providers and other stakeholders that may have been reticent to initiate certain care coordination arrangements because of perceived HIPAA violations or a lack of regulatory certainty. Clarifications to existing regulations will impact stakeholders beyond their involvement in care coordination arrangements.  The changes will also impact data sharing arrangements and reduce unnecessary administrative burdens on health care providers and health plans, such as eliminating the requirement to obtain an individual’s signature for the Notice of Privacy Practices (“NPP”) or the requirement to retain copies of the NPP for six years.  Further, the proposed changes to the Privacy Rule provide clarification to the laws governing patient rights of access to their health records, and help to better facilitate disclosures of health information in order to improve care for patients in emergencies or who are experiencing a health crisis, including mental health crises and opioid overdose situations. Comments to the NPRM are invited from stakeholders, and will be due some time in February 2021, at a date that is 60 days after the NPRM is published in the Federal Register. Please contact the author of this post or your regular Dorsey attorney if you have questions about how these changes to the Privacy Rule could impact you, and for assistance in submitting comments to the OCR. The team of attorneys in Dorsey & Whitney’s Healthcare Transactions and Regulations Practice Group will continue to closely monitor these changes, and post updates and analysis on Dorsey’s Health Law Blog and on Dorsey’s Regulatory Sprint Webpage as new information becomes available.

The Department of Health and Human Services Office of Inspector General (“OIG”) has issued a Special Fraud Alert to highlight what it views as inherent risks associated with speaker programs that pharmaceutical and medical device companies organize and fund. These programs are typically company-sponsored events at which one or more physicians or other health care professionals make presentations about a device or drug product or disease state.  The company will usually pay the speaker an honorarium and expenses, and may pay travel or other costs of attendees. Using unusually strong language, the OIG states that it is “skeptical about the educational value of such programs.”   Numerous investigations have revealed to the OIG that, often, health care professionals receive generous compensation to speak at these programs, and that the programs are offered under circumstances unconducive to learning, or involve audience members who have no legitimate reason to attend.  These cases cause the OIG to conclude that in many circumstances at least one purpose of the compensation paid to the speaker (and to the attendees), is to induce or reward referrals of the company’s products.  Any payment made purposefully to induce or reward referrals of items payable by a federal health care program is a violation of the federal anti-kickback statute, which is a felony punishable by a fine of up to $100,000, imprisonment for 10 years, or both.  Violation of the anti-kickback statute can also lead to liability under the federal civil false claims act, civil monetary penalties, and exclusion from federal health care programs.  Health care professionals who solicit or accept such payments are also at risk of violating the anti-kickback statute. Some of the characteristics of suspect speaker programs include: Sales or marketing personnel influence speaker selection; Health care professionals attend multiple programs on the same topic; The company sponsors numerous programs on the same or similar topics, particularly without a recent substantive change in the information; Significant time elapses with no new medical or scientific information nor new FDA-approved or cleared indication for a product; The company pays more than fair market value for the speaking services or pays compensation that takes into account the volume or value of past or potential future business generated by the health care professionals; Attendees include those without a legitimate business reason to attend; The location of the program is not conducive to the exchange of education information; or Alcohol (particularly fee alcohol), or a meal exceeding modest value is provided to attendees. The OIG points out that many other ways exist for health care professionals to obtain information about drug or device products, such as online resources, third-party educational conferences, medical journals, and others.  The existence of these other resources that do not involve payment to health care professionals suggests to the OIG that at least one purpose of payment associated with speaker programs is often to induce or reward referrals. The current pandemic emergency has put many in-person speaking programs on hold.  When in-person speaking programs resume, it will be important for medical device and pharmaceutical companies to review their speaker program practices, and take into account the OIG’s strong skepticism.   Both the OIG fraud alert and the alternative ways that health care professionals have learned about drug and device products during the pandemic have altered the landscape for speaker programs:  speaker program sponsors should take notice. If you have questions about the topic addressed here, please contact the author of any member of the Dorsey &Whitney Health Care Transactions & Regulations Practice Group.

On November 20, 2020, the Centers for Medicare & Medicaid Services (CMS) and the Department of Health and Human Services (HHS) Office of Inspector General (OIG) each released their much-anticipated final rules to revise the federal self-referral law (or “Stark Law”) regulations, the safe harbors under the federal anti-kickback statute (AKS), and regulations under the beneficiary inducements civil monetary penalty law (CMP).  The final rules are part of HHS’s “Regulatory Sprint to Coordinated Care,” which seeks to remove regulatory obstacles to care coordination and a value-based healthcare delivery system. The public inspection copy of the final CMS rules is available here, and the CMS fact sheet on the final rules is available here.  The public inspection copy of the final OIG rules is available here, and the OIG fact sheet on the final rules is available here.  Both rules will be published in the Federal Register on December 2, 2020. For our prior posts on the Regulatory Sprint to Coordinated Care, see here. We are reviewing the final rules and will post an in-depth analysis in the coming weeks.

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) has been actively enforcing HIPAA regulations this year, including a series of seven settlements under OCR’s Right of Access Initiative to enforce patients’ rights to timely access their medical records at a reasonable cost. This year, OCR has recorded more than $12.2 million in resolution agreements. This post summarizes OCR’s settlements in 2020 to date.  The OCR settlements have impacted a wide range of sectors in the health industry from health insurers, to hospital systems, physician clinics, FQHCs, mental health and substance abuse providers, business associates, and nonprofits serving those with AIDS/HIV.  Enforcement has been taken against all sizes of entities, including against solo practitioners and very small non-profits.  As with nearly all settlements with OCR, it was the initial breach notification that triggered the investigation.  However, the settlement ultimately resulted after OCR’s investigation discovered widespread non-compliance with HIPAA’s privacy and security requirements.  The following post provides a summary of these enforcement actions, and begins with an update about Anthem’s recent $39.5M settlement with 43 states and D.C. stemming from its massive data breach in 2014-2015, which resulted in a record $16 million settlement with OCR in 2018. Health Insurer Enforcement Anthem and 43-State Coalition Reach $39.5 Million Settlement Over Data Breach On September 30, 2020, state attorneys general in 43 states and Washington D.C. announced that they had reached a $39.5 million settlement with Anthem Inc., an Indianapolis, IN-based health insurer.  This settlement stemmed from an investigation by the state attorneys general into the largest health data breach in history, a series of state-sponsored cyberattacks in December 2014 and January 2015 that exposed the ePHI of nearly 79 million individuals.  In 2018, Anthem agreed to pay $16 million to OCR and to take substantial corrective action to settle potential violations of the HIPAA privacy and security rules related to the 2014 data breach. See the HHS press release about the OCR settlement here. Anthem has also paid $115 million to settle a class action related to the breach, the largest-ever class action settlement related to a data breach. Premera Blue Cross Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People In March, in the second-largest HIPAA settlement ever, Premera Blue Cross (PBC), the largest health plan in the Pacific Northwest, agreed to pay $6.85 to OCR and to implement a corrective action plan to settle potential HIPAA privacy and security rules violations related to a data breach. Using malware installed through a phishing email, cyber-attackers gained access to PBC’s system in August 2014 and went undetected until January 2015, resulting in the exposure of over 10.4 million individuals’ electronic protected health information (ePHI). OCR’s investigation determined that PBC had “systemic noncompliance with the HIPAA Rules including failure to conduct an enterprise-wide risk analysis, and failures to implement risk management, and audit controls.” See the HHS press release here. Hospital and Health System Enforcement Lifespan Pays $1.04 Million to Settle Unencrypted Stolen Laptop Breach Affecting Over 20,000 People In June, Lifespan Health System Affiliated Covered Entity (“Lifespan ACE”), a Rhode Island-based non-profit health system, agreed to pay a $1.04 million settlement to OCR and to adopt a corrective action plan to settle potential violations of the HIPAA privacy and security rules related to the theft of a hospital employee’s unencrypted laptop. The laptop contained the ePHI of more than 20,000 individuals. OCR’s investigation determined that there had been systematic noncompliance with the HIPAA Rules, including a failure to encrypt ePHI on laptops, a lack of device and media controls, and a failure to have a business associate agreement in place with the Lifespan Corporation, the parent company and business associate of Lifespan ACE. See the HHS press release here. Physician and Clinic Enforcement Solo Practice Pays $100,000 for Failing to Implement HIPAA Security Rule Requirements In February, Steven A. Porter, M.D., a Utah gastroenterologist and solo practitioner, agreed to pay $100,000 to OCR and to adopt a corrective action plan to settle a potential violation of the HIPAA security rule. OCR determined that Dr. Porter’s practice had demonstrated significant noncompliance with the HIPAA rules, specifically, failing to conduct any risk analysis and failing “to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.” See the HHS press release here. Orthopedic Clinic Pays $1.5 Million to Settle Systemic Noncompliance with HIPAA Privacy and Security Rules In July, Georgia-based Athens Orthopedic Clinic PA (“Athens Orthopedic”) agreed to pay $1.5 million to OCR and to implement a corrective action plan to settle potential violations of the HIPAA privacy and security rules. A hacker used a vendor’s credentials to access Athens Orthopedic’s electronic medical record system and exfiltrated patient health data, then demanded money from Athens Orthopedic in return for the return of the stolen records. Nearly 210,000 individuals were affected by the breach. OCR’s investigation found noncompliance with the HIPAA privacy and security rules, including “failures to conduct a risk analysis, implement risk management and audit controls, maintain HIPAA policies and procedures, secure business associate agreements with multiple business associates, and provide HIPAA Privacy Rule training to workforce members.” See the HHS press release here. FQHC Pays $25,000 for Failing to Implement HIPAA Security Rule Requirements In March, Metropolitan Community Health Services (“Metro”), doing business as Agape Health Services, agreed to pay $25,000 to OCR and to implement a corrective plan to settle potential violations of the HIPAA security rule. In 2011, Metro reported impermissible disclosure of PHI to an unknown email account, which affected over 1,200 patients. OCR’s investigation found that Metro had failed to conduct any risk analysis, failed to implement any HIPAA security rule policies and procedures, and not provided workforce members with security awareness training until 2016. Metro is a Federally Qualified Health Center that provides medical services in underserved areas in rural North Carolina on a sliding fee scale, which was taken into account in reaching this agreement. See the HHS press release here. Business Associate Enforcement CHSPSC Agrees to Pay $2.3 Million to Settle Data Breach Affecting Over 6 Million People In March, CHSPSC LLC (“CHSPSC”) agreed to pay $2.3 million and to adopt a corrective action plan to settle potential violation of the HIPAA privacy and security rules related to a breach affecting more than 6 million people. CHSPSC is based in Tennessee and provides a variety of business associate services, including IT and health information management. In 2014, the Federal Bureau of Investigation (FBI) notified CHSPSC that it had traced a cyber-attack to CHSPSC’s information system.  OCR’s subsequent investigation found “longstanding, systematic noncompliance” with the HIPAA security rule, including “failure to conduct a risk analysis, and failures to implement information system activity review, security incident procedures, or access controls.” See the HHS press release here. Right of Access Initiative Enforcement In 2019, OCR announced the Right of Access Initiative as an enforcement priority to support individuals’ right to timely access to their health records at a reasonable cost and in the readily producible format of their choice under the HIPAA privacy rule’s right of access provision, 45 CFR § 164.524. The HIPAA Rules generally require covered health care providers to provide medical records within 30 days of the request and providers can only charge a reasonable cost-based fee. This right to patient records extends to parents seeking access to their minor children’s medical records. To date this year, OCR has completed seven enforcement actions totaling $396,500 in settlement payments under the Right of Access Initiative, bringing the total number of enforcement settlements under this initiative to nine. In June, Housing Works Inc. (Housing Works), a New York City-based non-profit organization providing a range of services to individuals living with and affected by HIV/AIDS, including health care, agreed to pay $38,000 to OCR and to take corrective actions to settle a potential right of access violation. In complaints filed with OCR in July and August 2019, a patient alleged that he had not received his records in response to a June 2019 request. OCR opened an investigation, found a possible violation, and the patient received his medical records in November 2019. In July, All Inclusive Medical Services (AIMS), a California-based multi-specialty family medicine clinic, has agreed to pay $15,000 to OCR and to adopt a corrective action plan to settle a potential right of access violation. A patient alleged that in January 2018, AIMS had denied her requests to inspect and receive a copy of her records, in an April 2018 complaint filed with OCR. The patient ultimately received her medical records in August 2020. In August, Beth Israel Lahey Health Behavioral Services (BILHBS), the largest network of mental health and substance use disorder services in eastern Massachusetts, agreed to pay $70,000 to OCR and to take corrective actions following a potential right of access violation. A personal representative filed a complaint with OCR in April 2019 alleging that she had requested her father’s medical records in February 2019 and BILHBS had failed to provide them. BILHBS provided the requested medical records in October 2019. In August, Patricia King, M.D. (King MD), a small provider of psychiatric services in Virginia, agreed to pay $3,500 to OCR and to adopt a corrective action plan to settle a potential right of access violation. OCR received a complaint from a patient in October 2018, alleging that King MD failed to respond to her August 2018 request for her medical records. After OCR provided King MD with technical assistance on right of access requirements, a second complaint, and an OCR investigation that found that the failure to provide the requested medical records was a potential violation, the patient received her medical records in July 2020. In August, Wise Psychiatry, PC (Wise Psychiatry) a small provider of psychiatric services in Colorado, agreed to pay $10,000 to OCR and to take corrective actions to settle a potential right of access violation. A father requested his minor son’s medical records in November 2017, and following two complaints to OCR, OCR providing technical assistance to Wise Psychiatry on the HIPAA right of access requirements, and OCR opening an investigation, Wise Psychiatry sent the requested medical records in May 2019. See HHS’s press release about OCR’s first five right to access settlements of 2020 here. In September, Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (SJHMC), agreed to pay $160,000 and to adopt a corrective action plan to settle a potential right of access violation. SJHMC is based in Arizona and is a large, acute-care hospital with several hospital-based clinics. A mother made several requests for her son’s medical records, as his personal representative, beginning in January 2018, but did not receive all of the requested records until December 2019. See the HHS press release here. In September, NY Spine Medicine (NY Spine), a private medical practice specializing in neurology and pain management with offices in New York and Florida, agreed to pay $100,000 and to take corrective actions to settle a potential right of access violation. A patient requested a copy of her medical records in June 2019, and NY Spine provided some records in response, but did not provide the diagnostic films that the patient had specifically requested until October 2020, after OCR had initiated an investigation. See the HHS press release here. OCR’s enforcement of the HIPAA security and privacy rules this year is increasingly aggressive. Per HHS, OCR’s enforcement actions are “designed to send a message to the health care industry about the importance and necessity of compliance with the HIPAA Rules.”   If you have questions about HIPAA compliance, please contact the authors, your regular Dorsey attorney or any attorney in the Dorsey & Whitney health transactions and regulations practice group.

On September 22, 2020, the Department of Health and Human Services (“DHHS”) finalized a new rule to expand the scope of qualified reimbursable expenses incurred by living organ donors to include lost wages, child-care expenses, and elder-care expenses. The new rule goes into effect on October 22, 2020, and is a win for living organ donation. This final rule aligns with the initial proposed rule, and you can read our post on the proposed rule here for additional background. The final rule is associated with Section 8 of Executive Order 13879 titled “Advancing American Kidney Health,” issued on July 10, 2019. The Executive Order directed DHHS to propose a regulation allowing living organ donors to be reimbursed for related lost wages, child-care expenses, and elder-care expenses through the Reimbursement of Travel and Subsistence Expenses Incurred toward Living Organ Donation program (the “Program”) authorized under section 377 of the Public Health Service Act. Every 10 minutes, another person is added to the national organ transplant waiting list, and approximately 20 people die every day while waiting for a transplant. This final rule should expand the pool of willing organ donors and also improve donation outcomes by: (i) providing for the receipt of more high quality organs; (ii) reducing the waiting period for an organ; and (iii) resulting in better clinical outcomes than continuing dialysis or receiving a deceased donor kidney transplant. A new regulatory section will be added at 42 C.F.R. § 121.14 to list the categories of “incidental non-medical expenses” to include lost wages, child-care expenses, and elder-care expenses. The other criteria of the Program remain applicable and will still need to be met for reimbursement to be provided to living organ donors and other individuals evaluated for living organ donation. Of note, concurrently with the publication of this final rule DHHS published a final notice that changes the Program’s eligibility guidelines to increase the household income eligibility threshold to 350 percent of the DHHS Poverty Guidelines (from the current threshold of 300 percent) for living organ donors and organ recipients. If you have any questions on this new rule, one of the authors or your regular Dorsey attorney would be happy to assist you.

The Centers for Medicare and Medicaid Services (“CMS”) published an Interim Final Rule in the Federal Register on September 2, 2020 to supplement and strengthen the agency’s enforcement of COVID-19 reporting requirements.  The final rule also modifies various aspects of Medicare reimbursement methodologies for health plans, physicians, and other providers.  This post summarizes each of these regulatory changes, which are effective as of September 2, 2020. New Enforcement Requirements for COVID-19 Related Data Reporting To assist public health officials in detecting and tracking COVID-19 outbreaks and save lives, CMS is adding new reporting requirements for healthcare facilities along with expanded CMS enforcement authority to ensure compliance with such reporting requirements. The Interim Final Rule addresses reporting and related enforcement for three general categories of healthcare entities: long term care (LTC) facilities, hospitals and critical access hospitals (CAHs), and laboratories. A. LTC Facilities Under CMS regulations issued in May, LTC facilities are required to electronically report COVID-related data to the Centers for Disease Control and Prevention (CDC) on a weekly basis. Facilities must report a variety of information, including suspected and confirmed COVID-19 infections among residents and staff, the number of COVID-19 resident and staff deaths, the personal protective equipment and hand hygiene supplies in the facility, and more. The Interim Final Rule allows CMS to impose civil money penalties (“CMPs”) if a LTC facility fails to submit its weekly report.  CMS may impose a minimum of $1,000 for an initial violation. For every subsequent time the facility fails to report the required data, the CMP imposed will increase by $500, up to a maximum of $6,500.  For example, a facility that fails to report for two consecutive weeks will be subject to a minimum CMP of $2,500: $1,000 for the first week and $1,500 for the second week. CMS waived the normal notice-and-comment process due to the urgent need to track and contain COVID-19 infection outbreaks. LTCs are subject to these new penalties for reporting failures effective September 2, 2020, and the penalties will continue to be in effect for up to one year beyond the end of the COVID-19 public health emergency (“PHE”). B. Hospitals and CAHs The Interim Final Rule also makes daily reporting of COVID-related data a Condition of Participation in the Medicare and Medicaid programs for hospitals and CAHs. To support broader surveillance of the spread of COVID-19, CMS will require hospitals and CAHs to report certain COVID-related information to the Department of Health and Human Services (“HHS”) daily, through a standardized format specified by HHS, set forth here. CMS does not have authority to impose CMPs on hospitals or CAHs who fail to provide this reporting. However, should a hospital or CAH fail to consistently report test results throughout the duration of the PHE, it will be non-compliant with the hospital and the CAH Conditions of Participation set forth at 42 CFR §§ 482.42(e) and 485.640(d), respectively, and consequently subject to CMS termination of its Medicare provider agreement. C. Laboratories Additionally, the Interim Final Rule modifies the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”) to require all laboratories to report SARS-CoV-2 test results within 24 hours of a positive test result. Reports must be made throughout the PHE, as specified here.  If a laboratory fails to submit SARS-CoV-2 test results as required under the CLIA modifications, the Department of Health and Human Services may impose CMPs or other penalties on the laboratory. CMS states that CMPs for reporting violations will be $1000 for the first day of noncompliance, and $500 for each subsequent day the laboratory fails to report SARS-CoV-2 test results. The applicable statute allows for the imposition of CMPs of up to $10,000 for each violation. LTCs Must Test Residents and Staff for COVID-19 In addition to reporting COVID-related data, LTCs are required under the new rule to test their facility residents and staff for COVID-19.   Testing includes not only staff employees, but volunteers and those providing services under arrangements at the facility.  Testing must be conducted in a manner consistent with current professional standards of practice for COVID testing.   Documentation of testing and resulting must be provided in staff personnel records, and in resident medical records. CMS has published additional guidance here that addresses testing frequency, types of testing that should be conducted, and guidance on handling staff who refuse testing, among other topics. Limitation on Medicare Coverage of COVID-19 Testing Without an Order In a prior Interim Final Rule with Comment Period, CMS expanded coverage for COVID-19 testing for Medicare beneficiaries by eliminating the need for an order from a treating physician or other practitioner. CMS has now revised this policy, citing fraud and abuse concerns and clinical concerns that beneficiaries are receiving too many COVID-19 tests without medical attention and oversight.  Consequently, beginning September 2 and continuing for the duration of the PHE, Medicare will cover only one (1) COVID-19 diagnostic test without the order of a physician or other practitioner.   A single otherwise covered laboratory test each for influenza or a similar respiratory condition needed to obtain a final COVID-19 diagnosis, when performed in conjunction with a COVID-19 test, will also be covered.  Medicare will cover additional COVID-19 tests only with the order of a physician or other practitioner. Any COVID-19 test(s) that a beneficiary received prior to September 2, 2020 is disregarded for purposes of this new single COVID-19 test coverage rule. CMS points out that this coverage rule applies to the Medicare program only; COVID-19 testing coverage policies for group health plans, health insurance issuers, and other public programs must comply with applicable law. CMS is also allowing pharmacists and other practitioners allowed to order laboratory tests in accordance with state scope of practice and other laws to fulfill the requirements related to orders for covered COVID-19 tests for Medicare patients. Quality Reporting: Updates to the Extraordinary Circumstances Exceptions (ECE) Granted for Four Value-Based Purchasing Programs in Response to the PHE for COVID-19, and Update to the Performance Period for the FY 2022 SNF VBP Program Early in the PHE, CMS granted several “Extraordinary Circumstances Exceptions” (“ECEs”) which relieved facilities of certain data collection and reporting obligations so that more time and resources could be directed to patient care. CMS used such data reporting to score certain program performance, resulting in adjustments of Medicare payments pursuant to certain value-based and quality-related features of Medicare reimbursement methodologies.  CMS states that, although it was gathering data on these programs, it has concerns about the national comparability of data due to the geographic differences of COVID-19 incidence rates and hospitalizations and the impacts of varying state and local laws and policy changes implemented in response to COVID-19. Therefore, the Department proposes updating the ECEs it granted for the following value-based purchasing programs: The End-Stage Renal Disease Quality Incentive Program (ESRD QIP); The Hospital-Acquired Condition (HAC) Reduction Program; The Hospital Readmissions Reduction Program (HRRP); and The Hospital Value-Based Purchasing (HVBP) Program. Under the updated ECEs, CMS will only score data that was voluntarily reported for the fourth quarter of calendar year 2019. Further, CMS will exclude all data reported for the first or second quarter of calendar year 2020, due to the significant and variable impacts COVID-19 had on facilities during this period. In addition, the Interim Final Rule updates the performance period for the fiscal year 2022 SNF VBP Program, because CMS believes that the current measurement periods would not produce reliable results for measuring SNF quality of care as determined by hospital readmission rates.  The measurement periods are changing from October 1, 2019 through December 31, 2019 and July 1, 2020 through September 30, 2020 to April 1, 2019 through December 31, 2019 and July 1, 2020 through September 30, 2020. NCD Procedural Volumes for Facilities and Practitioners to Maintain Medicare Coverage The Interim Final Rule acknowledges that, because of the PHE, far fewer non-essential procedures have been performed over the past several months. As a result, hospitals and practitioners may not be able to meet certain procedural volume requirements that are set forth in certain national coverage determinations (“NCDs”), including: NCD 20.34 Percutaneous Left Atrial Appendage Closure (LAAC). NCD 20.32 Transcatheter Aortic Valve Replacement (TAVR). NCD 20.33 Transcatheter Mitral Valve Repair (TMVR). NCD 20.9.1 Ventricular Assist Devices (VADs). Typically, failure to meet the procedural volume requirements would prevent Medicare payment for those categories of procedures.  However, CMS will not enforce the procedural volume requirements contained in the four above-noted NCDs because of disruptions caused by the PHE. This waiver of enforcement only applies to facilities and practitioners that had met the volume requirements prior to the PHE for COVID-19. All other non-volume based coverage requirements under these NCDs remain in effect. Merit-Based Incentive Payment System (MIPS) Updates CMS is making changes to the Merit-Based Incentive Payment System (“MIPS”) for physicians and other clinicians, to reflect the manner in which Medicare beneficiaries are receiving primary care services during the PHE.  For the 2020 MIPS performance year and any subsequent performance year that starts during the PHE, CPT and HCPCS codes for communications technology-based services and telephone evaluation and management services are to be included in the definition of primary care services under MIPS.  This will allow those remote services to be included in CMS determinations of where Medicare beneficiaries receive a plurality of their primary care services for purposes of MIPS beneficiary assignment to physicians and other clinicians. CMS is also modifying one of the Improvement Activities in MIPS relating to COVID-19 clinical trial participation, so that clinicians can receive credit under this Improvement Activity not only for participating in a COVID-19 clinical trial, but also for participating in the care of patients diagnosed with COVID-19 and simultaneously submitting relevant clinical data to a clinical data registry for ongoing or future COVID-19 research. Recognizing Temporary Premium Credits as Premium Reductions CMS previously adopted policies allowing health insurance issuers offering health insurance coverage in the individual and small group markets on the American Health Benefit Exchanges established under The Patient Protection and Affordable Care Act (Pub. L. 111-148) to grant temporary premium credits for individuals and small businesses that may be struggling to pay premium during the PHE.  In this Interim Final Rule, CMS makes a number of technical changes and clarifications to ensure that health plan premium reporting takes into account any premium credits granted, including for purposes of medical loss ratio (MLR) reporting and rebates. Part C and Part D Health Plan Star Ratings Finally, CMS made changes to the Star Rating system for Medicare Part C and Part D health plans.  The Star Rating system allows CMS to publish comparative information to beneficiaries about Medicare Advantage and Medicare Part D health plans, and is the basis for determining quality bonus payments to Medicare Advantage plan, as well as beneficiary rebates. CMS currently excludes certain scores within the Stark Rating system if a plan has 60 percent or more of its enrollees living in a Federal Emergency Management Agency (FEMA)-designated Individual Assistance area.  Because of the PHE, the maintenance of this rule would remove almost all plans from those scoring metrics.  Consequently, CMS is removing that 60 percent rules for the 2022 Star Ratings (for which 2020 is the measurement year) to avoid having to exclude the vast majority of plans from the methodology. This recent Interim Final Rule clearly indicates that CMS wants to ensure consistent reporting of COVID-19 related data from laboratories, hospitals and long term care facilities.  It also illustrates the profound and widespread degree to which the PHE continues to impact Medicare reimbursement methodologies and systems. If you have any questions about the Interim Final Rule or any of the topics addressed in this post, please contact the authors or any member of the Dorsey & Whitney Health Transactions & Regulations Practice Group.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. We would like to thank Vanessa J. Szalapski for the following post from Dorsey’s FCA Now blog: The Department of Justice’s (“DOJ”) most recent settlement with Indivior Solutions, Inc., Indivior Inc., and Indivior plc (together, “Indivior”) demonstrates not only that the DOJ is continuing its pursuit of claims and settlements related to the opioid crisis, but also that the DOJ is searching for creative penalties beyond large monetary payouts. [Continue Reading]

On June 1, 2020, the Department of Justice (“DOJ”) issued an updated version of its “Evaluation of Corporate Compliance Programs” (the “DOJ Guidance”), available here. The DOJ Guidance is an update to guidance first issued by the DOJ in February 2017 (which we described in our prior blog post), and was last updated by the DOJ in April 2019.  Although the DOJ Guidance is directed to prosecutors, it is a useful roadmap for corporations in seeking to ensure their compliance program is effectively preventing, detecting and responding to improper conduct, and is not a program on paper only. The DOJ Guidance is intended to be used by prosecutors to assist them “in making informed decisions as to whether, and to what extent, [a] corporation’s compliance program was effective at the time of [an] offense, and is effective at the time of a charging decision or resolution, for purposes of determining the appropriate (1) form of any resolution or prosecution; (2) monetary penalty, if any; and (3) compliance obligations contained in any corporate criminal resolution (e.g., monitorship or reporting obligations).”  Thus, in the event that there is an investigation into alleged improper conduct, having a compliance program that operates in line with the DOJ Guidance may lead to a more favorable resolution than there otherwise would be. The DOJ Guidance notes that there are three “fundamental questions” a prosecutor should ask when evaluating compliance programs: Is the corporation’s compliance program well designed? Is the program being applied earnestly and in good faith? In other words, is the program adequately resourced and empowered to function effectively? Does the corporation’s compliance program work in practice? The DOJ Guidance sets forth a number of sample topics under the heading of each of the three questions listed above, which it says are not a checklist or formula, but are the topics “that the Criminal Division has frequently found relevant in evaluating a corporate compliance program both at the time of the offense and at the time of the charging decision and resolution.”  The DOJ Guidance emphasizes the importance of a compliance program being not merely a “paper program,” but rather one that is “implemented, reviewed, and revised, as appropriate, in an effective manner.” The most recent updates to the DOJ Guidance reflect the DOJ’s increased focus of taking a functional and dynamic approach to evaluating the effectiveness of a company’s compliance program.  The revisions explain new factors prosecutors may consider in the areas of risk assessment, policies and procedures, training and communications, mergers and acquisitions, and more in their assessment of corporate compliance programs.  Organizations should use the DOJ Guidance, including a consideration of these new factors, when evaluating the effectiveness of their compliance program. Key revisions to the DOJ Guidance are summarized below. Risk Assessments. The DOJ Guidance directs prosecutors to consider whether a company has “a process for tracking and incorporating into its periodic risk assessment lessons learned either from the company’s own prior issues or from those of other companies operating in the same industry and/or geographical region.” Prosecutors are also instructed to evaluate whether a company takes a continuous assessment approach to compliance review and updates, as opposed to a “snapshot-in-time” approach. Thus, it is imperative that compliance teams at an organization perform regular assessments, stay up-to-date on compliance problems, and incorporate lessons learned into the risk assessment process. Policies and Procedures. The DOJ Guidance continues to emphasize the importance of adequately communicating compliance policies and procedures throughout the company. The update includes two new questions related to the accessibility of policies and procedures: “Have the policies and procedures been published in a searchable format for easy reference?” and “Does the company track access to various policies and procedures to understand what policies are attracting more attention from relevant employees?” Training and Communications. New questions in the DOJ Guidance instruct prosecutors to evaluate whether a company is evaluating the effect of its training program on employee behavior or operations. Additionally, the DOJ will be assessing whether employees have opportunities to ask questions and whether the company overall has “relayed information in a manner tailored to the audience’s size, sophistication, or subject-matter expertise.” Confidential Reporting. The revisions also address confidential employee hotlines and other reporting mechanisms. Prosecutors will assess whether confidential reporting mechanisms are publicized both to employees and third parties, and whether a company is periodically testing the mechanism’s effectiveness. Third-Party Management. The DOJ Guidance adds a new question about a company’s management of third-party relationships: is risk assessment conducted only during the onboarding process or throughout the lifespan of the engagement? Mergers and Acquisitions. The DOJ has always considered comprehensive due diligence of acquisition targets to be an important part of a compliance program. The recent revisions to the DOJ Guidance, however, recognize that pre-acquisition due diligence may not always be possible. Where such pre-acquisition diligence is not conducted, the DOJ Guidance indicates that a company should have a legitimate reason for not conducting it, and that the company should conduct post-acquisition diligence and audits.  In addition, an acquired entity should always be timely integrated into a company’s existing compliance program structure. Compliance Resources. Adequate resources are essential for effective implementation of a compliance program. The DOJ Guidance instructs prosecutors to ask whether a company’s compliance program is “adequately resourced and empowered to function effectively.” Companies should continue to invest in the training and development of personnel and in the compliance program more broadly, throughout all levels of the organization. * * * Overall, the revised DOJ Guidance affirms previous guidance and stresses that compliance programs should be well-resourced, dynamic, and tailored to a company’s unique size, structure, and needs.  The DOJ Guidance also serves as a reminder that even in the midst of a global pandemic, the compliance function of an organization must remain robust and ever-adapting.  Healthcare organizations should use the DOJ Guidance and other existing resources to thoughtfully design, assess, and revise their compliance programs. Dorsey attorneys have substantial experience with assisting health industry clients in implementing compliance programs following the elements of an effective compliance program from the Department of Health and Human Services Office of Inspector General, in updating compliance programs, and in evaluating the effectiveness of existing compliance programs in line with the DOJ Guidance and other guidance.  For assistance with your organization’s compliance program, please contact the authors or your regular Dorsey attorney.

Current economic conditions have put additional strain on organizations across the health care spectrum in unprecedented ways. However, along with new challenges, both market conditions and new guidance from the Internal Revenue Service (IRS) bring fresh opportunities for tax-exempt senior services and other elder care organizations to consider new efficiencies, maximize revenues, and even expand operations. In particular, organizations in acquisitive periods and large health care systems looking to expand their spectrum of elder care services may find significant opportunities in the current market. Evaluating related versus unrelated revenue streams and associated expenses. Under Sections 511 through 514 of the Internal Revenue Code of 1986, as amended (IRC), tax-exempt organizations are required to pay unrelated business income tax (UBIT) on income from activities that are unrelated to their charitable, educational, scientific, religious or other exempt (or “related”) purposes. The unrelated business income (UBI) rules are complex, and such complexity can deter tax-exempt organizations from taking a comprehensive analysis relating to revenue sources and expense allocations for UBI calculation purposes. Changes to methodology for categorizing related versus unrelated revenue and expenses have implications across an organization’s financial reporting, to include tax returns and other compliance filings in both future and prior years. In May 2020, the IRS issued proposed regulations to give guidance for tax-exempt organizations calculating UBTI on separate unrelated trades or businesses (commonly referred to “siloing” such revenue and expenses) under IRC Section 512(a)(6), which was added by the 2017 Tax Cuts and Jobs Act (TCJA). The proposed regulations provide organizations guidance on how to identify and calculate UBTI from separate trades or businesses for purposes of IRC Section 512(a)(6), which generally requires organizations operating more than one unrelated trade or business to compute UBTI separately for each siloed trade or business. Once the businesses are broken into separate silos, an organization must determine how to allocate expenses that may apply to more than one activity to each silo. The preamble to the Section 512(a)(6) proposed regulations indicates that the IRS intends to publish a separate notice of proposed rulemaking to provide further guidance on expense allocation in calculating UBTI. In the interim, tax-exempt organizations may allocate such expenses using any reasonable method. Shifting models of care and new payment models across the health care spectrum provide not only cost efficiencies but also opportunities to analyze whether a tax-exempt organization’s activities (and associated revenues and expenses) are actually patient revenue related to such organization’s exempt purposes. And, if any activities are deemed unrelated to a tax-exempt organization’s exempt purposes, the new Section 512(a)(6) guidance provides a new benchmark to analyze such revenues and make good faith determinations relating to expense allocations. Acquiring assets out of bankruptcy proceedings. Economic downturns are painful, but for organizations with an acquisitive mindset, such market events can provide opportunities to expand existing and add activities through purchasing assets or businesses out of bankruptcy proceedings. If a tax-exempt organization is merely purchasing assets out of bankruptcy, the tax status of the former owner is typically not relevant. However, if the tax-exempt organization is purchasing the shares or equivalent ownership units of a taxable entity, it may still be a good fit for the acquiring tax-exempt organization but such transactions will require proper planning to protect the acquirer’s tax-exempt status.                                                                                                                                                                                 _____________________________________   Acquiring for-profit entities or operations. Whether acquired through bankruptcy proceedings or by a straight equity purchase, acquiring existing operations or ownership of a for-profit organization may present beneficial opportunities to tax-exempt organizations to enhance or expand their elder care service spectrum. While many senior housing organizations operate as for-profit enterprises, converting to a tax-exempt organization as a stand-alone organization or by acquisition by a tax-exempt organization may be a win-win for both organizations with proper planning. Additional considerations include the applicability of IRC Section 337(d), which requires certain corporations that transfer all or substantially all of their assets to a tax-exempt entity or convert from a taxable corporation to an exempt entity to recognize gain or loss as if it had sold the assets at fair market value. Also, the IRS has recently stated that organizations formerly operated as for-profit entities prior to their conversion to Section 501(c)(3) entities are one of the issues included on the annual compliance strategy list, and therefore may have a higher chance of future examination. However, if the converted organization files a new application for tax-exempt status by filing a Form 1023, Application for Recognition of Exemption Under Section 501(c)(3) of the Internal Revenue Code, that is approved by the IRS the examination would seem fairly straightforward so long as the Form 1023 is an accurate representation of the entity’s activities. Despite the additional due diligence and planning required, the last several years have shown several high-profile mergers and acquisitions of both tax-exempt and taxable skilled nursing facilities by tax-exempt organizations. Tax-exempt organizations, especially those looking to expand operations geographically or to encompass a more comprehensive spectrum of care should not discount opportunities to acquire an existing enterprise based solely on its taxable status. If you want to review your organization’s current senior services activities and/or evaluate expansion of elder care, please contact the authors or your regular Dorsey attorney.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey's Robert Webber, Ieva Aubin, Penni Frank, and Erin Bukacek for the following e-update: The U.S. Department of Health and Human Services (HHS) has made a significant change regarding eligibility for clinical J-1 waivers for foreign educated physicians who have completed graduate medical programs or training in the United States. This development changes the landscape for J-1 visa waiver availability nation-wide...[Continue Reading]    

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Andrew Brantingham, Ross C. D'Emanuele, and Alex Hontos for the following post from Dorsey's FCA Now blog: The CARES Act allocated $100 billion in relief funds to hospitals and other healthcare providers, to be distributed by the Department of Health and Human Services (“HHS”) through the Public Health and Social Services Emergency Relief Fund (or “Provider Relief Fund”). Many healthcare providers across the country have received payments from the Fund...[Continue Reading]

As we described in our prior blog post, on March 30, 2020, the Centers for Medicare & Medicaid Services (“CMS”) published multiple COVID-19 Blanket Waivers for Health Care Providers. CMS announced another round of Blanket Waivers on April 30, which are available here. These waivers provide additional flexibility to health care providers responding to the COVID-19 pandemic by expanding access to telehealth services and giving providers and facilities relief from many reporting and audit requirements so they can focus on patient care. The following is a summary of the new Blanket Waivers available to providers. These Blanket Waivers are retroactively effective back to March 1, 2020 and will continue through the end of the emergency declaration. Flexibility for Medicare Telehealth Services Eligible Practitioners CMS is expanding the types of health care practitioners who may be reimbursed for providing Medicare telehealth services to all practitioners who are eligible to bill Medicare for non-telehealth services. Thus, physical therapists, occupational therapists, speech language pathologists, and others may now furnish and receive reimbursement for Medicare telehealth services. Audio-Only Telehealth for Certain Services CMS is now permitting more services to be provided by audio-only technology. Several evaluation and management services, behavioral health counseling, and educational services no longer require a two-way, real-time interactive communication between the patient and practitioner. For a list of billing codes for these audio-only services, please review the CMS list of Medicare telehealth services, available here. Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) Certain Staffing Requirements In an effort to address potential staffing shortages, CMS is waiving the requirement that certain practitioners (NP, PA, or certified nurse-midwife) be available to furnish patient care services at least 50 percent of the time a Rural Health Clinic operates. However, a physician, nurse practitioner, physician assistant, certified nurse-midwife, clinical social worker, or clinical psychologist must still be available to furnish patient care services at all times the Rural Health Clinic operates. Long-Term Care Facilities and Skilled Nursing Facilities (SNFs) and/or Nursing Facilities (NFs) Quality Assurance and Performance Improvement (QAPI) CMS is modifying QAPI program requirements to the extent necessary to narrow the scope of the QAPI program to focus on adverse events and infection control. This will help ensure facilities focus on aspects of care delivery most closely associated with COVID-19 during the PHE. In-Service Training Nursing assistants will now have more time to complete their required 12 hours of in-service training. CMS has extended the deadline for completing this training until the end of the first full quarter after the declaration of the PHE concludes. Detailed Information Sharing for Discharge Planning for Long-Term Care (LTC) Facilities In order to help long-term care facilities expedite the discharge and movement of residents among care settings, CMS is waiving the discharge planning requirement that facilities must assist residents and their representatives in selecting a post-acute care provider using data such as standardized patient assessment data, quality measures, and resource use. All other discharge planning requirements remain in place. Clinical Records Long-term care facilities may now take ten working days to provide a resident a copy of their records after requested. Previously, facilities were required to provide a copy within two working ways when requested by the resident. Home Health Agencies (HHAs) Training Requirement for Home Health Aides Medicare conditions of participation for HHAs state that each Home Health Aide must receive 12 hours of in-service training every 12 months. To give both aides and the nurses that provide the training more time to perform patient care, this training requirement is postponed, and the new deadline for aide in-service training is the end of the first full quarter after the declaration of the PHE concludes. Detailed Information for Discharge Planning The requirement to provide patients with detailed information regarding discharge planning in selecting a post-acute care provider (such as quality and resource use measures of potential providers) is temporarily waived during the PHE. All other discharge planning requirements remain applicable. Clinical Records HHAs may take ten business days to provide a patient with copies of their medical records, instead of four business days. Hospice Training Requirement for Home Health Aides Hospice conditions of participation requiring the annual assessment and in-service training and education of all individuals furnishing care is postponed until the end of the first full quarter after the declaration of the PHE concludes. HHAs and Hospice Onsite Supervisory Visits For both HHAs and Hospices, the condition of Medicare participation that requires a registered nurse (or for HHA any other appropriate skilled professional) to make an annual onsite supervisory visit for each aide is postponed. Postponed onsite assessments must be completed no later than 60 days after the expiration of the PHE. Quality Assurance and Performance Improvement (QAPI) To allow HHAs and Hospices to focus on COVID-19 effort, the requirement that HHAs and Hospices maintain an effective, ongoing, data-driven QAPI program is modified to narrow the scope of the mandated QAPI program to infection control issues. Remaining QAPI activities should focus on adverse events. Ambulatory Surgical Centers (ASCs) Medical Staff During the PHE, CMS is waiving the ASC conditions of coverage requiring ASCs to periodically reappraise medical staff privileges. This will allow physicians whose privileges will expire to continue practicing at the ASC without the need for reappraisal. Community Mental Health Centers (CMHCs) Quality Assurance and Performance Improvement (QAPI) While maintaining the general requirement that CMHCs maintain an effective, ongoing, data-driven QAPI program, CMS is waiving the specific detailed requirements for QAPI program organization and content to provide flexibility for CMHCs to focus QAPI resources on circumstances that arise during the PHE. CMHC modifications to QAPI programs must be consistent with a state’s emergency preparedness or pandemic plan. Home Services CMS is waiving the prohibition on CMHCs providing partial hospitalization services and other CMHC services in an individual’s home. This will allow clients to safely shelter in place during the PHE while receiving needed care and services from the CMHC. CMHCs must still assess client needs, implement and update each client’s individualized active treatment plan, and promote client rights, including a client’s right to file a complaint. 40% Rule To promote access to services, the requirement that CMHCs provide at least 40% of their items and services to individuals who are ineligible for Medicare benefits is waived. Physical Environment for Multiple Providers/Suppliers Inspection, Testing & Maintenance (ITM) under the Physical Environment Conditions of Participation: CMS is waiving the following physical environment requirements for Hospitals, CAHs, inpatient hospices, ICF/IIDs, and SNFs/NFs to reduce disruption of patient care and potential exposure/transmission of COVID-19. Requirements to maintain facilities and equipment to ensure an acceptable level of safety and quality are temporarily modified as necessary to permit these facilities to adjust scheduled inspection, testing and maintenance (ITM) frequencies and activities for facility and medical equipment. These facilities may adjust scheduled ITM frequencies and activities required by the applicable Life Safety Codes and Health Care Facilities Codes. The following are not included in this waiver:  Sprinkler system monthly electric motor-driven and weekly diesel engine-driven fire pump testing. Portable fire extinguisher monthly inspection. Elevators with firefighters’ emergency operations monthly testing. Emergency generator 30 continuous minute monthly testing and associated transfer switch monthly testing. Means of egress daily inspection in areas that have undergone construction, repair, alterations or additions to ensure its ability to be used instantly in case of emergency. Requirements to have an outside window or outside door in every sleeping room are waived to permit these providers to utilize space not normally used for patient care for temporary care or quarantine. If you have any questions about the CMS Blanket Waivers, please contact the authors or your regular Dorsey & Whitney attorney. We continue to closely monitor the rapidly evolving legal landscape related to the COVID-19 pandemic. You can access Dorsey’s health law blog related to health law updates, available here. You can also access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here.

On March 9, 2020, the Centers for Medicare and Medicaid Services (“CMS”) issued a memorandum describing hospitals’ continuing obligations with respect to the Emergency Medical Treatment and Labor Act (“EMTALA”) during the COVID-19 public health emergency (“PHE”). Check out our previous blog post on this topic here. Last week, in response to a growing number of questions from hospitals and critical access hospitals (“CAHs”), CMS released additional guidance in the form of frequently asked questions (“FAQs”) concerning the implications of COVID-19 on EMTALA compliance. The FAQs address questions CMS has received on a variety of topics, including patient presentation to the emergency department (“ED”), the applicability of EMTALA in different facilities, determining who is a qualified medical professional, as well as information on medical screening exams, patient stabilization, transfers, and other EMTALA-related topics. Below, we set forth a sampling of some of those questions and answers. A full list of the FAQs, covering all of the EMTALA topics CMS addressed in its FAQs, including topics not covered in this blog, can be found here. Patients Presenting to the Emergency Department Q. May hospitals place a sign outside an ED stating “COVID-19 testing is not being offered to asymptomatic patients”? A. Yes. In general, signage may be used to inform individuals about the availability of COVID-19 testing or to provide direction to alternative sites on the hospital’s campus where medical screening examinations (“MSE”) are available; for example, directing the patient to a parking lot test site for COVID-19. CMS emphasized, however, that it is a violation of EMTALA for hospitals to use signage that presents a barrier to individuals, including potential COVID-19 patients, from coming to the ED or for hospitals to otherwise refuse to provide a MSE to anyone who comes to the ED for examination or treatment. Hospitals may encourage the public to go to off-campus sites to be screened for COVID-19 instead of to the hospital. Normally, a hospital may not tell individuals who have already entered an ED to go to the off-site location for the MSE—such a redirection usually may only be to an on-campus alternative site. However, CMS has approved via a section 1135 waiver for the COVID-19 public health emergency (“PHE”) the ability to re-direct patients to an offsite location for screening, in accordance with a state emergency preparedness or pandemic plan. Q. Is a hospital’s ability to refer an individual to an alternative off-campus screening site limited strictly to those individuals with COVID-19 symptoms? A. No. CMS clarified that any patients may be redirected to an off-campus screening location to receive an MSE under the section 1135 waivers regardless of the presence of COVID-19 symptoms. For example, ambulance patients may be referred off-campus (i.e., without any off-loading or any evaluation before the referral). Public health officials, emergency medical services (“EMS”) systems, and hospitals may develop protocols, including COVID-19 protocols, governing where EMS should transport individuals for emergency care. As a reminder, for a hospital owned-and-operated ambulance operating in accordance with community-wide EMS protocols that directs the transport of individuals to a hospital other than the hospital that owns the ambulance (for example, to the closest appropriate hospital), the presenting individual is considered to have come to the ED of the hospital to which the individual is transported. The receiving hospital is subject to EMTALA at the time the individual is brought onto hospital property. Where Does EMTALA Apply? Q. Can EMTALA be relaxed to allow hospitals to refer patients to urgent care facilities? A. Hospitals may encourage the public to go to off-campus sites for COVID-19 screening instead of the hospital so long as those sites are operating in accordance with the state or local pandemic plan, are identified specifically by the hospital as the place to receive an MSE, and have the capability to provide that MSE. Additionally, CMS has approved a section 1135 waiver for the duration of the public health emergency granting hospitals the ability to re-direct patients to an off-site location. Q. What is the definition of “on campus”? A. The definition of campus can be found at 42 C.F.R. § 413.65(a)(2) and means the physical area immediately adjacent to the provider’s main buildings, other areas and structures that are not strictly contiguous to the main buildings but are located within 250 yards of the main buildings and any other areas determined on a case-by-case basis. Per 42 C.F.R. § 489.24(b), “Hospital property” means the entire main hospital campus, including the parking lot, sidewalk, and driveway, but excluding other areas or structures of the hospital’s main building that are not part of the hospital, such as physician offices, rural health centers, skilled nursing facilities, or other entities that participate separately under Medicare, or restaurants, shops, or other nonmedical facilities. During the COVID-19 PHE, non-hospital properties, such as hotels, dormitories, and field hospitals at places like parks, are becoming extensions of hospitals, otherwise known as temporary expansion sites. This is permissible under the section 1135 waiver of the provider-based regulations at 42 C.F.R. § 413.65 and certain requirements under the Medicare conditions of participation at 42 C.F.R. § 482.41 and § 485.623. For the duration of the COVID-19 PHE, these waivers allow a hospital to establish and operate as part of the hospital any location meeting the Conditions of Participation (CoPs) for hospitals that continue to apply during the PHE. These waivers also allow a hospital to change the status of its current provider-based department locations to the extent necessary to address the needs of hospital patients as part of the state or local pandemic plan. As such, it is acceptable to triage and treat patients in these temporary expansion sites. Q: Can multiple hospitals with different Medicare provider numbers join together to establish the off-site location in accordance with the state emergency plan? If so, what EMTALA implications would result for each hospital involved? A: Yes. Temporary expansion sites may serve multiple hospitals if it is consistent with their state emergency plan. Unless the off-campus site is already a dedicated emergency department (“DED”) of a hospital, as defined under EMTALA regulations at 42 C.F.R. § 489.24(b), EMTALA requirements do not apply. If an individual being treated at a temporary expansion site needs additional medical attention on an emergent basis, the site is required, under the Medicare CoPs, to arrange referral/transfer. When multiple hospitals join to establish an off-site location, the hospitals should operate in distinct clinical spaces within the location or designate one facility that will assume responsibility for ensuring compliance with the CoPs including EMTALA requirements (if applicable). If the space is shared across multiple hospitals, CMS notes that noncompliance problems at a temporary expansion sites may implicate associated certified hospitals depending upon the type of noncompliance. Q: How does EMTALA apply if a community has exhausted its supply of beds and/or ventilators and a patient presents with an emergent condition that needs these resources for stabilization? A: Hospitals are required to provide stabilizing treatment to individuals determined to have an emergency medical condition within the hospital’s capability prior to arranging an appropriate transfer. In situations where facilities may not have the necessary services or equipment, they should provide stabilizing interventions within their capability until the individual can be transferred. For example, in cases where the hospital does not have available ventilators, establishing an advanced airway and providing manual ventilation can assist in stabilizing the individual until an appropriate transfer can be arranged. Q: If a hospital sets up an alternative off-campus testing site, is that site regulated by the hospital conditions of participation? A: Yes. Alternative care sites and temporary extension sites that are established by the hospital are still required to follow the applicable hospital CoPs to the extent not waived under the blanket waivers issued by CMS. Community testing centers established by the state would be under the state emergency and pandemic plan and are not required to meet the hospital CoPs. Qualified Medical Professionals (QMPs) Q: Has CMS removed the requirement to have a QMP, approved by the governing body, perform the MSE? A: No. QMPs responsible for performing MSEs must still be approved by the hospital’s governing body. Hospitals may request a case-by-case section 1135 waiver to allow MSEs to be performed by qualified medical staff authorized by the hospital, who are acting within their scope of practice and licensure, but are not designated in the hospital bylaws to perform the MSEs. Medical Screening Exams CMS has received a number of questions from providers regarding how MSEs may be performed in light of the COVID-19 pandemic. Q: Can emergency physicians and other health care practitioners conduct medical screening exams (MSEs) under EMTALA via telehealth? A: Yes. QMPs, including emergency physicians, can perform MSEs using telehealth equipment. The QMP may be on-campus and using technology to self-contain or offsite due to staffing shortages. The MSE may be performed solely via telehealth if clinically appropriate. If the patient is seen by a QMP located on campus via electronic two-way technology, the service would not be considered a telehealth visit. Regardless of location, the QMP must be performing within the scope of his/her state practice act and approved by the hospital’s governing body to perform MSEs. Q: Can CMS waive certain elements of EMTALA to allow for more flexibility in meeting the current medical screening exam (MSE)? A: CMS has temporarily waived some EMTALA requirements to allow screening for patients at a location offsite from the hospital’s campus to prevent the spread of COVID-19, so long as it is not inconsistent with a state’s emergency preparedness or pandemic plan. Under the waiver, hospital EDs may redirect incoming patients to alternative screening sites staffed by QMPs, to ensure symptomatic or COVID-19-positive patients are directed to appropriate settings of care. Q: Can emergency physicians perform medical screening exams outside of the ED, such as in tents in the parking lot, under EMTALA? A: Yes. A hospital may set up alternative sites on its campus to perform MSEs. Individuals may be redirected to these sites. Whether the individual is seen at the alternate on-campus site or in the ED, they should be logged in where they are seen. Individuals do not need to present to the ED, first, and if they do present to the ED, they may still be redirected to the on-campus alternative screening location for logging and subsequent screening. This is a triage function, and the person providing the redirection from the ED should be qualified to recognize individuals who are obviously in need of immediate treatment in the ED. Hospital non-clinical staff stationed at other entrances to the hospital may provide redirection to the on-campus alternative screening location for individuals seeking COVID-19 testing. Q: Can the MSE be conducted by a Registered Nurse (RN)? A: Yes. MSEs must be conducted by qualified personnel, which may include physicians, nurse practitioners, physician’s assistants, or RNs trained to perform MSEs, acting within the scope of their state licensure law, and as approved by the hospital’s governing body. Hospitals may request a waiver to allow MSEs to be performed by other personnel, including trained RNs not previously approved by the governing body to perform MSEs. Q: If there is an on-site COVID-19 testing location (e.g., tent outside main ED), would EMTALA apply if individuals are only requesting COVID-19 testing? Would a MSE be required? A: EMTALA would apply if a patient who was solely seeking COVID-19 testing made a request for medical treatment while on the hospital campus or demonstrated a medical condition that a prudent layperson would believe, based on the individual’s appearance or behavior, indicated that the individual needed examination or treatment of a medical condition. However, patients who present solely for the purpose of COVID-19 testing and are not making a request for treatment of a medical condition, do not necessarily require a MSE. If the person complains of or exhibits any symptoms of a medical condition, then that person should receive an appropriate MSE to determine whether an emergency medical condition (“EMC”) exists. The EMTALA obligation is satisfied if the MSE determines no EMC exists. Q: Can a hospital conduct an MSE if the patient remains in an automobile and meet its EMTALA obligations? A: It depends. The MSE does not have to take place in the ED to satisfy EMTALA. The content of the MSE varies according to the individual’s presenting signs and symptoms, and it can be as simple or as complex, as needed, to determine if an emergency medical condition exists. MSEs must be conducted by qualified personnel, which may include physicians, nurse practitioners, physician’s assistants, or RNs trained to perform MSEs and acting within the scope of their state practice act. If a clinically-appropriate MSE can be performed in an automobile to determine whether or not an emergency medical condition exists, that MSE would be permissible under EMTALA. Q: For off-campus, hospital-controlled sites, can a person first presenting to the ED be redirected from the ED to the off-campus site where the MSE will be completed? A: Yes. Hospitals may redirect patients presenting to the ED to an off-campus site where an MSE will be completed. Normally, a hospital may not tell individuals who have already entered an ED to go to the off-site location for the MSE, such a redirection usually only occurs to an on-campus alternative site. However, CMS has issued a blanket section 1135 waiver for the duration of the COVID-19 PHE the ability to re-direct patients to an offsite location for screening, in accordance with a state emergency preparedness or pandemic plan. Hospitals are generally able to manage the separation and flow of potentially infectious patients through alternate screening locations on the hospital campus during the COVID-19 PHE. Q: Is there a specific time frame in which the MSE has to take place if a patient is referred to an off-campus site? Would it have to happen that same day? A: There is no specified time frame in which the MSE has to occur after the referral from the hospital to an off-campus site. However, triage entails the clinical assessment of the individual’s presenting signs and symptoms at the time of arrival at the hospital, in order to prioritize when the individual will be seen by a physician or other QMP. Individuals presenting must be provided an MSE appropriate to the individuals’ presenting signs and symptoms, as well as the capability and capacity of the hospital. The MSE must be the same MSE that the hospital would perform on any individual coming to the hospital’s dedicated emergency department with those signs and symptoms, regardless of the individual’s ability to pay for medical care. If a hospital applies a nondiscriminatory screening process that is reasonably calculated to determine whether an EMC exists, it has met its obligations under EMTALA. The required MSE and stabilizing treatment should not be delayed. If the MSE is appropriate and does not reveal an EMC, the hospital has no further obligation. Q: If a hospital set up a COVID-19 testing location offsite, and patients only present to the hospital for testing without requesting additional services, do those patients need an MSE before we refer them offsite? A: Those patients would not be subject to an MSE in this case unless they are requesting examination or treatment for a medical condition or demonstrate a medical condition for which a MSE is necessary. EMTALA requires that all persons who present to the hospital or ED for a medical condition be provided an MSE to determine whether they have an EMC. Transfer and Stabilization of Patients Q: Has CMS waived elements of EMTALA to allow for more flexibility in the transfer and stabilization requirements? A: No. CMS has not waived EMTALA transfer or stabilization requirements. Hospitals are expected to provide stabilizing treatment within their capabilities and capacity prior to the initiation of a transfer to another hospital. However, when a section 1135 waiver has been issued, sanctions for an inappropriate transfer of a patient or for the direction or relocation of a patient to receive a MSE at an alternate location do not apply if certain conditions are met, as enumerated at 42 C.F.R. §489.24(a)(2)(i)(A)-(E). Q: Is transfer to a designated facility permissible regardless of COVID-19 status, as long as positives go to designated positive facilities and negatives go to designated negative facilities? A: Yes. A patient transfer under the state emergency and pandemic plan would apply to all patients regardless of COVID-19 status following an appropriate MSE and determination that patient is stable for an appropriate transfer. Q: When could a hospital refer a patient who comes to the ED for medical treatment to an urgent care center? A: Hospitals must provide a MSE to all patients who come to the ED requesting treatment for a medical condition or where the individual is demonstrating presence of a medical condition to determine if an EMC exists. The content of the MSE varies according to the individual’s presenting signs and symptoms, but should be provided within the capabilities of the hospital’s ED, including ancillary services routinely available to the hospital. Once the MSE is complete and if the patient is determined not to have an EMC, the hospital’s EMTALA obligation ends and the patient may be referred to an urgent care center for continued care of non-emergency illnesses or injuries. However, a section 1135 waiver gives the ability for hospitals to re-direct patients that have presented to the ED to an offsite location for the MSE in accordance with a state emergency preparedness or pandemic plan. Under the section 1135 waiver, hospital EDs may redirect incoming patients to alternative screening sites staffed by qualified medical personnel, to ensure that symptomatic or COVID-19-positive patients are directed to appropriate settings of care. Waivers Under Section 1135 of the Social Security Act Q: Has EMTALA been broadly waived? A: No. CMS has approved a section 1135 waiver for the COVID-19 PHE, which temporarily includes the ability to re-direct patients to an offsite location for screening in accordance with a state emergency preparedness or pandemic plan. Hospitals are still expected to provide an MSE to any individual who comes to the emergency department and requests examination or treatment, or has a request for examination or treatment made on their behalf. The purpose of the MSE is to determine if an emergency medical condition exists. If an EMC is determined to exist, the hospital must provide stabilizing treatment within the hospital capabilities or an appropriate transfer per 42 C.F.R. § 489.24. While certain aspects of EMTALA may be waived under the section 1135 waiver, federal civil rights laws have not been waived. Hospitals that receive federal financial assistance are still obligated to comply with federal civil rights laws, including Section 504 of the Rehabilitation Act, Title VI of the Civil Rights Act of 1964, Section 1557 of the Affordable Care Act and the Hill-Burton Act. Hospitals do not have to initiate a disaster plan before the section 1135 waiver becomes effective and hospitals are not required to provide notification to CMS upon initiation of the disaster plan. The flexibilities and blanket waivers released by CMS are retroactive to March 1, 2020. The waivers will end no later than the termination of the COVID-19 PHE, or 60 days from the date the waiver or modification is first published, unless the Secretary of HHS extends the waiver by notice for additional periods of up to 60 days, up to the end of the emergency period. Any additional formal guidance, revisions to existing guidance, or additional clarifications will be released via a QSO memorandum or other CMS approved communication. We at Dorsey are continuing to monitor the developments related to COVID-19. If you have any questions about the issues addressed in this blog, please contact the authors or your regular Dorsey attorney. You can access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here. You can also access Dorsey’s health law blog related to health law updates, available here.

ERISA litigators know that a war has been raging between “out-of-network” medical providers, on one hand, and the entities that insure and administer group health plans, on the other (collectively, “Insurers”). For years, out-of-network providers have been suing plans and Insurers claiming they were “underpaid” for their medical services, often to the tune of millions of dollars. Hundreds of these cases have cropped up around the country in recent years. COVID-19 has now opened up a new front in this war, and the first skirmishes have already started. On April 10, 2020, Columbus Specialty Hospital (“Columbus”) filed a complaint in New Jersey state court seeking $36 million from various New Jersey insurance companies (the “Defendant-Insurers”) for payment of treatment it provided during the “COVID-19 crisis.” See Columbus Specialty Hosp. v. Amerigroup Corp., et al., No. ESX-L-002635-20 (N.J. Sup. Ct. April 10, 2020). According to Columbus, it provides “long term acute care” to “immunocompromised seniors”—the “prime targets for COVID-19 infection.” Columbus claims the Defendant-Insurers grossly underpaid it “for the live-saving treatment” it provided to those “vulnerable patients.” Columbus’s lawsuit is similar in some ways to the out-of-network provider cases that have cropped up around the country—but it adds a few new twists. The Common Elements Columbus’s lawsuit shares common features with the out-of-network provider lawsuits that came before it. Like the providers in those cases, Columbus does not directly sue for benefits under the terms of the health plans at issue. Instead, it asserts various contractual and quasi-contractual claims, alleging (among other things) that the Defendant-Insurers promised to pay Columbus its “usual and customary rates” for the services in question. This is a common tactic by out-of-network providers because their “usual” rates are much higher than the rates called for in the plan documents. In another relatively common move, Columbus asserts claims under state “prompt pay” statutes, which regulate the length of time in which an Insurer must pay providers for submitted claims. The New Elements While Columbus’s lawsuit shares a common structure with other out-of-network provider cases, it introduces new elements and could set new trends in this area of litigation. First, Columbus tries to bolster its claims by highlighting the emotional aspects of the “national and state emergency” related to COVID-19. According to Columbus, the Defendant-Insurers’ failure to pay does not simply affect its bottom line; it means members of the “greatest generation” are not receiving “the live-saving care” they deserve. Columbus also accuses the Defendant-Insurers of putting health care workers at risk by preventing Columbus from purchasing personal protection equipment. By tying its claims to the COVID-19 crisis, Columbus is hoping to tilt the scales of equities in its favor—a potentially effective move, especially for claims tried before a jury. Expect other medical providers to follow suit and tie their claims to the COVID-19 crisis. Second, Columbus’s lawsuit indicates that out-of-network providers may be shifting tactics for how they attempt to bind Insurers to “contractual” promises to pay the providers’ rates. As mentioned above, these out-of-network provider lawsuits often turn on whether the Insurer and provider formed a “contract” through communications about reimbursement rates. Traditionally, providers have alleged that such a contract or promise arose from phone calls with an Insurer’s billing department, during which the Insurer allegedly confirmed a patient’s coverage and reimbursement rates. Here, by contrast, Columbus claims it actually faxed formal contracts to the Defendant-Insurers, which they accepted by their conduct. This tactic is plainly an attempt to avoid the contractual formation and ERISA preemption defenses that defendants usually assert in these cases. Expect other out-of-network providers to employ similar tactics in their efforts to bind Insurers to commitments outside the four corners of the relevant health plan document. Third, Columbus’s lawsuit illustrates the astonishing size of provider bills for COVID-19 treatments and the limited time that Insurers have to process those claims. Columbus alleges, for example, that it billed $8.9 million for one patient for services related to COVID-19. While that sum is just an allegation, it is nonetheless a staggering number. And Columbus invokes New Jersey’s “prompt pay” statutes to insist that the Defendants-Insurers should have processed its multi-million dollar bills at breakneck speeds. This combination of large bills and pressure to pay those bills quickly puts enormous pressure on Insurers’ billing departments. This flurry of large bills also opens the door to fraud and abuse by unscrupulous providers. Insurers will have to find a way to manage this risk, while still ensuring that proper bills are paid in a timely fashion. But inevitably, Insurers will discover overpayment after the fact, which may trigger recoupment actions by Insures and the group health plans, which they administer. Should you seek additional information about these types of claims, feel free to contact us.

As we explained in our prior blog post, on March 30, 2020, the Centers for Medicare & Medicaid Services (“CMS”) issued certain blanket waivers of sanctions under the federal physician self-referral law (or “Stark Law”) for “COVID-19 Purposes” (the “Stark Blanket Waivers”), which are available here. On April 21, 2020, CMS issued explanatory guidance, available here, on the scope and application of the Stark Blanket Waivers to certain financial relationships (the “Explanatory Guidance”). In addition to answering a variety of questions raised by the initial announcement of the Stark Blanket Waivers, the Explanatory Guidance provides an important reassurance to stakeholders. CMS states: “The Secretary will work with the Department of Justice to address False Claims Act relator suits where parties using the blanket waivers have a good faith belief that their remuneration or referrals are covered by a blanket waiver.” Despite this reassurance, however, it is crucial that parties seeking to rely on a Stark Blanket Waiver ensure that their arrangement, in fact, relates to “COVID-19 Purposes” (as defined in the Stark Blanket Waivers document), falls within the parameters of a specifically enumerated waiver within the Stark Blanket Waivers document, and that all non-waived requirements of an applicable Stark Law exception are met. We also note that, as CMS reminds parties in the Explanatory Guidance, relying on a Stark Blanket Waiver may not be necessary for certain arrangements related to COVID-19 Purposes, if these arrangements satisfy the requirements of an existing Stark Law exception. The following information summarizes the Explanatory Guidance. A. Compliance with Non-Waived Requirements of an Applicable Exception Many of the Stark Blanket Waivers eliminate or alter some, but not all, of the existing requirements of particular Stark Law exceptions. CMS warns that financial relationships or referrals must satisfy all non-waived requirements of an applicable exception in order to avoid implicating the Stark Law’s referral and billing prohibitions. We note that this includes, for example, meeting the “set in advance” requirement of applicable compensation exceptions, as this requirement is not waived by any of the Stark Blanket Waivers. B. Amendment of Compensation Arrangements The Explanatory Guidance clarifies when parties may modify the remuneration terms of an existing arrangement during the COVID-19 emergency period, and whether such terms can be amended during the emergency period and again at the conclusion of the emergency period to return to the original terms. This guidance applies when parties are relying on a compensation exception that has both a one-year term requirement and a “set in advance” requirement (such as the personal services arrangements exception). CMS points to the preamble guidance in the Fiscal Year 2009 Inpatient Prospective Payment System final rule (“FY 2009 IPPS Rule”), which CMS interprets as allowing for a second or subsequent amendment of the compensation terms of an arrangement, even within the first year of an initial amendment of those terms, as long as each time those terms are amended, “all requirements of an applicable exception are satisfied, the amended remuneration is determined before the amendment is implemented, the formula for the amended remuneration does not take into account the volume or value [of] referrals or other business generated by the referring physician, and the overall arrangement remains in place for at least 1 year following the amendment.” CMS reiterates that if parties amend a compensation arrangement during the emergency period, all non-waived requirements of an applicable exception must be met. The compensation terms of the arrangement may again be amended after the public health emergency is over. This further amendment may restore the original terms of the arrangement or make additional changes, as long as each of the criteria from the FY 2009 IPPS Rule (described above) are met. Finally, CMS points out that a modification of an existing arrangement could instead be analyzed as an additional compensation arrangement, for which the parties could use the Stark Blanket Waivers (if all applicable requirements are met). C. Applicability of Blanket Waivers to Indirect Compensation Arrangements The Explanatory Guidance states that the Stark Blanket Waivers do not apply to indirect compensation arrangements, and only apply to direct compensation arrangements. Parties can, however, seek an individual waiver of sanctions related to indirect compensation arrangements. The Explanatory Guidance goes on to note that many compensation arrangements that may appear to be indirect may be analyzed as direct compensation arrangements under the “stand in the shoes” provisions of the Stark Law. D. Repayment Options for Loans between a DHS Entity and a Physician (or the Immediate Family Member of a Physician) Two Stark Blanket Waivers (waivers #10 and #11) involve remuneration in the form of a loan with an interest rate below fair market value or on terms that are unavailable from a lender that is not in a position to make referrals to or generate business for the party making the loan. CMS states that these waivers do not require cash payments to the lender to satisfy a borrower’s debt. Loans may be repaid through in-kind payments, as long as the aggregate value of the in-kind payments is consistent with the amount of the loan and the arrangement is commercially reasonable. CMS provides that an example in-kind payment could be the maintenance of a medical practice and continuing to serve patients in the community where the entity is located. E. Repayment of Loans, Rent Abatement, or Other Amounts Due Following the End of the Emergency Period CMS clarified that, if parties use the Stark Blanket Waivers such as the loan arrangements described above, repayment obligations do not need to be completed prior to the termination of the Stark Blanket Waivers (which will be at the end of the public health emergency that was declared related to the COVID-19 outbreak). Many parties expressed concern that, after the termination of the Stark Blanket Waivers, the compensation arrangements entered into would no longer satisfy the requirements of an applicable exception because the interest charges or other charged amounts would not be consistent with the fair market value of the remuneration provided. The Explanatory Guidance provides that appropriate repayment terms agreed to before the termination of the Stark Blanket Waivers may continue beyond the termination of the waivers. However, disbursement of loan proceeds or additional remuneration after the termination of the Stark Blanket Waivers must satisfy all requirements of the applicable Stark exception. F. Restructuring of Existing Recruitment Arrangements with Income Guarantees CMS also responded to inquiries about the extension or restructuring of existing physician recruitment arrangements, such as whether a hospital could extend an income guarantee to address a recruited physician’s medical practice interruption due to the COVID-19 pandemic. The Explanatory Guidance states that CMS maintains its position that, under the Stark Law exception for physician recruitment, the terms of a recruitment arrangement cannot be altered once the physician has relocated their practice. Some Stark Blanket Waivers, however, may be available for remuneration from a hospital (or other entity) to assist a relocated physician whose medical practice is disrupted due to the pandemic in order to maintain the availability of medical care and related services for patients and the community. * * * For help determining whether an existing or proposed arrangement complies with a Stark Blanket Waiver and/or for inquiries regarding individual waiver requests, please contact the authors of this post or your regular Dorsey attorney. We continue to closely monitor the legal landscape related to the COVID-19 pandemic. You can access Dorsey’s health law blog providing health law updates, available here. You can also access Dorsey’s coronavirus resource center, containing a wide variety of legal resources related to the coronavirus outbreak, available here.

On Friday, April 24, 2020, President Trump signed into law the “Paycheck Protection Program and Health Care Enhancement Act,” colloquially referred to as “Phase 3.5.” Phase 3.5 comes on the heels of three much larger bills passed into law intended to address the effects of the ongoing coronavirus pandemic. The first three phases, the Coronavirus Preparedness and Response Supplemental Appropriations Act, the Families First Coronavirus Response Act, and the CARES Act, provided much-needed funding to hospitals and health care providers affected by COVID-19. Phase 3.5 continues this funding by providing additional emergency appropriations totaling $484 billion, the majority of which ($384 billion) goes to replenishing the Paycheck Protection Program, Economic Injury Disaster Loans, and Emergency Grants funds as established in the CARES Act. Phase 3.5 allocates an additional $75 billion to the Public Health and Social Services Emergency Fund for providers to prevent, prepare for, and respond to coronavirus. The Phase 3.5 package also includes $25 billion for COVID-19 testing, $11 billion of which is earmarked for states to aid in their efforts to ramp up testing. A breakdown of the major funding provisions included in the Phase 3.5 bill is below. Paycheck Protection Program Phase 3.5 appropriates an additional $321 billion to replenish the funds for the Paycheck Protection Program (“PPP”). The PPP was originally funded by the CARES Act with $349 billion to protect small businesses and help them avoid layoffs and rehire employees. The loan amounts distributed under the PPP will be forgiven so long as the loan proceeds are used to cover payroll costs, and most mortgage interest, rent, and utility costs, and employee and compensation levels are maintained. Phase 3.5 specifically sets aside $60 billion of these funds for small, midsize, and community lenders in an effort to avoid forcing smaller companies to compete with larger companies for the same funds. Economic Injury Disaster Loans Program Phase 3.5 appropriates $50 billion for Economic Injury Disaster Loans and an additional $10 billion for Emergency Injury Disaster Loan Grants. Public Health and Social Services Emergency Fund Phase 3.5 provides an additional $75 billion to the Public Health and Social Services Emergency Fund for hospitals and other health care providers to prevent, prepare for, and respond to coronavirus. This fund is managed by the Department of Health and Human Services. The CARES Act originally appropriated $100 billion to this fund, $30 billion of which was distributed beginning on April 10, 2020 with payments arriving in eligible health care providers’ bank accounts via direct deposit. On April 22, 2020, HHS unveiled the next phase of these distributions through a series of general and targeted distributions aimed in part at providing relief to those providers in areas highly impacted by COVID-19. Funds Allocated for Testing Phase 3.5 also provides $25 billion to the Public Health and Social Services Emergency Fund specifically for expenses surrounding the research, development, validation, manufacture, purchase, administration, and expanding of capacities for COVID-19 testing. A breakdown of the allocations for testing in Phase 3.5 is below: • $11 billion of these funds have been allocated to states to develop, purchase, administer, process, and analyze COVID-19 tests, including support for workforce, epidemiology, use by employers, scale up testing by public health and hospital laboratories, and community-based testing sites, health care facilities, and other entities engaged in testing. • $2 billion is to be provided to the states based on the Public Health Emergency Preparedness cooperative agreement in FY 2019; • $4.25 billion is to be allocated based on the number of COVID-19 cases; and • $750 million is to be provided to the Indian Health Service to aid tribes, tribal organizations, and Indian Health Service facilities. • $1 billion to the CDC for surveillance, epidemiology, laboratory capacity expansion, contact tracing, public health data surveillance and analytics infrastructure modernization, disseminating information about testing, and workforce support. • $1 billion to the NIH to develop, validate, improve, and implement testing and associated technologies and to accelerate research, development, and implementation of point of care and other rapid testing. • $1 billion to the Biomedical Advanced Research and Development Authority to cover research expenses. • $22 million to the FDA to support activities associated with diagnostic, serological, antigen, and other testing. • $600 million to HRSA for grants under the Health Centers program. • $225 million to rural health clinics to provide COVID-19 testing, with such funds also available to RHCs for building or construction of temporary structures, leasing of properties, and retrofitting facilities as necessary to support COVID-19 testing. • $1 billion for covering the costs of testing the uninsured. We are keeping a close eye on the rapid developments surrounding COVID-19. If you have any questions about this latest guidance issued by HHS, the CARES Act, or any questions related to COVID-19, please contact the author of this blog or contact your Dorsey and Whitney LLP attorney. You can access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here. You can also access Dorsey’s health law blog related to health law updates, including those applicable to tax exempt entities in the health care space, available here.

On April 22, 2020, the Department of Health and Human Services (“HHS”) issued a press release outlining the allocation of an additional $70 billion dollars in appropriations allocated by the CARES Act to the Public Health and Social Services Emergency Fund.  The initial $30B tranche of the total $100 billion provided for under the CARES Act was distributed earlier this month to providers based on a methodology taking into account those providers’ Medicare receipts from the prior year.  This is the “second round” of the initial funding provided for under the CARES Act and includes both a “General Allocation” of $50 billion and smaller “Targeted Allocations.”   In allocating the funds, HHS stated they are “working to address both the economic harm across the entire healthcare system due to the stoppage of elective procedures, and addressing the economic impact on providers incurring additional expenses caring for COVID-19 patients, and to do so as quickly and transparently as possible.” On April 21, 2020, the U.S. Senate passed a bill, colloquially referred to as “Stimulus Phase 3.5,” which provides for an additional $75 billion to replenish the Public Health and Social Services Emergency Fund.  These latest allocations are not related to the potential Stimulus 3.5 funds.  We are continuing to monitor Stimulus 3.5 funds and will update our website once that next round of stimulus funding is approved by the President.    The guidance provided by HHS with respect to the latest allocation of the additional $70 billion in appropriations for providers is below. I. GENERAL ALLOCATION $50 billion of the Provider Relief Fund is allocated for general distribution to Medicare facilities and providers impacted by COVID-19, based on eligible providers' 2018 net patient revenue.  To expedite providers getting money as quickly as possible, $30 billion was distributed immediately, proportionate to providers' share of Medicare fee-for- service reimbursements in 2019. On Friday, April 10, $26 billion was delivered to bank accounts. The remaining $4 billion of the expedited $30 billion distribution was sent on April 17. HHS said they used this formula to get the money out the door as quickly as possible.  HHS stated that, beginning this week, they will begin distribution of the remaining $20 billion of the general distribution to these providers to augment their allocation so that the whole $50 billion general distribution is allocated proportional to providers' share of 2018 net patient revenue. On April 24, a portion of providers will automatically be sent an advance payment based off the revenue data they submit in CMS cost reports. Providers without adequate cost report data on file will need to submit their revenue information to a portal opening this week at https://www.hhs.gov/providerrelief for additional general distribution funds.  Providers who receive their money automatically will still need to submit their revenue information so that it can be verified. Payments will go out weekly, on a rolling basis, as information is validated, with the first wave being delivered at the end of this week (April 24, 2020). Providers who receive funds from the general distribution have to sign an attestation confirming receipt of funds and agree to the terms and conditions of payment and confirm the CMS cost report. The terms and conditions also include other measures to help prevent fraud and misuse of the funds. All recipients will be required to submit documents sufficient to ensure that these funds were used for healthcare-related expenses or lost revenue attributable to coronavirus. HHS warned that there will be significant anti-fraud and auditing work done by HHS, including the work of the Office of the Inspector General. In the latest allocation, HHS reinforced President Trump’s directive that as a condition to receiving these funds, providers must agree not to seek collection of out-of-pocket payments from a presumptive or actual COVID-19 patient that are greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. II. TARGETED ALLOCATIONS A. ALLOCATION FOR COVID-19 HIGH IMPACT AREAS $10 billion will be allocated for a targeted distribution to hospitals in areas that have been particularly impacted by the COVID-19 outbreak. As an example, HHS said that hospitals serving COVID-19 patients in New York, which has a high percentage of total confirmed COVID-19 cases, are expected to receive a large share of the funds.  Hospitals should apply for a portion of the funds by providing four simple pieces of information via an authentication portal before midnight PT, Thursday April 23. This portal is live, and hospitals have already been contacted directly to provide this information. Hospitals will need to provide:  Tax Identification Number National Provider Identifier Total number of Intensive Care Unit beds as of April 10, 2020 Total number of admissions with a positive diagnosis for COVID-19 from January 1, 2020 to April 10, 2020 HHS stated that the authentication and data-sharing process should take less than five minutes via a system that should be familiar to most hospitals. HHS indicated this information is necessary for the government to determine what facilities will qualify for a targeted distribution. They added that supplying this information does not guarantee receipt of funds from this distribution. HHS will use the data it receives to distribute the targeted funds to where the impact from COVID-19 is greatest. The distribution will take into consideration the challenges faced by facilities serving a significantly disproportionate number of low-income patients, as reflected by their Medicare Disproportionate Share Hospital (DSH) Adjustment. B. ALLOCATION FOR TREATMENT OF THE UNINSURED As announced in early April, a portion of the $100 billion Provider Relief Fund will be used to reimburse healthcare providers, at Medicare rates, for COVID-related treatment of the uninsured. Every health care provider who has provided treatment for uninsured COVID-19 patients on or after February 4, 2020, can request claims reimbursement through the program and will be reimbursed at Medicare rates, subject to available funding. Steps will involve: enrolling as a provider participant, checking patient eligibility and benefits, submitting patient information, submitting claims, and receiving payment via direct deposit. Providers can register for the program on April 27, 2020, and begin submitting claims in early May 2020. For more information, visit coviduninsuredclaim.hrsa.gov. C. ALLOCATION FOR RURAL PROVIDERS $10 billion will be allocated for rural health clinics and hospitals.  This money will be distributed as early as next week (April 27, 2020) on the basis of operating expenses, using a methodology that distributes payments proportionately to each facility and clinic. This method recognizes the precarious financial position of many rural hospitals, a significant number of which are unprofitable. Rural hospitals are more financially exposed to significant declines in revenue or increases in expenses related to COVID-19 than their urban counterparts. D. ALLOCATION FOR INDIAN HEALTH SERVICE Included in the allocation is $400 million which will be allocated for Indian Health Service (“IHS”) facilities, distributed on the basis of operating expenses. Indian Country is also being impacted by COVID-19.  This money will be distributed as early as next week (April 27, 2020) on the basis of operating expenses for facilities. HHS indicated that this serves as a complement for “other funding provided to IHS and work we've done to expand IHS capacity for telehealth.” E. ADDITIONAL ALLOCATIONS HHS indicated that there are some providers who will receive further, separate funding, including skilled nursing facilities, dentists, and providers that solely take Medicaid. F. HELPING ENSURE ALL AMERICANS HAVE ACCESS TO CARE The Families First Coronavirus Response Act, as amended by the CARES Act, requires private insurers to waive an insurance plan member's cost-sharing payments for COVID-19 testing. The President also secured funding to cover COVID-19 testing for uninsured Americans. The Trump Administration has also touted secured commitments from private insurers, including Humana, Cigna, UnitedHealth Group, and the Blue Cross Blue Shield system, to waive cost-sharing payments for treatment related to COVID-19 for plan members. As a condition to receiving general funds, providers must agree not to seek collection of out-of-pocket payments from a presumptive or actual COVID-19 patient that are greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. We are keeping a close eye on the rapid developments surrounding COVID-19.  If you have any questions about this latest guidance issued by HHS, the CARES Act, or any questions related to COVID-19, please contact the authors of this blog or contact your Dorsey and Whitney LLP attorney. You can access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here. You can also access Dorsey’s health law blog related to health law updates, including those applicable to tax exempt entities in the health care space, available here. 

The recently-enacted Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”) is generally known for providing relief funds and other resources to help individuals, small businesses, state and local governments, and hospitals and healthcare providers address the COVID-19 public health emergency.  However, among the lesser-known of the CARES Act provisions are changes to federal law that will allow a significant harmonization of rules governing the confidentiality of substance use disorder patient records with the general federal rules governing the privacy of individually identifiable health information (i.e., the HIPAA privacy rules). Currently, a unique set of federal regulations found at 42 C.F.R. Part 2 restrict the disclosure and use of substance use disorder patient records that are maintained in connection with any federally-assisted substance use disorder program.  These “Part 2” rules are far stricter than the federal HIPAA privacy rules that apply generally to health plans and health care providers.  For example, whereas the HIPAA privacy rules allow health plans and health care providers to use and disclose protected health information (“PHI”) for purposes of treatment, payment, and health care operations without a patient’s written or oral consent, the Part 2 rules do not.  Another important distinction between the Part 2 rules and HIPAA is that if a patient authorizes the disclosure of PHI under HIPAA to an entity that is not regulated by HIPAA, then the PHI disclosed to that recipient falls outside the protections of HIPAA.  In contrast, when a patient consents to the disclosure of their substance use disorder records under Part 2, the Part 2 rules continue to apply to the records disclosed, even when the recipient is not a regulated Part 2 SUD program. Section 3221 of the CARES Act modifies the statute governing the confidentiality of SUD records in various and important ways.  First, a Part 2 SUD program will be allowed to obtain the prior written consent of a patient to use and disclose SUD records for purposes of treatment, payment, and health care operations as permitted by the HIPAA privacy rules.  An SUD program will need to obtain that patient consent only once, and the consent will apply to all future uses and disclosures of SUD records until a patient revokes the consent in writing. The statute goes on to state that any information disclosed pursuant to such a consent may then be redisclosed in accordance with the HIPAA regulations.   Although not entirely clear, this appears to mean that an entity not regulated by HIPAA that receives SUD records pursuant to a consent may redisclose the records without limitation under either HIPAA or the Part 2 rules. The CARES Act also states explicitly that the HIPAA breach notification provisions apply to SUD records held by a Part 2 program in the same manner that those rules apply to HIPAA covered entities. Furthermore, the CARES Act extends HIPAA’s penalty and enforcement provisions to violations of the Part 2 rules.  Although the Department of Health and Human Services (“HHS”) will need to issue regulations to confirm the operation of these enforcement provisions, this appears to mean that the HHS Office for Civil Rights may take on the civil enforcement of the Part 2 rules, in addition to enforcing the HIPAA rules. The primary reason for the historically strict privacy rules applicable to SUD records is to ensure that a patient receiving treatment for a substance use disorder in a Part 2 program is not more vulnerable because of the availability of their patient record than an individual with a substance use disorder who does not seek treatment.  In an effort to maintain this public policy goal while at the same time making the Part 2 rules more consistent with the HIPAA rules, the CARES Act enacts a general antidiscrimination provision prohibiting any entity from discriminating against an individual on the basis of information in Part 2 SUD records in: (a) admission, access to, or treatment for health care; (b) hiring, firing, or terms of employment or receipt of worker’s compensation; (c) the sale, rental, or continued rental of housing; (d) access to federal, state, or local courts; or (e) access to, approval of, or maintenance of government social services and benefits. Furthermore, other than as authorized by a court order or consented to by the patient, no SUD records or testimony relaying the information contained in such records, may be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any governmental authority against a patient. The statute mandates that regulations to implement and enforce these CARES Act provisions be issued to facilitate their application to all uses and disclosure of SUD records occurring on or after one (1) year following the enactment of the CARES Act (which would be March 27th, 2021).   Once implemented, the CARES Act provisions will be helpful to Part 2 programs, many of which struggle with the complexity of complying with both HIPAA and the Part 2 privacy rules.  But the new Part 2 law will by no means alleviate all of that complexity.  For example, a Part 2 program will be required to obtain a patient’s written consent in order to use and disclose SUD records for treatment, payment, and health care operations purposes; for those Part 2 program patients that refuse to sign such a consent, the Part 2 program will likely need to segregate those SUD records in order to manage the stricter limitations on their use and disclosure.  Moreover, the CARES Act does not harmonize Part 2 and HIPAA entirely; there will remain many uses and disclosures that are permitted under HIPAA but not permitted with regard to SUD records under Part 2.  Ultimately the CARES Act provisions modifying the Part 2 confidentiality rules will mitigate, but not eliminate, the complexities of managing patient records regulated by two separate sets of federal privacy rules. If you have questions about the CARES Act, HIPAA, or the Part 2 rules, please contact the author or any attorney in the Dorsey & Whitney health transactions and regulations practice group.

As the world grapples with the health crisis caused by COVID-19, litigation regarding a different health crisis—the opioid epidemic—continues to progress (see our previous posts on this topic here and here). In a major development last week for the multidistrict litigation, the Sixth Circuit concluded that key bellwether cases against twelve large pharmacy chains may not include untimely dispensing allegations. The multidistrict litigation (“MDL”) includes claims by numerous plaintiffs arising out of the nation’s opioid crisis. Two of those plaintiffs—Cuyahoga County and Summit County of Ohio—brought claims against certain pharmacies that sold prescription opioids (in addition to their claims against other defendants like distributors and manufacturers). The Counties’ claims against the pharmacies are scheduled for trial in November 2020. The Counties’ claims against the pharmacies originally related to the pharmacies’ capacity as “distributors” of drugs to their own retail pharmacies. The Counties expressly declined to bring any claims against the pharmacies as “dispensers” of prescription opioids. This is an important distinction. Distributors ship pharmaceuticals wholesale; dispensers fill prescriptions. Discovery against the pharmacies proceeded with respect to their alleged role as distributors. For all parties, discovery included more than 600 depositions and the production of tens of millions of documents. However, nearly ten months after the close of discovery, the Counties reversed course and moved to amend their complaints to add dispensing allegations against the pharmacies. On November 19, 2019—i.e., almost 19 months after the court’s deadline for amendments to the Counties’ complaints—the court granted the Counties’ motion. The court did so based on perceived efficiencies, reasoning the dispensing claims were better considered by the district court now rather than later “in front of some other Court that does not have the expertise I have developed over the past two years.” The court also allowed discovery on the recently-added dispensing claims. The pharmacies were ordered to produce data on every prescription that their pharmacies had filled for any opioid medication, anywhere in the United States, for a period of 13 years—including data on prescriptions outside Ohio, which the district court intended to make available for future cases, but which would be inadmissible in the Ohio-focused case in which it was to be produced. Following the district court’s order, the pharmacies petitioned the U.S. Court of Appeals for the Sixth Circuit for a writ of mandamus. The primary issue before the Sixth Circuit on the pharmacies’ petition was the district court’s decision to allow the Counties to amend their complaints 19 months after the court’s deadline for doing so. The Sixth Circuit granted the writ in a strongly-worded order. Stating that an “MDL court may not . . . distort or disregard the rules of law applicable” to each individual case consolidated in the MDL, the Sixth Circuit concluded there was no “good cause” for the Counties’ failure to timely amend their complaints to add the dispensing allegations. In fact, the Sixth Circuit recognized that the Counties’ express decision to omit those claims earlier “arguably amounts to an outright waiver of them.” According to the Sixth Circuit, “[n]ot a circuit court in the country, so far as we can tell, would allow a district court to amend its scheduling order under these circumstances.” The Sixth Circuit’s ruling once again highlights how the unprecedented scope of the opioid litigation—with more than 2,700 cases consolidated in the MDL—deeply strains ordinary structures and procedures of litigation. In the orders at issue, the district court appeared to value efficiency and the collective interests in managing the MDL as a whole over the individual rights of the parties in the specific case at hand. Stipulating that the “district judge in this case is notably conscientious and capable, and we fully recognize the complexity of his task in managing the MDL here,” the Sixth Circuit nevertheless concluded the district court had gone too far: “Respectfully, the district court’s mistake was to think it had authority to disregard the Rules’ requirements in the Pharmacies’ cases in favor of enhancing the efficiency of the MDL as a whole.” That decision should have been based, but was not, on the record in the individual case before the court. Even in an MDL as complex as the opioid litigation, the district court’s authority to manage it is not without limit. Cases within an MDL retain their separate identities and the parties in those individual cases have rights that cannot be impinged merely to create efficiencies in the MDL generally. Particularly with respect to issues that can be dispositive, e.g., motions for summary judgment or to amend pleadings, it remains important for district courts to articulate and apply the traditional standards governing such issues. The Sixth Circuit’s decision also means that important liability questions in the opioid litigation will remain unanswered for now. Had the dispensing claims been allowed, the trial set for November 2020 may have answered whether a pharmacy could or would be held liable for filling prescriptions issued by someone else. Because those claims are no longer part of the Counties’ complaints, the full extent of potential liability large pharmacies face for the opioid epidemic is still unclear. And unlike other categories of defendants like drug manufactures and large distributors, pharmacies have largely declined to settle the claims against them. The MDL is In re: National Prescription Opiate Litigation, case number 1:17:md-02804, in the U.S. District Court for the Northern District of Ohio.

On Mach 27, 2020, President Trump signed the CARES Act, providing in part for $100 billion in relief funds to eligible health care providers and suppliers affected by COVID-19.  The funding is intended to support healthcare-related expenses, including lost revenue, attributable to the pandemic. Many providers and suppliers received notice on Friday, April 10 that they are recipients of relief funds.  HHS emphasized that these are not loans and will not need to be repaid by recipients.  Below is a summary of the guidance issued by HHS in connection with the initial $30 billion infusion and a brief description of the terms and conditions to which recipients must adhere. Eligibility All facilities and providers that received Medicare fee-for-service (“FFS”) reimbursements in 2019 are eligible to receive these funds.  As noted above, the payments are intended to provide relief to providers in areas impacted by COVID-19 and those providers and suppliers who have been impacted financially by the crisis as a result of healthy patients delaying care and the cancellation of elective procedures.  As a condition of receiving these funds, providers and suppliers must agree not to seek out-of-pocket payments from a patient treated for COVID-19 that are greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. The relief payments will be made according to taxpayer identification numbers (“TIN”) in accordance with the following: Large Organizations and Health Systems: Large Organizations will receive relief payments for each of their billing TINs that bill Medicare. Each organization should look to the part of their organization that bills Medicare to identify details on Medicare payments for 2019 or to identify the accounts where they should expect relief payments. Employed Physicians: Employed physicians should not expect to receive an individual payment directly. The employer organization will receive the relief payment as the billing organization. Physicians in a Group Practice: Individual physicians and other clinicians in a group practice are unlikely to receive individual payments directly, as the group practice will receive the relief fund payment as the billing organization. Solo Practitioners: Solo practitioners who bill Medicare will receive a payment under the TIN used to bill Medicare. Determining Distributions HHS indicated that these payments will be based on the provider’s or supplier’s share of total Medicare FFS reimbursements in 2019.  HHS estimates that total FFS payments in 2019 were approximately $484 billion. Providers and suppliers can estimate their payment by dividing their 2019 Medicare FFS (not including Medicare Advantage) payments they received by $484,000,000,000, and multiply that ratio by $30,000,000,000. Providers and suppliers can obtain their 2019 Medicare FFS billings from their organization's revenue management system. Example: A community hospital that billed Medicare FFS $121 million in 2019 would divide that amount by the total Medicare FFS payments (i.e. $484B) and multiply that by the total amount available (i.e. $30B). ($121,000,000/$484,000,000,000 x $30,000,000,000 = $7,500,000) How Will I Receive These Funds? HHS has partnered with UnitedHealth Group (“UHG”) in an effort to provide rapid payment of these funds.  Eligible recipients will be paid via their ACH account information on file with UHG or on file with the Centers for Medicare and Medicaid Services (“CMS”).  The payments are automatic so recipients do not need to take further action to receive them.  Recipients that receive payments electronically should look for a payment via Optum Bank with “HHSPAYMENT” as the payment description.  Recipients who normally receive a paper check for reimbursement from CMS can expect to receive a check in the next few weeks.  Within 30 days of receiving this payment, recipients must sign an attestation confirming receipt of these funds and agree to the terms and conditions of payment.  The portal for signing the attestation will be open the week of April 13, 2020. Terms and Conditions Within 30 days of receiving payment, recipients must attest to receiving the funds and agree to the Terms and Conditions posted by HHS. Below is a brief summary of those terms and conditions. The recipient must certify the following: that it billed Medicare in 2019; currently provides diagnoses, testing, or care for individuals with possible or actual cases of COVID-19; is not currently terminated from participation in Medicare; is not currently excluded from participation in Medicare, Medicaid, and other Federal health care programs; and does not currently have Medicare billing privileges revoked. The payment may only be used to prevent, prepare for, and respond to coronavirus, and shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. Payment may not be used to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. The recipient must provide reports to HHS as the Secretary determines at a later date. Not later than 10 days after the end of each calendar quarter, any recipient that is an entity receiving more than $150,000 total in funds under any of the stimulus packages making appropriations for the coronavirus response and related activities shall submit to the Secretary and the Pandemic Response Accountability Committee a report containing the following information: the total amount of funds received from HHS under one of the foregoing enumerated Acts; the amount of funds received that were expended or obligated for reach project or activity; and a detailed list of all projects or activities for which large covered funds were expended or obligated. Recipients are required to maintain appropriate records and cost documentation as required by 45 CFR § 75.302 and 45 CFR § 75.361 through 75.365, and other information required by future program instructions to substantiate the reimbursement of costs under this award. Entities who have received federal awards in the past may already be familiar with these regulations.  These regulations set forth financial management and standards for federal awards, including maintaining accurate and complete documentation and having written policies and procedures detailing the accounting systems in place to perform the following: The ability to report revenue and expenditures separately by federal program; Identification in its chart of accounts of all federal awards received and expended under which federal program; and The process of maintaining records pertaining to the source and application of receipts and disbursements, federal awards, authorizations, obligations, unobligated balances, assets, expenditures, and income and interest, which must be supported by source documentation. For all care for a possible or actual case of COVID-19, the recipient must certify that it will not seek to collect from the patient out-of-pocket expenses in an amount greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. The Terms and Conditions include a number of statutory provisions that also apply to recipients.  More relief funds will be made available in the coming weeks.  HHS indicated that the next round of funding from the remaining $70 billion would be targeted to providers and suppliers in areas particularly impacted by the COVID-19 outbreak, rural providers, providers of services with lower shares of Medicare reimbursement or those who predominantly serve the Medicaid population, and providers requesting reimbursement for the treatment of uninsured patients. If you have any questions about the CARES Act, please contact the authors or your regular Dorsey & Whitney LLP attorney.  Dorsey is closely monitoring the rapidly evolving legal landscape related to the COVID-19 pandemic.

The U.S. Department of Health and Human Services Office of Inspector General (“OIG”) has taken numerous steps to minimize regulatory burdens for providers who need to make their primary focus delivering patient care during the COVID-19 national emergency. These steps, along with recent steps taken by other agencies to provide temporary regulatory flexibility, provide further welcomed relief to providers who are facing a tremendous burden during this time. 1. AKS Administrative Sanctions Not Imposed for Remuneration Covered by Stark Blanket Waivers related to “COVID-19 Purposes” As we wrote about in our prior blog post, on March 30, 2020, the Centers for Medicare & Medicaid Services (“CMS”) issued 18 blanket waivers of sanctions under the federal physician self-referral law (or “Stark Law”) for remuneration and referrals related to “COVID-19 Purposes” (the “Stark Blanket Waivers”). Then, on April 3, 2020, the OIG issued a Policy Statement notifying interested parties that it “will exercise its enforcement discretion not to impose administrative sanctions under the Federal anti-kickback statute [(“AKS”)] for certain remuneration related to COVID-19” that is covered by certain of the Stark Blanket Waivers. As the OIG explained in this Policy Statement, ordinarily, some financial relationships that implicate the Stark Law may also implicate, and may potentially violate, the AKS. In the Policy Statement, the OIG stated that it will not impose sanctions with respect to remuneration covered by the first 11 of the Stark Blanket Waivers, provided that all of the conditions and definitions within the Stark Blanket Waivers are met. This includes certain remuneration to or from a physician that is above or below fair market value and remuneration to a physician in the form of medical staff incidental benefits or non-monetary compensation that exceeds the limits set forth in applicable Stark exceptions (when specified requirements are met). Note that the remainder of the 18 Stark Blanket Waivers relates to referrals rather than remuneration. In the Policy Statement, the OIG specified that parties can submit questions via email to OIGComplianceSuggestions@oig.hhs.gov related to the application of the OIG’s administrative sanctions for remuneration associated with referrals described in items 12-17 of the Stark Blanket Waivers. (The OIG did not mention the 18th Stark Blanket Waiver, which relates to compensation arrangements that do not satisfy the writing or signature requirements of an applicable Stark exception, even though various AKS safe harbors also have writing and signature requirements. Presumably, parties can also submit questions to OIG about such arrangements, although many such arrangements may not implicate the AKS based on a facts and circumstances analysis outside of safe harbor protection.) The OIG stated that its purpose in issuing the Policy Statement was to avoid the need for parties to undertake a separate legal review under the AKS for arrangements that are covered by the Stark Blanket Waivers. The OIG cautioned, however, that the Policy Statement does not have any bearing on arrangements that are not covered by the Stark Blanket Waivers. This would include, for example, arrangements between a manufacturer and a physician, and arrangements that do not involve a physician (or immediate family member of a physician). The Policy Statement applies to conduct occurring on or after April 3, 2020, whereas the Stark Blanket Waivers were retroactive to March 1, 2020. The Policy Statement terminates the same day that the Stark Blanket Waivers terminate (i.e., the end of the Public Health Emergency (“PHE”) that was declared related to COVID-19). 2. Other Recent OIG Initiatives In addition to the Policy Statement described above, the OIG has undertaken other notable initiatives lately related to COVID-19. Specifically: The OIG issued a “Message from leadership on minimizing burdens on providers” on March 30, 2020, in which it stated: “For any conduct during this emergency that may be subject to OIG administrative enforcement, OIG will carefully consider the context and intent of the parties when assessing whether to proceed with any enforcement action.” On April 3, 2020, the OIG posted a FAQ website about the application of OIG’s administrative enforcement authorities (specifically, the AKS and beneficiary inducements civil monetary penalty) to arrangements connected to the COVID-19 PHE. This website sets forth instructions for submitting questions and limitations on the FAQs, including how this informal feedback during the unique circumstances of the PHE differs from the legally binding OIG advisory opinion process (which remains available to interested parties). Thus far, the FAQ website has one FAQ posted, in which the OIG responded to a question about whether health care providers/practitioners can furnish services for free or at a reduced rate to assist long-term care providers facing staffing shortages. The OIG stated: “In the unique circumstances resulting from the COVID-19 outbreak, we believe that these scenarios likely would present a low risk of fraud and abuse under the Federal anti-kickback statute and the Beneficiary Inducements CMP provided the services being offered are (i) necessary to meet patient care needs as a result of staffing shortages directly connected to the COVID-19 outbreak; (ii) provided for free or at a reduced cost only when necessary as a result of the COVID-19 outbreak; (iii) limited to the period subject to the COVID-19 Declaration; and (iv) not contingent on referrals for any items or services that may be reimbursable in whole or in part by a Federal health care program, either during or after the COVID-19 Declaration period.” The OIG has a “COVID-19 Portal” website, which includes a link for submitting questions regarding OIG’s authorities during the COVID-19 PHE, as well as links for information about other news and resources regarding OIG’s COVID-19 initiatives. On April 3, 2020, the OIG published a report based on brief phone interviews (or “pulse surveys”) that it conducted from March 23 to March 27, 2020 from a random sample of 323 hospitals across the country on challenges the hospitals are facing in responding to COVID-19, strategies used to address those challenges, and how the government can provide support. A summary of the report can be found here, and the complete report can be found here. Finally, while not related to easing provider burdens during the COVID-19 PHE, we note that on March 23, 2020, the OIG alerted the public about new fraud schemes related to COVID-19. In addition, a number of recently added OIG work plan items relate to COVID-19 response matters. * * * For assistance in determining whether an existing or proposed arrangement meets the criteria for waiving AKS administrative sanctions under the OIG Policy Statement described herein, or for any other questions regarding recent OIG initiatives related to COVID-19, please contact the authors or your regular Dorsey & Whitney LLP attorney. Dorsey is closely monitoring the rapidly evolving legal landscape related to the COVID-19 pandemic. You can access Dorsey’s health law blog related to health law updates, available here. You can also access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here.