Med Law Blog

Health information security and healthcare technology

Michael Cassidy — Tue, 04 Jun 2013 12:45:28 -0500

Lee Kim has been selected to the HIMSS Privacy and Security Committee for this coming fiscal year.

In addition, she recently gave a talk on mobile healthcare information security on May 30, 2013 at the SANS Mobile Device Security Summit. A review of her talk (and those of others) can be found here: http://blog.secureideas.com/2013/06/sans-mobile-summit-2013-recap.html.

Lee will be part of an ABA-HIMSS panel discussion on the HIPAA Omnibus Rule on June 11th at the Government Health IT conference.

She will be part of an ABA-HIMSS webinar on negotiating electronic health record contracts on June 20th.

Lee will also be presenting for the CERT Symposium: Cyber Security Incident Management for Health Information Exchanges on June 26th.

The Health IT Legal Landscape: Policy Changes and Practical Examples in a post-Omnibus Privacy Rule World

Michael Cassidy — Tue, 28 May 2013 09:03:19 -0500

Lee Kim will be speaking at the Government Health IT Conference on June 11-12, 2013 in Washington, D.C. addressing changes due to the Omnibus Privacy Rule. Privacy and security requirements for health data can be complex and intimidating. HIPAA and HITECH, and now the January 2013 release of the HIPAA Omnibus Rule have a very practical impact on health IT privacy policy and law.

The learning objective are:

· a foundational understanding of the 2013 HIPAA Omnibus Rule

· practical examples of best approaches for dealing with changes to the Business Associate Agreements and subcontracting

· knowledge of best and worst case scenarios for addressing new privacy requirements

For more information, click here.

Negotiating an Electronic Health Record Agreement: A Marriage Between Healthcare and Technology

Michael Cassidy — Tue, 28 May 2013 08:59:02 -0500

Lee Kim will be giving a webinar on negotiating electronic health record agreements on Thursday, June 20, 2013.

EHR’s are increasingly outsourced services provided by specialty vendors who can take advantage of economics of scale and concentrated expertise. But this means that mission-critical health care functions are more dependent on complex systems the provider does not own or manage.

Negotiating an EHR contract therefore requires that each party recognize what the other party needs for operations and compliance, that both understand what they can and cannot reliably deliver and that they anticipate an evolving relationship. Negotiating must raise and respond to issues ranging from assurances that necessary services levels and services levels will be delivered, to system update and transitions in case of termination, to the complexities of business associate contracting under the new HITECH rules, and many more.

This webinar will therefore cover the provider and the vendor perspectives on issues including:

· due diligence in defining provider needs and expectations, and vendor qualifications

· negotiation and definition of services and service levels, and related warranties and representations

· regulatory coordination, including HITECH and meaningful use

· the realities of indemnification and liability limitations

For more information, click here.

mHealth's Impact: The Most Rapid Transformation in Healthcare Today

Michael Cassidy — Mon, 20 May 2013 12:14:52 -0500

Lee Kim will be presenting a webinar for HIMSS on May 22nd entitled, "Regulation and Innovation in mHealth: What You Need to Know to Successfully Play in the mHealth Space" as part of the HIMSS Virtual Forum on mHealth's Impact: The Most Rapid Transformation in Healthcare Today. A summary of the presentation can be accessed here: http://www.mhimss.org/blog/advancements-abound-mhealth-what-about-pace-policy.

Healthcare to Go: Securing Mobile Healthcare Data

Michael Cassidy — Wed, 01 May 2013 09:38:16 -0500

Tucker Arensberg attorney, Lee Kim, will be speaking at the SANS Mobile Device Security Summit 2013 in Anaheim, California on May 30. Lee will be discussing the challenges of securing healthcare data and implementation of security controls in the mobile space.

PA DEPARTMENT OF HEALTH LEVIES $5.5 MILLION MCARE SURCHARGE ON HOSPITALS AND ASCs

Michael Cassidy — Wed, 24 Apr 2013 15:24:19 -0500

On April 14, 2013, the Pennsylvania Department of Health levied a $5.5 million surcharge for fiscal year 2013 on hospitals, ambulatory surgery centers (ASCs) and birth centers for funding the MCare professional liability debts and expenses. MCare authorized the Department of Health to assess the surcharge and allocate that to hospitals, ASCs and birth centers. DOH has determined that it needs $5.5 million for fiscal year 2013 and has determined that an equitable methodology for allotting that surcharge would be to use total operating rooms and procedure rooms for ASCs and birth centers and licensed beds for hospitals, which they refer to as the “units.”

The total number of units (i.e., beds, operating rooms and procedure rooms) in Pennsylvania is 44,742, which yields a 2013 surcharge of $122.87 per unit.

CLICK HERE FOR MORE INFORMATION ON THIS TOPIC

Proposed Rules Relating to Donated EHR software and certain related items to services to physicians

Michael Cassidy — Mon, 22 Apr 2013 06:54:56 -0500

CMS and the Office of Inspector General at HHS (OIG) have respectively published proposed rules to extend the sunset dates for the Stark exception and anti-kickback statute safe harbor permitting donations of EHR software and certain related items and services to physicians. These provisions are set to expire on December 31, 2013. Both agencies have proposed almost identical changes in their proposed rules. Comments regarding these proposed changes are due by June 10, 2013 for these proposed rules.

The proposed changes include the following:

1. Previously, the donated EHR software must have been certified as interoperable within 12 months prior to the donation (a requirement which has been the subject of much discussion within the healthcare technology vertical). Now, the proposed rules provide that the EHR will be deemed interoperable if it has received EHR certification in accordance with the then current definition of certified EHR technology as established by ONC as of the date of donation to the recipient.

2. Previously, the donated EHR software had to have e-prescribing capability. However, CMS and OIG both are of the belief that e-prescribing has been well deployed and therefore their rules do not need to require this functionality. Accordingly, they propose to eliminate the e-prescribing capability requirement.

3. Currently, sunset dates for the Stark exception and anti-kickback statute safe harbor permitting donations of EHR software and certain related items and services to physicians are December 31, 2013. The proposed rules would extend these dates to December 31, 2016 or, depending on commenter feedback, as late as December 31, 2021. These specific dates are associated with specific Medicare and Medicaid electronic health record incentive programs.

4. Because of the potential for fraud and abuse, the agencies are considering restricting the class of “protected donors.” The proposed rules propose to restrict the “protected doctors” to only hospitals, group practices, prescription drug plan sponsors and Medicare Advantage plans, or, alternatively, to specifically exclude from the definition of protected donors durable medical equipment suppliers, clinical laboratories, and home health agencies.

5. The agencies are also seeking comments on “new and modified conditions” that would prevent EHR donations from becoming a method for locking-in referrals, and that would encourage the free exchange of data.

6. The agencies are also seeking comment on whether to expand the definition of the “covered technology” that may be donated.

Link to CMS proposed rule (including instructions for comment by June 10th):

http://www.gpo.gov/fdsys/pkg/FR-2013-04-10/html/2013-08312.htm

Link to OIG proposed rule (including instructions for comment by June 10th):

http://www.regulations.gov/#!documentDetail;D=HHS_FRDOC_0001-0493

Safeguarding Your Data While Minimizing the Risk of Security Breaches

Michael Cassidy — Thu, 18 Apr 2013 14:58:22 -0500

Lee Kim, Tucker Arensberg attorney and Chair of the mHIMSS Legal/Policy Taskforce, will be a panelist at the American Conference Institute’s Legal and Business Guide to mHealth and Wireless Medical Technology in Washington, D.C. on April 30, 2013. Her panel will cover securing mobile devices, networks, data in the “cloud” and cybercrime.

OIG KO's PODs: Physician Owned Distributorships

Michael Cassidy — Wed, 27 Mar 2013 11:39:55 -0500

The OIG has issued a Special Fraud Alert, dated March 26, 2013, describing specific attributes and practices of Physician Owned Distributorships (PODs) believed to produce substantial fraud and abuse risk and pose dangers to patient safety.

PODs are physician owned entities that derive revenue from selling or arranging for the sale of implantable medical devices ordered by their physician owners for use in procedures that the physician owners perform on their own patients at hospitals or ambulatory surgery centers (ASCs).

OIG believes PODs create a risk of fraud in the following areas:

· Corruption of medical judgment;

· Overutilization;

· Increased costs to the Federal Healthcare Programs; and

· Unfair competition.

There is an interesting tension or contradiction created by the OIGs assumption of overutilization. While it is acceptable for physicians to prescribe the procedures they perform that use the devices and for which the physicians receive professional fees, and the hospitals that employ them receive facility fees, but there is an unacceptable risk of fraud and abuse for the incidentals associated with the procedures. Another contrary example is gain sharing when hospitals and physicians are entitled to engage in monitored collective practices to standardize procedures, purchase supplies and equipment, and divide the savings via “gain sharing arrangement.”

OIG is especially concerned regarding PODs that have questionable ownership recruitment practices, such as:

· Selecting investors because they are in a position to generate substantial business for the entity

· Requiring investors who cease practicing in the service area to divest their ownership interests

· Distributing extraordinary returns on investment compared to the level of risk involved

Furthermore, the OIG is particularly concerned about the presence of such financial incentives in the implantable medical device context, because such devices are typically “physician preference items” meaning that both the choice of brand and type of device may be made or strongly influenced by the physician, rather than being controlled by the hospital or ASC where the procedure is performed. However, on the contrary, it is typically acceptable for hospitals to participate in group purchasing organizations, or the hospitals get to select the devices.

The Special Fraud Alert contains a list of eight specific characteristics the OIG deems to be potentially fraudulent, which can be viewed by clicking above.

National Commission on Payment Reform Recommends 5 Year Transition Model

Michael Cassidy — Wed, 06 Mar 2013 14:44:21 -0500

The Society of General Internal Medicine convened the National Commission on Payment Reform to formulate a recommendation for healthcare payment reform. This Commission released its Report in March 2013. Although we have attached the report, here are the 12 fundamental recommendations.

1. Over time, payers should largely eliminate stand-alone fee-for-service payment to medical practices because of its inherent inefficiencies and problematic financial incentives.

2. The transition to an approach based on quality and value should start with the testing of new models or care over a five-year time period, incorporating them into increasing numbers of practices, with the goal of broad adoption by the end of the decade.

3. Because fee-for-service will remain an important mode of payment into the future, even as the nation shifts toward fixed-payment models, it will be necessary to continue recalibrating fee-for-service payments to encourage behavior that improves quality and cost effectiveness and penalize behavior that misuses or overuses care.

4. For both Medicare and private insurers, annual updates should be increased for evaluation and management codes, which are currently undervalued. Updates for procedural diagnosis codes should be frozen for a period of three years, except for those that are demonstrated to be currently undervalued.

5. Higher payment for facility-based services that can be performed in a lower-cost setting should be eliminated.

6. Fee-for-service contracts should always incorporate quality metrics into the negotiated reimbursement rates.

7. Fee-for-service reimbursement should encourage small practices (those having fewer than five providers) to form virtual relationships and thereby share resources to achieve higher quality care.

8. Fixed payments should initially focus on areas where significant potential exists for cost savings and higher quality, such as care for people with multiple chronic conditions, and in-hospital procedures and their follow-up.

9. Measures to safeguard access to high quality care, assess the adequacy of risk-adjustment indicators, and promote strong physician commitment to patients should be put into place for fixed payment models.

10. The Sustainable Growth Rate (SGR) should be eliminated.

11. Repeal of the SGR should be paid for with cost-savings from the Medicare program as a whole, including both cuts to physician payments and reductions in inappropriate utilization of Medicare services.

12. The Relative Value Scale Update Committee (RUC) should make decision-making more transparent and diversify its membership so that it is more representative of the medical profession as a whole. At the same time, CMS should develop alternative open, evidence-based, and expert processes to validate the data and methods it uses to establish and update relative values.

Two New Federal Policy Documents on Critical Infrastructure Protection

Michael Cassidy — Wed, 13 Feb 2013 14:56:31 -0500

Contributed by Lee Kim, Esq.

412.594.3915

The White House released two documents on February 12^th related to critical infrastructure protection and cybersecurity: the Presidential Policy Directive #21 on Critical Infrastructure and Resilience (PPD-21) which replaces the Homeland Security Presidential Directive (HSPD-7) which previously served as the policy basis for the national critical infrastructure protection enterprise. Interestingly, PPD-21 provides a framework for federal government to work with private sector, states, and local partners to protect the national critical infrastructure. The Executive Order builds on PPD-21 with a specific focus on the protection of critical infrastructure from cyber threats.

Final HIPAA omnibus rule published

Michael Cassidy — Thu, 17 Jan 2013 17:03:05 -0500

Contributed by Lee Kim, Esq.

412-594-3915

The final HIPAA Omnibus Rule has been published and addresses privacy, security, enforcement, and breach notification.

https://federalregister.gov/a/2013-01073

Top 5 Collections Mistakes Made By Long Term Care Facilities

Michael Cassidy — Thu, 17 Jan 2013 09:48:10 -0500

Money is a touchy subject. This is especially true when dealing with the elderly or infirm. However, facilities cannot keep the lights on if the bills are not paid. Follow the link to read what Danielle Dietrich, an attorney at Tucker Arensberg, P.C. writes are the Top 5 Collections Mistakes Made By Long Term Care Facilities.

www.wphospitalnews.com/top-5-collections-mistakes-made-by-long-term-care-facilities/

Danielle Dietrich, Esq. is an attorney with Tucker Arensberg, P.C. She handles all matters of business and commercial litigation for a variety of clients, including long-term care facilities. She can be reached at ddietrich@tuckerlaw.com or 412-594-5605.

California Issues Guidance on Mobile Privacy

Michael Cassidy — Fri, 11 Jan 2013 16:58:10 -0500

Contributed by Lee Kim, Esq.

412.594.3915

All commercial website and online service providers need to comply with the requirements of the California Online Privacy Protection Act. California recently issued guidance on how mobile application developers and others can comply with those requirements at the design stage in its guide entitled, "Privacy On the Go Recommendations for the Mobile Ecosystem." This is believed to be the first time an attorney general in the United States has issued such guidance.

According to news reports (see, e.g., http://www.informationweek.com/government/mobile/california-targets-mobile-apps-for-missi/240012603), California's Attorney General, Kamala D. Harris, has notified businesses that they may be violating the California Online Privacy Protection Act by not having privacy policies in place as required by COPPA.

AMA Adopts Principles for Physician Employment

Michael Cassidy — Tue, 08 Jan 2013 07:07:07 -0500

In November, 2012, the American Medical Association adopted new guiding principles for physicians entering into employment and contractual arrangements. According to one AMA Board Member, “The Principles for Physician Employment provide a broad framework to help guide physicians and their employers as they collaborate to provide safe, high quality, and cost-effective patient care.”

Contributed by: Stacy C. Mikelonis

The potentially problematic aspects of the employer-employee relationship addressed by the principles include contracting, and the AMA advises, “Both parties are urged to obtain the advice of legal counsel experienced in physician employment matters when negotiating employment contracts.” The principles go on to specifically reference matters including performance-based compensation arrangements, custody of patient records upon termination, due process protections for the physician, dispute resolution and restrictive covenants.

The percentage of physicians willing to trade the autonomy of independent practice for the perceived benefits of employment continues to increase. Many physicians are drawn by the freedom from the complexities of running a practice and struggles with shrinking reimbursement amid increasing regulation,. According to data analyzed by the consulting firm Accenture, the percentage of physicians who own at least a part of their practices is expected to be only 36% in 2013; a decline from 57% in 2000.

The AMA press release and link to the principles can be found at: http://www.ama-assn.org/ama/pub/news/news/2012-11-13-ama-adopts-principles-physician-employment.page

CMS Implements 0% Medicare Payment Update: Hold Claims for 10 Day

Michael Cassidy — Fri, 04 Jan 2013 11:39:58 -0500

The American Taxpayer Relief Act of 2012 includes the Physician Update Fix, which essentially provides a 0% Medicare change for 2013. The Centers for Medicare & Medicaid Services (CMS) is currently revising the 2013 Medicare Physician Fee Schedule (MPFS) to reflect the new law’s requirements as well as technical corrections identified since publication of the final rule in November. For your information, the 2013 conversion factor is $34.0230.

In order to allow sufficient time to develop, test, and implement the revised MPFS, Medicare claims administration contractors may hold MPFS claims with January 2013 dates of service for up to 10 business days (i.e., through January 15, 2013). We expect these claims to be released into processing no later than January 16, 2013. The claim hold should have minimal impact on physician/practitioner cash flow because, under current law, clean electronic claims are not paid sooner than 14 calendar days (29 for paper claims) after the date of receipt. Claims with dates of service prior to January 1, 2013, are unaffected. Medicare claims administration contractors will be posting the MPFS payment rates on their websites no later than January 23, 2013.

The 2013 Annual Participation Enrollment Program allowed eligible physicians, practitioners, and suppliers an opportunity to change their participation status by December 31, 2012. Given the new legislation, CMS is extending the 2013 annual participation enrollment period through February 15, 2013. Therefore, participation elections and withdrawals must be post-marked on and before February 15, 2013. The effective date for any participation status changes elected by providers during the extension remains January 1, 2013.

Pennsylvania Medical Records Fees for 2013

Michael Cassidy — Fri, 04 Jan 2013 11:30:42 -0500

The Pennsylvania Department of Health has issued its medical records fees for 2013. The announcement is attached; it provides as follows:

Not to Exceed

Amount charged per page for pages 1-20 $ 1.42

Amount charged per page for pages 21-60 $ 1.05

Amount charged per page for pages 61-end $ .35

Amount charged per page for microfilm copies $ 2.09

Flat fee for production of records to support $26.70

any claim under Social Security or any Federal

or State financial needs based program

Flat fee for supplying records requested by a $21.08

district attorney

*Search and retrieval of records $21.08

Note that the per page fee applies to “reproductions on electronic media.”

Tags:

OIG Advisory Opinion No. 12-17

Michael Cassidy — Fri, 21 Dec 2012 14:48:31 -0500

OIG Advisory Opinion No. 12-17

The OIG recently issued an interesting advisory opinion related to a hospital based hospice agency’s intent to establish a volunteer program to provide non-skilled services to terminally ill patients who do not qualify for hospice care. Under the proposed program, the hospice would offer a community services program to provide non-skilled services at no charge to terminally ill patients who have one year or less to live if the illness runs its normal course, but who do not qualify for hospice services either because they are projected to have more than six months to live or because they do not wish to renounce curative treatment.

The services would be provided by unpaid volunteers and would include activities such as companionship, visitation, transportation in the volunteers personal automobiles, running errands and respite for caregivers.

The OIG stated that while there was some risk the program could potentially generate prohibited remuneration under the anti-kickback statute if the requisite intent to induce or reward referrals were present, the program as described would not be a violation of the anti-kickback statute. The OIG based its opinion largely on the fact that the agency was not going to market the program in the community, rather it would explain the purpose of the program and eligibility criteria to local hospital case managers and others on request. In addition, the costs associated with the program would be maintained separately from the hospice program and the hospital’s expenses and would not be passed on to Federal health care programs (the hospital foundation was to fund the costs of the program for the first year).

Read the full text of the OIG opinion here: https://oig.hhs.gov/fraud/docs/advisoryopinions/2012/AdvOpn12-17.pdf

OIG Advisory Opinion No. 12-20

Michael Cassidy — Thu, 20 Dec 2012 16:34:32 -0500

Contributed by Lee Kim, Esq.

412.594.3915

The Office of Inspector General of the Department of Health and Human Services has issued an advisory opinion regarding a hospital's proposal to provide free acces to an electronic interface to community physicians and physician practices (who request it) so that the physicians and practices can transmit orders for certain services to and receive the results from the hospital. Specifically, physicians could use the interface to transmit to the hospital orders for laboratory and diagnostic services to be perofmred by the hospital and to receive the results of those services. In addition, the hospital would provide, through a contractor, support services necessary to maintain the interface, including software updates. The physicians who choose to particiapte would be responsible for maintaing all aspects of their EHR system.

The anti-kickback statute is not implicated if remuneration is not offered, paid, solicited, or received according to the OIG. The OIG reasoned that the free access to the interface and the related support services as provided by the hospital would not constitute remuneration to the participating physicians under the anti-kickback statute.

OIG advisory opinion: https://oig.hhs.gov/fraud/docs/advisoryopinions/2012/AdvOpn12-20.pdf

mHIMSS Roadmap

Michael Cassidy — Fri, 07 Dec 2012 11:44:42 -0500

Contributed by Lee Kim, Esq.

412.594.3915

mHIMSS, the mobile initiative of HIMSS, has released the mHIMSS Roadmap to serve as guideance for professionals, organizations, corporations and health systems on the adoption of mobile and mobile health devices.

Lee Kim, chair of the mHIMSS Legal/Policy taskforce, authored several sections of the legal & policy section of the mHIMSS Roadmap. It covers topics which include cloud, social media, patents, and medical devices.

The mHIMSS Roadmap was released earlier this week during the mHealth Summit and it has been heavily promoted by mHIMSS members and others in the social media space.