Healthcare Law Blog

When HIPAA Says Yes but Part 2 Says No, Part Three: Proactive Steps to Take If Your Program Is Under Investigation

In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walked you through what happens when your employees are contacted by investigators. Part Three will guide you throughout the investigatory process.

Receiving a subpoena or learning that your program is under investigation is concerning and stressful, but there are proactive steps you can take to protect your patients, your staff, and your program while demonstrating good faith cooperation. More >

When HIPAA Says Yes but Part 2 Says No, Part Two: When Investigators Contact Your Employees

In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walks you through what happens when your employees are contacted by investigators.

In a Medicaid fraud investigation, it is common for investigators, whether from a state attorney general’s office, an inspector general, or another agency, to contact your employees directly. They may show up at your facility, call staff members, or request informal interviews with your employees outside the work environment. Just as it is important to train employees on HIPAA compliance, SUD program employees must also be trained on Part 2. More >

When HIPAA Says Yes but Part 2 Says No, Part One: What SUD Providers Must Know When Responding to a Subpoena

Part 2 increases protections for SUD patient records because of the stigma and legal consequences associated with substance use treatment. Protecting patient records serves an important public health interest, because weakening confidentiality discourages patient participation in treatment. Federal courts have enforced Part 2 to protect patients. The increased privacy protection for substance use treatment was originally intended to prevent prosecution of patients in active treatment programs, and it still does. While Part 2 is not a new regulation, it did undergo major changes when the 2024 Final Rule was adopted on April 16, 2024 (with a two-year implementation period). Enforcement for the updated Part 2 rules began on February 16, 2026, when the HHS Office for Civil Rights (“OCR”) launched a civil enforcement program and began accepting complaints alleging Part 2 violations and breach notification violations.

Substance use disorder (“SUD”) treatment providers face increasing scrutiny from Medicaid fraud and control units and other government agencies that regularly use subpoenas as an early investigation tool. The United States Department of Health and Human Services (“HHS”) Office of Inspector General (“OIG”) Work Plan also targets SUD providers and focuses on billing accuracy, regulatory compliance, patient monitoring, and other provider-related issues. Because SUD treatment is now provided in such a wide range of settings — including rural health clinics, physician practices, federally qualified health centers, primary care centers, behavioral health providers, hospitals, and independent treatment programs — these providers are targets for heightened oversight but are also subject to complex federal privacy laws that mandate extra protection for the private health information of SUD patients. SUD providers should actively manage these regulatory risks. Although a subpoena may feel urgent and intimidating, federal privacy law strictly limits what SUD providers may disclose, even when the request comes from law enforcement or a state agency. SUD providers must understand and comply with their privacy obligations when responding to the first-line investigative tool, the subpoena. More >

The Heat Turns Up: The 60-Day Rule Gets a Facelift but Changes Create Complications for Providers

With the OIG’s May 30, 2025, announcement that they are seeking $454.4 million in funding to fight healthcare fraud, healthcare providers can expect increased governmental scrutiny despite Trump’s budget cutbacks and staff layoffs.  The OIG justifies its budget request by pointing out that for every $1 invested, there is an expected return of $11 in government recoveries and receivables, which fuels the Trump administration’s fight on fraud, waste, and abuse in health care. What this means for health care providers is intensified scrutiny and likely use of AI as a tool to evaluate big data to identify potential false claims, fraud, outliers, etc. Considering the OIG’s 90-page new General Compliance Guidance, healthcare providers’ self-policing strategies and internal audits are more important than ever as the heat turns up on alleged fraud and false claims. More >

The Future of DEI in Healthcare: Navigating Compliance and Risk Under New Federal Policies

The landscape of diversity, equity, and inclusion (DEI) in healthcare is undergoing a seismic shift following recent executive orders (EO) issued by President Donald J. Trump. The order, titled "Ending Illegal Discrimination and Restoring Merit-Based Opportunity," aims to eliminate DEI initiatives within federal government agencies and private companies contracting with the government. This policy shift presents significant legal and operational challenges for healthcare providers, particularly those relying on federal funding. More >

Medical Cannabis in Kentucky: What Practitioners Need to Know

As of January 1, 2025, medical cannabis is legal in Kentucky. Physicians and nurse practitioners who want to create access for their patients to this important treatment must become authorized to certify patients for medical cannabis and should be extremely careful to comply with confusing and complex regulatory requirements. More >

DEA Proposes New Tele-Prescribing Rules for End of COVID-19 State of Emergency

At the end of January, the Biden Administration announced that May 11, 2023, would mark the end of the federal public health emergency (PHE) declarations that have been in place for the last three years. For healthcare providers, this means change is on the horizon, especially where telemedicine is concerned. In response to the impending end of emergency telehealth provisions, the Drug Enforcement Agency (DEA) has proposed a permanent rule regarding the prescription of controlled medications via telemedicine in order to extend COVID-era accommodations. The public will be able to comment for 30 days on the proposed rules. A summary of the rules can be found here: Proposed Telemedicine Rules Summary. More >

OIG, in a Departure, Approves Hospital Provision of Nurse Practitioner Services

Traditionally, the Office of the Inspector General for the U.S. Department of Health and Human Services (“OIG”) would take a hard stance on any arrangements that might involve some form of remuneration from a hospital to a referring physician, but the winds of change may be blowing. In Advisory Opinion 22-20, published in December of 2022, the OIG has given a green light, albeit in a limited context, to an arrangement in which a hospital may have its employee nurse practitioners perform some services traditionally performed by the patients’ primary care physicians. This is a small step in the direction of a more flexible OIG stance on the federal Anti-Kickback Statute (“AKS”), but it doesn’t completely sidestep risks. More >

Malnutrition Diagnosis Codes: The Compliance Danger You’re Not Taking Seriously Enough

It may seem like hair-splitting, but including the wrong diagnostic codes for malnutrition on hospital inpatient claims – using codes for severe malnutrition in place of other forms of malnutrition – is a costly mistake. The estimated overpayment as a result of these coding errors is a reported $1 billion. Because the payment error rate was so high at a colossal 31%, Medicare-Severity Diagnosis Related Group ("MS-DRG") applicable entities must take note and prepare for a marked increase in Department of Health and Human Services Office of Inspector General ("OIG") audits for these coding practices. The Centers for Medicare & Medicaid Services ("CMS") also plans to implement review practices for malnutrition coding on a sample of inpatient claims. The increased payer audits will result in severe financial damage for hospitals and other MS-DRG applicable entities if they do not mitigate coding and documentation risks. More >

Compliance: Include Prescribing Practices!

Since the implementation of House Bill 1 in 2012, the restrictions on prescribing controlled substances have become more and more stringent, which is a response to the opioid epidemic sweeping Kentucky and the nation. The Cabinet for Health and Family Services, the Kentucky Board of Medical Licensure, the Kentucky Board of Nursing, and the Kentucky Board of Pharmacy are vigilant in policing prescribing practices and have tools through KASPER to closely monitor the prescribing practices of physicians and other practitioners. With the addition of new medications like Gabapentin to the controlled substances hit list, practitioners must be particularly careful to ensure that their prescribing is consistent with regulatory requirements, particularly when patients have been on this medication previously.   Physicians and practitioners must continually monitor compliance as even a minor violation can give rise to investigations, complaints and regulatory penalties.  Assessment of regulatory penalties, even when characterized as “Agreed Orders,” can have devastating consequences for physicians and practitioners’ practices and ability to maintain provider contracts, including Medicare and Medicaid. More >