Healthcare Law Blog

Reminder: Update Your “Grandfathered” HIPAA Business Associate Agreements Now!

In January 2013, the Department of Health and Human Services (“HHS”) published its Final Rule, which significantly increased the privacy and security responsibilities for the “business associates” of “covered entities,” as those terms are defined by HIPAA. A provision within the Final Rule mandated that all covered entities and their business associates revise their business associate agreements to reflect the new responsibilities. Specifically, a business associate must now, among other things: More >

Health Care Industry Familiar with HIPAA Breaches, Not So Much Hackers

Community Health Systems (“Community”), which operates 206 hospitals in 29 states, recently notified 4.5 million of its patients that online hackers had stolen personal data information from its systems in a period between April and June 2014. The data included names, addresses, birthdates, telephone numbers and Social Security numbers—all of which are protected under HIPAA. According to Community, the data did not include financial or medical information.

It has been reported that the hackers responsible for the attack are a group of cybercriminals from China that traditionally go after intellectual property, including medical device and equipment development data.  They used malicious software to obtain the data, which has since been removed by Community from the network. Further remedial efforts are already underway, including notifying affected patients and offering them identity theft protection services.

Hospitals should be accustomed to protecting data against privacy breaches as part of their HIPAA obligations, but outright cybertheft is a threat that many providers have not likely considered. The FBI, which is now investigating the Community incident, said in April that health care providers typically do not use the same high levels of security technology as companies in other industries (such as banking or retail). This makes providers an easy target for hackers. If a leading hospital system like Community can be breached, then hospitals of every size are at risk.

It is crucial that HIPAA-covered entities (and their business associates) understand and identify potential threats to their secured information. The importance of HIPAA risk analysis cannot be stressed enough; in fact, a risk analysis is required as the first step in HIPAA Security Rule compliance. While it may be impossible to build an impenetrable fortress of secured online information, it is evident that health care providers must continue to make it a top priority to protect patient records – both from HIPAA breaches and hackers.

Services may be performed by others.

This article does not constitute legal advice.

New Part D Regulations Face Increased Scrutiny from Advocacy Groups & Congress

On March 10, 2014, the Centers for Medicare & Medicaid Services (“CMS”) issued a memorandum to Part D Plan Sponsors and Medicare Hospice Providers entitled, "Part D Payment for Drugs for Beneficiaries Enrolled in Hospice – Final 2014 Guidance" (“Guidance”).   The Guidance, effective since May 1, 2014, requires a prior authorization process for Hospice and Part D providers to determine their respective responsibility for drug coverage. The Guidance followed a 2012 OIG report entitled "Medicare Could Be Paying Twice for Prescription Drugs for Beneficiaries in Hospice,” which found that Medicare Hospice patients’ medications were sometimes paid for by Part D rather than by the patient’s Hospice program. More >

Have You Reviewed Your Existing Business Associate Agreements?

Pursuant to the HIPAA Final Omnibus Rule (“Final Rule”), covered entities and their business associates were required to enter into new business associate agreements (“BAAs”) or modify existing BAAs by Sept. 23, 2013. However, existing BAAs that (i) were entered into on or before Jan. 25, 2013; (ii) met the requirements that were applicable prior to the promulgation of the Final Rule; and (iii) were not modified after March 26, 2013, have until Sept. 23, 2014 to be updated. That deadline is quickly approaching. More >

Time to “Face” The Risks

In 2011, the U.S. Centers for Medicare and Medicaid Services (“CMS”), as part of the reform instituted by the Affordable Care Act, required that home health agencies and hospice patients receive a face-to-face visit (at specified time periods) by a physician or nurse practitioner to ensure that they continue to meet Medicare and Medicaid eligibility criteria. More >

All Eyes on Hospice Care

In 2013, the Department of Justice (“DOJ”) and Office of Inspector General (“OIG”) charged the nation’s largest for-profit hospice chain, Vitas Innovative Hospice Care (“Vitas”), with false Medicare billings, inappropriately admitting patients with “aggressive marketing tactics,” and misleading patients and families about Medicare hospice benefits. This suit is just one of many recently filed against hospice providers, indicating that they are being watched keenly by enforcement authorities and government agencies. More >

Important Reminder for Association Group Health Plans

In Kentucky, most trade association-sponsored health plans renew on July 1, 2014. Now is an excellent time for trade association executives to review association and Health Plan materials to ensure compliance with applicable Federal and State requirements prior to renewal. More >

Physicians: Have You Checked Your Numbers?

As promised, the Centers for Medicare and Medicaid Services released information about Medicare payment to physicians and certain health care professionals on April 9^th. The release is in conjunction with the policy change instituted by the U.S. Department of Health and Human Services, which allows CMS to respond on a case-by-case basis to Freedom of Information Act requests for Medicare payment information related to individual physicians (see more on the topic here). More >

FTC: Don’t Limit APRNs Crucial Role in Health Care

The Federal Trade Commission (“FTC”) recently released a policy paper suggesting that state legislators should be cautious when evaluating legislative proposals to limit the scope of practice of Advance Practice Registered Nurses (“APRNs”). The FTC is concerned that by imposing more stringent physician supervision requirements, APRNS are effectively being restricted by another type of health care professional (the physician) thereby denying consumers the benefits of greater competition. This is especially troubling in light of the significant shortage of primary care practitioners in the U.S. By allowing APRNs to practice without heavier regulatory burdens, access to health care can be increased and possibly lead to “lower costs, better care, and more innovation,” according to the FTC. More >

Small Devices & Big Consequences: Why Medical Practices Need Encryption

On Tuesday, I shared information about the U.S. Health and Human Services (“HHS”) Office of Civil Rights’ (“OCR”) first settlement with a medical practice for alleged violations of the breach notification provisions of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. The $150,000 settlement was made with Adult & Pediatric Dermatology, P.C., (“the Practice”) after the entity reported a stolen jump drive that contained PHI of approximately 2,200 patients. More >