Federal Healthcare Law Update – March 2024

According to a recent announcement from the United States Department of Justice, Silver Lake Hospital, a long-term care hospital based in Newark, New Jersey, has agreed to pay over $18.6 million, plus interest, to resolve alleged violations of the federal False Claims Act for claiming excessive cost outlier payments from the Medicare program. In addition, several investors in Silver Lake Hospital have agreed to pay $12 million, plus interest, to resolve alleged Federal Debt Collection Procedures Act (FDCPA) violations for the fraudulent transfer of money by the hospital to its investors.

According to the Department of Justice, from 2018 to 2023, Silver Lake Hospital overbilled Medicare for in-patient services under the so-called “cost outlier” program, designed to incentivize and compensate hospitals for treating patients with unusually expensive care, in violation of the federal False Claims Act. Silver Lake allegedly defrauded the cost outlier payment system by rapidly increasing its charges far more than actual increases in its costs for providing care, thereby receiving excessive payments from Medicare. The Department of Justice further alleged that Silver Lake

On December 28, 2023, the U.S. Department of Health and Human Services Office of Inspector General, (OIG) issued Advisory Opinion No. 23-15 approving a proposed arrangement where a consultant would pay a referral fee to its physician practice clients if they recommend the consultant to other physician practices.

Under the proposed arrangement, the consultant provides practice optimization services to physician practice clients in exchange for a service fee. The consultant will offer these physician practice clients a $25 gift card if they recommend the consultant’s services to other physician practices and an additional $50 gift card if the recommendation results in a new physician practice retaining the consultant.

The OIG analyzed this arrangement based on three remuneration streams:

1. Gift cards provided to physician practice clients who recommend the consultant’s services to other physician practices. The OIG determined that these gift cards are not given in exchange for referrals, purchases, arrangements, or recommendations of any item or service reimbursable by Federal health care programs.

2. The service fee paid by the physician practice clients to the consultant. The OIG noted that the consultant agreed not to recommend to any client the purchasing, leasing, or ordering of any item or service reimbursable by Federal health care programs.

3. Higher reimbursements under Medicare’s MeritBased Incentive Payment System to physician practice clients due to consultant services. The OIG found that, although these services might result in increased reimbursement, any remuneration clients may receive is not in exchange for referrals, purchases, arrangements, or recommendations of any item or service reimbursable by Federal health care programs.

On February 8, 2024, the U.S. Department of Health and Human Services (HHS), in collaboration with the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), announced changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2.

This final rule includes the following key changes:

1. Patients may provide a single patient consent for all future uses and disclosures of patient records for treatment, payment, and healthcare operations.

2. HIPAA covered entities and business associates may re-disclose patient records, except that patient records cannot be used in legal proceedings against the patient without specific consent or court order.

3. Patients have the right to an accounting of disclosures, as well as to restrict certain disclosures, consistent with HIPAA.

4. If there is a breach under 42 C.F.R. Part 2, notice must be given that satisfies the same breach notification requirements under HIPAA.

5. HHS’s enforcement authority now includes the imposition of civil money penalties for violations of 42 C.F.R. Part 2.

The final rule aims to enhance coordination among

On February 2, 2024, the Substance Abuse and Mental Health Services Administration (SAMHSA), a division of the Department of Health and Human Services, published a final rule significantly updating the regulations governing Opioid Treatment Programs (OTPs) for the first time in 20 years. The final rule makes certain COVID-19 flexibilities permanent by expanding patient access and eligibility to medications for opioid use disorder by providing patients with the ability to initiate treatment via telehealth. Some of the other significant updates adopted in the final rule include allowing mid-level providers to order medications in OTPs to the extent permitted by state law, eliminating the requirement that patients have a history of addiction for a full year before being eligible for treatment, increasing access to interim treatment with or without medication treatment while awaiting further services, promoting patient-centric care, and removing the stigma around treatment by updating terminology to reflect current medical usage.

The final rule goes into effect on April 2, 2024, although OTPs will have until October 2, 2024 to ensure compliance. While finalizing more flexible regulations for OTPs, SAMHSA will continue to maintain accreditation requirements for all programs. The Drug Enforcement Agency (DEA) is expected to release a complementary rule that will pertain to those who are receiving care for substance use disorder but who are not participating in an OTP. It remains to be seen whether the DEA will permanently waive the in-person requirement for the prescription of controlled substances.

On February 16, 2024, the Centers for Medicare & Medicaid Services (CMS) announced plans to establish a Medicare demonstration project aimed at enhancing procedures for identifying, investigating, and prosecuting Medicare fraud within ambulatory surgical centers (ASCs) that cater to Medicare beneficiaries. Under this initiative, ASC providers would be required to submit comprehensive documentation to their Medicare Administrative Contractors (MACs) demonstrating compliance with applicable Medicare coverage, coding, and payment regulations before providing services. Trained clinical reviewers at the MACs would assess the medical necessity and adherence to Medicare requirements for the requested services. If an ASC provider fails to submit a prior authorization request before rendering the service and submitting a claim to Medicare for payment, the MAC would request the necessary information from the ASC provider to determine if the service meets applicable Medicare coverage, coding, and payment rules before processing the claim.

The specific procedures subject to prior authorization and the geographical scope of the demonstration project remain undisclosed by CMS. Comments from stakeholders are currently being sought by CMS until April 16, 2024. Further details are anticipated in the forthcoming 2025 ASC proposed payment rule from CMS.

On December 7, 2023, the Department of Health & Human Services, Office for Civil Rights (OCR) announced its first-ever settlement involving a cyber-attack that emanated from a phishing scheme. “Phishing is a type of cybersecurity attack used to trick individuals into disclosing sensitive information via electronic communication, such as email, by impersonating a trustworthy source,” and, according to OCR’s Director, “is the most common way that hackers gain access to health care systems to steal sensitive data and health information.”

By way of background, OCR conducted an investigation of a medical group after it filed a breach report with OCR stating that a hacker, through a successful phishing attack, had gained access to an email account containing protected health information, or PHI. Among OCR’s findings were that the group failed to conduct an organization-wide risk analysis to identify potential threats or vulnerabilities to the group’s systems, had no HIPAA policies and procedures in place, and failed to regularly review system activity. In settling the matter, the group agreed to pay OCR $480,000 and implement a corrective action plan that will be monitored for two years.

In the new guidance document CMS advised that:
• Texting patient information and the texting of patient orders among members of the health care team is permissible, if accomplished through a HIPAA compliant secure texting platform (STP) and in compliance with Medicare Conditions of Participation (CoPs), and
• Computerized Provider Order Entry (CPOE) continues to be the preferred method of order entry by a provider. CMS also reminds providers that, to maintain compliance with Medicare COPs and HIPAA, all providers must utilize and maintain systems/platforms that are secure

JONATHAN WALZMAN

What advice can you share with a client who might need your services?

Communication is key to a successful attorney-client relationship. Be open and transparent about your situation, concerns, and objectives, and clearly communicate your goals and priorities. Whether you are dealing with a transactional matter or a regulatory compliance issue, understanding what you want to achieve will guide our strategy and approach. Legal matters in healthcare can be complex and time-consuming. It is important to stay actively engaged and provide timely responses to requests for information or documents. Your cooperation and participation are essential to achieving your goals. By working closely and collaboratively with your attorney, we can navigate the legal process together and achieve the best possible outcome for your situation.

What are some best practices for healthcare clients?

Stay up-to-date with federal, state, and local laws and regulations governing the healthcare industry and implement policies
and procedures to ensure compliance. Always be proactive, and try to identify and mitigate potential risks before a problem materializes. Provide training and education programs for your staff to ensure that staff members are knowledgeable and competent in their roles and responsibilities and do not engage in conduct that can lead to potential liability. Finally, establish a relationship with experienced healthcare attorneys who can provide guidance, advice, and representation on legal matters affecting the practice and consult with them proactively. By adhering to these best practices, healthcare clients can promote legal compliance, mitigate risks, and uphold the highest standards of patient care and ethical conduct within their practices.

ERIKA MARSHALL

What advice can you share with a client who might need your services?

When discussing a potential problem with counsel the best advice is to clearly communicate what you believe the issue at hand to be and what your ultimate goal is. Communicating what you want will enable counsel to advocate for you and your interests while working toward a resolution.

What are some best practices for healthcare clients?

It is important that each owner, partner and member of a business have a general understanding of how their business operates and stay up to date on recent developments and changes in the healthcare sector to ensure compliance.

On February 15-18, Healthcare Law Vice Chair Isabelle Bibet-Kalinyak presented at the “Telling it Like it Is” conference giving an eye healthcare law and practice management update.

On January 31, Healthcare Law Vice Chair Isabelle Bibet-Kalinyak presented a legal and legislative update to the New Jersey Association of Ambulatory Surgery Centers.

On January 11, Healthcare Law Vice Chair, Isabelle Bibet-Kalinyak, Esq. represented Bucks-Mont Eye Associates in its M&A transaction with private equity-backed Vision Innovation Partners (VIP) which closed just before the end of 2023.

Congratulations to Managing Member and Healthcare Law Chair John D. Fanburg for being honored in the 2024 ROI Influencers Power List for Law.