Federal Healthcare Law Update – February 2024

On December 1, 2023, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) announced it expects to recoup billions of dollars in Medicare, Medicaid and other health and human services funds.

The fall 2023 Semiannual Report to Congress details HHS-OIG’s efforts identifying abuses, deficiencies, risks, and investigations relating to the administration of HHS programs. $3.44 billion of taxpayer funds will be recovered as a result of HHS-OIG audits and investigations from October 1, 2022 to September 30, 2023. In fiscal year 2023, HHS-OIG excluded 2,112 individuals and entities from participation in federal health care programs, reported 707 criminal enforcement actions against those engaging in crimes targeting HHS programs, and reported 746 civil actions, including false claims lawsuits.

Additional findings detailed in the report include:

• Medicare improperly paid providers for psychotherapy services, including those provided via telehealth, during the first year of the COVID-19 emergency.
• Many Medicaid enrollees with opioid use disorder were treated with medication (referred to as MOUD). However, one-third of the 1.5 million Medicaid enrollees with opioid use disorder did not receive MOUD in 2021. Certain demographic groups were found less likely to receive MOUD.
• CMS did not accurately report on its website, Care Compare, deficiencies that State surveyors identified during yearly and complaint inspections of Medicare and Medicaid-certified nursing homes.

On December 22, 2023, New York Governor Kathy Hochul vetoed a bill that proposed a ban on non-compete agreements (SB 3100), stating that certain amendments must be made to strike a balance between worker protection and industry needs. The bill, passed by the New York State Legislature on June 20, 2023, aims to restrict most new non-competition agreements for workers. Governor Hochul has specifically advocated for the inclusion of a sale-of-business exception and the potential introduction of a $250,000 salary threshold in any revised bill.

The proposed bill seeks to amend the New York State Labor Law, introducing a new section that prohibits employers and entities from enforcing non-compete agreements on covered individuals. “Covered individual” refers to any person who, whether or not employed under a contract of employment, performs work or services for another person on terms and conditions that render him or her, in relation to that other person, economically dependent on and obligated to perform duties for that other person. Covered individuals would be granted the right to file lawsuits within two years of specific triggering events, and courts would have the authority to invalidate non-compete agreements, awarding compensation for damages, attorney’s fees, and liquidated damages.

According to a Medicare Part A claims analysis published in the Journal of the American Medical Association, the acquisition of hospitals by private equity firms has been associated with an increase in hospital-acquired adverse events. The study examined hospitalizations between 2009 and 2019 at 51 hospitals that were acquired by private equity firms, comparing them to data from 259 matched control hospitals that were not acquired by private equity. Despite having a pool of lower-risk patients admitted, the private equity-acquired hospitals showed a 25.4% higher rate of hospital-acquired adverse events, including a 27.3% rise in falls, a 37.7% increase in central line-associated infections, and approximately twice as many surgical site infections compared to the control hospitals. Although hospital deaths decreased in the private equity acquired hospitals, the researchers suggested that this may be due to a healthier patient pool or potential patient transfers, raising questions about the overall impact of private equity on mortality rates. The study also highlighted the connection between hospital-acquired adverse events and staffing practices, emphasizing the role of private equity in reducing staffing and altering clinician labor mix, potentially contributing to the observed increase in adverse events.

On December 7, 2023, the Office of New York State Attorney General Letitia James (OAG) released a comprehensive report titled “Inaccurate and Inadequate,” which addresses systematic failures and calls for immediate action, by both regulators and network providers, to address “ghost networks,” which describes provider networks which are listed in a health plan’s provider directory that are (i) unreachable, (ii) not in-network, or (iii) not accepting new patients. Individuals struggling with mental health conditions often rely on health plan provider directories to access affordable, quality health care services, and ghost networks can force patients to choose between paying out-of-pocket, which is not possible for many, or forgoing treatment altogether.

To determine the extent of the problem, the OAG conducted a “secret statewide survey” of 13 health plans in major cities across the state. The callers attempted to schedule an appointment for an adult or child with a mental health provider who was listed in the directory as accepting new patients. According to the OAG’s report, 86% of the listed, in-network mental health providers called were “ghosts,” as they were unreachable, not in-network, or not accepting new patients.

Ghost networks are illegal under New York and federal law, which both require that health plans maintain accurate provider directories. Attorney General James reminded the New York State Department of Financial Services and the New York Department of Health that pursuant to New York law, each state agency had an affirmative obligation to propose regulations for network adequacy for mental health and substance use disorder treatment by December 31, 2023. The OAG report recommended that state regulators should actively monitor health insurance networks to ensure that their directories are up to date and take enforcement actions against health plans that violate the law. In addition, health plans should be required by law to meet cultural competence and language access standards, and should incentivize providers to join and stay in-network through higher reimbursement rates and reducing administrative burdens on providers. According to the OAG’s report, adopting these recommendations can significantly

On January 9, 2024, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued a final rule which provides guidelines for several federal statutes that provide protections for healthcare workers who refuse to provide treatment based on conscience objections. In 2019, the OCR adopted a sweeping new rule that dramatically expanded how various federal laws regarding conscience objections were interpreted. The 2019 rule was held unlawful by three separate federal district courts. The recently adopted final rule readopts portions of the original 2011 conscience objection rule that restored the longstanding process for enforcing federal conscience laws, and incorporates certain provisions of the 2019 rule that strengthen protections against conscience and religious discrimination.

The final rule clarifies the OCR’s authorities and enforcement tools, including affirming that the OCR is the designated office for receiving, handling, and investigating complaints; retaining descriptions of the OCR’s enforcement process that fall within HHS’s authority, and encouraging covered entities to post a notice explaining rights under the federal health care conscience protection statutes. The final rule also rescinds portions of the 2019 rule that would have stripped federal funding from health facilities that required workers to provide any service they objected to, such as abortions and gender-affirming care. According to HHS, the final rule strikes a balance between respecting the religious and moral rights of healthcare providers while protecting access to healthcare. The final rule will become effective on March 11, 2024.

On November 3, 2023, a federal district court issued a monumental decision endorsing an expansive view of who qualifies as a “patient” of a 340B program “covered entity” facility eligible to receive a drug under the federal 340B Drug Pricing Program. The federal 340B Drug Pricing Program is intended to help safety-net health care providers stretch their financial resources to reach more financially vulnerable patients and allows qualifying facilities that treat low-income and uninsured patients to buy outpatient prescription drugs at a discount of 25 to 50 percent. The federal court in Genesis Healthcare, Inc. v. Becerra overturned part of the government’s definition of what is a 340B-eligible patient, ruling in favor of a covered entity that challenged a Health Resources and Services Administration (HRSA) audit that found that the facility violated the 340B statute’s prohibition against diversion, which prohibits a drug from being provided to an individual who is not an eligible outpatient of that facility.

In its decision, the court found that the HRSA’s more restrictive definition of a 340B-eligible patient, which required a covered entity to initiate the services resulting in the relevant prescription in order to claim them as a patient, was inconsistent with the 340B statute. Instead, the court found that the intent of the statute required a broad reading of the definition of who is an eligible patient under the 340B Drug Pricing Program, allowing covered entities to use 340B drugs for prescriptions that originated outside of the facility. The court’s ruling also established that a covered entity must have an ongoing relationship with an individual to meet the broad definition of a 340B-eligible patient, notwithstanding that the statute does not establish any specific periods of time in order to establish a patient relationship.

On December 19, 2023, the U.S. Department of Justice announced a settlement with Community Health Network Inc. (Community), an Indiana healthcare system, in the amount of $345 million to resolve allegations of violations of the False Claims Act by knowingly submitting Medicare claims for services referred in violation of the Stark Law. The Stark Law prohibits physicians from referring patients to facilities with whom they have a financial relationship unless specific exceptions are met. Furthermore, it mandates that the remuneration for employed physicians be fair market value and does not take into account the volume of referrals from these physicians.

The complaint alleged that Community’s compensation to specialists, including cardiologists, cardiothoracic surgeons, vascular surgeons, neurosurgeons, and breast surgeons, exceeded fair market value. In addition, Community incentivized physicians by giving bonuses linked to the number of their referrals and Community filed claims with Medicare for services originating from these illicit referrals. In addition to the monetary payment, Community will enter a five-year Corporate Integrity Agreement with the U.S. Department of Health and Human Services Office of Inspector General.

On January 17, 2024, CMS issued a final rule regarding Interoperability and Prior Authorization. The goal of the final rule is to improve patient, provider, and payer access to data and the prior authorization process. Effective January 1, 2026, impacted payers, such as Medicare Advantage organizations, state Medicaid, and CHIP programs, must provide prior authorization decisions within 72 hours for urgent requests and 7 calendar days for non-urgent requests. Any denial must include a specific reason for such denial. This rule does not apply to prior authorization requests for medications.

Last month, the U.S. Department of Health & Human Services (HHS) released a “concept paper” titled “Healthcare Sector Cybersecurity: Introduction to the Strategy of the U.S. Department of Health and Human Services.” In its introductory comments, HHS highlighted cybersecurity threats facing the healthcare industry, including:

• “The healthcare sector is particularly vulnerable to cybersecurity risks and the stakes for patient care and safety are particularly high. Healthcare facilities are attractive targets for cyber criminals in light of their size, technological dependence, sensitive data, and unique vulnerability to disruptions. Cyber incidents in healthcare are on the rise. For instance, HHS tracks large data breaches through its Office for Civil Rights (OCR), whose data shows a 93% increase in large breaches reported from 2018 to 2022 (369 to 712), with a 278% increase in large breaches reported to OCR involving ransomware from 2018 to 2022.”

• “Cyber incidents affecting hospitals and health systems have led to extended care disruptions caused by multiweek outages; patient diversion to other facilities; and strain on acute care provisioning and capacity, causing cancelled medical appointments, non-rendered services, and delayed medical procedures (particularly elective procedures). More importantly, they put patients’ safety at risk and impact local and surrounding communities that depend on the availability of the local emergency department, radiology unit, or cancer center for lifesaving care.”

HHS also references President Biden’s “National Cybersecurity Strategy” published in March 2023, which sets forth “the U.S. Government’s approach to improving the nation’s cyber defense and securing our digital infrastructure.”

The HHS concept paper sets forth an action plan for cybersecurity improvements in order to advance ongoing efforts and cyber resiliency in the healthcare sector. The plan includes the following steps:

• Establish voluntary cybersecurity performance goals (CPGs) for the healthcare sector
-HHS, with input from the industry, will establish and publish voluntary sector-specific cybersecurity performance goals, setting a clear direction for

the industry and helping to inform potential future regulatory action from HHS

• Provide resources to incentivize and implement the cybersecurity practices
-HHS envisions accomplishing this through an upfront investment program and an incentives program for investments in cybersecurity practices

• Implement an HHS-wide strategy to support greater enforcement and accountability
-HHS plans to propose incorporation of CPGs into existing regulations and programs and to create new enforceable cybersecurity standards

• Expand and mature the one-stop shop within HHS for healthcare sector cybersecurity
-This will be accomplished within the Administration of Strategic Preparedness and Response (ASPR)

HHS believes these goals will assist in advancing the healthcare sector’s accountability and cyber resiliency in meeting the growing threat of cyber actors against the health care industry.

On January 10, Michael C. Foster released a blog entitled “Eli Lilly Launches Website to Sell Weight Loss Drugs Directly to Patients” regarding their new website that will make it easier for patients to obtain prescriptions for weight loss drugs, without ever having to leave their homes.

On January 4, Tax Member and Chair David J. Ritter and Counsel Robert A. Kosicki disseminated a Tax Client Alert named “More Online Services Available to Business Owners” about a new online tool users can download with business tax transcripts.

On December 21, Healthcare Law Vice Chair Isabelle Bibet-Kalinyak issued a Healthcare Client Alert called “Deck the Halls with Compliance: New Year, New Training Requirement for DEA-Registered Practitioners” to notify DEA-registered practitioners about the deadline to complete a one-time, eight-hour training.

On December 4, Healthcare Member and Litigation Chair Keith J. Roberts posted a podcast entitled “Tips for Physicians to Avoid Potential Litigations” to provide invaluable tips to safeguard your medical practice from potential litigations.

RIZA DAGLI

What advice can you share with a client who might need your services?

A large part of my practice involves disputes between healthcare providers and payors, such as Medicare/Medicaid and insurance companies. Whether the disputes are civil, administrative, or criminal, its important to retain counsel early. Sometimes providers are hesitant to involve lawyers early in the process, and its not because of the cost. Rather, providers are under the mistaken belief that involving an attorney gives the impression that they did something wrong. That couldn’t be further from the truth. It actually gives the impression they are smart and professional. Having worked for the Office of the Attorney General for a large part of my career, I can tell you that government investigators and prosecutors don’t draw negative inferences from individuals or entities hiring counsel, or speaking through counsel. They expect it. In complex matters, they actually look forward to communicating with counsel, because they identify issues faster, avoid misunderstandings, get the documents and information they need quicker, and hopefully resolve the case sooner. More often than not, the issue facing the provider is not unique, and an early call to an attorney, who has seen these issues before, can save time and money.

What are some best practices for healthcare clients?

Documentation is probably the easiest and cheapest way to avoid legal problems. It only takes a few extra minutes to satisfy the CPT code requirements, and to demonstrate that certain healthcare services were provided. Whether it’s the patient chart, medical notes, or something as simple as attendance logs, a provider can avoid significant expense and headache by making sure the documentation is complete.

MICHAEL C. FOSTER

What advice can you share with a client who might need your services?

Whether a client needs assistance with reviewing a simple contract, starting a practice, or expanding an already established healthcare system, it is crucial that clients trust their attorney to look out for their client’s best interests. Additionally, do your homework, always effectively communicate your goals, set realistic timelines, and ask questions. I would encourage clients to actively develop an ongoing professional relationship with their attorney, as you will want an attorney who can identify future potential issues in advance, knows your preferences and you genuinely enjoy interacting with.

What are some best practices for healthcare clients?

Avoid becoming the “test-case” by taking a proactive, not reactive, approach to compliance. Seeking out legal guidance on a potential arrangement or having an agreement reviewed in advance, could save you much more time and money in the long run. Additionally, healthcare employers should never take consistent, loyal and talented employees for granted. A proactive approach to employee retention, could save you from the cost of one or more replacements on the back end.