Parkview Hospital To Pay $800K To Settle HIPAA Charges After Retiring Physician Blows The Whistle

July 6, 2014

Health care providers, health plans, heath care clearinghouses and their business associates heed both the lesson about properly protecting protected health information and the more subtle lesson about the role of employees and other whistleblowers in bringing these violations to the attention of regulators contained in the latest Health Insurance Portability & Accountability Act (HIPAA) resolution agreement.

Late last month, the Department of Health & Human Services Office of Civil Rights (HHS) announced that complaints of a retiring physician over the mishandling of her patient records by Parkview Health System, Inc. (Parkview) prompted the investigation that lead Parkview to agree to pay $800,000 to settle charges that it violated HIPAA’s Privacy Rule.

The resolution agreement settles charges lodged by HHS based on an OCR investigation into the retiring physician’s allegations that Parkview violated the HIPAA Privacy Rule by failing to properly safeguard the records when it returned them to the physician following her retirement.

As a covered entity under the HIPAA Privacy Rule, HIPAA requires that Parkview appropriately and reasonably safeguard all protected health information in its possession, from the time it is acquired through its disposition.

In an investigation prompted by the physician’s complaint, OCR found that Parkview breached this responsibility in its handling of certain physician patient records in helping the physician to transition to retirement.

According to OCR, in September 2008, Parkview took custody of medical records pertaining to approximately 5,000 to 8,000 patients while assisting the retiring physician to transition her patients to new providers, and while considering the possibility of purchasing some of the physician’s practice.

Subsequently on June 4, 2009, Parkview employees, with notice that the physician was not at home, left 71 cardboard boxes of these medical records unattended and accessible to unauthorized persons on the driveway of the physician’s home, within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue. OCR concluded this conduct violated the Privacy Rule.

To settle OCR’s charges that these actions violated HIPAA, OCR has agreed to pay the $800,000 resolution amount and to adopt and implement a corrective action plan requiring Parkview to revise their policies and procedures, train staff, and provide an implementation report to OCR.

The resolution agreement highlights the role that current or former physicians, employees or others can play in helping OCR to identify HIPAA violations.  Health care providers and other covered entities and their business associates should take into account the likelihood that physicians on their own or other facility medical staffs, their employees and other participants in the care delivery system often may have and be motivated to report to government sensitive information about violations of HIPAA or other laws.  Since HIPAA and most other laws prohibited covered entities from forbidding or retaliating against a person for objectiving to or reporting the concern and offer whistleblowers potential participation in the reporting and prosecution of violations, employees or other workforce members increasingly make the complaints bring violations to OCR and other regulators.

Whether from an internal employee complaint, a  patient or competitor complaint or other source, HIPAA violations carry significant liability risks.  The HITECH Act tightened certain rules applicable to the use, access or disclosure of protected health information by covered entities and their business associates.  In addition, the HITECH Act added breach notification rules, extended direct responsibility for compliance with HIPAA to business associates, increased penalties for noncompliance with HIPAA and made other refinements to HIPAA’s medical privacy rules and made certain other changes.  Furthermore, enforcement of HIPAA and the resulting penalties have increased since the HITECH Act took effect.

With OCR stepping up both audits and enforcement and penalties for violations higher than ever since the HITECH Act amended HIPAA, Covered Entities and business associates should act quickly to review and update their policies, practices and training to implement any adjustments needed to maintain compliance and manage other risks under these ever-evolving HIPAA standards.

When conducting these efforts, Covered Entities and business associates not only carefully watch for and react promptly to new OCR guidance and enforcement actions, but also document their commitment and ongoing compliance and risk management activities to help support their ability to show their organization maintains the necessary “culture of compliance” commitment needed to mitigate risks in the event of a breach or other HIPAA violation and take well-documented, reasonable steps to encourage their business associates to do the same.    When carrying out these activities, most covered entities and business associates also will want to take steps to monitor potential responsibilities and exposures under other federal and state laws like the privacy and data security requirements that often apply to personal financial information, trade secrets or other sensitive data under applicable federal and state laws and judicial precedent.

For Help With Investigations, Policy Review & Updates Or Other Needs

If you need assistance in auditing or assessing, updating or defending your HIPAA, or other health or other employee benefit, labor and employment, compensation, privacy and data security, or other internal controls and practices, please contact the author of this update, attorney Cynthia Marcotte Stamer at cstamer@solutionslawyer.net or at (469)767-8872.

The Chair of the American Bar Association (ABA) RPTE Employee Benefits & Other Compensation Committee, a Council Representative on the ABA Joint Committee on Employee Benefits, Government Affairs Committee Legislative Chair for the Dallas Human Resources Management Association, and past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, Ms. Stamer works, publishes and speaks extensively on HIPAA and other privacy and data security, health plan, health care and other human resources and workforce, employee benefits, compensation, internal controls and related matters.

For more than 23 years, Ms. Stamer has counseled, represented and trained employers and other employee benefit plan sponsors, plan administrators and fiduciaries, insurers and financial services providers, third party administrators, human resources and employee benefit information technology vendors and others privacy and data security, fiduciary responsibility, plan design and administration and other compliance, risk management and operations matters.  She also is recognized for her publications, industry leadership, workshops and presentations on privacy and data security and other human resources, employee benefits and health care concerns.  Her many highly regarded publications on privacy and data security concerns include “Privacy Invasions of Medical Care-An Emerging Perspective.” ERISA Litigation Manual. BNA, 2003-2009; “Privacy & Securities Standards-A Brief Nutshell.” BNA Tax Management and Compliance Journal. February 4, 2005; “Cybercrime and Identity Theft: Health Information Security beyond HIPAA.” ABA Health eSource. May, 2005 and many others.  She also regularly conducts training on HIPAA and other privacy and data security compliance and other risk management matters for a broad range of organizations including the Association of State and Territorial Healthcare Organizations (ASTHO), the Los Angeles County Health Department, a multitude of health plans and their sponsors, health care providers, the American Bar Association, SHRM, the Society for Professional Benefits Administrators and many others.  Her insights on these and other matters appear in the Bureau of National Affairs, Spencer Publications, the Wall Street Journal, the Dallas Business Journal, the Houston Business Journal, and many other national and local publications. For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see www.CynthiaStamer.com or contact Ms. Stamer directly.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested reviewing some of our other Solutions Law Press resources available at http://www.solutionslawpress.com including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at www.SolutionsLawPress.com.

©2014 Cynthia Marcotte Stamer.  Non-exclusive right to republish granted to Solutions Law Press.  All other rights reserved.


Health Care & Other HIPAA Covered Entities Should Review New Reports As Part of HIPAA Risk Management Efforts

June 11, 2014

Health care providers, health plans and insurers, health care clearinghouses (collectively “Covered Entities”), their business associates, and others concerned about medical privacy regulations or protections should check out two new reports to Congress about breach notifications reported and other compliance data under the Health Insurance Portability & Accountability Act (HIPAA) by the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).   Reviewing this data can help Covered Entities and their business associates identify potential areas of exposures and enforcement that can be helpful to minimize their HIPAA liability as well as to expect OCR enforcement and audit inquiries.

Required by the Health Information Technology for Economic and Clinical Health (HITECH) Act, the two new reports discuss various details about HIPAA compliance for calendar years 2011 and 2012.  They include the following:

  • Report to Congress on Breach Notifications, discussing the breach notification requirements and reports OCR received as a result of these breach notification requirements; and
  • Report to Congress on Compliance with the HIPAA Privacy and Security Rules, summarizing complaints received by OCR of alleged violations of the provisions of Subtitle D of the HITECH Act, as well as of the HIPAA Privacy and Security Rules at 45 CFR Parts 160 and 164 .
  • Covered entities and their business associates should review the finding reported as part of their compliance practices. Others concerned about medical or other privacy or data security regulations or events also may find the information in the reports of interest.

Under HIPAA, covered entities generally are prohibited from using, accessing or disclosing protected health information about individuals except as specifically allowed by HIPAA,  In addition, HIPAA also requires Covered Entities to establish safeguards to protect protected health information against improper access, use or destruction, to afford certain rights to individuals who are the subjects of protected information, to obtain certain written assurances from service providers who are business associates before allowing those service providers to use, access or disclose protected health information when carrying out covered functions for the Covered Entity, and meet other requirements.

The HITECH Act tightened certain rules applicable to the use, access or disclosure of protected health information by covered entities and their business associates.  In addition, the HITECH Act added breach notification rules, extended direct responsibility for compliance with HIPAA to business associates, increased penalties for noncompliance with HIPAA and made other refinements to HIPAA’s medical privacy rules and made certain other changes.

Enforcement of HIPAA and the resulting penalties have increased since the HITECH Act took effect.

Covered Entities generally have been required to comply with most requirements the Omnibus Final Rule’s restated regulations restating OCR’s regulations implementing the Health Insurance Portability & Accountability Act (HIPAA) Privacy, Security and Breach Notification Rules to reflect HIPAA amendments enacted by the HITECH Act since March 26, 2013 and to have updated business associate agreements in place since September 23, 2013.  Although these deadlines are long past, many Covered Entities and business associates have yet to complete the policy, process and training updates required to comply with the rule changes implemented in  the Omnibus Final Rule.

Even if a Covered Entity or business associate completed the updates required to comply with the Omnibus Final Rule, however, recent supplemental guidance published by OCR means that most organizations now have even more work to do on HIPAA compliance. This includes the following supplemental guidance on its interpretation and enforcement of HIPAA against Covered Entities and business associates published by OCR since January 1, 2014 alone:

Beyond this 2014 guidance, Covered Entities and their business associates also should look at enforcement actions and data as well as other guidance OCR issued during 2013 after publishing the Omnibus Final Rule such as:

With OCR stepping up both audits and enforcement and penalties for violations higher than ever since the HITECH Act amended HIPAA, Covered Entities and business associates should act quickly to review and update their policies, practices and training to implement any adjustments needed to maintain compliance and manage other risks under these ever-evolving HIPAA standards.

When conducting these efforts, Covered Entities and business associates not only carefully watch for and react promptly to new OCR guidance and enforcement actions, but also document their commitment and ongoing compliance and risk management activities to help support their ability to show their organization maintains the necessary “culture of compliance” commitment needed to mitigate risks in the event of a breach or other HIPAA violation and take well-documented, reasonable steps to encourage their business associates to do the same.    When carrying out these activities, most covered entities and business associates also will want to take steps to monitor potential responsibilities and exposures under other federal and state laws like the privacy and data security requirements that often apply to personal financial information, trade secrets or other sensitive data under applicable federal and state laws and judicial precedent.

For Help With Investigations, Policy Review & Updates Or Other Needs

If you need assistance in auditing or assessing, updating or defending your HIPAA, or other health or other employee benefit, labor and employment, compensation, privacy and data security, or other internal controls and practices, please contact the author of this update, attorney Cynthia Marcotte Stamer at cstamer@solutionslawyer.net or at (469)767-8872.

The Chair of the American Bar Association (ABA) RPTE Employee Benefits & Other Compensation Committee, a Council Representative on the ABA Joint Committee on Employee Benefits, Government Affairs Committee Legislative Chair for the Dallas Human Resources Management Association, and past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, Ms. Stamer works, publishes and speaks extensively on HIPAA and other privacy and data security, health plan, health care and other human resources and workforce, employee benefits, compensation, internal controls and related matters.

For more than 23 years, Ms. Stamer has counseled, represented and trained employers and other employee benefit plan sponsors, plan administrators and fiduciaries, insurers and financial services providers, third party administrators, human resources and employee benefit information technology vendors and others privacy and data security, fiduciary responsibility, plan design and administration and other compliance, risk management and operations matters.  She also is recognized for her publications, industry leadership, workshops and presentations on privacy and data security and other human resources, employee benefits and health care concerns.  Her many highly regarded publications on privacy and data security concerns include “Privacy Invasions of Medical Care-An Emerging Perspective.” ERISA Litigation Manual. BNA, 2003-2009; “Privacy & Securities Standards-A Brief Nutshell.” BNA Tax Management and Compliance Journal. February 4, 2005; “Cybercrime and Identity Theft: Health Information Security beyond HIPAA.” ABA Health eSource. May, 2005 and many others.  She also regularly conducts training on HIPAA and other privacy and data security compliance and other risk management matters for a broad range of organizations including the Association of State and Territorial Healthcare Organizations (ASTHO), the Los Angeles County Health Department, a multitude of health plans and their sponsors, health care providers, the American Bar Association, SHRM, the Society for Professional Benefits Administrators and many others.  Her insights on these and other matters appear in the Bureau of National Affairs, Spencer Publications, the Wall Street Journal, the Dallas Business Journal, the Houston Business Journal, and many other national and local publications. For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see www.CynthiaStamer.com or contact Ms. Stamer directly.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested reviewing some of our other Solutions Law Press resources available at http://www.solutionslawpress.com including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at www.SolutionsLawPress.com.

©2014 Cynthia Marcotte Stamer.  Non-exclusive right to republish granted to Solutions Law Press.  All other rights reserved.


Small Smiles Dental Centers Excluded As Federal Health Program Provider For 5 Years

April 4, 2014

Yesterday’s announcement of the exclusion of the operator and manager of the national dental chain, Small Smiles Dental Centers, from exclusion in Medicaid, Medicare and other federal health programs highlights the risks health care providers run by failing to comply with a Corporate Integrity Agreement.

Daniel R. Levinson, Inspector General of the U.S. Department of Health and Human Services, announced April 3, 2014 that the operator and manager of the Small Smiles Dental Centers, CSHM, LLC (formerly known as FORBA Holdings and Church Street Health Management (CSHM), has signed an Exclusion Agreement that bars CSHM from participating in Medicare, Medicaid, and all other Federal health care programs for 5 years. Small Smiles Dental Centers provides services primarily to children on Medicaid.

Mr. Levinson said that this exclusion “makes clear to the provider community that OIG closely monitors our CIAs, critically evaluates providers’ representations and certifications, and will pursue exclusion actions against providers that fail to abide by their integrity agreement obligations.”

According to the announcement, the exclusion is based on CSHM’s alleged material breaches of its Corporate Integrity Agreement (CIA) with the Office of Inspector General (OIG).

CSHM’s corporate predecessor entered into the CIA in 2010, as part of the resolution of a False Claims Act case involving allegations that the company had provided dental services to children on Medicaid that were medically unnecessary or failed to meet professionally recognized standards of care.

On March 7, 2014, OIG issued a Notice of Exclusion to CSHM based upon numerous material breaches of its obligations under the CIA. CSHM failed to report serious quality-of-care reportable events, take corrective action, or make appropriate notifications of those events to the State dental boards as required by the CIA, OIG found. CSHM also failed to implement and maintain key quality-related policies and procedures, comply with internal quality and compliance review requirements, properly maintain a log of compliance disclosures, and perform training as required by the CIA. Finally, CSHM submitted a false certification from its Compliance Officer regarding its compliance with CIA obligations.

This exclusion marks the culmination of a series of alleged failures by CSHM and its corporate predecessors to comply with its CIA. Under the CIA, an independent quality monitor conducted more than 90 site visits and reviews to monitor CSHM’s compliance. Since the 2010 settlement, OIG repeatedly cited CSHM and took actions to address those violations, promote improved compliance, and maintain access to care for an underserved population. These actions included imposing financial penalties and forcing the divestiture of one of the company’s clinics.

Despite these actions, CSHM remained in material breach of its CIA and OIG issued Notices of Intent to Exclude to the company in December 2013 and January 2014. In such cases, providers get the chance to show OIG that they have cured, or are in the process of curing, the material breaches. CSHM represented to OIG that it would cure the material breaches. However, through meetings with CSHM and its Board of Directors and review of its written submissions, OIG determined that CSHM had failed to cure the material breaches and proceeded with the exclusion.

CSHM disputed OIG’s determination that it was in material breach of the CIA. However, under the Exclusion Agreement, CSHM now has waived its objections to these findings.

To minimize immediate disruption of care to the hundreds of thousands of children treated at CSHM clinics and to enable an orderly, controlled shutdown of the company or divestiture of its assets, the exclusion takes effect September 30, 2014. CSHM waived its right to appeal this exclusion in any judicial forum.

Until the exclusion goes into effect on September 30, 2014, an independent monitor will continue to monitor the quality of care being provided to patients at CSHM clinics. CSHM is required to inform patients at least 30 days before closing a clinic. CSHM is also required to keep State Medicaid agencies abreast of developments and provide monthly status reports to OIG. Any divestiture of assets by CSHM must be through bona fide, arms-length transactions to an entity that is not related to or affiliated with CSHM.

Beyond the implications for Small Smiles Dental Centers, the announced exclusion carries important implications for other health care providers.  First, of course, the exclusion means that Small Smiles Dental Centers and CSHM as excluded providers are ineligible for hiring by other providers participating in Medicare or other Federal Health Programs.  Second, the exclusion also highlights the advisability for other providers covered by CIAs not only to see to comply with their CIA and in the event the OIG questions of the adequacy of that compliance to look for opportunities to work with OIG to rectify alleged concerns as cooperatively as possible unless a high degree of certainty that the provider can prove that OIG’s concerns are unfounded.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help.

Board Certified in Labor & Employment Law, Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 23 years experience advising health industry clients about these and other matters.

Throughout her career, Ms. Stamer has advised and represented health care providers and other health industry clients to establish and administer compliance and risk management policies and to respond to health care, human resources, tax, privacy, safety, antitrust, civil rights, and other laws as well as with internal investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns including a number of programs and publications on OCR Civil Rights rules and enforcement actions. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance with these or other compliance concerns, wish to ask about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

Other Resources

If you found this update of interest, you also may be interested in reviewing some of the other updates and publications authored by Ms. Stamer available including:

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources available at www.solutionslawpress.com.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2014 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press. All other rights reserved.


 


APDerm To Pay $150k To Settle 1st HIPAA Breach Rule Charges

December 27, 2013

A new settlement agreement announced by the Department of Health & Human Services (HHS) Office of Civil Rights (OCR) shows health plans, health care providers, health care clearinghouses and their business associates the perils of failing to properly implement the necessary policies and procedures to comply with the breach notification requirements added to the Health Insurance Portability & Accountability Act of 1996 (HIPAA) added by the Health Information Technology for Economic and Clinical Health (HITECH) Act, passed as part of American Recovery and Reinvestment Act of 2009 (ARRA).

APDerm Settlement Overview

Private dermatology practice, Adult & Pediatric Dermatology, P.C., (APDerm) has agreed to pay $150,000 and implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy,  Security, and Breach Notification Rules.  The APDerm Settlement  marks the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the HITECH Act.

According to its December 26, 2013 announcement of the settlement, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) opened an investigation of APDerm upon receiving a report that an unencrypted thumb drive containing the electronic protected health information (ePHI) of approximately 2,200 individuals was stolen from a vehicle of one its staff members. The thumb drive was never recovered.  The investigation revealed that APDerm had not conducted an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of ePHI as part of its security management process.  Further, APDerm did not fully comply with requirements of the Breach Notification Rule to have in place written policies and procedures and train workforce members.

Enforcement Actions Highlight Growing HIPAA Exposures For Covered Entities

The APDerm settlement provides more evidence of the growing exposures that health care providers, health plans, health care clearinghouses and their business associates need to carefully and appropriately manage their HIPAA responsibilities. See HIPAA Heats Up: HITECH Act Changes Take Effect & OCR Begins Posting Names, Other Details Of Unsecured PHI Breach Reports On WebsiteIt joins the  growing list of settlement or resolution agreements under HIPAA announced by OCR.

The APDerm also is notable both as it settles the first ever charges against a covered entity for failing to adopt required Breach Notification policies and procedures and the relatively most settlement payment required in comparison to other announced settlement.  Other settlements have been significantly higher.  For instance,  OCR required that Blue Cross Blue Shield of Tennessee (BCBST) to pay $1.5 million to resolve HIPAA violations charges.

In response to these expanding exposures, all covered entities and their business associates should review critically and carefully the adequacy of their current HIPAA Privacy and Security compliance policies, monitoring, training, breach notification and other practices taking into consideration OCR’s audit,  investigation and enforcement actions, emerging litigation and other enforcement data, their own and reports of other security and privacy breaches and near misses, evolving rules and technology, and other developments to determine if additional steps are necessary or advisable. For tips, see here.

For Representation, Training & Other Resources

If you need assistance monitoring HIPAA and other health and health plan related regulatory policy or enforcement developments, or to review or respond to these or other health care or health IT related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer may be able to help.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help.

Board Certified in Labor & Employment Law, Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 23 years experience advising health industry clients about these and other matters.

Throughout her career, Ms. Stamer has advised and represented health care providers and other health industry clients to establish and administer compliance and risk management policies and to respond to health care, human resources, tax, privacy, safety, antitrust, civil rights, and other laws as well as with internal investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns including a number of programs and publications on OCR Civil Rights rules and enforcement actions. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

Other Resources

If you found this update of interest, you also may be interested in reviewing some of the other updates and publications authored by Ms. Stamer available including:

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources available at www.solutionslawpress.com.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2011 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press. All other rights reserved.


[1] WHD’s announcement of the planned rule notes that this draft shared December 15 remains subject to change before formally published in the Federal Register


Reminder To Follow Confidentiality, Due Process When Conducting Peer Revew & Credentialing

December 16, 2013

Hospitals, physicians, health plans and others participating in credentialing and peer review activities need to use care to ensure that they and others involved in these matters understand and comply with the confidentiality requirements of the Health Care Quality Improvement Act and similar state laws.

Hospitals and their medical staffs, physician and other practice groups and other health care organizations commonly require or query the National Practitioner Data Bank (NPDB) established under HCQIA and other sensitive professional and personal when checking the backgrounds and credentials of physicians seeking admission to the medical staff, employment, staff privileges, participation in provider panels or other positions.  These health care organizations and providers also frequently may receive inquiries from other health care providers or organizations seeking information about a provider who is applying for admission, employment or other status.  Finally, medical staffs, practices and other health care organizations from time to time may conduct credentialing, peer review or other disciplinary activities, or quality assurance reviews that may involve the discussion of information about the conduct, quality, discipline or other credentials and qualifications of current or former physicians at their own or another health care organization.

The investigation or discipline of a physician and certain other information regarding potential performance or credentialing concerns about a physician or other health care worker often by necessity involves the receipt, sharing, or use of sensitive professional or personal information with credentialing, management, medical staff leadership or others involved in the investigation, review or process.  When participating in any of these activities, all parties involved in the activities or providing input or participation in their conduct need to understand and be required to comply fully with all applicable confidentiality and privacy requirements.   While participants in these processes often may feel great temptation to circumvent formal processes in the name of expediency, to share sensitive insight with special relationships or other inducements to cut corners on confidentiality, the participants in these activities and the organizations conducting the activities should take all necessary steps to ensure that the participants carefully comply with the confidentiality and privacy requirements and only obtain and share information as allowed by and in accordance with the procedures established by these rules.

The background check rules of the Fair Credit Reporting Act (FCRA) generally require that health care organizations, as well as other businesses, conducting background check or other investigations using third party data or investigators comply with the notice, consent and disclosures of the FCRA.  Parties requesting or providing information as part of a credentialing, peer review or other investigation should ensure that the necessary disclosures, notices and consents have been obtained before requesting or sharing information.  The fulfillment of these requirements should not be assumed as experience demonstrates that these requirements are commonly overlooked by many health care and other organizations engaged in these activities.

In addition to meeting the FCRA, HCQIA, most state peer review, and medical staff bylaws generally require that credentialing, peer review, quality assurance, and other performance and discipline activities be conducted in accordance with carefully prescribed rules, including specific requirements concerning the protection of the confidentiality of information about a provider.  While relatively rare, violation of HCQIA’s confidentiality rules can create significant liability.  For instance, after it self-disclosed conduct to the Department of Health & Human Services Office of Inspector General (OIG), The Queen’s Medical Center (QMC), Hawaii, agreed to pay $150,500 in civil money penalties for allegedly violating the NPDB in 2009.

Beyond the rare sanctions under HCQIA, failing to following the rules of HCQIA and state laws can undermine the defensibility of peer review and credentialing decisions by undermining the ability of participants in the process to rely upon the peer review privilege to protect deliberations and discussions conducted in connection with the peer review and credentialing process from discovery, as well as by providing evidence of bad faith, malice or other bad motivation or acts corrupted the process and determination.  Beyond hurting the defensibility of the credentialing and peer review process, violations of confidentiality or other procedures often also give rise to antitrust, defamation, invasion of privacy, tortious interferences, and other damage claims by physicians who feel their ability to practice and reputations have been injured by alleged improper conduct in connection with a peer review, credentialing or quality assurance process.

Beyond avoiding giving rise to claims by the targeted physician or other health care provider, all participants in these processes also need to use care to properly protect any individually identifiable patient information.  Records and information about a patient, his medical condition, payment history and other related patient data and information often involved in these activities typically qualifies as personal health information, the use, access, and disclosure of which is restricted by the Privacy Rules of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and state common law, HIPAA and other medical records privacy and confidentiality laws.  In addition to the specific requirements of HIPAA and other medical information privacy laws, patient financial information and certain other sensitive information also may be protected by a broad range of federal and state laws protecting personal financial and other sensitive personal information, contractual rights created by privacy policies of the organizations involved or other laws.

Conducting proper credentialing, peer review and quality assurance activities is a critical aspect of the hiring and oversight of physicians and others providing care.  As important as these requirements are, health care providers and organizations participating in these activities need to remember that the physicians who are subjected to these requirements also enjoy confidentiality, due process and other legal protections, which can create significant liability when violated.  Consequently, health care organizations, physicians and members of management, and other staff and participants should use care to follow the proper procedures to ensure that physician rights to confidentiality, due process and other protections are honored as these activities are conducted.

Using care when discussing these concerns is equally important for a physician or other health care provider who is the subject of an investigation, credentialing, peer review, quality assurance or other activity.  While a physician whose personal or professional conduct or credentials are questioned understandably feels a strong urge to defend him or herself through a campaign of communication or other actions, physicians on the receiving end also need to follow the process and restrict their discussions.

Cynthia Marcotte Stamer, for additional information or representation.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help.

Board Certified in Labor & Employment Law, Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 23 years experience advising health industry clients about these and other matters.

Throughout her career, Ms. Stamer has advised and represented health care providers and other health industry clients to establish and administer compliance and risk management policies and to respond to health care, human resources, tax, privacy, safety, antitrust, civil rights, and other laws as well as with internal investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns including a number of programs and publications on OCR Civil Rights rules and enforcement actions. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

Other Resources

If you found this update of interest, you also may be interested in reviewing some of the other updates and publications authored by Ms. Stamer available including:

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources available at www.solutionslawpress.com.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2011 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press. All other rights reserved.


[1] WHD’s announcement of the planned rule notes that this draft shared December 15 remains subject to change before formally published in the Federal Register


CMS Gives Providers Facing Fee Schedule Reduction For Unsuccessful EPrescribing Can Request Review Until 2/28

December 16, 2013

Physicians and other eligible professionals and group practices (who self-nominated for the 2012 and/or 2013 Electronic Prescribing (eRx) group practice reporting option) who were unsuccessful electronic prescribers under the 2012 or 2013 eRx Incentive Program can expect to receive notification from the Centers for Medicare & Medicaid Services (CMS) plans that CMS will have their 2014 eRx payment adjusted to 98.0% of his or her otherwise applicable Medicare Part B physician fee schedule (PFS) allowed charges amount for the specified services for all charges with dates of service from January 1–December 31, 2014.

Providers receiving these notices may wish to request a review of this planned adjustment under an informal review process for the 2014 eRx payment adjustment implemented by CMS. An informal review may be requested if the eligible professional or group practice receives notification from CMS confirming they will be subject to the 2014 eRx payment adjustment or they did not meet the requirements to avoid the 2014 eRx payment adjustment. CMS will accept nformal review requests  through February 28, 2014.

Eligible professionals and group practices should submit their eRx informal review request via email to the informal review mailbox at eRxInformalReview@cms.hhs.gov.

Complete instructions on how to request an informal review are available in the 2014 eRx Payment Adjustment Informal Review Made Simple educational document.

Physicians or other health care providers who have questions about these or other e-prescribing or reimbursement concerns may contact the author of this update, Cynthia Marcotte Stamer, for additional information or representation.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help.

Board Certified in Labor & Employment Law, Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 23 years experience advising health industry clients about these and other matters.

Throughout her career, Ms. Stamer has advised and represented health care providers and other health industry clients to establish and administer compliance and risk management policies and to respond to health care, human resources, tax, privacy, safety, antitrust, civil rights, and other laws as well as with internal investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns including a number of programs and publications on OCR Civil Rights rules and enforcement actions. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

Other Resources

If you found this update of interest, you also may be interested in reviewing some of the other updates and publications authored by Ms. Stamer available including:

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources available at www.solutionslawpress.com.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2011 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press. All other rights reserved.


[1] WHD’s announcement of the planned rule notes that this draft shared December 15 remains subject to change before formally published in the Federal Register


Update Mileage Reimbursement Policies, Communications For IRS 2014 Mileage Rates

December 10, 2013

Health care organizations should review the updated optional standard mileage rates and maximum standard automobile costs for purposes of claiming certain automobile allowances during 2014 recently released by the Internal Revenue Service (IRS) to determine and make the necessary arrangements to communicate and implement any changes in the rates that their business plans to use to reimburse employees and others for mileage.  In addition, health care organizations also may want to consider sharing information about the updates to medical expense mileage reimbursement rates and other aspects of those rules in newsletters or other marketing communications to help empower those patients and their families to understand and use the new rates and rules to properly claim deductions that their families qualify for on their 2014 tax return for mileage incurred traveling for medical care.

Notice 2013-80, which is scheduled for official publication in Internal Revenue Bulletin 2013-52 on December 23, 2013, provides the optional 2014 standard mileage rates for taxpayers to use in computing the deductible costs of operating an automobile for business, charitable, medical or moving expense purposes.  This notice also provides the amount taxpayers must use in calculating reductions to basis for depreciation taken under the business standard mileage rate, and the maximum standard automobile cost that may be used in computing the allowance under a fixed and variable rate (FAVR) plan.   The IRS released an advanced copy of the Notice on December 6, 2013.

Many health care organizations reimburse doctors, management, home health, sales and marketing or other employees and other service providers for mileage and other automobile expenses under policies that use these IRS standard rates to calculate the reimbursement amounts.  Reimbursement of employees based on these rate is not required.  Because reimbursements in excess of the standard rates can create income tax recordkeeping and reporting challenges for the employer, the employee or both, however, most businesses use standard mileage reimbursement rates set at or below the IRS optional standard rates.  Businesses facing financial or other challenges may want to reevaluate whether to continue to reimburse mileage and if so, the rate of reimbursement to use to do so.

When communicating with employees about the businesses’ policies for reimbursing business and moving expense mileage, businesses should take care to ensure that employees understand differences in the mileage reimbursement rates that apply to different categories of expenses.  As an added service to employees, many human resources departments also may want to consider alerting employees to consult their tax advisor or take other steps to properly understand and retain documentation of mileage not only for business expense reimbursement, but also medical and moving purposes.  The availability of this information can be helpful to empower workers and their families to understand and take proper advantage of rules for deducting these expenses even when the employer or its health plan does not reimburse the employee for the expenses.

In addition to reimbursements for workers, businesses also should consider the potential effects of the adjustments in the IRS optional standard mileage rates on the amounts they may bill their customers for mileage expenses as well as the amount that they should expect that their vendors and service providers may bill the business for mileage expenses under contracts that provide for reimbursement of those expenses. Businesses whose contracts with vendors or customers provide for reimbursement of mileage expenses using rates based on the IRS’ optional standard mileage rates should evaluate the effect of the announced adjustments on those mileage obligations to ensure that mileage expenses are properly anticipated, billed and paid.

Beyond dealing with their own policies for reimbursement and billing for mileage, many health care organizations may want to consider sharing information about the 2014 medical mileage reimbursement rates announced by the IRS with patients and their families.  Many patients and their families may qualify to claim deductions for mileage for medical travel under IRS rules, but may not be aware of the adjusted rates or the proper procedures for identifying and documenting their medical mileage.  While often negligible for families who are not suffering major illness requiring extensive commuting or travel, patients with chronic or serious medical conditions often can benefit from claiming these deductions properly.   Communicating the new rates and other tips for keeping records and claiming the mileage deduction could be a significant and valued service to aid these families.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help.

Board Certified in Labor & Employment Law, Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 23 years experience advising health industry clients about these and other matters.

Throughout her career, Ms. Stamer has advised and represented health care providers and other health industry clients to establish and administer compliance and risk management policies and to respond to health care, human resources, tax, privacy, safety, antitrust, civil rights, and other laws as well as with internal investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns including a number of programs and publications on OCR Civil Rights rules and enforcement actions. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

Other Resources

If you found this update of interest, you also may be interested in reviewing some of the other updates and publications authored by Ms. Stamer available including:

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources available at www.solutionslawpress.com.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2011 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press. All other rights reserved.


[1] WHD’s announcement of the planned rule notes that this draft shared December 15 remains subject to change before formally published in the Federal Register


Follow

Get every new post delivered to your Inbox.

Join 639 other followers

%d bloggers like this: