Daniel M. Lindenberg

On June 13, 2013, HHS' Office of Inspector General(OIG) published 

, which further confirms the department’s longstanding antipathy towards carving out referrals of federal healthcare beneficiaries or business generated from otherwise questionable financial arrangements.

In Opinion No. 13-03, a "Parent Laboratory" proposed to establish and own a management company, which would enter into contracts with physician practices in order to allow the physicians to effectively own and operate their own clinical laboratories. The management company would provide the physicians with facility space, lab management, and support, and would lease them personnel, equipment, and licenses for use of the Parent Laboratory’s proprietary methods of operation. The Parent Laboratory certified that the physicians would agree to only use these clinical laboratories for patients who are not beneficiaries of federal healthcare programs; patients who are federal healthcare program beneficiaries may be sent to any laboratory.

The OIG found that the Parent Laboratory would offer the physicians prohibited remuneration in the form of an opportunity to expand into a financially profitable lab business. Although the physicians would bill only for non-federal healthcare program services, OIG acknowledged that referrals covered by a federal healthcare program might occur for several reasons: physicians would make referrals to the Parent Laboratory for convenience, to further demonstrate a commitment to the Parent Laboratory, or to potentially secure more favorable pricing on private-pay services. Additionally, the physicians may not make a distinction between the Parent Laboratory and the laboratories operated with support from the management company owned by the Parent Laboratory. OIG concluded that this arrangement insufficiently minimized the risk of federal healthcare program fraud and abuse and that it could potentially impose administrative sanctions in connection with its enforcement of the Anti-Kickback Statute, if requisite intent was found to exist.

The Anti-Kickback Statute protects against the exchange of remuneration for the inducement or reward of referrals reimbursable by a federal healthcare program. Carve-out arrangements implicate, and may violate, the Anti-Kickback Statute by disguising remuneration for federal healthcare program business through payments purportedly related to non-federal healthcare program business.

, OIG similarly held that the arrangement insufficiently minimized the risk of federal healthcare program fraud and abuse. In No. 12-06, Arrangement B, the physicians similarly had elements of a suspect contractual joint venture - the physicians had an opportunity to expand into another profitable business with little or no risk. Specifically, the physicians formed a subsidiary company that contracted out all operations exclusively to an established anesthesia provider. The physicians’ business risk was minimal because the anesthesia service referrals were wholly dependent on the physician’s ASC’s referrals; they controlled the amount of business they referred to the subsidiary. The physicians also did not participate in the operation of its anesthesia subsidiary, but shared in the economic benefit of the new business of the ASC (the anesthesia provider receiving the negotiated rate and the physician-owners received residual profits equal to the amount the subsidiaries collected from Medicare and other third-party payers and patients for anesthesia services minus the amount the subsidiaries paid the anesthesia provider).

Although OIG has noted its displeasure with arrangements failing to minimize the risk of federal healthcare program fraud and abuse, some carve-out arrangements have passed OIG muster.

, a consulting organization entered into an agreement with hospitals to audit hospital bills for undercharges and overcharges to private insurer paying on a charge basis, but with no auditing of any bills reimbursed by federal healthcare programs either as primary payers or secondary payers. Although this arrangement carved-out non-federal healthcare beneficiaries, it posed a limited risk of fraud and abuse because it was a one-time, wholly retrospective billing audit and the items or services were previously ordered, provided, and claimed prior to the audit.

, a university's hemophilia center entered into a contract with a pharmacy company to dispense anti-hemophilia factor and other outpatient drugs and to provide outpatient pharmacy services for the university. The arrangement excluded Medicaid fee-for-service patients from receiving drugs through the university’s outpatient drug program. OIG recognized that parallel arrangements that bifurcate services between federal and private pay business may create a risk that the parties will swap discounted private pay business for referrals of higher paying federal business. However, OIG concluded that the arrangement contained several safeguards to minimize the risk of swapping: the company would not control the price charged for drugs for non-Medicaid patients nor file claims for such drugs, there was no inference that the company paid for referrals as there was no remuneration between the companies through the provision of free or below-market services, and the exclusion of the Medicaid patients was consistent with the section 340B bar on duplicate discounting and the Medicaid prohibition against reassignment.

Although some arrangements overcome OIG scrutiny, physicians should heed OIG warnings.

Often in practice, arrangements that attempt to exclude federal program business are improperly affected by a tainted referral arrangement despite the carve-out.

The information contained within this blog posting on this website, is made available by the attorney authoring the posting for educational purposes only, and to give you general information and a general understanding of the law. It is not intended to provide specific legal advice to your individual circumstances or legal questions. By using this blog site you understand that your reading of this blog posting does not establish an attorney-client relationship between you and the authoring attorney or his law firm.  This blog posting should not be used as a substitute for competent legal advice from a licensed professional attorney in your state. Readers of this information should not act upon any information contained in this blog posting on this website without seeking professional counsel.

Articles

HHS' Office of Inspector General reiterates antipathy towards some physician arrangements that carve out federal referrals.

Physicians Cautioned to Scrutinize Their Carve-Out Arrangements

Office of Inspector General (OIG) fraud alert

 published last month by the OIG, OIG stated that physician-owned distributorships (“PODs”) have the “strong potential for improper inducements between and among the physician investors, the entities, device vendors and device purchasers.” A POD includes any physician-owned entities deriving revenue from selling, or arranging for the sale of, implantable medical devices ordered by the physician owner for use in procedures that the physician-owner performs on its own patients at hospitals or ASCs.

The Anti-Kickback Statute ascribes criminal liability to anyone (on both sides of the arrangement) who knowingly and willfully offers, pays, solicits or receives any remuneration to induce, or in return for, referrals or items or services reimburseable by a federal health care program. One purpose of the statute is to protect patients from inappropriate medical referrals or recommendations by health care professionals who may be unduly influenced by financial incentives. The OIG makes clear that a referring physician earning profit even through investment in an entity for which he or she generates business, could be illegal remuneration under the statute.

OIG is particularly concerned about POD investment arrangements that generate disproportionately high profits for physician-owners because the investment risk associated with PODs is often minimal. Therefore, OIG scrutinizes the selection of investors in a position to generate substantial business for the entity, in the entities requiring investors that cease participating in the service area to divest their ownership interests, and in those investors receiving “extraordinary” returns on investments compared to the level of risk involved.  OIG concerns are also heightened when physician-owners: 1.) are few in number, such that the volume or value of a particular physician’s recommendations or referrals closely correlates to that physician’s return on investment; or 2.) alter their medical practice after or shortly before investing in the POD (i.e., they perform more surgeries, or more extensive surgeries, or switch to using their PODs’ devices on an exclusive, or nearly exclusive basis).

OIG also fears that PODs breed corruption of medical judgment, overutilization, increased costs to Federal health care programs and beneficiaries, and unfair competition. Both the choice of brand and type of device are often made and strongly influenced by the physician, rather than controlled by the hospital or ASC where the procedure is performed. Therefore, OIG believes that physician-owners use the implantable devices of their PODs in lieu of other, more clinically appropriate devices or perform more procedures (or more extensive procedures) than are medically necessary.

Even in an age of transparency furthered by the Affordable Care Act, however, OIG does not believe that disclosure to a patient of the physician’s financial interest in a POD is sufficient to address these concerns. Nor will a physician-owner’s claim that their POD’s devices are superior in design or manufacturing disprove unlawful intent.

Because PODs may be lawful under the Anti-Kickback Statute, OIG scrutinizes the intent of the parties. However, the following characteristics are some examples that raise red flags for OIG:

• Size of investment offered to each physician varies with the volume or value (expected or actual) of devices used by the physician.

• Distributions are not proportional to ownership interest.

• Physician-owners pay different prices for ownership interests, because of the volume or value (expected or actual) of devices used by the physicians.

• Referrals to hospitals or ASCs are conditioned on the purchase of the physician’s POD devices through coercion or promises (i.e., physician states that or implies they will perform surgeries or refer patients elsewhere if a hospital or an ASC does not purchase devices from the POD; promises or implies they will move surgeries to the hospital or ASC if it purchases devices from the POD; or by requiring a hospital or ASC to enter into an exclusive purchase arrangement with the POD).

• Physician-owners are required, pressured, or actively encouraged to refer, recommend, or arrange for the purchase of the devices sold by the POD .

• Physician-owners are threatened with, or experience, negative repercussions (decreased distributions or required divestiture) for failing to use the POD devices for their patients.

• POD retains the right to repurchase a physician-owner’s interest for the physician’s failure or inability (through relocation, retirement, or otherwise) to refer, recommend, or arrange for the purchase of the POD’s devices.

• POD is a shell entity that does not conduct appropriate product evaluations, maintain or manage sufficient inventory in its own facility, or employ or otherwise contract with personnel necessary for operations.

• POD does not maintain continuous oversight of all distribution functions.

• When a hospital or an ASC requires physicians to disclose conflicts of interest, the POD’s physician-owners either fail to inform the hospital or ASC of, or actively conceal through misrepresentations, their ownership interest in the POD.

The Anti-Kickback Statute is not a prohibition on the generation of profits and OIG does not wish to discourage innovation. However, OIG is particularly concerned with a physician’s intentional and illegitimate investment interests in PODs and thus, physicians should carefully consider their ownership arrangements with such entities.

The OIG deems PODs to be inherently suspect under the Anti-Kickback Statute, so physicians should take note.

Physician-Owned Distributorships Raise Heightened Concern by OIG

In mid-January, HHS' Office of Civil Rights (OCR) issued the final rule modifying HIPAA. The modification significantly expanded and revised the existing HIPAA privacy, security, enforcement, and breach notification rules. Under the new rule, de-identification remains in full effect; once individually identifiable health information or protected health information (PHI) is “de-identified” it is no longer PHI subject to HIPAA.

HHS recently issued separate guidance that finally evaluates when PHI is properly de-identified. 

As previously discussed, there are two methods:

 the safe harbor method of removing 18 specific identifiers and the expert method.

In the expert method, HHS allows the use of an expert to conduct an identification risk assessment to determine that the risk of identifying the individual who is the subject of the information either alone or in combination with other reasonably available information is very small.

When evaluating identification risk, an expert is advised to consider the degree to which the data can be linked to a data source that reveals the individual’s identity. The strength of “linkage” hinges on whether the data is distinguishing or unique, there is a naming data source, and a mechanism to relate the de-identified and identified data sources. Inability to design a relational mechanism would prevent a third party’s ability to “achieve success to no better than random assignment of de-identified data and named individuals. The lack of a readily available naming data source does not mean the data is sufficiently protected from future identification, but it is difficult to re-identify an individual or a group of individuals, given the data sources at hand,” according to HHS.

The route by which health information can be linked to naming sources or where sensitive knowledge can be inferred is an important aspect of an identification risk assessment. A higher risk feature is one that is found in many places and is publicly available. For instance, patient demographics are a higher risk feature in that such data can be exploited by anyone in receipt of the information, whereas clinical features, such as blood pressure or temporal dependencies, are lower risk features in that they may distinguish a patient in a specific population, but are accessible to a much smaller set of people.

The de-identification standard does not require the expert to follow or assess risk according to a specific method. The qualified expert may apply generally accepted statistical or scientific principles to compute the uniqueness of a data set. Data managers and administrators working with the expert can look to the following principles when considering the identification risk of health information. These principles are considered a starting point for the covered entity’s reasoning and not a definitive list.

Additionally, if an expert determines that the risk of identification is greater than very small, the HHS guidance provides that experts may modify the information to mitigate the identification risk to that level, as required by the de-identification standard. The expert may initiate suppression techniques and eliminate or remove certain features about the data prior to dissemination. The expert could abbreviate or generalize the information, such as generalizing the age of a patient from one-year to five-year age groups. The expert may apply perturbation techniques to maintain the data’s original statistical properties, but replace specific values with equally specific, but different, values. For instance, instead of age 21, identify an age of 20 years +/- 2 years.

Health providers and business associates (as well as their subcontractors) wishing to limit information in their possession subject to HIPAA, thus mitigating the risk of a HIPAA Privacy/Security Rule violation or breach, should review their de-identification procedures in light of the HHS de-identification guidance.

It's a good time for medical practices to review their de-identification methods to avoid a potential HIPAA violation under recently released rules.

HIPAA’s De-Identification Guidance and Role of Expert Evaluations

The Office for Civil Rights (OCR) recently issued important guidance regarding the HIPAA concept known as “de-identification.” This guidance applies to covered entities, which include physicians and business associates (a person or entity, other than a member of the covered entity’s workforce), that perform certain services on behalf of the covered entity involving "protected health information" or PHI.

HIPAA’s Privacy Rule helps guard against the use or disclosure of an individual’s identifying health information or PHI by permitting its use in only certain instances, such as for treatment, payment, healthcare operations, or as authorized by the patient.(1) PHI is information, including demographic information, which relates to the individual’s provision of healthcare, their physical or mental medical condition (past, present, or future), and any payment for that care that identifies or can be used to identify the individual. De-identification mitigates privacy risks by removing health data that individually identifies the individual and with respect to which there is no reasonable basis to believe that the information can be used to identify the individual. However, the privacy rule permits a physician or its business associate to create information for secondary use in comparative studies, policy assessments, and life science research that is not individually identifiable by following its de-identification standards.

De-identification occurs either by: (1) meeting the safe harbor in removing 18 identifiers and verifying there is no actual knowledge that the residual information can identify the individual; or (2) an expert has documented its statistical or scientific analysis determining that there is a 

 of an anticipated recipient using such health information with other reasonably available information to identify an individual who is a subject of the information.

The following 18 identifiers of the individual or of relatives, employers, or household members of the individual, are to be removed to comply:


The assessment of whether or not there is a “very small” risk that an anticipated recipient could identify an individual must be determined by an expert who may have a statistical, mathematical, or scientific background. OCR does not require that an expert have a specific professional degree or certification when rendering health information de-identified. However, OCR will evaluate the expert’s determination of acceptable “very small” risk based on his/her education and actual experience using health information de-identification methodologies.

There is also no universal level for the “very small” risk threshold. Risk will be determined on a case-by-case because its assessment is dependent on many factors (such as, replicability, availability of the data source, distinguishability, and social environment). Risk identified for one particular data set in the context of a specific environment may not be appropriate for the same data set in a different environment or a different data set in the same environment. As a result, an expert needs to define an acceptable very small risk based on its assessment of the ability of an anticipated recipient to identify an individual.

Although no single universal solution or process addresses all privacy and identification issues, experts are expected to document the methods and results of their analyses that justify their determination. Such steps may include: (i) the extent to which health information can (or cannot) be identified by the anticipated recipients; (ii) guidance on which statistical or scientific methods can be applied to the health information to mitigate anticipated risk; (iii) the execution of such methods; and (iv) their evaluation of the ability to identify the resulting health information confirming that the risk is no more than very small when disclosed to the anticipated recipients. It is understood that this process may require several iterations.

Additionally, HIPAA does not explicitly require an expiration date be attached to the expert’s determination. In light of the evolution of technology, social conditions and availability of information, however, time-limited certifications may be considered reasonable. Covered entities should have an expert examine whether future releases of the data to the same recipient (e.g., monthly reporting) be subject to additional or different de-identification processes consistent with current conditions to reach the very low risk requirement.

In the next part of this post, I will discuss the examples and principles used in satisfying the safe harbor and methods used by experts to determine information is de-identified.

2 See 67 FR 53182, 53233-53234 (Aug. 14, 2002)

Here's guidance on how to avoid violating HIPAA when it comes to de-identification of protected health information.

New HIPAA Guidance on De-Identifying Protected Health Information

Specialists’ unrestricted call coverage arrangements with non-profit hospitals (which may include, among others, cardiology, gastroenterology, hematology/oncology, nephrology, surgery, otolaryngology, ophthalmology, orthopedics, pediatrics, plastic surgery, pulmonology, urology, and vascular surgery) may be paid per diem under certain instances.

Hospitals have on-call coverage arrangements with all medical specialties to provide necessary treatment as well as stabilization of an emergent medical condition (EMTALA) as a condition of participation in Medicare. Following an advisory opinion published October 30, 2012, by the Department of Health and Human Services’ Office of the Inspector General (OIG), specialists with staff privileges may be compensated per diem in exchange for unrestricted call coverage at a hospital ED provided that their arrangement for professional services has safeguards that adequately protect against a violation of the federal Anti-kickback Statute.

The Anti-kickback Statute ascribes criminal liability to both sides of an impermissible “kickback” transaction where either party knowingly and willfully offers, pays, solicits, or receives anything of value to induce or reward referrals of items or services reimbursable by a federal healthcare program. OIG opines that the Anti-kickback Statute’s safe harbor for personal services and management contracts protects specialists’ unrestricted call coverage arrangements with hospitals as long as the agreement satisfies all conditions of the safe harbor (and any applicable Stark law requirements) and incorporates additional safeguards against fraud and abuse.

The OIG’s concerns were that such a scheme: (i) creates considerable risk that physicians may demand compensation as a condition of doing business at a hospital; (ii) could be misused to entice physicians to join or maintain staff privileges to generate additional business for the hospital; and (iii) could covertly engender kickbacks if payment is in excess of fair market value, payment is for no identifiable services, or the aggregate on-call payments are disproportionately high.

However, in its advisory opinion, OIG highlighted several safeguards that could further protect a per diem fee arrangement:

1. The independent valuation determines per diem payment amounts as commercially reasonable, within a range of fair market values for actual and necessary services provided without regard to referrals or business generated among the parties;

2. The funds allocated for each participating specialty are calculated in advance and uniformly for all such physicians without regard to business generated for the hospital;

3. The specialists provide actual and necessary services in an arrangement that does not intend to compensate for all care provided to ED patients, whether it be for a quick in-person response, follow-up care, or furnishing services for in-patient care through to the patient’s discharge; and

4. The hospital appears to have an equitable policy that offers payment scheme uniformly to all physicians within each specialty, does not selectively reward the highest referrers and the method of scheduling on-call coverage is governed by its bylaws.

Although only the parties requesting an OIG advisory opinion can rely on it, this opinion helps expand possible compensation opportunities for physicians.

If you have an arrangement with a hospital for on-call coverage that is paid per diem, take a close look at the agreement so you don't violate federal law. 

Specialists’ Call Coverage and Per Diem Compensation

In a False Claims Act (FCA) settlement, the HHS Office of the Inspector General (OIG) may enter into a corporate integrity agreement (CIA) with a settling provider in exchange for the OIG’s agreement that it will not seek to exclude the physician or the practice from participation in Medicare, Medicaid, or other federal healthcare programs. The FCA is a title for a series of statutes that prohibit fraudulent activity against the government and prescribe the processes and the consequences for those found to have violated the prohibition.

A CIA typically imposes a number of requirements on participants including: (1) a compliance officer; (2) developing and implementing policies and procedures; (3) retaining an Independent Review Organization (IRO); (4) internal audit and review processes; (5) developing and implementing a code of conduct; and (6) developing and implementing training. Regardless of industry changes and company standards, the practice must strictly follow CIA terms for the entire period, typically three years to seven years.

In August 2012, OIG met with 32 CIA participants (called “Roundtable Participants”), including physician practices, to discuss these restrictive requirements. As a guide to all providers, OIG published a paper on October 9, 2012, to summarize the meeting and note additional points for negotiating a future CIA. Some of those suggestions are discussed below.

 monitors daily activities. As a member of senior management, he reports directly to the governing board. Because he is appointed to ensure the practice avoids further fraud and abuse, he should not be subordinate to a practice’s executives, such as their general counsel or chief financial officer.

The compliance officer develops and implements the practice’s compliance 

which cover the code of conduct, hotline procedures for employees wanting to raise an anonymous concern, restrictions against contracting with excluded persons or entities and operations of the compliance program. When negotiating the CIA, he should also allocate resources to investigate and resolve the practice’s compliance issues.

 to help evaluate and analyze coding, billing, and claim submissions and reimbursements. The IRO should conduct a discovery sample of paid Medicare claims (i.e., 50 claims) randomly selected from a 12-month period. If the net financial error rate for the discovery sample is 5 percent or greater, conduct a full sample and systems review to identify the underlying causes of the claims errors.

Practices should regularly audit claims, coding and billing reports internally and have results verified by the IRO to identify issues more quickly and keep down the costs of external review. Roundtable Participants also suggested increasing the sample size and focusing claims review on particular types of claims.

 maintains quality of care. The process internally examines whether policies and procedures are followed, staff are trained and CIA terms are met. When conducting an internal audit, the practice should conduct quarterly billing audits using external entities, internal reviews of contracts, certification reviews, and as-needed audits when problems arise.

Roundtable Participants found it helpful to rely on the OIG Work Plan - an annual report outlining initiatives that OIG will investigate over the year - and to investigate issues raised in hotline calls. They also found internal audits more valuable than IRO results - in part because issues reviewed in internal audits are set by the practice, using identified and changing risk areas.

 reflects a practice’s commitment to comply with federal healthcare program requirements, outlines employee obligations to report concerns with noncompliance to the compliance officer as well as anonymously and without fear of retaliation.

The CIA should be tailored and limited to those employees and contractors involved in the type of conduct that led to the CIA. OIG relies on a one-size-fits-all model. Therefore, an in-depth discussion of the policies and procedures specific to the practice during negotiations would make implementation easier. Roundtable Participants found it more efficient to also make revisions and obtain certifications during annual general trainings instead of distributing the conduct code and obtaining certifications each time revisions are made.

 on agreement requirements, the compliance program and on issues that led to the agreement is provided generally to all signatories of the CIA (employees and management). Vendors and contractors are trained on specific aspects of the CIA related to their direct patient activities at the practice.

It is difficult to annually create modules relevant to all employees. Therefore, to better inform employees and contractors the practice should identify its own annual training topics and annually target separate employee groups. . Scenarios should be drawn from complaints or audit results to make training more real and to facilitate discussions of subtler topics with employees. Focus should be less on providing a minimum number of hours of annual training and more on thoroughly addressing CIA topics. Roundtable Participants also suggested that additional training be provided for employees that fail to pass an annual competency test.

CIAs are particularly rigorous if management lacks understanding about the internal operations of the practice. However, installing a self-imposed compliance program reduce instances of FCA investigation. A practice should educate staff on compliance policies and procedures, internally evaluate coding, claim submissions and reimbursement, and screen and monitor employees to proactively identify and fix potential problems.

As part of a False Claims Act settlement, medical practices may enter into a corporate integrity agreement. Here's your guide to what that may entail.