Daniel M. Lindenberg

On June 13, 2013, HHS' Office of Inspector General(OIG) published 

, which further confirms the department’s longstanding antipathy towards carving out referrals of federal healthcare beneficiaries or business generated from otherwise questionable financial arrangements.

In Opinion No. 13-03, a "Parent Laboratory" proposed to establish and own a management company, which would enter into contracts with physician practices in order to allow the physicians to effectively own and operate their own clinical laboratories. The management company would provide the physicians with facility space, lab management, and support, and would lease them personnel, equipment, and licenses for use of the Parent Laboratory’s proprietary methods of operation. The Parent Laboratory certified that the physicians would agree to only use these clinical laboratories for patients who are not beneficiaries of federal healthcare programs; patients who are federal healthcare program beneficiaries may be sent to any laboratory.

The OIG found that the Parent Laboratory would offer the physicians prohibited remuneration in the form of an opportunity to expand into a financially profitable lab business. Although the physicians would bill only for non-federal healthcare program services, OIG acknowledged that referrals covered by a federal healthcare program might occur for several reasons: physicians would make referrals to the Parent Laboratory for convenience, to further demonstrate a commitment to the Parent Laboratory, or to potentially secure more favorable pricing on private-pay services. Additionally, the physicians may not make a distinction between the Parent Laboratory and the laboratories operated with support from the management company owned by the Parent Laboratory. OIG concluded that this arrangement insufficiently minimized the risk of federal healthcare program fraud and abuse and that it could potentially impose administrative sanctions in connection with its enforcement of the Anti-Kickback Statute, if requisite intent was found to exist.

The Anti-Kickback Statute protects against the exchange of remuneration for the inducement or reward of referrals reimbursable by a federal healthcare program. Carve-out arrangements implicate, and may violate, the Anti-Kickback Statute by disguising remuneration for federal healthcare program business through payments purportedly related to non-federal healthcare program business.

, OIG similarly held that the arrangement insufficiently minimized the risk of federal healthcare program fraud and abuse. In No. 12-06, Arrangement B, the physicians similarly had elements of a suspect contractual joint venture - the physicians had an opportunity to expand into another profitable business with little or no risk. Specifically, the physicians formed a subsidiary company that contracted out all operations exclusively to an established anesthesia provider. The physicians’ business risk was minimal because the anesthesia service referrals were wholly dependent on the physician’s ASC’s referrals; they controlled the amount of business they referred to the subsidiary. The physicians also did not participate in the operation of its anesthesia subsidiary, but shared in the economic benefit of the new business of the ASC (the anesthesia provider receiving the negotiated rate and the physician-owners received residual profits equal to the amount the subsidiaries collected from Medicare and other third-party payers and patients for anesthesia services minus the amount the subsidiaries paid the anesthesia provider).

Although OIG has noted its displeasure with arrangements failing to minimize the risk of federal healthcare program fraud and abuse, some carve-out arrangements have passed OIG muster.

, a consulting organization entered into an agreement with hospitals to audit hospital bills for undercharges and overcharges to private insurer paying on a charge basis, but with no auditing of any bills reimbursed by federal healthcare programs either as primary payers or secondary payers. Although this arrangement carved-out non-federal healthcare beneficiaries, it posed a limited risk of fraud and abuse because it was a one-time, wholly retrospective billing audit and the items or services were previously ordered, provided, and claimed prior to the audit.

, a university's hemophilia center entered into a contract with a pharmacy company to dispense anti-hemophilia factor and other outpatient drugs and to provide outpatient pharmacy services for the university. The arrangement excluded Medicaid fee-for-service patients from receiving drugs through the university’s outpatient drug program. OIG recognized that parallel arrangements that bifurcate services between federal and private pay business may create a risk that the parties will swap discounted private pay business for referrals of higher paying federal business. However, OIG concluded that the arrangement contained several safeguards to minimize the risk of swapping: the company would not control the price charged for drugs for non-Medicaid patients nor file claims for such drugs, there was no inference that the company paid for referrals as there was no remuneration between the companies through the provision of free or below-market services, and the exclusion of the Medicaid patients was consistent with the section 340B bar on duplicate discounting and the Medicaid prohibition against reassignment.

Although some arrangements overcome OIG scrutiny, physicians should heed OIG warnings.

Often in practice, arrangements that attempt to exclude federal program business are improperly affected by a tainted referral arrangement despite the carve-out.

The information contained within this blog posting on this website, is made available by the attorney authoring the posting for educational purposes only, and to give you general information and a general understanding of the law. It is not intended to provide specific legal advice to your individual circumstances or legal questions. By using this blog site you understand that your reading of this blog posting does not establish an attorney-client relationship between you and the authoring attorney or his law firm.  This blog posting should not be used as a substitute for competent legal advice from a licensed professional attorney in your state. Readers of this information should not act upon any information contained in this blog posting on this website without seeking professional counsel.

Articles

HHS' Office of Inspector General reiterates antipathy towards some physician arrangements that carve out federal referrals.

Physicians Cautioned to Scrutinize Their Carve-Out Arrangements

Office of Inspector General (OIG) fraud alert

 published last month by the OIG, OIG stated that physician-owned distributorships (“PODs”) have the “strong potential for improper inducements between and among the physician investors, the entities, device vendors and device purchasers.” A POD includes any physician-owned entities deriving revenue from selling, or arranging for the sale of, implantable medical devices ordered by the physician owner for use in procedures that the physician-owner performs on its own patients at hospitals or ASCs.

The Anti-Kickback Statute ascribes criminal liability to anyone (on both sides of the arrangement) who knowingly and willfully offers, pays, solicits or receives any remuneration to induce, or in return for, referrals or items or services reimburseable by a federal health care program. One purpose of the statute is to protect patients from inappropriate medical referrals or recommendations by health care professionals who may be unduly influenced by financial incentives. The OIG makes clear that a referring physician earning profit even through investment in an entity for which he or she generates business, could be illegal remuneration under the statute.

OIG is particularly concerned about POD investment arrangements that generate disproportionately high profits for physician-owners because the investment risk associated with PODs is often minimal. Therefore, OIG scrutinizes the selection of investors in a position to generate substantial business for the entity, in the entities requiring investors that cease participating in the service area to divest their ownership interests, and in those investors receiving “extraordinary” returns on investments compared to the level of risk involved.  OIG concerns are also heightened when physician-owners: 1.) are few in number, such that the volume or value of a particular physician’s recommendations or referrals closely correlates to that physician’s return on investment; or 2.) alter their medical practice after or shortly before investing in the POD (i.e., they perform more surgeries, or more extensive surgeries, or switch to using their PODs’ devices on an exclusive, or nearly exclusive basis).

OIG also fears that PODs breed corruption of medical judgment, overutilization, increased costs to Federal health care programs and beneficiaries, and unfair competition. Both the choice of brand and type of device are often made and strongly influenced by the physician, rather than controlled by the hospital or ASC where the procedure is performed. Therefore, OIG believes that physician-owners use the implantable devices of their PODs in lieu of other, more clinically appropriate devices or perform more procedures (or more extensive procedures) than are medically necessary.

Even in an age of transparency furthered by the Affordable Care Act, however, OIG does not believe that disclosure to a patient of the physician’s financial interest in a POD is sufficient to address these concerns. Nor will a physician-owner’s claim that their POD’s devices are superior in design or manufacturing disprove unlawful intent.

Because PODs may be lawful under the Anti-Kickback Statute, OIG scrutinizes the intent of the parties. However, the following characteristics are some examples that raise red flags for OIG:

• Size of investment offered to each physician varies with the volume or value (expected or actual) of devices used by the physician.

• Distributions are not proportional to ownership interest.

• Physician-owners pay different prices for ownership interests, because of the volume or value (expected or actual) of devices used by the physicians.

• Referrals to hospitals or ASCs are conditioned on the purchase of the physician’s POD devices through coercion or promises (i.e., physician states that or implies they will perform surgeries or refer patients elsewhere if a hospital or an ASC does not purchase devices from the POD; promises or implies they will move surgeries to the hospital or ASC if it purchases devices from the POD; or by requiring a hospital or ASC to enter into an exclusive purchase arrangement with the POD).

• Physician-owners are required, pressured, or actively encouraged to refer, recommend, or arrange for the purchase of the devices sold by the POD .

• Physician-owners are threatened with, or experience, negative repercussions (decreased distributions or required divestiture) for failing to use the POD devices for their patients.

• POD retains the right to repurchase a physician-owner’s interest for the physician’s failure or inability (through relocation, retirement, or otherwise) to refer, recommend, or arrange for the purchase of the POD’s devices.

• POD is a shell entity that does not conduct appropriate product evaluations, maintain or manage sufficient inventory in its own facility, or employ or otherwise contract with personnel necessary for operations.

• POD does not maintain continuous oversight of all distribution functions.

• When a hospital or an ASC requires physicians to disclose conflicts of interest, the POD’s physician-owners either fail to inform the hospital or ASC of, or actively conceal through misrepresentations, their ownership interest in the POD.

The Anti-Kickback Statute is not a prohibition on the generation of profits and OIG does not wish to discourage innovation. However, OIG is particularly concerned with a physician’s intentional and illegitimate investment interests in PODs and thus, physicians should carefully consider their ownership arrangements with such entities.

The OIG deems PODs to be inherently suspect under the Anti-Kickback Statute, so physicians should take note.

Physician-Owned Distributorships Raise Heightened Concern by OIG

In mid-January, HHS' Office of Civil Rights (OCR) issued the final rule modifying HIPAA. The modification significantly expanded and revised the existing HIPAA privacy, security, enforcement, and breach notification rules. Under the new rule, de-identification remains in full effect; once individually identifiable health information or protected health information (PHI) is “de-identified” it is no longer PHI subject to HIPAA.

HHS recently issued separate guidance that finally evaluates when PHI is properly de-identified. 

As previously discussed, there are two methods:

 the safe harbor method of removing 18 specific identifiers and the expert method.

In the expert method, HHS allows the use of an expert to conduct an identification risk assessment to determine that the risk of identifying the individual who is the subject of the information either alone or in combination with other reasonably available information is very small.

When evaluating identification risk, an expert is advised to consider the degree to which the data can be linked to a data source that reveals the individual’s identity. The strength of “linkage” hinges on whether the data is distinguishing or unique, there is a naming data source, and a mechanism to relate the de-identified and identified data sources. Inability to design a relational mechanism would prevent a third party’s ability to “achieve success to no better than random assignment of de-identified data and named individuals. The lack of a readily available naming data source does not mean the data is sufficiently protected from future identification, but it is difficult to re-identify an individual or a group of individuals, given the data sources at hand,” according to HHS.

The route by which health information can be linked to naming sources or where sensitive knowledge can be inferred is an important aspect of an identification risk assessment. A higher risk feature is one that is found in many places and is publicly available. For instance, patient demographics are a higher risk feature in that such data can be exploited by anyone in receipt of the information, whereas clinical features, such as blood pressure or temporal dependencies, are lower risk features in that they may distinguish a patient in a specific population, but are accessible to a much smaller set of people.

The de-identification standard does not require the expert to follow or assess risk according to a specific method. The qualified expert may apply generally accepted statistical or scientific principles to compute the uniqueness of a data set. Data managers and administrators working with the expert can look to the following principles when considering the identification risk of health information. These principles are considered a starting point for the covered entity’s reasoning and not a definitive list.

Additionally, if an expert determines that the risk of identification is greater than very small, the HHS guidance provides that experts may modify the information to mitigate the identification risk to that level, as required by the de-identification standard. The expert may initiate suppression techniques and eliminate or remove certain features about the data prior to dissemination. The expert could abbreviate or generalize the information, such as generalizing the age of a patient from one-year to five-year age groups. The expert may apply perturbation techniques to maintain the data’s original statistical properties, but replace specific values with equally specific, but different, values. For instance, instead of age 21, identify an age of 20 years +/- 2 years.

Health providers and business associates (as well as their subcontractors) wishing to limit information in their possession subject to HIPAA, thus mitigating the risk of a HIPAA Privacy/Security Rule violation or breach, should review their de-identification procedures in light of the HHS de-identification guidance.

It's a good time for medical practices to review their de-identification methods to avoid a potential HIPAA violation under recently released rules.

HIPAA’s De-Identification Guidance and Role of Expert Evaluations

The Office for Civil Rights (OCR) recently issued important guidance regarding the HIPAA concept known as “de-identification.” This guidance applies to covered entities, which include physicians and business associates (a person or entity, other than a member of the covered entity’s workforce), that perform certain services on behalf of the covered entity involving "protected health information" or PHI.

HIPAA’s Privacy Rule helps guard against the use or disclosure of an individual’s identifying health information or PHI by permitting its use in only certain instances, such as for treatment, payment, healthcare operations, or as authorized by the patient.(1) PHI is information, including demographic information, which relates to the individual’s provision of healthcare, their physical or mental medical condition (past, present, or future), and any payment for that care that identifies or can be used to identify the individual. De-identification mitigates privacy risks by removing health data that individually identifies the individual and with respect to which there is no reasonable basis to believe that the information can be used to identify the individual. However, the privacy rule permits a physician or its business associate to create information for secondary use in comparative studies, policy assessments, and life science research that is not individually identifiable by following its de-identification standards.

De-identification occurs either by: (1) meeting the safe harbor in removing 18 identifiers and verifying there is no actual knowledge that the residual information can identify the individual; or (2) an expert has documented its statistical or scientific analysis determining that there is a 

 of an anticipated recipient using such health information with other reasonably available information to identify an individual who is a subject of the information.

The following 18 identifiers of the individual or of relatives, employers, or household members of the individual, are to be removed to comply:


The assessment of whether or not there is a “very small” risk that an anticipated recipient could identify an individual must be determined by an expert who may have a statistical, mathematical, or scientific background. OCR does not require that an expert have a specific professional degree or certification when rendering health information de-identified. However, OCR will evaluate the expert’s determination of acceptable “very small” risk based on his/her education and actual experience using health information de-identification methodologies.

There is also no universal level for the “very small” risk threshold. Risk will be determined on a case-by-case because its assessment is dependent on many factors (such as, replicability, availability of the data source, distinguishability, and social environment). Risk identified for one particular data set in the context of a specific environment may not be appropriate for the same data set in a different environment or a different data set in the same environment. As a result, an expert needs to define an acceptable very small risk based on its assessment of the ability of an anticipated recipient to identify an individual.

Although no single universal solution or process addresses all privacy and identification issues, experts are expected to document the methods and results of their analyses that justify their determination. Such steps may include: (i) the extent to which health information can (or cannot) be identified by the anticipated recipients; (ii) guidance on which statistical or scientific methods can be applied to the health information to mitigate anticipated risk; (iii) the execution of such methods; and (iv) their evaluation of the ability to identify the resulting health information confirming that the risk is no more than very small when disclosed to the anticipated recipients. It is understood that this process may require several iterations.

Additionally, HIPAA does not explicitly require an expiration date be attached to the expert’s determination. In light of the evolution of technology, social conditions and availability of information, however, time-limited certifications may be considered reasonable. Covered entities should have an expert examine whether future releases of the data to the same recipient (e.g., monthly reporting) be subject to additional or different de-identification processes consistent with current conditions to reach the very low risk requirement.

In the next part of this post, I will discuss the examples and principles used in satisfying the safe harbor and methods used by experts to determine information is de-identified.

2 See 67 FR 53182, 53233-53234 (Aug. 14, 2002)

Here's guidance on how to avoid violating HIPAA when it comes to de-identification of protected health information.