Rose J. Willis, JD

The Department of Health and Human Services (the “Department”) has proposed long-awaited revisions and updates to the Stark and Anti-Kickback Laws (the “Laws”). These changes would address concerns that the Laws as they currently exist (1) prevent participation in value-based arrangements and (2) are overly burdensome to non-abusive arrangements. For example, arrangements such as a hospital’s provision of care coordinators to physicians, which could currently violate the Laws, may become acceptable under the rules proposed by the Office of Inspector General and the Centers for Medicare and Medicaid Services (the “Proposed Rules”).

A significant portion of the Proposed Rules is dedicated to participation in value-based and coordinated care arrangements. These sections propose a complex framework of new exceptions and safe harbors that must be met before a value-based arrangement (“VBA”) could qualify. The new exceptions and safe harbors are tied to multiple newly defined terms and focus heavily on the existence of financial risk within the VBA including the new concept of a “value-based enterprise” (VBE). Overall, 4 new exceptions were proposed within the Stark Law and 4 new safe harbors were proposed within the Anti-Kickback Law for VBAs. 

6 considerations for outsourcing â¨at your medical practice

Careful attention to all value-based factors and definitions would be necessary in order to be confident that an arrangement falls within these exceptions and/or safe harbors. However, when finalized, they will offer parties greater flexibility to participate in these innovative arrangements. For example, a specialist could share its data analytic services with a primary care physician to improve care coordination without violating the Laws. A hospital could offer new technology to remotely monitor patients for possible healthcare intervention needs. Although these arrangements could violate the Laws currently, they are within the scope of the government’s intent to promote care based on value rather than volume.

The Proposed Rules revise various other aspects of the Laws to promote VBAs. For example, Stark Law group practice rules would allow distribution of profits to physicians in a manner directly attributable to their participation in a VBE. Proposed changes to the personal services safe harbor to the Anti-Kickback Statute would remove limiting language surrounding part-time arrangements and allow parties to set in advance a methodology for calculating compensation rather than a specified compensation number, in order to meet the safe harbor. Part-time arrangements could now fall within this safe harbor even without setting in advance the exact schedule of the part-time intervals.

Another significant portion of the Proposed Rules addresses the unnecessary burdens created by the Laws including responses to the Department’s request for information issued over a year ago. One such proposal would clarify the definition of “commercially reasonable” clarifying that an arrangement does not have to be profitable to make it commercially reasonable. For example, a hospital service line that operates at a loss may still be commercially reasonable if it fills a vital need in the community. 

Additionally, the Proposed Rules would set forth a bright line test to the Stark Law’s “volume or value of referrals” standard and separate it from the definition of “fair market value”. The new volume or value standard would prohibit any linkage between referrals and compensation. For example, physician compensation based on personally performed wRVUs would be considered based on the volume or value of referrals if the wRVU multiplier is tiered based on the number of referrals made by the physician. The definition of fair market value would incorporate the concept of “general market value” and be re-organized for clarity into 3 definitions-one for general application, another for rental of equipment, and a third for rental of office space, due to the heightened risk involved in equipment and space leases. For example, a hospital proposing to employ a specialist who is the top specialist in the entire country might be permitted to pay this top specialist a salary that is significantly higher than what independent salary surveys would otherwise indicate appropriate if the general market value of the specialist is higher, and still fall within fair market value. 

The Proposed Rules would help ease the transition to value based care while addressing many undue burdens of the Laws. Although we await the final version of these rules, we can be sure adding value and reducing burdens will remain a common theme.

Articles

Four new exceptions and four new safe harbors proposed.

HHS’ revisions could add value and reduce burden

At some point, all healthcare providers need to engage third parties to perform activities or functions on their behalf. In so doing, providers need to ensure those third parties maintain confidentiality of information learned in the course of their services. Providers must be even more vigilant when those third parties have access to certain patient information.

Providers who are considered covered entities under the 

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

 are required to properly protect an individual’s health information in compliance with the requirements set forth in the 

HIPAA Privacy, Security, Breach Notification and Enforcement Rules

Specifically, the Privacy Rule allows such access to and disclosure of protected health information (PHI) by third parties, defined as business associates, only if the provider obtains satisfactory assurances in writing from the business associate that it will:

1.    use the PHI only for the purpose for which it was engaged by the provider,

2.    safeguard the information from misuse and

3.    help the provider comply with some of its duties under the Privacy Rule.

The provider, and in certain situations its business associate, have direct liability under HIPAA, meaning that should either party breach certain aspects of the HIPAA Rules, the HHS 

 (OCR) may bring an enforcement action directly against that party. Recently, the 

 that specifically identifies the only situations where a business associate has direct liability under HIPAA. Those 10 situations are:

1.             Failure to provide the secretary of HHS with records and compliance reports; cooperate with complaint investigations and compliance reviews; and permit access by the secretary to information, including PHI, pertinent to determining compliance.

2.             Taking any retaliatory action against any individual or other person for filing a HIPAA complaint, participating in an investigation or other enforcement process, or opposing an act or practice that is unlawful under the HIPAA Rules.

3.             Failure to comply with the requirements of the Security Rule.

4.             Failure to provide breach notification to a covered entity or another business associate.

5.             Impermissible uses and disclosures of PHI.

6.             Failure to disclose a copy of electronic PHI to either the covered entity, the individual or the individual’s designee - whichever is specified in the business associate agreement - to satisfy a covered entity’s obligations regarding the form and format, and the time and manner of access under 45 C.F.R. §§ 164.524(c)(2)(ii) and 3(ii), respectively.

7.             Failure to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.

8.             Failure, in certain circumstances, to provide an accounting of disclosures.

9.             Failure to enter into business associate agreements with subcontractors that create or receive PHI on their behalf, and failure to comply with the implementation specifications for such agreements.

10.          Failure to take reasonable steps to address a material breach or violation of the subcontractor’s business associate agreement.

The fact sheet is important because it reminds us there are situations in which a business associate could cause a breach of HIPAA but not be directly liable to OCR. In those situations, it is the provider who would likely be directly liable to OCR for the business associate’s actions.

As an example, the HIPAA Rules prohibit a provider from charging fees to their patients in excess of a specified limitation for copies of or access to their PHI. In the event the business associate agreement authorizes the business associate to fulfill a request by an individual for access to his or her PHI, and the business associate charges a fee that exceeds the amount permitted under HIPAA, then the provider would be directly liable to OCR for those actions.

To address these situations, providers should incorporate language into the indemnification provision of their business associate agreements requiring the business associate indemnify the provider “for any actions or omissions of the business associate that cause the provider to fail to satisfy its obligations under the HIPAA Rules.” Additionally, to the extent a provider has insurance covering HIPAA-related liability, the provider should seek to ensure it includes liability caused by actions or omissions of its business associates.

. She focuses her practice on healthcare regulatory, transactional and corporate law in her representation of healthcare providers and suppliers and other participants in the healthcare industry. 

 regularly counsels healthcare industry clients on matters involving mergers and acquisitions, software agreements, physician referral rules, certificates of need, privacy and security of health information, corporate documents and compliance program elements.

Recent clarifications on HIPAA liability underscore the importance of maintaining protected health information and taking precautions when working with third parties.

Author | Rose J. Willis, JD

Articles

HHS’ revisions could add value and reduce burden

10 times you could be held liable for a business associate’s HIPAA breach