Yulian Shtern, Esq.

In the past decade, there has been a steady increase in the number and types of surgical procedures performed in an office-based setting by various practitioners – including general surgeons, gastroenterologists, ophthalmologists, radiologists, dermatologists, podiatrists, dentists and other specialists.  While advances in medical technology have enabled more procedures to be performed in an office setting, patient safety concerns remain crucial and warrant a re-examination of legal and regulatory oversight.  Practitioners performing office-based surgery (OBS) should be familiar with the laws and leading issues associated with OBS procedures.

Although the precise definition varies from state-to-state, an OBS procedure is generally any surgical or diagnostic procedure performed in a physician’s medical office that is invasive or involves subcutaneous penetration, excluding minor surgical procedures.  Most jurisdictions classify procedures as “surgical” or “invasive” by reference to the type and level of sedation or anesthesia used. 

In many states, an OBS medical practice is exempt from licensure requirements that apply to other surgical facilities, such as hospitals or ambulatory surgical centers (ASCs).  Unlike these larger institutional surgical facilities, OBS practices do not have to satisfy the more stringent physical plant, safety and sanitary requirements imposed on the licensed facilities. Accordingly, an OBS medical practice can be located in any structure or suite of rooms established by one or more physicians for the private practice of medicine, but is typically limited to one surgical operating room. 

OBS practices are generally subject to less stringent requirements because  OBS procedures are relatively low risk and do not require the full complement of emergency room equipment and staff on hand in case of patient emergencies, which are mandatory in hospitals and ASCs.  Receiving treatment in the OBS setting may be more efficient and convenient for the patient, especially where risk of an adverse outcome is low, and an overnight stay or a longer recovery time is unnecessary.

States regulate OBS practices to varying degrees.  In some states, such as Massachusetts, an OBS practice is not required to register or obtain facility licensure.  Rather, such practices are regulated by the state medical licensing board, which regulate surgical practitioners’ in the ordinary course of the board’s oversight responsibilities, and a practitioner performing OBS procedures may simply have to check off a box or complete an additional form when renewing his or her license.  In other states, offices performing OBS must register with the state’s department of health or the respective practitioner’s licensing board.  The registration process is intended to provide some degree of oversight and accountability for OBS practices, without subjecting them to full hospital or ASC licensure requirements (e.g., lower or no registration fees and no or fewer state inspections).   The more stringent states, such as New Jersey, will require OBS practices to obtain facility licensure from the state’s department of health under recently enacted statutory amendments, just like an ASC or a hospital (but perhaps with less rigorous requirements as compared to larger facilities). 

States also differ with respect to operational and regulatory requirements, such as surgery time limits, procedure specific limitations (e.g., maximum percentage of body fat removed during liposuction), the level of life support certification required for staff members, additional continuing medical education (CME) requirements (e.g., mandatory CMEs on anesthesia), and credentialing or board certification or eligibility requirements for practitioners.  Some states, such as New York, also require post-procedure incident or adverse event reporting to a state regulatory agency.  Although some states oversee OBS compliance internally (e.g., department of health), many states require or encourage OBS practices to achieve compliance by obtaining registration with the Centers for Medicare & Medicaid Services (CMS) or accreditation from an approved agency. 

While state regulations vary to some degree as to which procedures trigger an accreditation requirement, many states require or encourage OBS practices to obtain accreditation from a private agency (or certification as an ambulatory surgical center from CMS).  Accreditation agencies require OBS practices to satisfy certain operating and office standards, which ensure that procedures are performed in a sanitary and safe manner.  These standards are developed additionally to verify that support staff is qualified, trained and experienced and that anesthesia is administered by a qualified professional, with adequate oversight. 

Accrediting agencies also set forth requirements concerning cleanliness of operating rooms and adequacy of personnel and equipment to respond to emergency situations (e.g., staff members are to be certified with advanced cardiovascular life support training).  Accreditation can be obtained from several agencies, such as the Joint Commission, the American Association for Accreditation of Ambulatory Surgery Facilities (AAAASF) and the Accreditation Association for Ambulatory Health Care (AAAHC). 

Physicians interested in establishing or joining an OBS practice should also determine whether the OBS practice can charge a “facility fee” in addition to the reimbursement paid to physicians for professional services.  OBS practices are not always guaranteed to receive a facility fee – i.e., payment for the use of the physical location and equipment.  While rules and policies governing the payment of facility fees vary from state-to-state, third-party payors often deny payment of a facility fee charged by an OBS practice. 

As such, revenues attributable to OBS procedures may be limited to the professional fee reimbursement for such procedures.  Profits margins will be further limited if the professional fee reimbursement does not adequately cover expenses associated with an OBS practice, such as rent, equipment maintenance, wages for non-profession extenders or technicians (who generally cannot bill for their services), and compliance with regulatory and accreditation requirements. 

Given the broad spectrum of regulation and different requirements applicable to performing OBS procedures across jurisdictions, Physicians interested in or already running OBS practices should carefully navigate through the legal and economic considerations required to perform OBS procedures in their medical offices.

; 973-639-8297) is a Senior Counsel of Epstein Becker & Green, P.C. in the Newark office, and 

; 973.848.7719) is an Associate in the Newark office, of Epstein Becker & Green, P.C., a national law firm with a primary focus on health care and life sciences.
 

Articles

A brief overview of laws and issues related to office based surgical practices.

What You Need to Know About Office-Based Surgery Laws

Electronic healthcare security systems were put to the test in 2016, as record numbers of hospitals, facilities and physician practices fell victim to ransomware attacks.  The increasing number of ransomware attacks on providers is particularly troublesome because hackers can essentially lock out users from their EHR systems.  Once a system is infected, providers feel compelled to pay the ransom rather than sustaining an interruption to patient care.  For these reasons, providers should learn about the risks of ransomware and develop strategies to prevent and manage such malicious cyber-attacks. 

Ransomware refers to malicious software that attempts to deny access to a user's data, usually by encrypting the data in a way that prohibits access until a ransom is paid.  Computer systems affected by ransomware will see ominous messages, indicating that their computer is essentially locked out, except for a web-link that directs the user to pay a ransom to a hacker.  The ransom is usually demanded in Bitcoin or other cryptocurrency and requires the user to access the "dark web" to make the payment.  Hackers promise that upon payment they will release a decryption key, which will restore the user's system.  However, there have been instances where hackers do not honor their promises and instead demand more money.     

In addition to the general problems created by ransomware, healthcare businesses must also consider their obligations under HIPAA and other privacy and security laws.  According to 

 from the Department of Health and Human Services (HHS), the presence of ransomware is a "security incident" under the HIPAA Security Rule and triggers the security incident and response and reporting procedures required under HIPAA. 

HHS guidance also states that any electronic protected health information ("ePHI") that is encrypted by ransomware is presumed a "breach," triggering a covered entity's breach notification obligations.  Although ransomware does not typically distribute or disclose computer files that are held hostage, HHS states that the act of taking possession or control of ePHI by unauthorized individuals constitutes a breach.  HIPAA's breach notification rules can seriously compromise the goodwill and reputation of a provider, as notification to affected individuals, to the Secretary of HHS and to the media (for breaches affecting over 500 individuals) may be required.  The breach notification obligations can only be avoided if the victim of a ransomware attack can demonstrate that there is a "…low probability that the PHI has been compromised," based on the factors set forth in the breach notification rules. 

Preventing ransomware is a complex undertaking, as this particular strain of malware is constantly evolving and infiltrating even those systems that follow recommended security measures.  HHS guidance recommends that providers follow the HIPAA security rule to prevent ransomware infections.  In particular, providers should implement a robust and frequent data backup plan, which would enable providers to restore previous "infection-free" versions of their electronic data.  Providers should also invest in reputable security software (e.g., firewalls, e-mail filters, anti-virus programs) and promptly install updates, which periodically update the software's ability to recognize and detect new ransomware attacks. 

Once a ransomware attack is identified and underway, providers are encouraged to follow a security incident response plan.  According to HHS guidance, this includes conducting an initial analysis, that determines the scope of the attack (what systems were affected?), the origination of the incident, whether the incident is ongoing, finished or spread further throughout a network,  nd analysis of how the incident occurred.  Thereafter, appropriate response activities include containing the infection and preventing propagation of the malware, eradicating instances of ransomware, recover from the ransomware attack by restoring data or backups and conducting post-incident activities that address identified vulnerabilities.    

Providers should also consider reporting the attack to its local FBI or U.S. Secret Service field office. These agencies work with Federal, state, local and international partners to pursue cyber criminals globally and assist victims of cybercrime.  The FBI has also released 

 to help victims of ransomware attacks, which echoes the recommendations set forth in the HHS guidance. 

Physician practices that wish to avoid ransomware attacks should implement robust security incident response protocols.  These protocols should include education and training that helps members of the workforce to identify, prevent and address ransomware attacks. 

, is a health law attorney with Abrams, Fensterman, Fensterman, Eisman, Formato, Ferrara & Wolf, LLP. 

More practices are falling victim to ransomware attacks, where hackers can lock out users from their EHR systems. Here is some guidance around this issue.

Ransomware: What to Do When Your Systems are Hijacked

In reflection on my year during this holiday season, I am grateful for the ability to represent some of the most talented and hard-working physicians in the country.  However, I cannot help but feel compassion for some of the providers who face harsh and seemingly unjust consequences for minor mistakes.  A perfect example is the physician whose Medicare enrollment status is revoked or voided by its regional contractor.

CMS can revoke a provider's billing privileges for a variety of reasons, such as following a provider's conviction for a criminal offense or noncompliance with enrollment requirements.  In effect, the revocation terminates the provider's ability to treat and bill for Medicare patients and precludes the provider from reapplying for Medicare enrollment for a specific period of time.  While revocation is appropriate in certain circumstances, the tool is sometimes used to punish relatively minor mistakes.  In these circumstances, physicians will believe that their local Medicare contractor is staffed by Ebenezer Scrooge or the Grinch.    

An example of the harsh applications of revocation is when a provider uses a P.O. Box address as its practice location.  According to CMS, providers may not indicate a P.O. Box address as their practice location.  A practice location is required to be operational - i.e., if CMS were to inspect the address listed on the Medicare enrollment forms, it would anticipate walking into a medical clinic or office.  Thus, any provider with a P.O. Box practice location in its enrollment forms can be subject to revocation, which can last between one and three years.  Obviously, these providers are not practicing medicine at their local post-offices.  Yet, CMS and Medicare contractors are required to revoke such providers' billing privileges for a seemingly innocuous mistake. 

Worst yet, providers who are revoked by CMS for not having an operational practice location are also unable to bill Medicare for services rendered from the date that CMS determines a location is inactive.  In other words, if CMS or a contractor visits a provider's practice location on Nov. 1 and  determines that it is not operational, the provider cannot bill for services rendered on or after Nov. 1.  However, the provider will not likely receive notice of the revocation until 2-4 weeks after CMS makes its determination. During this delay, the provider may unknowingly be performing weeks of services for which it expects reimbursement from Medicare, only to find out that it will not be paid because of revocation.  This leaves the poor provider blindsided and without sufficient revenues to pay its staff for the holidays. Or in laymen's terms, "Scrooged."

Good luck avoiding Scrooge! I wish all of you the happiest of holidays and a very successful new year. 

Sometimes CMS can unjustly revoke a provider's billing privileges. Here are a few examples. 

The Medicare Contractor Who Stole Christmas

Physicians, among millions of other concerned Americans, are anxious to see how they will be affected by President-elect Donald Trump's cabinet appointments and policy choices.  The transfer of power is particularly nerve-racking in the healthcare industry, given that Trump has been inconsistent with his views on the Affordable Care Act. What can physicians expect during the next four years under President Trump (in addition to the lavish gold "TRUMP" insignia at their local hospital)?

Trump and the Republican-led Congress will certainly and swiftly repeal most or all of the ACA.  However, it is unclear when the repeal will become effective.  The President-elect has promised immediate action, consistent with his fast-paced business practices.  However, House Speaker Paul Ryan indicated that the task of repealing and replacing Obamacare would take up to three years, to avoid prejudice to the 20 million Americans who are relying on coverage obtained via Obamacare.  In any event, physicians in private practice may not see the effects of "repeal and replace" for several years, possibly even after Trump's first term.  

At this time, the substantive effects of "repeal and replace" are difficult to predict.  The respective agendas of Trump's transition team and the Republican Congress are broad and do not comprehensively address policy initiatives focused on physicians and other providers.  The Republican agenda focuses primarily on broad health insurance reform policies, such as legislation that would permit the sale of health insurance across state lines and decrease insurance costs by increasing competition.  While such a law may reduce insurance costs for patients, providers might experience increased administrative burdens and costs in adapting to such an interstate insurance system, particularly if conflicting state laws impose regulatory requirements in addition to any federal regulations.    

Perhaps the most telling policy changes can be inferred in President-elect Trump's appointment of Representative Tom Price as the next Secretary of Health and Human Services ("HHS").  Rep. Price, an orthopedic surgeon for over 20 years, has historically supported policies that would remove the remove the intervention of the state and federal government into the practice of medicine. If Rep. Price will be confirmed by the Senate, he will have broad discretionary authority to change or remove some of the regulations governing providers.  The physician community would most certainly welcome relief of regulatory burdens, which have become increasingly complex and burdensome in recent history.  However, any such policy initiatives may be difficult to implement while simultaneously enforcing Trump's campaign 

 to seek out and eliminate fraud, waste and abuse. 

The incoming Republican-led government is also poised to implement obstacles pertaining to abortion rights. The Republican agenda uniformly supports providing freedom for providers to exercise their conscience with respect to refusing abortion care and preventing federal funds from being used for abortion.  These policies greatly concern the pro-choice lobby, which has decreased barriers to abortion under President Obama's administration.  Providers in obstetrics and gynecology may experience impediments in providing abortion care and we may see an increase of interstate travel by women seeking abortions in neighboring pro-life states.

The first one-hundred days of President Trump's administration will likely result in more answers and more passionate debate about the healthcare policies initiatives that will govern providers for the next 4 years.

What can physicians expect from healthcare policy under President-elect Donald Trump? A look ahead to the next four years.

Will Trump Make Practicing Medicine Great Again?

Due to the recent focus on prescription opioid abuse, the healthcare industry should anticipate substantial amendments to state and federal laws dealing with controlled substance abuse.  While many commentators blame the pharmaceutical industry for creating this nationwide epidemic, it is likely that governmental agencies will look to physicians and other prescribing practitioners to help enforce a solution.  With no uniform solution or protocol in dealing with the opioid abuse epidemic, practitioners will likely see differing approaches and requirements, as promulgated by the various state governments.

U.S. Health and Human Services (HHS) Secretary Sylvia M. Burwell said in a 

: "[t]he opioid epidemic is one of the most pressing public health issues in the United States. More Americans now die from drug overdoses than car crashes, and these overdoses have hit families from every walk of life and across our entire nation." The topic has gained widespread media attention, as over 18,893 Americans died from prescription pain-killer overdose in 2014, according to the American Society of Addiction Medicine.  Most recently, John Oliver's latest episode of 

 examined the role of pharmaceutical companies in creating this nationwide epidemic. According to Oliver, the prescription opioid epidemic is largely attributable to the pharmaceutical industry's deceptive and manipulative marketing campaigns to convince practitioners that prescription opioids are safe and not addictive. 

Notwithstanding the alleged transgressions of the pharmaceutical industry, governments will seek to impose new regulations and protocols upon the entire healthcare industry, especially physicians, to help combat this problem.  The federal government has taken certain initial actions to help treat America's opioid epidemic, such as expanding access to buprenorphine - a medication used to treat opioid use disorder.  However, many are dissatisfied with the speed and scope of the federal government's response to date and, as a result, several states have stepped up to adopt their own measures.  In general, intervention on the state government level will likely be quicker and more effective in the short term.  However, the differing approaches amongst the various states have led to a disparity of focus and responsibility in addressing the opioid epidemic.          

New York's has most recently focused on the insurance industry to help patients obtain substance abuse treatment.  New York's Department of Financial Services recently issued guidance directing insurance companies to change the way they authorize coverage for substance abuse treatment. Insurers are now required to adopt the utilization review standards set forth by the state's Office of Alcoholism and Substance Abuse Services, which are less arbitrary than the standards previously used by private insurers.  The guidance also requires insurers to provide coverage for medication used for detoxification or maintenance treatment of a substance use disorder.    

South Carolina also recently addressed access to substance abuse treatment by relying on pharmacists to intervene.  Pursuant to a recently enacted law, South Carolina will permit pharmacists to dispense opioid antagonists without a prescription from a physician.  The newly enacted law will establish a protocol to be followed by pharmacists when acting without a verbal or written order from a prescriber.  It is unclear, however, whether pharmacists will utilize this newly enacted power to intervene and address a patient's condition without a practitioner's order    

Gov. Peter Shumlin of Vermont took a different approach proposing to impose limits on the number of painkillers that could be prescribed at a given time in a press conference on Oct. 19.  The proposed regulations in Vermont seek to limit prescription quantities based on the severity and duration of a patient's pain.  If the proposed regulations are promulgated, physicians will then have to consult regulatory algorithms to determine the appropriate dosage and quantity of painkillers. 

With the growing disparity of substance abuse laws on the state level, practitioners must be mindful of updates and distinctions in all states where they perform professional services.  This poses a heavy burden on the medical community, which must balance its ethical treatment obligations, with the risks of malpractice liability and regulatory or criminal enforcement.  These concerns are largely responsible for the cautious response of the physician community to the substance abuse problem. Some commentators have 

, stating that practitioners are only downsizing the use of painkillers in their treatment regimens, while failing or hesitating to facilitate substance abuse treatment. As noted by the various examples above, it is likely that more states, and possibly the federal government, will impose legal and regulatory obligations that may prohibit physicians from sitting on the sidelines.      

Different states are enacting various prescription measures to fight against opioid abuse. Here's what you need to know about these regulations. 

How Does the Fight against Opioids Affect Your Practice? 

Adopting an effective corporate compliance program is in essence preventive care for the physician practice.  Like obesity and diabetes, fraud, waste and abuse is an epidemic in the American healthcare industry, which when left untreated will result in costly consequences.  The current accepted "treatment" for fraud, waste and abuse is civil and criminal enforcement action, which punishes providers and others who cause unnecessary costs to the healthcare system.  But is punishment the best way to treat and deter undesired conduct? What if there was a way to treat fraud, waste and abuse like there is for a patient at risk for obesity and diabetes?

Corporate compliance programs are akin to the treatment protocols for a patient at risk of obesity and diabetes.  Like patients who are taught to identify and avoid junk food, the compliance program requires providers to undergo education and training to identify and avoid unhealthy conduct.  The compliance program also establishes a system of accountability, requiring providers to document compliance related activities and assess their progress, just as a patient is required to track daily calories and weight.  If properly implemented, the compliance program ensures a long and prosperous career. However, without a compliance program, the provider is at risk of developing a serious and irreversible condition.

Effective corporate compliance programs generally have the following elements:

1. Establishing written standards and procedures to embody compliance expectations;

2. Designation of a "compliance officer" – i.e., an employee vested with responsibility for the day-to-day compliance matters;

3. Training and education on the compliance program, fraud, waste and abuse, expectations and risk areas;

4. Accessible lines of communications between the compliance officer, management and the workforce;

5. Disciplinary policies to encourage good faith participation in the compliance program, but also to punish those who fail to adhere to the compliance program;

6. An accountability system for routine identification of risk areas and self-evaluation;

7. A system for responding to compliance issues with corrective action and policies and procedures to prevent reoccurrence of such issues; and

8. Policies of non-intimidation and non-retaliation for good faith participation in the compliance program (only mandatory in New York).

It is important to understand that an effective compliance program is more than just a pre-drafted binder and manual.  Like a diet book that is not followed and only gathers dust on a book-shelf, a compliance manual is meaningless if it is not followed.  Rather, a compliance program only works if it is properly implemented, which, akin to a diet, requires some effort and sacrifice. 

Providers are encouraged to seek resources and guidance on implementing corporate compliance programs, some of which is available for free.  Healthcare regulators, such as the Office of Inspector General (OIG) for the Department of Health and Human Services, have published several guidance documents on corporate compliance, including comprehensive compliance guidance addressing the risk areas for 

While compliance programs are generally voluntary at present time, providers should be cognizant of any applicable laws that mandate a corporate compliance program. For instance, physicians who bill at least $500,000 to the New York State Medicaid Program are required by law to implement an effective compliance program and certify their adherence to this requirement.  Additionally, enforcement agencies, such as the OIG, may require corporate compliance programs as part of a settlement or resolution to a pre-existing fraud, waste and abuse issue. 

Here are eight elements of an effective corporate compliance program, which can prevent healthcare fraud and abuse before it ever starts. 