Yulian Shtern, Esq.

In the past decade, there has been a steady increase in the number and types of surgical procedures performed in an office-based setting by various practitioners – including general surgeons, gastroenterologists, ophthalmologists, radiologists, dermatologists, podiatrists, dentists and other specialists.  While advances in medical technology have enabled more procedures to be performed in an office setting, patient safety concerns remain crucial and warrant a re-examination of legal and regulatory oversight.  Practitioners performing office-based surgery (OBS) should be familiar with the laws and leading issues associated with OBS procedures.

Although the precise definition varies from state-to-state, an OBS procedure is generally any surgical or diagnostic procedure performed in a physician’s medical office that is invasive or involves subcutaneous penetration, excluding minor surgical procedures.  Most jurisdictions classify procedures as “surgical” or “invasive” by reference to the type and level of sedation or anesthesia used. 

In many states, an OBS medical practice is exempt from licensure requirements that apply to other surgical facilities, such as hospitals or ambulatory surgical centers (ASCs).  Unlike these larger institutional surgical facilities, OBS practices do not have to satisfy the more stringent physical plant, safety and sanitary requirements imposed on the licensed facilities. Accordingly, an OBS medical practice can be located in any structure or suite of rooms established by one or more physicians for the private practice of medicine, but is typically limited to one surgical operating room. 

OBS practices are generally subject to less stringent requirements because  OBS procedures are relatively low risk and do not require the full complement of emergency room equipment and staff on hand in case of patient emergencies, which are mandatory in hospitals and ASCs.  Receiving treatment in the OBS setting may be more efficient and convenient for the patient, especially where risk of an adverse outcome is low, and an overnight stay or a longer recovery time is unnecessary.

States regulate OBS practices to varying degrees.  In some states, such as Massachusetts, an OBS practice is not required to register or obtain facility licensure.  Rather, such practices are regulated by the state medical licensing board, which regulate surgical practitioners’ in the ordinary course of the board’s oversight responsibilities, and a practitioner performing OBS procedures may simply have to check off a box or complete an additional form when renewing his or her license.  In other states, offices performing OBS must register with the state’s department of health or the respective practitioner’s licensing board.  The registration process is intended to provide some degree of oversight and accountability for OBS practices, without subjecting them to full hospital or ASC licensure requirements (e.g., lower or no registration fees and no or fewer state inspections).   The more stringent states, such as New Jersey, will require OBS practices to obtain facility licensure from the state’s department of health under recently enacted statutory amendments, just like an ASC or a hospital (but perhaps with less rigorous requirements as compared to larger facilities). 

States also differ with respect to operational and regulatory requirements, such as surgery time limits, procedure specific limitations (e.g., maximum percentage of body fat removed during liposuction), the level of life support certification required for staff members, additional continuing medical education (CME) requirements (e.g., mandatory CMEs on anesthesia), and credentialing or board certification or eligibility requirements for practitioners.  Some states, such as New York, also require post-procedure incident or adverse event reporting to a state regulatory agency.  Although some states oversee OBS compliance internally (e.g., department of health), many states require or encourage OBS practices to achieve compliance by obtaining registration with the Centers for Medicare & Medicaid Services (CMS) or accreditation from an approved agency. 

While state regulations vary to some degree as to which procedures trigger an accreditation requirement, many states require or encourage OBS practices to obtain accreditation from a private agency (or certification as an ambulatory surgical center from CMS).  Accreditation agencies require OBS practices to satisfy certain operating and office standards, which ensure that procedures are performed in a sanitary and safe manner.  These standards are developed additionally to verify that support staff is qualified, trained and experienced and that anesthesia is administered by a qualified professional, with adequate oversight. 

Accrediting agencies also set forth requirements concerning cleanliness of operating rooms and adequacy of personnel and equipment to respond to emergency situations (e.g., staff members are to be certified with advanced cardiovascular life support training).  Accreditation can be obtained from several agencies, such as the Joint Commission, the American Association for Accreditation of Ambulatory Surgery Facilities (AAAASF) and the Accreditation Association for Ambulatory Health Care (AAAHC). 

Physicians interested in establishing or joining an OBS practice should also determine whether the OBS practice can charge a “facility fee” in addition to the reimbursement paid to physicians for professional services.  OBS practices are not always guaranteed to receive a facility fee – i.e., payment for the use of the physical location and equipment.  While rules and policies governing the payment of facility fees vary from state-to-state, third-party payors often deny payment of a facility fee charged by an OBS practice. 

As such, revenues attributable to OBS procedures may be limited to the professional fee reimbursement for such procedures.  Profits margins will be further limited if the professional fee reimbursement does not adequately cover expenses associated with an OBS practice, such as rent, equipment maintenance, wages for non-profession extenders or technicians (who generally cannot bill for their services), and compliance with regulatory and accreditation requirements. 

Given the broad spectrum of regulation and different requirements applicable to performing OBS procedures across jurisdictions, Physicians interested in or already running OBS practices should carefully navigate through the legal and economic considerations required to perform OBS procedures in their medical offices.

; 973-639-8297) is a Senior Counsel of Epstein Becker & Green, P.C. in the Newark office, and 

; 973.848.7719) is an Associate in the Newark office, of Epstein Becker & Green, P.C., a national law firm with a primary focus on health care and life sciences.
 

Articles

A brief overview of laws and issues related to office based surgical practices.

What You Need to Know About Office-Based Surgery Laws

Electronic healthcare security systems were put to the test in 2016, as record numbers of hospitals, facilities and physician practices fell victim to ransomware attacks.  The increasing number of ransomware attacks on providers is particularly troublesome because hackers can essentially lock out users from their EHR systems.  Once a system is infected, providers feel compelled to pay the ransom rather than sustaining an interruption to patient care.  For these reasons, providers should learn about the risks of ransomware and develop strategies to prevent and manage such malicious cyber-attacks. 

Ransomware refers to malicious software that attempts to deny access to a user's data, usually by encrypting the data in a way that prohibits access until a ransom is paid.  Computer systems affected by ransomware will see ominous messages, indicating that their computer is essentially locked out, except for a web-link that directs the user to pay a ransom to a hacker.  The ransom is usually demanded in Bitcoin or other cryptocurrency and requires the user to access the "dark web" to make the payment.  Hackers promise that upon payment they will release a decryption key, which will restore the user's system.  However, there have been instances where hackers do not honor their promises and instead demand more money.     

In addition to the general problems created by ransomware, healthcare businesses must also consider their obligations under HIPAA and other privacy and security laws.  According to 

 from the Department of Health and Human Services (HHS), the presence of ransomware is a "security incident" under the HIPAA Security Rule and triggers the security incident and response and reporting procedures required under HIPAA. 

HHS guidance also states that any electronic protected health information ("ePHI") that is encrypted by ransomware is presumed a "breach," triggering a covered entity's breach notification obligations.  Although ransomware does not typically distribute or disclose computer files that are held hostage, HHS states that the act of taking possession or control of ePHI by unauthorized individuals constitutes a breach.  HIPAA's breach notification rules can seriously compromise the goodwill and reputation of a provider, as notification to affected individuals, to the Secretary of HHS and to the media (for breaches affecting over 500 individuals) may be required.  The breach notification obligations can only be avoided if the victim of a ransomware attack can demonstrate that there is a "…low probability that the PHI has been compromised," based on the factors set forth in the breach notification rules. 

Preventing ransomware is a complex undertaking, as this particular strain of malware is constantly evolving and infiltrating even those systems that follow recommended security measures.  HHS guidance recommends that providers follow the HIPAA security rule to prevent ransomware infections.  In particular, providers should implement a robust and frequent data backup plan, which would enable providers to restore previous "infection-free" versions of their electronic data.  Providers should also invest in reputable security software (e.g., firewalls, e-mail filters, anti-virus programs) and promptly install updates, which periodically update the software's ability to recognize and detect new ransomware attacks. 

Once a ransomware attack is identified and underway, providers are encouraged to follow a security incident response plan.  According to HHS guidance, this includes conducting an initial analysis, that determines the scope of the attack (what systems were affected?), the origination of the incident, whether the incident is ongoing, finished or spread further throughout a network,  nd analysis of how the incident occurred.  Thereafter, appropriate response activities include containing the infection and preventing propagation of the malware, eradicating instances of ransomware, recover from the ransomware attack by restoring data or backups and conducting post-incident activities that address identified vulnerabilities.    

Providers should also consider reporting the attack to its local FBI or U.S. Secret Service field office. These agencies work with Federal, state, local and international partners to pursue cyber criminals globally and assist victims of cybercrime.  The FBI has also released 

 to help victims of ransomware attacks, which echoes the recommendations set forth in the HHS guidance. 

Physician practices that wish to avoid ransomware attacks should implement robust security incident response protocols.  These protocols should include education and training that helps members of the workforce to identify, prevent and address ransomware attacks. 

, is a health law attorney with Abrams, Fensterman, Fensterman, Eisman, Formato, Ferrara & Wolf, LLP. 

More practices are falling victim to ransomware attacks, where hackers can lock out users from their EHR systems. Here is some guidance around this issue.

Ransomware: What to Do When Your Systems are Hijacked

In reflection on my year during this holiday season, I am grateful for the ability to represent some of the most talented and hard-working physicians in the country.  However, I cannot help but feel compassion for some of the providers who face harsh and seemingly unjust consequences for minor mistakes.  A perfect example is the physician whose Medicare enrollment status is revoked or voided by its regional contractor.

CMS can revoke a provider's billing privileges for a variety of reasons, such as following a provider's conviction for a criminal offense or noncompliance with enrollment requirements.  In effect, the revocation terminates the provider's ability to treat and bill for Medicare patients and precludes the provider from reapplying for Medicare enrollment for a specific period of time.  While revocation is appropriate in certain circumstances, the tool is sometimes used to punish relatively minor mistakes.  In these circumstances, physicians will believe that their local Medicare contractor is staffed by Ebenezer Scrooge or the Grinch.    

An example of the harsh applications of revocation is when a provider uses a P.O. Box address as its practice location.  According to CMS, providers may not indicate a P.O. Box address as their practice location.  A practice location is required to be operational - i.e., if CMS were to inspect the address listed on the Medicare enrollment forms, it would anticipate walking into a medical clinic or office.  Thus, any provider with a P.O. Box practice location in its enrollment forms can be subject to revocation, which can last between one and three years.  Obviously, these providers are not practicing medicine at their local post-offices.  Yet, CMS and Medicare contractors are required to revoke such providers' billing privileges for a seemingly innocuous mistake. 

Worst yet, providers who are revoked by CMS for not having an operational practice location are also unable to bill Medicare for services rendered from the date that CMS determines a location is inactive.  In other words, if CMS or a contractor visits a provider's practice location on Nov. 1 and  determines that it is not operational, the provider cannot bill for services rendered on or after Nov. 1.  However, the provider will not likely receive notice of the revocation until 2-4 weeks after CMS makes its determination. During this delay, the provider may unknowingly be performing weeks of services for which it expects reimbursement from Medicare, only to find out that it will not be paid because of revocation.  This leaves the poor provider blindsided and without sufficient revenues to pay its staff for the holidays. Or in laymen's terms, "Scrooged."

Good luck avoiding Scrooge! I wish all of you the happiest of holidays and a very successful new year. 

Sometimes CMS can unjustly revoke a provider's billing privileges. Here are a few examples. 

The Medicare Contractor Who Stole Christmas

Physicians, among millions of other concerned Americans, are anxious to see how they will be affected by President-elect Donald Trump's cabinet appointments and policy choices.  The transfer of power is particularly nerve-racking in the healthcare industry, given that Trump has been inconsistent with his views on the Affordable Care Act. What can physicians expect during the next four years under President Trump (in addition to the lavish gold "TRUMP" insignia at their local hospital)?

Trump and the Republican-led Congress will certainly and swiftly repeal most or all of the ACA.  However, it is unclear when the repeal will become effective.  The President-elect has promised immediate action, consistent with his fast-paced business practices.  However, House Speaker Paul Ryan indicated that the task of repealing and replacing Obamacare would take up to three years, to avoid prejudice to the 20 million Americans who are relying on coverage obtained via Obamacare.  In any event, physicians in private practice may not see the effects of "repeal and replace" for several years, possibly even after Trump's first term.  

At this time, the substantive effects of "repeal and replace" are difficult to predict.  The respective agendas of Trump's transition team and the Republican Congress are broad and do not comprehensively address policy initiatives focused on physicians and other providers.  The Republican agenda focuses primarily on broad health insurance reform policies, such as legislation that would permit the sale of health insurance across state lines and decrease insurance costs by increasing competition.  While such a law may reduce insurance costs for patients, providers might experience increased administrative burdens and costs in adapting to such an interstate insurance system, particularly if conflicting state laws impose regulatory requirements in addition to any federal regulations.    

Perhaps the most telling policy changes can be inferred in President-elect Trump's appointment of Representative Tom Price as the next Secretary of Health and Human Services ("HHS").  Rep. Price, an orthopedic surgeon for over 20 years, has historically supported policies that would remove the remove the intervention of the state and federal government into the practice of medicine. If Rep. Price will be confirmed by the Senate, he will have broad discretionary authority to change or remove some of the regulations governing providers.  The physician community would most certainly welcome relief of regulatory burdens, which have become increasingly complex and burdensome in recent history.  However, any such policy initiatives may be difficult to implement while simultaneously enforcing Trump's campaign 

 to seek out and eliminate fraud, waste and abuse. 

The incoming Republican-led government is also poised to implement obstacles pertaining to abortion rights. The Republican agenda uniformly supports providing freedom for providers to exercise their conscience with respect to refusing abortion care and preventing federal funds from being used for abortion.  These policies greatly concern the pro-choice lobby, which has decreased barriers to abortion under President Obama's administration.  Providers in obstetrics and gynecology may experience impediments in providing abortion care and we may see an increase of interstate travel by women seeking abortions in neighboring pro-life states.

The first one-hundred days of President Trump's administration will likely result in more answers and more passionate debate about the healthcare policies initiatives that will govern providers for the next 4 years.

What can physicians expect from healthcare policy under President-elect Donald Trump? A look ahead to the next four years.

Author | Yulian Shtern, Esq.

Articles

What You Need to Know About Office-Based Surgery Laws

Ransomware: What to Do When Your Systems are Hijacked

The Medicare Contractor Who Stole Christmas

Will Trump Make Practicing Medicine Great Again?