It was a busy April for the Office for Civil Rights (“OCR”) (see our prior post on a settlement from earlier in April). On April 20, OCR announced a Resolution Agreement with Center for Children’s Digestive Health, S.C. (“CCDH”) related to CCDH’s failure to enter into a business associate agreement with a paper medical records storage vendor. The cost of that missing agreement? $31,000. Then, on April 24, OCR announced a settlement with CardioNet, a remote monitoring company for cardiac arrhythmias, related to CardioNet’s failure to implement compliant HIPAA policies and procedures and failure to conduct a sufficient risk assessment. The price of those failures? $2.5 million! Continue Reading Two HIPAA Mistakes Lead to Fines from OCR
Earlier this week, the HHS Office for Civil Rights (“OCR”) announced a $400,000 settlement with Metro Community Provider Network (“MCPN”) related to a 2012 HIPAA breach caused by a phishing scam. The phishing scam, carried out by accessing MCPN employees’ email accounts, gave a hacker access to the electronic protected health information (“ePHI”) of 3,200 individuals. In investigating the breach, OCR determined that, prior to the breach, MCPN had not conducted a security risk analysis (a requirement under HIPAA). Further, OCR found that even after MCPN conducted a risk analysis, its analysis was insufficient to meet the requirements of the HIPAA Security Rule.
In addition to the $400,000 fine, MCPN agreed to a corrective action plan with OCR. That plan requires MCPN to conduct a comprehensive risk analysis and to submit a written report on the risk analysis to OCR. Additionally, MCPN will be required to develop an organization-wide risk management plan, to review and revise its Security Rule policies and procedures, to review and revise its Security Rule training materials, and to report to OCR any instance of a workforce member failing to comply with its Security Rule policies and procedures. Continue Reading Gone Phishin’: Hack Leads to HIPAA Settlement
On Wednesday, March 8, James B. Comey, Director of the FBI, was at Boston College to deliver the keynote address for the inaugural Boston Conference on Cyber Security (BCCS 2017). Director Comey addressed various industry, cyber security, FBI, law enforcement and military experts in attendance regarding current cyber threats to both industry and government assets and the FBI’s approach to confronting them. During his remarks, Director Comey was asked to opine on the biggest cyber threat to healthcare providers, to which Comey quickly responded, “ransomware.” Continue Reading Advice to Healthcare Providers on Ransomware from the Head of the FBI
The Massachusetts Department of Public Health (DPH) Determination of Need (DoN) Program has promulgated final DoN regulations (shown here compared against the draft revisions.) Approved by the Massachusetts Public Health Council (PHC) on January 11, 2017, DPH anticipates that the DoN regulations (105 CMR 100.000, et seq.) will be published in the Massachusetts Register on January 27, 2017, which will be their effective date.
Commissioner Monica Bharel, M.D., MPH emphasized that the overarching goal of these revisions is to meaningfully infuse public health and population health principles within this longstanding health care regulation. The Commissioner noted that it is her belief that successful cost containment must occur in the context of tackling social determinants of health. Our previous blog post, published at the time the draft revisions were presented to the PHC, reviews in some detail the DoN Program’s public policy goals underpinning these revisions, and we refer you to that post for more information.
At the presentation of the draft revisions to the PHC on August 23, 2016, DPH announced its intent to solicit and encourage robust public comment, and the public did not disappoint. A January 11, 2017 memorandum from senior DPH staff to Commissioner Bharel and members of the PHC requesting approval of the final proposed DoN regulations stated that DPH received over 100 comments, submitted at two public hearings and in writing during the 45-day public comment period. The memorandum summarizes not only the comments received, but the stakeholders who submitted the comments and DPH’s public policy rationale for its reaction to many of the comments. Materials (available here and here) accompanying the presentation of the final proposed DoN regulations also summarize the draft revisions, comments received and final proposed DoN regulations.
Many comments addressed the requirements for DoN review of ambulatory surgery, transfer of ownership, Community Health Initiative (CHI) projects, as well as application requirements, review process and criteria, and standard conditions. Two areas that generated many of the public comments, and which resulted in adjustments to the proposed DoN regulations, are discussed below. Continue Reading Massachusetts Determination of Need Program – Final Regulations
Massachusetts Long Term Care Facility Regulations – Proposed Amendments
The Massachusetts Department of Public Health (DPH) continues its efforts to revise its regulations to comply with Executive Order 562, which requires all state agencies to review its regulations. Long-Term Care Facilities (LTCFs) must currently comply with 3 separate regulations: 105 CMR 150.00 (Licensing of Long-Term Care Facilities); 105 CMR 151.000 (General Standards of Construction for LTCFs in Massachusetts); and 105 CMR 153.000 (Licensure Procedure and Suitability Requirements for LTCFs). (Note: these links will bring you to DPH’s redlined versions, where applicable. The corresponding presentations by DPH staff to the Public Health Council (PHC) at the PHC’s November 9, 2016 meeting are available here.) Continue Reading Massachusetts Long Term Care Facility Regulations – Proposed Amendments
At yesterday’s Public Health Council meeting, the Massachusetts Department of Public Health (DPH) released yet another round of proposed regulatory amendments. On deck were regulations concerning Long Term Care Facilities, Hospice Programs, and Temporary Nursing Service Agencies, as well as requirements for Training of Nurses’ Aides in Long-Term Care Facilities. Also presented were updated regulations on the Drug Formulary Commission (formerly List of Interchangeable Drug Products regulations). Senior DPH staff presented the proposed regulations, highlighting key objectives. Council members were highly engaged in the discussions, asking numerous questions and offering comments. Commissioner Monica Bharel, MD, MPH, commended DPH staff for their hard work on the amendments and the Council for its support of these ongoing efforts. Continue Reading Massachusetts Regulatory Overhaul Continues
Continuing our current coverage of health policy issues and trends, Mintz Levin’s Health Law Practice and ML Strategies have issued a joint Alert regarding the Massachusetts Health Policy Commission’s Annual Cost Trends Hearings. The hearings, which took place on October 17 and 18, provided an opportunity for a wide-ranging discussion of the Commonwealth’s health care system and its rising costs. The Alert highlights the topics covered over the course of the hearing, and summarizes the points made by the academic, industry, and political leaders who participated. Many of these topics, including pharmaceutical spending, behavioral health, and alternative payment models, are at the core of emerging health policy discussions across the country. You can read the full alert here.
The Centers for Medicare & Medicaid Services (CMS) recently released its final rule overhauling long-term care (LTC) facility participation requirements for Medicare and Medicaid (“Final Rule”). This much anticipated rule represents the first major update of these regulations in 25 years – setting new staffing, patient protections, and compliance requirements for LTC facilities. CMS estimates that these changes will not necessarily be inexpensive for facilities, costing an average of $62,900 per facility in the first year and $55,000 in each subsequent year. In response to the estimated financial burden and the complexity of the Final Rule, CMS has adopted a phased approach for the rollout, spreading out implementation of the various requirements over the next three years. The implementation dates are November 28, 2016 for Phase 1, November 28, 2017 for Phase 2, and November 28, 2018 for Phase 3. The three phases have been categorized based on CMS’s assessment of each revision’s complexity and the extent to which interpretive guidance and survey processes will need to be revised.
We highlight key provisions of the Final Rule below:
Prohibition against Pre-Dispute Binding Arbitration Agreements
In an effort to strengthen resident rights, under the Final Rule, CMS will prohibit LTC facilities from entering into pre-dispute binding arbitration agreements with residents or their legal representatives. While the initial Proposed Rule set forth specific criteria to be met by LTC providers seeking to make use of pre-dispute binding arbitration agreements, the Final Rule bans them altogether. CMS cites doubts about residents’ ability to understand the implications of such agreements as well as concerns about the arbitration process in general. In response to comments regarding CMS’s legal authority to ban arbitration agreements, the agency clarified that the Final Rule would have no effect on existing pre-dispute arbitration agreements between LTC facilities and residents, and that any such existing agreements could still be enforced. The prohibition against pre-dispute binding arbitration agreements is included in Phase 1. Continue Reading CMS releases Final Rule Overhauling Long-Term Care Facility Requirements
The Massachusetts Department of Public Health (DPH) has released for public comment proposed amendments to DPH’s Medical Marijuana Regulations (105 CMR 725) (the “regulations”). DPH believes that the proposed amendments will streamline the Medical Use of Marijuana Program (the “Program”) by updating existing processes, providing additional clarity, and creating consistency with changes made to related laws, all with the goal of promoting patient access while assuring public safety is maintained. At a meeting of the Public Health Council (PHC) held on September 14, 2016, DPH representatives, including Program Director Bryan Harter, MBA, LICSW, presented the proposed amendments. DPH’s presentation to the PHC at the meeting includes a summary of the proposed amendments, as well as a brief history of the Program, including applications received, provisional Certificates of Registration to operate a Registered Marijuana Dispensary (RMD) (41), and number of RMDs currently open and dispensing marijuana for medical use (7).
Amendments are undoubtedly necessary. The current regulations, which became effective on May 24, 2013, were implemented in connection the creation of the Program, and DPH now has the benefit of experience with the RMD process to amend its regulations to reflect, in some cases, lessons learned. As with proposed amendments to other regulations (see our prior posts here and here), these amendments are also necessary to comply with Governor Baker’s Executive Order 562, which directed all executive branch state agencies to review and, where possible, streamline, simplify and improve their regulations. Continue Reading Medical Marijuana in Massachusetts – DPH Proposes Amendments to Regulations
The civil monetary penalties for violations of myriad health care laws continue to rise. In June, we discussed the enormous increase in penalties under the federal False Claims Act (“FCA”). Through an interim final rule, the Department of Justice nearly doubled the per-claim FCA penalty. The minimum per-claim FCA penalty increased from $5,500 to $10,781 and the maximum per-claim FCA penalty increased from $11,000 to $21,563. The FCA penalties nearly doubled because the Federal Civil Penalties Inflation Adjustment Act of 2015 (the “2015 Adjustment Act”) required federal agencies to update civil monetary penalties (“CMPs”) within their jurisdiction by August 1, 2016 to catch-up with inflation.
Because of the 2015 Adjustment Act, numerous other CMPs—in addition to the FCA—recently have increased or likely will increase. Continue Reading Penalties For Health Care Law Violations Surge