May – June 2014 Health Law Updates – Florida Bar Health Law Section

Dear Health Law Section Members:

The Section website has been updated with articles on significant developments in the health law arena that may be of interest to you in your practice. These summaries are presented for general information only as a courtesy to Section members and do not constitute legal advice from The Florida Bar or its Health Law Section. On behalf of the Section, I extend my deepest appreciation to the following volunteers who have generously donated their time to prepare these summaries for your review:

Joy Easterwood
Maria D. Garcia
Rodney Johnson
Michael Leeth
Timothy M. Moore
Michael Smith
Monica Rodriguez

Thank you.

Malinda R. Lugo, Esq.

You can download a copy of this month’s update using the links below.

May – June 2014 Health Law Updates (DOCX)

May – June 2014 Health Law Updates (PDF)

Life Sciences

FDA Assessing Efficacy of Rules Regulating Drug Pricing Claims

On May 7, the Food and Drug Administration (FDA) announced that it will study “the impact of price comparison information in direct-to-consumer (DTC) and health care [sic] professional advertising for prescription drugs.” 79 Fed. Reg. 26,255, 26,255 (May 7, 2014).

Currently, prescription drug advertisers may use truthful, non-misleading information about the price of a drug and its competitor. That comparison should include context conveying that the drugs may not have comparable efficacy and safety and that the acquisition costs presented may not show the actual prices paid by consumers, pharmacies, or third-party payers. The FDA is concerned that “adding contextual information about efficacy or safety is not sufficient to correct the impression that the products are interchangeable and that price is the main factor to consider.” 79 Fed. Reg. at 26,256.

To investigate how price comparison and contextual information impact consumers and healthcare providers, the FDA will analyze reactions to one of three versions of an advertisement. Participants will be consumers who self-identified as having a diabetes diagnosis and physicians who are general practitioners or specialists; the FDA will exclude those who work in healthcare or marketing. One version of the advertisement will show price information about only the advertised product. The second version will show a price comparison. The third will show a price comparison and contextual information that the compared drugs may not have comparable efficacy and safety and the acquisition costs may not be the actual prices paid. Physicians will see an advertisement targeting healthcare providers; consumers will see a DTC advertisement. After watching an advertisement, participants will answer a questionnaire concerning the advertisement.

Reported by Timothy M. Moore, Esq.

Compliance

OIG Proposed Rules Expand Exclusions, Waiver Availability, Subpoena Power, and Limitations Period

In a May 9 notice of proposed rulemaking, the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) announced its intention to substantially revise regulations concerning exclusion from federal healthcare programs, waiver of exclusions, investigation of exclusion cases, and time limitations for seeking exclusion. 79 Fed. Reg. 26,810 (May 9, 2014). Many of the revisions are codifications or implementations of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and the Patience Protection and Affordable Care Act of 2010.

Here are some of OIG’s proposed revisions:

New Exclusions

OIG will create a new permissive exclusion for those convicted of obstructing an audit related to (1) any offense described in the mandatory or the permissive exclusion provisions (42 C.F.R. §§ 1001.101 and 1001.201); or (2) the use of federal healthcare program funds whether received directly or indirectly.
OIG will create a new permissive exclusion for those that knowingly make or cause to be made any false statement, omission, or misrepresentation of a material fact in any application, agreement, bid, or contract to participate or enroll as a provider of services or supplier under a federal healthcare program.

New Waiver and Reinstatement Opportunities

OIG, under specific circumstances, will allow early reinstatement for those that OIG excluded because they lost their license due to professional competence, professional performance, or financial integrity. OIG seeks input on methods for providing early reinstatement other than the method OIG proposed in its notice.
OIG will expand waiver availability by allowing (1) administrators of federal healthcare programs to request a waiver; (2) requests to be made on behalf of those excluded under sections 1128(a)(1), (a)(3), or (a)(4) of the Social Security Act; or (3) a waiver if the requesting administrator determines that the exclusion would impose a hardship on any beneficiaries.

Revision of Aggravating and Mitigating Factors

OIG will increase the financial loss aggravating factor to a threshold of $15,000 or more.
OIG will increase the mitigating factor relating to misdemeanor offenses and loss to government programs to a threshold of $5,000 or less. OIG will do the same for the mitigating factor relating to other offenses and loss to government programs.

New Subpoena Authority

OIG may issue testimonial subpoenas during investigations of potential cases involving the exclusion statute.

Statute of Limitations

OIG will codify that exclusions are not subject to a limitations period.

Comments are due by July 8, 2014.

Reported by Timothy M. Moore, Esq.

Changes to Conditions of Participation for Hospitals related to Medical Staff

CMS published a final rule on May 12, 2014 updating the hospital conditions of participation related to the medical staff and the governing body (“Final Rule”). Specifically, the Final Rule addresses (1) the composition of the medical staff and governing body, (2) required consultation between the governing body and medical staff, and (3) requirements for a unified and integrated medical staff for multi-hospital systems. For more information please see: http://www.regulations.gov/#!documentDetail;D=CMS-2013-0019-0393

Reported by Monica Rodriguez, Esq.

OIG Proposes Substantial Reorganization, Clarification, and Expansion of CMP Rules

On May 12, the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) proposed significant revisions to its civil monetary penalty (CMP) rules. 79 Fed. Reg. 27,080 (May 12, 2014). OIG intends to overhaul the CMP rules’ organization, clarify its interpretation or application of various rules, and implement authority it received in the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, the Patience Protection and Affordable Care Act of 2010, and other legislation.

Here are some of the proposed revisions:

New Bases for CMPs, Assessments, and Exclusions

OIG may impose CMPs, assessments, and exclusion for (1) failing to grant OIG timely access to records; (2) ordering or prescribing while excluded; (3) making false statements, omissions, or misrepresentations in an enrollment application; (4) failing to report and return an overpayment; or (5) making or using a false record or statement that is material to a false or fraudulent claim.
OIG may impose CMPs or assessments against a Medicare Advantage or Part D contracting organization when its employees or agents, or any provider or supplier who contracts with it, engages in the conduct described in section 1857(g) of the Social Security Act.

Revisions to Method for Determining Penalty and Assessment Amounts and Exclusion Length

OIG intends to rely upon a non-exhaustive list of five primary factors to determine the amount of a CMP or an assessment and the length of exclusion. Those factors are (1) the nature and circumstances of the violation, (2) the degree of culpability of the person, (3) the history of prior offenses, (4) other wrongful conduct, and (5) other matters as justice may require. OIG will apply those factors to all determinations unless the subpart pertaining to the violation gives other factors.
OIG proposes an alternate methodology for calculating CMPs and assessments for those who (1) arrange or contract with an individual or entity for the provision of items or services for which payment may be made under a federal healthcare program and (2) knew or should have known that individual or entity was excluded from participating in federal healthcare programs.
For separately billable services and items, OIG may impose a CMP for each item or service.
For non-separately-billable services and items, OIG may impose a CMP for each day the CMP respondent employs, contracts, or arranges with the excluded person for a non-separately-billable service or item.
OIG will increase the claims-mitigating circumstance to $5,000.
OIG will make the claims-aggravating circumstance $15,000.
OIG will consider a new aggravating circumstance: whether the respondent’s level of intent to commit the violation was greater than the minimum intent required to establish liability.
OIG will consider corrective action to be a mitigating circumstance only if the respondent used the Self-Disclosure Protocol to disclose the violation to OIG and cooperated fully with OIG.

In this notice of rulemaking, OIG noted its intention to make additional rules concerning “[e]xclusion authorities (42 CFR parts 1000, 1001, 1002, 1006, 1007); inflation adjustment for CMPs (42 CFR part 1003); and safe harbors under the anti-kickback statute, a revised definition of remuneration in part 1003, and a codified gainsharing CMP (42 CFR 1001.952, 42 CFR part 1003).” 79 Fed. Reg. at 27,081.

Reported by Timothy M. Moore, Esq.

Changes to Conditions of Participation for Hospitals related to Medical Staff

Reported by Monica Rodriguez, Esq.

OIG Proposes Substantial Reorganization, Clarification, and Expansion of CMP Rules

Here are some of the proposed revisions:

New Bases for CMPs, Assessments, and Exclusions

OIG may impose CMPs, assessments, and exclusion for (1) failing to grant OIG timely access to records; (2) ordering or prescribing while excluded; (3) making false statements, omissions, or misrepresentations in an enrollment application; (4) failing to report and return an overpayment; or (5) making or using a false record or statement that is material to a false or fraudulent claim.
OIG may impose CMPs or assessments against a Medicare Advantage or Part D contracting organization when its employees or agents, or any provider or supplier who contracts with it, engages in the conduct described in section 1857(g) of the Social Security Act.

Revisions to Method for Determining Penalty and Assessment Amounts and Exclusion Length

OIG intends to rely upon a non-exhaustive list of five primary factors to determine the amount of a CMP or an assessment and the length of exclusion. Those factors are (1) the nature and circumstances of the violation, (2) the degree of culpability of the person, (3) the history of prior offenses, (4) other wrongful conduct, and (5) other matters as justice may require. OIG will apply those factors to all determinations unless the subpart pertaining to the violation gives other factors.
OIG proposes an alternate methodology for calculating CMPs and assessments for those who (1) arrange or contract with an individual or entity for the provision of items or services for which payment may be made under a federal healthcare program and (2) knew or should have known that individual or entity was excluded from participating in federal healthcare programs.
For separately billable services and items, OIG may impose a CMP for each item or service.
For non-separately-billable services and items, OIG may impose a CMP for each day the CMP respondent employs, contracts, or arranges with the excluded person for a non-separately-billable service or item.
OIG will increase the claims-mitigating circumstance to $5,000.
OIG will make the claims-aggravating circumstance $15,000.
OIG will consider a new aggravating circumstance: whether the respondent’s level of intent to commit the violation was greater than the minimum intent required to establish liability.
OIG will consider corrective action to be a mitigating circumstance only if the respondent used the Self-Disclosure Protocol to disclose the violation to OIG and cooperated fully with OIG.

Reported by Timothy M. Moore, Esq.

FACILITY AND PROFESSIONAL LICENSURE

New Telemedicine Regulations Issued by the Florida Board of Medicine

The Florida Board of Medicine issued its “Standards for Telemedicine Practice” as two identical rules for osteopaths (Final Rule 64B15-14.0081) and allopaths (Final Rule 64B8-9.0141). The Board stated that: (i) the standard of care shall be the same whether in person or by telemedicine; (ii) Florida licensed physicians and physician assistants are responsible for the quality of the equipment and technology and its ability to enable them to meet or exceed the prevailing standard of care; (iii) controlled substances shall not be prescribed through telemedicine; (iv) adequate patient confidentiality and recordkeeping must be maintained; and (v) the physician-patient relationship may be established through telemedicine.

Notably, in defining Telemedicine, the Board explicitly excluded “the provision of health care services only through an audio only telephone, email messages, text messages, facsimile transmission, U.S. Mail or other parcel service, or any combination thereof” – signaling to the industry that these early iterations of telemedicine (most commonly, the telephone) isn’t adequate to meet these new standards. Whereas the ability to view the patient by webcam or smartphone would qualify as telemedicine, a mere phone conservation would not.

Further, on May 15 the Board signaled that it proposes to develop a rule amendment to potentially allow controlled substances to be prescribed in the limited circumstance of a hospitalized patient.

Reported by Matthew Leeth, Esq.

The Florida Agency for Health Care Administration (AHCA) Releases List of Recent Licensure Actions Against Medical Providers

AHCA recently released information regarding licensure actions and final orders against medical providers throughout the State of Florida for the month of May 2014. AHCA issued a significant number of final orders for failure to meet licensure requirements. The decisions reached in the final orders are varied, including denials of license renewal applications, revocations and surrendering of existing licenses, and a termination from the Medicaid Program. The sanctioned medical providers include seven entities in Miami-Dade County, two in Broward County and two in Orange County.

AHCA also issued an emergency suspension for The Four Seasons ALF Community, Inc., an assisted living facility (ALF) in Charlotte County, due to survey inspections, which found issues that caused a serious threat to residents.

A list of the specific, sanctioned providers is available at http://ahca.myflorida.com/Executive/Communications/Press_Releases/pdf/MayMonthlyFacilityActions.pdf. You may also find additional information regarding the final orders at http://apps.ahca.myflorida.com/dm_web/(S(jtrnl5fukcfknvhds5vtad1s))/default.aspx.

Reported by Maria D. Garcia, Esq.

Convictions Directly Related to Licensure – Part I

The Board of Clinical Social Work, Marriage and Family Therapy and Mental Health Counseling will soon consider a Recommended Order from the Division of Administrative Hearings that recommends the Board issue a restricted license to a registered mental health counselor intern. Marion J. Gwizdala v. Department of Health, Board of Clinical Social Work, Marriage and Family Therapy and Mental Health Counseling, DOAH Case No. 13-4668 (April 29, 2014). Previously, the Board denied the application of a candidate seeking registration as a mental health counseling interne based upon the candidate’s prior convictions for child molestation in 1976 and 1985. The Administrative Law Judge recommended the Board issue a restricted license to the candidate that would allow the candidate to only treat adult patients. The Recommended Order provides an analysis of what constitutes a conviction related to the practice of a profession. The ALJ explained that a conviction can directly relate to the practice of a profession even when the crime was not committed while practicing the profession, or when the conviction does not directly relate to the ability to practice the profession.

Despite the candidate’s convictions, the ALJ recommended that the Board issue a restricted license to the candidate based in part upon the length of time since the candidate’s convictions, the candidate’s efforts at rehabilitation, the effect of the denial on the candidate’s livelihood, and the candidate’s involvement in community service. The Department of Health filed exceptions to the Recommended Order.

Submitted by Michael L. Smith, Esq.

Convictions Directly Related to Licensure Part II

The Board of Pharmacy will be considering a Recommended Order from the Division of Administrative Hearings that recommends the Board revoke the license of a pharmacist. Department of Health Board of Pharmacy v. Christopher Stephen Switlyk, R.Ph., DOAH Case No. 14-0883PL (June 23, 2014). The pharmacist pleaded guilty to one count of conspiring to violate 21 U.S.C. Sections 841(a)(1), 843(a)(2), 843(a)(3), and 856(a)(1). The pharmacist was charged with allowing his pharmacy to fill and dispense more than one million doses of Schedule II controlled substances based upon illegal prescriptions. The pharmacist claims that he should not have pled guilty and is seeking to have the conviction vacated or his sentence reduced. Not surprisingly, the Administrative Law Judge found the convictions were related to the pharmacist’s practice of his profession.

Submitted by Michael L. Smith, Esq.

Altered Medical Records Creates Inference That Practitioner Conscious Of Guilt

A physician was found to have altered a patient’s medical record with exculpatory evidence after the patient died, and it appeared a medical malpractice suit would be filed. Department of Health Board of Medicine v. Peter V. Choy, M.D., DOAH Case No. 13-4280 PL (April 15, 2014). The Recommended Order details numerous alterations the physician made in the medical record after questions were raised regarding the physician’s care of the patient. The Administrative Law Judge found the physician’s alteration of the record allowed the ALJ to infer that the physician was hiding something and conscious of his guilt. The ALJ found that the physician made deceptive, untrue and fraudulent representations in the practice of medicine by deliberately altering the patient record. The ALJ recommended that the Board revoke the license of the physician, which was within the penalty guidelines of the Board for the violations charged.

Submitted by Michael L. Smith, Esq.

Health Information Technology & Privacy

Legislative Update: The Florida Information Protection Act

On June 20, 2014, Governor Scott signed into law a complete overhaul of the Florida Information Protection Act (“FIPA”). Some of the highlights include:

An expansion of the definition of “Personal Information” to include an individual’s first name or first initial and last name in combination with an individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
The definition of “Personal Information” also includes a user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.
The notice requirements for a breach of security expand beyond notice to impacted individuals, and now require notice directly to Florida’s Department of Legal Affairs (DLA) for any breach affecting 500 or more individuals in the State of Florida, as expeditiously as possible, but no later than thirty (30) days after the determination of a breach or reason to believe a breach has occurred. Additionally, FIPA goes further to provide that upon the DLA’s request, the Covered Entity must provide:
Police report, incident report, or computer forensics report.
A copy of the policies in place regarding breaches.
Steps taken to rectify the breach.
Notice to impacted individuals must be made as expeditiously as practicable and without unreasonable delay, but no later than thirty (30) days after the determination of a breach or reason to believe a breach has occurred.
In the event of a breach of security of a system maintained by a Third-Party Agent, FIPA specifically requires notification to the impacted Covered Entity as expeditiously as practicable, but no later than ten (10) days following the determination of the breach or reason to believe breach occurred.
In order to rely on a risk of harm analysis when determining that notice is not required, a Covered Entity must first consult with local law enforcement agencies. Thereafter, any determination that notice is not required must be provided in writing to the DLA within thirty (30) days of such a determination.
Reasonable measures to protect and secure data in electronic form containing Personal Information are required of Covered Entities and Third-Party Agents. Each Covered Entity and Third-Party Agent must also take all reasonable steps to dispose, or arrange for the disposal, of customer records containing Personal Information within its custody or control when records are no longer to be retained by way of shredding, erasing, or otherwise modifying Personal Information in the records to make it unreadable or undecipherable through any means.

Reported by Joy Easterwood, Esq.

OCR Issues Reports to Congress

The U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”), issued two Reports to Congress. The Reports include details on reported breaches and HIPAA Privacy, Security, and Breach Notification Rule Compliance in calendar years 2011 and 2012. The Reports, along with the prior Reports, can be found at http://www.hhs.gov/ocr/privacy/hitechrepts.html.

Reported by Joy Easterwood, Esq.

Data Breach Results in Largest Settlement to Date

On May 7, 2014, the OCR announced that two health care organizations agreed to settle charges that they potentially violated the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy and Security Rules by failing to secure thousands of patients’ electronic protected health information (“ePHI”) held on their network. The monetary payments of $4,800,000 include the largest HIPAA settlement to date.

The settlement arose from a joint breach report filed by New York and Presbyterian Hospital (“NYP”) and Columbia University (“CU”) in September of 2010, related to a joint arrangement wherein NYP and CU operate a shared data network and a shared network firewall that is administered by employees of both entities. The shared network links to NYP patient information systems containing ePHI.

The breach was discovered when a complaint was received from an individual who found the ePHI of their deceased partner on the internet. The OCR announced that because of a lack of technical safeguards, deactivation of the server by a physician resulted in ePHI being accessible on internet search engines.

The OCR cited other findings, including that,

Neither NYP nor CU made efforts prior to the breach to assure that the server was secure and that it contained appropriate software protections.
Neither entity had conducted an accurate and thorough risk analysis that identified all systems that access NYP ePHI.
Neither entity had developed an adequate risk management plan that addressed the potential threats and hazards to the security of ePHI.
NYP failed to implement appropriate policies and procedures for authorizing access to its databases and failed to comply with its own policies on information access management.

This settlement provides a great reminder that when entities participate in joint arrangements of this sort, the OCR expects them to share the burden of addressing the risks to protected health information.

$3,300,000 of the settlement was paid by NYP and $1,500,000 was paid by CU. Both entities agreed to corrective action plans, which include undertaking a risk analysis, developing a risk management plan, revising policies and procedures, training staff, and providing progress reports.

The New York and Presbyterian Hospital Resolution Agreement may be found at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/ny-and-presbyterian-hospital-settlement-agreement.pdf

The Columbia University Resolution Agreement may be found at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/columbia-university-resolution-agreement.pdf

Reported by Joy Easterwood, Esq.

OCR Audits to Begin in the Fall

Earlier this year, the OCR announced their new audit protocol that will begin in the fall of 2014. As with the previous audits, Covered Entities will receive a notification and data request from the OCR. However, this time Business Associates will also be part of the ongoing and permanent audit program, with Business Associate audits expected to begin in 2015. Unlike the pilot audits, the audits will be conducted by OCR personnel rather than a third party.

The next round of audits is expected to include 350 Covered Entities and 50 Business Associates. 1200 organizations (800 Covered Entities and 400 Business Associates) have, or soon will, receive pre-audit surveys from the OCR.These audits are expected to target compliance with HIPAA privacy and security standards, as well as adherence to breach notification rules and regulations.

Reported by Joy Easterwood, Esq.

Public Health

Hospital Legal Preparedness Resources

The Public Health Law Program’s http://www.cdc.gov/phlp/news/current.html#legal2“>Hospital Legal Preparedness: Relevant Resources (http://www.cdc.gov/phlp/publications/topic/hospital.html) compiles CDC and external resources to help hospitals to consider the law when they prepare for and respond to emergencies.

CDC Public Health Law Program announces the publication of three accountable care resources describing accountable care frameworks and the legal provisions that support them. These resources can help practitioners understand how accountable care might impact public health and engage with accountable care entities in their jurisdictions.

Reported by Rodney Johnson, Esq.

Miscellaneous

Class Action Lawsuit on Copying Charges for Medical Records

The Thirteenth Judicial Circuit allowed a class action case to continue against a company that charged $1.00 per page for records for attorneys instead of $1.00 per page for the first 25 pages and 25 cents thereafter. See Allen v. Healthport Technologies, Case No. 12-CA-013154, Hillsborough County, Florida.

Reported by Monica Rodriguez, Esq.

HHS to End Fix Indemnity Coverage on Standalone Basis

On March 24, 2014 HHS published in the Federal Register a Proposed Rule establishing HHS’s desire to treat fixed indemnity insurance as an excepted benefit in the individual health insurance market. This would require that fixed indemnity insurance be sold only supplemental to health insurance that qualifies as minimum essential coverage. Fixed indemnity coverage, which pays the insured a fixed benefit for a health-related occurrence (e.g. visiting doctor or having an x-ray performed) irrespective of the amount charged by the provider. This new regulation would prohibit carriers nationwide from offering these policies to individuals without first verifying that the insured has obtained minimum essential coverage as defined by the PPACA.

Despite numerous negative comments submitted by carriers, agencies, lawyers, consumer protection groups, and even a few state regulators, the rule was made final May 16, 2014. HHS disagreed with these commenters, which cited concern, among other things, over (i) HHS’s statutory authority in the matter, (ii) the limitation of consumer choice, and (iii) the potential for constitutional challenge. HHS reiterated that it sought to address “stakeholder concerns” regarding the perceived marketing practices of fixed indemnity products to individuals without major medical coverage. Under the Final Rule, HHS will require carriers (or their agents, where appropriate) receive reasonable assurances from the Insured that they have a health plan providing minimum essential coverage prior to purchasing a fixed indemnity health policy. This requirement is slated to begin for policies issued on or after January 1, 2015, and for previously-issued policies, upon their first renewal occurring on or after October 1, 2016.

Reported by Matthew Leeth, Esq.

Florida State Senate Bill 1036 Set to Become Law Effective July 1, 2014

Senate Bill 1036 passed during the recent 2014 legislative session. The bill mainly addresses nursing education programs, and it will become law on July 1, 2014, as Chapter 2014-92, Laws of Florida. The new law will update regulations on licensure by examination, nursing programs’ curriculum and requirements for training programs. For example, it will require graduates of approved pre-licensure nursing education programs who do not take the licensure examination within a specified period after graduation to complete a licensure examination preparatory course, as specified under Florida law.

The bill language is available at http://laws.flrules.org/2014/92.

Reported by Maria D. Garcia, Esq.