Health Law Monitor

OCR's Strict HIPAA Enforcement Trend Continues

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights’ (OCR) is continuing with its recent trend towards stricter enforcement for violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.  Increased enforcement actions have followed OCR investigations, most recently arising from a breach reported under the Health Information Technology for Economic and Clinical Health (HITECH) Act’s breach notification rule. 

In March, Blue Cross Blue Shield of Tennessee (BCBST) agreed to pay a $1.5 million settlement related to potential violations of the HIPAA Privacy and Security Rules.  This settlement resulted from a BCBST breach report that 57 unencrypted computer hard drives containing protected health information of over one million individuals were stolen from a leased facility in Tennessee.  The OCR investigation revealed that BCBST had failed to implement appropriate administrative safeguards to adequately protect its health information by failing to perform the required security evaluation, and had failed to implement appropriate physical safeguards.  In addition to the monetary settlement, BCBST agreed to implement a corrective action plan addressing gaps in HIPAA compliance; to review, revise, and maintain its Privacy and Security Policies and Procedures; to conduct regular and robust training for employees; and to perform monitor reviews to ensure compliance with the corrective action plan. 

A more recent example of this strict enforcement involved a physician practice’s agreement to pay a $100,000.00 fine and implement a corrective action plan under a Resolution Agreement with the OCR.  Phoenix Cardiac Surgery, P.C., agreed to the terms of the Resolution Agreement following the OCR’s investigation of its practice of posting clinical and surgical appointments on a publicly accessible internet-based calendar. OCR initiated the investigation after receiving a complaint alleging that the practice impermissibly disclosed electronic protected health information by making it publically available on the internet.  The OCR found that Phoenix Cardiac Surgery had failed to implement sufficient policies and procedures to adequately protect patient information.  Further, OCR determined that Phoenix Cardiac Surgery had inadequately documented employee training with respect to Privacy and Security Rules, and failed to identify a security official, conduct a risk analysis, or obtain satisfactory assurances in Business Associate Agreements with internet-based calendar and email providers.  The Resolution Agreement made clear that vendors who store and transmit patient information are business associates and must comply with the HIPAA Privacy and Security Rules.  Health care providers should therefore verify that they have Business Associate Agreements in place for these types of services. 

Covered entities should expect an OCR follow-up investigation after any major reporting of a breach. Those that wish to minimize their exposure to future enforcement sanctions should evaluate their policies and procedures, risk assessments, documentation (including Business Associate Agreements), and employee compliance training on HIPAA related issues at their earliest opportunity.

West Virginia Legislature Enacts Comprehensive Substance Abuse Laws

On March 29, 2012, Governor Earl Ray Tomblin signed into law Senate Bill 437, generally Relating to Substance Abuse.  SB 437 was passed on March 10, 2012 and becomes effective 90 days from passage.   This law is one of the most comprehensive approaches taken in recent history to address the prescription drug diversion and substance abuse related problems in West Virginia.  

The purpose of this posting is to provide a summary of the changes made by the new law.  It is still unclear as to how the new law will be interpreted and applied.  Any person or entity subject to these provisions of law should seek guidance from experienced health law counsel. 

The new law contains five main areas of focus:

1. Adds additional regulation of opioid treatment centers (Methadone Clinics); 
2. Establishes licensing and regulation of chronic pain clinics;
3. Establishes review capabilities of the Controlled Substances Database under the Board of Pharmacy to flag abnormal or unusual usage patterns of controlled substances by patients and unusual prescribing or dispensing patterns by licensed practitioners; 
4. Implements a requirement for continued medical education for physicians and continued education for all other prescribers, dispensers and persons who administer controlled substances; and 
5. Establishes a requirement for pharmacies to utilize a Multi-State Real-Time Tracking System to track sales of pseudoephedrine, and limits the amount allowed to be legally purchased daily (3.6g), monthly (7.3g), and annually (48g)

1.  Additional Regulation of Opioid Treatment Centers (Methadone Clinics).

 The new law modifies W. Va. Code §16-1-4 and adds additional requirements for opioid treatment centers (OTC) including:

• Requiring all staff working or volunteering at an OTC to complete minimum educational, reporting and safety training criteria established by the secretary of DHHR; 
• Requiring individualized treatment of care plans to include a recovery model; 
• Clarifying that within the detoxification protocol, the strength of maintenance doses of methadone should decrease over time, be limited to a defined period of time, and require participants to work towards a drug-free lifestyle; 
• Requiring semi-annual reports from OTC’s to DHHR to include whether discharge from program was based on successful completion; 
• Requiring random drug testing of all patients to be conducted at least monthly; 
• Adding marijuana and similar substances to the list of drugs to test for when drug testing patients; 
• Providing mandatory weekly counseling no less than thirty minutes upon a positive drug test; 
• Adding an exception to discharging a patient from the program upon a fourth positive drug test within a six month period if the patient tests positive solely for marijuana or other similar substances; 
• Requiring a licensed health care professional [as defined in rules by DHHR] to be present and on duty at the OTC and a physician to be on-call for consultation; 
• Requiring  a check of the Controlled Substances Monitoring Program (CSMP) database for physician treating patients in an OTC at specified times including: at patient’s intake; after initial 30 days treatment, and; prior to any take-home medication being granted; 
• Requiring results obtained from the CSMP to be maintained with the patient records; 
• Requiring each OTC to establish a peer review committee for reviewing whether the program is following national guidelines and submitting the results of the review quarterly to DHHR.

 2.  Creates the Chronic Pain Licensing Act

The law establishes a new code section, W. Va. Code §15-5H-3, et seq., which requires all pain management clinics to be licensed by the DHHR.  Licenses shall expire one year from date of issuance and all pain management clinics are subject to periodic inspection by DHHR.

• Pain Management Clinicis defined as: All privately owned pain management clinics, facilities or offices not otherwise exempted from this article and which meet both of the following criteria: (1) where in any month more than 50 percent of patients are prescribed or dispensed opioids or other controlled substances specified in rules promulgated pursuant to this article for chronic pain resulting from non-malignant conditions; (2) the facility meets any other identifying criteria established by the [DHHR] secretary by rule.                                                    
• Chronic Painis defined as: Pain that has persisted after reasonable medical efforts have been made to relieve the pain or cure its cause and that has continued, either continuously or episodically, for longer than three continuous months.  For purposes of this article, “chronic pain” does not include pain associated with a terminal condition or with a progressive disease that, in the normal course of progression, may reasonably be expected to result in a terminal condition. 

The following practices and facilities are EXEMPTED from this Act:

• A facility that is affiliated with an accredited medical school at which training is provided for medical or osteopathic students, residents or fellows, podiatrists, dentists, nurses, physician assistants, veterinarians or any affiliated facility to the extent that it participates in the provision or instruction; 
• A facility that does not prescribe or dispense controlled substances for the treatment of chronic pain; 
• A hospital licensed in this state, a facility located on the campus of a licensed hospital that is owned, operated or controlled by that licensed hospital, and an ambulatory health care facility as defined by W. Va. Code §16-2D-2,  that is owned, operated or controlled by a hospital; 
• A physician practice owned or controlled, in whole or in part, by a licensed hospital or by an entity that owns or controls, in whole or in part, one or more licensed hospitals; 
• A hospice program licensed in this state; 
• A nursing home licensed in this state; 
• An ambulatory surgical facility as defined by W. Va. Code §16-2D-2; and 
• A facility conducting clinical research that may use controlled substances in studies approved by a hospital-based institutional review board or an institutional review board accredited by the association for the accreditation of human research protection program.

 Operational Requirements for pain management clinics (clinic) established by this Act include:

• The clinic must be licensed with DHHR, the Secretary of State and the State Tax Department; 
• At least one owner must be an actively licensed physician; 
• Each clinic must designate a physician owner to practice at the clinic and be responsible for operation of the clinic, and supervise all staff; 
• No owner or other person associated with the clinic may have a felony conviction; 
• Criminal background checks must be performed; 
• Each clinic location must be licensed separately; 
• No prescriber may be an owner or employee of a licensed clinic if the prescriber has ever had his or her DEA number revoked, has been denied a license to prescribe or dispense controlled substances denied or has been convicted of a felony;  
• Dispensing in a clinic is allowed only by physicians and pharmacists, and only for a 72 hour supply; 
• Prior to dispensing or prescribing a controlled substance, the treating physician must access the CSMP.  If treatment is ongoing the physician must access the CSMP at each patient examination or at least every 90 days; 
• Sets forth requirements for documentation and recordkeeping; 
• A physical examination of the patient must occur on the same day the physician prescribes, dispenses or administers a controlled substance to the patient and at least 4 times a year thereafter.

Monetary fines for noncompliance are as high as $20,000 for a physician who knowingly operates an unlicensed pain management clinic.

Advertising regulations are established requiring at a minimum the identification of one physician owner responsible for the content of the advertisement for the clinic. 

3.  Changes and Modifications relating to the Controlled Substances Monitoring Program database

 A.  New information reported to the Controlled Substances Database:

The following additional information must be reported to the CSMP: name of the dispensing physician or dentist; full legal name of the patient; full legal name, birth date and address of person picking up the prescription if other than the patient; and the source of payment. 

There is a clarification that reporting is required for controlled substances (Schedules II, III and IV) which are dispensed by a practitioner. Dispensing is limited to a 72 hour duration. 

Prior to dispensing a controlled substance sold at retail, a pharmacist must verify the full legal name, address and date of birth of the person receiving the drug through the presentation of a government-issued photo ID.

B.  Controlled Substances Database Law Modified:

The CSMP is clarified as being confidential and not subject to the West Virginia Freedom of Information Act.  It shall also not be obtainable as discovery in civil matters absent a court order.

There is a clarification that law enforcement having access to the CSMP information must be a member of a federally affiliated drug task force, be certified as a West Virginia law enforcement officer, have completed DEA diversion training and have completed National Association of Drug Diversion Investigation Training.  The dispensing of Schedules II, III, and IV controlled substances must be reported to the Board of Pharmacy within 24-hours (current law is 7 days).

The law establishes an Advisory Board to be appointed by the Board of Pharmacy comprised of physicians and pharmacists.  The Advisory Board is charged to: “develop, implement, and recommend parameters to be used in identifying abnormal or unusual usage patterns of patients in the state; make recommendations for training, research and other areas to have the potential to reduce inappropriate use; monitor the ability of medical providers to meet the 24-hour reporting requirement; and, establish educational outreach programs with law enforcement.”

The Board of Pharmacy is charged with sending reports of patients that fall outside the parameters established by the Advisory Committee to their physicians.

The law establishes a Database Review Committee to be appointed by the Board of Pharmacy to “query the database based on parameters established by the advisory committee”. This review committee may make determinations on a case-by-case basis on specific unusual prescribing or dispensing patterns, or abnormal or unusual usage patterns of controlled substances by patients.  The Review Committee may, based upon reasonable cause, refer matters to law enforcement or the licensing board having jurisdiction over the prescribers or dispensers under consideration.  The Review Committee consists of two prosecutors, two physicians and one pharmacist.  An additional physician may be appointed on a case-by-case basis.

The state’s chief medical officer is required to report to the Review Committee information regarding any person who has died from a drug overdose.

C.  Prescribers and dispensers granted immunity for reporting suspected doctor shoppers.

Any prescriber or dispenser may notify law enforcement of a patient who, in his or her judgment, is potentially a doctor shopper.  The prescribing practitioner or dispenser is immune from any civil, administrative or criminal liability if the notification is made in good faith.

D.  Requirement to check the Controlled Substances database:

All prescribers and dispensers are required to check the CSMP upon initially prescribing or dispensing a pain relieving controlled substance to a patient (who is not suffering from a terminal illness) for chronic nonmalignant pain.  They are required to check the CSMP annually thereafter.

Any prescriber or dispenser who is required to check the CSMP and fails to do so shall be disciplined by their licensing board as such board deems appropriate.

E.  Felony for unauthorized use or disclosure of the Controlled Substances database:

Unauthorized access, use or disclosure of information in the CSMP for reasons unrelated to the purposes of the law is a felony punishable by imprisonment in a state correctional facility for not less than one year nor more than five years, or by fines of not less than $3,000 nor more than $10,000, or both. 

4.  Requirement for continuing medical education

As provided in W. Va. Code §30-1-7a, the current requirement of 2 hours of continuing education in “end of life care and pain management” required for those licensed by the Boards of Medicine, Dental Examiners, Osteopathy, Registered Professional Nurses, Optometry and Pharmacy is being deleted from law.  A new requirement is created for “drug diversion training” and “best practices for prescribing of controlled substances training” to be done every licensure cycle. Only those who prescribe, dispense or administer controlled substances are required to take the training.

5.  Regulation of the sale of pseudoephedrine products at retail pharmacies

Products containing pseudoephedrine are currently required to be sold from behind the counter and personal information regarding the purchaser is required to be reported to the Board of Pharmacy.  The new law requires that all pharmacies now utilize a“multi-state real-time tracking system” to determine if an individual has purchased their limit of such products (some pharmacies voluntarily do this now). 

Current federal regulations limit the sale of pseudoephedrine to 9 grams per month.  Further state limitations are placed on the sale of the drug at: 3.6 grams per day, 7.2 grams monthly and 48 grams annually. These limits do not apply to prescription products containing pseudoephedrine.

Violations for any pharmacy or wholesaler are established as a misdemeanor. 

Pharmacists are required to offer patient counseling to improve proper use and discuss contraindications.

Information regarding pseudoephedrine product purchases shall be disclosed to DEA agents, local law enforcement, and the WV State Police.

To Report or Not Report? CMS' Proposed Rule Provides Guidance on Overpayments

A rule proposed by The Centers for Medicare and Medicaid Services (CMS) that would implement the Patient Protection and Affordable Care Act’s (ACA) overpayment requirements was published in the Federal Register on February 16, 2012.  Section 6402 of the ACA amends the Social Security Act to include a new section, 1128J(d), requiring providers or suppliers of services under Medicare or Medicaid to report and return “overpayments” within 60 days from the date the overpayment was identified or the date any corresponding cost report is due, whichever is later.¹  The knowing and improper failure to return overpayments is subject to federal False Claims Act liability, potentially exposing the provider or supplier to penalties and treble damages.

CMS Announces Cut in Physician Reimbursement Rates and Changes to Supervision Requirements for Outpatient Services

CMS issued the 2011 Medicare Physician Fee Schedule final rule, which cuts physician reimbursement by 24.9% between November 2010 and January 2011. Additionally, CMS recently released its 2011 Outpatient Prospective Payment System final rule setting forth several changes to physician supervision requirements for hospital outpatient services to take effect on January 1, 2011.

Health Care Reform Whitepaper: New IRS Mandates for Charitable Hospitals

 

    Under prior law, charitable hospitals established tax-exemption under Internal Revenue Code (“IRC”) § 501(c)(3) by providing a community benefit. Most hospitals established a community benefit by providing health care regardless of a patient’s ability to pay (including payment through Medicare or Medicaid), by providing charitable (unreimbursed) care to the community, by maintaining an emergency room, by not restricting use of its facilities to a particular group of physicians, and/or by utilizing excess funds to improve the quality of patient care, expand facilities, and advance medical education and research.

Important Changes to Medicare Secondary Payer Electronic Reporting Rules

The Centers for Medicare and Medicare Services ("CMS") announced that it is extending the date for electronic reporting under the Medicare Secondary Payer rules for all Non-Group Health Plans from April 1, 2010 to January 1, 2011.

 

PREPARED TO COMPLY? - HITECH ACT ENFORCEMENT SET TO BEGIN

On February 17, 2010, HHS will begin to enforce changes to the HIPAA enacted through the HITECH Act.  The new requirements imposed by the HITECH Act will have a significant impact on the privacy and security of personal health information and compliance efforts of affected healthcare Covered Entities and their Business Associates.  The HITECH Act has expanded the direct applicability of the Privacy and Security Rules to Business Associates.  Significant changes may be necessary to comply with the new requirements.  

The 'Other' Health Care Reform Moves Ahead

The federal government moves ahead with its incentive program for the adoption of electronic health records.

 

Jackson Kelly lawyer James W. Thomas recently wrote an article that explores a pair of coordinated regulations issued by the U.S. Department of Health and Human Services on Jan. 13 which will define “meaningful use” for electronic health record systems.

 

To read Thomas’ article that appeared in the Jan. 29, 2010 edition of The State Journal, click here.  

 

The State Journal is a weekly business newspaper in West Virginia.

CMS CLARIFIES SUPERVISION REQUIREMENTS FOR OUTPATIENT SERVICES

CMS recently released its 2010 Outpatient Prospective Payment System (“OPPS”) rule clarifying the requirements for supervision of certain hospital outpatient services. The rule makes clear that if direct physician supervision is required for the performance of an outpatient service, this level of supervision may not be assumed to exist in a hospital setting. Rather, a hospital must establish a plan or policy to ensure that the direct supervision required by the Centers for Medicare and Medicaid Services (“CMS”) for a particular outpatient service is available. Read More.

CMS Issues Options for Providers to Comply with EMTALA in Anticipation of H1N1

In anticipation of a possible H1N1 virus outbreak this flu season, CMS has released guidance concerning EMTALA requirements during disasters and pandemics.  CMS has outlined compliance options that are permissible under EMTALA and that grant providers with flexibility to handle extraordinary increases in emergency department visits.  The options include setting up alternative screening sites on the hospital campus, off-campus screening at hospital-controlled sites, and community screening clinics at sites not under hospital control.  To read more click here.