Dorsey Health Law
Indiana Notification of Health Care Transactions Law Takes Effect
On July 1, 2024, Indiana’s new health care transactions notification law takes effect.[1] The law is designed to increase government oversight of mergers and acquisitions involving health care entities. Indiana joins a growing number of states that have passed similar legislation implementing notice requirements and increasing antitrust evaluations for certain health care transactions.[2] The following provides a general overview of Indiana’s new law. General Purpose and Key Definitions Indiana’s health care transactions notification law grants the Indiana Attorney General (AG) the authority to review certain mergers and acquisitions between two health care entities if at least one of the entities is an Indiana health care entity.[3] To enforce this oversight power, the law establishes specific notice requirements for the transacting health care entities. Such notice must be provided to the Indiana AG at least ninety (90) days before the date of the merger or acquisition.[4] Upon reviewing a submission of notice, the Indiana AG may issue a civil investigative demand for more information regarding the merger or acquisition. Below are key definitions from Indiana’s law defining the applicable scope: Transactions affected by the new notification requirements include mergers and acquisitions. “Merger” is defined as any change of ownership including: An acquisition or transfer of assets, or The purchase of stock effectuated by a merger agreement. “Acquisition” is defined as any agreement, arrangement, or activity that results in a person acquiring, directly or indirectly, control of another person. Entities affected by the new law are those specifically falling within the statute’s definition of health care entities.[5] “Health care entity” is defined as: Any organization or business that provides diagnostic, medical, surgical, dental treatment, or rehabilitative care. An insurer that issues a “policy of accident and sickness insurance,”[6] which generally includes a policy or contract covering bodily injury, disablement by injury or illness, or death by accident or disease.[7] The statute provides specific exceptions for several types of coverage.[8] A health maintenance organization. A pharmacy benefit manager, which refers to an entity that performs certain administrative functions on behalf of a health plan, state agency, insurer, managed care organization, or other third party payor.[9] An administrator, meaning a person who, on behalf of an insurer, “underwrites, collects charges or premiums from, or adjusts or settles claims on residents of Indiana in connection with life, annuity, or health coverage offered or provided by an insurer.”[10] The statute provides several specific exclusions for persons not considered an administrator.[11] A private equity partnership, regardless of where the private equity partnership is located, seeking to enter a merger or acquisition with any entity described above.[12] If a transaction meets the definition of merger or acquisition, and the entities involved are “health care entities” under the statute, then the transaction may be subject to certain notification requirements. Notification Requirements Indiana’s health care transactions notification law requires an Indiana health care entity “involved in a merger or acquisition with another health care entity with total assets, including combined entities and holdings, of at least ten million dollars ($10,000,000)” to provide written notice to the Indiana AG at least ninety (90) days before the date of the merger or acquisition.[13] For notice to be required under Indiana’s health care transactions notification law, the transaction must: (1) satisfy the statute’s definition of either a merger or acquisition; (2) involve two or more “health care entities,” one of which must be based in Indiana; and (3) concern at least ten (10) million dollars in total assets. If these characteristics are met, then the transacting health care entities must submit notice as outlined below. If the transaction is subject to Indiana’s notice requirements, each health care entity involved in the transaction must submit written notice to the Indiana AG, which must include the following information: The entity’s business address and federal tax number. The name and contact information of a representative of the health care entity concerning the merger or acquisition. A description of the health care entity. A description of the merger or acquisition, including the anticipated timeline. A copy of any materials that have been submitted to a federal or state agency concerning the merger or acquisition.[14] Attorney General Obligations and Oversight Powers Following a health care entity’s compliance with the above notice requirements, the Indiana AG will review the information submitted and provide a written analysis of any antitrust concerns regarding the merger or acquisition. The Indiana AG must provide its analysis not later than forty-five (45) days following the health care entity’s submission of notice. The analysis is given to the representative of the health care entity that submitted notice. Additionally, the Indiana AG has the power to issue a civil investigative demand to collect further information regarding the merger or acquisition from the health care entities submitting notice. The civil investigative demand must be made pursuant to Indiana’s existing law, which, in part, requires the attorney general to have reasonable cause to believe a person has violated a statute enforced by the attorney general.[15] Finally, Indiana’s health care transactions notification law imposes certain confidentiality requirements. The Indiana AG must keep confidential all nonpublic information provided through the notice requirements. Furthermore, any information received or produced by the Indiana AG is also considered confidential. If you have any questions regarding Indiana’s health care transactions notification law and how your organization or transaction may be impacted, please contact the authors or your regular Dorsey attorney. Summer Associate Katelyn Tarrolly provided substantial assistance researching and drafting this blog post. [1] Burns Ind. Code Ann. §§ 25-1-8.5-1—25-1-8.5-4. [2] See Lillie Cox, Randall Hanson, Jamie McCarty & Neal Peterson, Minnesota Attorney General Notification of Health Care Transaction, Dorsey Health Law Blog (May 30, 2023), https://www.dorseyhealthlaw.com/minnesota-attorney-general-notification-of-health-care-transactions/ (noting several states have enacted or are considering similar legislation, including California, Connecticut, Delaware, Massachusetts, Minnesota, Nevada, New Jersey, New York, Oregon, Rhode Island, and Washington). [3] To trigger Indiana’s transactions notification requirements, both entities must be health care entities. Additionally, the law requires at least one of those entities to be an “Indiana health care entity.” The statute does not define “Indiana health care entity.” Currently, there is no guidance that clarifies the criteria for being considered an “Indiana health care entity” under the new law. Burns Ind. Code Ann. § 25-1-8.5-4. [4] The statute provides that notice shall be given “at least ninety (90) days prior to the date of the merger or acquisition[.]” This likely means notice must be given ninety (90) days prior to the closing date of the merger or acquisition; however, there is no guidance currently clarifying the correct interpretation of this provision. Burns Ind. Code Ann. § 25-1-8.5-4. [5] “Health care entity” does not include the Medicaid program or the Medicare program. Burns Ind. Code Ann. § 25-1-8.5-2(b). [6] Burns Ind. Code Ann. § 25-1-8.5-2. [7] See Burns Ind. Code Ann. § 27-8-5-1 (“‘[P]olicy of accident and sickness insurance’, as used in this chapter, includes any policy or contract covering one (1) or more of the kinds of insurance described in Class 1(b) or 2(a) . . . .”).; see also Burns Ind. Code Ann. § 27-1-5-1 (defining Class 1(b) and Class 2(a) insurance). [8] An insurer that issues one or more of the following types of coverage is explicitly excluded from the definition of health care entity: “(A) accident only, credit, dental, vision, long term care, or disability income insurance; (B) coverage issued as a supplement to liability insurance; (C) automobile medical payment insurance; (D) a specified disease policy; (E) a policy that provides indemnity benefits not based on any expense incurred requirements, including a plan that provides coverage for: (i) hospital confinement, critical illness, or intensive care; or (ii) gaps for deductibles or copayments.; (F) worker’s compensation or similar insurance; (G) a student health plan; (H) a supplemental plan that always pays in addition to other coverage. Burns Ind. Code Ann. § 25-1-8.5-2(a)(2). [9] A pharmacy benefit manager is an entity that: “(1) contracts directly or indirectly with pharmacies to provide prescription drugs to individuals; (2) administers a prescription drug benefit; (3) processes or pays pharmacy claims; (4) creates or updates prescription drug formularies; (5) makes or assists in making prior authorization determinations on prescription drugs; (6) administers rebates on prescription drugs; or (7) establishes a pharmacy network.” Burns Ind. Code Ann. § 27-1-24.5-12. [10] Burns Ind. Code Ann. § 27-1-25-1. [11] Administrator does not include: (1) an employer or wholly owned direct or indirect subsidiary of an employer acting on behalf of the employees of: (A) the employer; (B) the subsidiary; or (C) an affiliated corporation of the employer; (2) a union acting for its members; (3) an insurer; (4) an insurance producer licensed under IC 27-1-515.6 that has a life or accident and health or sickness qualification and whose activities are limited exclusively to the sale of insurance; (5) a creditor acting for its debtors; (6) a trust established under 29 U.S.C. 186 and the trustees, agents, and employees acting pursuant to that trust; (7) a trust that is exempt from taxation under Section 501(a) of the Internal Revenue Code; (8) a financial institution that is subject to supervision or examination by federal or state banking authorities to the extent that the financial institution collects and remits premiums to an insurance producer or an authorized insurer in connection with a loan payment; (9) a credit card issuing company that: (A) advances for; and (B) collects from, when a credit card holder authorizes the collection; credit card holders of the credit card issuing company, insurance premiums or charges; (10) a person that adjusts or settles claims in the normal course of the person’s practice or employment as an attorney at law and that does not collect charges or premiums in connection with life, annuity, or health coverage; (11) a health maintenance organization; (12) a limited health maintenance organization; (13) a mortgage lender to the extent that the mortgage lender collects and remits premiums to an insurance producer or an authorized insurer in connection with a loan payment; (14) a person that is licensed as a managing general agent and acts exclusively within the scope of activities under the license; (15) a person that (A) directly or indirectly underwrites, collects charges or premiums from, or adjusts or settles claims on residents of Indiana in connection with life, annuity, or health coverage provided by an insurer; (B) is affiliated with the insurer; and (C) performs the duties specified in clause (A) only according to a contract between the person and the insurer for the direct and assumed life, annuity, or health coverage provided by the insurer. Id. [12] The statute does not define “private equity partnership.” Currently, there is no guidance interpreting what is considered a “private equity partnership.” Burns Ind. Code Ann. § 25-1-8.5-2(a)(6). [13] Burns Ind. Code Ann. § 25-1-8.5-4(a). [14] Burns Ind. Code Ann. § 25-1-8.5-4(b). [15] Burns Ind. Code Ann. § 4-6-3-3.
June 24, 2024
Minnesota Supreme Court Holds That The Minnesota Health Records Act Allows Release of Health Records For Permitted Purposes Under HIPAA
On October 11, 2023 the Minnesota Supreme Court issued an opinion in Schneider v. Children's Health Care holding that the Minnesota Health Records Act (“MHRA”) provision allowing health care providers to release health records when there is "specific authorization in law" encompasses all operative law in Minnesota, including permitted disclosures under the federal HIPAA privacy rule. This case appears to resolve longstanding questions about the interaction between the MHRA and the HIPAA privacy rule, and concludes that the MHRA’s health records release prohibitions are no stricter than the HIPAA privacy rule. In 2020, Children's Health Care alerted the Schneider family that a third-party vendor for its foundation had suffered a data breach, and that their child's protected health information may have been compromised. The Schneiders were not aware that Children’s had disclosed their child’s protected health information to its related foundation. The family sued Children's, alleging a violation of the MHRA and claiming that Children’s had obtained no written consent to disclose health records to the foundation for fundraising purposes. However, Children’s was permitted to disclose the health information to its foundation under the federal HIPAA privacy rule. Children's moved for summary judgment, arguing that the MHRA provision allowing release of health records when there is a "specific authorization in law" permits Children’s to release records when permitted under the HIPAA privacy rule. The district court and court of appeals granted summary judgment to Children's, and the Schneiders then petitioned the Minnesota Supreme Court to review. Statutory Background The HIPAA privacy rule prohibits covered entities, such as health care providers, from using or disclosing protected health information (“PHI”) unless permitted under the rule. The HIPAA privacy rule permits the use and disclosure of PHI under various circumstances, including for fundraising purposes. Covered entities under HIPAA may use a limited set of data elements for fundraising (or disclose that same information to a related foundation for fundraising), without any written consent or authorization from the patient. The HIPAA privacy rule also contains a general preemption rule, which provides that any state law that is contrary to the federal privacy rule is preempted. However if a state law affords greater privacy protection for identifiable health information, then the federal rule will not preempt that state law. The MHRA limits when certain Minnesota-licensed health care providers (including hospitals) are permitted to release health records without a patient’s written consent. The MHRA has a fewer number of permitted disclosures without patient consent than the HIPAA privacy rule does. But the MHRA exception at issue in Schneider allows for release of health records if there is a "specific authorization in law." Brief Analysis The Schneiders first argued that the scope of the phrase "specific authorization in law" refers only to Minnesota laws, and thus would not extend to the federal HIPAA fundraising exception. The Court rejected this argument, finding that in this context the plain and ordinary meaning of "law" refers to law that is binding and enforceable in Minnesota, which includes both Minnesota and federal law. Second, the Schneiders argued that the Court has required the Minnesota legislature to explicitly reference a federal law that is to be incorporated into a state statute. They claimed that because the MHRA does not explicitly reference federal law or HIPAA, the HIPAA fundraising exception is not a “specific authorization in law.” The Court rejected that argument, instead finding that the plain language of “law” makes it clear that the legislature explicitly intended to incorporate federal law into the MHRA. The final argument was that the MHRA is more stringent than the HIPAA privacy rule, and as such, is not preempted by the federal rule. This argument rested on the premise that because the MHRA does not have a separate fundraising exception, the MHRA must be more stringent than the HIPAA privacy rule. The Court disagreed, noting that the argument assumes its conclusion that the MHRA does not incorporate the HIPAA privacy rule as a “specific authorization in law.” Because the Court determined that the MHRA does incorporate the HIPAA privacy rule it was unpersuaded by this argument, effectively ruling that the MHRA’s records release provisions are no more stringent than the HIPAA privacy rule. The Schneider v. Children's Health Care case has practical, operational impact on health care providers in Minnesota. The case essentially reconciles permitted health records release under the MHRA with permitted disclosures of PHI under HIPAA. This should relieve Minnesota health care providers of the need to obtain a written patient consent under the MHRA in order to release health records for purposes for which disclosure is permitted under the HIPAA privacy rule, such as coordinating care with unaffiliated providers or billing health insurance. Contact the authors or any member of the Dorsey & Whitney Health Care Regulations & Transactions practice group with questions about HIPAA, the Minnesota Health Records Act, or other health information privacy matters.
October 27, 2023

