Ross C. D'Emanuele

On March 9, 2026, the Department of Health and Human Services Office of Inspector General (“OIG”) posted an advisory opinion addressing a medical technology manufacturer and distributor’s proposal to offer ambulatory surgery centers (“ASCs”) a discount on (“IOLs”) and other surgical supplies used to perform cataract surgery, contingent on affiliated physician practices purchasing the company’s software product at full price.  The OIG found that the proposed arrangement would constitute prohibited remuneration under the Federal anti-kickback statute if the intent to induce referrals were present, but the OIG stated it would not impose sanctions due to three factors that mitigate the risk of fraud and abuse.  This is the first OIG advisory opinion to rely expressly in part on the rationale that a proposed arrangement “does not present an inappropriately high risk of steering or unfair competition.” The proposed arrangement is structured as follows: the medical technology manufacturer and distributor “(the “Company”) would offer discounts to ASCs on supplies needed to perform cataract surgery contingent on a physician group practice with ophthalmic surgeons who perform cataract surgery at the ASC (the “Practice”) purchasing a subscription agreement for software that the Company sells. The Practice must purchase a license to the Company’s software at full price, and the ASC would then become eligible for discounts on the Company’s surgical supplies. The OIG found that the arrangement was low risk under the Federal anti-kickback statute for three reasons: The proposed arrangement “should not increase costs to Federal health care programs or result in overutilization.” This is due to the way that Federal health care programs reimburse for cataract surgeries – via set facility fees and professional services fees – such that the software and surgical supplies are not separately billable items.  Because Federal health care programs would pay the same amount regardless of which software and surgical products are used, the proposed arrangement should not increase costs to Federal health care programs. The proposed arrangement “presents a low risk of interference with clinical decision-making” because the discounted surgical supplies do not require the use of specific corresponding IOLs or supply packs, and the software will function the same regardless of the electronic health record, diagnostic equipment used, or brand or type of IOLs or supply packs chosen. The OIG recognized that surgeons with ownership in the ASC could receive an indirect benefit from the surgical supply discounts, but it noted that a discount of this nature is only one factor that a surgeon might consider when choosing surgical supplies.  And because purchasing the software would present an additional expense for the Practice, the arrangement would not act as a financial incentive that would distort clinical decision-making. Finally, the proposed arrangement “does not present an inappropriately high risk of steering or unfair competition” because the discount on IOLs and surgical supplies is only one of many factors that impact selection of IOLs, surgical supplies and software platforms. The OIG noted that because the referral source (the Practice) must purchase a full-price software license in order for the referral recipient (the ASC) to receive the supply discount, the risk is lower than if the referral source received the discount contingent on the referral recipient paying full price for other items or services. This is the first time that the OIG has articulated this third rationale as, in part, a basis for issuing a favorable advisory opinion.  The OIG’s analysis here indicates that while the OIG gives weight to potential steering or unfair competition, some steering and some potentially unfair competition may be permissible as long as that risk is low or not inappropriately high, respectively.  In examining this arrangement, the OIG concluded that a discount that does not meet the discount safe harbor to the anti-kickback statute can be one factor impacting competition, but that may be acceptable so long as it is not the only factor or even a strong factor.  And the OIG found that the relationship between the parties – who can refer to whom and which party pays full price and which party gets the discount – is an important consideration. As always, OIG advisory opinions are only applicable to the requesting individual or entity and cannot be relied on by other individuals or entities. However, this advisory opinion may help clinicians, manufacturers and their legal counsel assess arrangements involving more complex discount arrangements that do not meet the discount safe harbor to the anti-kickback statute. If you have questions or would like additional information, please contact the authors or any of your contacts in the Dorsey & Whitney health care practice group.

On June 9, 2025, Oregon Governor, Tina Kotek, signed SB 951[1] into law, making Oregon’s “corporate practice of medicine” doctrine one of the country’s most restrictive. SB 951 places numerous restrictions on the relationships between management services organizations and clinician practices, which will impact many of the written arrangements and techniques that management services organizations and clinician practices currently use. SB 951 also places new and/or clarified restrictions on professional medical corporation structuring and the use of certain restrictive covenants in contracts among health industry parties. This blog post provides a general overview of these new restrictions. Key Definitions Here are key definitions that help clarify the scope of SB 951: “Management services organization” or “MSO” is defined as an entity that provides management services to a professional medical entity in return for monetary compensation under a written agreement. “Management services” is broadly defined and includes payroll, human resources, employment screening, employee relations, and other administrative or business services. “Medical licensee” or “licensee” is defined as an individual who is licensed in Oregon to practice medicine or naturopathic medicine or as a nurse practitioner or physician assistant. “Professional medical entity” is defined as an Oregon professional corporation organized for the purpose of practicing medicine, practicing naturopathic medicine, or allowing physicians, nurse practitioners and physician assistants to jointly render healthcare services, or a limited liability company, partnership limited liability partnership or partnership organized for a medical purpose that is authorized to transact business in Oregon.[2] Restrictions on MSOs MSOs, including their shareholders, directors, members, managers, officers and employees (collectively, “agents”), may not, with certain exceptions: own or control a majority of; be a director, officer, employee or independent contractor of, or receive compensation from the MSO to manage; or exercise a proxy, right or power to vote the shares of; a professional medical entity with which it has a management services agreement (“MSA”). Additionally, MSOs and their agents may not, with certain exceptions: control or enter into agreements to, or otherwise permit a non-licensee to, control or restrict the sale or transfer of a professional medical entity’s ownership interests or assets; issue, or cause a professional medical entity to issue, ownership interests in the professional medical entity or a subsidiary or affiliate of the professional medical entity; pay dividends from a professional medical entity’s ownership interests; acquire, or finance the acquisition of, a majority of a professional medical entity’s ownership interests; or exercise de facto control over a professional medical entity’s administrative, business or clinical operations in a manner that affects the professional medical entity’s clinical decision making or the nature and quality of its medical care, which includes, but is not limited to, hiring or setting compensation for licensees, setting clinical or billing and collection policies, and negotiating agreements with third-party payors and other third parties that are not employees of the professional medical entity. So, what can an MSO still do? SB 951 clarifies that the restrictions still permit an MSO to: enter into agreements to control or restrict the transfer or sale of a professional medical entity’s ownership interests or assets for cause, including, but not limited to, an owner’s loss of their professional license, exclusion from a federal health care program, breach of the MSA or death; provide management services as long as the MSO is not exercising de facto control over a professional medical entity’s operations in a manner that affects the professional medical entity’s clinical decision making or the nature and quality of its medical care; purchase, lease or take assignment of a right to possess a professional medical entity’s assets in an arms’-length transaction with a willing seller, lessor or assignor; provide support and consultation on any business operations matters, such as accounting, facilities management and compliance with applicable laws; advise a professional medical entity’s participation in payor arrangements, value-based arrangements or vendor agreements; collect quality metrics as required by law or one of the professional medical entity’s agreements; and set criteria for reimbursement under an agreement between a professional medical entity and a payor. Any MSA provision that violates any of the above restrictions is void and unenforceable. Additionally, professional medical entities and licensees have a private right of action against MSOs and the MSO’s agents, and damages may include actual damages, an injunction or other equitable relief, punitive damages and attorneys’ fees. Existing MSOs and professional medical entities conducting business in Oregon have until January 1, 2029 to comply with these restrictions. However, new MSOs and professional medical entities planning to conduct business in Oregon, including those involved in a sale or transfer of ownership, must comply with these restrictions by January 1, 2026. Restrictions on Professional Medical Corporations SB 951 also imposes restrictions on professional medical corporations (“PCs”), with certain exceptions. PCs’ articles, bylaws and other organizational arrangements may not allow for the removal of any director or officer without a majority vote of licensee-shareholders or licensee-directors, except for cause. Additionally, PCs may only replenish or transfer control over their operations through a valid shareholder agreement that is solely among and for the benefit of a majority of shareholders who are physicians licensed in Oregon. These restrictions apply to any agreements that are entered into or renewed on or after June 9, 2025. Non-Competition, Non-Disclosure and Non-Disparagement Agreements Lastly, non-competition agreements with professional licensees that restrict the practice of medicine or nursing as well as non-disclosure and non-disparagement agreements between an MSO, hospital or hospital-affiliated clinic and an employed licensee are void and unenforceable, with certain exceptions. These restrictions also apply to any agreements that are entered into or renewed on or after June 9, 2025. The Big Picture Notably, as of 2022, OHA requires notice of and reviews material health care transactions. This, along with the passage of SB 951, indicates Oregon’s strong focus on its regulation and oversight of the “corporate practice of medicine.” And Oregon is not alone. These are recent developments in a long history of state concerns with the separation of corporations and unlicensed individuals and healthcare professional’s medical decision making and patients’ care (i.e., the corporate practice of medicine) and, more recently, private equity involvement in health care. SB 951 materially reinforces and expands Oregon’s “corporate practice of medicine” doctrine and impacts not only MSAs but other MSO-practice relationships, MSO and PC governance and agreements with restrictive covenants. SB 951 raises difficult issues such as the permitted scope of an MSO’s authority if the requirement is to avoid control that affects the professional medical entity’s clinical decision making or the nature and quality of medical care. Given the wide-reaching implications of this new law and to ensure compliance with SB 951 by the applicable compliance dates, existing MSOs and clinician practices conducting business in Oregon will need to review and likely revise their current business models, practices, and written agreements as necessary, and new MSOs and clinician practices planning to conduct business in Oregon will need to closely review their proposed business models and practices. Please contact the authors or your regular Dorsey attorney with any questions about how these restrictions could affect your current business model or any contemplated transactions. [1] https://olis.oregonlegislature.gov/liz/2025R1/Downloads/MeasureDocument/SB951/Enrolled. [2] While this law does not currently apply to other healthcare providers. Oregon House Majority Leader, Ben Bowman, predicts that future legislative sessions will likely address the expansion of this law to other healthcare providers, such as hospitals and dentists.

As the federal government continues to take action in response to events impacting the healthcare landscape, stakeholders must ensure that they are staying up-to-date with health information privacy and security developments in the healthcare industry. This blog post summarizes two recent significant actions: a new HIPAA final rule and proposed federal cybersecurity legislation. New HIPAA Final Rule The U.S. Department of Health and Human Services (“HHS”) has expressed concern about patient trust in the privacy of health care information since the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization in 2022. Most recently, on April 22, 2024, HHS’s Office for Civil Rights (“OCR”) issued a new final regulation under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule: HIPAA Privacy Rule to Support Reproductive Health Care Privacy. The final rule strengthens privacy protections for sensitive information about reproductive health care by: Prohibiting covered entities and their business associates from using or disclosing protected health information (“PHI”) for the purpose of an investigation into or proceeding against an individual or entity who seeks, obtains, provides, or facilitates lawful reproductive health care, which includes providing information on or paying for any such services. This prohibition does not apply in situations of suspected abuse, neglect, or endangerment. Prohibiting covered entities and their business associates from identifying any individual or entity for the purpose of any such investigation or proceeding. Requiring covered entities and their business associates to obtain a signed attestation when they receive a request for PHI potentially related to reproductive health care for the purpose of health oversight activities, judicial or administrative proceedings, law enforcement, or coroner or medical examiner disclosures. The attestation must include the individual or class of individuals whose PHI is requested, the covered entity or business associate, the requestor, a statement that the PHI will not be used or disclosed for any prohibited purpose, and a statement acknowledging the criminal penalties for any violation of the Privacy Rule. Prohibiting a provider from refusing to treat a person as the personal representative of a patient merely because they provided or facilitated reproductive health care for a patient. Requiring covered entities to revise their Notice of Privacy Practices. The final rule is scheduled for publication in the Federal Register on April 26, 2024. It will become effective 60 days after publication, with compliance to occur by February 16, 2026 for the Notice of Privacy Practices requirement and within 240 days after publication for all other requirements. As the compliance dates quickly approach, covered entities and business associates must ensure alignment of their policies, practices, and Notices of Privacy Practices with this new final rule. Covered entities and business associates may also need to revise their business associate agreements, to the extent that such agreements would permit a business associate’s use or disclosure of PHI that is prohibited under the new rule. Proposed Federal Cybersecurity Legislation The healthcare industry has seen a recent increase in cybersecurity incidents. According to OCR, over the past few years, the number of large breaches reported and the number of individuals affected by those breaches have doubled. Now, following the Change Healthcare breach, Congress is considering new legislation: Health Care Cybersecurity Improvement Act of 2024 (S.B. 4054). On March 22, 2024, Senator Mark R. Warner (D-VA), introduced the proposed federal legislation, which has been referred to the Senate Committee on Finance. Sen. Warner, who is a member of the Committee on Finance and co-founder and co-chair of the Senate Cybersecurity Caucus, is a well-known advocate of enhanced cybersecurity in the healthcare industry. The proposed legislation charges the Secretary of HHS with setting minimum cybersecurity standards for Medicare’s Accelerated Payment Program and Advance Payments Program. During the COVID-19 public health emergency, the Centers for Medicare and Medicaid Services offered accelerated and advance payments to assist in disruptions to claims payments due to the public health emergency. Under the Health Care Cybersecurity Improvement Act of 2024, if a participating Part A hospital or one of its intermediaries does not meet the set standards, the hospital will not receive accelerated payments under the Accelerated Payment Program where a cybersecurity incident caused the disrupted operations or cash flow problems. Similarly, if a participating Part B provider or one of its intermediaries does not meet the set standards, the provider will not receive advance payments under the Advance Payments Program where a cybersecurity incident caused the delayed claims payments by health insurance companies. Notably, the accelerated and advance payments are only for Medicare Part A and Part B claims payments. Currently, the bill is still in the early stages of the legislative process, and, if the law were enacted, enforcement would not occur until two years after its enactment. However, given the continuing prevalence of cybersecurity incidents in the healthcare industry, additional detailed HIPAA Security Rule cybersecurity guidance, as well as emerging state agency activity (such as New York’s proposed cybersecurity regulations for hospitals), now is the time for healthcare providers and other covered entities and business associates to focus on HIPAA Security Rule compliance to protect against hacking, ransomware and other cybersecurity attacks, and the resulting disruptions to clinical care. If you have any questions about the HIPAA Privacy Rule or Security Rule, proposed cybersecurity legislation, or their potential impact on you or your organization, please contact the authors or your regular Dorsey attorney.  

On October 11, 2023 the Minnesota Supreme Court issued an opinion in Schneider v. Children's Health Care holding that the Minnesota Health Records Act (“MHRA”) provision allowing health care providers to release health records when there is "specific authorization in law" encompasses all operative law in Minnesota, including permitted disclosures under the federal HIPAA privacy rule.  This case appears to resolve longstanding questions about the interaction between the MHRA and the HIPAA privacy rule, and concludes that the MHRA’s health records release prohibitions are no stricter than the HIPAA privacy rule. In 2020, Children's Health Care alerted the Schneider family that a third-party vendor for its foundation had suffered a data breach, and that their child's protected health information may have been compromised. The Schneiders were not aware that Children’s had disclosed their child’s protected health information to its related foundation.  The family sued Children's, alleging a violation of the MHRA and claiming that Children’s had obtained no written consent to disclose health records to the foundation for fundraising purposes. However, Children’s was permitted to disclose the health information to its foundation under the federal HIPAA privacy rule.  Children's moved for summary judgment, arguing that the MHRA provision allowing release of health records when there is a "specific authorization in law" permits Children’s to release records when permitted under the HIPAA privacy rule. The district court and court of appeals granted summary judgment to Children's, and the Schneiders then petitioned the Minnesota Supreme Court to review. Statutory Background The HIPAA privacy rule prohibits covered entities, such as health care providers, from using or disclosing protected health information (“PHI”) unless permitted under the rule. The HIPAA privacy rule permits the use and disclosure of PHI under various circumstances, including for fundraising purposes.  Covered entities under HIPAA may use a limited set of data elements for fundraising (or disclose that same information to a related foundation for fundraising), without any written consent or authorization from the patient. The HIPAA privacy rule also contains a general preemption rule, which provides that any state law that is contrary to the federal privacy rule is preempted.  However if a state law affords greater privacy protection for identifiable health information, then the federal rule will not preempt that state law. The MHRA limits when certain Minnesota-licensed health care providers (including hospitals) are permitted to release health records without a patient’s written consent.  The MHRA has a fewer number of permitted disclosures without patient consent than the HIPAA privacy rule does.  But the MHRA exception at issue in Schneider allows for release of health records if there is a "specific authorization in law." Brief Analysis The Schneiders first argued that the scope of the phrase "specific authorization in law" refers only to Minnesota laws, and thus would not extend to the federal HIPAA fundraising exception. The Court rejected this argument, finding that in this context the plain and ordinary meaning of "law" refers to law that is binding and enforceable in Minnesota, which includes both Minnesota and federal law. Second, the Schneiders argued that the Court has required the Minnesota legislature to explicitly reference a federal law that is to be incorporated into a state statute. They claimed that because the MHRA does not explicitly reference federal law or HIPAA, the HIPAA fundraising exception is not a “specific authorization in law.” The Court rejected that argument, instead finding that the plain language of “law” makes it clear that the legislature explicitly intended to incorporate federal law into the MHRA. The final argument was that the MHRA is more stringent than the HIPAA privacy rule, and as such, is not preempted by the federal rule. This argument rested on the premise that because the MHRA does not have a separate fundraising exception, the MHRA must be more stringent than the HIPAA privacy rule. The Court disagreed, noting that the argument assumes its conclusion that the MHRA does not incorporate the HIPAA privacy rule as a “specific authorization in law.” Because the Court determined that the MHRA does incorporate the HIPAA privacy rule it was unpersuaded by this argument, effectively ruling that the MHRA’s records release provisions are no more stringent than the HIPAA privacy rule. The Schneider v. Children's Health Care case has practical, operational impact on health care providers in Minnesota.  The case essentially reconciles permitted health records release under the MHRA with permitted disclosures of PHI under HIPAA.  This should relieve Minnesota health care providers of the need to obtain a written patient consent under the MHRA in order to release health records for purposes for which disclosure is permitted under the HIPAA privacy rule, such as coordinating care with unaffiliated providers or billing health insurance. Contact the authors or any member of the Dorsey & Whitney Health Care Regulations & Transactions practice group with questions about HIPAA, the Minnesota Health Records Act, or other health information privacy matters.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Ross D'Emanuele, Jamie Nafziger and Bianca Tillman for the following publication: Companies may face class action lawsuits as early as July 2023 based on Washington’s new privacy law. Governor Jay Inslee recently signed House Bill 1155, the WA My Health, My Data Act (“MHMDA” or “the Act”), giving companies and non-profits a very short compliance window. MHMDA is part of “Washington State’s nation-leading effort to stem the attack on choice”1 in response to the Supreme Court’s 2022 decision in Dobbs that overturned Roe v. Wade. Lawmakers state that the new law was designed to “protect the independence and dignity of individuals when they make healthcare decisions”2 in the state of Washington by safeguarding the privacy of Consumer Health Data not previously covered by the Health Insurance Portability and Accountability Act (“HIPAA”). However, the MHMDA is much more comprehensive than it seems and covers more than health data. All companies, even those not traditionally associated with health or wellness, should assess whether they fall in scope of the MHMDA’s broad reach and if so, take immediate compliance steps. Read more here.

The use of tracking technologies on websites and mobile applications (e.g., cookies) has become largely ubiquitous in our technology-driven world. Health care providers and organizations, for example, may use tracking technologies to identify their patients’ care needs and improve patient experience. As the use of tracking technologies burgeons, so do concerns from individuals about how to protect their personal information. Understandably so, as this technology comes with significant risks if collected information ends up in the wrong hands. Further, because of the sensitivity of the information involved, entities that handle Protected Health Information (“PHI”) and are regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) must be particularly cautious when using tracking technologies. On December 1, 2022, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”), which is responsible for enforcing HIPAA, issued a Bulletin addressing the use of tracking technologies by regulated entities, including Covered Entities and Business Associates, as defined by HIPAA.[1] The Bulletin does not create new obligations for HIPAA-regulated entities, and seeks only to clarify current HIPAA obligations as it relates to the use of tracking technologies, specifically, when a third-party vendor is utilized. What is a Tracking Technology? A tracking technology is a “script or code” on a website or mobile application (“app”) that collects information about users as they interact with the website or application.[2] The information gathered is analyzed and used to “create insights about users’ online activities”, and even their personal characteristics, wants or needs.[3] Tracking technologies include mechanisms such as cookies, pixels, web beacons, and embedded tracking codes in apps and devices. One such example is the Facebook pixel by Meta, which website owners can embed into their website to track site visits and user activity on the website.[4] How is HIPAA Implicated? HIPAA-regulated entities are required to safeguard PHI, which includes protecting it from impermissible disclosures. When regulated entities utilize third-party vendors to track the activity of website or app users, information is collected through tracking technologies placed on the website or app, which is then sent to that vendor to perform data analytics. If the collected information includes PHI, it is protected by HIPAA, and the HIPAA Privacy, Security, and Breach Notification Rules (“HIPAA Rules”) apply.[5] The rule for what qualifies as PHI in this context is much broader than one might think. Sometimes it is apparent: a patient portal that a patient must log in to almost certainly has access to PHI, such as the person’s medical or billing information. However, even an unauthenticated webpage that does not require a login, such as a health care provider’s public website, may provide a tracking technology vendor access to PHI. For example, tracking technologies might collect identifying information, such as an individual’s email address or IP address. If that person then begins searching for a provider or information on a particular medical condition, which is also tracked and sent to the vendor, the regulated entity is now disclosing PHI to the vendor.[6] Likewise, mobile apps may collect information such as health and billing information, as well as information about the user’s device (fingerprints, network location, etc.). This, too, is PHI, and any disclosure to the vendor must comply with HIPAA. Purported Class Action Lawsuits In recent months, several health plans and hospital systems have been the target of purported class action lawsuits from private plaintiffs alleging that the defendants utilized tracking technology vendors and unlawfully disclosed PHI without individual consent.  Because there is no private right of action under the HIPAA Rules, these lawsuits do not bring HIPAA claims.  But they appear to use alleged HIPAA Rule violations as a basis for claims under the Electronic Communication Privacy Act of 1986, the Computer Fraud and Abuse Act, and state law common law privacy claims.   Accordingly, this is not merely a technical HIPAA matter, and can result in real consequences. What Should Regulated Entities Do to Comply with HIPAA When Using Tracking Technology Vendors? Make sure a Business Associate Agreement (“BAA”) is in place. A tracking technology vendor is a Business Associate when it creates, receives, maintains, or transmits PHI on behalf of a Covered Entity.[7] Further, disclosures to the vendor must be permitted by the HIPAA privacy rule, and only the minimum necessary PHI for the applicable purpose may be disclosed. If a BAA is not practicable or sufficient (e.g., there is no applicable permitted disclosure under the HIPAA privacy rule), the regulated entity must obtain individuals’ HIPAA-compliant authorization before any disclosure to the vendor occurs.[8] It is worth noting here certain mechanisms that do not qualify as HIPAA-compliant authorization: Privacy policy or terms of use. While a regulated entity may disclose the use of tracking technology here, that is insufficient to permit a disclosure of PHI that requires an individual’s authorization under the HIPAA privacy rule. Website banners asking individuals to accept or reject tracking technologies, such as cookies. A tracking technology vendor that promises to de-identify PHI before using information it receives or promises not to save PHI, because disclosure has already occurred at that point. Apply administrative, physical and technical safeguards to electronic PHI, as required under the Security Rule (e.g., encrypt PHI sent to the vendor), and consider and address tracking technologies when performing risk assessments. Notify individuals, the Secretary, and the media as required if a breach occurs. Final Thoughts HIPAA-regulated entities that utilize tracking technologies, and in particular, tracking technology vendors, must remain vigilant as to how PHI may be collected on various platforms. In particular, be aware that even a public, unauthenticated webpage could result in disclosure of PHI due to identity- or device-tracking pixels. When using a tracking technology vendor, a BAA must be in place, and the purpose of the disclosure must be permitted under the HIPAA Rules. Failure to do could result in impermissible disclosure of PHI, constituting a violation of the HIPAA Rules.  The practice could also attract claims from private plaintiffs under various statutory and common law theories. Be proactive in addressing this potential gap in your privacy program; do not wait until the problem finds you. [1] 45 CFR § 160.103. [2] Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, Dep’t of Health & Human Services (Dec. 1, 2022), https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html - ftn8. [3] Id. [4] See https://www.facebook.com/gpa/blog/the-facebook-pixel. [5] See 45 CFR parts 160 and 164. [6] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html - ftn8. [7] Id. [8] 45 CFR § 164.508(b).

On February 1, 2023, the Federal Trade Commission (FTC) filed a complaint in the U.S. District Court for the Northern District of California alleging that digital health platform GoodRx violated the FTC Act by repeatedly sharing personal health information with advertising companies and platforms, such as Facebook and Google, and failed to report the unauthorized disclosures pursuant to its Health Breach Notification Rule (16 C.F.R. § 318).  Though GoodRx maintains that it shared all health information appropriately, according to the proposed stipulated order, the digital health platform has agreed to pay a $1.5 million civil penalty.  Once the proposed order is approved by a federal court judge, the monetary penalty, as well as several non-monetary sanctions, will go into effect.  This settlement may signal the beginning of a new era of health privacy enforcement, where the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is not the only federal health privacy law for which organizations must ensure compliance. The FTC’s Health Breach Notification Rule is not new—even though the GoodRx complaint marks its first enforcement action.  The rule went into effect in September 2009 and was the subject of a 2021 FTC policy statement.  Substantively, the Health Breach Notification Rule is very similar to HIPAA’s Breach Notification Rule (45 C.F.R. §§ 164.400-414).  Pursuant to both rules, a data holder must notify the subject of any unsecured “individually identifiable health information” and the agency responsible for enforcing the applicable rule in response to a breach of such information.  Also pursuant to both rules, if a breach of unsecured personal health information involves more than 500 individuals (and, in the case of the Health Breach Notification Rule, if a breach involves exactly 500 individuals), the data holder must notify the media. The primary differentiating factor between the rules are the types of entities to which they apply.  The HIPAA Breach Notification Rule is specific in scope and only applies to Covered Entities and their Business Associates.  A Covered Entity is limited to a: (1) health plan, (2) health care clearinghouse, or (3) health care provider, who also electronically transmits health information in connection with transactions for which HHS has adopted standards.  A Business Associate is a person or entity who, on behalf of a Covered Entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information. The FTC’s Health Breach Notification Rule is broader in scope and applies to all vendors that “offer or maintain a personal health record (PHR).” A PHR is an electronic record of “individually identifiable health information,” as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. The FTC has stated that an example PHR Vendor might be a health app that collects information from consumers and can sync with a consumer’s fitness tracker. The Health Breach Notification Rule also applies to “PHR related entities” and “third-party service providers.”  A PHR Related Entity interacts with a PHR Vendor by either offering products or services through the Vendor’s website, offering products or services through a Covered Entity’s website that offers individual’s health records, or by accessing information in a PHR or sending information to a PHR.  The FTC states that an example of a PHR Related Entity might be a company that offers a fitness tracker and sends information to health apps.  A Third Party Service Provider is an entity that provides services to a PHR Vendor in connection with the offering or maintenance of a PHR or to a PHR Related Entity in connection with a product or service offered by that entity; and accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information as a result of such services.  The FTC states that an example of a Third Party Service Provider might be a company that provides billing, debt collection, or data storage services relating to health information for a PHR. In light of the GoodRx complaint and the FTC’s enforcement of the Health Breach Notification Rule, all entities that utilize or maintain personal health information—and especially those offering healthcare apps, connected devices, and wearables, that often do not fall under the definitions of Covered Entities and Business Associates—should evaluate the applicability of the Health Breach Notification Rule to their organization and its business practices.  Entities that fall under the definitions of PHR Vendor, PHR Related Entity, and Third Party Service Provider, should be sure to have an effective privacy and security program in place, including procedures for conducting regular risk assessments and risk management trainings to ensure proper identification of and response to a breach of personal health information.  Such entities should also review their privacy policies, both internally and externally-facing, to ensure they reflect current data-sharing practices, and should review their vendor contracts to take inventory of any permissions or restrictions on how personal health information is used and disclosed to ensure they are obtaining the necessary consent. For more information on the Health Breach Notification Rule, the FTC’s Health Privacy webpage offers a variety of resources—including a simplified explainer of the rule, compliance tips, and an interactive tool geared toward mobile health apps. For more tailored guidance, or with any questions, please do not hesitate to reach out to one of the authors or your regular Dorsey & Whitney attorney.

The Department of Justice (“DOJ”) recently announced two settlement agreements, both involving durable medical equipment (“DME”) companies, following allegations that the companies had violated the Anti-Kickback Statute (“AKS”). The AKS, found at 42 U.S.C. § 1320a-7b, prohibits the exchange of anything of value (i.e., remuneration) with any intent to induce referrals for services or products reimbursable by federal health care programs. These settlements highlight two important reminders when it comes to complying with the AKS: (1) illegal remuneration can come in many forms and need not be monetary; and (2) commission-based compensation, while allowed for employees, is improper remuneration with regard to independent contractors. The first settlement involved a DME manufacturer that allegedly misled federal health care programs, including Medicare, Medicaid, and TRICARE, by paying kickbacks to DME suppliers. Specifically, the manufacturers provided DME suppliers with data about physician prescribing practices to aid their marketing efforts. In exchange, those suppliers then marketed the manufacturer’s products to providers. This resulted in DME suppliers submitting false claims for respiratory-related equipment following Respironics’ illegal inducements. Under the settlement terms, Respironics agreed to pay over $24 million in total to the United States and various affected states. Respironics also entered into a five-year corporate integrity agreement (“CIA”) with the U.S. Department of Health & Human Services Office of Inspector General (“HHS-OIG”). This settlement agreement makes clear that anything of value – even data – can be considered illegal remuneration under the AKS.  Even if there is no marginal cost involved from the perspective of the data provider, data nonetheless can have value to the recipient.  Consequently, product manufacturers, health care providers and others should recognize that value in any form can be the basis for anti-kickback allegations. The second settlement involved a DME manufacturer that produces knee braces and related products. It was alleged that the supplier paid an independent sales representative and the representative’s company commission payments ranging from 20-35% of VQ’s net revenue on every knee brace ordered by a particular set of providers. The providers then submitted claims for the braces allegedly contaminated by these kickbacks. The sales representative was able to “establish itself as the exclusive brace supplier” for several providers and collect millions of dollars in annual brace sales, according to the DOJ press release. Notably, this settlement was the result of an independently-prompted government investigation of Medicare claims data. Under the settlement terms, the DME manufacturer agreed to pay $2.25 million and entered into a five-year CIA with HHS-OIG. The issue of commission payments was also addressed early last year in United States v. Mallory, 988 F.3d 730 (4th Cir. 2021), wherein a federal court ordered a blood testing laboratory and its contracted sales agents to pay more than $100 million in damages after finding that the lab’s commission-based compensation to its contractors violated the AKS. These recent events illustrate that commission-based compensation arrangements with independent contractors are still an issue whenever federal health care programs are involved. And while there is an AKS safe harbor for commission payments to employees (42 C.F.R. § 1001.952(i)), the Department of Health and Human Services has made clear that commission payments for contracted services are not likewise protected. The DOJ has established its intent to aggressively scrutinize and prosecute such arrangements. In summary, these DME manufacturer settlements underscore two important AKS guidelines for all health care service and equipment providers: (1) be aware of untraditional items of value, such as data, that could be considered illegal remuneration; and (2) avoid commission-based compensation arrangements with independent contractors whenever federal program provide reimbursement for the products or services.

With the enactment of the Eliminating Kickbacks in Recovery Act (“EKRA”) in 2018, the permissibility of commission-based compensation to laboratory sales representatives based on volume, revenue, or profit has come under question, and there is still little case law interpreting the Act. Despite EKRA being a relatively newer law, laboratories should remain mindful of how the more established Anti-Kickback Statute (the “AKS”) impacts the permissibility of such commission-based compensation as well. Under current law, commission-based payments (including commission based on volume, revenue, profit, etc.) should be permissible when paid to employee sales representatives. However, labs should be cautious when considering commission-based compensation to independent contractor sales representatives. I. The Anti-Kickback Statute The AKS subjects to criminal and civil penalties anyone who knowingly and willfully offers, pays, solicits, or receives remuneration to induce or reward the referral of business reimbursable under any federal health care programs. 42 U.S.C. § 1320a-7b(b). Importantly, the AKS extends beyond paying value in exchange for direct patient referrals; it also prohibits paying remuneration intended to induce or reward someone to arrange for or recommend that others purchase, lease, or order any good, facility, service, or item reimbursable by any federal health care program. See Id. The AKS contains numerous safe harbors, the compliance with which protects parties from violation of the AKS. One of these is the employment safe harbor, which permits any payments to an employee if there is a bona fide employment relationship. 42 U.S.C. § 1320a-7b(b)(3)(B). This safe harbor does not extend to independent contractors. Id. II. The Eliminating Kickbacks in Recovery Act EKRA subjects to criminal penalties anyone who, with respect to services covered by certain public health care benefit programs, knowingly and willfully: (1) solicits or receives any remuneration in return for referring a patient or patronage to a recovery home, clinical treatment facility, or laboratory; or (2) pays any remuneration to induce a referral of an individual to a recovery home, clinical treatment facility, or laboratory or in exchange for an individual using the services of that recovery home, clinical treatment facility, or laboratory. 18 U.S.C. § 220(a). Laboratory is defined to include all laboratories, not just those that perform testing related to substance abuse. 18 U.S.C. § 220(e)(4). Notably, EKRA’s language appears to be limited to paying for direct referrals. Unlike AKS, EKRA does not include language that extends its prohibitions to paying for arranging or recommending others to make referrals or order services. In addition, EKRA does not have an employee safe harbor analogous to the employee safe harbor under AKS, but rather has a narrower exception permitting payments made under a bona fide employment relationship (including with independent contractors, unlike under the AKS employment safe harbor) where the payment does not vary based on the procedures performed, or amounts billed or received from the health care benefit program from the individuals referred. 18 U.S.C. § 220(b)(2). In 2021, a federal district court in Hawaii issued the first and, to date, only judicial opinion interpreting EKRA in S&G Labs Haw., LLC v. Graves, 2021 U.S. Dist. LEXIS 200365. The district court held that while the employment agreement with Graves (a client account manager) provided for commission-based payments that varied based on the number of tests S&G performed, the arrangement did not violate EKRA since there was only an attenuated connection between the commission-based payments and patient referrals: “Undoubtedly, Graves’s commission-based compensation structure induced him to try to bring more business to S&G . . . However, the ‘client’ accounts they serviced were not individuals whose samples were tested at S&G. Their ‘clients’ were ‘the physicians, substance abuse counseling centers, or other organizations in need of having persons tested.’ However, S&G was not compensated by those ‘clients’; S&G was ‘compensated for the testing services on a ‘per test’ basis by third party insurers, government agencies under the Medicare and Medicaid programs, and direct self-pay by some individuals.’ There is no evidence that Graves’s client accounts included individuals who self-paid for S&G to perform urinalysis on their samples.” Id. at 33-34. The district court concluded that since “Graves was not working with individuals, the compensation that S&G paid him was not paid to induce him to refer individuals to S&G.” Id. at 34. In other words, the district court concluded that because Graves was not himself a source of lab referrals, EKRA’s prohibitions could not reach the volume-based compensation arrangement between Graves and his laboratory employer. III. Commissions to Employee Sales Representatives vs. Independent Contractor Sales Representatives Under current law discussed above, labs should generally be able to make commission-based payments (including commissions based on volume, revenue, profit, etc.) to employee sales representatives, but should carefully consider the AKS when proceeding with respect to independent contractor sales representatives. A. Employee Sales Representatives Commission-based payments, including commission based on volume, revenue, profit, etc., to employee sales representatives are permissible under the AKS. Such payments would fall within the AKS employment safe harbor so long as a bona fide employment relationship exists. Per the S&G Labs interpretation of EKRA, commission-based payments, including commission based on volume, revenue, profit, etc., to employee sales representatives are also permissible under EKRA, provided that a lab’s employee sales representatives have a similar relationship to their client accounts as that described in S&G Labs, wherein sales representatives are working with physician clinics, hospitals, and other organizations and facilities that would utilize the lab, and are not working with individual patients. B. Independent Contractor Sales Representatives Based on the only case law to address the issue at this point, so long as independent contractor sales representatives work with organizations and facilities, and are not in a position to refer individual patients, then EKRA should not bar commission-based payments to a lab’s independent contractor sales representatives. However, commission-based payments to independent contractor sales representatives remain an issue under the AKS if the laboratory business involves federal health care programs. Such payments fall outside of the employment safe harbor to the AKS, and the broad reach of the AKS prohibition on arranging or recommending that others order items and services could extend to payment arrangements with independent contractor sales representatives. Consequently, laboratories should proceed cautiously when considering compensating independent contractor sales personnel based in whole or in part on a volume- or value-based methodology. We will continue to closely monitor the state of EKRA and the AKS for guidance, revisions to the law, and enforcement. If you have further questions or need advice on how to restructure compensation arrangements to comply with EKRA and the AKS, please contact the authors or your regular Dorsey attorney.  

Overview On July 1, 2021, the Department of Health and Human Services (HHS), along with other federal agencies, released an interim final rule implementing certain provisions of the No Surprises Act.[1] The No Surprises Act aims to protect health plan participants and beneficiaries from surprise medical bills when they receive items and services in certain settings from out-of-network providers and health care facilities. The rule will be enforced beginning January 1, 2022. The rule includes requirements applicable to: (1) group health plans and health insurance issuers that offer group or individual health insurance coverage; (2) certain types of health care providers; and (3) health benefit plans offered by carriers under the Federal Employees Health Benefits Act.  This article will focus on provider requirements under the new rule. Provider Requirements Under the Interim Final Rule Under the No Surprises Act, nonparticipating providers, facilities, and air ambulance providers are prohibited from balance billing individuals.  This means that the nonparticipating provider, facility, or air ambulance provider may not bill an individual for a dollar amount that exceeds the individual’s in-network cost-sharing obligations.  A nonparticipating provider is any physician or other health care provider acting within the scope of their licensure under applicable state law and who does not have a contractual relationship with the health plan or health insurance issuer. The balance billing prohibition applies to the following health care services: (1) emergency services provided by a nonparticipating provider or nonparticipating emergency facility; (2) non-emergency services provided by a nonparticipating provider at a participating health care facility; and (3) air ambulance services furnished by a nonparticipating air ambulance service provider.  For purposes of the balance billing prohibition for non-emergency services provided by a nonparticipating provider at a participating health facility, a participating health care facility is a hospital, hospital outpatient department, critical access hospital or ambulatory surgical center that has a direct or indirect contractual relationship with the health plan or health insurance issuer with respect to the item or service furnished. Any participants, beneficiaries, or enrollees in a group health plan or group or individual health insurance coverage offered by an issuer, including Federal Employees Health Benefits beneficiaries, are covered by the rule’s protections. Disclosure Requirements The No Surprises Act requires providers, facilities, plans and issuers to disclose the patient protections against balance billing to individuals. Per the interim final rule, the disclosure must: (1) contain clear and understandable language of the protections, including how to contact federal and state agencies for suspected violations; (2) be provided within the required time frame, and (3) comply with federal civil rights laws regarding communication and language barriers.  Air ambulance service providers are exempt from the disclosure requirements.  For providers and facilities, the deadline for providing disclosure depends on the circumstances.  If an appointment is scheduled at least 72 hours before the date of the appointment, then disclosure must be made no later than 72 hours prior to the date of appointment.  If an appointment is schedule within 72 hours of the appointment, disclosure must be provided on the same date as, and at least three hours prior to, the appointment. Disclosure must be provided via three channels: Public location. Providers must post the required disclosure in a prominent, central location where services are provided, such as near a scheduling or check-in desk. Public website. The public website disclosure must be searchable and accessible free of charge and without any login or personal information inputting requirements. Providers and facilities that do not have a website are exempt from this requirement. One-page notice. Individuals must be provided with a one-page notice of the disclosure. The notice must have a minimum of 12-point font, and it may be double-sided. Provider Exception To prevent duplicate disclosure notices to individuals, HHS created an exception to the disclosure requirement for providers. If a provider furnishes items or services covered by the plan or coverage at a facility, including hospital emergency departments and independent freestanding emergency departments, it satisfies the disclosure requirements if the facility agrees in writing to provide the required disclosure on behalf of the provider. This is available regardless of whether the provider and facility bill jointly or separately. If the facility fails to provide proper disclosure under the written agreement, the facility, not the provider, is in violation of the rule. Notice and Consent Exception Under the No Surprises Act, the prohibition on balance billing does not apply if notice is given to an individual, and the individual consents to waiving balance billing protections with respect to the providers and/or facilities named in the notice. What to Include Providers and facilities are required to use the standard notice and consent forms that will be issued by HHS for this exception to apply. These forms must be tailored to include certain specific information, including (1) the out-of-network providers and/or facilities to which it applies, and (2) a good-faith cost estimate for the applicable items or services. The notice, and subsequent consent, will only be valid for those providers and/or facilities named in the notice. How to Provide Notice The notice and consent documents must be given to the individual together, and they must be physically separate from, and not attached or incorporated into, any other documents. The documents may be given electronically if the individual so chooses. Additional Details Like the disclosure requirements, the notice and consent forms must meet language access and timing requirements specified by the rule. The individual may revoke their consent at any time prior to the furnishing of the relevant items or services by notifying the provider/facility in writing. Providers and facilities may refuse to treat individuals who do not consent, subject to other state and federal laws. Exceptions to the Exception In the following circumstances, the notice and consent exception is unavailable, and the balance billing prohibition always applies: Where notice is received by the individual, but consent is either not given or is revoked; Emergency services; Post-stabilization services, unless certain conditions are met; Air ambulance services; Items or services furnished as a result of unforeseen, urgent medical needs that arise at a time an item or service is furnished for which notice and consent was received; and Ancillary services, such as anesthesiology, pathology, radiology, and neonatology, whether provided by a physician or a non-physician practitioner. Penalties HHS may impose civil monetary penalties of up to $10,000 per violation on providers and facilities that violate the balance billing prohibition requirements. However, these penalties may be waived if a provider or facility unknowingly violates the statute and should not have reasonably known that it did so, and within 30 days withdraws the bill in violation and reimburses the plan or individual for the difference between the amount billed and the correct billable amount, plus interest. Conclusion The final interim rule makes clear that beginning January 1, 2022, providers and facilities must address the disclosure and balance billing prohibitions in the No Surprises Act. While this article is not meant to encompass all of the details, it offers providers an overview of what these expectations are and what measures must be taken to comply with the rule.   If you have questions regarding the No Surprises Act, please contact the authors or any member of Dorsey’s Health Transactions and Regulations practice group. [1]             Office of Personnel Mgmt. et al., Requirements Related to Surprise Billing; Part I, at *2 (2021). Summer Associate Hannah McCallum provided substantial assistance researching and drafting this article.

In just two weeks, on January 19, 2021, a sweeping set of changes to the federal physician self-referral law (or “Stark Law”) and anti-kickback statute (“AKS”) regulations go into effect.  These changes, which are part of the U.S. Department of Health and Human Services (“HHS”) “Regulatory Sprint to Coordinated Care,” are the most significant changes to the Stark Law and AKS in a decade.  There are hundreds of pages of preamble guidance and revised regulation text setting forth these sweeping changes from the Centers for Medicare & Medicaid Services (“CMS”) and HHS Office of Inspector General (“OIG”). To help you digest these materials, a team of attorneys from Dorsey & Whitney’s Healthcare Transactions and Regulations Practice Group has published two white papers, which are available at the following links: White Paper: Understanding the Final Rules to Revise the Stark Law Regulations White Paper: Understanding the Final Rules to Revise the Anti-Kickback Statute and Beneficiary Inducement Civil Monetary Penalty Regulations These white papers provide an in-depth summary of the changes to these regulations, including key provisions from CMS and OIG preamble guidance.  Please contact the authors or your regular Dorsey attorney if you would like assistance with understanding how the final rules impact your organization.

The Department of Health and Human Services Office of Inspector General (“OIG”) has issued a Special Fraud Alert to highlight what it views as inherent risks associated with speaker programs that pharmaceutical and medical device companies organize and fund. These programs are typically company-sponsored events at which one or more physicians or other health care professionals make presentations about a device or drug product or disease state.  The company will usually pay the speaker an honorarium and expenses, and may pay travel or other costs of attendees. Using unusually strong language, the OIG states that it is “skeptical about the educational value of such programs.”   Numerous investigations have revealed to the OIG that, often, health care professionals receive generous compensation to speak at these programs, and that the programs are offered under circumstances unconducive to learning, or involve audience members who have no legitimate reason to attend.  These cases cause the OIG to conclude that in many circumstances at least one purpose of the compensation paid to the speaker (and to the attendees), is to induce or reward referrals of the company’s products.  Any payment made purposefully to induce or reward referrals of items payable by a federal health care program is a violation of the federal anti-kickback statute, which is a felony punishable by a fine of up to $100,000, imprisonment for 10 years, or both.  Violation of the anti-kickback statute can also lead to liability under the federal civil false claims act, civil monetary penalties, and exclusion from federal health care programs.  Health care professionals who solicit or accept such payments are also at risk of violating the anti-kickback statute. Some of the characteristics of suspect speaker programs include: Sales or marketing personnel influence speaker selection; Health care professionals attend multiple programs on the same topic; The company sponsors numerous programs on the same or similar topics, particularly without a recent substantive change in the information; Significant time elapses with no new medical or scientific information nor new FDA-approved or cleared indication for a product; The company pays more than fair market value for the speaking services or pays compensation that takes into account the volume or value of past or potential future business generated by the health care professionals; Attendees include those without a legitimate business reason to attend; The location of the program is not conducive to the exchange of education information; or Alcohol (particularly fee alcohol), or a meal exceeding modest value is provided to attendees. The OIG points out that many other ways exist for health care professionals to obtain information about drug or device products, such as online resources, third-party educational conferences, medical journals, and others.  The existence of these other resources that do not involve payment to health care professionals suggests to the OIG that at least one purpose of payment associated with speaker programs is often to induce or reward referrals. The current pandemic emergency has put many in-person speaking programs on hold.  When in-person speaking programs resume, it will be important for medical device and pharmaceutical companies to review their speaker program practices, and take into account the OIG’s strong skepticism.   Both the OIG fraud alert and the alternative ways that health care professionals have learned about drug and device products during the pandemic have altered the landscape for speaker programs:  speaker program sponsors should take notice. If you have questions about the topic addressed here, please contact the author of any member of the Dorsey &Whitney Health Care Transactions & Regulations Practice Group.

The Centers for Medicare and Medicaid Services (“CMS”) published an Interim Final Rule in the Federal Register on September 2, 2020 to supplement and strengthen the agency’s enforcement of COVID-19 reporting requirements.  The final rule also modifies various aspects of Medicare reimbursement methodologies for health plans, physicians, and other providers.  This post summarizes each of these regulatory changes, which are effective as of September 2, 2020. New Enforcement Requirements for COVID-19 Related Data Reporting To assist public health officials in detecting and tracking COVID-19 outbreaks and save lives, CMS is adding new reporting requirements for healthcare facilities along with expanded CMS enforcement authority to ensure compliance with such reporting requirements. The Interim Final Rule addresses reporting and related enforcement for three general categories of healthcare entities: long term care (LTC) facilities, hospitals and critical access hospitals (CAHs), and laboratories. A. LTC Facilities Under CMS regulations issued in May, LTC facilities are required to electronically report COVID-related data to the Centers for Disease Control and Prevention (CDC) on a weekly basis. Facilities must report a variety of information, including suspected and confirmed COVID-19 infections among residents and staff, the number of COVID-19 resident and staff deaths, the personal protective equipment and hand hygiene supplies in the facility, and more. The Interim Final Rule allows CMS to impose civil money penalties (“CMPs”) if a LTC facility fails to submit its weekly report.  CMS may impose a minimum of $1,000 for an initial violation. For every subsequent time the facility fails to report the required data, the CMP imposed will increase by $500, up to a maximum of $6,500.  For example, a facility that fails to report for two consecutive weeks will be subject to a minimum CMP of $2,500: $1,000 for the first week and $1,500 for the second week. CMS waived the normal notice-and-comment process due to the urgent need to track and contain COVID-19 infection outbreaks. LTCs are subject to these new penalties for reporting failures effective September 2, 2020, and the penalties will continue to be in effect for up to one year beyond the end of the COVID-19 public health emergency (“PHE”). B. Hospitals and CAHs The Interim Final Rule also makes daily reporting of COVID-related data a Condition of Participation in the Medicare and Medicaid programs for hospitals and CAHs. To support broader surveillance of the spread of COVID-19, CMS will require hospitals and CAHs to report certain COVID-related information to the Department of Health and Human Services (“HHS”) daily, through a standardized format specified by HHS, set forth here. CMS does not have authority to impose CMPs on hospitals or CAHs who fail to provide this reporting. However, should a hospital or CAH fail to consistently report test results throughout the duration of the PHE, it will be non-compliant with the hospital and the CAH Conditions of Participation set forth at 42 CFR §§ 482.42(e) and 485.640(d), respectively, and consequently subject to CMS termination of its Medicare provider agreement. C. Laboratories Additionally, the Interim Final Rule modifies the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”) to require all laboratories to report SARS-CoV-2 test results within 24 hours of a positive test result. Reports must be made throughout the PHE, as specified here.  If a laboratory fails to submit SARS-CoV-2 test results as required under the CLIA modifications, the Department of Health and Human Services may impose CMPs or other penalties on the laboratory. CMS states that CMPs for reporting violations will be $1000 for the first day of noncompliance, and $500 for each subsequent day the laboratory fails to report SARS-CoV-2 test results. The applicable statute allows for the imposition of CMPs of up to $10,000 for each violation. LTCs Must Test Residents and Staff for COVID-19 In addition to reporting COVID-related data, LTCs are required under the new rule to test their facility residents and staff for COVID-19.   Testing includes not only staff employees, but volunteers and those providing services under arrangements at the facility.  Testing must be conducted in a manner consistent with current professional standards of practice for COVID testing.   Documentation of testing and resulting must be provided in staff personnel records, and in resident medical records. CMS has published additional guidance here that addresses testing frequency, types of testing that should be conducted, and guidance on handling staff who refuse testing, among other topics. Limitation on Medicare Coverage of COVID-19 Testing Without an Order In a prior Interim Final Rule with Comment Period, CMS expanded coverage for COVID-19 testing for Medicare beneficiaries by eliminating the need for an order from a treating physician or other practitioner. CMS has now revised this policy, citing fraud and abuse concerns and clinical concerns that beneficiaries are receiving too many COVID-19 tests without medical attention and oversight.  Consequently, beginning September 2 and continuing for the duration of the PHE, Medicare will cover only one (1) COVID-19 diagnostic test without the order of a physician or other practitioner.   A single otherwise covered laboratory test each for influenza or a similar respiratory condition needed to obtain a final COVID-19 diagnosis, when performed in conjunction with a COVID-19 test, will also be covered.  Medicare will cover additional COVID-19 tests only with the order of a physician or other practitioner. Any COVID-19 test(s) that a beneficiary received prior to September 2, 2020 is disregarded for purposes of this new single COVID-19 test coverage rule. CMS points out that this coverage rule applies to the Medicare program only; COVID-19 testing coverage policies for group health plans, health insurance issuers, and other public programs must comply with applicable law. CMS is also allowing pharmacists and other practitioners allowed to order laboratory tests in accordance with state scope of practice and other laws to fulfill the requirements related to orders for covered COVID-19 tests for Medicare patients. Quality Reporting: Updates to the Extraordinary Circumstances Exceptions (ECE) Granted for Four Value-Based Purchasing Programs in Response to the PHE for COVID-19, and Update to the Performance Period for the FY 2022 SNF VBP Program Early in the PHE, CMS granted several “Extraordinary Circumstances Exceptions” (“ECEs”) which relieved facilities of certain data collection and reporting obligations so that more time and resources could be directed to patient care. CMS used such data reporting to score certain program performance, resulting in adjustments of Medicare payments pursuant to certain value-based and quality-related features of Medicare reimbursement methodologies.  CMS states that, although it was gathering data on these programs, it has concerns about the national comparability of data due to the geographic differences of COVID-19 incidence rates and hospitalizations and the impacts of varying state and local laws and policy changes implemented in response to COVID-19. Therefore, the Department proposes updating the ECEs it granted for the following value-based purchasing programs: The End-Stage Renal Disease Quality Incentive Program (ESRD QIP); The Hospital-Acquired Condition (HAC) Reduction Program; The Hospital Readmissions Reduction Program (HRRP); and The Hospital Value-Based Purchasing (HVBP) Program. Under the updated ECEs, CMS will only score data that was voluntarily reported for the fourth quarter of calendar year 2019. Further, CMS will exclude all data reported for the first or second quarter of calendar year 2020, due to the significant and variable impacts COVID-19 had on facilities during this period. In addition, the Interim Final Rule updates the performance period for the fiscal year 2022 SNF VBP Program, because CMS believes that the current measurement periods would not produce reliable results for measuring SNF quality of care as determined by hospital readmission rates.  The measurement periods are changing from October 1, 2019 through December 31, 2019 and July 1, 2020 through September 30, 2020 to April 1, 2019 through December 31, 2019 and July 1, 2020 through September 30, 2020. NCD Procedural Volumes for Facilities and Practitioners to Maintain Medicare Coverage The Interim Final Rule acknowledges that, because of the PHE, far fewer non-essential procedures have been performed over the past several months. As a result, hospitals and practitioners may not be able to meet certain procedural volume requirements that are set forth in certain national coverage determinations (“NCDs”), including: NCD 20.34 Percutaneous Left Atrial Appendage Closure (LAAC). NCD 20.32 Transcatheter Aortic Valve Replacement (TAVR). NCD 20.33 Transcatheter Mitral Valve Repair (TMVR). NCD 20.9.1 Ventricular Assist Devices (VADs). Typically, failure to meet the procedural volume requirements would prevent Medicare payment for those categories of procedures.  However, CMS will not enforce the procedural volume requirements contained in the four above-noted NCDs because of disruptions caused by the PHE. This waiver of enforcement only applies to facilities and practitioners that had met the volume requirements prior to the PHE for COVID-19. All other non-volume based coverage requirements under these NCDs remain in effect. Merit-Based Incentive Payment System (MIPS) Updates CMS is making changes to the Merit-Based Incentive Payment System (“MIPS”) for physicians and other clinicians, to reflect the manner in which Medicare beneficiaries are receiving primary care services during the PHE.  For the 2020 MIPS performance year and any subsequent performance year that starts during the PHE, CPT and HCPCS codes for communications technology-based services and telephone evaluation and management services are to be included in the definition of primary care services under MIPS.  This will allow those remote services to be included in CMS determinations of where Medicare beneficiaries receive a plurality of their primary care services for purposes of MIPS beneficiary assignment to physicians and other clinicians. CMS is also modifying one of the Improvement Activities in MIPS relating to COVID-19 clinical trial participation, so that clinicians can receive credit under this Improvement Activity not only for participating in a COVID-19 clinical trial, but also for participating in the care of patients diagnosed with COVID-19 and simultaneously submitting relevant clinical data to a clinical data registry for ongoing or future COVID-19 research. Recognizing Temporary Premium Credits as Premium Reductions CMS previously adopted policies allowing health insurance issuers offering health insurance coverage in the individual and small group markets on the American Health Benefit Exchanges established under The Patient Protection and Affordable Care Act (Pub. L. 111-148) to grant temporary premium credits for individuals and small businesses that may be struggling to pay premium during the PHE.  In this Interim Final Rule, CMS makes a number of technical changes and clarifications to ensure that health plan premium reporting takes into account any premium credits granted, including for purposes of medical loss ratio (MLR) reporting and rebates. Part C and Part D Health Plan Star Ratings Finally, CMS made changes to the Star Rating system for Medicare Part C and Part D health plans.  The Star Rating system allows CMS to publish comparative information to beneficiaries about Medicare Advantage and Medicare Part D health plans, and is the basis for determining quality bonus payments to Medicare Advantage plan, as well as beneficiary rebates. CMS currently excludes certain scores within the Stark Rating system if a plan has 60 percent or more of its enrollees living in a Federal Emergency Management Agency (FEMA)-designated Individual Assistance area.  Because of the PHE, the maintenance of this rule would remove almost all plans from those scoring metrics.  Consequently, CMS is removing that 60 percent rules for the 2022 Star Ratings (for which 2020 is the measurement year) to avoid having to exclude the vast majority of plans from the methodology. This recent Interim Final Rule clearly indicates that CMS wants to ensure consistent reporting of COVID-19 related data from laboratories, hospitals and long term care facilities.  It also illustrates the profound and widespread degree to which the PHE continues to impact Medicare reimbursement methodologies and systems. If you have any questions about the Interim Final Rule or any of the topics addressed in this post, please contact the authors or any member of the Dorsey & Whitney Health Transactions & Regulations Practice Group.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Andrew Brantingham, Ross C. D'Emanuele, and Alex Hontos for the following post from Dorsey's FCA Now blog: The CARES Act allocated $100 billion in relief funds to hospitals and other healthcare providers, to be distributed by the Department of Health and Human Services (“HHS”) through the Public Health and Social Services Emergency Relief Fund (or “Provider Relief Fund”). Many healthcare providers across the country have received payments from the Fund...[Continue Reading]

As we described in our prior blog post, on March 30, 2020, the Centers for Medicare & Medicaid Services (“CMS”) published multiple COVID-19 Blanket Waivers for Health Care Providers. CMS announced another round of Blanket Waivers on April 30, which are available here. These waivers provide additional flexibility to health care providers responding to the COVID-19 pandemic by expanding access to telehealth services and giving providers and facilities relief from many reporting and audit requirements so they can focus on patient care. The following is a summary of the new Blanket Waivers available to providers. These Blanket Waivers are retroactively effective back to March 1, 2020 and will continue through the end of the emergency declaration. Flexibility for Medicare Telehealth Services Eligible Practitioners CMS is expanding the types of health care practitioners who may be reimbursed for providing Medicare telehealth services to all practitioners who are eligible to bill Medicare for non-telehealth services. Thus, physical therapists, occupational therapists, speech language pathologists, and others may now furnish and receive reimbursement for Medicare telehealth services. Audio-Only Telehealth for Certain Services CMS is now permitting more services to be provided by audio-only technology. Several evaluation and management services, behavioral health counseling, and educational services no longer require a two-way, real-time interactive communication between the patient and practitioner. For a list of billing codes for these audio-only services, please review the CMS list of Medicare telehealth services, available here. Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) Certain Staffing Requirements In an effort to address potential staffing shortages, CMS is waiving the requirement that certain practitioners (NP, PA, or certified nurse-midwife) be available to furnish patient care services at least 50 percent of the time a Rural Health Clinic operates. However, a physician, nurse practitioner, physician assistant, certified nurse-midwife, clinical social worker, or clinical psychologist must still be available to furnish patient care services at all times the Rural Health Clinic operates. Long-Term Care Facilities and Skilled Nursing Facilities (SNFs) and/or Nursing Facilities (NFs) Quality Assurance and Performance Improvement (QAPI) CMS is modifying QAPI program requirements to the extent necessary to narrow the scope of the QAPI program to focus on adverse events and infection control. This will help ensure facilities focus on aspects of care delivery most closely associated with COVID-19 during the PHE. In-Service Training Nursing assistants will now have more time to complete their required 12 hours of in-service training. CMS has extended the deadline for completing this training until the end of the first full quarter after the declaration of the PHE concludes. Detailed Information Sharing for Discharge Planning for Long-Term Care (LTC) Facilities In order to help long-term care facilities expedite the discharge and movement of residents among care settings, CMS is waiving the discharge planning requirement that facilities must assist residents and their representatives in selecting a post-acute care provider using data such as standardized patient assessment data, quality measures, and resource use. All other discharge planning requirements remain in place. Clinical Records Long-term care facilities may now take ten working days to provide a resident a copy of their records after requested. Previously, facilities were required to provide a copy within two working ways when requested by the resident. Home Health Agencies (HHAs) Training Requirement for Home Health Aides Medicare conditions of participation for HHAs state that each Home Health Aide must receive 12 hours of in-service training every 12 months. To give both aides and the nurses that provide the training more time to perform patient care, this training requirement is postponed, and the new deadline for aide in-service training is the end of the first full quarter after the declaration of the PHE concludes. Detailed Information for Discharge Planning The requirement to provide patients with detailed information regarding discharge planning in selecting a post-acute care provider (such as quality and resource use measures of potential providers) is temporarily waived during the PHE. All other discharge planning requirements remain applicable. Clinical Records HHAs may take ten business days to provide a patient with copies of their medical records, instead of four business days. Hospice Training Requirement for Home Health Aides Hospice conditions of participation requiring the annual assessment and in-service training and education of all individuals furnishing care is postponed until the end of the first full quarter after the declaration of the PHE concludes. HHAs and Hospice Onsite Supervisory Visits For both HHAs and Hospices, the condition of Medicare participation that requires a registered nurse (or for HHA any other appropriate skilled professional) to make an annual onsite supervisory visit for each aide is postponed. Postponed onsite assessments must be completed no later than 60 days after the expiration of the PHE. Quality Assurance and Performance Improvement (QAPI) To allow HHAs and Hospices to focus on COVID-19 effort, the requirement that HHAs and Hospices maintain an effective, ongoing, data-driven QAPI program is modified to narrow the scope of the mandated QAPI program to infection control issues. Remaining QAPI activities should focus on adverse events. Ambulatory Surgical Centers (ASCs) Medical Staff During the PHE, CMS is waiving the ASC conditions of coverage requiring ASCs to periodically reappraise medical staff privileges. This will allow physicians whose privileges will expire to continue practicing at the ASC without the need for reappraisal. Community Mental Health Centers (CMHCs) Quality Assurance and Performance Improvement (QAPI) While maintaining the general requirement that CMHCs maintain an effective, ongoing, data-driven QAPI program, CMS is waiving the specific detailed requirements for QAPI program organization and content to provide flexibility for CMHCs to focus QAPI resources on circumstances that arise during the PHE. CMHC modifications to QAPI programs must be consistent with a state’s emergency preparedness or pandemic plan. Home Services CMS is waiving the prohibition on CMHCs providing partial hospitalization services and other CMHC services in an individual’s home. This will allow clients to safely shelter in place during the PHE while receiving needed care and services from the CMHC. CMHCs must still assess client needs, implement and update each client’s individualized active treatment plan, and promote client rights, including a client’s right to file a complaint. 40% Rule To promote access to services, the requirement that CMHCs provide at least 40% of their items and services to individuals who are ineligible for Medicare benefits is waived. Physical Environment for Multiple Providers/Suppliers Inspection, Testing & Maintenance (ITM) under the Physical Environment Conditions of Participation: CMS is waiving the following physical environment requirements for Hospitals, CAHs, inpatient hospices, ICF/IIDs, and SNFs/NFs to reduce disruption of patient care and potential exposure/transmission of COVID-19. Requirements to maintain facilities and equipment to ensure an acceptable level of safety and quality are temporarily modified as necessary to permit these facilities to adjust scheduled inspection, testing and maintenance (ITM) frequencies and activities for facility and medical equipment. These facilities may adjust scheduled ITM frequencies and activities required by the applicable Life Safety Codes and Health Care Facilities Codes. The following are not included in this waiver:  Sprinkler system monthly electric motor-driven and weekly diesel engine-driven fire pump testing. Portable fire extinguisher monthly inspection. Elevators with firefighters’ emergency operations monthly testing. Emergency generator 30 continuous minute monthly testing and associated transfer switch monthly testing. Means of egress daily inspection in areas that have undergone construction, repair, alterations or additions to ensure its ability to be used instantly in case of emergency. Requirements to have an outside window or outside door in every sleeping room are waived to permit these providers to utilize space not normally used for patient care for temporary care or quarantine. If you have any questions about the CMS Blanket Waivers, please contact the authors or your regular Dorsey & Whitney attorney. We continue to closely monitor the rapidly evolving legal landscape related to the COVID-19 pandemic. You can access Dorsey’s health law blog related to health law updates, available here. You can also access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here.

The recently-enacted Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”) is generally known for providing relief funds and other resources to help individuals, small businesses, state and local governments, and hospitals and healthcare providers address the COVID-19 public health emergency.  However, among the lesser-known of the CARES Act provisions are changes to federal law that will allow a significant harmonization of rules governing the confidentiality of substance use disorder patient records with the general federal rules governing the privacy of individually identifiable health information (i.e., the HIPAA privacy rules). Currently, a unique set of federal regulations found at 42 C.F.R. Part 2 restrict the disclosure and use of substance use disorder patient records that are maintained in connection with any federally-assisted substance use disorder program.  These “Part 2” rules are far stricter than the federal HIPAA privacy rules that apply generally to health plans and health care providers.  For example, whereas the HIPAA privacy rules allow health plans and health care providers to use and disclose protected health information (“PHI”) for purposes of treatment, payment, and health care operations without a patient’s written or oral consent, the Part 2 rules do not.  Another important distinction between the Part 2 rules and HIPAA is that if a patient authorizes the disclosure of PHI under HIPAA to an entity that is not regulated by HIPAA, then the PHI disclosed to that recipient falls outside the protections of HIPAA.  In contrast, when a patient consents to the disclosure of their substance use disorder records under Part 2, the Part 2 rules continue to apply to the records disclosed, even when the recipient is not a regulated Part 2 SUD program. Section 3221 of the CARES Act modifies the statute governing the confidentiality of SUD records in various and important ways.  First, a Part 2 SUD program will be allowed to obtain the prior written consent of a patient to use and disclose SUD records for purposes of treatment, payment, and health care operations as permitted by the HIPAA privacy rules.  An SUD program will need to obtain that patient consent only once, and the consent will apply to all future uses and disclosures of SUD records until a patient revokes the consent in writing. The statute goes on to state that any information disclosed pursuant to such a consent may then be redisclosed in accordance with the HIPAA regulations.   Although not entirely clear, this appears to mean that an entity not regulated by HIPAA that receives SUD records pursuant to a consent may redisclose the records without limitation under either HIPAA or the Part 2 rules. The CARES Act also states explicitly that the HIPAA breach notification provisions apply to SUD records held by a Part 2 program in the same manner that those rules apply to HIPAA covered entities. Furthermore, the CARES Act extends HIPAA’s penalty and enforcement provisions to violations of the Part 2 rules.  Although the Department of Health and Human Services (“HHS”) will need to issue regulations to confirm the operation of these enforcement provisions, this appears to mean that the HHS Office for Civil Rights may take on the civil enforcement of the Part 2 rules, in addition to enforcing the HIPAA rules. The primary reason for the historically strict privacy rules applicable to SUD records is to ensure that a patient receiving treatment for a substance use disorder in a Part 2 program is not more vulnerable because of the availability of their patient record than an individual with a substance use disorder who does not seek treatment.  In an effort to maintain this public policy goal while at the same time making the Part 2 rules more consistent with the HIPAA rules, the CARES Act enacts a general antidiscrimination provision prohibiting any entity from discriminating against an individual on the basis of information in Part 2 SUD records in: (a) admission, access to, or treatment for health care; (b) hiring, firing, or terms of employment or receipt of worker’s compensation; (c) the sale, rental, or continued rental of housing; (d) access to federal, state, or local courts; or (e) access to, approval of, or maintenance of government social services and benefits. Furthermore, other than as authorized by a court order or consented to by the patient, no SUD records or testimony relaying the information contained in such records, may be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any governmental authority against a patient. The statute mandates that regulations to implement and enforce these CARES Act provisions be issued to facilitate their application to all uses and disclosure of SUD records occurring on or after one (1) year following the enactment of the CARES Act (which would be March 27th, 2021).   Once implemented, the CARES Act provisions will be helpful to Part 2 programs, many of which struggle with the complexity of complying with both HIPAA and the Part 2 privacy rules.  But the new Part 2 law will by no means alleviate all of that complexity.  For example, a Part 2 program will be required to obtain a patient’s written consent in order to use and disclose SUD records for treatment, payment, and health care operations purposes; for those Part 2 program patients that refuse to sign such a consent, the Part 2 program will likely need to segregate those SUD records in order to manage the stricter limitations on their use and disclosure.  Moreover, the CARES Act does not harmonize Part 2 and HIPAA entirely; there will remain many uses and disclosures that are permitted under HIPAA but not permitted with regard to SUD records under Part 2.  Ultimately the CARES Act provisions modifying the Part 2 confidentiality rules will mitigate, but not eliminate, the complexities of managing patient records regulated by two separate sets of federal privacy rules. If you have questions about the CARES Act, HIPAA, or the Part 2 rules, please contact the author or any attorney in the Dorsey & Whitney health transactions and regulations practice group.

On Mach 27, 2020, President Trump signed the CARES Act, providing in part for $100 billion in relief funds to eligible health care providers and suppliers affected by COVID-19.  The funding is intended to support healthcare-related expenses, including lost revenue, attributable to the pandemic. Many providers and suppliers received notice on Friday, April 10 that they are recipients of relief funds.  HHS emphasized that these are not loans and will not need to be repaid by recipients.  Below is a summary of the guidance issued by HHS in connection with the initial $30 billion infusion and a brief description of the terms and conditions to which recipients must adhere. Eligibility All facilities and providers that received Medicare fee-for-service (“FFS”) reimbursements in 2019 are eligible to receive these funds.  As noted above, the payments are intended to provide relief to providers in areas impacted by COVID-19 and those providers and suppliers who have been impacted financially by the crisis as a result of healthy patients delaying care and the cancellation of elective procedures.  As a condition of receiving these funds, providers and suppliers must agree not to seek out-of-pocket payments from a patient treated for COVID-19 that are greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. The relief payments will be made according to taxpayer identification numbers (“TIN”) in accordance with the following: Large Organizations and Health Systems: Large Organizations will receive relief payments for each of their billing TINs that bill Medicare. Each organization should look to the part of their organization that bills Medicare to identify details on Medicare payments for 2019 or to identify the accounts where they should expect relief payments. Employed Physicians: Employed physicians should not expect to receive an individual payment directly. The employer organization will receive the relief payment as the billing organization. Physicians in a Group Practice: Individual physicians and other clinicians in a group practice are unlikely to receive individual payments directly, as the group practice will receive the relief fund payment as the billing organization. Solo Practitioners: Solo practitioners who bill Medicare will receive a payment under the TIN used to bill Medicare. Determining Distributions HHS indicated that these payments will be based on the provider’s or supplier’s share of total Medicare FFS reimbursements in 2019.  HHS estimates that total FFS payments in 2019 were approximately $484 billion. Providers and suppliers can estimate their payment by dividing their 2019 Medicare FFS (not including Medicare Advantage) payments they received by $484,000,000,000, and multiply that ratio by $30,000,000,000. Providers and suppliers can obtain their 2019 Medicare FFS billings from their organization's revenue management system. Example: A community hospital that billed Medicare FFS $121 million in 2019 would divide that amount by the total Medicare FFS payments (i.e. $484B) and multiply that by the total amount available (i.e. $30B). ($121,000,000/$484,000,000,000 x $30,000,000,000 = $7,500,000) How Will I Receive These Funds? HHS has partnered with UnitedHealth Group (“UHG”) in an effort to provide rapid payment of these funds.  Eligible recipients will be paid via their ACH account information on file with UHG or on file with the Centers for Medicare and Medicaid Services (“CMS”).  The payments are automatic so recipients do not need to take further action to receive them.  Recipients that receive payments electronically should look for a payment via Optum Bank with “HHSPAYMENT” as the payment description.  Recipients who normally receive a paper check for reimbursement from CMS can expect to receive a check in the next few weeks.  Within 30 days of receiving this payment, recipients must sign an attestation confirming receipt of these funds and agree to the terms and conditions of payment.  The portal for signing the attestation will be open the week of April 13, 2020. Terms and Conditions Within 30 days of receiving payment, recipients must attest to receiving the funds and agree to the Terms and Conditions posted by HHS. Below is a brief summary of those terms and conditions. The recipient must certify the following: that it billed Medicare in 2019; currently provides diagnoses, testing, or care for individuals with possible or actual cases of COVID-19; is not currently terminated from participation in Medicare; is not currently excluded from participation in Medicare, Medicaid, and other Federal health care programs; and does not currently have Medicare billing privileges revoked. The payment may only be used to prevent, prepare for, and respond to coronavirus, and shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. Payment may not be used to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. The recipient must provide reports to HHS as the Secretary determines at a later date. Not later than 10 days after the end of each calendar quarter, any recipient that is an entity receiving more than $150,000 total in funds under any of the stimulus packages making appropriations for the coronavirus response and related activities shall submit to the Secretary and the Pandemic Response Accountability Committee a report containing the following information: the total amount of funds received from HHS under one of the foregoing enumerated Acts; the amount of funds received that were expended or obligated for reach project or activity; and a detailed list of all projects or activities for which large covered funds were expended or obligated. Recipients are required to maintain appropriate records and cost documentation as required by 45 CFR § 75.302 and 45 CFR § 75.361 through 75.365, and other information required by future program instructions to substantiate the reimbursement of costs under this award. Entities who have received federal awards in the past may already be familiar with these regulations.  These regulations set forth financial management and standards for federal awards, including maintaining accurate and complete documentation and having written policies and procedures detailing the accounting systems in place to perform the following: The ability to report revenue and expenditures separately by federal program; Identification in its chart of accounts of all federal awards received and expended under which federal program; and The process of maintaining records pertaining to the source and application of receipts and disbursements, federal awards, authorizations, obligations, unobligated balances, assets, expenditures, and income and interest, which must be supported by source documentation. For all care for a possible or actual case of COVID-19, the recipient must certify that it will not seek to collect from the patient out-of-pocket expenses in an amount greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. The Terms and Conditions include a number of statutory provisions that also apply to recipients.  More relief funds will be made available in the coming weeks.  HHS indicated that the next round of funding from the remaining $70 billion would be targeted to providers and suppliers in areas particularly impacted by the COVID-19 outbreak, rural providers, providers of services with lower shares of Medicare reimbursement or those who predominantly serve the Medicaid population, and providers requesting reimbursement for the treatment of uninsured patients. If you have any questions about the CARES Act, please contact the authors or your regular Dorsey & Whitney LLP attorney.  Dorsey is closely monitoring the rapidly evolving legal landscape related to the COVID-19 pandemic.

On Monday, April 6th the Centers for Medicare and Medicaid Services (“CMS”) adopted an interim final rule to change a wide range of Medicare payment policies during the COVID-19 public health emergency so that Medicare providers and suppliers have flexibility to furnish services to beneficiaries using remote communications technology. As healthcare providers implement infection prevention and control procedures throughout their operations, CMS recognizes that immediately and temporarily increasing the availability of services using telecommunications technology is necessary and appropriate to maintain Medicare beneficiary access to medically necessary services without jeopardizing their health or the health of the healthcare workers furnishing those services. The interim final rule with comment period is applicable to services provided beginning March 1, 2020, and will be effective for the period of the COVID-19 public health emergency. The rule addresses a variety of Medicare payment policies (including coverage, supervision, and “home bound” requirements) applicable to physicians and other clinicians, hospitals, home health agencies, hospice agencies, independent laboratories, ambulance service providers, rural health clinics, federally qualified health centers, inpatient rehabilitation facilities, and Medicare Part C and D health plans. The following summarizes the Medicare payment policy changes. 1. Place of Service Coding for Medicare Telehealth Services Medicare pays for a discrete set of services under Social Security Act § 1834(m) that are reported using codes that describe ‘‘face-to-face’’ services but are furnished using audio/video, real-time communication technology, instead of in-person. Clinicians bill for these Medicare telehealth services using a unique place of service code “02,” which identifies them as Medicare telehealth services. CMS pays the physician or practitioner for Medicate telehealth services at the lower Medicare Physician Fee Schedule “facility rate” because facility expenses (e.g., staff, supplies, and equipment) associated with the services are generally incurred by the site where the patient is located, and not by the remotely-located practitioner. On an interim basis CMS will pay for Medicare telehealth services at the rate that ordinarily would be paid under the Medicare physician fee schedule if the services were furnished in-person. Physicians and other practitioners billing for Medicare telehealth services should report the place of Service code that would have been reported had the service been furnished in person instead of place of service code “02.” Because Medicare identifies claims for telehealth services through the place of service code “02,” CMS has finalized use on an interim basis of CPT telehealth modifier 95, which applies to claim lines that describe services furnished via telehealth. 2. Additions to Medicare Telehealth Services As noted above, Medicare pays for a defined set of Medicare telehealth services. For telehealth services with dates of service beginning March 1, 2020 through the end of the declared COVID-19 public health emergency (including any renewals), CMS is adding the following services to the list of covered Medicare telehealth services. Together with CMS’ waivers the originating site requirements applicable to Medicare telehealth services and the OIG’s policy statement addressing waiver of beneficiary copayments for telehealth services, this expansion in covered telehealth services can facilitate the meaningful and quick expansion in deployment of telehealth services. A. Emergency Department Visits  99281 99282 99283 99284 99285 B. Initial and Subsequent Observation, and Observation Discharge Day Management 99217 99218 99219 99220 99224 99225 99226 99234 99235 99236 C. Initial Hospital Care and Hospital Discharge Day Management 99221 99222 99223 99238 99239 D. Initial Nursing Facility Visits and Nursing Facility Discharge Day Management 99304 99305 99306 99315 99316 E. Critical Care Services 99291 99292 F. Domiciliary, Rest Home, or Custodial Care Services 99327 99328 99334 99335 99336 99337 G. Home Visits 99341 99342 99343 99344 99345 99347 99348 99349 99350 H. Inpatient Neonatal and Pediatric Critical Care 99468 99469 99471 99472 99473 99475 99476 I. Initial and Continuing Intensive Care Services 99477 99478 99479 99480 J. Care Planning for Patients With Cognitive Impairment 99483 K. Group Psychotherapy 90853 (Group psychotherapy (other than of a multiple-family group)) L. End-Stage Renal Disease (ESRD) Services 90952 90953 90959 90962 M. Psychological and Neuropsychological Testing 96130 96131 96132 96133 96136 96137 96138 96139 N. Therapy Services: For these services, CMS states that because Social Security Act § 1834(m) does not provide for payment for these services as Medicare telehealth services when furnished by physical therapists, occupational therapists, or speech language pathologists. 97161 97162 97163 97164 97165 97166 97167 97168 97110 97112 97116 97535 97750 97755 97760 97761 92521 92522 92523 92524 92507 O. Radiation Treatment Management Services 77427 77427 3. Frequency Limitations on Subsequent Care Services in Inpatient and Nursing Facility Settings, and Critical Care Consultations CMS is removing the frequency restrictions for each of the following codes for subsequent inpatient visits and subsequent nursing facility visits furnished via Medicare telehealth for the duration of the PHE for the COVID–19 pandemic. A. Subsequent Inpatient Visits 99231 99232 99233 B. Subsequent Nursing Facility Visits 99307 99308 99309 99310 C. Critical Care Consultation Services G0508 G0509 4. Required ‘‘Hands-On’’ Visits for ESRD Monthly Capitation Payments Current Medicare rules state that for End Stage Renal Disease (“ESRD”) related services that are on the Medicare telehealth list, a required clinical examination of the vascular access site must be furnished face-to-face ‘‘hands on’’ (without the use of an interactive telecommunications system) by a physician, clinical nurse specialist (CNS), nurse practitioner (NP), or physician assistant (PA). CMS is permitting on an interim basis the required clinical examination to be furnished as a Medicare telehealth service during the COVID–19 pandemic. In addition, Medicare rules typically require that a beneficiary receive a face-to-face visit, without the use of telehealth, at least monthly in the case of the initial 3 months of home dialysis and at least once every 3 consecutive months after the initial 3. CMS states that they will exercise enforcement discretion on an interim basis to relax enforcement in connection with the requirements under Social Security Act § 1881(b)(3)(B) that certain visits be furnished without the use of telehealth. Specifically, CMS will not conduct review to consider whether those visits were conducted face-to-face, without the use of telehealth. This applies to the following codes: 90951 90952 90953 90954 90955 90957 90958 90959 90960 90961 90962 90963 90964 90965 90966 90967 90968 90969 90970 5. Communication Technology-Based Services Certain services are performed using remote communications technology and are paid for by the Medicare program, but are not considered Medicare telehealth services because these services are by their nature performed using communications technology and are not ordinarily performed in person. These services include certain remote patient monitoring services (e.g., CPT codes 99453, 99454, 99457, and 99458, virtual check-in services). CMS payment rules for these services have limited their use to established patients only, and advance beneficiary consent has been required. The interim final rule states that all of these services can be furnished to both new and established patients. CMS also states that beneficiary consent to receive these services can be obtained annually, can be obtained at the time that a service is furnished, and may be documented by auxiliary staff under general supervision. To mitigate exposure risks, CMS is also broadening the types of clinicians that can perform remote evaluation of patient images and virtual check-ins (HCPCS codes G2010 and G2012) to include licensed clinical social workers, clinical psychologists, physical therapists, occupational therapists, and speech-language pathologists. 6. Direct Supervision Many services paid under the Medicare physician fee schedules, such as services performed incident to a physician’s professional service (see 42 C.F.R. § 410.26), must be provided under the direct supervision of the billing physician or nonphysician practitioner, meaning that the physician or nonphysician practitioner must be present in the office suite and immediately available to furnish assistance and direction throughout the performance of the procedure. CMS is temporarily modifying the definition of direct supervision at 42 C.F.R. § 410.32(b)(3)(ii) to state that direct supervision includes virtual presence through audio/video real-time communications technology. Similarly, the definitions of direct supervision applicable to hospital outpatient services at 42 C.F.R. § 410.28(e)(1) and hospital rehabilitation and intensive cardiac rehabilitation services described at 42 C.F.R. §§ 410.47 and 410.49 are modified in the same manner to permit physician supervision of these hospital services via virtual presence through audio/video real-time communications technology when use of such technology is indicated to reduce exposure risks for the beneficiary or health care provider. Additionally, the minimum default level of physician supervision for the initiation of outpatient non-surgical extended duration therapeutic services will now be changed from direct supervision to general supervision. 7. Definition of Homebound for Purposes of Home Health Benefits The interim final rule addresses whether beneficiaries instructed to remain in their homes or are under ‘‘self-quarantine’’ are considered ‘‘confined to the home’’ or ‘‘homebound’’ for purposes of the Medicare home health benefit. CMS states that the current definition of ‘‘confined to the home’’ (that is, ‘‘homebound’’) would apply to patients: (a) Where a physician has determined that it is medically contraindicated for a beneficiary to leave the home because he or she has a confirmed or suspected diagnosis of COVID–19; or (b) where a physician determines that it is medically contraindicated for a beneficiary to leave the home because the patient has a condition that may make the patient more susceptible to contracting COVID–19. Beneficiaries must meet all other eligibility requirements to receive Medicare home health services. The beneficiary must be under the care of a physician; receiving services under a plan of care established and periodically reviewed by a physician; be in need of skilled nursing care on an intermittent basis or physical therapy or speech-language pathology; or have a continuing need for occupational therapy. 8. Home Health Benefits and Remote Technology CMS is also amending home health plan of care requirements at 42 C.F.R. § 409.43(a) to allow the integration of technology and remote communication into the home health plan of care, so long the use of technology is related to the skilled services being furnished by the nurse/therapist/therapy assistant to optimize the services furnished during the home visit, and that the use of technology is included on the home health plan of care along with a description of how the use of such technology will help to achieve the goals outlined on the plan of care without substituting for an in person visit as ordered on the plan of care. On an interim basis home health agencies can report the costs of telecommunications technology as allowable administrative and general costs on their cost reports. 9. Telecommunications and Hospice For hospices, regulations at 42 C.F.R. § 418.204 are modified to state that when a patient is receiving routine home care, hospices may provide services via a telecommunications system if it is feasible and appropriate to do so to ensure that Medicare patients can continue receiving reasonable and necessary services for the palliation and management of a patients’ terminal illness and related conditions without jeopardizing the patients’ health or the health of those who are providing such services. The use of such technology must be included on the plan of care. The inclusion of technology on the plan of care must continue to meet the requirements at 42 C.F.R. § 418.56, and must be tied to the patient-specific needs as identified in the comprehensive assessment and the measurable outcomes that the hospice anticipates will occur as a result of implementing the plan of care. Telecommunication technology can also be used by a hospice physicians or nurse practitioner for a face-to-face visit used solely for the purpose of recertifying a patient for hospice services. Telecommunications technology for this purposes means multimedia communications equipment that includes, at a minimum, audio and video equipment permitting two-way, real-time interactive communication between the patient and distant site hospice physician or nurse practitioner. Hospices can also report hospices can report the costs of telecommunications technology used to furnish services under the routine home care level of care during the public health emergency as ‘‘other patient care services’’ on their cost report. 10. Inpatient Rehabilitation Facilities In order to be considered medically necessary, inpatient rehabilitation facility services must be expected to require medical supervision involving a rehabilitation physician conducting face-to-face visits with the patient at least 3 days per week throughout the patient’s stay. CMS is modifying these rules to permit such visits to be conducted using remote telecommunication technology. In addition, CMS is temporarily eliminating the requirement that at the time of admission a patient’s medical record at the facility must contain a postadmission physician evaluation. 11. Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) For RHCs and FQHCs, CMS is expanding the services that can be included in the payment for HCPCS code G0071, and is updating the payment rate for this code to include the national non-facility payment rates for three new codes (CPT Codes 99421, 99422, and 99423) to reflect the addition of these services. In addition, to address the impact of the COVID–19 pandemic on underserved rural and urban communities, CMS is implementing changes to the requirements for visiting nursing services furnished in the home by RHCs and FQHCs. For the duration of the public health emergency, any area typically served by the RHC, and any area that is included in the FQHCs service area plan, is determined to have a shortage of home health agencies, and there is no need for the RHC or FQHC to request a determination that there is a shortage of home health agencies in the area in order for visiting nurse services to be covered by Medicare. 12. Clinical Laboratory Fee Schedule and Merit-based Incentive Payment System Updates In order to expand the testing available to Medicare beneficiaries who need it, payments will now be provided to independent laboratories for specimen collection for COVID-19 testing under certain circumstances. A travel allowance will also be provided for a lab technician to collect a specimen for testing from non-hospital inpatients or homebound patients. Clinician participation in a COVID-19 clinical trial utilizing a drug or biological product to treat a patient with a COVID-19 infection will now be credited as an improvement activity for the Merit-based Incentive Payment System (MIPS) 2020 performance period. Additionally, the MIPS automatic extreme and uncontrollable circumstances policy will be applied to MIPS eligible clinicians for the 2019 MPS performance period as data submission for 2019 will be impacted. 13. Opioid Treatment Programs Audio-only telephone calls will be permitted for the therapy and counseling portions of the weekly bundle of services furnished by Opioid Treatment Programs if the beneficiaries do not have access to two-way audio/video communications technology. 14. Teaching Physicians, Residents and Moonlighting Regulations The teaching physician regulations are amended to allow the teaching physician to provide supervision either with physical presence or be present through interactive telecommunications technology during the key portion of residents’ service. Residents may also provide services from quarantine, such as reading the results of tests and other imaging studies under the supervision of the teaching physician by interactive telecommunications technology. This change does not apply in the case of surgical, high risk, interventional, or other complex procedures, services performed through an endoscope, and anesthesia services. CMS clarified that Medicare may make payment under the PFS for teaching physician services, including under the primary care exception, when a resident furnishes telehealth services to beneficiaries under direct supervision of the teaching physician which is provided by interactive telecommunications technology. CMS is also permitting the hospital that is paying the resident’s salary and fringe benefits for the time that the resident is at home or in the home of a patient that is already a patient of the physician or hospital, but performing patient care duties within the scope of the approved residency program, to claim that resident for indirect medical education and direct graduate medical education purposes. During the emergency, “moonlighting,” or services of residents that are not related to their approved GME programs and are performed in the inpatient setting of a hospital in which they have their training program, are separately billable physicians’ services for which payment can be made. 15. Psychiatric Hospitals CMS has deleted several references to 42 C.F.R. § 482.12(c) in 42 C.F.R. § 492.61(d) to clarify that the latter’s provisions apply to all patients, not only Medicare beneficiaries. 16. Innovation Center Models CMS is now permitting certain beneficiaries to obtain the set of Medicare Diabetes Prevention Program (MDPP) services more than once per lifetime, increase the number of virtual make-up sessions, and allow certain MDPP suppliers to deliver virtual MDPP sessions on a temporary basis. CMS is also implementing a 3-month extension to the Comprehensive Care for Joint Replacement model performance year 5 and amending the CJR extreme and uncontrollable circumstances policy to be applicable to episodes impacted by the COVID-19 pandemic. 17. Remote Physiologic Monitoring Remote physiologic monitoring services can temporarily be furnished to new patients, as well as to established patients. Further, consent to receive RPM services can be obtained once annually, including at the time services are furnished, during the duration of the COVID-19 public health emergency. RPM codes can also be used for physiologic monitoring of patients with acute and/or chronic conditions. 18. Evaluation and Management (E/M) Services CMS is finalizing, on an interim basis, separate payment for CPT codes 98966-98968 and CPT codes 00441-99443. For these codes, work RVUs as recommended by certain AMA Committees are finalized: 0.25 for CPT code 98966 0.50 for CPT code 98967 0.75 for CPT code 98968 0.25 for CPT code 99441 0.50 for CPT code 99442 0.75 for CPT code 99443. Additionally, CMS is finalizing the recommended direct PE inputs which consist of 3 minutes of post-service RN/LPN/MTA clinical labor for each time code. CMS will also not conduct reviews to consider whether those services were furnished to established patients, and the services may be furnished to new patients as well. To facilitate billing of CPT codes 98966-98968, CMS is designating these codes as “sometimes therapy” services that would require the private practice occupational therapist, physical therapist, and speech-language pathologist to include the corresponding GO, GP, or GN therapy modifier on those claims. CMS is also permitting the office/outpatient E/M level selection for office/outpatient services when furnished via telehealth to be based on MDM or time, with time defined as all of the time associated with the E/M on the day of the encounter. Any requirements regarding documentation of history and/or physical exam in the medical record are removed for office/outpatient services via telehealth, though E/M visits should continue to be documented as necessary to ensure quality and continuity of care. 19. National Coverage Determination and Local Coverage Determination Requirements Certain National Coverage Determinations and Local Coverage Determinations of covered items or services will not apply during the COVID-19 Pandemic, including: face-to-face and in person requirements; clinical indications for certain respiratory, home anticoagulation management and infusion pump policies; and requirements for consultations or services furnished by or with the supervision of a particular medical practitioner or specialist. 20. Part C and Part D Quality Star Ratings CMS is modifying the calculation of the 2021 and 2022 Medicare Part C and D Star Ratings in several ways to address the expected disruption to data collection. The interim final rule: A. replaces the 2021 Star Ratings measures calculated based on HEDIS and Medicare CAHPS data collections with earlier values from the 2020 Star Ratings (which are not affected by the public health threats posed by COVID-19); B. establishes how CMS will calculate or assign Star Ratings for 2021 in the event that CMS’ functions become focused on only continued performance of essential agency functions and CMS and/or its contractors do not have the ability to calculate the 2021 Star Ratings; C. modifies the current rules for the 2021 Star Ratings to replace any measure that has a data quality issue for all plans due to the COVID-19 outbreak with the measure-level Star Ratings and scores form the 2020 Star Ratings; D. in the event that CMS is unable to complete HOS data collection in 2020 (for the 2022 Star Ratings), replaces the measures calculated based on HOS data collections with earlier values that are not affected by the public health threats posed by COVID-19 for the 2022 Star Ratings; E. removes guardrails for the 2022 Star Ratings; and F. expands the existing hold harmless provision for the Part C and D Improvement measures to include all contracts for the 2022 Star Ratings. 21. Ordering Medicaid Home Health Services In addition to physicians, licensed practitioners such as NPs and PAs may order Medicaid home health services during the existence of the PHE for the COVID-19 pandemic. These services include part-time or intermittent nursing, home health aide services, medical supplies, equipment, and appliances, and may include therapeutic services. This change applies to who can order home health services covered under 42 C.F.R. § 440.70(b)(1)–(4). It does not expand the benefit categories where these items can be covered. 22. Origin and Destination Requirements Under the Ambulance Fee Schedule The list of destinations for covered ambulance transportation is expanded to include all destinations, from any point of origin, that are equipped to treat the condition of the patient consistent with EMS protocols established by state and/or local laws where the services will be furnished. 23. Inpatient Hospital Services Furnished Under Arrangements Outside the Hospital The “under arrangements” policy is changed to allow hospitals broader flexibilities to furnish inpatient services, including routine services, outside the hospital. For services provided for discharges for patients admitted to the hospital during the PHE for COVID-19 beginning March 1, 2020, if routine services are provided under arrangements outside the hospital to its inpatients, these services are considered as being provided by the hospital. 24. Advance Payments to Suppliers Furnishing Items and Services under Part B Under Medicare Part B, the definition of advance payments to suppliers furnishing items and services will change from a payment made by the carrier to a payment made by the contractor, and payments under emergency exceptions will be permitted. CMS is also increasing the advance payment limit from 80 percent of the anticipated payment to 100 percent.

On March 30, 2020, the Centers for Medicare & Medicaid Services (“CMS”) published a compilation of COVID-19 Emergency Declaration Blanket Waivers for Health Care Providers (each, a “Blanket Waiver”). Section 1135 of the Social Security Act gives CMS the authority to issue waivers that ease requirements for providers affected by an emergency if: (1) the President makes an emergency declaration under the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5121-5207 (the “Stafford Act”); and (2) the Secretary of the Department of Health and Human Services declares a Public Health Emergency (“PHE”), both of which have now occurred in light of COVID-19. CMS is permitted to issue both blanket waivers and provider/supplier requested waivers on a case-by-case basis. Blanket waivers apply to all applicable providers and suppliers, while individual waivers apply only to the requesting provider or supplier. A provider or supplier need not request a provider/supplier-specific waiver of a requirement if CMS has issued a blanket waiver addressing the same requirement. It is important to note that 1135 waivers apply solely to federal requirements and do not apply to state licensure or other requirements. Any applicable state requirements (e.g., licensure) must also be addressed with the relevant state agency. Another important note of caution is that these 1135 waivers often include specific details and requirements. It is critical for health care providers to review the waivers carefully before taking action under them. To that end, providers should visit the CMS Coronavirus Waivers & Flexibilities website, here, to locate the specific guidance and requirements from CMS about the type of program waiver(s) being sought. CMS has provided numerous Frequently Asked Questions (“FAQ”) documents and provider-specific fact sheets that detail the details about and limits of the available waivers and flexibilities for each type of provider (hospital, skilled nursing facility, physicians, laboratories, home health providers, etc.). Additionally, this website contains links to all of the waivers provided in each state. The following is a summary of the Blanket Waivers CMS has made available to providers and suppliers on March 30, 2020. These Blanket Waivers are retroactively effective back to March 1, 2020 and will continue through the end of the emergency declaration. I. Hospital Waivers The Blanket Waivers include significant regulatory relief for hospitals. The following is a summary of the hospital-specific Blanket Waivers, and here is a CMS Fact Sheet that was published for hospitals to further explain these specific Blanket Waivers: a. Temporary Expansion Sites (a.k.a. Hospitals Without Walls) Under this Blanket Waiver, hospitals are permitted to offer health care services in locations that are not currently part of the hospital. Previously, hospitals would have been required to meet Life Safety Code and other regulatory provisions and obtain approvals to provide services in a new location. This waiver will help hospitals set up temporary expansion sites to offer inpatient services (e.g., nursing, room and board) in locations such as shell space in a hospital, parking structures, dormitories and the like – as long as the hospital exercises control and oversees the services provided at the location, and as long as the location is approved by the state (to ensure safety and comfort for patients and staff). CMS is also allowing currently enrolled ambulatory surgery centers (“ASCs”) to temporarily enroll as hospitals by calling the COVID-19 Provider Enrollment Hotline to complete and sign an attestation form in order to enroll and provide services during the PHE as a hospital. CMS also encourages other entities (e.g., freestanding emergency departments which are not currently allowed to enroll in Medicare) to call the COVID-19 Provider Enrollment Hotline to complete and sign an attestation form in order to enroll and provide services during the PHE. Further, CMS is allowing hospitals to change their provider-based locations to address patient needs, as well as allowing additional flexibilities related to inpatient services furnished under arrangements. Moreover, hospitals are permitted to screen patients at locations off of a provider’s campus, in order to avoid the spread of COVID-19. Further, for surge facilities in off campus departments, CMS is waiving the requirements to have policies and procedures for evaluating emergencies so these facilities do not need to focus time on drafting policies and procedures but rather can focus on patient care needs. b. Relaxed Paperwork, Policies, Cost Reporting, Filing Deadlines and Enrollment Requirements For hospitals that are impacted by a widespread outbreak of COVID-19, the timeframes for providing patients a copy of their medical records are waived, as are the requirements related to visitation and seclusion. Additionally, CMS is granting a 30-day post-discharge requirement to complete medical records, CMS is waiving medical records department staffing requirements, and also waiving specific requirements for the form and content of the medical record and the medical record completion requirements. Further, verbal orders can be authenticated more than 48 hours after the fact (although read-back verification is still required). CMS is also waiving requirements to provide information about advanced directives to patients. Further, To ensure that hospitals and critical access hospitals focus on patient care and ensuring patients are discharged in an appropriate setting, as opposed to focusing on the paperwork and other regulatory obligations, CMS is waiving the detailed regulatory paperwork and other requirements related to discharge planning. For example, CMS recognizes that during the PHE, hospitals may not be able to use specific quality metrics and other data, or a comprehensive list of nursing homes in the area, to select a nursing home or home health agency. However, hospitals are still required to work with families to ensure that the discharge meets patients’ care needs. Further, CMS is waiving the entire condition of participation related to utilization review plans and committees, nursing care plans, having available a current therapeutic diet manual, developing and implementing emergency preparedness policies and procedures and communication plans, as well as waiving the detailed provisions governing a hospital’s quality assessment and performance improvement program (although hospitals must still have such a program in place). CMS has established a toll-free hotline for all providers as well as significant flexibilities in provider enrollment. See here for additional information from CMS on provider enrollment relief, as well as our previous blog post on this topic, available here. Further, CMS is waiving the signature and proof of delivery requirements for Part B drugs and durable medical equipment (although the delivery and the fact that a signature could not be obtained due to COVID-19 should be documented in the record). Additionally, CMS is delaying the cost-report filing deadlines until June and July, and CMS is extending the data submission deadlines for hospitals on the reporting of occupational mix of employees until August 3, 2020. Further, Medicare Administrative Contractors (“MACs”), Qualified Independent Contractors (“QICs”), and Independent Review Entities (“IREs”) are allowed to grant extensions to providers on appeals and are permitted to offer other flexibilities on filings and deadlines. c. Critical Access Hospitals (“CAHs”) Without Walls CAHs are now permitted to exceed their 25 bed limit and the 96 hour length of stay limit. CMS is also permitting CAHs to treat patients in urban areas (they typically must be located in a rural area) as needed in order to establish surge locations. Further, CMS is waiving the restrictions on CAHs’ ability to establish off campus provider based locations, and to establish the normally restricted co-location arrangements with other providers. CMS is waiving the minimum personnel qualification requirements at CAHs for clinical nurse specialists, nurse practitioners and physician assistants, and CMS is deferring to the state for the requirements of staff licensure, certification or registration, which will allow more flexibility to CAHs in states where federal requirements are more stringent. d. Distinct Part Units CMS is also now allowing hospitals to house acute care patients in excluded distinct part units (as long as the unit’s beds are appropriate for acute inpatients). Hospitals are permitted to bill for the care provided in the distinct part unit under the Inpatient Prospective Payment System. Providers should annotate in the medical record to explain that the care was provided in the distinct part unit due to capacity issues related to the PHE. Hospitals are also now permitted to provide care in acute care beds and units for patients who would normally be treated in distinct part psychiatric units or distinct part rehabilitation units, as long as the acute beds and units are appropriate for such patients. Hospitals should continue to bill under the Inpatient Psychiatric or Inpatient Rehabilitation Prospective Payment System for those patients, and annotate in the medical record to explain that the care was provided in the acute care unit due to capacity issues or other exigent circumstances related to the PHE. e. Telemedicine CMS is waiving telemedicine restrictions on hospitals and CAHs to make it easier for these providers to provide telemedicine for their patients through agreements with off-site hospitals, in order to improve access to specialty care. f. Workforce CMS is waiving the sterile compounding requirements to allow the re-use of face masks. CMS is also waiving the 2-year reappointment period for medical staff re-credentialing, the requirement that patients in a hospital be under the care of a physician (to allow other practitioners like physician assistants and APRNs to be used to the fullest extent possible), and CMS is waiving the requirement for CRNAs to work under the supervision of a physician. Further, CMS has stated that Hospitals do not have to designate in writing the personnel qualified to perform specific respiratory care procedures or the amount of supervision required for personnel to carry out those procedures. II. Long-Term Care, Skilled Nursing Facilities, and Nursing Facility Waivers The Blanket Waivers provide a number of flexibilities related to nursing services. See here for the CMS fact sheet published specifically for long term care facilities. CMS is waiving the 3-day prior hospitalization requirement for coverage of a skilled nursing facility (“SNF”) stay, waiving the timeframe requirements for certain data submission for SNFs and long-term care (“LTC”) facilities, and allowing nursing homes to suspend pre-admission screening and annual resident review assessments. Certain physical environment requirements are now waived, allowing for expanded use of non-SNF buildings or non-resident rooms in a LTC facility for patients in certain emergency circumstances. To promote social distancing: requirements that residents participate in-person in resident groups are waived; requirements related to room-sharing and moving a resident’s room are waived for the purpose of grouping or separating residents with respiratory illness symptoms and/or residents with a confirmed COVID-19 diagnosis from residents without these symptoms or diagnosis; and physicians and non-physician practitioners may conduct visits through telehealth options when previously the visits were required to be in-person. CMS is also partially waiving training and certification requirements required for nurse aids employed for longer than four months at a facility in order to assist with potential staffing shortages. CMS has waived certain resident transfer and discharge requirements in particular circumstances, though advance notification and receiving facility agreements are generally still required, and related care planning requirements are also waived in certain circumstances. Additionally, CMS is delaying the cost-report filing deadlines until June and July, and CMS is extending the data submission deadlines for hospitals on the reporting of occupational mix of employees until August 3, 2020. Further, Medicare Administrative Contractors (“MACs”), Qualified Independent Contractors (“QICs”), and Independent Review Entities (“IREs”) are allowed to grant extensions to providers on appeals and are permitted to offer other flexibilities on filings and deadlines. III. Home Health, Hospice, ESRD, and DMEPOS Waivers CMS has provided FAQ documents on these waivers for home health, here; for hospice, here; for ESRD Facilities, here; and for DME Suppliers, here. Under the Blanket Waivers, CMS provided extensions for home health, hospice, and ESRD providers to complete certain assessment required for Medicare reimbursement. CMS also waived certain home health, hospice and ESRD in-person assessment, visit, and supervision requirements to reduce the need for ordinary course check-ins and to allow for greater use of telehealth. In addition, hospices are relieved of the requirement to provide non-core hospice services, such as physical therapy, occupational therapy, and speech-language pathology. In providing additional flexibility in timing and in-person visits, CMS’s goal is to support containment efforts for at-risk populations and to free up professional resources to focus on treatment of those infected with coronavirus and to focus on operations related to the pandemic. In addition, CMS is waiving certain routine audits, maintenance, and certification requirements for ESRD Facilities and ESRD Facility staff. Again, CMS is attempting to free up resources and provide flexibility to support providers’ focus on pandemic-related efforts. CMS authorized the establishment of Special Purpose Renal Dialysis Facilities (“SPRDF”) to mitigate transmission among the at-risk population. Such facilities do not require a federal survey to be completed before providing services. CMS is allowing physicians that are appropriately credentialed at a certified dialysis facility to provide care at a “designated isolation location” such as a SPRDF without separate credentialing. Dialysis services may now also be provided in nursing homes and SNFs, so long as the services and necessary equipment and supplies are provided by personnel of the resident’s usual Medicare-certified dialysis facility. In an effort to expedite supply of and reimbursement for DMEPOS, CMS is waiving the replacement requirements (such as the face-to-face requirement, a new physician’s order, and new medical necessity documentation) for DMEPOS that are lost, destroyed, irreparably damaged, or otherwise rendered unusable. DMEPOS suppliers must still provide a narrative description about why the equipment must be replaced. IV. Practitioner Licensure, Provider Enrollment, Appeals, and Medicaid/CHIP Waivers CMS has provided a specific fact sheet describing the waivers and flexibilities available for physicians and other clinicians, available here. The Blanket Waivers are intended to ease the burden on the health system in order to allow providers to focus on patient care. To that end, CMS is temporarily waiving the Medicare reimbursement requirements that out-of-state practitioners be licensed in the state in which they are providing services when they are licensed in another state when the following four conditions are met: The practitioner must be enrolled in Medicare; The practitioner must have a valid license to practice in the state which relates to his or her Medicare enrollment; The services must be furnished, whether in-person or remote via telehealth, in a state in which the emergency is occurring in order to contribute to relief efforts in his or her professional capacity; and The practitioner must not be excluded in any state that is part of the PHE. Please note that the foregoing Medicare reimbursement waiver for licensure does not waive state or local licensure requirements. As a result, providers must review the state licensure requirements in each jurisdiction prior to delivering telehealth to patients in that location. Please see the blog post we published on this topic of telehealth opportunities here. Additionally, CMS has taken a number of steps to ease the provider enrollment requirements. See here for additional information from CMS on provider enrollment relief, as well as our previous blog post on this topic, available here. CMS has set up a hotline for physicians and non-physician practitioners to enroll and receive temporary Medicare billing privileges. Additionally, CMS has taken the following steps to facilitate the enrollment of providers in the wake of the COVID-19 outbreak, including: Waiver of certain screening requirements, including application fees, background checks, and site visits; Postponement of revalidation actions; Allowing licensed providers to render services outside their state of enrollment;  Expediting pending or new applications;  Easing telehealth restrictions; and Allowing physicians and non-physician practitioners to terminate opt-out status early and enroll in Medicare. Regarding appeals, the new waivers grant broad powers to MACs, QICs, and IREs to relax the requirements of federal regulations regarding the appeals process in FFS, and Parts C and D. MACs, QIEs, and IREs are instructed to allow extensions to file an appeal and to permit the waiver of requests for timeliness requirements for additional information to adjudicate appeals. MACs, QICs, and IREs are now allowed to process an appeal even with incomplete Appointment of Representation forms as outlined in federal regulations. Additionally, MACs, QICs, and IREs can now process appeals that do not meet the required elements of those same federal regulations. MACs, QICs, and IREs are given broad flexibility with respect to other parts of the appeals process so long as good cause requirements are satisfied. Finally, regarding Medicaid and CHIP, the new waivers permit states to request approval that certain statutes and implementing regulations be waived under section 1135. To request such an approval, states may submit an 1135 waiver request directly to their Center for Medicaid and CHIP Services (CMCS) state lead or Jackie Glaze, Acting Director, Medicaid and CHIP Operations Group, Center for Medicaid and CHIP Services at CMS by e-mail (Jackie.Glaze@cms.hhs.gov) or by letter. CMS sets forth a number of examples of the kinds of requests that states can make under this waiver, including: Waiver of prior authorization requirements for FFS programs; Waiver of out-of-state requirements for providers to provide care to another state’s Medicaid enrollees impacted by COVID-19; Temporary suspension of provider enrollment and revalidation requirements to increase access to care; Temporary waiver of state licensure requirements; Temporary suspension of requirements for pre-admission and annual screening requirements for nursing home residents. CMS encourages states to assess their needs and take advantage of these waivers. To assist states with the waiver request process and provide additional guidance, CMS released the Medicaid and CHIP Disaster Response Toolkit, which can be found here. Further, the CMS Coronavirus Waivers & Flexibilities website, here, contains a link to each state’s request for waivers and the responses from CMS. V. Stark Waivers On the same date, CMS also issued much-anticipated Blanket Waivers of sanctions under the federal physician self-referral law, or “Stark Law,” for “COVID-19 Purposes.” These Blanket Waivers are set forth here. Please see our separate post, available here, with detailed information about these Stark Law Blanket Waivers. * * * If you have questions about the new CMS waivers, please contact the authors or your regular Dorsey & Whitney LLP attorney. Dorsey is closely monitoring the rapidly evolving legal landscape related to the COVID-19 pandemic. You can access Dorsey’s health law blog related to health law updates, available here. You can also access Dorsey’s coronavirus resource center, which contains a wide variety of legal resources related to the coronavirus outbreak, available here.

With the aim of enabling providers to focus attention and resources on fighting the COVID1-19 pandemic, CMS announced over the weekend that it intends to alleviate some of Medicare participating providers' and suppliers' financial burden by expanding its Medicare accelerated and advance payment (AAP) program to a broader group of Medicare Part A providers and Part B suppliers for the duration of the public health emergency. Medicare accelerated and advance payments are typically employed for emergency funding for scenarios in which claims submissions or processing is disrupted; the announcement is at once historic and yet also wholly in scope with the scale of and disruption caused by the pandemic. The expedited payments have been employed usually during natural disasters such as tornadoes, flooding, and the like, and may also be used during a national emergency. Lawmakers are recognizing the scale and scope of what providers are facing (and will continue to face), so CMS is expanding the Medicare accelerated and advance payments program eligibility to all applicable Medicare providers and suppliers, throughout the US, during the public health emergency related to COVID-19. The payment amount will vary by applicable provider or supplier depending on what amount is requested; the payments are potentially substantial. The permitted payment amounts are based on applicants’ historical Medicare payment amount for the requested time period and as permitted by category. Most providers and suppliers may request up to 100% of their historical Medicare payment amount for a three-month period. Inpatient acute care hospitals, children’s hospitals, and certain cancer hospitals are able to request up to 100% of their historical Medicare payment amount for a six-month period. Critical access hospitals may request up to 125% of their historical Medicare payment amount for a six-month period. In addition, CMS has extended the repayment date to begin 120 days after the payment is issued; the timeline for repayment again varies by organization type but is not less than 210 days. Providers and suppliers interested in seeking these payments may request the appropriate specific amount using the Accelerated or Advance Payment Request form provided on your Medicare Administrative Contractor’s (MAC’s) website. For example, the MAC, WPS, has recently updated its AAP application form, available here, which can simply be e-mailed to WPS at the email address located at the bottom of the one-page application. In order to be able to qualify for this expansion, a few conditions apply, and are worth double-checking as to whether any of these are true of your organization. The requesting providers or suppliers: Must have billed Medicare for claims within 180 days immediately prior to the date of signature on the provider’s/supplier’s request form; Must not be in bankruptcy proceedings, nor be under active medical review or program integrity investigation; and Must not have any outstanding delinquent Medicare overpayments. If any of the above conditions apply, then your organization would not be eligible to apply under this COVID-specific expansion. This expansion of the AAP program takes effect immediately, and CMS aims to issue payments within seven days of a request. Details about reconciliation and recoupment, as well as instructions as to how to apply, may be found in the CMS fact sheet found here. If you have any questions about the announcement or the application process, please contact the author(s) or your regular Dorsey attorney or Dorsey Health Strategies consultant.

On March 27, 2020, the President signed into law the “Coronavirus Aid, Relief, and Economic Security Act’’ (“CARES Act”). The CARES Act is the third phase of the federal government’s response to the coronavirus following two other laws to support American families and address health sector needs that were approved on March 6, 2020 (Phase I here) and March 18, 2020 (Phase II here). The CARES Act includes provisions which provide cash payments and other resources to help individuals, small businesses, state and local governments and hospitals/healthcare providers. The CARES Act includes four sections (called “Titles”) and each title addresses a different topic. This e-update summarizes Title III of the CARES Act titled “Supporting America’s Health Care System in the Fight Against the Coronavirus”. Title III provides much needed financial assistance to the health care industry, as well as additional guidance and other provisions which provide information on waivers and other benefits to help hospitals and others who are on the front lines of fighting the COVID-19 pandemic. The following is a summary of the major provisions of Title III, organized in order by section numbers under the CARES Act but does not address subtitle B – Education Provisions and subtitle C – Labor Provisions. We will provide links to summaries of other provisions in the CARES Act prepared by our colleagues throughout the firm as they become available. Click here to read the summary.

In light of the COVID-19 pandemic, the Food and Drug Administration (“FDA”) issued recent non-binding guidance (“Guidance”) on the conduct of ongoing clinical trials of medical products. The FDA acknowledges that the public health emergency may result in unavoidable protocol modifications and/or deviations. Quarantines, site closures, travel limitations, interruptions in the supply chain for the investigational product, and infection of site personnel and trial subjects can all disrupt  protocol-specified procedures, such as mandatory visits, administration of the investigational product, or laboratory testing.  The Guidance provides FDA’s thinking on how sponsors, clinical investigators, and Institutional Review Boards/Independent Ethics Committees (“IRBs”) should, notwithstanding the current challenges, approach trial participant safety, compliance with good clinical practices (GCP) and risks to trial integrity. Highlights from the Guidelines include: Trial Participant Safety It is clear that for each changed circumstance necessitated by the COVID-19 emergency, trial sponsors (together with investigators and IRBs) should first consider the impact on participant safety.  Decisions regarding continued participant recruitment, continued use of an investigational product, changing patient monitoring practices, discontinuing the trial, or other modifications should be considered with trial participant safety as the paramount factor. FDA considers it critical that trial participants be informed of all changes that could impact them. Participants may not be able to travel to investigational sites for protocol-mandated visits.  Sponsors should evaluate whether alternative methods for safety assessments, such as delayed patient visits, phone calls, or virtual visits, are sufficient to assure trial participant safety. If any trial participants are unable to access the investigational product or the investigational site, they may need additional safety monitoring. Sponsors may also consider whether there are alternative means to administer the investigational product when scheduled site visits are impracticable.  However, FDA states that regulatory requirements regarding investigational product accountability remain in effect and should be addressed and documented. COVID-19 Screening; Changes to Study Protocol The FDA states that COVID-19 screening procedures mandated by the investigational site do not need to be reported as an amendment to the protocol (even if performed during clinical study visits), unless the sponsor is incorporating the data collected as part of a new research objective. In addition, although sponsors are encouraged to engage with IRBs as soon as possible about urgent or emergent protocol changes, such changes to study protocols or informed consent as a result of COVID-19 that are intended to minimize or eliminate immediate hazards or to protect the life and well-being of trial participants may be implemented without IRB approval or amendment, or before filing an IND or IDE with FDA, but must be reported after such implementation. Documenting and Analyzing Study Changes and Impact In addition to trial participant safety, the other key takeaway from the Guidance is that FDA expects sponsors to document and explain all efforts to minimize the impact of any protocol modifications or deviations on the safety of trial participants and study data integrity.  This documentation should include: (1) what contingency measures were implemented to manage study conduct (including their duration and how they were necessitated by COVID-19); (2) a listing of all affected participants by unique study identifier, and a description of how the individual’s participation was affected; and (3) analysis and discussions addressing the impact of such contingency measures on the safety and efficacy results reported for the study. Importantly, if there are missed visits, changes in visit schedules, or other facts that result in missing information, then each affected case report form should include specific information that explains the missing data and its relationship to COVID-19.  This information should also be summarized in the clinical study report. If changes in the study protocol lead to changes to efficacy assessment methods, amendments in data management or statistical analysis plans, the FDA requests that the sponsor consult with the applicable FDA review division. The FDA states that sponsors, investigators, and IRBs should all consider adopting policies and procedures (or revisions to existing policies) to address potential disruption as a result of COVID-19. The FDA provided examples of potential changes: impact on the informed consent process, study visits and procedures, data collection, study monitoring, adverse event reporting, changes to investigations, site staff, and monitoring resulting from regional or nationally imposed travel restrictions or quarantine measures or illness. Depending on the nature of revisions to the policies and procedures, applicable regulations may require a protocol amendment. Undoubtedly, the current public health emergency will impact ongoing clinical trials.  The extent and nature of that impact will vary depending on the trial, the investigational product, the disease being studied in the trial, the ability to conduct safety monitoring, and other factors.  The FDA recognizes these facts, and the Guidance stresses two fundamental points.  First, all trial activity, and each modification or deviation to a trial protocol, should be assessed with trial participant safety as the principal consideration.  Second, all changes necessitated by COVID-19 should be carefully documented and analyzed in the clinical trial report to explain their connection to COVID-19 and their impact on participant safety and trial data integrity. A copy of the full guidance issued by the FDA can be found at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-guidance-conduct-clinical-trials-medical-products-during-covid-19-pandemic If you have further questions, please contact the authors or any member of Dorsey & Whitney’s health care transactions and regulations practice group.

The COVID-19 pandemic has dramatically increased the number of patients and providers seeking to implement and use telehealth visits and other digital health solutions – and rapidly, at that.  The challenge of implementing digital health solutions, particularly telehealth, has historically been the patchwork setup of both federal and various state regulations that made it difficult for providers and telehealth vendors to offer solutions at a large scale, particularly across state lines.  In the current state of public emergency, both the federal government and various state governments are recognizing the need to ease prior restrictions and expand telehealth availability in order to help patients receive care at home; this helps limit the spread of COVID-19 by further enabling social distancing and freeing up providers’ brick-and-mortar hospitals and clinics to treat COVID-19 patients.  The need is clear, as is the desire by all parties to jump in and offer telehealth visits.  The new challenge has become understanding how state requirements fit in daily updates to federal law.  In this blog post, we will look first to the current legal environment with respect to the federal waiver and state regulations, and then provide recommendations (in numbered list below) as to what this means for your plans to offer telehealth visits. Specifically, clinical licensure has traditionally been amongst the most challenging regulations to contend with in offering telehealth visits.  Federal reimbursement and state clinician licensure rules generally restrict clinicians from offering telehealth services to a patient physically located in a state without the appropriate medical license in that state.  Now, however, through CMS 1135 waivers and state-specific executive orders, which we have described more below, clinicians are able to leverage relaxed cross-state reimbursement and licensure rules to offer telehealth services more easily and immediately during this time of public health emergency. Historically, the general rule, with few exceptions, is that a clinician must be licensed to practice in the state in which the patient receiving telehealth services is located. These rules are derived from state professional licensing laws, as well as from payor requirements, including the conditions of payment under the Medicare and Medicaid programs. Therefore, a physician licensed to practice in Minnesota, for example, could not typically provide telehealth services to a patient located in Iowa during the time of the visit without first obtaining an Iowa license to practice medicine. Failure to do so could subject the physician’s medical license to discipline, and could also render the services not billable to various private and governmental payors. Currently, the in-state licensure requirements of payors and professional licensing bodies are beginning to change within the confines of the COVID-19 public health emergency. With respect to Medicare and Medicaid billing requirements, under the emergency proclamation by the President, CMS has the authority to issue “1135 waivers” that will temporarily waive or modify certain Medicare and Medicaid requirements to ensure that sufficient health care items and services are available to meet the needs of individuals enrolled in Federal health care programs. Shortly following the Proclamation on Declaring a National Emergency Concerning the Novel Coronavirus Disease (COVID-19) Outbreak, both HHS and CMS issued statements announcing a number of COVID-19 1135 waivers now either applicable automatically nationwide or available through request by individual providers and the states, depending on the type of waiver. These waivers encompass an array of options and relaxing of rules that apply to services provided to Medicare and Medicaid patients.  One of the waivers provides that CMS will “temporarily waive [reimbursement] requirements that out-of-state providers be licensed in the state where they are providing services when they are licensed in another state” (the “Clinician Licensing Waiver”).  (Other waivers ease restrictions surrounding provider Medicare and Medicaid enrollment, skilled nursing and other long-term care facility requirements, and bed allocation requirements).  This is an enormous and important shift, and one that digital health advocates have been championing for a long time, as it enables clinicians to “see” patients in other states without a protracted cross-state licensure process. The challenge, however, is understanding how the federal waivers and existing state requirements interact. These 1135 waivers apply only to federal requirements, and any providers looking to practice in accordance with these waivers must be careful to also comply with applicable state laws. Largely, the COVID-19 1135 waivers fall in two categories: (1) blanket waivers; and (2) case-by-case waivers. The blanket waivers include those waivers listed by CMS in their statement and are applicable automatically nationwide with respect to Medicare rules (not Medicaid or other CMS programs, except by request, as noted below). The Clinician Licensing Waiver is one such waiver. This waiver applies automatically to Medicare reimbursement, but clinicians must also ensure they are practicing in accordance with a particular state’s licensing rules before issuing professional services in that state. States that would like these Medicare blanket waivers, including the Clinician Licensing Waiver, to apply to their state’s Medicaid program must send a request to CMS for case-by-case approval. Currently, only Florida and Washington have received approval for their requested COVID-19 1135 waivers, including the Clinician Licensing Waiver along with other provider enrollment and prior authorization requirement waivers. However, CMS states that it will continue to expeditiously review and approve 1135 waivers during the COVID-19 public health emergency. This CMS website will provide up-to-date information on all states that receive any COVID-19 1135 waivers. While the Clinician Licensing Waiver is limited in applicability to Medicare and Medicaid reimbursement, states are beginning to follow suit by temporarily waiving their state level professional licensure requirements for telehealth providers. Still, providers should take caution to not provide services without a state license unless and until it is confirmed that the state will allow this practice. One state that we have identified as permitting telehealth practice without a state license during the COVID-19 public health emergency is Iowa. Iowa’s emergency proclamation contains a section that temporarily suspends various telehealth practice standards, including the requirement that Iowa telehealth providers be licensed in Iowa. Note, however, that commercial payor rules may be unaffected by both the federal waivers and the easing of state professional licensing rules. From an operational standpoint, the Clinician Licensing Waiver ostensibly eases offering telehealth visits across state lines, but the state-specific regulations still require ongoing vigilance.  For those providers and other types of vendors seeking to offer telehealth, we would encourage the following:   Identify exactly which populations you must be able to treat in order for the telehealth visits to be feasible and viable (financially and operationally) for your organization While organizations would like to be able to immediately offer telehealth visits for everyone, the reality at this time, while states sort out whether they will ease state licensure restrictions, is that you may only be able to conduct telehealth visits and receive reimbursement in states in which your clinician is allowed to practice without a license and for certain populations only.  It will vary tremendously by state, and the answer may change on a near-daily basis, as states make their decisions.   Speak with your attorney about the states in which you want to offer visits (or where your patient populations may currently be) to understand the current status for those states Per above, the situation is changing rapidly, and we strongly recommend asking your attorney to check the state’s status vis-à-vis the federal waivers.  We would advise adding that into your tracking document (see next item).   Draft your quick state-by-state plan and what your readiness checks will be to start with a new state (and do not worry – this can be rough-and-ready) We often help our clients with state rollout plans and readiness checklists, and they are still important now; however, given the dramatic need for speed, do not let the perfect be the enemy of the good.  Based on your answers to the above two items, you should confirm with your team both the plan for which states you will be able to offer visits in and also the criteria for when and how you will assess and identify the next states in which you can offer telehealth services.  You can perfect and polish these plans at a later point, but having a plan of action for all involved will prevent confusion or, worse, lack of compliance if you do not pay careful attention to states’ evolving rules.  We would recommend that your state readiness checklist include an attorney approval step; this is particularly important now, since the states’ rules are changing so rapidly.  The good news is that, for the most part, the changes are leaning toward the more permissive rather than restrictive, so you may find new states in which you are able to operate.   Identify exactly which active state licenses your clinicians hold and document, ideally in a spreadsheet or other easy tracking mechanism We recommend (and create for our clients) tracking tools with respect to clinical licensure during regular times, and it is equally important now.  While the goal is to be able to offer telehealth visits to patients in states in which your clinicians are not currently licensed, you will need to keep track of who is actually licensed where, so that if and when regulations should revert, or if and when there should be changes to the scope of licensure or reimbursement, you are able to quickly assess your own staff’s licensure status and pivot as needed.  These tracking tools need not be fancy, though it is helpful to tie them to calendar reminders or other ticklers to enable consistent monitoring.   Keep in mind – and regularly monitor – other relevant requirements as you contemplate the nature and process of the telehealth visits. For example, you will still want to abide by current HIPAA requirements (which are also changing during this public emergency – please see our article here), documentation requirements, and reimbursement-related considerations. Your standard operating procedure and telehealth visit process will likely need to be altered to include verbal caveats or discussion points between your providers and the patients.  We would advise reviewing and then either drafting or updating your current visit script, as well as the documentation presented on your website portal for the telehealth visit.   Your plan for downtime procedures is going to become all the more important – assess if you’re ready and that your providers are aware of what to do. With so many people using internet and particularly video chat services, our IT infrastructure and that of the telehealth platform vendors themselves is experiencing a surge in usage, which will test capacity levels.  This would be the case in “regular” life, but becomes more important now, as you reach out to and conduct telehealth visits with new patients: does your script and posted information include information as to how the patient can reach you if the telehealth visit is interrupted?  What should be their plan with respect to reaching out to local (in-state) providers versus your organization, both for downtime and post-visit? This issue is rapidly changing and being updated at both the Federal and state level on a day-to-day basis. For additional information on various COVID-19 responses, guidance and resources, please see our articles on Medicare payment for telehealth services; HIPAA provisions now allowing the use of personal devices and everyday communication technology to deliver telehealth; DEA prescribing laws now allowing controlled substances to be prescribed via telehealth without an in person exam; and numerous other helpful legal analyses and guidance on COVID-19 related matters. If you would like specific information on how your state is currently treating these issues, please reach out to the authors or your usual Dorsey attorney or Dorsey Health Strategies business consultant.

On March 17, 2020, the Centers for Medicare and Medicaid Services (“CMS”) and the Department of Health and Human Services Office of the Inspector General (“OIG”) each issued policy statements which expand access to telehealth services for Medicare beneficiaries and permit physicians and other practitioners to reduce or waive beneficiary cost-sharing obligations for Medicare telehealth services during the COVID-19 public health emergency. Immediately following the enactment of the Coronavirus Preparedness and Response Supplemental Appropriations Act, available here, CMS issued a temporary expansion of the Medicare telehealth benefit beginning as of March 6, 2020 and effective until the public health emergency declared by the Secretary of the Department of Health and Human Services ends.  The CMS policy statement can be found here. A key element of this telehealth expansion is that payment will be made for office visits and other covered Medicare telehealth services furnished to beneficiaries located in any part of the U.S.  Moreover, the CMS waiver facilitates payment for telehealth services furnished while the beneficiary is located in their home or in any care setting.   Without this emergency expansion, current Medicare rules at Social Security Act § 1834(m) generally limit coverage for telehealth services to beneficiaries located in rural areas, and only when the beneficiary is within a hospital, clinic, or other medical facility at the time of the telehealth visit. Clinicians who may offer telehealth services to Medicare beneficiaries include physicians, nurse practitioners, physician assistants, clinical social workers, clinical psychologists, and registered dieticians.  CMS also states that to the extent Medicare reimbursement for a telehealth service requires a prior relationship between the clinician and beneficiary, CMS will use its enforcement discretion and not audit claims submitted during the public health emergency to determine if such a prior relationship existed. The CMS waiver explicitly permits clinicians to use telephones with audio and video capabilities to furnish Medicare telehealth services during the COVID-19 public health emergency.  Together with the new waiver of certain HIPAA privacy rules (addressed in our prior blog post found here), this now will permit clinicians to conduct visits with Medicare beneficiaries using common communications tools such as personal phones, devices and computers, and common technologies such as FaceTime or Skype. CMS issued a FAQ document on this temporary and emergency telehealth benefit expansion, which can be found here. In tandem with CMS’ expansion of the Medicare telehealth benefit, the OIG issued a policy statement to address the potential anti-kickback and beneficiary inducement issues that providers may face during this emergency.  OIG states that it will not sanction physicians or other practitioners for reducing or waiving cost-sharing obligations that a beneficiary may owe for telehealth services furnished during the COVID-19 public health emergency and furnished in accordance with the then-applicable Medicare rules (which would include the CMS telehealth benefit expansion during the emergency).  Normally, the routine reduction or waiver of Medicare beneficiary cost-sharing obligations would implicate the federal anti-kickback statute and the civil monetary penalty law prohibiting beneficiary inducement. Clinicians are not obligated to reduce or waive Medicare beneficiary coinsurance and deductible obligations, but may do so in accordance with the OIG policy statement without risk of anti-kickback or beneficiary inducement enforcement.  Moreover, the OIG states that it will not view providing future services that may occur as a result of any free telehealth services to, by itself, be evidence of beneficiary inducement. The OIG Policy Statement can be found here. These CMS and OIG issuances are intended to give providers added flexibility to combat the COVID-19 emergency.  Hospitals and other providers should consider how the temporary Medicare telehealth expansion and the flexibility in dealing with beneficiary cost-sharing can help them keep clinicians and beneficiaries safer, alleviate some of the burden on provider staff and space, and help reduce the spread of COVID-19. If you have any questions, please contact the author or any member of Dorsey’s healthcare transactions and regulations practice group.

The first publicly disclosed prosecution under the Eliminating Kickbacks in Recovery Act (“EKRA”) occurred last month, a little over a year after EKRA became law. As we described in a previous blog post, EKRA criminalizes certain health care payment arrangements related to referrals, regardless of payor. In the recent EKRA prosecution, an office manager of a Kentucky substance abuse treatment clinic pleaded guilty to soliciting kickbacks from a toxicology laboratory in exchange for urine drug testing referrals. Theresa Merced, the 80-year-old office manager, admitted that the CEO of the toxicology lab gave her a $4,000 check as part of a larger bundle of promised inducements. When law enforcement questioned Merced about the check, she denied knowledge of it and said it was likely a loan from the CEO to her husband. After the questioning, Merced asked the CEO to alter the laboratory’s financial records to reflect her story. Last month, Merced plead guilty to one count of violating EKRA, one count of making false statements, and one count of attempted tampering with records. She is scheduled to be sentenced on May 1, 2020, and faces up to twenty years in prison and a maximum fine of $250,000. EKRA was passed as part of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act of 2018 (the “SUPPORT Act”) in response to concerns that the federal Anti-Kickback Statute (“AKS”) was not broad enough to adequately address abusive payment arrangements related to addiction treatment centers. The laws are similar, yet are distinct in several ways. Like the AKS, EKRA makes it a crime to knowingly and willfully solicit, receive, pay or offer any remuneration in order to induce referrals. EKRA, however, only covers arrangements that induce referrals to specific entities: recovery homes, clinical treatment facilities (i.e., certain non-hospital settings that provide substance use treatment), and laboratories. Additionally, EKRA applies to payment arrangements involving all payors, not just those involving federal health care programs like Medicare and Medicaid. Both the AKS and EKRA are criminal statutes with a maximum term of imprisonment of ten years. Both laws provide for several similar safe harbors, but the EKRA safe harbors are narrower in certain respects. For example, although the AKS provides a safe harbor for any payment that is part of any bona fide employment arrangement, EKRA’s employment safe harbor only permits payment that does not vary based on the number of individuals referred, the number of tests or procedures performed, or the amount billed to or received from the health care benefit program from the individuals referred. Thus, EKRA does not protect employment compensation to the same extent that the AKS does.  . Although the DOJ has authority to clarify the law and its safe harbors by regulations, none have been proposed. Since EKRA passed in October 2018, many have raised concerns about whether Congress intended for the law to apply so broadly and whether it will be enforced for activity that was previously permissible under the AKS. The Merced prosecution did not involve employment compensation, so does not shed light on whether DOJ or HHS will pursue criminal enforcement for business practices previously permitted under the AKS. The prosecution also dispels hopes that the DOJ would refrain from prosecuting under the statute until clarifying the law through regulations or guidance. The consequences of EKRA are potentially far-reaching and severe. Until clarifying regulations are promulgated, healthcare providers and other entities should evaluate whether their referral and compensation practices comply with the EKRA safe harbors in addition to the safe harbors of the Stark Law and AKS. Because EKRA applies to all payors, this evaluation should take into account practices related to all claims, not just government-reimbursed claims. We will continue to closely monitor the state of EKRA for guidance, revisions to the law, and enforcement. If you have further questions or need advice on how to restructure payment arrangements to comply with EKRA, please contact the authors or your regular Dorsey attorney.

The Centers for Medicare and Medicaid Services (CMS) has issued a final rule to require every hospital licensed in the United State to make public a robust set of standard charges for every item or service that the hospital bills.  In addition, CMS and other agencies have issued a proposed rule to require group health plans and health insurance issuers to: (1) disclose in-network negotiated rates and out-of-network allowed amounts for every health care item or service; and (2) offer a real-time tool to provide a plan enrollee with an estimate of cost-sharing and out-of-pocket expenses associated with plan covered items and services. The hospital price disclosure rule is effective January 1, 2021.  Hospitals and hospital trade associations have stated that they will bring a legal challenge against the final rule as exceeding CMS’ legal authority. The rule will require every licensed hospital to provide two separate sets of standard charge lists: (1) a list of standard charges for at least 300 “shoppable” hospitals services that a consumer can schedule in advance; and (2) a comprehensive list of standard charges for all items and services for which the hospital establishes a charge.  Both lists must be updated at least annually and placed on a publicly-accessible website.  Only hospitals are regulated under the final rule; ambulatory surgery centers or other clinics or facilities that may provide items and services that are also performed in hospitals are not required to report pricing. For the comprehensive charge list the hospital must report seven data elements for each item or service: (1) description; (2) code used to bill the item or service; (3) hospital’s gross charge; (4) negotiated rate with every third party payer (linked by name to the third party payer and plan); (5) highest charge the hospital has negotiated with any third party payer; (6) lowest charge the hospital has negotiated with any third party payer; and (7) charge applicable to an individual who pays cash.  The “shoppable” charge list must include similar data elements, with the addition of the hospital location(s) at which the “shoppable” service is provided.   The resulting report will be an exceedingly dense data set of hundreds of thousands of line items for a typical hospital. The biggest change the final rule would effect is that payment rates that a hospital negotiates with third party payers would no longer be confidential or proprietary, and would in fact be public information under the final rule. CMS made clear that a hospital must report data on all items or services the hospital provides and charges, including the professional services of its employed physicians or other clinicians.  This appears to apply only to the hospital itself (presumably identified by NPIs associated with the hospital) and not to separate corporate entities, formed for the purpose of operating physician group, that do not operate the hospital but may be owned by the same entity (or corporate affiliate) that operates the hospital. The health plan proposed rule would require every group health plan or health insurance issuers to make available on a website a negotiated rate file that lists: (1) the name and Employer Identification Number (EIN) or Health Insurance Oversight System (HIOS) identifier for each plan option or coverage offered; (2) codes and plan language description for each item or service; and (3) negotiated rate for each item or service furnished by every in-network provider (linked by National Provider Identifier (NPI) to each in-network provider) along with the last date of contract term for that rate.  A separate file that lists out-of-network allowed amounts for each items or service furnished by out-of-network providers must also be posted.  These lists must be updated monthly under the proposed rule. In addition, health plans must offer a tool to allow plan enrollees to obtain real-time information about cost-sharing information with regard to specific items or services. Unless halted by courts, hospitals will need to begin the considerable work of compiling and formatting the data files required under the final rule.  And, although it is unclear how the hospital pricing data will be analyzed and used (and by whom), hospitals should analyze their own pricing data and begin anticipating and preparing for the questions and critiques that will arise.

Medicare reimbursement for remote patient monitoring has taken a number of steps forward throughout this year. New and proposed rules from the Centers for Medicare and Medicaid Services both expand the billing options available to health care providers and also build in additional flexibility in the provision of remote patient monitoring in order to further the health industry’s push to value-based care. Remote patient monitoring (“RPM”) is a form of digital health in which medical data from individual patients is collected in one location and electronically transmitted to health care providers in a different location for assessment and recommendations. RPM differs from other digital health services in that there is not necessarily a live, or “real-time”, interaction between the patient and their health care provider. Instead, RPM is used by health care providers to monitor various aspects of their patient’s vital signs, including: weight, blood pressure, blood sugar, heart rate, and oxygen levels. RPM is not only a useful tool for health care providers to use during a patient’s hospitalization, but it is also useful in reducing the number of hospitalizations altogether. For example, RPM can be used to allow older or disabled individuals to live at home longer and avoid having to move into skilled nursing facilities, since their vitals can be monitored without having to see a health care provider in person. Until this year, Medicare reimbursement for RPM services was difficult to come by. While Medicare previously offered reimbursement for RPM services billed under CPT code 99091, the code did not take current technology and staffing models into account (likely because the language from the code dates back roughly 16 years). In order to address this issue and further incentivize health care providers to use RPM, the Centers for Medicare and Medicaid Services (“CMS”) finalized three new RPM billing codes that were effective January 1, 2019 (“Final Rule”). The new codes are titled, “Chronic Care Remote Physiologic Monitoring” and included the following descriptions: CPT code 99453: “Remote monitoring of physiologic parameter(s) (e.g., weight, blood pressure, pulse oximetry, respiratory flow rate), initial; set-up and patient education on use of equipment.” CPT code 99454: “Remote monitoring of physiologic parameter(s) (e.g., weight, blood pressure, pulse oximetry, respiratory flow rate), initial; device(s) supply with daily recording(s) or programmed alert(s) transmission, each 30 days.” CPT code 99457: “Remote physiologic monitoring treatment management services, 20 minutes or more of clinical staff/physician/other qualified healthcare professional time in a calendar month requiring interactive communication with the patient/caregiver during the month.” Finalization of these new codes did not come without fair criticism and disparate interpretations of the level of required supervision. In creating the codes, CMS stated that RPM could not be delivered “incident to” a practitioner’s professional services. Therefore, RPM services could not be reimbursed if the services were furnished by auxiliary personnel (individuals acting under the supervision of a physician). Following backlash of this conclusion, CMS issued a technical correction to the Final Rule on March 14, 2019, that allows “incident to” billing of RPM services by auxiliary personnel if they are under direct supervision. This was overall a win for RPM reimbursement; however, through separate codes (CPT 99487, 99489, and 99490), CMS allows reimbursement for Chronic Care Management under general supervision. The difference being that general supervision does not require a physician to be in the same building at the same time as the auxiliary personnel delivering the services. This contradictory treatment resulted in commentators arguing that CMS’s approach hinders, rather than increases, a patient’s access to digital health services by limiting where a physician may be located during the supervision of such services. CMS seems to be addressing this concern in the proposed 2020 Physician Fee Schedule that was published August 14, 2019 (“Proposed Rule”). The Proposed Rule would allow “incident to” RPM services to be reimbursed under general supervision rather than limiting reimbursement to direct supervision. By way of example, this means RPM could be reimbursed when the auxiliary personnel use RPM with patients who are in a hospital while the auxiliary personnel are supervised via other telemedicine modalities by a physician at their home. This change would greatly improve a patient’s access to RPM by enabling physicians to bill for such services delivered in a more flexible manner. In addition to this change, the Proposed Rule revises CPT code 99457 and adds yet another code to allow for additional reimbursement for each 20-minute interval that RPM services are provided.  This is in contrast to the Final Rule’s version of CPT code 99457, which allowed only one reimbursement for RPM services delivered for 20 minutes or more. CMS is accepting comments on the Proposed Rule until September 27, 2019. If you would like to submit comments or have any questions, one of the authors or your regular Dorsey attorney would be happy to assist you.