Health Care

Back in December, we wrote about a district court ruling rejecting the Federal Trade Comission’s (“FTC”) motion to enjoin the proposed combination of Thomas Jefferson University (“TJU”) and Albert Einstein Healthcare Network (“Einstein”) that would create an 18-hospital system in the Philadelphia area. The FTC and the Pennsylvania Attorney General had alleged the merger would lead to TJU/Einstein controlling at least 60% of the inpatient GAC hospital services market in a portion of Philadelphia. Following the district court decision, the FTC quickly appealed to the Third Circuit Court of Appeals and filed an emergency motion for a stay pending appeal. Days later, a three-judge panel denied the government’s motion without comment.

The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced that it will exercise its enforcement discretion for health care providers’ and their business associates’ noncompliance with the HIPAA rules with respect to their good faith use of online or web-based scheduling applications for scheduling COVID-19 vaccination appointments. OCR will not impose penalties for such noncompliance during the COVID-19 nationwide public health emergency.

The Food and Drug Administration (FDA) and the National Telecommunications Information Administration (NTIA) in partnership with three domain name registries disabled nearly 30 websites illegally offering opioids for sale. Working together as part of a pilot program jointly created by the Department of Health and Human Services (HHS) and the Department of Commerce (Commerce), FDA and NTIA aim to reduce the availability of unapproved and misbranded opioids illicitly offered for virtual sale. Based on several joint warning letters and the subsequent shuttering of numerous websites illegally selling opioids, it would appear the partnership is a success. Both agencies and the domain registries have committed to continuing this working relationship beyond the pilot program. Time will tell if the continued joint effort reduces the unlawful sale of opioids online and in turn, minimizes the risks associated with the opioid crisis.

In this final post of our blog series on the substantial changes to the regulations implementing the Anti-Kickback Statute (AKS) and the Physician Self-Referral Law (commonly known as the Stark Law), we cover change to (i) key Stark Law terminology, and (ii) the scope and application of the Stark Law exceptions. The Centers for Medicare & Medicaid Services (CMS) finalized new definitions for various key terms used in the Stark Law regulations as well as revisions to existing terms that are generally intended to provide more certainty and flexibility. This post discusses a few of the highlights, but the final regulations contain many others.

On January 19, 2021, significant changes to the regulations implementing the Anti-Kickback Statute (AKS) and the Physician Self-Referral Law (commonly known as the Stark Law) went into effect. The sweeping changes come through two final rules – one issued by the Office of Inspector General (OIG) addressing changes to the AKS and the Beneficiary Inducements CMP, and one issued by the Centers for Medicare & Medicaid Services (CMS) addressing changes to the Stark Law.

In this fifth installment of our blog series covering the changes, we dive into (i) the new AKS safe harbor and Stark Law exception for cybersecurity technology and related services, and (ii) the significant changes to the existing safe harbor and exception for electronic health records (EHR) technology.

Since the beginning of the pandemic, telehealth providers have seen a dramatic increase in demand for their services along with a number of temporary regulatory measures aimed at expanding telehealth access to more patient populations. In this post, we outline some important developments that will bring greater certainty to telehealth providers and suggest that expanded access to telehealth is here to stay.

Although the Biden-Harris Administration that assumed control of the Executive Branch on January 20, 2021 immediately ordered a regulatory freeze of new or pending rules while the new administration gets its bearings (as reported by our colleagues in this post), several important changes to the laws enforced by the Food and Drug Administration (FDA) were recently enacted by Congress. As legislative actions, those changes are of course unaffected by President Biden’s regulatory freeze and so we thought worth a summary to ensure our readers are up to speed on the large amount of activity that occurred in the final weeks of the 116th Congress and the Trump Administration.

With a notably sharply worded opinion, the Fifth Circuit recently vacated over $4.3 million in penalties levied against the University of Texas M.D. Anderson Cancer Center (M.D. Anderson) by the Department of Health and Human Services (HHS) for a series of alleged HIPAA violations. The case stems from three separate incidents that occurred between 2012 and 2013. In two instances, M.D. Anderson workforce members lost unencrypted protected health information (PHI), while the third incident involved the theft of a faculty member’s laptop also containing unencrypted PHI. On appeal, the Fifth Circuit concluded that HHS’s civil monetary penalties order against M.D. Anderson was arbitrary, capricious, and contrary to law, vacating the penalties and pointedly criticizing the agency’s actions and arguments in this matter.

Beyond its harsh words for HHS, this opinion is notable for calling into question some longstanding HHS enforcement practices and interpretations of the HIPAA regulations. The opinion also makes clear that regulated entities should check the math when HHS levies a fine. Although limited in its precedential authority, the Fifth Circuit’s opinion, at the very least, gives HIPAA-regulated entities some new food for thought if faced with an HHS enforcement action.

In the waning days of the Trump administration, the Office for Civil Rights (“OCR”) announced a number of new initiatives, including proposed HIPAA amendments, discussed here, and a very recent COVID-19 related Notice of Enforcement Discretion. Under the Notice of Enforcement Discretion, published on January 19, 2021, OCR announced that it would not impose penalties for non-compliance with HIPAA on covered entities making good faith use of online or web-based applications for COVID-19 vaccination scheduling. With the swearing in of President Biden, these and other regulatory initiatives, including all regulations that have been sent to the Office of the Federal Register, but not yet published, are to be withdrawn until a department or agency head appointed by President Biden reviews and approves the rule.

The U.S. Department of Health and Human’s Services (HHS) Health Resources and Services Administration’s (HRSA) long-awaited administrative dispute resolution (ADR) final rule went into effect last week, on January 13, 2021. The ADR regulations, which have lingered in HHS since 2010, arrive amid increasing tensions and a flood of 340B-related litigation between covered entities, manufacturers, and HHS.

Politics will have an effect on FDA policies in 2021, including with respect to the ongoing COVID-19 response, manufacturing, compliance, digital health, laboratories, user fees, device servicing, and more.

In a recently decided case, Rutledge v. Pharmaceutical Care Management Association, the U.S. Supreme Court held that the Employee Retirement Income Security Act of 1974 (ERISA) does not preempt an Arkansas statute that regulates reimbursement levels paid by Pharmacy Benefit Managers (PBMs) to local pharmacies.

As we’re all painfully aware, public health issues dominated 2020 and with the country’s attention focused on COVID-19 testing, status, transmission and care, HIPAA went mainstream. Health information became critical not only for health care providers, but for all manner of businesses, employers, property owners, and the national media. HIPAA – or more often than not “HIPPA” – was frequently touted in the news and on social media as the reason why COVID-related information could or could not be shared. As we head into 2021 with the pandemic raging on, the vaccination program underway, and a new administration taking over, here is a look at what we expect for “HIPPA” in 2021.

In addition to the incredible work of agency scientists and reviewers to get the first COVID-19 vaccines authorized for emergency use in December (as we covered in Part 2 of our year-end post), the Food and Drug Administration (FDA) has continued to make substantial progress on its non-COVID priorities as well, which we cover in this part 3 of our year-end post.

Following up on our colleagues’ post earlier this month covering the Food and Drug Administration’s 2020 device law and policy activities, this post will explore prescription drug and biologic law and policy developments over the past year. We’ll also begin looking forward into 2021 and the agency’s transition to an incoming Biden Administration.

What a year for the Food and Drug Administration! FDA, an agency with regulatory oversight of 20-25% of products on which consumers spend, including food and medicines, but which typically stays out of the limelight, was thrust into the public eye amidst the COVID-19 pandemic. This was the year many Americans became familiar with lesser-known and niche policies like those governing emergency use authorizations (EUAs) and with the role of FDA in regulating laboratory developed tests (LDTs). The agency also took some flak for seeming to bow to political pressure in authorizing hydroxychloroquine for emergency use as a potential COVID-19 treatment, then rescinding the authorization, as well as for its less-than-accurate pronouncements of positive data concerning convalescent plasma treatment. These were reminders that the agency Americans trust to protect the public does get things wrong sometimes and is susceptible in some ways to political pressure, and that effectively ensuring the public health requires a balance between safety and effectiveness and patient access to medical products. As we look ahead, we eagerly anticipate how FDA will protect and promote public health in a Biden administration. In this post we’ll explore the FDA’s device law and policy activities from 2020.

The Department of Health and Human Services (HHS) is pushing ahead in its Regulatory Sprint to Coordinated Care with a new proposed rule, announced by HHS’ Office for Civil Rights on December 10, to modify the HIPAA Privacy Rule. This proposed rule follows HHS’ 2018 Request for Information on Modifying HIPAA Rules to Improve Coordinated Care, which sought to identify regulatory impediments to value-based care presented by HIPAA. With this proposed rule, HHS aims to “reduce burden on providers and support new ways for them to innovate and coordinate care on behalf of patients, while ensuring that [HHS] uphold[s] HIPAA’s promise of privacy and security,” according to HHS Deputy Secretary Eric Hargan. It would achieve these objectives through a variety of updates to the Privacy Rule, which we highlight in this blog post, along with initial reactions from our HIPAA privacy team.

As you know, we have been parsing through the HHS rules that finalize important changes to the Anti-Kickback Statute (AKS) and Physician Self-Referral Law (Stark Law) regulations, which go into effect January 19, 2021. Today, we are taking a look at changes to existing AKS safe harbors and Stark Law exceptions, and, an extra add-on: a new Stark Exception for Limited Remuneration to a Physician. Mintz is also hosting a webinar during which we will review the key provisions from the final rules and provide practical examples of how the industry can take advantage of these significant changes. We hope you can join us.

This third post in our multi-part series on the final rules examines the three new AKS safe harbors and four new Stark Law exceptions that offer protection for value-based arrangements. The primary goal of these final rules is to reduce regulatory barriers and advance the health care industry’s transition to value-based care. Value-based care, often referred to as pay-for-performance, is a payment model that offers health care providers and suppliers financial incentives to meet certain performance measures that improve quality of care or appropriately reduce costs, as opposed to traditional fee-for-service or capitated payments healthcare reimbursement.

Plus, we have prepared easy-to-read comparison charts breaking down the current, proposed, and final regulations. These comparison charts offer a quick way to get up to speed on these voluminous final rules and their many historic changes to the AKS and Stark Law.

While health care entities often want to provide free or discounted items or services to patients (e.g., free transportation, co-payment waivers, free supplies), these free or discounted items or services pose risk under both the federal Anti-Kickback Statute (AKS) and the civil monetary penalty rules regarding beneficiary inducements (Beneficiary Inducements CMP), so minimizing risk when providing such items or services is important.  Fortunately, as announced last week, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) issued a final rule making sweeping changes to the regulations implementing the AKS and the Beneficiary Inducements CMP, many of which will result in greater flexibility and reduced administrative burdens for the health care industry.