Source: http://healthlawmonitor.jacksonkelly.com/other/page/2/
Timestamp: 2018-09-20 17:10:40
Document Index: 506946889

Matched Legal Cases: ['art 1', '§1001', '§16', '§15', '§16', '§16', '§30']

Health Law Monitor: Other
Breaking Down the Final HIPAA/HITECH Rule - Part 1
As promised, this is the first in our series “The Final HIPAA/HITECH Rule – Breaking It Down.” This installment outlines the changes specific to business associates. In the coming days, we will focus on breach reporting, individual PHI issues (including marketing and sale of PHI), and enforcement.
On January 17, the U.S. Department of Health and Human Services, Office for Civil Rights (“HHS-OCR”) released its final rule (the “Final Rule”) which modifies the Privacy, Security, and Enforcement Rules under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Breach Notification Rule under the Health Information Technology for Economic and Clinical Health Act (“HITECH”). The complete text of and comments to the Final Rule was published in the Federal Register on January 25, 1013. While HIPAA traditionally applied directly only to covered entities including treatment providers, health plans, and health care clearinghouses, HITECH expanded the direct applicability of the Privacy and Security Rules to business associates.
The Final Rule takes effect March 26, 2013, and covered entities and business associates must comply with the applicable requirements by September 23, 2013. So, what’s new for business associates?
Direct Application – HIPAA’s Privacy and Security rules now directly apply to business associates, which includes subjecting both covered entities and business associates to HHS-OCR compliance reviews. Prior to HITECH, a business associate’s obligations were strictly a matter of contract between the business associate and the covered entity.
Business associates will be required to comply with the physical, administrative, and technical safeguards and related HIPAA documentation requirements of the HIPAA Security rule. This means performing a HIPAA security risk analysis, implementing HIPAA security policies and training workforce members – mere compliance with the provisions of an existing business associate contract is no longer sufficient.
Broader Definition - The definition of “business associate” has been expanded to include:
a Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information (“PHI”) to a covered entity that requires access to such PHI on a routine basis;
a person that offers a personal health record to one or more individuals of a covered entity; and
a subcontractor that creates, receives, maintains, or transmits PHI on behalf of the business associate.
The expanded definition of business associate is specifically designed to include entities that provide data storage and transmission of PHI, and personal health record venders acting for covered entities. In the comments to the Final Rule, HHS-OCR made clear that a data storage vendor that maintains PHI, such as a cloud services provider, is a business associate even if the vendor never actually views or accesses the data. HHS-OCR further clarified that the “conduit exception” is a very narrow one intended to exclude only those entities providing mere courier services and that do not require access to PHI on a routine basis, such as the U.S. Postal Service or United Parcel Service. The conduit exception extends to the electronic transmission of data though an entity, such as an internet service provider, performing mere data transmission services.
Subcontractor Compliance - Subcontractors of business associates will automatically become business associates themselves, and business associates will be required to obtain “satisfactory assurances” that the subcontractors will appropriately safeguard PHI.
A business associate who uses subcontractors to create, receive, or transmit PHI on its behalf must have a written business associate agreement (“BAA”) with each subcontractor, thereby creating a continuous “chain of trust” for PHI. The subcontractors will be directly liable under HIPAA, and business associates must take reasonable steps to cure any breach or terminate the contract if a subcontractor materially breaches its BAA.
Mandatory Updates to BAAs – Covered entities and business associates must amend existing BAAs, and in some cases, execute new agreements to comply with the Final Rule. BAAs must address each of the following:
reporting breaches of unsecured PHI to covered entities;
mandatory compliance with HIPAA Privacy and Security obligations;
detailed description of permitted uses and disclosures of PHI.
BAAs must be modified to conform to HITECH’s additional requirements. Under the revised BAAs, business associates must report breaches of unsecured PHI to covered entities, and comply with all requisite Privacy and Security rule requirements. Because a business associate may only use or disclose PHI as provided in its business associate agreement, or as required by law, care should be taken to specifically describe the scope of those permissible uses and disclosures. Otherwise, a use or disclosure made but not specifically included in the agreement renders the business associate potentially vulnerable to a HIPAA violation. It is likewise noteworthy that a subcontractor’s permitted uses and disclosures may not be broader than those of the business associate from which the subcontractor receives the PHI.
Another important part of complying with the Privacy and Security Rules is the application of the “minimum necessary” standard when using or disclosing PHI or requesting PHI from a covered entity or business associate. A business associate or subcontractor’s application of the minimum necessary standard will vary based on the circumstances and the context of the governing BAA. HHS-OCR will issue further guidance on the application of the minimum necessary standard to address questions raised by commenters to the Final Rule.
Acknowledging the potential costs and burdens associated with revising existing agreements, HHS-OCR provides an additional one year transition period for amending existing BAAs until September 22, 2014, if the parties otherwise had an agreement in place which complied with the previous rule prior to January 25, 2013. If no such compliant business associate agreement was in place on that date, or if the parties renew or modify such agreement after March 23, 2013, then an updated business associate agreement need to be executed which is fully compliant with the Final Rule.
Increased Penalties - Business associates may be liable for increased penalties for noncompliance with the Privacy Rule up to a maximum penalty of $1.5 million depending upon the following factors:
the time period during with the violation occurred,
the financial harm to affected individuals,
the harm to affected individual’s reputation, and
the harm to an individual’s ability to obtain health care.
The increased penalties imposed under the Final Rule highlights the importance of compliance with the changes described above. Although a business associate is not liable for compliance with the entire Privacy Rule, it will be directly liable for the following:
uses and disclosures of PHI that are not in accordance with its BAA or the Privacy Rule;
failure to disclose PHI to HHS-OCR for compliance purposes;
failure to disclose PHI to an individual, or the individual’s designee for the covered entity to comply with its obligations to provide electronic access to PHI;
failure to comply with the minimum necessary standard; and
failure to enter BAAs with subcontractors.
Contact the Jackson Kelly Health Law Group with any questions specific to how these changes impact you. Stay tuned for our next installments of “The Final HIPAA/HITECH Rule – Breaking It Down.”
Posted at 10:51 AM in Compliance, Health Reform, HIPAA privacy issues , Other | Permalink | Comments (0) | TrackBack (0)
Implications of the New Financial Conflict of Interest Rules Circulated by the U.S. Department of Health and Human Services
Work as an expert witness for a law firm falls easily into these defined categories. During the course of a project, the Investigator must disclose any changes in SFIs within 30 days; however, an Investigator is not required to disclose travel reimbursed by a U.S. federal, state or local governmental agency, an institution of higher education (as defined at 20 U.S.C §1001(a)), an academic teaching hospital, a medical center or a research institute that is affiliated with an institution of higher education. Also excluded from mandatory disclosure is an Investigator’s salary or any other remuneration paid by the Investigator’s current Institution, intellectual property income received from the Investigator’s Institution and income from investment vehicles, such as mutual funds and retirement accounts so long as the Investigator does not directly control investment decisions.
An “Investigator” is the principal who is responsible for the design, conduct, or reporting of research or a research project funded by a Public Health Service (PHS), or proposed for such funding. Collaborators and consultants may be included as Investigators and therefore required to report SFIs to the Institution. By definition, Investigator includes the spouse and dependent children of the Investigator. Investigator also may include graduate students and post-doctoral fellows if they meet the definition. Before applying for or receiving PHS money for research, Investigators are required to undergo COI training and disclose their SFIs and the Institution must provide this information to the PHS granting the award.
An “Institution” is any domestic or foreign, public or private, entity or organization that applies for or has received PHS research funding. Under the rules, it is incumbent on the Institution to establish a written procedure to require each Investigator to disclose SFIs and after gathering the SFI information, it is the Institution that determines whether the SFI relates to the PHS funded research and whether the SFI constitutes a COI. The policy an Institution uses to make this determination is required to be made available on a public website, or within 5 business days of a request. Before engaging in PHS funded research, the Institution is required to collect SFI information from its Investigators. The Institution must conduct annual reviews during the period of the research and must require reporting of new SFIs of Investigators within 30 days of discovering or acquiring a new SFI. The information collected is reported to the PHS Awarding Component (the National Institute of Health). Before spending funds from the PHS award, the Institution must ensure that the information on certain SFIs that the Institution determines are COIs are available to the public. However, the requirement that the information on COIs be available online was changed after comment to require that the information concerning COIs be available by written response within 5 days of a request and is not required to be online. The information required includes the Investigator’s name, title and role in the research project; the name of the entity in which the Investigator holds the SFI; the nature of the SFI; the approximate dollar value of the SFI or a statement that the dollar value cannot be determined through references to public prices or other reasonable measures of fair market value.
The FCOI rules apply only to grants and cooperative agreements awarded on or after August 24, 2012, including noncompeting continuing awards. The rules do not apply to no-cost extensions. The new FCOI policy applies to research contracts, research grants, career development awards, center grants, individual fellowship awards, infrastructure awards, institutional training grants, program project or research resources awards and conference grants.
Posted at 04:24 PM in Compliance, Litigation and medical malpractice defense , Other | Permalink | Comments (0) | TrackBack (0)
West Virginia Legislature Enacts Comprehensive Substance Abuse Laws
On March 29, 2012, Governor Earl Ray Tomblin signed into law Senate Bill 437, generally Relating to Substance Abuse. SB 437 was passed on March 10, 2012 and becomes effective 90 days from passage. This law is one of the most comprehensive approaches taken in recent history to address the prescription drug diversion and substance abuse related problems in West Virginia.
The purpose of this posting is to provide a summary of the changes made by the new law. It is still unclear as to how the new law will be interpreted and applied. Any person or entity subject to these provisions of law should seek guidance from experienced health law counsel.
The new law contains five main areas of focus:
Adds additional regulation of opioid treatment centers (Methadone Clinics);
Establishes licensing and regulation of chronic pain clinics;
Establishes review capabilities of the Controlled Substances Database under the Board of Pharmacy to flag abnormal or unusual usage patterns of controlled substances by patients and unusual prescribing or dispensing patterns by licensed practitioners;
Implements a requirement for continued medical education for physicians and continued education for all other prescribers, dispensers and persons who administer controlled substances; and
Establishes a requirement for pharmacies to utilize a Multi-State Real-Time Tracking System to track sales of pseudoephedrine, and limits the amount allowed to be legally purchased daily (3.6g), monthly (7.3g), and annually (48g)
1. Additional Regulation of Opioid Treatment Centers (Methadone Clinics).
The new law modifies W. Va. Code §16-1-4 and adds additional requirements for opioid treatment centers (OTC) including:
Requiring all staff working or volunteering at an OTC to complete minimum educational, reporting and safety training criteria established by the secretary of DHHR;
Requiring individualized treatment of care plans to include a recovery model;
Clarifying that within the detoxification protocol, the strength of maintenance doses of methadone should decrease over time, be limited to a defined period of time, and require participants to work towards a drug-free lifestyle;
Requiring semi-annual reports from OTC’s to DHHR to include whether discharge from program was based on successful completion;
Requiring random drug testing of all patients to be conducted at least monthly;
Adding marijuana and similar substances to the list of drugs to test for when drug testing patients;
Providing mandatory weekly counseling no less than thirty minutes upon a positive drug test;
Adding an exception to discharging a patient from the program upon a fourth positive drug test within a six month period if the patient tests positive solely for marijuana or other similar substances;
Requiring a licensed health care professional [as defined in rules by DHHR] to be present and on duty at the OTC and a physician to be on-call for consultation;
Requiring a check of the Controlled Substances Monitoring Program (CSMP) database for physician treating patients in an OTC at specified times including: at patient’s intake; after initial 30 days treatment, and; prior to any take-home medication being granted;
Requiring results obtained from the CSMP to be maintained with the patient records;
Requiring each OTC to establish a peer review committee for reviewing whether the program is following national guidelines and submitting the results of the review quarterly to DHHR.
2. Creates the Chronic Pain Licensing Act
The law establishes a new code section, W. Va. Code §15-5H-3, et seq., which requires all pain management clinics to be licensed by the DHHR. Licenses shall expire one year from date of issuance and all pain management clinics are subject to periodic inspection by DHHR.
Pain Management Clinicis defined as: All privately owned pain management clinics, facilities or offices not otherwise exempted from this article and which meet both of the following criteria: (1) where in any month more than 50 percent of patients are prescribed or dispensed opioids or other controlled substances specified in rules promulgated pursuant to this article for chronic pain resulting from non-malignant conditions; (2) the facility meets any other identifying criteria established by the [DHHR] secretary by rule.
Chronic Painis defined as: Pain that has persisted after reasonable medical efforts have been made to relieve the pain or cure its cause and that has continued, either continuously or episodically, for longer than three continuous months. For purposes of this article, “chronic pain” does not include pain associated with a terminal condition or with a progressive disease that, in the normal course of progression, may reasonably be expected to result in a terminal condition.
The following practices and facilities are EXEMPTED from this Act:
A facility that is affiliated with an accredited medical school at which training is provided for medical or osteopathic students, residents or fellows, podiatrists, dentists, nurses, physician assistants, veterinarians or any affiliated facility to the extent that it participates in the provision or instruction;
A facility that does not prescribe or dispense controlled substances for the treatment of chronic pain;
A hospital licensed in this state, a facility located on the campus of a licensed hospital that is owned, operated or controlled by that licensed hospital, and an ambulatory health care facility as defined by W. Va. Code §16-2D-2, that is owned, operated or controlled by a hospital;
A physician practice owned or controlled, in whole or in part, by a licensed hospital or by an entity that owns or controls, in whole or in part, one or more licensed hospitals;
A hospice program licensed in this state;
A nursing home licensed in this state;
An ambulatory surgical facility as defined by W. Va. Code §16-2D-2; and
A facility conducting clinical research that may use controlled substances in studies approved by a hospital-based institutional review board or an institutional review board accredited by the association for the accreditation of human research protection program.
Operational Requirements for pain management clinics (clinic) established by this Act include:
The clinic must be licensed with DHHR, the Secretary of State and the State Tax Department;
At least one owner must be an actively licensed physician;
Each clinic must designate a physician owner to practice at the clinic and be responsible for operation of the clinic, and supervise all staff;
No owner or other person associated with the clinic may have a felony conviction;
Criminal background checks must be performed;
Each clinic location must be licensed separately;
No prescriber may be an owner or employee of a licensed clinic if the prescriber has ever had his or her DEA number revoked, has been denied a license to prescribe or dispense controlled substances denied or has been convicted of a felony;
Dispensing in a clinic is allowed only by physicians and pharmacists, and only for a 72 hour supply;
Prior to dispensing or prescribing a controlled substance, the treating physician must access the CSMP. If treatment is ongoing the physician must access the CSMP at each patient examination or at least every 90 days;
Sets forth requirements for documentation and recordkeeping;
A physical examination of the patient must occur on the same day the physician prescribes, dispenses or administers a controlled substance to the patient and at least 4 times a year thereafter.
Monetary fines for noncompliance are as high as $20,000 for a physician who knowingly operates an unlicensed pain management clinic.
Advertising regulations are established requiring at a minimum the identification of one physician owner responsible for the content of the advertisement for the clinic.
3. Changes and Modifications relating to the Controlled Substances Monitoring Program database
A. New information reported to the Controlled Substances Database:
The following additional information must be reported to the CSMP: name of the dispensing physician or dentist; full legal name of the patient; full legal name, birth date and address of person picking up the prescription if other than the patient; and the source of payment.
There is a clarification that reporting is required for controlled substances (Schedules II, III and IV) which are dispensed by a practitioner. Dispensing is limited to a 72 hour duration.
Prior to dispensing a controlled substance sold at retail, a pharmacist must verify the full legal name, address and date of birth of the person receiving the drug through the presentation of a government-issued photo ID.
B. Controlled Substances Database Law Modified:
The CSMP is clarified as being confidential and not subject to the West Virginia Freedom of Information Act. It shall also not be obtainable as discovery in civil matters absent a court order.
There is a clarification that law enforcement having access to the CSMP information must be a member of a federally affiliated drug task force, be certified as a West Virginia law enforcement officer, have completed DEA diversion training and have completed National Association of Drug Diversion Investigation Training. The dispensing of Schedules II, III, and IV controlled substances must be reported to the Board of Pharmacy within 24-hours (current law is 7 days).
The law establishes an Advisory Board to be appointed by the Board of Pharmacy comprised of physicians and pharmacists. The Advisory Board is charged to: “develop, implement, and recommend parameters to be used in identifying abnormal or unusual usage patterns of patients in the state; make recommendations for training, research and other areas to have the potential to reduce inappropriate use; monitor the ability of medical providers to meet the 24-hour reporting requirement; and, establish educational outreach programs with law enforcement.”
The Board of Pharmacy is charged with sending reports of patients that fall outside the parameters established by the Advisory Committee to their physicians.
The law establishes a Database Review Committee to be appointed by the Board of Pharmacy to “query the database based on parameters established by the advisory committee”. This review committee may make determinations on a case-by-case basis on specific unusual prescribing or dispensing patterns, or abnormal or unusual usage patterns of controlled substances by patients. The Review Committee may, based upon reasonable cause, refer matters to law enforcement or the licensing board having jurisdiction over the prescribers or dispensers under consideration. The Review Committee consists of two prosecutors, two physicians and one pharmacist. An additional physician may be appointed on a case-by-case basis.
The state’s chief medical officer is required to report to the Review Committee information regarding any person who has died from a drug overdose.
C. Prescribers and dispensers granted immunity for reporting suspected doctor shoppers.
Any prescriber or dispenser may notify law enforcement of a patient who, in his or her judgment, is potentially a doctor shopper. The prescribing practitioner or dispenser is immune from any civil, administrative or criminal liability if the notification is made in good faith.
D. Requirement to check the Controlled Substances database:
All prescribers and dispensers are required to check the CSMP upon initially prescribing or dispensing a pain relieving controlled substance to a patient (who is not suffering from a terminal illness) for chronic nonmalignant pain. They are required to check the CSMP annually thereafter.
Any prescriber or dispenser who is required to check the CSMP and fails to do so shall be disciplined by their licensing board as such board deems appropriate.
E. Felony for unauthorized use or disclosure of the Controlled Substances database:
Unauthorized access, use or disclosure of information in the CSMP for reasons unrelated to the purposes of the law is a felony punishable by imprisonment in a state correctional facility for not less than one year nor more than five years, or by fines of not less than $3,000 nor more than $10,000, or both.
4. Requirement for continuing medical education
As provided in W. Va. Code §30-1-7a, the current requirement of 2 hours of continuing education in “end of life care and pain management” required for those licensed by the Boards of Medicine, Dental Examiners, Osteopathy, Registered Professional Nurses, Optometry and Pharmacy is being deleted from law. A new requirement is created for “drug diversion training” and “best practices for prescribing of controlled substances training” to be done every licensure cycle. Only those who prescribe, dispense or administer controlled substances are required to take the training.
5. Regulation of the sale of pseudoephedrine products at retail pharmacies
Products containing pseudoephedrine are currently required to be sold from behind the counter and personal information regarding the purchaser is required to be reported to the Board of Pharmacy. The new law requires that all pharmacies now utilize a“multi-state real-time tracking system” to determine if an individual has purchased their limit of such products (some pharmacies voluntarily do this now).
Current federal regulations limit the sale of pseudoephedrine to 9 grams per month. Further state limitations are placed on the sale of the drug at: 3.6 grams per day, 7.2 grams monthly and 48 grams annually. These limits do not apply to prescription products containing pseudoephedrine.
Violations for any pharmacy or wholesaler are established as a misdemeanor.
Pharmacists are required to offer patient counseling to improve proper use and discuss contraindications.
Information regarding pseudoephedrine product purchases shall be disclosed to DEA agents, local law enforcement, and the WV State Police.
Posted at 11:13 AM in Compliance, Other | Permalink | Comments (0) | TrackBack (0)
Health Reform Update - Provider Impact
The third installment of our health reform series focuses on the impact upon health care providers of the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Affordability Reconciliation Act (referred to together herein as “PPACA”).
Continue reading "Health Reform Update - Provider Impact" »
Posted at 02:21 PM in Health Reform, Other | Permalink | Comments (0) | TrackBack (0)
Providing Care to Federal Employees May Mean Affirmative Action Plans and Additional Compliance Requirements.
If you provide medical services to federal government employees, you may be a government contractor without knowing it. It is important to realize that what you don’t know can hurt you.
Continue reading "Providing Care to Federal Employees May Mean Affirmative Action Plans and Additional Compliance Requirements. " »
Posted at 02:50 PM in Compliance, Other | Permalink | TrackBack (0)