Department of Health and Human Services

DEPARTMENTAL APPEALS BOARD

Civil Remedies Division

Director of the Office for Civil Rights,

Petitioner,

Vv.

Lincare, Inc., d/b/a United Medical,

Respondent.
Docket No. C-14-1056
Decision No. CR4505

Date: January 13, 2016

DECISION

Respondent, Lincare, Inc., d/b/a United Medical, supplies respiratory care, infusion
therapy, and medical equipment to patients in their homes. The estranged husband of one

of its managers complained t!

at his wife allowed him access to the “protected health

information” of Lincare patients, even though he was not authorized to see it. Following

a lengthy investigation, the D:

irector of the Office for Civil Rights (OCR) determined that

Respondent Lincare violated the Health Insurance Portability and Accountability Act of

1996 (HIPAA) because it did

not implement policies and procedures to safeguard records

containing its patients’ protected health information (PHI), and it failed to protect against

disclosure to unauthorized pe
money penalty (CMP) of $23

OCR moves for summary jud

rsons the PHI of 278 of its patients. OCR proposes a civil
9,800.

gment, which Respondent Lincare opposes.

I agree that the undisputed evidence establishes that Lincare violated HIPAA. I therefore
grant OCR’s motion and sustain the $239,800 CMP.
Background

HIPAA, sections 1171 through 1180 of the Social Security Act (Act) (collectively
referred to as the Administrative Simplification Provisions), creates privacy rights and
protections for consumers of health services. Pursuant to its provisions, the Secretary of
Health and Human Services has implemented a “Privacy Rule,” which sets standards for
protecting PHI. 45 C.F.R. Part 160 and Part 164, Subpart E; see Act § 1172(d). Except
as permitted by the regulations, a “covered entity,” such as Respondent Lincare (see
discussion below for definition), may not disclose PHL, a type of individually identifiable
ealth information (see below). 45 C.F.R. § 164.502(a). It “must reasonably safeguard”
PHI from “any intentional or unintentional use or disclosure that is in violation of the
standards, implementation specifications or other requirements” of Subpart E of the
Privacy Rule. 45 C.F.R. § 164.530(c)(2).

Here, Richard Shaw was married to Lincare Manager Faith Shaw, although their
marriage went through a rough patch. She left him and, in late 2008, Richard Shaw
complained to OCR that she left behind documents containing the PHI of Lincare
patients. The documents were in his possession even though he was not authorized to see
them. OCR Exhibit (Ex.) 1; OCR Ex. 2 at 1-2 (Montoya Decl. § 3). OCR investigated
and determined that Respondent Lincare had violated HIPAA’s Privacy Rule. In a letter
dated January 28, 2014, OCR advised Respondent Lincare that it proposed imposing a
$239,800 CMP. OCR Ex. 1.

Respondent Lincare appeals and OCR now moves for summary judgment. See 45 C.F.R.
§ 160.508(b)(13). With its motion and brief (OCR Br.), OCR submits 41 exhibits (OCR
Exs. 1 — 41). Respondent Lincare filed a brief opposing summary judgment (R. Br.),
along with one exhibit (R. Ex. 1). OCR filed a reply (OCR Reply) and Respondent filed
a sur-reply (R. Sur-reply).

Issues
As a threshold matter, I consider whether summary judgment is appropriate.
On the merits, the issue is whether Respondent Lincare violated HIPAA standards.

Because Respondent did not properly challenge the amount of the CMP, that issue is not
before me.
Discussion

Summary Judgment. Summary judgment is appropriate if a case presents no genuine
issue of material fact, and the moving party is entitled to judgment as a matter of law.
Bartley Healthcare Nursing & Rehab., DAB No. 2539 at 3 (2013) (citing Celotex Corp.
v. Catrett, 477 U.S. 317, 322-25 (1986)); Jil. Knights Templar Home, DAB No. 2274 at
3-4 (2009), and cases cited therein.

The moving party may show the absence of a genuine factual dispute by presenting
evidence so one-sided that it must prevail as a matter of law or by showing that the non-
moving party has presented no evidence “sufficient to establish the existence of an
element essential to [that party’s] case, and on which [that party] will bear the burden of
proof at trial.” Livingston Care Ctr. v. Dep’t of Health & Human Servs., 388 F.3d 168,
173 (6th Cir. 2004) (quoting Celotex Corp., 477 U.S. at 323-24). To avoid summary
judgment, the non-moving party must then act affirmatively by tendering evidence of
specific facts showing that a dispute exists. Matsushita Elec. Indus. Co. v. Zenith Radio
Corp., 475 U.S. 574, 586 n.11 (1986); see also Vandalia Park, DAB No. 1939 (2004);
Lebanon Nursing & Rehab. Ctr., DAB No. 1918 (2004). The non-moving party may not
simply rely on denials, but must furnish admissible evidence of a dispute concerning a
material fact. J/l. Knights Templar, DAB No. 2274 at 4; Livingston Care Ctr., DAB No.
1871 at 5 (2003).

In examining the evidence for purposes of determining the appropriateness of summary
judgment, I must draw all reasonable inferences in the light most favorable to the non-
moving party. Brightview Care Ctr., DAB No. 2132 at 2, 9 (2007); Livingston Care Ctr.,
388 F.3d at 172; Guardian Health Care Ctr., DAB No. 1943 at 8 (2004); but see
Brightview, DAB No. 2132 at 10 (entry of summary judgment upheld where inferences
and views of non-moving party are not reasonable). However, drawing factual inferences
in the light most favorable to the non-moving party does not require that I accept the non-
moving party’s legal conclusions. Cf Guardian Health Care Ctr., DAB No. 1943 at 11
(“A dispute over the conclusion to be drawn from applying relevant legal criteria to
undisputed facts does not preclude summary judgment if the record is sufficiently
developed and there is only one reasonable conclusion that can be drawn from those
facts.”).
Admissible evidence. Respondent Lincare argues that OCR has not demonstrated that it
must prevail as a matter of law because its evidence is unreliable and inadmissible.
According to Respondent, OCR’s affidavits are unreliable because they include legal
conclusions and “simple, unsworn hearsay.” Without specifically challenging any one of
the non-testimonial exhibits, Respondent characterizes them all as “un-verified pieces of
paper.” R. Br. at 6.!

As a threshold matter, the Federal Rules of Civil Procedure do not even require a movant
to support its motion with affidavits. Rules 56(a) and (b) say that either party may move
for summary judgment “with or without supporting affidavits.” See Celotex Corp.,477
USS. at 323 (finding “no express or implied requirement in Rule 56 that the moving party
support its motion with affidavits or other similar materials negating the opponent’s
claim. On the contrary, Rule 56(c), which refers to ‘the affidavits, ifany’ (emphasis
added), suggests the absence of such a requirement.”); Hartnagel v. Norman, 953 F.2d
394, 395 (8th Cir. 1992) (“The movant is not required by the rules to support its motion
with affidavits or other similar materials negating the opponent’s claim.”).

Moreover, although I may apply the Federal Rules of Evidence “where appropriate,” I am
not bound by them, and I have broad discretion to admit evidence. I must exclude
evidence that is irrelevant or immaterial; I may exclude relevant evidence “if its probative
value is substantially outweighed by the danger of unfair prejudice, confusion of the
issues, or by considerations of undue delay or needless presentation of cumulative
evidence.” 45 C.F.R. § 160.540. Applying these criteria, OCR’s exhibits are
unquestionably admissible:

e Affidavits. The affidavits include the testimony of Valerie Montoya, the OCR
investigator assigned to Mr. Shaw’s complaint. OCR Ex. 3 (Montoya Decl.). She
describes Complainant Shaw’s accusations, the admissions and other statements
made to her by Lincare Center Manager (and estranged wife) Faith Shaw, and the
admissions and other statements made to her by Lincare Area Manager Darrell
Layton. Under the Federal Rules of Evidence, all of these statements would be
admissible for the fact that the individuals made them.” Fed. R. Evid. 801(c).

' Respondent’s criticism could more easily apply to its own exhibit — the written
declaration of Lincare Corporate Compliance Officer Jenna Pederson. Without
additional foundation or explanation, she declares as true selected quotations from
statements that she and two other Lincare employees made, which Respondent cited in its
brief opposing summary judgment. R. Ex. 1.

> Unless offered for the truth of the matter asserted, the statements would not even
qualify as hearsay. Fed. R. Evid. 801(c)(2).
Moreover, because Lincare employees made these statements about “a matter
within the scope of [their employment] relationship . . . while it existed,” they are
admissible as exceptions to the hearsay rule. Rule 801(d)(2).

Respondent Lincare claims that Center Manager Shaw made her statements to
Investigator Montoya after her employment at Lincare had ended. R. Sur-reply at
6. But Respondent offers no evidence of — in fact, does not even mention — when
the employment relationship ended. In correspondence dated July 28, 2009,
Lincare told Investigator Montoya that Ms. Shaw was the Center Manager until
July 2009 and then became a patient account coordinator in Lincare’s Regional
Billing and Collections office. OCR Ex. 30 at 2; see also OCR Ex. 12 at 1; OCR
Ex. 32 at 47

More remarkably, Respondent also claims — again without providing any support —
that the statements made by Center Manager Shaw and Area Manager Layton are
outside the scope of their jobs. R. Sur-reply at 6. This cannot possibly be true.
The statements in question refer to the Lincare policies and instructions for
protecting PHI and to Manager Shaw’s handling of the PHI she removed from the
office she managed. Both Manager Shaw and Area Manager Layton, who was
Manager Shaw’s immediate supervisor, explained the company’s policies for
maintaining PHI taken out of the office. Their jobs required them to handle, or
supervise those who handled, PHI. If protecting PHI were “outside the scope” of
their jobs, the company was guilty of even more serious HIPAA violations than
those alleged here. But the actual uncontroverted evidence establishes that these
PHI matters were within the scope of their employment.

Investigator Montoya also authenticates some of OCR’s exhibits, specifically, the
compromised documents containing PHI that Mr. Shaw turned over to OCR (see
below). OCR Ex. 3 at 2 (Montoya Decl. § 8); OCR Ex. 5; OCR Ex. 7.

> Some evidence suggests that, by late August 2010, Manager Shaw no longer worked at
Lincare. OCR Ex. 19. In the absence of any evidence to the contrary, I could reasonably
infer that she was still an employee when she spoke to Investigator Montoya in August
2009 and even as late as June 2010. Of course, her departure from the company does not
make her subsequent statements inadmissible in these proceedings, particularly
considering that they are supported by other evidence and not specifically challenged by
Lincare. 45 C.F.R. § 160.540; see Florence Park Care Ctr., DAB No. 1931 (2004)
(holding that the moving party must submit evidence only with respect to facts that are in
dispute).
The second affidavit was prepared by Laurie A. Rinehart-Thomas, the director of
Health Information Management and Systems at Ohio State University. Ms.
Rinehart-Thomas is certified by the American Health Information Management
Association as a registered health information administrator. OCR Ex. 4
(Rinehart-Thomas Decl.). She offers her expert opinion on Respondent Lincare’s
HIPAA compliance and also describes standards in the industry against which to
measure the reasonableness of Respondent’s conduct. To the extent that her
declaration asserts facts regarding industry standards and practices, those facts
would be relevant and material. While I agree that I have the ultimate authority to
decide legal questions, I do not agree that a witness’s declaration is inadmissible
simply because it includes legal conclusions. Indeed, the rules say the opposite.
Rule 704 says that an opinion “is not objectionable just because it embraces the
ultimate issue.” Fed. R. Evid. 704(a).*

e Other exhibits. Nor are OCR’s other exhibits “unverified pieces of paper” that
would not be admissible. Not only are OCR’s exhibits relevant and material and
thus admissible under 45 C.F.R. § 160.540, they would be admissible under the
Federal Rules. They include:

1. OCR’s notice letter and other correspondence between OCR and
Respondent Lincare (OCR Exs. 1, 29, 30, 31, 32);

2. Complainant Shaw’s written complaint (OCR Ex. 2) and other documents
from OCR’s investigation (OCR Exs. 6, 10, 17, 18, 19, 20);

3. The Lincare patient documents containing the PHI that is the subject of this
appeal (OCR Exs. 5, 7, 10);

4. Respondent Lincare’s written policies and procedures regarding patient PHI
(OCR Exs. 8, 9);

5. Email correspondence among Lincare employees regarding the missing
documents (OCR Exs. 11, 12, 13);

6. Handwritten notes of a Lincare employee, which describe employee
conversations regarding the missing documents (OCR Exs. 20-28);

7. The criminal court docket sheet for a criminal complaint the company
brought against Complainant Richard Shaw (OCR Ex. 14);

+ Ms. Rinehart-Thomas offers interesting insights into the types of practices companies
use to protect PHI. These might have been useful in a closer case. But, here, I need not
rely on her opinions in order to conclude that Lincare violated HIPAA.
8. Correspondence between Respondent Lincare and Complainant Shaw
regarding the missing documents (OCR Exs. 15, 16);

9. Transcripts of Investigator Montoya’s interviews with Lincare employees
(OCR Exs. 33, 34);

10. Research materials regarding the importance of protecting PHI (OCR
Exs. 35-38); and

11. OCR materials with instructions about protecting PHI (OCR Exs. 39-41).

Respondent Lincare has not come forward with any evidence suggesting that this
evidence is unreliable and does not even allege that it disputes the underlying facts
established by these documents. In fact, it has explicitly admitted most of them. R. Br.
at 2-5.

OCR has thus come forward with admissible evidence, which, as the following
discussion shows, establishes that it must prevail at trial. To avoid summary judgment,
Respondent Lincare had to come forward with evidence showing a dispute of material
fact. But it has not done so, and OCR is therefore entitled to summary judgment. See
Guardian Health Care Ctr., DAB No. 1943 (finding summary judgment appropriate
where the moving party identified certain facts as undisputed, and the nonmoving party
failed to identify which of those facts were in dispute, relying instead on unsubstantiated
assertions and generalizations to oppose the motion); Florence Park Care Ctr., DAB No.
1931.

I. OCR is entitled to summary judgment because the undisputed evidence establishes
that Respondent Lincare did not reasonably safeguard the PHI of its patients, as
required by 45 C.F.R. § 164.530(c), which allowed an unauthorized individual
access to that information.*

Privacy Rule. As noted above, HIPAA creates privacy rights and protections for
consumers of health services, and, pursuant to its provisions, the Secretary has
implemented the Privacy Rule, which mandates that a covered entity reasonably
safeguard PHI from any use or disclosure that violates the rule’s requirements. 45 C.F.R.
§ 164.530(c)(2).

“Disclosure” includes “the release, transfer, provision of access to, or divulging of
information outside the entity holding the information.” 45 C.F.R. § 160.103.

> My findings of fact/conclusions of law are set forth, in italics and bold, in the
discussion captions of this decision.
The regulations define “covered entity,” as 1) a health plan; 2) health care clearing house;
or 3) health care provider who transmits any health information in electronic form in
connection with a transaction covered by HIPAA. Act § 1172(a); see Act § 1173(a)(1);
45 C.F.R.§§ 160.102, 160.103, 160.104. Employees, volunteers, trainees, and other
persons whose conduct, in performing work for a covered entity, is “under the direct
control of such covered entity” are considered the entity’s “workforce.” 45 C.F.R.

§ 160.103.

“Health information” means any information, whether oral or recorded in any form, that
1) is created or received by, among other entities, a health care provider; and 2) relates to
an individual’s physical or mental health or condition, the provision of care to an
individual, or payment for providing health care to an individual. 45 C.F.R. § 160.103.
The regulations then define particular types of health information:

e “Individually identifiable health information” is a subset of health information,
including demographic information, that is collected from an individual. It is
created or received by a health care provider or other specified entity, and relates
to an individual’s physical or mental health or condition (past, present, or future);
the provision of health care to an individual; or payment for providing health care
to an individual. The information identifies an individual or could be used to
identify an individual. 45 C.F.R. § 160.103.

e “Protected health information” (PHI) is a type of individually identifiable health
information. With limited exceptions not applicable here, it means identifiable
health information that is transmitted by electronic media, maintained in electronic
media, or transmitted or maintained in any other form or medium. 45 C.F.R.

§ 160.103.

HIPAA authorizes the Secretary to impose CMPs on those who violate its standards. It
incorporates most of the existing CMP provisions of the Act, which are found at section
1128A. Act § 1176(a)(2); 45 C.F.R. § 160.402(a). Section 1128A of the Act makes a
principal liable for the actions of its agent acting within the scope of that agency. Act

§ 1128A(); 45 C.F.R. § 160.402(c)(1).

Lincare’s HIPAA violations: disclosure of PHI to an unauthorized individual. The
material facts of this case are not in dispute. Respondent Lincare supplies oxygen and
other respiratory therapy equipment and services to patients in their homes or at
alternative sites. It operates more than 850 branch locations in 48 states. R. Br. at 1. The
parties agree that Lincare is a “covered entity.” OCR Br. at 4; R. Br. at 2.

This case centers around the Lincare branch located in Wynne, Arkansas, which was
doing business as United Medical. Faith Shaw was the Wynne Center’s manager from
October 2005 until July 2009 and, as such, was responsible for maintaining the PHI of its
patients. The parties agree that she was a workforce member. OCR Br. at 4; R. Br. at 2;
OCR Ex. 19; OCR Ex. 32 at 3 (referring to Ms. Shaw as “Ms. Williams”).

Among other materials, Ms. Shaw was responsible for:

e An “Emergency Procedures Manual,” dated February 2005, which contained PHI
of 270 Lincare patients, specifically their names, addresses, telephone numbers,
and emergency contacts (OCR Br. at 4; R. Br. at 4; OCR Ex. 5); and

e Patient-specific documents dated between June 2007 and July 2008 for eight
Lincare patients. These included patient assessments and care plans, physician
prescriptions, certificates of necessity, and confirmations of orders. These
documents also contained patient names, addresses, telephone numbers, dates of
birth, medical symptoms, diagnoses, medical test results, prescriptions, names of
physicians, and names of pharmacies. OCR Br. at 4-5; R. Br. at 4; OCR Ex. 7.

The parties agree that all of these materials included PHI. OCR Br. at 4; R. Br. at 2-3.

The parties also agree that, because Lincare employees provided services away from the
company’s offices, they had to remove from those offices records containing PHI. In
addition, prior to November 2008, the company instructed its center managers to
maintain copies of the procedures manual “secured” in their vehicles so that company
employees would have access to patient contact information if a center office were
destroyed or otherwise made inaccessible. OCR Ex. 18 at 1-2; OCR Ex. 33 at 30; OCR
Ex. 34 at 20-22, 26, 30, 33; R. Br. at 9.

Accordingly, Center Manager Shaw took from the office the manual and other documents
containing PHI. She told the OCR investigator that she kept the documents in her car
even though she knew that her husband had keys to the car. When she moved out of the
marital home in August 2008, she left the documents behind. She also admitted to the
OCR investigator that, when she left, she didn’t even know where the car was parked.
OCR Ex. 18.

Neither Center Manager Shaw nor anyone else from Lincare realized that the documents
were missing until about November 2008, when Richard Shaw — who, everyone agrees,
was not authorized to see the PHI — reported to Lincare and then to OCR that he had
them. OCR Br. at 5; R. Br. at 3-4; OCR Ex. 3 at 2-6 (Montoya Decl. {§ 7, 10, 11, 17);
OCR Ex. 17, OCR Ex. 18; OCR Ex. 30 at 1, OCR Ex. 33 at 13.
10

Affirmative Defenses. HIPAA limits the affirmative defenses available to Respondent
Lincare. Act § 1176(a)(1). For violations occurring on or after February 18, 2009, OCR
may not impose a CMP if: 1) the covered entity establishes that it did not know about the
violation (determined in accordance with federal common law of agency) and, by
exercising reasonable diligence, would not have known about the violation; or 2) despite
the exercise of ordinary business care and prudence, circumstances made it unreasonable
for the covered entity to comply with the violated provision; the violation was not caused
by “willful neglect”; and it was corrected within 30 days of the date the covered entity
knew or should have known about it. OCR may extend the 30-day period as it deems
appropriate, “based on the nature and extent of the failure to comply.” 45 C.F.R.

§ 160.410(b).

Respondent Lincare claims that it was the victim of a theft, for which it should not be
held accountable. Without providing evidence to support its accusations, it maintains that
Complainant Shaw “stole” the manual and attempted to use it as leverage to induce his
estranged wife to return to him. R. Br. at 16. For purposes of summary judgment, I need
not accept such unsupported allegations as true. But even if I accepted the allegations,
Lincare’s “defense” is just as damaging — perhaps even more damaging — than the OCR
version of events. Under HIPAA, Respondent was obliged to take reasonable steps to
protect its PHI from theft.° It violated that obligation when Manager Shaw took
documents out of the office, left them in places (car or home) accessible to this
purportedly untrustworthy and possibly unbalanced individual, and then, apparently
without giving a thought to the security of those documents, abandoned them entirely.”

Further, as OCR correctly points out, even after it learned of the breach, Lincare took no
steps to prevent further disclosure of PHI. Indeed, managers did not seem to recognize
that they had a significant problem protecting PHI that was removed from the office.
When asked whether Lincare considered revising its policies to include specific
guidelines for safeguarding PHI taken out of its offices, Corporate Compliance Officer

° The drafters of the regulations noted that theft “may or may not signal a violation of

[the Privacy Rule], depending on the circumstances and whether the covered entity had
reasonable policies to protect against theft.” 65 Fed. Reg. 82462, 82562 (December 28,
2000).

7 Lincare has not come forward with a shred of evidence to substantiate its defamatory
allegations against Complainant Shaw, and, in fact, all the evidence before me suggests
that he found the documents in the house or car that he shared with his wife. See, e.g.,
OCR Exs. 17, 18. The company filed a criminal complaint against him and had him
arrested, but the charges were dropped. OCR Ex. 14 at 2; R. Br. at 3. In any event, there
is no question that Mr. Shaw called OCR to report the unauthorized disclosure and that he
turned the documents over to that office. He may have wanted to punish his wife or to
compel her return, but his is hardly the behavior of someone intent on stealing PHI.

11

Pederson replied that Lincare personnel “considered putting a policy together that said
thou shalt not let anybody steal your protected health information.” OCR Ex. 33 at 29.
I do not consider this a serious response.

Thus, undisputed evidence establishes that Manager Shaw, a Lincare workforce member,
removed her patients’ PHI from the company office, left it in places to which her
husband, an unauthorized person, had access, and then abandoned it altogether. Neither
she nor anyone else at Lincare even knew that the information was missing until months
later. Lincare thus failed to “reasonably safeguard” its patients’ PHI and violated section
164.530(c) of the HIPAA Privacy Rule.

2. OCR is entitled to summary judgment because the undisputed evidence establishes
that, in violation of 45 C.F.R. § 164.530(i), Respondent Lincare failed to develop or
implement policies and procedures to protect from disclosure the PHI that staff
removed from branch offices.

HIPAA requirements. A covered entity must implement policies and procedures that,
with respect to PHI, comply with the “standards, implementation specifications, or other
requirements” of subparts D and E of the Privacy Rule. The policies and procedures
must be reasonably designed, taking into account the size and the type of activities
undertaken by the covered entity to ensure compliance. 45 C.F.R. § 164.530(i)(1). The
covered entity must maintain its policies and procedures “in written or electronic form.”
45 CFR. §164.530(j)(1)(i).

Lincare’s HIPAA violation: inadequate policies and procedures for protecting PHI. As
noted above, the parties agree that, in order to perform their duties, Lincare employees
had to take out of the office documents containing PHI. OCR Br. at 5; R. Br. at 3-4. The
parties also agree that Lincare was required to develop and implement policies and
procedures reasonably designed to protect its patients’ PHI while those documents were
out of the office. OCR Br. at 6; R. Br. at 6-7.

In attempting to identify a material fact in dispute, Respondent Lincare asserts that the
question of whether its policies were “reasonably designed” presents a factual dispute
requiring a hearing. R. Br. at 7. But deciding whether Lincare’s policies met the
regulatory requirements that they be reasonably designed is a legal question. And, as the
undisputed evidence establishes, Lincare’s policies were inadequate. In fact, no written
policy even addressed staff’s protecting PHI that was removed from the offices.

At the time of the unauthorized disclosures to Complainant Shaw, Respondent Lincare
had in place a written privacy policy that addressed maintaining records within the center
offices but said nothing about removing them from those offices. Indeed, a strict reading
of the policy suggests that such documents should not leave the office, but must be kept
in areas inaccessible to all except company employees. The policy explicitly prohibits
12

outsiders from areas where PHI is stored, limiting their access to the office’s “front
entrance area or lobby.” OCR Ex. 9 at 4 (“Access to areas containing PHI is limited to
company employees.”).

The company ostensibly revised its policies in 2009, which was after it learned of the
unauthorized disclosure. Yet, the new policies and procedures provide no guidance to
employees required to remove documents from the office’s secured storage space; in that
respect, its policies for protecting patient records were virtually unchanged. OCR Ex. 8
at 4. Indeed, as noted above, Lincare management did not seem to recognize any
problem and did not seriously consider amending its policies to safeguard PHI removed
from the office. OCR Ex. 33 at 29 (“We considered putting a policy together that said
thou shalt not let anybody steal your protected health information.”).

According to Area Manager Layton, sometime after the breach — he could not remember
when — he instructed staff to return all patient-specific information to the center on the
same day it was taken out. Area Manager Layton conceded that he had no written record
of those instructions. OCR Ex. 34 at 27; see R. Br. at 9 (affirming that staff were
instructed to return the manual to the offices at night, but not indicating when that policy
went into effect).

To establish that it had in place and implemented an adequate policy, Respondent Lincare
points to the following bullet point in the written policy:

e Information Storage — filing cabinets and medical charts are to be kept in secured
locations where they cannot be accessed by the public.

OCR Ex. 8 at 4; OCR Ex. 9 at 4; R. Br. at 7.

In context, this provision plainly addresses file storage within the office. It and other
instructions are explicitly addressed to “each location,” not to the individual employees,
and it is in a list of instructions for storage of information within the office. But, even if
it applied to documents taken out of the office, the policy does not satisfy the regulation
because it provides no usable guidance to employees. Given the “type of activities”
Lincare employees engage in, i.e., providing care in patient homes and regularly taking
PHI out of the office, the bullet point does nothing to ensure compliance with the
requirements of the Privacy Rule.

Respondent Lincare suggests that its policies are deliberately broad so that the individual
centers could tailor them to meet their differing needs. R. Br. at 7. Developing such
individualized policies, which take into account an office’s size and type of activities,
13

would certainly be consistent with the regulations. But those policies must still be
maintained “in written or electronic form.” Respondent Lincare has come forward with
no such policies for its Wynne, Arkansas (or any other) branch and does not claim that
they existed in the required format.

Instead, Respondent Lincare suggests that it satisfied HIPAA requirements because its
employees were trained in privacy policies, and “understood those policies, practices and
procedures[.]” R.Br. at 8. But even if this training were flawless (and no evidence
suggests that it was even adequate), staff training does not compensate for missing
policies.* In addition to having policies and procedures in place, the covered entity must
train all members of its workforce. 45 C.F.R. § 164.530(b).

Finally, the company had no policies — written or otherwise — in place to monitor
documents removed from their offices and to ensure their return. This meant that PHI
could be missing for indefinite periods without the company’s knowledge, as happened
with the documents Manager Shaw removed and later abandoned.

Respondent Lincare presents no evidence to establish that it maintained, in written or
electronic form, policies and procedures reasonably designed to address protecting the
PHI removed from its offices. Indeed, no evidence suggests that it implemented any
coherent policies to keep that information secure. It therefore violated section 164.530(i)
of the HIPAA Privacy Rule.

3. Respondent Lincare has waived any challenge to the amount of the proposed
penalty.

OCR argues that Respondent Lincare has waived any challenge to the amount of the
CMP. Lagree. To preserve that issue, a party’s hearing request must include “the factual
and legal basis for opposing the penalty.” 45 C.F.R. § 160.504(c); OCR Ex. 1 at 8; OCR
Reply at 18. Here, except to challenge the HIPAA violation itself, neither Lincare’s
hearing request nor its subsequent submissions challenge the amount of the penalty. It
thus waived any challenge to the amount of the penalty.

® Respondent offers no real evidence describing the training curriculum. It relies on
selected quotes from company employees describing their training. The employee
descriptions are far from comprehensive; they do not specify what the policies were or
when they were implemented. For example, Respondent quotes Service Representative
Robert Dean Scott describing a Wynne Center policy to return the manual to the office at
night. R. Br. at 9. Neither he nor Respondent indicates when this policy went into effect.
R. Br. at 9. Based on the undisputed evidence in the record, it probably occurred
sometime after the breach. OCR Ex. 34 at 27.
14

Moreover, even if it had otherwise preserved the issue, the respondent has the burden of
going forward and the burden of persuasion with respect to any challenge to the amount
of the proposed penalty. 45 C.F.R. § 160.534(b)(ii). Because it proffers no evidence or
argument attacking the amount of the penalty, Respondent Lincare has not met its
burden, and I must affirm the amount of the proposed penalty.

Conclusion

The undisputed evidence establishes that Lincare violated HIPAA because it failed to
safeguard the PHI of its patients; a member of its workforce disclosed patient PHI to an
unauthorized person; and it lacked policies and procedures reasonably designed to ensure
compliance with the Privacy Rule. I therefore grant OCR’s motion for summary
judgment and sustain the $239,800 CMP.

/s/
Carolyn Cozad Hughes
Administrative Law Judge


Department of Health and Human Services
DEPARTMENTAL APPEALS BOARD

Civil Remedies Division

Westchester Surgical Associates, PLLC,
Petitioner,
v.
Centers for Medicare & Medicaid Services.

Docket No. C-15-3884

Decision No. CR4503

Date: January 12, 2016
DECISION

The Centers for Medicare & Medicaid Services (CMS), through its administrative
contractor, National Government Services (NGS), determined that the effective date for
the reassignment of Medicare benefits from Kalyani Bhuta, M.D. (Dr. Bhuta), to the
newly formed group practice of Westchester Surgical Associates, PLLC (Westchester or
Petitioner) was January 14, 2015. On reconsideration, NGS upheld its prior
determination regarding the effective date for the reassignment of Dr. Bhuta’s Medicare
benefits to Westchester. Westchester requested a hearing to obtain a reassignment
effective date of October 1, 2014, which was the date Dr. Bhuta began providing services
in association with Westchester. However, because the earliest date on which
Westchester could be considered eligible to participate in the Medicare program is
January 14, 2015, Dr. Bhuta’s reassignment of benefits cannot be earlier than January 14,
2015. Therefore, I affirm NGS’s determination that the effective date for the
reassignment of Dr. Bhuta’s Medicare benefits to Westchester is January 14, 2015.

I. Background and Procedural History

Dr. Bhuta and Dr. Heena Rajdeo were physicians enrolled in the Medicare program.
They had previously been associated with a hospital group practice, but, on October 1,
2014, they opened Westchester together as a group practice. Hearing Request at 1; CMS
Ex. 1, Part II at 6-7. Drs. Bhuta and Rajdeo hired Laura Dewender, a certified
credentialing specialist, to assist with the Medicare applications for each physician and to
assist with enrolling Westchester in Medicare. Hearing Request at 1.

As part of the transition of Drs. Bhuta and Rajdeo to a new practice, they filed a number
of forms, all of which NGS received on November 10, 2014:

a) CMS-855B (Medicare Enrollment Application — Clinics/Group Practices and
Certain Other Suppliers) to enroll Westchester in the Medicare program for the
first time (CMS Exhibit (Ex.) 1);

b) CMS-855R (Medicare Enrollment Application — Reassignment of Medicare
Benefits) to reassign the Medicare benefits assigned to Dr. Bhuta by her patients to
Westchester (CMS Ex. 2);

c) CMS-855I (Medicare Enrollment Application — Physicians and Non-Physician
Practitioners) to report to CMS a change in Dr. Bhuta’s contact information and
that she was now affiliated with Westchester (CMS Ex. 5);!

d) CMS-855R (Medicare Enrollment Application — Reassignment of Medicare
Benefits) to reassign the Medicare benefits assigned to Dr. Rajdeo by her patients
to Westchester (CMS Ex. 3); and

e) CMS-855I (Medicare Enrollment Application — Physicians and Non-Physician
Practitioners) to report to CMS a change in Dr. Rajdeo’s contact information and
that she was now affiliated with Westchester (CMS Ex. 4).

These filings were meant to enroll Westchester in the Medicare program, and inform
CMS that Drs. Bhuta and Rajdeo were both affiliated with and reassigning their Medicare
benefits to Westchester. See CMS Ex. 37 {fj 2-4. Significantly, Drs. Bhuta and Rajdeo
wanted the reassignment of their benefits to be effective on October 1, 2014, the date
they first began seeing patients at Westchester. CMS Ex. 2 at 6; CMS Ex. 3 at 6.

By letter dated December 10, 2014, NGS notified Westchester that it needed additional
information in order to process its CMS-855B enrollment application and Westchester
had to submit the required information within 30 calendar days of December 10, 2014, or
else NGS might reject the application. CMS Ex. 6. NGS sent this notice by email;
however, NGS’s email notice went into Ms. Dewender’s email spam folder, which Ms.
Dewender did not check until being prompted to do so by an NGS employee at a later
date. CMS Ex. 7 at 1; CMS Ex. 14; CMS Ex. 37 4 6; Petitioner Exhibit (P. Ex.) 2 at 1-2.
Westchester, therefore, did not timely respond to the December 10 letter and, on February

' The instructions for CMS-855I state that the form is to be used for enrollment and it is
also to be used by those currently enrolled who need to make changes to enrollment
information. The instructions state that a form CMS-855R must also be filed for a
reassignment of benefits. CMS Ex. 4 at 3; CMS Ex. 5 at 4.

12, 2015, NGS rejected Westchester’s CMS-855B enrollment application. CMS Ex. 8;
CMS Ex. 37 4 9. Consequently, NGS also rejected Drs. Bhuta’s and Rajdeo’s CMS-
855R reassignment of benefits applications based on its rejection of Westchester’s
enrollment application. CMS Ex. 9; CMS Ex. 10; CMS Ex. 37 § 11. NGS processed and
approved Drs. Bhuta’s and Rajdeo’s CMS-855I change of information applications.
CMS Ex. 11; CMS Ex. 12; CMS Ex. 37 § 13-14.

Westchester submitted a new CMS-855B enrollment application, and Drs. Bhuta and
Rajdeo submitted a joint CMS-855R reassignment application, which NGS received on
February 13, 2015. CMS Ex. 13; CMS Ex. 14; CMS Ex. 15; CMS Ex. 37 4 17, 24.
NGS approved Westchester’s enrollment application and set the effective date of
enrollment in the Medicare program as February 13, 2015, with a retrospective billing
date of January 14, 2015. CMS Ex. 22; CMS Ex. 37 at 6n.1. NGS also approved the
reassignment application for Dr. Bhuta, which NGS also made effective January 14,
2015. CMS Ex. 21; CMS Ex. 37 § 23. Further, NGS approved the reassignment
application for Dr. Rajdeo, which NGS made effective October 1, 2014. CMS Ex. 26;
CMS Ex. 37 § 26.

Ina May 14, 2015 letter, Westchester requested that NGS reconsider the January 14,
2015 effective date for the reassignment of Dr. Bhuta’s Medicare benefits to Westchester.
Westchester requested an October 1, 2014 effective date because that is the date Dr.
Bhuta started to see patients at Westchester and NGS had assigned Dr. Rajdeo an October
1, 2014 effective date of reassignment. CMS Ex. 30; CMS Ex. 33; CMS Ex. 37 § 30.
However, in a June 15, 2015 reconsidered determination, NGS upheld the January 14,
2015 effective date for the reassignment of benefits to Westchester, stating that Dr.
Rajdeo’s effective date for reassignment had been an error. CMS Ex. 35. NGS later
issued a revised determination in which it amended the effective date for the
reassignment of Dr. Rajdeo’s benefits to January 14, 2015. CMS Ex. 36.

Petitioner timely requested a hearing before an Administrative Law Judge (ALJ). On
September 3, 2015, I issued an Acknowledgment and Pre-hearing Order (Pre-Hearing
Order), which established a prehearing submission schedule. In response, CMS filed a
motion for summary judgment with a brief in support of the motion (CMS Br.) and 37
exhibits (CMS Exs. 1-37) as its pre-hearing exchange. Petitioner filed a pre-hearing
exchange, consisting of several documents, which were all marked as P. Ex. 2.

On November 24, 2015, CMS moved to dismiss Petitioner’s hearing request due to
abandonment. Petitioner opposed CMS’s motion to dismiss because it had filed P. Ex. 2
as its pre-hearing exchange. Petitioner also moved for summary judgment. On
December 3, 2015, I issued an order denying CMS’s motion to dismiss as well as both
parties’ motions for summary judgment.
II. Decision on the Written Record

Petitioner did not object to CMS’s proposed exhibits. Therefore, I admit CMS Exs. 1-37
into the record.

CMS did not file a timely objection to Petitioner’s proposed exhibit, P. Ex. 2. See Pre-
Hearing Order § 7; Civil Remedies Division Procedures § 14(e). Therefore, I admit P.
Ex. 2 into the record.

CMS offered the written direct testimony for one witness (CMS Ex. 37); however,
Petitioner did not request to cross-examine that witness. Petitioner submitted a notarized
statement from Laura Dewender P. Ex. 2 at 1-3; however, CMS did not timely request to
cross-examine Ms. Dewender. See Pre-Hearing Order 4 9; Civil Remedies Division
Procedures § 16(b) (an ALJ may require parties to affirmatively state they intend to
cross-examine a witness). Because there are no witnesses for whom cross-examination
was timely requested, I issue this decision based on the written record. Pre-Hearing
Order | 13; Civil Remedies Division Procedures § 19(d).

II. Issue and Jurisdiction

In its hearing request, Petitioner appears to seek review of NGS’s decision concerning the
effective date for Westchester’s enrollment in the Medicare program and for Drs. Bhuta’s
and Rajdeo’s reassignments of Medicare benefits to Westchester. Westchester seeks an
October 1, 2014 effective date. Hearing Request at 1. However, Petitioner only
requested reconsideration of NGS’s determination regarding the effective date for Dr.
Bhuta’s reassignment of benefits. CMS Exs. 30, 33. Petitioner did not request
reconsideration of the effective date for Westchester’s enrollment or Dr. Rajdeo’s
reassignment of benefits. CMS Ex. 37 §§ 22, 34. Consequently, NGS only issued a
reconsidered determination concerning the effective date for Dr. Bhuta’s reassignment of
Medicare benefits. CMS Ex. 35. Because there is a reconsidered determination only in
relation to the effective date of Dr. Bhuta’s reassignment of Medicare benefits, that is the
only matter over which I have jurisdiction. Karthik Ramaswamy, DAB No. 2563, at 7
(2014) (en banc), aff’d, Ramaswamy v. Burwell, 83 F. Supp. 3d 846 (E.D. MO 2015).

Therefore, the only issue in this case is whether CMS had a legitimate basis for
establishing January 14, 2015, as the effective date for Dr. Bhuta’s reassignment of
Medicare benefits to Westchester.
IV. Findings of Fact, Conclusions of Law, and Analysis”

The Social Security Act (Act) authorizes the Secretary of Health and Human Services
(Secretary) to promulgate regulations governing the enrollment process for providers and
suppliers. 42 U.S.C. §§ 1302, 1395cc(j). A provider or supplier seeking billing
privileges under the Medicare program must “submit enrollment information on the
applicable enrollment application. Once the provider or supplier successfully completes
the enrollment process . .. CMS enrolls the provider or supplier into the Medicare
program.” 42 C.F.R. § 424.510(a). CMS then establishes an effective date for billing
privileges under the requirements stated in 42 C.F.R. § 424.520(d) and may permit
limited retrospective billing under 42 C.F.R. § 424.521.

For Medicare Part B claims, a beneficiary may assign his or her benefits to an enrolled
physician or non-physician supplier providing services to that beneficiary. 42 U.S.C.

§ 1395u(b)(3)(B)(ii). In certain circumstances, a supplier who has received an
assignment of benefits may reassign those benefits to an employer, or to an individual or
entity with which the supplier has a contractual arrangement. 42 U.S.C. § 1395u(b)(6);
42 C.F.R. § 424.80(b)(1)-(2). CMS instructs its employees that reassignment of benefits
may only occur between enrolled suppliers and that “[t]he effective date of reassignment
is the date on which the individual began or will begin rendering services with the
reassignee.” Medicare Program Integrity Manual (MPIM) § 15.5.20.°

I. NGS enrolled Westchester in the Medicare program on February 13,
2015, with retrospective Medicare billing privileges effective January
14, 2015; therefore, the effective date for Dr. Bhuta’s reassignment
of Medicare benefits to Westchester is January 14, 2015, the earliest
date on which Westchester could be considered enrolled in the
Medicare program.

Westchester is a “physician or nonphysician practitioner organization” that sought
enrollment in the Medicare program as an organizational entity. 42 C.F.R. § 424.502;
CMS Ex | at 7. Prior to the filing of Westchester’s applications to enroll in the Medicare
program, Dr. Bhuta was an enrolled supplier in the Medicare program. 42 C.F.R

§ 424.502 (defining “supplier” to include physicians); see CMS Ex. 4 at 5.

“ My findings of fact and conclusions of law are set forth in italics and bold font.

> See MPIM § 15.5.20, titled “Processing Form CMS-855R Applications” (rev. 416, eff.
Feb. 27, 2012). The current online version of the MPIM can be found at
https://www.cms.gov/regulations-and-guidance/guidance/manuals/internet-only-
manuals-ioms-items/cms019033.html (last visited December 30, 2015).
Reassignment of Medicare benefits is allowed to an “entity” such as Westchester as long
as the entity is enrolled in the Medicare program. 42 C.F.R. § 424.80(b)(2). Section
15.1.1 of the MPIM defines reassignment as the situation when “an individual physician,
non-physician practitioner, or other supplier grants another Medicare-enrolled provider or
supplier the right to receive payment for the physician’s, non-physician practitioner’s or
other supplier’s services.” If an individual physician is already enrolled in Medicare and
wants to reassign his payments to an entity that is already enrolled in Medicare, a CMS-
855R application is all that is required for the reassignment. If the entity to which the
physician wants to reassign his benefits is not enrolled in Medicare, then that entity must
complete a CMS-855B application. A Medicare contractor, such as NGS, cannot
approve the reassignment until the entity is enrolled. 42 C.F.R. § 424.502; MPIM

§§ 15.1.2, 15.5.4.3B, 15.5.20 (“[b]oth the individual practitioner and the eligible supplier
must be currently enrolled (or concurrently enrolling . . . ) in the Medicare program
before the reassignment can take place”); see also CMS Ex. 2 at 5; CMS Ex. 3 at 5 (The
CMS-855R completed by Petitioner also advises applicants that “‘[b]oth the individual
practitioner and the eligible supplier must be currently enrolled (or concurrently enrolling
...) in the Medicare program before the reassignment can take place.).

In the present case, Dr. Bhuta was enrolled in the Medicare program before October 1,
2014, the date on which Petitioner seeks the reassignment of benefits from Dr. Bhuta to
commence. However, Westchester was not enrolled in the Medicare program until
February 13, 2015,‘ and was only granted retrospective Medicare billing privileges from
January 14, 2015.° CMS Ex. 22; CMS Ex. 37 at 6n.1. Because Westchester did not
request reconsideration of its enrollment effective date (CMS Ex. 37 § 22), the enrollment
effective date, and consequently, the retrospective billing effective date, are binding.

42 CFR. § 498.20(b)(1).

Although Westchester and Dr. Bhuta first submitted CMS-855B and CMS-855R
applications to NGS in November 2014, those applications are not before me because
NGS rejected them. CMS may reject a Medicare enrollment application if the applicant
does not furnish complete information and supporting documentation within 30 days
from the date the contractor requests the information. 42 C.F.R. § 424.525(a)(1). When
CMS rejects an enrollment application, the applicant does not have a right to
administrative review of the rejection. 42 C.F.R. § 424.525(d). Moreover, once CMS

* Petitioner filed an enrollment application on February 13, 2015, which was processed
to completion. CMS Ex. 13. Therefore, the effective date for its enrollment in Medicare
is February 13, 2015. 42 C.F.R. § 424.520(d); 73 Fed. Reg. 69,725, 69,769 (Nov. 19,
2008).

> In general, CMS may only grant up to a 30-day retrospective billing period to a newly
enrolled physician or physician practice. 42 C.F.R. § 424.521 (a)(1).
rejects an enrollment application, the filing date of the rejected application does not play
arole in determining the effective date for enrollment based on a subsequent application.
When CMS processes a subsequent application to completion, it is the filing date of that
subsequent application that controls the effective date of enrollment. Ramaswamy, DAB
No. 2563 at 6; 71 Fed. Reg. 20,754, 20,759 (April 21, 2006).

The present case is similar to Middlesex Rheumatology and Crispin Abarientos, M.D.,
DAB CR3660 (2015). In Middlesex, the ALJ relied on MPIM § 15.5.20 for the
proposition that reassignment can only occur between two enrolled entities. The ALJ
applied the effective date provisions from the enrollment regulations because the
reassignee was not previously enrolled in the Medicare program and the earliest effective
date for the reassignment was the effective date of enrollment for the non-enrolled entity.
The ALJ noted that relevant CMS policy on reassignment provides that the effective date
of reassignment of an already enrolled supplier is determined only by the date that the
supplier began or will begin providing services with the reassignee, but reassignment
could only be made to an enrolled entity. /d. at 11 citing to MPIM § 15.5.20 (“[t]he
effective date of reassignment is the date on which the individual began or will begin
rendering services with the reassignee.”).

The regulations and CMS policy in the MPIM do not permit a reassignment of Medicare
benefits to an entity that is not enrolled in Medicare. Therefore, Dr. Bhuta’s
reassignment to Westchester could not be effective before the effective date of
Westchester’s enrollment and billing privileges. Although Dr. Bhuta began rendering
services with Westchester on October 1, 2014, Westchester could not accept any
assignment of benefits as it was not yet enrolled in the Medicare program.

I conclude that NGS correctly determined that January 14, 2015, was the earliest
effective date for Dr. Bhuta’s reassignment of benefits to Westchester because January
14, 2015, is the earliest date on which Westchester could be considered eligible to
participate in the Medicare program.

2. Petitioner’s equitable and estoppel arguments cannot be considered.

Petitioner advances several reasons why I should grant a reassignment effective date from
Dr. Bhuta to Westchester earlier than January 14, 2014. Petitioner claims that it is “a
small two physician practice” and not knowledgeable in Medicare credentialing. Hearing
Request at 3. Petitioner explains that numerous calls were made to NGS for assistance,
but NGS did not provide guidance, and errors made by NGS staff resulted in additional
delays in processing its applications. Hearing Request at 2-3; P. Ex. 2 at 2. Further,
Petitioner asserts that had it received better communications from NGS, it would have
submitted the requested information timely. Hearing Request at 3; P. Ex. 2 at 2.
Petitioner also claims that during the enrollment process, Dr. Bhuta provided services to
Medicare and Medicaid beneficiaries for three-and-a-half months at a cost of more than
$65,000 to Petitioner, for which it will not receive compensation. Hearing Request at 4.

I do not have authority to grant the equitable relief Petitioner seeks in the form of an
earlier effective date of reassignment. US Ultrasound, DAB No. 2302 at 8 (2010)
(“Neither the ALJ nor the Board is authorized to provide equitable relief by reimbursing
or enrolling a supplier who does not meet statutory or regulatory requirements.”).
Therefore, Petitioner’s equitable estoppel argument must be rejected.

Petitioner also claims that it never received the notice from NGS advising it that NGS
required additional information in order to process its applications. According to
Petitioner, the email notice NGS sent went unnoticed into Ms. Dewender’s email spam
folder. Hearing Request at 2; P. Ex. 2 at 1-2. However, the record before me shows that
for both the CMS-855R and CMS-855B applications, Petitioner identified Ms. Dewender
as the person to be contacted should questions arise during the processing of the
applications. Petitioner also provided Ms. Dewender’s email address as a means of
contacting Ms. Dewender. CMS Ex. | at 11; CMS Ex. 2 at 9; CMS Ex. 5 at 26; CMS Ex.
13 at 12; CMS Ex. 15 at 9.

Under CMS’s internal procedures, NGS properly exercised discretion to use email as a
means of contacting Ms. Dewender in regards to Petitioner’s enrollment applications.
See MPIM §15.5.13 (“unless the provider requests that the contractor communicate with
only a specific individual (e.g., an authorized official) or via specific means (e.g., only
via the correspondence address e-mail) — the contractor has the discretion to use the
contact persons listed in section 13 of the Form CMS-855 for all written and oral
communications (e.g., mail, e-mail, telephone) related to the provider’s Medicare
enrollment.”). Because the regulations do not specify a method of communication that
NGS must use to contact providers and suppliers in order to request additional
information (see 42 C.F.R. § 424.525(a)), CMS’s internal procedures do not conflict with
the regulations and NGS properly sent its request by email to Petitioner.

V. Conclusion

For the reasons explained above, I affirm CMS’s determination that the effective date of
reassignment of Medicare benefits from Dr. Bhuta to Westchester is January 14, 2015.

/s/
Scott Anderson
Administrative Law Judge


Department of Health and Human Services
DEPARTMENTAL APPEALS BOARD

Civil Remedies Division

Center for Tobacco Products,
(FDA No. FDA-2015-H-2140)

Complainant
v.

Massood Ali
d/b/a 7-Eleven Store 10317A,

Respondent.
Docket No. C-15-3001
Decision No. CR4502

Date: January 12,2016

INITIAL DECISION AND DEFAULT JUDGMENT

The Center for Tobacco Products (CTP) began this matter by serving an administrative
complaint on Respondent, Massood Ali d/b/a 7-Eleven Store 10317A, located at 4833
Coronado Parkway, Cape Coral, Florida 33904, and by filing a copy of the complaint
with the Food and Drug Administration’s (FDA) Division of Dockets Management. The
complaint alleges that 7-Eleven Store 10317A impermissibly sold cigarettes to minors,
thereby violating the Federal Food, Drug, and Cosmetic Act (Act), 21 U.S.C.

§ 301 et seq., and its implementing regulations, 21 C.F.R. pt. 1140. CTP seeks to impose
a $250 civil money penalty against Respondent 7-Eleven Store 10317A. During the
hearing process, Respondent has failed to comply with a judicial direction regarding
CTP’s discovery request. I therefore strike Respondent’s answer and issue this decision
of default judgment.
I. Procedural History

CTP began this matter by serving an administrative complaint seeking a $250 civil
money penalty on Respondent Massood Ali d/b/a 7-Eleven Store 10317A, located at
4833 Coronado Parkway, Cape Coral, Florida 33904. Respondent filed an answer to
CTP’s complaint on August 3, 2015. I issued an Acknowledgement and Prehearing
Order (APHO) on August 21, 2015, that set deadlines for parties’ submissions, including
the September 21, 2015 deadline to request that the opposing party provide copies of
documents relevant to this case. Additionally, the APHO stated that a party receiving
such a request must provide the requested documents no later than 30 days after the
request. CTP served Respondent with its request for documents on September 21, 2015.

On October 27, 2015, CTP filed a Motion to Compel Discovery indicating that CTP had
not received a response to its request for production of documents. See 21 C.F.R.

§ 17.23(a). On the same date, CTP also filed a motion requesting that all pre-hearing
exchange deadlines be extended. In an October 28, 2015 letter issued by my direction,
Respondent was given until November 12, 2015, to object to CTP’s motion. Respondent
did not file an objection to CTP’s motion.

On November 24, 2015, I issued an order granting CTP’s Motion to Compel Discovery
and extending the pre-hearing exchange deadlines. The Order allowed Respondent until
December 8, 2015 to comply with CTP’s discovery request. In granting CTP’s Motion to
Compel Discovery, I also explained that failure to comply with CTP’s discovery request
may result in sanctions, including the issuance of an Initial Decision and Default
Judgment, finding Respondent liable for the violations listed in the complaint and
imposing a civil money penalty. CTP subsequently filed a Motion to Impose Sanctions
on December 11, 2015, indicating that Respondent did not comply with the November
24, 2015 Order Granting CTP’s Motion to Compel.

Il. Pending Motions

On December 11, 2015, CTP filed a Motion to Impose Sanctions. In its December 11,
2015 memorandum supporting its Motion for Sanctions, CTP stated that “Respondent
still has not produced any documents in response to CTP’s Request for Production that
was served on it more than eleven weeks ago.”

Due to noncompliance with my Order granting CTP’s Motion to Compel, I am striking
Respondent’s Answer, issuing this default decision, and assuming the facts alleged in
CTP’s complaint to be true. See 21 C.F.R. § 17.35(c) (3), 17.11(a). The harshness of the
sanctions I impose upon either party must relate to the nature and severity of the
misconduct or failure to comply, and I find the failure to comply here sufficiently
egregious to warrant striking the answer and issuing a decision without further
proceedings. See 21 C.F.R. § 17.35(b).
III. Default Decision

Striking Respondent’s Answer leaves the Complaint unanswered. Therefore, I am
required to issue an initial decision by default if the complaint is sufficient to justify a
penalty. 21 C.F.R. § 17.11(a). Accordingly, I must determine whether the allegations in
the Complaint establish violations of the Act.

For purposes of this decision, I assume the facts alleged in the Complaint are true and
conclude the default judgment is merited based on the allegations of the Complaint and
the sanctions imposed on Respondent for failure to comply with the orders. 21 C.F.R.
§ 17.11. Specifically:

e At approximately 6:48 p.m. on November 20, 2014, at Respondent’s business
establishment, 4833 Coronado Parkway, Cape Coral, Florida 33904, an FDA-
commissioned inspector observed Respondent’s staff selling a package of
Marlboro cigarettes to a person younger than 18 years of age;

e Ina warning letter dated December 18, 2014, CTP informed Respondent of the
inspector’s November 20, 2014 observation, and that such action violates federal
law, 21 C.F.R. § 1140.14(a). The letter further warned that Respondent’s failure
to correct its violation could result in a civil money penalty or other regulatory
action;

e At approximately 9:02 p.m. on February 27, 2015, at Respondent’s business
establishment, 4833 Coronado Parkway, Cape Coral, Florida 33904, an FDA-
commissioned inspector documented Respondent’s staff selling a package of
Marlboro Gold Pack cigarettes to a person younger than 18 years of age.

These facts establish Respondent 7-Eleven Store 10317A’s liability under the Act. Under
21 CFR. § 1140.14(a), no retailer may sell cigarettes to any person younger than 18
years of age.

A $250 civil money penalty is permissible under 21 C.F.R. § 17.2.
Order

For these reasons, I enter default judgment in the amount of $250 against Respondent
Massood Ali d/b/a 7-Eleven Store 10317A. Pursuant to 21 C.F.R. § 17.11(b), this order
becomes final and binding upon both parties after 30 days of the date of its issuance.

/s/
Steven T. Kessel
Administrative Law Judge


Department of Health and Human Services
DEPARTMENTAL APPEALS BOARD

Civil Remedies Division

Doris U. Tan, M.D., P.C.
(PTAN: A100078224;
NPI: 1356685077),
Petitioner,
v.
Centers for Medicare & Medicaid Services.
Docket No. C-16-42
Decision No. CR4501
Date: January 8, 2016
DECISION
Petitioner, Doris U. Tan, M.D., P.C. (herein Petitioner) is a professional corporation
owned by Doris U. Tan, M.D., a physician who is a board certified obstetrician and
gynecologist. Petitioner participated in the Medicare program until the Centers for
Medicare & Medicaid Services (CMS) revoked its Medicare supplier number because it
employed a managing employee who was excluded from all federal health care programs,
including the Medicare program. Petitioner appeals the revocation of its supplier

number.

For the reasons discussed below, I find that Petitioner was not compliant with Medicare
requirements and that CMS properly revoked its supplier number.
I. Background

In a letter dated June 22, 2015, the Medicare contractor, National Government Services
(NGS), notified Petitioner that its supplier number would be revoked effective June 19,
1996, and that it was barred from reenrollment for a period of three years. CMS Exhibit
(Ex.) 2 at 1. In its letter, NGS explained that it had discovered that an employee of
Petitioner, Sung Dam Tan, had been excluded by the Inspector General from participation
in federally funded health care programs pursuant to section 1128(b)(4) of the Social
Security Act (Act). NGS also explained that this individual had been listed as a
managing employee on Petitioner’s Form CMS-855I (Medicare Enrollment Application
for Physicians and Non-Physician Practitioners), therefore, CMS was authorized to
revoke Petitioner’s Medicare enrollment and billing privileges pursuant to 42 C.F.R.

§ 424.535(a)(2). See 42 U.S.C. § 1320a-7.

Petitioner submitted a request for reconsideration on or about July 1, 2015. CMS Ex. 8.
In its request, Petitioner’s owner, Dr. Tan, explained the following:

While I do trust the integrity of said employee, at the time that his
services were engaged, we were not aware that he was barred from
participating in Medicare billing after an incident some years prior
when his license was revoked. Since receiving your letter, he was
terminated as an employee at my practice and his responsibilities
have been transferred to another member of my staff. I hope my
ignorance in this matter and my swift action in correcting the error
will inspire leniency and understanding as you consider the
revocation of my Medicare enrollment and billing privileges.

Id.

In a reconsidered determination dated August 21, 2015, R.F., an NGS employee, affirmed
the revocation of Petitioner’s supplier number pursuant to 42 C.F.R.

§ 424.535(a)(2). CMS Ex. 9. Petitioner submitted a timely request for hearing on
October 20, 2015.

In an order dated October 27, 2015, I directed the parties to submit pre-hearing briefs
addressing all issues of law and fact, including any motions for summary judgment, along
with any proposed exhibits, including written direct testimony in the form of an affidavit
or declaration, of any proposed witness. Acknowledgment and Pre-Hearing Order at 3-5,
4 4-8. The order advised the parties that a hearing for the purpose of cross-examining
witnesses “will be necessary only if a party files admissible, written direct testimony, and
the opposing party asks to cross-examine.” Acknowledgment and Pre-Hearing Order at
6,4 10.
CMS submitted a brief and motion for summary judgment disposition (CMS Br.), along
with ten proposed exhibits. Petitioner submitted its brief (P. Br.), which also sought
summary disposition, and four proposed exhibits. In the absence of any objections, I
admit into evidence CMS Exs. 1-10 and P. Exs. 1-4.!

Neither party has expressed a desire to cross-examine any witnesses. I consider the
are : . 2
record in this case to be closed, and the matter is ready for a decision on the merits.”

II. Applicable law

Section 1831 of the Act establishes the supplementary medical insurance benefits
program for the aged and disabled known as Medicare Part B. 42 U.S.C. § 1395).
Payment under the program for services rendered to Medicare-eligible beneficiaries may
only be made to eligible providers of services and suppliers.* Act

§§ 1835(a) (42 U.S.C. § 1395n(a)); 1842(h)(1) (42 U.S.C. § 1395(u)(h)(1)). The Act
requires that the Secretary of Health and Human Services issue regulations that establish
a process for the enrollment of providers and suppliers, including the right to a hearing
and judicial review in the event of denial or non-renewal. Act § 1866(j) (42 U.S.C.

§ 1395cc(j)). Pursuant to 42 C.F.R. § 424.505, a supplier must be enrolled in the
Medicare program and be issued a billing number to have billing privileges and to be
eligible to receive payment for services rendered to a Medicare-eligible beneficiary.

CMS may revoke an enrolled supplier’s Medicare billing privileges and supplier
agreement for any of the reasons listed in 42 C.F.R. § 424.535. Pursuant to 42 C.F.R.

§ 424.535(a)(2)(i), CMS may revoke a supplier’s enrollment if it is determined that a
managing employee of the supplier is excluded from participation in Medicare, Medicaid,
or any other federal health care program. A managing employee is defined as “a general
manager, business manager, administrator, director, or other individual that exercises
operational or managerial control over, or who directly or indirectly conducts, the day-to-

' CMS has argued that a declaration submitted in conjunction with the October 20, 2015
request for hearing is inadmissible. However, CMS has not objected to P. Ex. 4, which
contains similar information. See Acknowledgment and Prehearing Order at 5, ¥ 8
(directing that any written direct testimony should be submitted at the time of the pre-
hearing exchange). The evidence considered in my decision is limited to the evidence
contained in CMS Exs. 1-10 and P. Exs. 1-4.

> The parties have each argued that summary disposition is appropriate. It is unnecessary
in this instance to address the issue of summary disposition, as neither party has
requested an in-person hearing.

> For purposes of the Act, Petitioner is a Medicare supplier. Act § 1861(d) (42 U.S.C.
§ 1395x(d)).
day operation of the provider or supplier, either under contract or through some other
arrangement, whether or not the individual is a W-2 employee of the provider or
supplier.” 42 C.F.R. § 424.502.

III. Discussion

I. CMS was authorized to revoke Petitioner’s enrollment
and billing privileges. ‘

2. The September 24, 2012 Form CMS-855I Petitioner
submitted listed a managing employee who had been
excluded from participation in Medicare and federal
health care programs.

This case hinges on whether an employee Petitioner identified as an individual having
managing control on the Form CMS- 855] was in fact a managing employee. Petitioner
concedes that the individual listed on the form had his medical license revoked and has
been excluded from participation in federal health care programs, so the factual question
before me is whether the employee at issue was a managing employee. See 42 C.F.R.

§ 424.502.°

Sung Dam Tan is the sole managing employee listed on the Form CMS-8551 at issue.°
The New York State Administrative Review Board for Professional Medical Conduct
revoked Mr. Tan’s license to practice medicine. CMS Ex. 10 at 1. Thereafter, the
Inspector General of the Department of Health and Human Services, in May 1996,
notified Mr. Tan that he would be excluded from Medicare and other federal health care
programs until such time as he regains his medical license and applies for and is granted
reinstatement as a Medicare provider. Jd. The May 1996 letter explained to Mr. Tan that
“payment will not be made to any entity in which you are serving as an employee,
administrator, operator, or in any other capacity for any services that you furnish, order or
prescribe on or after the effective date of this exclusion.” Jd. at 2. The effective date of

* Findings of fact and conclusions of law are set forth in bold and italics.

* Petitioner limits its arguments to contesting CMS’s revocation of its billing privileges
and does not dispute either the effective date assigned or the length of the reenrollment
bar.

° | will refer to Petitioner’s owner as “Dr. Tan” throughout this decision. Sung Dam Tan
is Petitioner’s husband (P. Ex. 4 at 2) and, like Dr. Tan, holds a medical degree. P. Ex. 4
at 1,2; CMS Ex. 10. As such, Sung Dam Tan can appropriately be addressed as “Dr.
Tan,” as well. For the sake of clarity, I will refer to Sung Dam Tan as “Mr. Tan,” which
is how both parties refer to him in their briefs.
Mr. Tan’s exclusion is June 19, 1996, which is the same effective date of revocation that
is listed in Petitioner’s initial and reconsidered determinations. CMS Exs. 2, 9, 10.

Petitioner submitted a Form CMS-855] on or about September 24, 2012. In Section 6 of
the form, entitled “Individuals Having Managing Control,” the following guidance is
provided to applicants:

This section captures information about all managing employees. A
managing employee means a general manager, business manager,
director, or other individual who exercises operational or managerial
control over, or who directly or indirectly conducts, the day-to-day
operations of the supplier, either under contract or through some
other arrangement, regardless of whether the individual is a W-2
employee of the supplier.

All managing employees at any of your practice locations in Section
4 must be reported in this section. If there is more than one
managing employee, copy and complete this section as needed.

CMS Ex. 1. Petitioner listed only one managing employee in its application, Mr. Tan.’
Petitioner reported that Mr. Tan had the job title of “office manager,” and his Social
Security number, date of birth, and place of birth were printed on the application. Id.

The effective date Mr. Tan acquired managing control was listed as March 16, 1996.° Jd.
Section 13 (Contact Person) was also completed, indicating that Mr. Tan was the person
to be contacted regarding the enrollment application, even though the form instructed that
the physician would be contacted directly if no one was listed in that section. CMS Ex. 1
at 23. In Section 6 of the completed form, Dr. Tan checked “NO” in response to a
question asking whether “the individual in Section 6A above, under any current or former
name or business identity, had a final adverse legal action listed on page 12 of this
application imposed against him/her.” This negative response was inaccurate, in that the
types of legal actions listed on page 12 included “revocation or suspension of a license to
provide health care by any State licensing authority” and “[a]ny suspension or exclusion
from participation in, or any sanction imposed by, a Federal or State health care

7 Despite Dr. Tan’s declaration that Xiaofang Qyu (referred to by Dr. Tan as “Winnie”)
ad been the “assistant manager” of the practice for approximately ten years, this
individual is not listed as a managing official on the Form CMS-855I. I observe that Dr.
Tan reported that “[e]ach of the responsibilities of the ‘managing employee’ for my
practice were performed either personally by me, or by Winnie under my supervision.”
P. Ex. 4 at 3.

* This date pre-dates the June 19, 1996 effective date of Mr. Tan’s exclusion from
participation in Medicare and other federal health care programs.

program.” CMS Ex. | at 12, 13. Petitioner has conceded that Mr. Tan’s medical license
is currently revoked and he continues to be excluded from participation in federal health
care programs. P. Ex. 4.

In Petitioner’s request for reconsideration, which is Dr. Tan’s initial response to CMS’s
notice that it was revoking Petitioner’s supplier number pursuant to section
434.535(a)(2), Dr. Tan did not indicate that she misunderstood the meaning of the term
“managing employee” or that she had committed a clerical error. Rather, Dr. Tan
explained that she was previously unaware that a managing employee could not “have
had their licenses revoked or surrendered.” CMS Ex. 8. Dr. Tan further acknowledged
that she was “not aware that [Mr. Tan] was barred from participating in Medicare
billing.” Dr. Tan reported that she took “swift action in correcting the error” and that she

had terminated Mr. Tan and transferred his responsibilities to “another member of [her]
staff.” Id.

In a December 2015 declaration admitted as P. Ex. 4, Dr. Tan alleges that she committed
a “clerical error” by listing Mr. Tan as a managing official in Section 6 of the Form
CMS-855I. She explains that Mr. Tan performed only simple clerical tasks, and that she
and her “‘assistant manager,” Xiaofang Qyu, ran the practice together. Furthermore, Dr.
Tan contends in the same declaration that she did not understand the meaning of the term
“managing employee” when she completed the Form CMS 8551, even though the form
clearly explained who should be listed as a managing employee. As explained below, I
do not find Dr. Tan’s statements in this regard to be credible.

While Dr. Tan explains that she was “not aware” that a managing employee “‘is a specific
legal term,” she fails to give any explanation of why she listed Mr. Tan as a managing
employee, as opposed to listing her assistant manager or not listing anyone, which would
have resulted in her being the point of contact for the Medicare contractor. Although she
explained that she and the assistant manager managed the practice’s operations together,
Dr. Tan did not list the assistant manager, rather than Mr. Tan, as a managing employee
on the Form CMS-855I. Furthermore, even though Dr. Tan currently expresses her belief
that Mr. Tan’s listing was a clerical error and a result of the failure to understand a legal
definition of managing employee, it is striking that she omits any discussion in her
declaration of why Mr. Tan was listed as holding the job title of “office manager” even
though he was purportedly not a managing employee. While Dr. Tan contends that the
she was confused because the term “managing employee” is a “term of art,” it is unclear
to me how her designation of an employee as holding the position of “office manager”
could refer to someone who held no managerial responsibilities. Even though she now
claims that she was ignorant of the specific meaning of the term managing employee, she
previously expressed, only months earlier in July 2015, that her “error” was based on her
lack of knowledge that an individual whose medical license had been revoked could not
serve as a managing employee and her lack of knowledge that Mr. Tan had been
excluded.°? Dr. Tan’s statements at P. Ex. 4 are inconsistent with her prior statements and
are given little probative weight. Petitioner has failed to show that there was any clerical
error when it stated that Mr. Tan was the “office manager” in Section 6 of the form, or
that there was any error in listing Mr. Tan as a managing employee. Neither Dr. Tan’s
declaration nor Petitioner’s brief disputes, or even acknowledges, that Petitioner
identified Mr. Tan as its office manager, and absent any contradictory evidence, I find
that the contemporaneous evidence shows that Mr. Tan held the position of office
manager in Petitioner’s office. Although Dr. Tan explained in her declaration that Mr.
Tan, a non-practicing medical doctor, performed only simple duties such as ordering and
maintaining office supplies, maintaining the copier and printer, and ordering water for the
water cooler, these claims are not credible in light of his designation as “office manager”
and his being listed as a managing employee and point of contact for the application.
Petitioner has not presented any probative or credible evidence that Mr. Tan was not a
managing employee, and has not demonstrated that Dr. Tan’s statements on the
application or in the request for reconsideration were made in error.

CMS has submitted evidence showing that Mr. Tan and CMS were in contact regarding
the enrollment application. CMS Exs. 4, 5, 6, 7. Petitioner argues that these exhibits do
not support CMS’s arguments. These documents, which consist of letters addressed to
Mr. Tan and the report of a telephone call between Mr. Tan and CMS, have some
evidentiary value but do not independently establish whether Mr. Tan was a managing
employee. While these documents show that Mr. Tan did, in fact, serve as a point of
contact for Petitioner’s Medicare enrollment, I reiterate that the most significant evidence
consists of Petitioner’s own assertion that Mr. Tan was its “office manager” and the
statements made in Dr. Tan’s reconsideration request. While Petitioner contends that Mr.
Tan was not a “managing employee” pursuant to section 424.502, it has not reconciled
how an employee who holds the position of “office manager” was not a managing
employee, or how its previously asserted defense of being unaware of the requirements of
section 424.535(a)(2) would be relevant if Mr. Tan were merely an employee who
handles only low-level clerical tasks.

While Petitioner alleges that it committed an “honest mistake” and a “clerical error” in
completing the application, I disagree. P. Br. at 4, 8. Petitioner has not shown that the
information provided on the Form CMS-855I in September 2012 was inaccurate.

° An individual whose medical license has been revoked can, in theory, serve as a
managing employee so long as the individual has not also been excluded from
participating in all federal health care programs, as Mr. Tan was. Nothing in section
424.535(a)(2) requires CMS to revoke a supplier’s billing privileges for employing an
individual whose license has been revoked.
IV. Conclusion

Petitioner did not meet all of the Medicare supplier requirements, and CMS properly
revoked its supplier number and billing privileges.

/s/
Leslie C. Rogall
Administrative Law Judge


Department of Health and Human Services
DEPARTMENTAL APPEALS BOARD

Civil Remedies Division

Parkview Adventist Medical Center,
Petitioner,
v.
Centers for Medicare & Medicaid Services.
Docket No. C-15-3800
Decision No. CR4500

Date: January 7, 2016

DECISION

The Centers for Medicare & Medicaid Services (CMS) granted the request of Parkview
Adventist Medical Center (Parkview or Petitioner) to voluntarily terminate its Medicare
provider agreement. CMS set the effective date of termination based on the date on
which Parkview ceased to provide inpatient services. Parkview requested a hearing to
challenge CMS’s action arguing that the date of termination and CMS’s reason for
picking that date amounted to an involuntary termination. Because I agree that CMS’s
action constitutes an involuntary termination, I have jurisdiction to issue a decision in this
case. Based on the record in this matter, I affirm CMS’s determination to terminate
Parkview; however, I modify the effective date of the termination from June 18, 2015, to
July 4, 2015.

I. Background

Parkview was a non-profit, 55-bed hospital located in Brunswick, Maine, and was a
Medicare provider for decades. Petitioner Exhibit (P. Ex.) 1 §] 3-5. Due to operating
losses attributed to its inpatient unit and emergency department, Parkview decided to
petition for bankruptcy protection and sell Parkview’s assets to another hospital. P. Ex. 1

46.
Ina June 15, 2015 letter, Parkview notified CMS that it was voluntarily terminating its
participation in the Medicare program under 42 C.F.R. § 489.52. The letter stated that
Parkview was going to file in bankruptcy court and would cease operating as a hospital
following the issuance of an order by the bankruptcy court. Parkview anticipated that the
court would issue such an order within 60 to 90 days. Finally, Parkview stated that on
June 18, 2015, it would transition from providing inpatient services to only providing
outpatient services. P. Ex. 1 § 10; CMS Ex. 1.

On June 16, 2015, Parkview filed a voluntary petition for Chapter 11 bankruptcy. P. Ex.
1412. On that date, Parkview also filed a motion with the bankruptcy court that stated,

among other things, all inpatients at Parkview would be transitioned to other facilities by
the close of business on June 18, 2015. CMS Ex. 2 § 16; see also CMS Ex. 5 ¥ 14.

By June 18, 2015, Parkview discharged all of its inpatients and closed its inpatient care
unit. P. Ex. 1 912. On June 19, 2015, the Maine Department of Health and Human
Services (Maine DHHS) issued a conditional license for Parkview to operate outpatient
services during the pendency of the bankruptcy proceedings. CMS Ex. 6. Maine DHHS
did not authorize Parkview to admit inpatients. CMS Ex. 6 at 2.

Also on June 19, 2015, CMS issued a letter in which it accepted Parkview’s voluntary
termination of its Medicare provider agreement and set June 18, 2015, as the effective
date of termination. CMS stated the following:

Based upon information from your hospital’s website, your
statements to CMS, and your emergency motion filed in
bankruptcy court], CMS has determined that the date of
voluntary termination of your Part A Medicare Provider
Agreement is June 18, 2015. See 42 C.F.R. §489.52(b)(1).

According to the information reviewed by CMS, the hospital
as closed its inpatient services on June 18, 2015, and
discharged all inpatients on or about 4:00pm on June 18,
2015. Additionally, the hospital is not accepting new
inpatients, and does not plan to accept new inpatients in the
future. Therefore, the hospital no longer meets the definition
of “hospital,” as outlined in [42 U.S.C. § 1395x(e)]. See also
42 CFR. § 482.1. More specifically, a Medicare-
participating hospital must be an institution which is
primarily engaged in providing care to inpatients.
Additionally, you have also requested voluntary termination
of your participation in the Medicare program.

CMS Ex. 3 at 1.
On June 24, 2015, Parkview’s counsel emailed CMS and explained that CMS’s decision
to terminate Parkview’s provider agreement on June 18 would have significant negative
ramifications for Parkview’s bankruptcy transition plan. CMS Ex. 10 at 2-3. Parkview’s
counsel indicated that Parkview could request that Maine DHHS permit Parkview to
admit one or more inpatients if CMS would reinstate Parkview’s Medicare provider
agreement again. CMS Ex. 10 at 2-3. On June 25, 2015, CMS responded that it was
willing to rescind the termination of the provider agreement if Parkview reopened its
inpatient admissions. CMS Ex. 10 at 1.

On July 27, 2015, Parkview notified CMS that it viewed CMS’s decision to terminate
Parkview’s provider agreement on June 18 to be an involuntary termination because
CMS based the effective date of termination on Parkview’s failure to meet a requirement
to be a hospital in the Medicare program. Parkview also sought to rescind its June 15
notice of voluntary termination. CMS Ex. 7.

On August 4, 2015, CMS responded to Parkview’s counsel that CMS had accepted
Parkwood’s voluntary termination of its provider agreement and that CMS would have to
treat Parkview’s request to rescind the termination of the provider agreement as an initial
request to participate in the Medicare program. CMS also advised Parkview that it may
request a hearing before an Administrative Law Judge (ALJ) if Parkview believed that
CMS’s actions constituted an involuntary termination. CMS Ex. 8.

On August 17, 2015, Parkview requested a hearing to dispute CMS’s decision to
terminate Parkview’s provider agreement effective June 18, 2015. Parkview argued that
CMS involuntarily terminated Parkview’s provider agreement, but failed to provide
notice of the termination 15 days before it became effective.

I issued an Acknowledgment and Pre-hearing Order (Order) on September 23, 2015. On
October 2, 2015, CMS moved for a more definite statement from Parkview. Parkview
opposed CMS’s motion, but also articulated a detailed basis for the hearing request, thus
rendering CMS’s motion moot. On October 28, 2015, CMS filed a motion for summary
judgment and memorandum in support of that motion (CMS Br.), and 12 exhibits (CMS
Exs. 1-12). Petitioner filed a prehearing brief and opposition to the CMS motion for
summary judgment (P. Br.) and three exhibits (P. Exs. 1-3). CMS filed a reply brief
(CMS Reply) in which CMS requested that I either grant summary judgment or issue a
decision on the record.

II. Decision on the Record

I admit all of the parties’ proposed exhibits because neither party objected to any of the
exhibits. Order § 7; Civil Remedies Division Procedures § 14(e).
My Order advised the parties that they must submit written direct testimony for each
proposed witness and that an in-person hearing would only be necessary if the opposing
party requested to cross-examine a witness. Order {J 8-10; Civil Remedies Division
Procedures §§ 16(b), 19(b). Both parties submitted written direct testimony (P. Exs. 1, 2;
CMS Ex. 11); however, neither party requested to cross-examine any of the witnesses.
Therefore, I issue a decision based on the written record. Order § 13; Civil Remedies
Division Procedures § 19(d).

III. Issues

1. Whether CMS had a legitimate basis to terminate Parkview’s Medicare provider
agreement.

2. Ifso, whether CMS correctly set June 18, 2015, as the effective date of
termination.

IV. Jurisdiction

I have jurisdiction to decide the issues in this case. 42 U.S.C. § 1395cc(h)(1); 42 C.F.R.
§§ 489.53(e), 498.3(b)(8).

V. Findings of Fact, Conclusions of Law, and Analysis!

A hospital that participates in the Medicare program is considered a provider of services
(provider). 42 U.S.C. § 1395x(u); 42 C.F.R. § 400.202 (definition of Provider). A
provider will only be eligible to receive payments under the Medicare program if it enters
into an agreement with the Secretary of Health and Human Services (Secretary).

42 U.S.C. § 1395cc(a); see also 42 C.F.R § 489.2(b)(1). In order for a hospital to be a
provider in the Medicare program, it must be primarily engaged in providing care to
inpatients. 42 U.S.C. § 1395x(e)(1).

A provider may voluntarily terminate its Medicare provider agreement. 42 U.S.C.

§ 1395cc(b)(1). To do so, the provider must send written notice to CMS and may provide
the intended date of termination. 42 C.F.R. § 489.52(a)(1), (3). If the provider’s notice
does not specify a date for termination or the date requested by the provider is
unacceptable to CMS, CMS may set a date for termination that is not more than six
months after the date on the provider’s termination notice. 42 C.F.R. § 489.52(b)(1). A
provider who ceases to be in business is deemed to be terminated as of the date that the
provider ceased providing services. 42 C.F.R. § 489.52(b)(3). A provider who is

' My findings of fact and conclusions of law are set forth in italics and bold font.
voluntarily terminating its provider agreement must provide public notice of this fact at
least 15 days before the termination goes into effect. 42 C.F.R. § 489.52(c)(1).

CMS may involuntarily terminate a provider’s Medicare provider agreement for a variety
of reasons, including a failure to substantially meet the applicable provisions in 42 U.S.C.
§ 1395x. 42 U.S.C. § 1395cec(b)(2); 42 C.F.R. § 489.53(a). Generally, CMS must give
notice of an involuntary termination of a provider agreement 15 days before the
termination takes effect and CMS concurrently gives notice to the public of the
termination. 42 C.F.R. § 489.53(d)(1), (5).

I. CMS involuntarily terminated Parkview’s Medicare provider
agreement.

Parkview asserts that CMS’s June 19, 2015 determination is an involuntary termination
of Parkview’s provider agreement. P. Br. at 12-15; CMS Ex. 7. CMS argues that it
merely accepted Parkview’s voluntary termination and legitimately set an effective date
for termination. CMS Br. 8-13; CMS Ex. 8. There is no dispute that Parkview sent a
letter to CMS on June 15, 2015, seeking voluntary termination of its Medicare provider
agreement. CMS Ex. 1. There is no dispute that Parkview’s letter indicated that it
intended for termination to occur on the same day as the bankruptcy court issued its order
approving the sale of Parkview’s assets, which Parkview expected within 60 to 90 days.
CMS Ex. | at 2. There is also no dispute in this case that CMS responded to Parkview’s
letter with a June 19, 2015 letter in which CMS retroactively terminated Parkview’s
provider agreement on June 18, 2015. CMS Ex. 3. CMS reasoned that Parkview failed
to specify a voluntary termination date; therefore, CMS set the termination date based on
the date Parkview last provided inpatient services. CMS Ex. 3 at 1; CMS Ex. 11 5-6.

I am persuaded that CMS’s determination to impose a retroactive effective date for a
voluntary termination based on Parkview’s decision to cease providing inpatient services
was an involuntary termination of Parkview. As explained below, a hospital that does not
primarily engage in providing inpatient care may be involuntarily terminated. See

42 US.C. §§ 1395cc(b)(2), 1395x; 42 C.F.R. § 489.53(a). When CMS based its June 19,
2015 determination to retroactively terminate Parkview on Parkview’s failure to meet a
statutory requirement to be a hospital in the Medicare program, CMS involuntarily
terminated Parkview. United Medical Home Care, Inc., DAB No. 2194, at 8-9 (2008).

This conclusion is confirmed by CMS’s willingness to rescind the termination if
Parkview returned to compliance and started to admit inpatients again. CMS Ex. 10 at 1.
Further, although CMS has never conceded that its June 19, 2015 determination was an
involuntary termination, CMS informed Parkview on August 4, 2015, that it could
request a hearing, within 60 days of the June 19, 2015 letter, if Parkview thought the
determination was an involuntary termination. CMS Ex. 8. CMS even indicated that it
would “not challenge the timeliness of any appeal if Parkview files it within 60 days of
receipt of this letter.’ CMS Ex. 8 at 1. Finally, CMS did not move for dismissal of
Parkview’s hearing request, even though a provider does not have a right to a hearing
based on a voluntary termination. See 42 C.F.R. §§ 489.52, 498.3, 498.70(b). Therefore,
while CMS’s position is that it acted within its authority under 42 C.F.R. § 489.52 to set
an effective date for a voluntary termination, CMS’s actions subsequent to June 19, 2015,
betray uncertainty as to the type of action it took.

Although not found in the June 19, 2015 determination, CMS asserts that its retroactive
voluntary termination determination was justified because Parkview ceased its business
activities and that, as such, June 18, 2015, is the appropriate effective date for the
voluntary termination under 42 C.F.R. § 489.52(b)(3). CMS Br. at 10, 12. However, the
record is clear that Parkview did not cease its business activity on June 18, 2015, but
rather continued to be licensed by Maine DHHS and provided outpatient care during the
pendency of the bankruptcy proceeding. P. Ex. 1 § 15; CMS Ex. 1 at 1; CMS Ex. 2 § 10;
CMS Ex. 6; CMS Ex. 9; CMS Ex. 10 at 2. Therefore, this argument is unavailing.

2. Parkview ceased to provide inpatient care on June 18, 2015.

Parkview was a 55-bed hospital. P. Ex. 1 § 3-5. Although Parkview previously
provided care to inpatients, there is no dispute that “[b]y June 18, 2015, all inpatients had
been discharged and [Parkview] had closed its inpatient care services... .” P. Br. at 6;
CMS Br. at 3; see also P. Ex. 1 §§] 10, 12; CMS Ex. 1; CMS Ex. 2 at 8; CMS Ex. 4; CMS
Ex. 5 ¥ 14; CMS Ex. 6 at 1; CMS Ex. 9; CMS Ex. 10 at 2; CMS Ex. 11 6. On June 19,
2015, Maine DHHS issued a conditional license for Parkview to operate outpatient
services during the pendency of the bankruptcy proceedings; however, Maine DHHS did
not authorize Parkview to admit inpatients. CMS Ex. 6. There is no evidence in the
record that Parkview admitted or cared for any inpatients after June 18, 2015.

3. CMS had a legitimate basis for involuntarily terminating Parkview
because Parkview permanently ceased to provide inpatient services on
June 18, 2015.

The statutory definition for a hospital participating in the Medicare program states that
the hospital must be:

primarily engaged in providing, by or under the supervision
of physicians, to inpatients (A) diagnostic services and
therapeutic services for medical diagnosis, treatment, and care
of injured, disabled, or sick persons, or (B) rehabilitation
services for the rehabilitation of injured, disabled, or sick
persons.
42 U.S.C. § 1395x(e)(1) (emphasis added). The Secretary may terminate a provider
agreement for a provider who “fails substantially to meet the applicable provisions of
section 1395x of [42 U.S.C.].” 42 U.S.C. § 1395cc(b)(2). Therefore, Parkview is subject
to termination if it was not “primarily engaged” in providing care to inpatients on and
after June 18, 2015. See Arizona Surgical Hospital LLC, DAB No. 1890 (2003); see also
Kearney Regional Medical Ctr., L.L.C., DAB No. 2639 (2015). As found above,
Parkview permanently ceased to provide any inpatient services as of June 18, 2015.
Therefore, CMS was justified in involuntarily terminating Parkview’s provider agreement
in its June 19, 2015 determination. 42 C.F.R. § 489.53(a)(1).

4. The effective date for the termination of Parkview’s Medicare
provider agreement is July 4, 2015.

With limited exceptions not applicable here, CMS must give notice of an involuntary
termination at least 15 days before the termination goes into effect. 42 C.F.R.

§ 489.53(d)(1). In the present matter, CMS set the effective date of termination one day
before it issued its June 19, 2015 determination. Because this does not comport with the
regulatory requirement for involuntary terminations, the effective date of Parkview’s
termination must be modified to July 4, 2015, which is 15 days after the date that appears
on the determination.

Petitioner argues that CMS’s June 19, 2015 notice was inadequate because it failed to
provide notice of the effective date of the termination 15 days in advance of the
termination taking effect. P. Br. at 15. In particular, Parkview indicates that notice of the
termination would have given Parkview an opportunity to try to readmit inpatients in
order to avoid termination. P. Br. at 16.

I disagree that Parkview was sufficiently prejudiced by CMS’s lack of notice. On June
17, 2015, one day before Parkview discharged all inpatients, CMS informally notified
Maine DHHS (which was working with Parkview on its bankruptcy plan) that CMS
would terminate Parkview’s provider agreement if Parkview no longer provided inpatient
care. P. Ex. 3. Importantly, in response to a June 24, 2015 email from Parkview, CMS
stated that it would rescind the termination if Parkview readmitted inpatients. CMS Ex.
10 at 2-3. However, Parkview did not act to ensure it continued to provide inpatient care.
Finally, CMS sent a second notice on August 4, 2015, which provided Parkview with
appeal rights. CMS Ex. 8. Parkview has exercised those appeal rights and is receiving
some measure of the relief it has requested. While the scenario presented in this case is
not ideal, CMS took sufficient action to avoid prejudicing Parkview. See United Medical
Home Care, DAB No. 2194, at 12-13.
5. Ido not have the authority to provide equitable relief to Parkview.

Parkview argues that a CMS official provided incorrect information that Parkview relied
upon when determining the transition plan that it would follow during the bankruptcy
proceedings. The record reflects that when considering its decision to seek bankruptcy
protection and sell its assets, Parkview held discussions with officials from the state of
Maine, including the Maine DHHS and the Attorney General’s Office, as well as
potential purchasers. P. Ex. 1 § 6. Based on these discussions, Parkview decided to file
for bankruptcy, maintain outpatient services until a bankruptcy court approved the sale of
Parkview’s assets, and cease to provide inpatient services following a three-day transition
period after filing for bankruptcy. P. Ex. 1 §7; P. Ex. 294; CMS Ex. 9. Just before
commencing the transition period, an employee of the Maine DHHS contacted CMS and
asked if a Medicare provider agreement for a hospital would remain in effect pending a
bankruptcy court order if the hospital only provided outpatient services. P. Ex. 1 8.
The Maine DHHS employee did not identify Parkview during the conversation with
CMS. See P. Ex. 295. The CMS employee responded that the provider agreement
would remain in effect until the bankruptcy court issued its order. P. Ex. 1 § 9;

P. Ex. 296. Parkview moved forward with its plan, which included ceasing inpatient
care. On June 17, 2015, Parkview posted on its website notice of its bankruptcy filing
and that inpatient services would cease on June 18, 2015. CMS Ex. 4. Also on June 17,
2015, the CMS employee who had previously advised Maine DHHS that a hospital
provider agreement would remain in effect during bankruptcy proceedings, even if the
ospital no longer had inpatients, sent an email to Maine DHHS advising that the
termination date of a Medicare provider agreement in such a circumstance is the date that
the provider discharges the last inpatient. P. Ex. 3 at 2; see also P. Ex. 1 § 13;
P.Ex.297.

Although it appears that CMS provided incorrect information to Maine DHHS, it is well
settled that an incorrect statement cannot be used to estop the government. See, e.g.,
Office of Personnel Mgmt. v. Richmond, 496 U.S. 414 (1990); Heckler v. Cmty. Health
Servs. of Crawford County, Inc., 467 U.S. 51 (1984); Oklahoma Heart Hosp., DAB No.
2183, at 16 (2008); Wade Pediatrics, DAB No. 2153, at 22 n.9 (2008), aff'd, 567 F.3d
1202 (10th Cir. 2009); U.S. Ultrasound, DAB No. 2302, at 8 (2010). Therefore, to the
extent that Parkview seeks equitable estoppel based on misinformation provided by CMS
to Maine DHHS, I must reject that argument.
VI. Conclusion

I affirm CMS’s involuntary termination of Petitioner’s Medicare provider agreement.
However, I modify the effective date of termination to July 4, 2015.

/s/
Scott Anderson
Administrative Law Judge