Category: Healthcare Providers

10 ways you can protect your company from a cyberattack

By Emmie Futrell, Class of 2018; Robb S. Harvey, Partner at Waller; Elizabeth N. Pitman, Counsel at Waller

The government, through the United States Department of Justice, has increased its efforts to respond to cyberattacks, a hot-button issue that extended across disciplines in 2017. The newly created Cyber-Digital Task Force has been charged with developing policies to combat global cyber terror and involve federal law enforcement on the front lines of this virtual battlefield.

The OCR’s January and February 2018 OCR Cybersecurity Newsletters provided targeted tips to HIPAA-covered entities and business partners to prevent cyber extortion as a means to obtain ransom money and to avoid the consequences of phishing attacks. The OCR recommended training, vigilance and bolstering defenses by encrypting and backing up sensitive data and training workforce. Specifically, OCR provided the following list of suggestions:

  1. Train employees to identify unusual emails and other messages that hackers could use to break into your system.
  2. Document suspicious activity and review those logs regularly.
  3. Perform a risk analysis that looks at the entire organization and addresses known risks.
  4. Use anti-malware programs to prevent access by malicious software proactively.
  5. Implement and test cyberattack recovery plans.
  6. Encrypt and back up sensitive data.
  7. Stay on top of new and emerging cyber threats, perhaps by signing up for governmental alerts known as US-CERT alerts, which are generated by the government’s National Cyber Awareness System and received via email or an RSS feed and provide timely information about security issues
  8. Be wary of unusual emails and text messages
  9. Use multi-factor authentication
  10. Stay updated with anti-malware software and system patches

These measures can both protect and prove cost-effective.

The 2017 Ponemon Data Breach report found that the healthcare industry in the United States stands to lose the most from a data breach, with the average cost per lost or stolen record at $380. Estimated savings for companies that only chose to extensively encrypt information are $16 per record and, companies that have a prepared Incident Response Team and Plan could save $19 per record. Saving these costs per record could significantly lessen the inevitable economic impact of a large-scale breach. The report made clear that time is of the essence in a breach, a sentiment that has been echoed by the OCR’s guidance and HIPAA’s response requirements.

Implementing the OCR’s guidance can help healthcare companies save costs when faced with cyber extortion. Many of the suggestions from the OCR will also ensure that HIPAA standards are satisfied. For example, documenting suspicious activity will be key in creating the necessary paper trail in the event of an OCR investigation. This type of documentation is already required by HIPAA. Implementing cyberattack recovery plans like training an Incident Response Team and developing contingency plans, including the possible necessity of paying the ransom, will guarantee that the breach can be identified and contained as quickly as possible and data availability and integrity are maintained. These measures will ensure that electronic health records and other healthcare information continue to be a pathway towards innovation, rather than a backdoor for an insidious attack.

Why telehealth was a big winner in new budget deal

By Andy Cole, Class of 2018; Amber Greene Arnold, Associate at Waller

Hidden in the details of the Bipartisan Budget Act of 2018 are some key telehealth provisions that are receiving praise from many industry groups and could mark a significant development for Medicare telehealth policy.

The new legislation promotes telehealth in several ways.

Tele-stroke. Medicare currently only covers tele-stroke services for patients located in rural health professional shortage areas and counties not classified as a metropolitan statistical area.  Effective January 1, 2019, however, Medicare will cover a telehealth consultation for any Medicare beneficiary presenting at a hospital with acute stroke symptoms, without regard to current geographic restrictions.

End-Stage Renal Disease (ESRD) Services.  Beginning January 1, 2019, the legislation allows nephrologists to use telehealth to provide monthly clinical assessments for ESRD patients on home dialysis.  This provision is not subject to any geographical restrictions and the “originating site” may be a freestanding dialysis facility or the patient’s home. However, ESRD patients benefiting from this provision will still be required to have an in-person assessment each of the first three months of home dialysis and once every three months thereafter.  This provision is notable for ESRD patients who may have difficulty traveling.

Medicare Advantage Plans.  Currently, Medicare Advantage plans may cover telehealth services in addition to those covered by the traditional Medicare program, but these additional telehealth services are not paid for separately by Medicare.  The new legislation, however, authorizes Medicare Advantage plans, beginning with the 2020 plan year, to offer to include additional telehealth benefits beyond those available under traditional Medicare in their annual bid to the government.  These additional telehealth services would also have to be available to patients through in-person visits as well.  Due to the rapidly growing number of beneficiaries enrolling in Medicare Advantage plans, this provision may have a significant effect on the growth of telehealth services under Medicare.

Accountable Care Organizations.  The legislation also allows for increased coverage of telehealth services provided to Medicare patients assigned to certain ACOs.  More specifically, after January 1, 2020, for two-sided ACOs (meaning the ACO shares in both savings and losses) or an ACO tested or expanded through the Center for Medicare and Medicaid Innovation, existing telehealth geographic limitations will not apply.  This will allow for a patient’s home to qualify as an “originating site” even if the patient’s home is not located in a rural health professional shortage area.

These changes reflect a continued interest by lawmakers in supporting and expanding telehealth services and have the potential to increase access to care for Medicare beneficiaries while potentially lowering costs.  Healthcare providers should monitor the implementation of these provisions and evaluate opportunities for participating in Medicare’s expansion of coverage for telehealth.

Back to the Future: CMS revives Obama-era proposed rule on critical access hospitals

By Emmie Futrell, Class of 2018; Kristen A. Larremore, Partner at Waller; Amber Green Arnold, Associate at Waller

Since the 1997 Balanced Budget Act, which created the designation for Critical Access Hospitals (CAH), the requirements for Medicare and Medicaid participation for these rural facilities have largely remained untouched.  But, a recent decision by CMS to revive and finalize an Obama-era proposed CAH rule will change certain Medicare participation requirements for CAHs.

According to a recent rulemaking notice, CMS intends to issue a final version of the proposed CAH rule sometime in the next 17 months.

The CAH designation was created to protect financially vulnerable rural hospitals that provide vital care to rural communities and combat a string of rural hospital closures. However, the intervening years since 1997 have brought many changes to healthcare in the United States, and in June 2016 CMS issued a proposed rule in an attempt to modernize Medicare participation requirements for CAHs and other hospitals.

Highlights of the wide-ranging proposed rule include a requirement that CAHs maintain an infection prevention program, as well as an antibiotic stewardship program to promote the appropriate use of antibiotics.  CAHs would also be required to designate leaders for each of these programs.

CMS hopes these programs will result in a reduction in hospital-acquired infections, including those that may be drug-resistant, which can lengthen inpatient stays and result in increased costs to the Medicare program. However, critics of these proposed requirements have noted that many drug-resistant organisms come into hospitals from other settings and have questioned whether these anti-infection requirements will improve patient care if care delivered outside of the hospital setting is not subject to similar requirements.

The proposed rule also establishes an explicit requirement that CAHs comply with federal anti-discrimination laws — – a requirement already applicable to Medicare providers.  The proposed rule would address this disparity and seek to address reports of discriminatory barriers to access by requiring CAH facilities to adopt and implement nondiscrimination policies.

In addition, the proposed rule would clarify that each patient’s medical records must contain adequate documentation justifying the patient’s admission and continued hospitalization, support the patient’s diagnoses, and describe the patient’s progress and response to medications and services.  The proposed rule also clarifies that patients should be able to access their medical records in form and format requested by the patient, including electronically, if readily producible in that form and format.

In light of recent findings in a Bipartisan Policy Center report that was published in January 2018, CMS may consider additional revisions to the proposed rule.

The report considered the rural communities of seven upper Midwest states and the relationship between local communities and CAHs. The report indicated that, while in many of the smaller localities studied, there were still barriers to access of critical primary care services, CAHs would not necessarily be helpful in addressing such access issues in each rural community.

The report found that, in some instances, CAHs are not financially sustainable due to low occupancy of patients requiring inpatient services. Proposals are wide-ranging to correct this issue, but many proposals include modifying the CAH designation to allow these facilities to include primary care and other outpatient services in addition to the inpatient care that they are already required to provide.

Although the extent to which the Trump administration will finalize the rule as initially proposed remains unclear, CAHs should closely monitor developments for any new CMS proposals addressing CAHs and a final rule implementing changes, because CAHs continue to be a focus of lawmakers and healthcare policy advisors.

Veterans Choice Health Care Program Could Run Out of Funding

By William Dodd, Class of 2019

The Veterans’ Access to Care through Choice, Accountability, and Transparency Act of 2014, more commonly known as the Veterans Choice Program, is a U.S. public law that works to expand the number of healthcare options available for eligible veterans. Among many provocations leading up to the creation of the Program, one of the primary driving forces behind enacting the law was the Veterans Health Administration Scandal of 2014, which uncovered years of lies regarding the true wait times for veterans seeking medical care. Along with expanding medical staff and the number of VA facilities, one of the primary provisions of the Choice Program allows veterans living 40 miles or more from a VA clinic, or who are unable to get an appointment within 30 days, to seek treatment from a non-VA facility. In order to accomplish this, the 2014 Choice Program set forth $2 billion altogether, with $500 million specifically intended to increase the number of medical personnel in the VA system. The result of increased healthcare options after years of systematic failure led to an immediate increase in demand for healthcare services. Ultimately, the initial $2 billion proved insufficient to carry the program through to a long-term legislative remedy.

To combat the lack of funding for the popular program, as well as Congress’s failure to enact a timely and suitable long-term remedy, the Trump administration provided $2.1 billion in emergency funding to keep the Choice program alive. However, only weeks after the emergency funding was provided, it became clear that the program may require additional funding to avoid disruption of care for hundreds of thousands of vets. Based on estimates from David Shulkin, VA Secretary, the $2.1 billion in emergency funds will likely run out by mid-December of this year. In addition, Shulkin stated that any additional funding received would be used to bring facilities closer to where veterans live, which would continue to increase access to care for eligible veterans.

While pouring money into the Program may serve as the best option to temporarily meet the immediate demand – generated by years of lack of access to quality care – a long-term legislative fix is the best step to moving forward. As policy director for Concerned Veterans for America, Dan Caldwell, stated, “while Congress must quickly move forward on a temporary fix for the VCP budget shortfall, the Choice Program must ultimately be overhauled, expanded, and permanently reformed.” A long-term plan would likely save money through the creation of a sustainable, organized system to increase access for veterans across the board; however, before any such plan can be enacted, the immediate goal for lawmakers and the Trump administration is to meet to immediate demands of the current crisis.

After speaking with the Trump administration to address the issue of moving forward, Mr. Shulkin has promised to expand the Program during the 2018 year. Pursuant to Mr. Shulkin’s promise, President Trump has proposed an additional $2.9 billion increase in Program funding for the 2018 year, as well as another $3.5 billion in 2019. Along with increased funding projected over the next two years, proposed revisions in the Choice Program seek to eliminate the 30-day or 40-mile eligibility requirements to receive care from non-VA providers. Namely, this process would be done pursuant to the Veterans Coordinated Access and Rewarding Experiences (CARE) Act, a recent proposal from Shulkin. Along with eliminating the aforementioned eligibility requirements, the CARE Act would also include a “health risk assessment,” to be performed by VA personnel, in order to determine which provider – VA or private – will better meet the needs of the veteran-patient. The results of this assessment, as Mr. Caldwell stated, “will incentivize VHA facilities to become higher-performing health care providers through competition.” In Mr. Shulkin’s words, “at minimum, where the VA does not offer a service, veterans will have the choice to receive care in their communities.”

However, the CARE Act has experienced strong pushback from organizations, such as the American Federation of Government Employees (AFGE), on the basis that the CARE Act and similar proposals would “voucherize” VA in favor of private care. In response to this, House VA Committee Chairman, Phil Roe, stated that “this effort is in no way, shape or form intended to create a pipeline to privatize the VA health care system.” Moreover, in Shulkin’s words, “this is about building a VA that veterans choose for their care . . . We want veterans to choose VA.”

Other parties, such as director of the Schaeffer Center for Health Policy and Economics at USC, Dana Goldman, hold the exact opposite view. Goldman advocates for the VA’s complete integration into mainstream private healthcare through the provision of Platinum Plans under the ACA, which are required to cover 90% of the cost of all essential health benefits, and often include no co-payments or deductibles. According the Goldman’s estimates, the average annual cost of a Platinum Plan is around $5,000. If such plans were offered to every veteran under the age of 65, based on the $5,000 annual estimate, this plan would drastically reduce the amount paid annually for coverage of individual vets, which is currently around $7,700. Pursuant to Goldman’s reasoning, the cost savings could be directed towards specialized care for individuals with unique health needs, such as those who suffer from traumatic brain injuries, PTSD, and infectious diseases.

Currently, due to the organizational, administrative failure within the VA system, in regards to reimbursement within the private sector, many private providers have expressed a lack of interest in treating veteran-patients due to the lack of response, administrative hassle, and delayed payments in dealing with the VA. If Goldman’s plan caught on, the impact on private providers would be substantial. Already, more than 30% of VA appointments are made in the private sector. If complete integration were to ever take place, private providers would receive higher volume and guaranteed federal reimbursement for treating veteran-patients, and the VA could focus its efforts solely on administration and the provision of non-healthcare services. This plan would also eliminate the perpetual conflict in regards to whether veterans are receiving quality care, as well as the shortage of health professionals within the current VA system, as complete integration into private healthcare would offer all veterans an opportunity to seek out the best providers to meet their healthcare needs.  

Concerning where to go from here, for current VA attorneys, staff, and providers in the private sector, much will be determined in the coming months as proposals and reform measures continue to be set forth. With the VA system in its current state, proposed remedies range all the way from complete reform to complete integration. Unfortunately, little can be determined as of the current moment, and a wait and see approach is all anyone can do for the time being. As for the veterans in need of care, change cannot wait, and Congress needs to act quickly in order to ensure proper treatment and quality care for those who served and continue to serve our country valiantly.

Combatting the Opioid Crisis

By Andy Cole, Class of 2018

Florida Governor Rick Scott announced on September 26, 2017, plans to introduce legislation that would limit opioid prescriptions to only three days unless a set of very strict standards are met. If the standards are met, then a seven day supply would be permitted. Currently, this bill has not been filed in the House or Senate, but a similar seven day limit bill has been filed.
This legislation follows President Donald Trump declaring the opioid epidemic as a national emergency and many other states and pharmaceutical retailers taking similar stances. Less than a week before Gov. Scott’s announcement, pharmaceutical retailer CVS announced that beginning next February it will limit opioid prescriptions to seven days for patients who are new to pain therapy. Additionally, the Pharmaceutical Research and Manufacturers of America has announced its support for a seven day limit on opioid prescriptions with exceptions for certain conditions such as cancer.
It is unclear if this legislation will pass as it is currently planned. If so, it will be the strictest opioid limitations in the country. Many states have passed seven day limits for first time opioid patients.
In Massachusetts, Governor Charlie Baker proposed a similar 72 hour limit on opioids for first time users. This proposal was met with much criticism from many doctors and advocacy groups who called the proposal “draconian.” The final product of the bill had overwhelming support from both parties. Baker, a Republican, signed the final bill after it passed unanimously through the Democrat controlled legislature.
Many state legislatures have found it hard to balance the need for doctors to maintain discretion and to curb a national crisis. Many doctors and organizations are calling for tighter restrictions that prevent overprescribing of opioids to patients who do not need the medication.
Dr. Steven Stanos, president of American Academy of Pain Medicine, said the academy “supports any initiative that would help limit the effects of over prescribing medications or leading to excessive unused medicines that could lead to harm to a patient or family members or their community.”
The trend of states seeking to regulate the amounts of opioids doctors are allowed to prescribe will continue to grow until the epidemic can be helmed. As many states look to begin drafting their legislative initiatives for 2018 and many politicians prepare for midterm elections, combating opioid addictions will undoubtedly be a bipartisan effort.
There is a possibility that many states will push for law similar to the law enacted in Massachusetts, which requires practitioners to take more steps to combat opioid misuse. The first point of the law is to limit opioid prescriptions to seven days for any new opioid prescription. This applies to all opiates Schedule II through Schedule VI. There are exceptions to this limit. Physicians can prescribe for more than seven days if the prescription is designed for the treatment of substance use disorder or opioid dependence, for inpatient prescriptions, for pain related to an acute medical condition, for chronic pain management, for pain associated with a cancer diagnoses, or for palliative care.
If a first time opiate prescription is being written for greater than a seven-day supply pursuant to an exception, the prescriber must document in the medical record the specific exception for which the opiate is being prescribed; and provide brief information about the actual condition or treatment that necessitates more than seven days; and indicate whether there were known and available non-opiate alternatives. The state has added an additional requirement for prescribing opioids to minors under the age of eighteen. For minors, the prescriber must also document that there was a discussion with the parent/guardian of the known risks with the specific prescription and why it is necessary for that condition/treatment. Additionally, prescribers must document in the medical record each and every time an outpatient opioid prescription is being issued to anyone.
This law moves beyond the prescription limit and also requires prescribers to check the Prescription Monitoring Program every time he or she schedules a Schedule II or III narcotic. The law also requires prescribers to complete training in pain management and addiction. In addition, it requires prescribers and patients to enter into a written pain management treatment agreement for prescriptions for extended-release long-acting opioids.
Finally, this law also places a new burden on pharmacists. If a patient requests a partially filled opioid prescription, the pharmacist must notify the prescriber within seven days. Then the prescriber is responsible for discussing with the patient the quantity of the prescription and the option to partial fill.
From an attorney’s point of view, it is important to make sure your client is aware of all of these changes and their new obligations under the law. While Tennessee has not enacted this type of law yet, combatting the opioid crisis in the state will be high on the legislative agenda for the next few years. A piece of legislation similar to this is bound to be at least be discussed by lawmakers as a potential route to take. At the moment it is difficult to tell how difficult it will be to monitor providers who may abuse the system.

CMS Modernizes Conditions of Participation for Home Health Agencies

By Will Blackford, Class of 2017

On January 13, 2017, the Centers for Medicare and Medicaid Services (“CMS”) published in the Federal Register its Final Rule pertaining to the Conditions of Participation (“CoPs”) for home health agencies (“HHAs”). The rule represents the first modernization in over two decades of the fundamental requirements for HHA participation in Medicare and Medicaid, despite efforts in 1997 to revise the entire set of HHA CoPs. With enforcement of the new provisions beginning July 13, 2017, CMS has given HHAs a six-month window for adapting their policies, procedures, and practices to comply with the new standards.

The most significant changes under the Final Rule revolve around four categories:

  • Patient Rights. CMS added an expansive CoP that sets forth the specific rights that HHAs owe each patient and the steps they must take to protect such rights.
  • Care Planning. The final rule updates the comprehensive patient assessment requirement to focus on all aspects of patient wellbeing. It also requires that a HHA provide its patients with a written copy of the plan of care and utilize an integrated communication system to identify and coordinate care between the HHA and the patient’s physicians.
  • Quality Assessment and Performance Improvement. To ensure continual evaluation and improvement of care for patients, CMS will now require that HHAs initiate a data-driven, agency-wide quality assessment and performance improvement (QAPI) program that is capable of measuring improvement in indicators that are linked to improvement in patient outcomes, safety and care quality.
  • Infection and Prevention Control. The new infection prevention and control requirement that focuses on the use of standard infection control practices, and patient/caregiver education and teaching.

In addition to the modified care standards, CMS also refined the definition of “Representative” to expressly distinguish between a patient-selected representative and a legal representative with legal decision-making authority under the law. There are numerous updates throughout the Final Rule that are shaped by this two-tiered approach to representation.

To meet these new requirements, HHAs need to familiarize themselves with the Final Rule and analyze their current policies and procedures to formulate a plan for tackling implementation of these significant changes. Agencies that fail to comply with any of the new CoPs by the July 13, 2017 deadline are at risk of penalties ranging from imposition of sanctions for marginal issues, to program termination for major infractions.

Increased Price Transparency

By Zachary Gureasko, Class of 2017

On President Donald Trump’s website, one of his objectives is: “Require price transparency from all healthcare providers, especially doctors and healthcare organizations like clinics and hospitals. Individuals should be able to shop to find the best prices for procedures, exams or any other medical-related procedure.” President Trump believes that by allowing the individual to “shop around” for the best prices, competition among providers will increase and they will be forced to lower costs.

There are some organizations that already attempt to use existing data to provide consumers with cost estimates that they can use to make cost-informed choices. One such organization is FAIR Health, which is an independent, non-profit corporation whose mission is to promote cost transparency in healthcare costs. Using the website highlights some discrepancies in costs that would be helpful to consumers. For example, a procedure done in Nashville proper priced at $5,000 could potentially cost as low as half of that amount if it was performed more than 45 miles away from Nashville.

The health care industry has long been viewed as “hiding the ball,” so to speak, when it comes to the full prices of their services. Generally, the only information they offer before the patient elects to undergo a procedure or treatment is the immediate cost, such as a co-payment or deductible. Arguments have been made, even prior to President Trump’s call for increased transparency, for the provision of total costs to the consumer. The justification for this is that consumers with more information will be able to comparison shop and obtain the desired care for a relatively affordable price.

There are issues with price transparency from both provider and consumer perspectives. There are impediments to price reporting, such as contractual provisions preventing health plans from negotiating their rates with providers, as well as the indication that encouraging patients to be more price-conscious could have negative impacts on low-income consumers due to cost-shifting. Additionally, there is currently no standard structure for reporting prices, and the interplay between health care providers, insurance companies, and government agencies almost require some sort of formatted structure to be in place to enable providers to adequately report in a way that would achieve the intended result of these price transparency efforts.

Several studies have also shown that price transparency initiatives, such as requiring hospitals to publish the prices of their procedures and treatments up-front, do not truly lead to changes in either consumer behavior or pricing. This result is potentially attributable to a perceived correlation between high cost and high value, one that is not necessarily accurate in the health care industry as it might be in other industries. Another wrinkle in the fold from a consumer perspective is the notion that consumers will use price transparency tools in their decision-making. However, many consumers are unaware that such tools exist; moreover, even if they are aware of the tools’ existence, research has shown that this has little to no bearing on the consumers’ ultimate decisions or determinations.

As a final consideration, although efforts to increase price transparency are still in their early stages (and thus there is not enough data to form a fully conclusive study on their impact), not all health care services are amenable to “shopping around.” For instance, a person in an emergent situation will not be on his or her smartphone comparing the prices of different ERs. The person will assuredly utilize the nearest hospital with an emergency room. Emergency room services comprise a fairly substantial portion of health care costs. Therefore, it remains to be seen whether increased price transparency will truly increase competition or lower health care costs for consumers.