Federal Court Denies HCQIA Immunity for Failure to Provide Due Process

In Osuagwu v. Gila Regional Medical Center (2012 U.S. LEXIS U3225), the United States District Court for the District of New Mexico denied HCQIA immunity to the hospital and the individual defendants on the basis that the hospital failed to satisfy the due process requirements of the Healthcare Quality Improvement Act (HCQIA). Since the denial of immunity is a relatively rare occasion, I thought it meaningful to point out some key findings:

• The Court found that there was no reasonable effort to obtain the facts
• The Court found that the hearing process itself was tainted because a physician who acted as the primary accuser and investigator was also a member of the panel
• The Court found that Dr. Osuagwa was denied the opportunity to cross-examine witnesses when statements of physicians treated as “experts” for purposes of the investigation were not produced as witnesses
• Finally, and perhaps most meaningfully, the Court found that the action could not have been taken in the reasonable belief that the action was warranted by the facts with all of these procedural deficiencies

With respect to the failure to make a reasonable effort to obtain the facts, the Court found that Dr. Osuagwa was not given the chance to present his defense to the Investigating Committee in violation of the bylaws. The Court had no problem with summary suspensions prior to an investigation, and most medical staff bylaws provide for that procedure, but thereafter, the Court found that the hospital did not make an effort to get the doctor’s side of the story before taking further action.

There were a number of factors relied upon the Court to come to this conclusion, but I think the importance of this case is that the Court recognized the need to get both sides of the story in the investigatory process, before the hearing.

The Court also acknowledged the hearing deficiencies of allowing one of the key participants in the investigation to serve on the hearing panel and not providing the physician the opportunity to cross-examine witnesses.

The witness issue is also an involving development in medical staff hearings. The HCQIA proceedings and most bylaws relax the rules of evidence and allow hearsay. Some believe that this allowance of hearsay allows the statements, whether written or oral, of other physicians who have opined regarding the quality of care to be admitted into evidence, regardless of the objections. 

Since the target physician rarely has any subpoena power in medical staff hearings, they typically have no means of attacking this testimony, other than presenting their own different opinions. If this position is universally adopted, the lack of subpoena power will not be so much of an issue because the use of those opinions without providing the opportunity of cross-examination will provide a basis for challenging the immunity, proceeding to a real court, and then using the subpoena power to cross-examine those witnesses.

An agreement between Highmark and UPMC is expected to be announced at 12:30 p.m. today by Gov. Tom Corbett's office today, sources have told the Post-Gazette.

Details of the agreement were not immediately known and none of the parties involved would comment this morning.

Legislators and others said today that a three-year pact, until 2015, would allow Highmark subscribers to continue to pay in-network rates for services provided by UPMC hospitals and doctors.

Sen. Jim Ferlo, D-Highland Park, said that Highmark representatives were in Harrisburg on Tuesday, including vice president Deborah L. Rice and executive vice president Dan Onorato.

Sen. Ferlo said that Sen. Don White, R-Indiana, chairman of the banking and insurance committee, met with Mr. Corbett yesterday to talk about "trying to pound UPMC and Highmark into some kind of accommodation."

Sources said those meetings came after the governor's office mediated meetings last week between Highmark and UPMC.

A source said that the new contract will involve new, higher reimbursement rates for Highmark to pay, which is said to bring them more in line with the rates the commercial insurers are now paying.

UPMC has pacts with national insurers and did not want to undercut those by allowing Highmark to pay rates netogiated in 2002.

"It's certainly important for Western Pennsylvania," said state Rep. Tony DeLuca, D-Penn Hills, minority chair of the Insurance Committee. "The fact is, we're talking about Highmark subscribers being able to use the 20 facilities and 3,000 doctors which most of the people are worried about. They also, hopefully, within the three years, can get West Penn Allegheny on their feet and save 11,000 jobs. That's good news for the area, it's good news for the workers. It's good news for the Highmark subscribers."

The agreement comes little more than a year after negotiations broke down between the two health giants, with UPMC saying it would not negotiate with Highmark once it became known that the insurer intended to buy the financially-ailing West Penn Allegheny Health System and compete with UPMC in the health provider market.

Highmark said UPMC was asking for a 40 percent increase in reimbursement payments, but continued to say it wanted to continue negotiations.

Early in the dispute, UPMC signed contracts with four national insurers -- Aetna, United Healthcare, Cigna and HealthAmerica -- and encouraged Highmark subscribers to consider changing their insurance if they wanted to keep their doctor.

Those contracts reportedly contain more favorable reimbursement rates than UPMC had with Highmark, which may have put pressure on Highmark to soften its position.

For months the two sides could not even agree when terms of the current 10-year contract expired.

UPMC maintained the one-year run out period, which would go to June 30, 2013, applied only to hospital services but not services provided by UPMC physicians.

In December, Gov. Corbett's office brokered an agreement that assured Highmark subscribers in-network access to UPMC physicians and hospitals through June 2013.

Highmark, meanwhile, has been rebuilding the West Penn Allegheny system, reopening the West Penn Hospital emergency department in Bloomfield and, in January, announcing a $20 million upgrade to the Forbes Regional Hospital campus in Monroeville.

Ratcheting up the stakes in the eastern suburbs, Highmark officials said in February that they would not sign a one-year agreement that would include in its network UPMC East, scheduled to open this summer less than two miles from Forbes Regional.

The document can be accessed here:

https://www.federalregister.gov/articles/2012/04/18/2012-9331/medicare-and-medicaid-programs-electronic-health-record-incentive-program-stage-2-corrections

412.594.3915

The HHS Office for Civil Rights (OCR) received a report that a physician practice, Phoenix Cardiac Surgery (PCS), was posting clinical and surgical appointments for their patients on an Internet-based calendar that was publicly accessible.  OCR investigated and found that PCS  had implemented few policies and procedures to comply with the HIPAA Privacy and Security Rules, and had limited safeguards in place to protect patients’ electronic protected health information (ePHI). 

Phoenix Cardiac Surgery, P.C., of Phoenix and Prescott, Arizona, has agreed to pay the U.S. Department of Health and Human Services (HHS) a $100,000 settlement and take corrective action to implement policies and procedures to safeguard to protected health information of its patients. 

The settlement with the physician practice follows an extensive investigation by the HHS Office for Civil Rights (OCR) for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.

OCR’s investigation revealed the following issues, among others:

·        Failed to implement adequate policies and procedures to appropriately safeguard patient information; 

·        Failed to document that it trained any employees on its policies and procedures on the Privacy and Security Rules;

·        Failed to identify a security official and conduct a risk analysis; and

·        Failed to obtain business associate agreements with Internet-based email and calendar services where the provision of the service included storage of and access to its ePHI.

For more information, please visit the following link:

Resolution Agreement and Corrective Action Plan

Although this case is just in its early stages, it is interesting to note that federal court is recognizing the old theory that hospitals which receive governmental funding may be quasi public institutions and that their actions must therefore satisfy state constitutional due process requirements.

Although courts routinely allow hospitals to close departments and enter into exclusive contracting agreements for various departments or services within hospitals, this case recognizes that doing so while other physicians maintain existing medical staff membership and clinical privileges may raise state constitutional due process issues.

It is also noteworthy that this opinion does not mention the contractual issues associated with barring physicians from using existing clinical privileges on the basis that medical staff bylaws constitute contracts between the hospital and the various members of the medical staff. That is not to say this contractual issue will not be raised at some later point in time, since the lawsuit also asserts claims for unfair deceptive anticompetitive and illegal trade practices, claims based upon termination of physician’s privileges, claims for violations of the Federal Anti-Kickback Statute along the lines of economic credentialing, and finally claims based upon the hospital’s alleged breach of a corporate integrity agreement, the terms of which are not disclosed or discussed in the opinion.

Martindale-Hubbell Peer Review Ratings are driven by the confidential opinions of lawyers and members of the judiciary who provide reviews of lawyers about whom they have professional knowledge.

Tucker Arensberg is a 78-attorney law firm headquartered in Pittsburgh with an office in Harrisburg. The firm concentrates in general business law practice, banking, insolvency and creditors' rights, estates and trusts, health care, oil and gas rights, litigation, mergers and acquisitions, technology and intellectual property, environmental, labor and employment, real estate, workers' compensation and school and municipal law. For more information on the firm, please visit www.tuckerlaw.com

Special Alert

CMS proposes one-year delay for ICD-10

Today the Department of Health and Human Services (HHS) published a rule that proposes to delay ICD-10 one year from Oct. 2013 to Oct. 2014. The one-year delay of ICD-10 is in response to continued concerns from MGMA and others that adoption of the new code sets will prove extremely challenging to physician practices. In its most recent communication to HHS, MGMA called on the government to reconsider its ICD-10 implementation process. Despite the additional time, MGMA contends that failure to make appropriate changes will result in wide-spread disruption of the healthcare system.

The rule also includes a proposal to implement a national health plan identifier, required under the Patient Protection and Affordable Care Act of 2010 (ACA). MGMA has long supported adoption of a health plan identifier as a critical step toward administrative simplification. HHS estimates this new identifier will save providers and plans as much as $4.6 billion over 10 years.

MGMA Government Affairs will submit formal comment on this proposal. For additional ICD-10 and ACA information, visit mgma.com/policy/healthit.

Contributed by Lee Kim, Esq.

412.594.3915

Representatives from the Utah Department of Health (UDOH) and the Utah Department of Technology Services (DTS) announced details of a data breach by hackers involving 24,000 Medicaid claims.  Information which may have been compromised included names, addresses, social security numbers, birth dates, and procedure codes according to the UDOH.

According to the UDOH blog:

"DTS had recently moved the claims records to a new server, and hackers believed to be operating out of Eastern Europe were able to circumvent the server’s multi-layered security system. The affected server has been shut down, and new security measures have since been implemented. The agency takes such attacks by thieves seriously and is cooperating with law enforcement in a criminal investigation."

For more information:

http://udohnews.blogspot.com/2012/04/state-agencies-investigating-data.html

412.594.3915

In a unanimous decision, the US Supreme Court held that the claims in Mayo Collaborative Services v. Prometheus Laboratories, Inc. (Docket No. 10-1150) effectively claim a law of nature and are therefore not patent eligible under 35 U.S.C. 101.  The claims in the Mayo decision were directed to a process of medical treatment, specifically, a method of optimizing therapeutic efficacy for treatment of an immune-mediated gastrointestinal disorder (as recited in Claim 1).  Because the laws of nature were recited by the patent claims (i.e., the relationships between concentrations of certain metabolites in the blood and the likelihood that a thiopurine drug dosage would prove ineffective or cause harm) are not themselves patent eligible. 

The claims inform a relevant audience about certain laws of nature and any additional steps consisted of well-understood, routine, conventional activity already engaged in by the scientific community.  Those steps, when viewed as a whole, added nothing significant beyond the sum of their parts taken separately.  To transform an unpatentable law of nature into a patent-eligible application of such a law, one must do more than simply state a the law of nature while adding the words "apply it."  Appending conventional steps, specified at a high level of generality, to the laws of nature, natural phenomena, and abstract ideas cannot make those laws, phenomena, and ideas patent-eligible.

More complete examination guidelines will be developed by the United States Patent and Trademark Office, but, the USPTO has issued a memorandum which states that examiners must continue to ensure that claims, particularly process claims are not directed to an exception to eligibility which claim the amounts to a monopoly on the law of nature, natural phenomenon, or the abstract idea itself.  A claim that includes an exception should include other elements or combination of elements such that the claimed product or process amounts to significantly more than a law of nature, a natural phenomenon, or an abstract idea with conventional steps specified at a high level of generality appended thereto.

Link to the US Supreme Court Opinion: http://www.supremecourt.gov/opinions/11pdf/10-1150.pdf

Link to the USPTO guidance in view of the Mayo decision: http://articles.law360.s3.amazonaws.com/0322000/322575/Mayo%20Memo.pdf

412.594.3915

Previously, we commented on the ONC Mobile Devices Roundtable on March 16, 2012.  Now, the video and other materials are available online.  These materials may be accessed via the following link: http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__mobile_devices_roundtable/3815?q=mobiledevicesroundtable#archive.  (ONC has a Youtube video channel.  This link leads to that for the video content.)

OEI-09-09-00380

WHY WE DID THIS STUDY

Independent Diagnostic Testing Facilities (IDTF), a type of Medicare provider, offer diagnostic services and are independent of physicians’ offices or hospitals. IDTF services have historically been vulnerable to abuse. In 1997, the Office of Inspector General found that 20 percent of IDTFs were not at the locations on file with the Centers for Medicare & Medicaid Services (CMS). In 2007, CMS reported that in Los Angeles, it had denied $163 million in IDTF charges and terminated Medicare billing privileges for 83 IDTFs.

HOW WE DID THIS STUDY

To describe IDTF billing patterns and identify questionable IDTF claims, we conducted a four-part review of such claims among geographic areas—specifically, Core Based Statistical Areas (CBSA). Based on an analysis of all Medicare Part B IDTF claims from 2009, we

(1) identified the top 20 CBSAs with the highest average Medicare payments per beneficiary for IDTF services, terming these “high-utilization CBSAs”; (2) compared IDTF billing patterns in high-utilization CBSAs to such billing patterns in all other CBSAs nationally; (3) identified IDTF claims with questionable characteristics; and (4) compared the prevalence of IDTF claims with questionable characteristics in high-utilization CBSAs to the prevalence of such claims in all other CBSAs.

WHAT WE FOUND

Twenty high-utilization CBSAs accounted for 10.5 percent of Medicare Part B payments for IDTF services despite having only 2.2 percent of the total population of beneficiaries. Almost four times more beneficiaries in high-utilization CBSAs received IDTF services than beneficiaries in all other CBSAs. Nine percent of the IDTFs that served beneficiaries in high-utilization CBSAs provided 90.1 percent of IDTF services. Additionally, high-utilization CBSAs had twice as many claims with at least two questionable characteristics as all other CBSAs.

WHAT WE RECOMMEND

We recommend that CMS: (1) monitor IDTF claims for questionable characteristics, (2) take appropriate action when IDTFs submit a high number of questionable claims, and (3) assess whether to impose a temporary moratorium on new IDTF enrollments in CBSAs with high concentrations of IDTFs. CMS concurred with all of our recommendations.

412.594.3915

The ONC Health IT Mobile Devices roundtable is being aired today, on March 16, 2012, by way of live video webcast at http://www.hhs.gov/live. 

Here are my thoughts upon hearing the content (which is certainly instructive and helpful) (and this was submitted to ONC Health IT for public comment):

1. By way of background, I am intellectual property and health information technology law attorney at Tucker Arensberg, P.C. in Pittsburgh, PA.  I am also a former IT professional (including in health IT).  While encryption is an addressable implementation specification, encryption plug-ins and stand-alone programs have come a long way in terms of end user usability and feasibility of implementation.  Sensitive data should be encrypted (including protected health information), whether data at rest and data in motion, including without limitation e-mail, files, backup media, and the like. 

2. Not only should encryption be used, but a non-ascertainable and non-guessable private key or password should be used.  Private keys or passwords should not be easily discoverable (such as taped to a keyboard or monitor) and should not be vendor defaults.

3. When storage media and devices which may contain protected health information are at the end of their life cycle, they should be properly disposed of.  Any storage media, whether stand-alone or embedded within a device, should be purged or otherwise eliminated such that such information cannot be reconstructed by an unauthorized person.

4. Access control also needs to get better within healthcare facilities.  HIPAA audit trails should be accurate.  The use of mobile and other computing devices should be increased to ensure that there is no "sharing" of logins or other authentication means.

5. As to mobile devices, the software which resides on them should respect the encryption and other security controls, as opposed to being "rogue" applications which may not. 

6. There is an increasing threat of heuristic malware and hence a need for anti-malware solutions which not only take into account malware signatures, but also examine the heuristics of malware (for malware code which cannot be detected with traditional engines which scan for signatures or for which a signature is not yet known).  There needs to be a solution for mobile devices and  standard computing devices.

7. Remote wipe of mobile devices should be used whenever possible in case a device is lost or stolen.
..

All covered entities and business associates should review their HIPAA Security Rule policies and ensure that they are complying with the Rule to the fullest extent possible.  As stated in our previous blog entries, HHS, through its OCR enforcement arm, is starting to enforce breaches in a very significant way.

412.594.3915

The HITECH Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to HHS and the media.  Smaller breaches affecting less than 500 individuals must be reported to the secretary on an annual basis.  The HHS Office for Civil Rights enforces the HIPAA Privacy and Security Rules.

The enforcement action is the first resulting from a breach report required by the HITECH Act Breach Notification Rule.  The investigation was a result of Blue Cross Blue Shield of Tennessee (BCBST) reporting to HHS a notice that fifty-seven unencrypted hard drives were stolen from a leased facility in Tennessee, which contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers.

BCBST has agreed to pay the U.S. Department of Health and Human Services (HHS) $1,500,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.  BCBST has agreed to a corrective action plan to address gaps in BCBST's HIPAA compliance program.  BCBST has agreed to review, revise, and maintain its Privacy and Security Rule policies and procedures, to conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA, and to perform monitor reviews to ensure BCBST's compliance with the corrective action plan.

OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. The investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls.  Administrative and physical safeguards, in addition to technical safeguards, are required by the HIPAA Security Rule.

I have attached the ranking of the Pittsburgh community and was somewhat surprised to see it ranking in the third cortile with an overall rank of 156 out of 306. 

I have attached the ranking of the Pittsburgh community and was somewhat surprised to see it ranking in the third cortile with an overall rank of 156 out of 306. 

A physician took a job with a health clinic with the understanding that he must work at the clinic for 4-6 years to become a board certified radiologist. The offer letter stated that the physician “will be granted 4-6 years from the date of employment to become board certified” and that if he did not, “continued employment . . . will need to be reevaluated. The physician also signed a “Practice Agreement” in which he acknowledged that his employment “may be terminated at any time by either party for any or no reason.” In order to obtain his work visa for the position, the physician and sponsoring health clinic had to represent that the physician “had at least a three year employment commitment” in the U.S. Based on these representations, the physician was granted the visa in 2007. In May 2008, the physician’s employment was terminated and he filed suit against the health clinic for breach of contract. On appeal, the Third Circuit upheld the lower court’s dismissal of the case.

Pennsylvania law presumes employment is at-will and to overcome such a presumption, an individual must show clear and precise evidence of the parties’ intention to form an employment contract for a definite length of time. In this case, the court held that the language in the offer letter concerning employment for 4-6 years was “too vague to establish an express contract for a definite period” and such language simply clarified the board certification requirement. The court also held that the absence of an at-will disclaimer in the offer letter does not suggest a definite period. Further, the court found that the inclusion of language that an employer will discharge an employee only for “just cause” does not establish an express or implied contract that such employee can only be terminated for that just cause. Finally, the court noted that the issuance of a work visa does not guarantee employment for its entire validity period. In fact, the Immigration & Nationality Act permits employers to terminate employment prior to the expiration of a workers visa. Therefore, there is no implied right of employment for the full term of an approved visa.

Based upon the foregoing, employment at-will is still a viable concept in Pennsylvania and an individual must be able to provide clear and precise evidence to over come this concept.

Written by Emilie Ridge, Esquire

·       How to Use the Exclusions Database

·       How to Report Fraud to the OIG

·       OIG’s Self-Disclosure Protocol

·       Tips for Implementing an Effective Compliance Program

·       Compliance Program Basics

·       Physician Self-Referral Law

·       False Claims Act

·       Federal Anti-Kickback Statute

The denial of the attorneys’ fees is basically based upon laches and estoppel theory, because the hospital waited six years before pleading immunity under HCQIA. The Court concluded that although the hospital was the prevailing party, all of the intervening motions and attorneys’ fees could have been avoided had the hospital pleaded immunity at the inception of the case. The Court reversed the lower Court award overturning fees in favor of the hospital of approximately $500,000. 

HCQIA § 11112 provides immunity to hospitals that provide due process rights to physicians, and recommends the procedures to be followed. However, subsection (a)(3) allows hospitals to provide such due process as is fair under the circumstances. 

In the Fox v. Good Samaritan Hospital LP circumstances, Dr. Fox was terminated because he refused to follow a policy adopted by the hospital for call coverage, and admitted that he refused to follow the policy because he thought it was inappropriate and unnecessary. 

Given there was no dispute regarding the facts, the hospital did not provide the typical hearing and appeal mechanism, even though that process existed in the bylaws. Instead, the hospital offered the physician, and Dr. Fox accepted, the opportunity to present his arguments to the Executive Committee and to the Board of Trustees, both of which rejected Dr. Fox’s request to change the policy.

The Court concluded that this ad hoc due process was satisfactory under the HCQIA exception. 

Contributed by: Lee Kim, Esq.

412.594.3915

CMS has released the notice of proposed rulemaking for meaningful use stage 2 and has provided an overview fact sheet outlining the differences from stage 1.

Link to NPRM:

http://www.ofr.gov/OFRUpload/OFRData/2012-04443_PI.pdf

Link to fact sheet:

https://www.cms.gov/apps/media/press/factsheet.asp?Counter=4286&intNumPerPage=10&checkDate=&checkKey=&srchType=1&numDays=3500&srchOpt=0&srchData=&keywordType=All&chkNewsType=6&intPage=&showAll=&pYear=&year=&desc=&cboOrder=date