FileFax, Inc. (“FileFax”) is a Business Associate of the Center for Children’s Digestive Health (“Center”). The Center is a small, for-profit healthcare provider with a subspecialty practice in pediatrics. Since 2003, FileFax stored inactive paper medical records that contained protected health…
On or about December 5, 2011, a hacker accessed email accounts of employees of Metro Community Provider Network (“Metro”), a federally-qualified health center, and acquired 3,200 individuals’ electronic protected health information (“ePHI”) via a phishing incident[1]. Accordingly, on January 27,…
A frequent question from physicians is: What do I do if I have a patient who does not pay his or her bill? And for those physicians who are thinking ahead: What can I do to avoid having a patient who does not pay his or her bill? This article briefly addresses strategies physicians may try to…
For the first time since its September 2010 introduction, CMS’ Self-Referral Disclosure Protocol (“SRDP”) is undergoing sweeping changes. Beginning June 1, 2017, parties using SRDP to voluntarily disclose actual or potential violations of the Stark law will use specifically-designed forms to submit…
In January 2017, we reported on CMS’ recent publication of a comprehensive final rule revising the conditions of participation (“COPs”) that home health agencies (“HHAs”) must abide by in order to participate in Medicare and Medicaid programs. This Final Rule was published on January 13, 2017 and…
In order to maintain enrollment in Medicare, suppliers and providers must comply with Medicare program mandates, including the “enrollment requirements” detailed in Medicare’s conditions for payment regulations.[1] The enrollment requirements obligate a provider to submit – and keep current – a…
The Indiana Supreme Court recently held in Charles McKeen, M.D. v. Billy Turner that a plaintiff’s theory of negligence at trial need not be identical to the plaintiff’s theory in his or her submission to the Medical Review Panel (“Panel”), so long as evidence relating to the theories of…
Do you have a corporate policy that governs your "protected communications" which may be sent or received through the use of mobile devices? If yes, does your Policy address each of the following "Top 10" requirements? Here's a checklist to assist you in reviewing, updating (and communicating)…
The United States Department of Justice’s (“DOJ”) Fraud Section recently published guidelines (“Guidelines”) it will use when determining whether to bring charges against health care entities or individuals. While the Guidelines in no way represent an absolute defense against potential federal or…
On March 10, 2017 the Department of Health and Human Services, Office of Inspector General (“OIG”) published Advisory Opinion No. 17-01 regarding a hospital system’s proposal to provide free or reduced-cost lodging and meals to certain financially needy patients (“Proposed Arrangement”). The OIG…
President Trump’s March 16 “America First: A Budget Blueprint to Make America Great Again,” proposes to cut $15.1 billion in Department of Health and Human Services (“HHS”) spending, representing a nearly 18% reduction in annual spending.[1] The cuts target many entrenched programs and grants,…
HIPAA, as amended by HITECH, imposes significant requirements on those persons or entities who qualify as a business associate (BA) as a result of their access to protected health information (PHI) in the performance of services on behalf of a covered entity (CE).
For example, a BA could be a third…
