OCR shows no signs of slowing HIPAA enforcement

The HHS Office for Civil Rights (OCR) is on pace to have another record-breaking year for enforcement actions against covered entities (CEs) and business associates (BAs) accused of Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) violations. As of February 13, 2017, it had already entered into two resolution agreements with CEs and imposed civil monetary penalties (CMPs) on another for only the third time in its history. Prior to 2016, the OCR had not entered into more than six resolution agreements with CEs or BAs in single year. As of December 2016, the OCR had entered into twice that number. As of February 13, 2016, the OCR had just imposed its second CMP, but had not yet entered into any resolution agreements.

The agency kicked off the year by entering into a $475,000 resolution agreement with Presence Health. Unlike past agreements that settled potential violations of the HIPAA Privacy and Security Rules, the Present Health resolution represented the OCR’s first agreement to resolve potential violations of the HIPAA Breach Notification Rule. Presence failed to notify the OCR, affected individuals, and the media that paper-based operating schedules containing the protected health information (PHI) of 836 individuals had gone missing in the statutorily-required 60-day timeline for breaches affecting more than 500 individuals; instead, it waited more than 100 days.

Eight days later, the OCR announced a $2.2 million resolution agreement with MAPFRE Life Insurance Company of Puerto Rico for Security Rule violations affecting the data of 2,209 individuals. The OCR determined that MAPFRE failed to perform a risk analysis, implement risk management plans, and encrypt data stored in removable storage media led to a breach caused when a thief stole a USB data storage device containing electronic PHI (ePHI).

In early February, the OCR announced that it had issued a final determination and imposed a $3.2 million CMP on Children’s Medical Center of Dallas due to a pattern of noncompliance with the Security rule. Children’s suffered a breach in 2010 due to the loss of an unencrypted, non-password-protected BlackBerry device containing the ePHI of 3,800 individuals.  It suffered a second breach in 2013; despite the first breach, Children’s had failed to encrypt a laptop containing the ePHI of 2,462 individuals that was later stolen. The agency determined that the CMP was merited based on Children’s failure to implement risk management plans, in contravention of prior recommendations to do so, and its failure to encrypt mobile devices, storage media, and workstations. The OCR also imposed CMPs against Lincare, Inc., a home health company, in 2016 and against Cignet Health in Prince George’s County, Maryland, in 2011.

The agency stepped up enforcement efforts in 2016, in part due to negative reports regarding its performance from the HHS OIG and the Government Accountability Office (GAO). It began the Phase 2 audit process, targeting both CEs and BAs, and announced its intention to allocate resources for the first time to investigate complaints of breaches affecting 500 individuals or fewer. It appears geared to continue, if not ramp up, its enforcement efforts, but the impact of newly appointed HHS Secretary Thomas E. Price, M.D.–who will appoint a new OCR director–remains to be seen. Price, a physician and former Congressional representative has historically opposed government regulatory activity of physicians. However, Adam H. Greene, Partner at Davis Wright Tremaine, suggests that, although Price the physician may dislike HIPAA, “his personal views will [not] necessarily lead to a significant change in enforcement.”

 

KFF offers facts about Medicare spending

As the new Administration and Congress consider changes to federal health care programs, including Medicare, a Kaiser Family Foundation (KFF) issue brief offers spending facts about the program, which currently accounts for roughly $1 of every $7 in federal spending. The brief indicated that repealing the Patient Protection and Affordable Care Act (ACA) (P.L. 111-148) would increase spending and worsen the program’s long-term financial outlook, but noted that Medicare faces challenges apart from ACA repeal, including higher health costs and an aging population.

Although the program faces financial challenges, KFF noted that Medicare “isn’t going broke.” The Hospital Insurance Trust Fund, which pays for Part A benefits, primarily through payroll taxes, is expected to pay for full insurance benefits until 2028, at which point it will be able to pay for 87 percent of hospital benefits. Part B physician services and Part D drug benefits, however, are paid for through a combination of general revenues and beneficiary premiums and are set only a year in advance. As a result, they are not subject to a funding shortfall, but higher projected spending would increase the amount of general revenue funding and beneficiary premiums required to cover costs. Spending on Part benefits is expected to rise faster than spending on benefits paid for under Parts A and B, with per-capita spending expected to rise 5.8 percent for Part D between 2015 and 2025, compared to 3.2 percent for Part A and 4.6 percent for Part B.

The aging U.S. population is resulting in higher Medicare spending. For example, the number of people over age 65 is expected to double from 2010 to 2050 from 40 million to 84 million, while the number of people over 80—who account for a disproportionate share of Medicare spending—is expected to nearly triple, from 11 million to 31 million. Medicare spending accounted for 15 percent of the federal budget in 2016, and is expected to increase to 18 percent of the federal budget, accounting for $1 in every $6 spent, by 2027. Average annual growth in spending is expected to increase more quickly between 2015 and 2025—at a rate of 7.1 percent—than it did immediately after the ACA was enacted between 2010 and 2015, when it increased at a rate of only 4.4 percent.

ACA provisions reducing payments to providers and Medicare Advantage (Part C) plans reduced overall spending growth from 9 percent between 2000 and 2010 to 4.4 percent between 2010 and 2015. KFF cited a Congressional Budget Office (CBO) report and stated that ACA repeal would add $802 billion to Medicare spending through 2025; KFF opined that repeal would lead to higher deductibles, premiums, and cost sharing for beneficiaries and would hasten the insolvency of the Hospital Insurance Trust Fund (see Repealing the Affordable Care Act—an unaffordable idea?, Health Law Daily, June 24, 2015). With the ACA in place, KFF reports that net Medicare spending is projected to grow from 3.2 percent of the gross domestic product (GDP) in 2016 to 5.7 percent of the GDP in 2046; prior to the ACA, net Medicare spending was projected to account for 8.5 percent of the GDP in 2046.

DOJ comes for executive in Tenet fraud case

A former senior executive of Tenet Healthcare Corporation is facing charges for his alleged role in a fraud scheme that resulted in Tenet and its subsidiaries billing Medicaid programs more than $400 million over a thirteen-year period. The Department of Justice (DOJ) charged the former senior vice president of operations for Tenet’s Southern States Region and former CEO of North Fulton Medical Center with mail, health care, and major fraud. The executive pleaded not guilty to his alleged role in the scheme, which involved the payment of bribes to prenatal clinics in exchange for referrals of undocumented, pregnant Medicaid patients to Tenet Health System Medical, Inc. (THSM) hospitals, including North Fulton Medical, Atlanta Medical Center, Inc., Spalding Regional Medical Center, Inc., and Hilton Head Hospital.

Tenet, Atlanta Medical, and North Fulton Medical entered into a $513 million settlement in October 2016 to resolve criminal and civil charges; the settlement included the hospitals’ agreement to forfeit more than $145 million in Medicaid payments for unlawful referrals. Atlanta Medical and North Fulton Medical allegedly participated in the scheme while subject to a 2006 corporate integrity agreement (CIA) with the HHS Office of Inspector General (OIG). THSM and its subsidiaries entered into a three-year non-prosecution agreement, as well (see Corporations, beware: Tenet Healthcare to pay $513M to settle kickback charges, October 4, 2016).

In addition to the general scheme involving the payment of bribes and kickbacks from 2000 through 2013, Tenet operated an affiliated billing center than allegedly assisted in processing Medicaid billings for payment from 2007 through 2013. The DOJ alleges that the executive “took affirmative steps to conceal the scheme,” by working around internal accounting controls; falsifying books, records, and reports; and falsely certifying to the OIG that Tenet was complying with the terms of the CIA and Medicare and Medicaid requirements while knowing that Tenet was paying for illegal referrals.

Innovative ways for Medicaid to promote supportive housing

Federal law prohibits federal matching of state Medicaid room-and-board spending, aside from nursing facility services. However, there are a variety of ways in which Medicaid can contribute to “integrated strategies” to bolster “supportive housing,” or affordable housing combined with support services to encourage health and recovery following living transitions resulting from homelessness, hospitalization, incarceration, or aging out of foster care. A Kaiser Family Foundation (KFF) report analyzed three innovative programs in action today.

A 2015 Center for Medicaid and CHIP Services (CMCS) informational bulleting outlined three housing-related activities covered by Medicaid: individual housing transition services from institutions to community-based housing; individual housing and tenancy sustaining services; and state-level housing services that aid in identifying and securing housing resources, as well as services available via section 1915(b) and (c) waivers, section 1115 demonstration waivers, targeted case management services, and demonstrations established through the Patient Protection and Affordable Care Act (ACA) (P.L. 111-148) (see Federal funding available for some Medicaid housing related activities, Health Law Daily, June 29, 2015). KFF suggested that managed care plan initiatives, health homes established by the ACA, State Innovation Models, and accountable care organizations (ACOs) are other vehicles linking Medicaid with supportive housing.

The report analyzed three models of integration. The City of Philadelphia, also a county, established a single-payer system for public behavioral health care of as permitted by law; 85 percent of the population served is Medicaid-eligible. Medicaid provides a source of payment for health services received by eligible individuals house under the Permanent Supportive Housing (PSH) initiative through three separate programs that offer: services to those experiencing chronic homelessness and severe psychiatric disorders; residential substance use disorder treatment to individuals with a history of chronic homelessness and long-term addiction; and temporary shelter during inclement weather while addressing substance use problems. Louisiana used its Medicaid state plan authority to cover tenancy support services to support PSH, which targets low-income, disabled individuals, most of whom are Medicaid beneficiaries. Mercy Maricopa Integrated Care, a Phoenix, Arizona managed care organization (MCO), provides permanent supportive housing services to adults with serious mental illness (SMI), most of whom are Medicaid beneficiaries.

The KFF authors determined that the three models demonstrate that efforts to integrate Medicaid with supportive housing “can be tailored to align with specific policy goals,” such as the reduction of chronic homelessness or the reduction of unnecessary institutionalization of the mentally ill. Integration efforts can improve patterns of health care use and reduce Medicaid costs. However, they face “operational challenges,” such as differing housing administration and Medicaid structures, complexity and fragmentation within systems, and multiple funding streams. Success can only be achieved through strong leaders entering into committed partnerships.