Hospitals pay nearly $1 million over ABC television documentary

After allegations that the privacy of patients was compromised by inviting film crews for an ABC television documentary series without first obtaining authorization, three hospitals in Boston have agreed to pay nearly $1 million to settle potential violations. The HHS Office for Civil Rights (OCR) has reached separate settlements with Massachusetts General Hospital (MGH), Brigham and Women’s Hospital (BWH), and Boston Medical Center (BMC) for compromising the privacy of patients’ protected health information (PHI) by inviting film crews for an ABC television network documentary series, without first obtaining authorization from patients. Collectively, the three entities paid OCR $999,000 to settle potential violations of the HIPAA Privacy Rule. HHS has also provided specific guidance about the Health Insurance Portability and Accountability Act (P.L. 104-191) and media coverage, including direction that blurring or pixilation is insufficient to protect patient privacy (Resolution Agreement, August 3, 2018; Resolution Agreement, September 6, 2018; Resolution Agreement, September 6, 2018).


To resolve potential HIPAA violations, MCH agreed to pay $515,000, BWH agreed to pay $384,000, and BMC agreed to pay $100,000. Each entity also agreed to provide workforce training as part of a corrective action plan that will include OCR’s guidance on disclosures to film and media. HHS initiated the investigation of BWH based on information in a Boston Globe newspaper article that indicated BWH permitted ABC News to film a medical documentary program at BWH. HHS also initiated of an investigation of MGH based on a news story posted to MGH’s website indicating that ABC News would be filming a medical documentary program at MCH.

This is the second HIPAA case involving an ABC medical documentary television series. In 2016, New York-Presbyterian Hospital entered into a settlement in association with the filming of “NY Med.” “Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments,” said Roger Severino, OCR director. “Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.”

Guidance on media coverage

HHS reaffirmed that health care providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible. This includes any written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media. It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients. Using techniques such as blurring, pixelation, or voice alteration software for whom an authorization was not obtained is insufficient.

Only in very limited circumstances does the HIPAA Privacy Rule permit health care providers to disclose protected health information to members of the media without a prior authorization signed by the individual. For example, a covered entity may seek to have the media help identify or locate the family of an unidentified and incapacitated patient in its care. The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility. A health care provider may also utilize the services of a contract film crew to produce training videos or public relations materials on the provider’s behalf if certain protections are in place.

Device manufacturer’s misrepresentations result in $12.5M FCA settlement

Medical device manufacturer AngioDynamics, Inc., settled with the United States for $12.5 million following allegations that the company caused health care providers to submit false claims related to the use of the LC Bead® and the Perforator Vein Ablation Kit® (PVAK) to Medicare, Medicaid, and other federal health care programs. The government alleged that the manufacturer both provided instructions to use inaccurate billing codes and misrepresented Medicare billing policy related to the devices. The settlement came as a result of a suit filed under the whistleblower provision of the False Claims Act (FCA) (31 U.S.C. § 3729).

LC Bead allegations

The medical device manufacturer will pay $11.5 million—$10.9 million paid to the federal government and $600,000 paid to state Medicaid programs—to resolve allegations that the company caused the submission of false claims for procedures involving an unapproved drug delivery device marketed with false and misleading promotional claims. The government alleged that between 2006 and 2011, AngioDynamics served as the distributor for the manufacturer of the LC Bead and marketed the product for use as a drug delivery device in combination with chemotherapy drugs. Employees of the manufacturer routinely claimed that this use of the LC Bead was “better,” “superior,” “safer,” and “less toxic” than alternative treatment, despite lack of clinical evidence to support the statements and despite the FDA’s repeated declination to approve the product. Knowing that many insurers did not provide coverage for certain LC Bead procedures, the company instructed health care providers to use inaccurate billing codes for claims related to these uses.

PVAK allegations

AngioDynamics will also pay $1 million to resolve allegations that the company caused the submission of false claims in connection with the use of PVAK, used to close or collapse malfunctioning veins and which was approved by the FDA only for use in treating superficial veins and not for perforator veins. The manufacturer voluntarily recalled the PVAK and reissued the product under the name “the 400 micron kit.” Despite the recall and rebranding, certain AngioDynamics employees took part in a continued campaign to market the device to treat perforator veins, falsely representing to providers that Medicare would cover this use

Kusserow on Compliance: Drifting into corporate integrity agreements is dangerous

Compliance Officers are well aware of impending Corporate Integrity Agreements (CIAs) as cases move through investigations and settlements with the Department of Justice (DOJ) and HHS Office of Inspector General (OIG).  This lead time permits time to prepare for meeting obligations. Consultants with extensive experience in this area offer some thoughts and suggestions to avoid making costly mistakes, or failing to meet CIA deadlines.

  • Suzanne Castaldo, J.D., has assisted many organizations in meeting CIA terms and makes the point that, “When a matter falls into an investigation by the DOJ and OIG, legal counsel takes over to resolve the matter. After the case is settled with the DOJ, they continue to work with the OIG on terms and conditions for the CIA.  The result often catches the organization and their Compliance Officers, executive leadership, and Board about the full scope of what needs to be done in the 120 days following agreement.”
  • Tom Herrmann, J.D., had a number of years at the OIG coordinating with the DOJ, developing settlement agreements, and appointing monitors, as well as working as an Independent Review Organization (IRO) with more than a dozen organizations. He urges “Compliance Officers or organizations moving to DOJ settlement and OIG to not sit back and wait for an agreement to be negotiated.   They should be in communication with their legal counsel to understand what is being discussed in terms of timing and obligations and begin maneuvering with plans to meet the obligations that will be in the CIA.”
  • Carrie Kusserow, who worked as both a Compliance Officer and a consultant in meeting corporate integrity agreement (CIA) obligations, agrees, in that, “When CIAs are signed, most Compliance Officers and their executive leadership are often surprised by the implications of what has been agreed; and ill prepared to meet the terms and stringent timelines that are included in them. They wake up and begin to focus on the real scope of what has been agreed in the CIA.  Suddenly they find they begin to understand the scope of their commitment and begin racing the clock to accomplish all that to which they have agreed.  Frequently this leads to mistakes and delays in trying to do all that is required within strict timeframes established that include securing the Independent Review Organization, as well as Compliance Experts for the Board.  All this is the backdrop to preparing the first report to the OIG.  The last thing any organization needs is to fail in meeting obligations at the outset of a CIA.”
  • Steve Forman, CPA, who also has extensive experience both in leading IRO teams as well as being a Board appointed Compliance Expert for three organizations, observed that “There is little by way of excuse for Compliance Officers, leadership and the Board not being adequately prepared for what is coming in terms of a CIA. Compliance Officer should, at the first sign that there will be a settlement with the government begin their homework and preparation, by reviewing recent CIAs posted on the OIG website.   CIAs follow a pattern, granted that terms and conditions evolve, it does so slowly.  All a Compliance Officer needs to do is find a CIA with factual similarity to their situation; and then read the terms and apply them to their own organization.  By doing this, they will know how much time they will have to do certain things.”
  • Al Bassett, J.D., who has more than 20 years’ experience in providing compliance advisory services, adds, “Many of the tasks that will be required under a CIA can and should be undertaken well in advance of an agreement. It is foolish to wait until a CIA is signed.  The race is on once a case is moving to the DOJ, not OIG.  In many cases this provides a year or more of advance preparation to meet what will likely be included in the CIA in terms of being able to evidence compliance program effectiveness. It is important that organizations realize that CIAs are no longer just focused upon substantive issues that led to the problem that are monitored by an IRO.  Recent CIAs have turned their attention to compliance and certifications.  Compliance standards are set forth and there are mandated certifications by the executive leadership, including the Compliance Officer, along with members of the Board.  Board certifications have also led to mandates to engage in addition to an IRO, a Compliance Expert to assist and give advice to boards to prepare them to personally certify the compliance program.  Knowing this, the Compliance Officer should be working in overdrive, before any settlement, in preparing to meet what is needed to evidence compliance program effectiveness.”
  • All of the experts agreed that it is strongly advisable for Compliance Officers to begin looking for qualified experts to fill the roles of an IRO and Compliance Expert. They underscore this as a very serious responsibility, for once selected, they are likely to have that role for up to five years.  Although there are many who would like to fill those roles, finding the right qualified experts will take some time and weeding.  Far too many organizations find themselves rushed on finding the right experts and are forced to settle on lesser qualified parties.  A bad selection can result in many additional unnecessary burdens, higher costs, and increased problems with the OIG.  The best advice given is to find an organization with experience in these roles with many CIAs.  They will know what needs to be done and not learn on the engagement at the expense of the organization.  They also will be known by, and have experience and credibility with, the OIG.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2016 Strategic Management Services, LLC. Published with permission.

Over 500 hospitals reach DSH payment settlement with CMS

Resolving 11 pieces of litigation stretching back to 2010, over 500 hospitals on July 14, 2016, entered into confidential settlement agreements with CMS regarding Medicare disproportionate share hospital (DSH) payments. Details of the settlements were not available at press time, although they involve disputed DSH payments for cost reporting periods from 1991 through 2007, depending on the hospital. Neither CMS nor the attorneys at Akin Gump, lead counsel for the hospitals involved in the settlements, would comment on the settlements.


Medicare makes DSH payments as a percentage add-on to the standard payment amount per discharge under the prospective payment system for the operating costs of inpatient hospital services. The fact situations for the hospitals involved in the settlement were similar – the hospitals challenged CMS’ payment determinations on the grounds that errors and omissions in the calculation of the DSH payment formula wrongfully reduced the resulting DSH payments. The hospitals also challenged a subsequent ruling by CMS – CMS-1498-R – that the Provider Reimbursement Review Board and the other Medicare administrative appeals tribunals lack jurisdiction over provider appeals of specific DSH payment adjustment issues.

Treatment of Part C days

The hospital parties in four cases also filed a motion to stay further proceedings pending a final, non-appealable merits decision in either Allina Health Services, et al. v. Burwell, 1:14-cv-01415-GK (D.D.C.) (see Court has jurisdiction to hear health system’s challenge to DSH calculation, Health Law Daily, November 2, 2015) or Allina Health System, et al. v. Burwell, 1:16-cv-00150-GK (D.D.C.). The substantive issue in dispute in those cases concerns the treatment of Medicare Part C days in the Medicare DSH payment calculation for periods after October 1, 2004.

Original complaints and stipulations

Listed below are the complaints for the 11 cases that were settled, along with the number of hospitals involved in each complaint and the cost years involved on the original complaints, followed by a link to the July 14, 2016 stipulation.