An RSS Feed from melniklegal.com

Florida Telemedicine - Status Update on SB 1646

Mon, 21 Apr 2014 00:00:13 EST

The push for telemedicine in Florida continues. The bill to create the Telemedicine Act, SB 1646, is in appropriations as of April 11, 2014.

The bill would permit and thereby expand the provision of healthcare services in Florida using telemedicine. According to the bill summary, the bill also:

creates s. s. 456.4503, F.S.;

requiring specified practitioners providing telemedicine services to patients in this state to be licensed in this state;
providing certain exceptions for emergency services and consultations; authorizing non-Florida licensed physicians to meet alternative requirements;
requiring pertinent records to be made available upon request;
requiring other health care providers to be supervised by a telemedicine provider;
providing continuing education requirements for telemedicine providers;
establishing venue; providing applicability;
authorizing the licensing boards to adopt rules;

creates s. 456.4504, F.S.;

providing standards and prohibitions for the provision of telemedicine services;
prohibiting nonemergency prescribing of a legend drug without a physical examination;
prohibiting the prescription of a controlled substance for chronic nonmalignant pain using telemedicine;

creates s. 456.4505, F.S.;

authorizing the use of telemedicine services in the diagnosis and treatment of the human eye;
providing requirements for the use of automated equipment;
requiring the owner or lessee of the automated equipment to maintain specified liability insurance under certain circumstances;
prohibiting prescriptions for spectacles or contact lens based solely on the use of an autorefractor;

creates s. 456.4506, F.S.;

providing requirements for reimbursement of telemedicine services under the Medicaid program;
requiring a report to the Legislature on the usage and costs of telemedicine in Medicaid by a certain date;
providing for future repeal;

amends s. 409.967, F.S.;

prohibiting a managed care plan under Medicaid from using telemedicine providers that are not physicians;

amends ss. 627.645 and 641.185, F.S.;

prohibiting the denial of a claim for payment for medical services based on a medical necessity determination conducted via telemedicine unless the determination is made by a physician;
providing an effective date.

The full text of the bill is available here - https://www.flsenate.gov/Session/Bill/2014/1646.

Posted by Tatiana Melnik April 21, 2014.

Florida Governor Signs New Data Breach Law Requiring All Businesses to Implement Security Controls

Fri, 27 Jun 2014 22:41:33 EST

After being unanimously passed by the Florida legislature on April 30, 2014, on June 20, 2014, Florida's Governor Rick Scott signed the Florida Information Protection Act of 2014 (Act or FIPA). This Act repeals and wholly replaces Florida's existing data breach law (at Flat. Stat. Section 817.5681) with new Section 501.171. FIPA takes effect on July 1, 2014.

A few preliminary comments.... This statute is a relatively sweeping change for Florida and raises the bar for other states. It applies to every business that handles "personal information" of Florida residents and requires these businesses to take proactive "reasonable measures" to secure data. But, like many other data breach and data security statutes, FIPA fails to define what it means to take "reasonable measures." In general, this means that companies need to follow industry best practices. As a starting point, businesses should conduct a risk analysis to better gauge their risks. FIPA also implements a records disposal requirement.

Given the increased liability brought about by this statute, Florida-based businesses that share data with other entities should review their contracts to ensure that data breach notification requirements are included together with appropriate cyberliability (i.e., data breach) insurance requirements, damages caps, and indemnification language. Non-Florida based businesses that handle "personal information" of Florida residents should be aware that they too may be subject to the requirements can be pulled into court under the Florida Long-Arm Statute.[1]

What Steps Should Companies Take?
Companies should consider taking a few proactive steps to gauge their risks and liabilities in light of the proactive requirement to take security measures, shortened deadline to provide data breach notification, and notification requirements for down-stream entities (e.g., business associates, vendors, contractors, etc.).

Under take a risk analysis to better assess potential risks and vulnerabilities to the confidentiality, integrity and availability of all personal information handled by the company

For a good starting point for a risk analysis, consider looking to the HIPAA materials and the NIST guidance documents

Review existing privacy and security policies and procedures and update as needed

Policies should reflect what the organization actually does and not what it would do in an ideal world. Policies that are in place but are not followed may demonstrate willful negligence and be the proverbial "smoking gun" in litigation

Develop an incident response plan, which should include a data breach notification plan

This plan should be called an "incident response plan" because not every incident is a breach. By calling something a "breach" your team may be attributing a legal meaning to an event that is merely a potential security incident. Keep in mind that the term "breach" is defined in the statue.

Any security incident is a stressful event. Having a plan in place, that at the very least contains important phone numbers for contacts who can assist you through the process will ease the stress a bit. Your attorney should be the first call because you never know what you are going to find.

Encrypt personal information to the extent possible and definitely encrypt all mobile devices

The loss and theft of laptops is one of the leading causes of data breaches. Laptops should have hard drive encryption (as opposed to a separate drive that each employee should use to store personal information). If your company is using a Windows based product, check to see if BitLocker is available on the version you're using because it comes preinstalled in some Windows products and only needs to be enabled.

Employee owned mobile devices that have access to "personal information" should be enrolled in a mobile device management system and the company should have written authorization from the employee to wipe the device, copy the device, seize it in the event of litigation, etc.

Encryption is particularly important because it pulls the information out of the definition of "personal information" and therefore also pulls it out of the breach notification requirement.

Identify all vendor and business relationship that impact "personal information" and review the existing contracts to ensure that your business will receive timely notification in the event of an incident as well as cooperation during the investigation

A Few Highlights from the New Law

Arguably, every organization is covered under the law because the definition of "covered entity" is quite broad:

�Covered entity� means a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information. For purposes of the notice requirements . . ., the term includes a governmental entity.
Those in the healthcare space will be familiar with the term "covered entity" but note that this provision covers every organization that acquires, maintains, stores, or uses personal information.

The definition of personal information is quite broad and includes social security numbers, healthcare information, health insurance policy number, credit card numbers, and "a user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account."

There is a shorter timeline to notify affected Florida individuals - Under Florida's previous law, organizations were required to notify within 45 days. Now, it is "no later than 30 days after the determination of a breach or reason to believe a breach occurred" unless there is a law enforcement delay or "if, after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm to the individuals whose personal information has been accessed.

As noted above, covered entities must take proactive measures to protect the personal information. "Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information."

There is no private right of action. But, a "violation of this section shall be treated as an unfair or deceptive trade practice in any action brought by the [Department of Legal Affairs (i.e., the Florida Attorney General)] under s. 501.207 against a covered entity or third-party agent." Civil penalties are not to exceed $500,000 and will go into the General Revenue Fund.

FIPA includes a data records disposal provision. "Each covered entity or third-party agent shall take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within its custody or control when the records are no longer to be retained. Such disposal shall involve shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means."

The text of the new law is available here - https://laws.flrules.org/2014/189.

---------------------
[1] Interestingly, the Florida legislature addressed the possibility of this in the "Bill Analysis and Fiscal Impact Statement" as follows:

Although the bill does not specifically provide that the covered entity must be conducting business in this state, the Florida Long-Arm statute may provide courts with the authority to assert personal jurisdiction over a nonresident covered entity. The statute enumerates a number of actions that a person or his or her representative may take that would submit that person to the jurisdiction of Florida courts. Those actions include, among other things, operating, conducting, engaging in, or carrying on a business venture in this state or having an office or agency in this state; committing a tortious act within this state; or breaching a contract in this state by failing to perform acts required by the contract to be performed in this state. A person may also become subject to the jurisdiction of a Florida court if the person is engaged in substantial and not isolated activity within Florida.

Florida Senate, Bill Analysis and Fiscal Impact Statement: CS/SB 1524, April 1, 2014, https://www.flsenate.gov/Session/Bill/2014/1524/Analyses/2014s1524.pre.rc.PDF.

---------------------

Posted by: Tatiana Melnik on June 27, 2014

Details on the Meaningful Use Penalties Hardship Exception

Mon, 10 Mar 2014 00:50:20 EST

CMS has recognized that some eligible professionals (EP) and eligible hospitals (EH) are struggling to meet Meaningful Use obligations, which makes them subject to payment adjustments under the American Recovery and Reinvestment Act of 2009 (ARRA). Payment adjustments are only applicable to the Medicare EHR Incentive Program and would be applied beginning on January 1, 2015 for Medicare eligible professionals and October 1, 2014 for eligible hospitals. But, CMS has advised that EPs (and EHs) may be exempt from payment adjustments if they can show that demonstrating Meaningful Use would result in a significant hardship.

On March 10, 2014 CMS issued 2014 CEHRT Hardship Exception Guidance for eligible professionals, eligible hospitals and critical access hospitals that are unable to implement the 2014 Edition of Certified Electronic Health Record technology in time to successfully demonstrate meaningful use for the 2014 reporting year.

While some information is included for EHs, this post focuses primarily on EPs.

What must EPs and EHs do to be considered for a hardship exception?

To be considered, an EP or EH must:

complete a Hardship Exception application; and
show proof of the hardship.

Applications for both EPs and EHs are available on the CMS website here.

Please be sure to review your application carefully because "all documentation is required at the time of submission and additional documentation will not be accepted."

Is there any liability associated with signing the Hardship Application?

Yes. Care should be taken when completing applications (as well as when making Meaningful Use attestations). Both the signatory and the eligible professional can be held personally liable for the information in the application. When signing the Hardship Application, the signatory attests that: "I understand that both the provider and I can be held personally responsible for all information entered."

On January 22, 2014, a Texas grand jury indicted a former CFO on allegations of EHR Meaningful Use fraud. The CFO was charged with making false statements to CMS and aggravated identity theft. If convicted, the CFO faces up to 5 years in federal prison for making a false statement and up to 2 years in federal prison for aggravated identity theft.

Find the Meaningful Use process confusing? Need help navigating the EHR incentive program?

Now sure what all of the Meaningful Use requirements mean?

Need help completing the Exception Application? Need help selecting the appropriate hardship reason?

Has you practice or hospital been overpaid under the Medicare EHR Incentive Program?

We can help!
Please contact us today.

We can also assist with resolving EHR vendor and other IT vendor disputes.

You may also want to read our article in the Journal of Health Care Compliance entitled, Doctors, Unhappy with their EHR System, Sue the Vendor in a Class Action: Now May Be the Time to Reassess EHR Solutions and Formulate a Plan to Remedy Deficiencies.

When are the applications due?

Applications from EPs must be submitted to CMS no later than midnight EDT on July 1, 2014.

Applications from EHs must be submitted to CMS no later than midnight EDT on April 1, 2014.

How will CMS notify me of its decision?

Notifications will be made to the e-mail address provided to CMS.

Can CMS's decision on the hardship be appealed?

No. According to CMS, "determinations made by CMS or their designee regarding Hardship Exceptions are final and cannot be appealed."

Will CMS be flexible in granting hardship exceptions?

In a speech at the National HIMSS Conference, CMS Administrator Marilyn Tavenner said that, while CMS would not delay the compliance deadline for Meaningful Use Stage 2, the agency would be more flexible in granting hardship exemptions to providers. [1] In a March 6, 2014 letter to Tavenner, Senators John Thune (R-SD), Lamar Alexander (R-TN), Richard Burr (R-NC), Tom Coburn, (R-OK), Mike Enzi (R-WY), and Pat Roberts (R-KS) requested that CMS �immediately clarify how the hardship exceptions will be granted.� [2]

What does it mean to have a "hardship?"

In the application, CMS has advised that "to file a Hardship Exception Application, the circumstance must be beyond the EP's control and the EP must explicitly outline how the circumstance significantly impaired the EP's ability to meet Meaningful Use."

CMS provides the following list of available reasons in the application:

Lack of Infrastructure - During any 90 day period from January 1, 2013 to July 1, 2014 (the beginning of the year that is 2 years before the payment adjustment year to July 1 of the year preceding the payment adjustment year), the EP was located in an area without sufficient Internet access to comply with the Meaningful Use objectives requiring Internet connectivity, and faced insurmountable barriers to obtaining such Internet connectivity.

Unforeseen and/or Uncontrollable Circumstances - During the 1 or 2 calendar years (2013 and 2014) preceding the payment adjustment year (2015), the EP faced extreme and uncontrollable circumstances that prevented the EP from becoming a meaningful EHR user. Some of these circumstances include:

Weather disaster
Unable to obtain data necessary to attest to Meaningful Use because the medical practice closed or otherwise went out of business
Bankruptcy or debt restructuring

Lack of control over the availability of Certified EHR Technology - EPs who had difficulty in meeting Meaningful Use during the period that begins 2 calendar years before the payment adjustment year through the Application deadline (January 1, 2013 -July 1, 2014) must demonstrate that:

EP practices at multiple locations, and
is unable to control the availability of Certified EHR Technology at one such practice location or a combination of practice locations, and
where the location or locations constitute more than 50 percent of patient encounters.

Lack of Face-to-Face Interaction - EPs who had difficulty in meeting Meaningful Use during the period that begins 2 calendar years before the payment adjustment year through the Application deadline (January 1, 2013 -July 1, 2014).

This exception is only available if the EP can demonstrate: (1) lack of face to face interactions, and (2) lack of need to follow up with patients.

The EP must demonstrate (a) either a complete lack of face-to-face interactions and follow-up or (b) that the cases of face-to-face interaction and follow-up are extremely rare and not part of normal scope of practice for that EP.

2014 EHR Vendor Issues - During the fiscal year (2014) preceding the payment adjustment year (2015), the EP's EHR vendor was unable to obtain 2014 certification or the EP was unable to implement Meaningful Use due to 2014 EHR certification delays.

The information needed to substantiate the hardship is relatively detailed. So, for example, if the reason for the hardship is lack of infrastructure because the cost of an Internet connection is prohibitive, the EP must provide a copy of the one-time infrastructure build-out cost quote from Internet Service Provider.

How long is the hardship exception valid?

If approved, the Meaningful Use hardship exception is valid for one (1) payment year only.

What if the hardship exception continues into the next payment year?

CMS will require that the provider or the hospital complete a new application. But, per CMS, "in no case may a provider be granted an exception for more than 5 years."

Are there any EPs that are excluded from the payment adjustments or otherwise not required to complete the Exception Application?

Yes. The following EPs do not need to complete an application:

EPs that successfully met Meaningful Use in 2013 will be excluded from the payment adjustment and do not need to submit a Hardship Exception Application for Payment Year 2015.

Providers that are classified in the Medicare Provider Enrollment, Chain and Ownership System (PECOS) as having one of the following 5 specialty codes as their primary area of practice DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS:

Diagnostic Radiology (30)
Nuclear Medicine (36)
Interventional Radiology (94)
Anesthesiology(05)
Pathology (22)

New EPs enrolling in the Medicare program, DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS.

Hospital-based EPs for 2012 or 2013, DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS.

Related Posts

Posted by: Tatiana Melnik
Date: March 10, 2014

-----------------
[1] Ashley Gold, UPDATED: CMS to be More Flexible with Meaningful Use Stage 2 Hardship Exemptions, FierceHealthIT, Feb. 27, 2014.

[2] Press Release, GOP Senators Call For Details on Administration Plan to Grant Exemptions from Electronic Health Records Regulations, March 6, 2014.

Wyoming Legislature Rejects Bill Limiting Employer Access to Social Media Accounts

Sun, 16 Mar 2014 01:24:25 EST

On February 27, 2014, the Wyoming House failed to pass (on a 16-36 vote in the House) a bill that would have restricted an employer's ability to request or require access to a social media account of an employee or prospective employee. The Senate approved the bill on February 18, on a 28-2 vote.

With the growth of social media and peoples desire to share everything with the world, even news that is subject to an explicit confidentiality provision, many employers have used these same tools to evaluate prospective employees as well as monitor current employees.

Several states have already passed laws restricting employer access to employee's or prospective employee's social media accounts. As of this writing, Wyoming would have been the thirteenth state.

Proposed Bill S.F. 81 provided that it was a "discriminatory or unfair employment practice [f]or an employer or employment agency, itself or through its agent, to request or require any employee or prospective employee to disclose any username, password or other means for viewing or accessing the information contained on an employee's or prospective employee's personal social media account." [1] The proposed Bill further defined "social media account" as "an electronic service or account, or electronic content, including but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations." [2]

But, the proposed Bill did not prohibit employers and their agents from engaging in a number of activities, including, for example, "[r]equesting an employee or prospective 3employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding[.]" [3]

The proposed language would have been incorporated into the Wyoming Fair Employment Practices Act of 1965 (Title 27, Chapter 9), which provides that, aggrieved parties may bring their cases to the Wyoming Department of Workforce Services. [4]

According to a report by BNA, "House bill sponsor Ruth Ann Petroff (R) [said] that the bill failed 'because there were a perfect number of people who didn't think the bill went far enough combined with a perfect number who thought it went too far.'"

Employers should continue to pay attention to passed and pending legislation regarding social media access as well as on-going activities at the National Labor Relations Board. Employers should also be aware that reviewing the social media accounts of prospective employees may put them at risk to claims that decisions not to hire were unlawful discrimination or retaliation for activity that is protected by law. Existing laws prohibit employers from basing their hiring decisions on a number of factors, including a person�s age, race, national origin, religion and marital status. The Constitutions and laws of a number of states prohibit additional factors.

NOTE: Tatiana Melnik is not licensed to practice law in Wyoming. Please contact counsel licensed in Wyoming with questions related to Wyoming law. For referrals, please check with the Wyoming Bar Association at https://www.wyomingbar.org/.

--------------------------------------

[1] State of Wyoming, Employer Access to Social Media Accounts, Senate File No. SF0081, 27-9-105(a)(v) (Feb. 2014), available at https://legisweb.state.wy.us/2014/Introduced/SF0081.pdf.

[2] Id.

[3] Id. at 27-9-105(a)(v)(B).

[4] See sec. 27-9-106(a). ("Any person claiming to be aggrieved by a discriminatory or unfair employment practice may, personally or through his attorney, make, sign and file with the department within six (6) months of the alleged violation a verified, written complaint in duplicate which shall state the name and address of the person, employer, employment agency or labor organization alleged to have committed the discriminatory or unfair employment practice, and which shall set forth the particulars of the claim and contain other information as shall be required by the department. The department shall investigate to determine the validity of the charges and issue a determination thereupon."

------------------

Posted on: March 26, 2014
By: Tatiana Melnik

HMA to Repay $31 Million for Improper EHR Claims

Mon, 11 Nov 2013 21:03:06 EST

In a Form 8-K filed with the SEC on November 5, 2013 [1], Health Management Associates, Inc. (HMA) announced that it will restate financial statements to address a repayment of $31 million the company received in EHR Incentive Payments for demonstrating "Meaningful Use" of certified EHR technology. HMA notified CMS and the relevant state programs and is in the process of repaying the funds received from both Medicare and Medicaid.[2]

HMA explained that, "[i]n October 2013, based on the results of an internal review, the Company determined that it had made an error in applying the requirements for certifying its EHR technology under these programs and, as a result, that 11 of the hospitals it had enrolled in the [federal Medicare and various state Medicaid Healthcare Information Technology (HCIT)] programs did not meet the 'meaningful use' criteria necessary to qualify for HCIT payments." As a result, HMA will be restating financial statements for the years ended December 31, 2010, 2011 and 2012 and the quarters ended March 31 and June 30, 2013 to correct the accounting treatment of the payments:

2011 - recognized as income approximately $8.3 million
2012 - recognized as income approximately $17.3 million
2013 (first six months) - recognized as income approximately $5.4 million

HMA also advised that the following filings and reports "should no longer be relied upon" given the errors:

consolidated financial statements contained in

HMA's Annual Report on Form 10-K for the fiscal year ended December 31, 2012
the Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2013 and June 30, 2013

all releases issued by HMA discussing its financial results for December 31, 2012, March 31, 2013, and June 30, 2013
HMA's guidance for fiscal year 2013 issued on July 30, 2013
Ernst & Young LLP reports dated February 27, 2013 on HMA's consolidated financial statements and the effectiveness of HMA's internal control over financial reporting

HMA's story is a good reminder that Meaningful Use payment recipients, particularly those with multiple offices, must take the appropriate steps to audit use to ensure that incentives are not being claimed erroneously. CMS hired Figliozzi and Company to undertake audits on Medicare eligible professionals and eligible hospitals, as well as on hospitals that are eligible for both the Medicare and Medicaid EHR Incentive Programs. CMS made clear in an announcement in February 2013 that it expects eligible professionals, eligible hospitals, and critical access hospitals to "retain ALL relevant supporting documentation (in either paper or electronic format) used in the completion of the Attestation Module responses." [3]

How long the documentation must be retained depends on the type of documents:

Documents that support attestation data for meaningful use objectives and clinical quality measures - retained for six years post-attestation
Documents that support payment calculations (e.g., cost report data) - retention period should follow the current document retention processes.

Companies should review their document retention policies to ensure that the policies are consistent with requirements. If no retention policy is currently in place, now may be the appropriate time to develop such a policy.

[1] Health Management Associates, Inc., Securities and Exchange Commission Form 8-K, Nov. 5, 2013.

[2] Press Release, Health Management Associates, Inc., Nov. 5, 2013.

[3] CMS, EHR Incentive Program, Supporting Documentation for Audits, Updated Feb. 2013.