|
|
||||||
|
04/03/2006 |
||||||
|
Sanford V. Teplitzky John F. Lessner Appeared in CCH Health Care Compliance Letter In this article we will illuminate the government's approach to Health Insurance Portability and Accountability Act of 1996 (HIPAA) compliance as reflected in the final enforcement rule. Additionally, we will explain the provisions addressing the two modes of compliance review, enforcement through “informal means," the imposition of civil money penalties, the abilities of covered entities to demonstrate affirmative defenses to the imposition of civil money penalties, and notice and hearing requirements for imposition of civil money penalties. Covered entities should familiarize themselves with these new provisions to make any adjustments and fine tune their HIPAA compliance efforts as necessary. The Department of Health and Human Services' (HHS) long awaited final rule on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) administrative simplification enforcement provisions was published on February 16, 2006.1 This final rule amends the existing rules relating to the enforcement of privacy noncompliance rules, applying them to all of the HIPAA administrative simplification provisions, e.g. the privacy, security, and transaction code set standard rules. The final enforcement rule provides details about the investigation process, the basis for civil money penalty (CMP) liability and determining civil money penalty amounts, and generally provides certain procedural protections and provisions with regard to HIPAA covered entities. The effective date of the final rule is March 16, 2006. Resolution by “Informal Means" The rule explains that “informal means" may include demonstrated compliance by the covered entity, a completed corrective action plan, or other satisfactory resolution of an alleged or identified violation. The significance of this aspect of the final rule is that the government is codifying its tiered approach to HIPAA enforcement by encouraging compliance by covered entities through cooperation in the form of action plans or plans of correction rather than imposing compliance by resorting to punitive enforcement actions, such as civil money penalties. Notification of resolution or request for additional evidence. If an alleged or identified violation is resolved by informal means, HHS is required to inform the covered entity and the complainant of the resolution in writing. If the matter is not resolved by informal means, HHS must inform the covered entity and provide it an opportunity to submit evidence of mitigating factors or affirmative defenses that would potentially resolve the issue informally. Such response by the covered entity to HHS must be submitted within 30 days of HHS' notice to the covered entity. Notification of findings. After any submitted information is received and reviewed by HHS. If HHS finds that a civil money penalty should be imposed, HHS will inform the covered entity of its findings through a notice of proposed determination sent by certified mail. Conversely, if, based on the covered entity's submission, HHS finds there was no evidence of noncompliance; HHS will inform the covered entity and the complainant of its findings. Statistical support for measured approach. With respect to its intended approach to HIPAA enforcement, in the preamble, HHS notes that as of October 31, 2005, it had received over 16,000 privacy complaints from health care consumers. It further notes that 60 percent of these cases have been resolved informally or otherwise closed to date, indicating that HHS is receiving cooperation from covered entities and that covered entities are quickly addressing compliance problems through corrective action. Thus, with these statistics as support, it appears that HHS recognizes the value in taking a measured approach to HIPAA enforcement, rather than immediate corrective action through the imposition of civil money penalties. HHS Review The government most likely gave itself this ability to conduct compliance reviews of covered entities' HIPAA programs to address issues that can often be brought to HHS' attention regarding a covered entity's operational practices but have not necessarily been identified by an individual or do not stem from a specific complaint. For example, the media sometimes identify particular concerns or issues with operational aspects of health care providers' practices that may raise HIPAA concerns. In that event, HHS has enabled itself to review a covered entity's compliance so that it can take appropriate enforcement action if violations are identified. Covered Entity Liability for Violations Workforce violations. The final rule further provides guidance for covered entities with respect to their liability for their workforce's compliance violations. Significantly, the stated basis for a civil money penalty sanction includes specific reference to the federal common law of agency. This provision provides that covered entities are liable for a violation of the HIPAA rules based on the acts or omissions of any agent of the covered entities, including a workforce member, who is acting within the scope of his or her agency. Business associates. The rule explicitly excludes business associates from such direct liability, assuming that the covered entity has complied with the applicable requirements pertaining to business associate agreements and business associates' obligations under the administrative simplification rules, and provided that the covered entity did not know of a pattern of activity or practice of the business associate nor failed to act upon such pattern or practice if it did know. In such cases, a covered entity will not be held liable for acts or omissions of its business associate. Amount of Civil Money Penalty Calculating the amount of the penalty. With respect to calculation of the amount of the civil money penalty, the rule notes that in the case of continuing violations of the provisions, a separate violation occurs each day the covered entity is in violation of the provision. Consequently, even though the actual amount of a civil money penalty is limited to $100, that $100 may be assessed on a daily basis for the period of time a covered entity is out of compliance with the provision. As noted above, however, the total violation is limited to no more than $25,000 for the same violations in a calendar year. Moreover, in assessing the number of violations that have occurred, the rule requires HHS to base its assessment on the nature of the covered entity's obligation to act or not act under the provisions violated. For example, HHS must assess whether the violation involved the failure to respond within a certain time frame or acting or not acting with respect to certain persons. Mitigating factors. In determining the amount of the civil money penalty, the provisions permit, but do not require, HHS, to consider certain aggregating or mitigating factors. The factors HHS may consider in assessing a civil money penalty include:
Additional factors HHS may take into consideration include the degree of culpability of the covered entity, including whether the violation was intentional and whether it was beyond the direct control of the covered entity and any prior compliance history of the covered entity, including previous violations, the financial condition of the covered entity, and other matters “as justice may require." Affirmative Defenses
These affirmative defenses are significant because covered entities that conduct regular and ongoing compliance and promptly address HIPAA issues when they are identified, will have positioned themselves well for establishing an affirmative defense if a complaint is lodged and HHS investigates. Notice of Intent to Impose a Penalty Hearing Rules and Procedures Rules for statistical sampling. Of particular note are the provisions addressing statistical sampling. The hearing rules specifically permit HHS to introduce results of a statistical sampling study as evidence of the number of violations of the rule that was used in determining the amount of the civil money penalty. The rule provides that the statistical study must be based upon an appropriate sampling and computed by valid statistical methods, in which case it constitutes prima facie evidence of the number of violations. As a result of these provisions, HHS is permitted to estimate the number of violations, rather than prove the exact number that occurred, arguably granting HHS significant discretion in determining civil money penalty amounts. Further appeal rights. Finally, the hearing rules ultimately provide that the administrative law judge's decision may be appealed to the Departmental Appeals Board and, if the covered entity is dissatisfied with the decision of the Board, the covered entity may request judicial review in federal district court. Conclusion Sanford V Teplitzky is a Principal and Chairman of the Health Low Department of Ober, Kaler, Grimes & Shriver and is resident in the Baltimore office of the firm. His clients are typically large health care companies and delivery networks that seek help with fraud and abuse problems and representation in federal or state investigations. He is a former president of the American Health Lawyers Association and a frequent writer and lecturer on various health care fraud and abuse issues. Mr. Teplitzky can be contacted at 410-347-7364 or by e-mail at teplitzky@ober.com. John F Lessner is a Principal in the law firm of Ober, Kaler, Grimes & Shriver in Baltimore. Mr. Lessner focuses his practice on regulatory matters involving Medicare/Medicaid issues and state licensure of hospitals, nursing homes, assisted living facilities, group homes, home health agencies, laboratories and other health facilities. He advises and represents clients on Medicare and Medicaid cost reimbursement issues, conditions of participation, certification, privacy, e-health, advance directive and freedom of choice issues in institutional settings. Mr. Lessner can be reached at 410-347-7683 or by e-mail at jflessner@ober.com. |
||||||
|
Ober, Kaler, Grimes & Shriver Maryland
Washington, D.C. Virginia |
||||||
