MSBCBS of TN Settles HIPAA/HITECH Violation for $1.5M

The HHS Office for Civil Rights (OCR) announced a settlement of $1.5M with Blue Cross Blue Shield of Tennessee (BCBST) relating to potential violations under the HIPAA Privacy and Security Rules. According to the OCR press release, the enforcement action by OCR is the first reported as resulting from a breach report required under the new Breach Notification Rule implemented as a result of the HITECH provisions of HIPAA.

The breach involved 57 unencrypted computer hard drives that were stolen from a facility leased by BCBST in Tennessee. The hard drives contained protected health information of approximately 1 million individuals. The breach was reported by BCBST to OCR under the HITECH provisions and regulations that require reporting of potential breaches. The press release indicates that OCR’s investigation found that BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.

For more information check out the HHS press release "HHS settles HIPAA case with BCBST for $1.5 million" which includes a link to the HHS Resolution Agreement entered into between OCR and BCBST.

OHFLAC Announces New Independent Informal Dispute Resolution Procedure for West Virginia Nursing Homes

The latest West Virginia Health Care Association e-News Update announced that the Office of Health Facility Licensure and Certification (OHFLAC) has put into place a new Independent Informal Dispute Resolution (IIDR) review of disputed deficiencies for all nursing homes in West Virginia. The new IIDR procedure goes into effect immediately and three out of state vendors experienced in IDRs were selected to be the third party reviewers. The current Informal Dispute Resolution (IDR) will remain as an alternative option.

According to the e-News Update, the new procedure will be detailed in a letter to providers when OHFLAC returns the Statement of Deficiencies to the provider after a survey. The letter will contain instructions on how to request an IIDR. OHFLAC is proposing to use the following language in the letters:

INFORMAL DISPUTE RESOLUTION:
In accordance with 42 CFR 488.331, you have an opportunity to question cited deficiencies through an informal dispute resolution process. To request an informal dispute resolution, please submit in writing the specific deficiencies being disputed and an explanation of why you are disputing those deficiencies to:

                                    Informal Dispute Resolution Review Committee
                                    Office of Health Facility Licensure and Certification
                                    408 Leon Sullivan Way
                                    Charleston, WV 25301-1713

You may also send your request via email to DHHR.OHFLAC.@wv.gov. 
This request must be sent during the same ten (10) calendar days you have for submitting a Plan of Correction (POC) for the cited deficiencies and must be contained on a document separate from the CMS-2567L, which contains the POC. 
You may choose between an informal dispute resolution (IDR) and an independent informal dispute resolution (IIDR).  You must clearly indicate your choice in the attention line of your request and the subject line of your email. An IDR will be completed by OHFLAC staff not associated with the referenced survey event.

Per West Virginia State Code §16-5C-12a, an IIDR will be completed by an independent review organization.  If an independent informal dispute resolution process is selected, the matter will be assigned to one of three independent review organizations accredited by the Utilization Review Accreditation Commission.  The facility may be subject to certain costs such as:
•     The cost of a face-to-face conference if one is requested; and
•     The cost charged by the independent review organization, should the facility not be successful in its dispute.

Please call us at 304-346-4575 if you have any questions.

The new IIDR procedure will allow nursing homes an alternative option to the standard IDR process when questions arise during the survey process and related POC requirement. The new procedure will allow a nursing home provider to challenge the particular survey finding through an alternative/independent process. Whether this new alternative procedure will be valuable to nursing home providers is yet to be seen.

West Virginia Health Care Association Launches WV Senior Care Website

This past week health care colleague and CEO of the West Virginia Health Care Association, Patrick D. Kelly, advised me that the association has launched a new website to provide a resource for families and seniors who are researching residential and health care options in West Virginia. The website is called West Virginia Senior Care: Helping Seniors Make Informed Decisions About Senior Care and can be found at: http://www.wvseniorcare.com/.

The website is designed to help all of us find information and make better decisions regarding care for our parents and the elderly. The website includes everything from in home care services, such as home health, hospice, and other in home services, to care offered in assisted living facilities, residential care, nursing homes, hospitals, etc. The press release issued by the West Virginia Health Care Association provides additional details.

After looking around the website it looks like a great resource of health care information for West Virginia seniors.

CMS Issues proposed rule for Stage 2 Meaningful Use EHR Incentive Programs under HITECH

Yesterday the Centers for Medicare & Medicaid Services (CMS) announced the proposed rule for Stage 2 Meaningful Use under the the Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs which is a part of the Health Information Technology for Economic and Clinical Health Act (HITECH).

The incentive program is part of the national health information technology reform effort under the American Recovery and Reinvestment Act of 2009 which provides incentive payments to eligible health care professionals, eligible hospitals and Critical Access Hospitals who adopt certified EHR technology and use it to demonstrate “meaningful use” of that technology to CMS.

The proposed rule also revised certain Stage 1 criteria, as well as criteria that apply regardless of the Stage, as finalized in the final rule titled Medicare and Medicaid Programs; Electronic Health Record Incentive Program published on July 28, 2010 in the Federal Register. The provisions included in the Medicaid section of the proposed rule (which relate to calculation of patient volume and hospital eligibility) would take effect shortly after finalization of this rule, not subject to the proposed 1 year delay for Stage 2 of meaningful use of certified EHR technology. Changes to Stage 1 of meaningful use would take effect for 2013, but most would be optional until 2014.

CMS provides the following Fact Sheet summary of the Stage 2 requirements. The complete proposed rule can be found here and should be published in the Federal Register in the next week. If you are interested in submitting comments to the proposed rule the deadline for submission will be 60 days from the date of publication of the proposed rule in the Federal Register.

SCOTUS Overturns Supreme Court of Appeals of West Virginia Decision on Nursing Home Arbitration Agreements

On February 21, 2012, the U.S. Supreme Court vacated a ruling by the Supreme Court of Appeals of West Virginia in the matter of Marmet Health Care Center, Inc. v. Brown et al., 565 U.S.(2012). The Supreme Court of Appeals of West Virginia previously held that all pre-dispute arbitration agreements that applied to personal injury and wrongful death claims against nursing homes were unenforceable.  In a strongly worded opinion, the U.S. Supreme Court held that the West Virginia court misread and disregarded national precedent and controlling federal law regarding the Federal Arbitration Act. The litigation involved three negligence suits against nursing homes in West Virginia for the care they provided to three separate residents: Clayton Brown, Jeffrey Taylor, and Sharon Marchio. In each of the cases, a family member entered into a binding arbitration agreement on behalf of the resident with the respective nursing home. In all three cases, after the resident died, lawsuits were filed in state circuit courts alleging personal injury and wrongful death against the nursing homes. The Brown and Taylor cases were dismissed by the circuit courts based on the arbitration agreements. The Marchio case was consolidated with the other two cases when it was brought before the West Virginia Supreme Court on a certified question. In a decision concerning all three cases, the West Virginia Supreme Court held that "as a matter of public policy under West Virginia law, an arbitration clause in a nursing home admission agreement adopted prior to an occurrence of negligence that results in a personal injury or wrongful death, shall not be enforced to compel arbitration of a dispute concerning the negligence." Brown v. Genesis Healthcare Corp., No. 35494 (W.Va., June 29, 2011). The West Virginia Supreme Court found unpersuasive the U.S. Supreme Court's prior interpretation of the Federal Arbitration Act, calling it "tendentious" and "created from whole cloth." Brown v. Genesis Healthcare Corp., No. 35494 (W.Va., June 29, 2011). In vacating the West Virginia court's ruling, the U.S. Supreme Court held that the West Virginia court's interpretation of the Federal Arbitration Act was incorrect and inconsistent with its clear instruction and prior precedents. On remand, the West Virginia court was instructed to consider whether, absent the general public policy issue, the arbitration clauses in the Brown and Taylor cases are unenforceable under state common law principles that are not specific to arbitration and preempted by the Federal Arbitration Act. This leaves the possibility that certain arbitration clauses may be invalidated on such general contract grounds, such as fraud, duress, and lack of capacity, to name a few. For additional information you can review the documents filed in the matter the U.S. Supreme Court docket for the Marchio portion of the case. Also, the briefs filed in the Brown, Taylor, and Marchio matters filed before the Supreme Court of Appeals of West Virginia can be found here.   Thanks to Ryan A. Brown, a member of the Flaherty Sensabaugh Bonasso PLLC Health Care Practice Group who represents the defendant nursing home, Clarksburg Nursing & Rehabilitation Center, Inc., in the Marchio matter for the above summary of the decision. Also involved in the case was my partner, Mark Robinson.

HIPAA Privacy Action Filed Against University Health Associates

The West Virginia Record reports the filing of a medical record breach action against West Virginia University Medical Corporation dba University Health Associates (UHA) under the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The action filed in Monongalia Circuit Court was filed by Jennifer M. McGinley on behalf of Randy Friend (11-C-774).

The complaint asserts that Mr. Friend received a letter from UHA indicating that an employee had accessed his medical record without authorization. Mr. Friend claims that his medical record was accessed multiple times by a former UHA employee and that this former employee related the medical information to several other people living in Mr. Friend's community causing him emotional distress and embarrassment.

Also, Jeff Drummond at the HIPAA Blog reports on an interesting lawsuit filed by the Minnesota AG against Accretive Health in Minnesota. The action involves Fairview Health and North Memorial who hired Accretive Health as its debt collection company. Accretive Health lost an unencrypted laptop with medical and other personal information. As Jeff indicates this has some interesting aspects including the question of direct liability of a business associate under the HITECH amendments to HIPAA and also whether the covered entities only disclosed the "minimum necessary" information to its debt collection company. Interesting case to watch develop.

UPDATE: The complaint filed in the United States District Court District of Minnesota, State of Minnesota, by its Attorney General Lori Swanson v.Accretive Health, Inc.

WVHCA: 2012 CON Capital Expenditure Minimum

The West Virginia Health Care Authority has announced the 2012 certificate of need capital expenditure minimum threshold of $2,916,104. The new threshold is effective beginning January 1, 2012. The threshold is used as a part of the analysis by health care providers who must determine whether or not a certificate of need is required for a proposed project or health care acquisition. 

Pursuant to W.Va. Code 16-2D-2(h) and (s), the Authority is required to adjust the expenditure minimum annually and publish an update of the amount on or before December 31 of each year. The expenditure minimum adjustment isbased on the DRI inflation index published in the Global Insight DRI/WEFA Health Care Cost Review. The DRI inflation index as of December 31, 2011 is 2.9%.