We are pleased to present our annual review of developments in the field of health law. The year was marked by key changes in False Claims Act jurisprudence and Medicare payment policy. 2016 also brought with it focused enforcement activity, particularly in the areas of antitrust, health information privacy and security, and fraud and abuse, and particularly with respect to individual actors. Yet, the most significant event in the field had little to do with health law, strictly speaking. The election of Donald Trump, and of Republican majorities in both houses of Congress, portends major changes in federal healthcare policy, which will likely figure prominently in our next annual review.

In an effort to take stock of the year that was and prepare for the challenges that lie ahead, we have compiled a list of 10 important issues that affect a broad range of healthcare industry clients. If you would like to learn more about these or other health law issues, please contact any of the attorneys in the healthcare practice group at Bradley Arant Boult Cummings LLP.

CMS Resolves 60-Day Rule Uncertainty with Long-Pending Final Rule

Following a long period of uncertainty, on February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) finalized regulations to implement the so-called “60-day rule”—i.e., the requirement that healthcare providers report and return Medicare overpayments within 60 days. CMS’s proposed rule had been pending for four years as of the issuance of the final rule, and the underlying statutory rule had been in effect for nearly six years since its addition by the Affordable Care Act.

Between the passage of the Affordable Care Act and the publication of the final rule, providers and others in the healthcare community were largely left to fend for themselves in interpreting high-stakes issues that carry with them potential False Claims Act liability. Uncertainty morphed into alarm when, in August 2015, the U.S. District Court for the Southern District of New York issued an opinion in United States ex rel. Kane v. Continuum Health Partners, Inc. in which it concluded that “the sixty day clock begins ticking when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained.”

To the relief of many, the final rule, which applies to Medicare Parts A and B, provides that the 60-day clock for reporting and repayment begins not on a provider’s notice of a potential overpayment, but on the provider’s identification and quantification of that overpayment. Under the final rule, a provider has identified an overpayment “when [it] has, or should have through the exercise of reasonable diligence, determined that [it] has received an overpayment and quantified the amount of the overpayment.” The final rule goes on to clarify that “reasonable diligence” for these purposes includes both proactive compliance activities and investigations conducted in response to receiving “credible information” of a potential overpayment. CMS also clarifies that these investigations should be completed within six months from the receipt of credible information, except in extraordinary circumstances.

The provider community also welcomed CMS’s position in the final rule that overpayments must be reported and returned only if identified within six years of the date the overpayment was received. CMS had proposed a 10-year lookback period in the proposed rule.

Click here for our in-depth review of the final 60-day rule.

CMS Overhauls Medicare Physician Payment System

CMS moved quickly during 2016 to significantly reform Medicare’s physician payment system as mandated by the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), which was enacted in April 2015. On May 9, 2016, CMS proposed a rule to implement numerous and far-reaching changes to the Medicare physician reimbursement system following the repeal, via MACRA, of the sustainable growth rate methodology for updating physician fee schedule payments. The proposed rule endured considerable criticism from physician groups, who cast the rule as overly complex and potentially punitive to small physician practices that lack resources to make operational changes necessary to succeed under the new payment system. On October 14, 2016, CMS released a final rule on the subject. While CMS took some steps in the final rule to address physicians’ concerns, the new MACRA payment system looms as a daunting challenge to physician practices, particularly small and solo practices.

The final rule creates a two-track payment system designed to implement the goal of moving toward a reimbursement system that encourages quality patient care and efficient resource utilization. Under the first default payment track (known as the Merit-Based Incentive Payment System or MIPS), CMS will consolidate three existing physician quality programs: the Physician Quality Report System; the Physician Value-Based Payment Modifier; and the Medicare Electronic Health Record Incentive Program. Beginning in 2019, CMS will apply a positive or negative adjustment to physician reimbursement based on performance in four categories: (1) quality, (2) clinical practice improvement activities, (3) advancing care information performance, and (4) cost performance.

The second payment track (the Advanced Alternative Payment Model or APM) rewards eligible clinicians for participating in Medicare payment models that emphasize value of care rather than volume of care, such as next generation ACOs, comprehensive ESRD care initiatives, and Medicare shared savings programs. Providers in the APM will be eligible for a lump sum incentive payment of five percent of the prior year’s Medicare Part B payments for each year they retain “qualified provider” status from 2019 through 2024. Beginning in 2026, qualified providers will be reimbursed on a higher physician fee schedule than non-qualified providers.

For a detailed summary of the MACRA final rule, click here.

Supreme Court Upholds Implied Certification Theory of False Claims Act Liability

In June, the U.S. Supreme Court issued a decision that should significantly change the landscape of False Claims Act litigation. In Universal Health Services v. United States ex rel. Escobar, a unanimous Court validated the controversial “implied certification” theory of FCA liability. According to that theory, when a defendant submits a claim for payment to the government, it impliedly certifies compliance with various statutory, regulatory, and contractual requirements that otherwise apply to it. The theory holds that noncompliance with one of those requirements renders the claim “false” even if the defendant actually provided the government the good or service and made no explicit false statement.

Although the Court upheld the implied certification theory, it may have limited it. The decision states that implied certification may be viable “at least where two conditions are satisfied:” (1) a claim makes specific representations about a good or service (as opposed to merely requesting payment), and (2) the defendant’s failure to disclose noncompliance with material statutory, regulatory or contractual requirements makes those specific representations “misleading half-truths.” Since the Escobar ruling, lower courts have disagreed on whether these two conditions are necessary or merely sufficient for implied certification liability. The government has argued that the Supreme Court’s language “at least where two conditions are satisfied” indicates that implied certification may also be applicable in other situations. Defendants have argued that the two conditions are required for liability to attach.

The Supreme Court also emphasized the “demanding” nature of the materiality standard in the False Claims Act. It described the materiality standard as turning on the “likely or actual behavior of the recipient of the alleged misrepresentation” and noted that the government’s past practices in paying such claims are relevant to the determination of whether a misrepresentation is material. The Court further stated that the government’s designation of a requirement as a “condition of payment” is relevant but not dispositive. It remains uncertain how the Court’s description of a “demanding” materiality standard turning on “likely or actual behavior” reconciles with the statutory definition of materiality as “having a natural tendency to influence, or be capable of influencing, the payment or receipt of money or property.” Since the Escobar ruling, lower courts have increasingly grappled with materiality, in some cases expressing a willingness to dismiss cases at the pleading stage where a plaintiff insufficiently alleges materiality.

Click here for our prior coverage of Escobar. For our annual review of False Claims Act developments, click here.

Congress Considers Changes to Stark Law, DOJ Continues String of Settlements

Since its enactment, the Stark Law has been the subject of continuous discussion and debate in the healthcare community. A July 2016 congressional report suggests changes may be afoot. Referring to the Stark Law as a “minefield for the healthcare industry,” the Senate Finance Committee published a whitepaper focused on how to modernize the law to better fit the current healthcare landscape. In the report, the Committee considered key stakeholder perspectives on the Stark Law, focusing on the complexity of the law, the severity of its penalties, and its overall effect on the efforts of Congress and healthcare providers to integrate the delivery of healthcare services. The Stark Law was originally enacted to curb overutilization concerns in the Medicare program, but in light of the current shift from fee-for-service reimbursement to value-based payment methodologies, these concerns are diminishing. The report examines potential reforms to the Stark Law and even considers the possibility of repealing all or a portion of the law. The report suggests expanding the use of Stark Law waivers, reducing the penalties for technical violations, and simplifying the existing definitions and exceptions.

While the Senate pondered the future of the Stark Law, the government continued to enforce it. The DOJ announced a number of significant settlements of Stark Law allegations against health systems, including settlements of $17 million with Lexington Medical Center in West Columbia, South Carolina; $9.9 million with Memorial Health University Medical Center in Savannah, Georgia; and $3.3 million with Tri-City Medical Center in Oceanside, California. The settlements with Lexington Medical Center and Memorial Health University Medical Center also included five-year corporate integrity agreements.

Although the settlement amounts were not as high in 2016 as in years past, the DOJ announced in December that it obtained more than $4.7 billion in settlements and judgements from civil cases involving allegations of fraud and false claims in its fiscal year 2016, representing the third highest annual recovery in FCA history. These settlements reflect the DOJ’s continuing commitment to using the FCA to enforce the Stark Law and reemphasize its view that arrangements that violate the Stark Law compromise physician independence.

Government Increases Pursuit of Individuals for Corporate Wrongs

In a memo from Deputy Attorney General Sally Quillian Yates on September 9, 2015, the Department of Justice announced a number of policy directives and clarifications with regard to increasing focus on prosecuting individual employees alongside corporations for corporate wrongdoing, including in civil False Claims Act investigations. In 2016, the healthcare industry began to see the ramifications of this policy shift:

• On September 19, the Department of Justice entered into a $30 million settlement with North American Health Care, Inc. and two executives in connection with allegations that the company provided medically unnecessary rehabilitation services. As part of the settlement, the company’s Chairman of the Board will pay $1 million and the Senior Vice President of Reimbursement Analysis will pay $500,000.
• On September 27, Tuomey Healthcare System’s former CEO agreed to a $1 million payment and a four-year exclusion from participation in federal healthcare programs in connection with alleged Stark Law violations involving his hospital. This settlement followed a $237.4 million judgment against the hospital for improper financial relationships and the resulting sale of the hospital to a nearby health system.
• On October 24, the government entered into a $145 million settlement agreement with Life Care Centers of America Inc. and its owner in connection with allegations that the company provided medically unnecessary rehabilitation services. The government’s press release explicitly noted that the settlement resolved separate allegations against the owner that he had been unjustly enriched by the conduct.

Deputy Attorney General Yates stated recently that she expects “in coming months and years, when companies enter into high-dollar resolutions with the Justice Department, you’ll see a higher percentage of those cases accompanied by criminal or civil actions against the responsible individuals.” Yates also noted that she does not expect this new policy directive to be affected by the change in political administration.

CMS Implements Site-Neutral Payment Policies

The Bipartisan Budget Act of 2015 initiated a change in Medicare hospital payment policy that continued to play out this year. After the Act was enacted on November 2, 2015, it was unclear how the provisions of Section 603, which addressed site-neutral payment of hospital outpatient departments, would be implemented by CMS. Section 603 required that newly created off-campus hospital outpatient departments no longer be paid under the Outpatient Prospective Payment System (OPPS) beginning in 2017. However, the provision excluded from its ambit those departments billing Medicare for covered services furnished prior to the enactment of the Act. Thus, off-campus provider-based departments (PBDs) in operation prior to November 2, 2015, received “excepted” status and will continue to be paid under the OPPS, but new, or “non-excepted,” off-campus PBDs are only eligible for such reimbursement until January 1, 2017, at which time they are to be paid under an applicable payment system.

CMS implemented Section 603 through its annual OPPS rulemaking process. Importantly, the agency defined the “applicable payment system” for non-excepted items and services. Beginning January 1, 2017, the Physician Fee Schedule is the applicable payment system for the vast majority of items and services furnished in non-excepted off-campus PBDs. Hospitals are to identify these items and services with a new claim line modifier, and the Medicare program generally will pay for these items and services at a rate equal to half of the OPPS rate.

In addition to defining the payment methodology for items and services furnished in non-excepted PBDs, the final rule made another significant departure from CMS’s earlier proposed rule. CMS had proposed that an excepted off-campus PBD would continue to be paid under the OPPS only for the items and services it was furnishing prior to November 2, 2015, but could not expand its services into additional “clinical families of services” and continue to be paid under OPPS for those expanded services. In the final rule, CMS declined to finalize this proposal, allowing an excepted off-campus PBD to receive payments at the OPPS rate for all items and services, regardless of whether it furnished those types of items and services prior to November 2, 2015.

Although these changes from the proposed rule provided some relief to hospitals, CMS did finalize several of the restrictions on PBDs it proposed. With one limited exception, an excepted off-campus PBD will lose excepted status if it relocates from the physical address—including the unit or suite number—listed on the hospital’s Medicare enrollment form as of November 1, 2015. In addition, individual excepted PBDs cannot be transferred from one hospital to another and maintain excepted status. In fact, when a hospital undergoes a change of ownership, the excepted status of an off-campus PBD will only be retained by the new owner only if the new owner accepts assignment of the former owner’s Medicare provider agreement.

For more information about CMS’s final rule, click here.

CMS Significantly Revises Long-term Care Requirements

On October 4, 2016, CMS published its final rule reforming the requirements for long-term care (LTC) facilities participating in Medicare and Medicaid. The final rule is the first major overhaul of LTC facility regulation in 25 years and impacts over 15,000 facilities providing LTC services to more than 1.5 million residents. Writing in response to evolving standards of care, a more diverse and clinically complex LTC resident population, and the agency’s increasing focus on higher-quality, higher-efficiency care, CMS adopted—and rejected—several proposed provisions that garnered extensive commentary from industry stakeholders and patient groups.

Notable among these choices was the agency’s highly publicized decision to prohibit nursing homes from requiring residents, as a condition of admission, to sign agreements limiting the resident to binding arbitration to address any disputes that may arise during his or her stay. Other key provisions bolstering residents’ rights included a requirement that LTC facilities investigate and report all allegations of abuse and neglect and a limitation on facilities’ ability to hire individuals with prior abuse or neglect actions on their professional record.

Elsewhere in the rule, CMS rejected a proposed provision that would have required a physician or mid-level practitioner to examine a resident in person before the resident could be transferred to a hospital. The measure was intended to avoid unnecessary hospitalizations, but industry stakeholders argued it would be logistically impractical for small and rural facilities. CMS also declined to adopt a new regulation governing outpatient rehabilitation services offered by LTC facilities, electing instead to wait until the particulars of such arrangements could be evaluated more thoroughly.

Other major developments CMS adopted in the final rule included requiring facility staff members to receive proper training on caring for residents with dementia and preventing elder abuse; ensuring that facilities maintain the level and distribution of staffing appropriate for the needs of their residents; creating a new “comprehensive person-centered care planning” initiative through which facilities will develop care plans for residents that take into account the resident’s goals and preferences; improving care planning—particularly discharge planning—for all residents with the involvement of the resident’s interdisciplinary care team; granting dieticians and therapy providers authority to write orders related to their respective areas of expertise; and updating infection prevention and control programs. Many of the key provisions of the final rule became effective November 28, 2016.

See our earlier coverage of the final rule here.

FTC Losses on Hospital Mergers Prompt New Focus on Geographic Markets

The Federal Trade Commission (FTC) suffered a series of losses—and some critical rebounds—in its federal court challenges to hospital mergers this year. In late 2015, the FTC filed actions to block three different proposed hospital mergers: PinnacleHealth and Penn State Hershey Medical Center in Harrisburg, Pennsylvania; NorthShore University HealthSystem and the Advocate Health Care Network in Chicago, Illinois; and St. Mary’s Medical Center and Cabell Huntington Hospital in Huntington, West Virginia. By mid-2016, the agency had lost in federal district court on both the Harrisburg and Chicago mergers and had withdrawn its challenge to the Huntington merger, thanks in large part to a state law specifically designed to block its efforts. By the end of the year, the Commission had prevailed on the appellate court level on both the Harrisburg and Chicago mergers, but further state action threatens to prevent similar FTC victories in 2017.

The Harrisburg and Chicago mergers share a similar trajectory. In late 2015, the FTC challenged both proposed mergers under Section 7 of the Clayton Act, arguing that the mergers would substantially lessen competition. In both cases, the parties disagreed on the relevant geographic market for the hospitals’ services, and therefore the impact the proposed merger would have on that market for purposes of competition. In both cases, the district court sided with the hospitals, citing the volume of patients that regularly traveled in and out of the hospitals’ locales as evidence that the geographic market could sustain the merger without lessening competition. And, in both cases, the appeals court rejected the district court’s analysis. Within a month of each other, the Third and Seventh Circuits held that the appropriate tool to define the relevant geographic market is the “hypothetical monopolist test,” under which the key question is whether a hypothetical monopolist in the proposed geographic market could impose a small price increase without losing so many sales to suppliers outside the proposed geographic market that the price increase would become unprofitable for the hypothetical monopolist. While the fate of the particular mergers may differ—the Harrisburg hospitals have abandoned their merger plans, while the Chicago hospitals are set to resume battle in district court—the appeals courts’ adoption of the hypothetical monopolist test will guide future merger plans and FTC challenges to the same.

By contrast, the Huntington merger battle started out very much like its Harrisburg and Chicago counterparts, but diverged abruptly when the West Virginia legislature passed a new state law designed to protect the merger. Under the law, the state’s Health Care Authority now holds the power to approve or reject such cooperative agreements between healthcare providers. The Authority explicitly approved the Huntington hospitals’ proposed merger agreement, removing it from the FTC’s regulatory grasp and ensuring the agency would face an uphill climb should it proceed with its efforts. The FTC dismissed its complaint without prejudice in July 2016 and issued a statement that the case “presents yet another example of healthcare providers attempting to use state legislation to shield potentially anticompetitive combinations from antitrust enforcement.”

The FTC may see similar successes and failures in 2017. The NorthShore-Advocate merger will continue its way through the federal courts in Chicago. Meanwhile, the Tennessee Department of Health and the Southwest Virginia Health Authority are reviewing a proposed merger between Mountain States Health Alliance and Wellmont Health System on the Tennessee-Virginia border. If the agencies approve the hospitals’ application for a certificate of public advantage, it may effectively prevent the FTC’s intervention in the merger.

HIPAA Enforcement Heats Up

2016 was a banner year for the Office for Civil Rights (OCR) in HIPAA enforcement, with more settlements and a bigger haul than ever before. In all, OCR published 13 resolution agreements requiring total payment of over $23.5 million, or an average of more than $1.8 million per settlement. By comparison, from the April 2003 effective date of the HIPAA privacy rule through the end of 2015, OCR entered into 29 settlements totaling approximately $28 million.

Among these settlements was a $5.55 million settlement—the largest to date—with Advocate Health Care Network, a large nonprofit health system based in the greater Chicago area. The settlement resulted from three separate breach notification reports submitted by Advocate on behalf of one of its subsidiaries. Two of the incidents involved stolen computers; the third involved unauthorized access to the network of a subcontractor billing company. In all, the three incidents involved the electronic-protected health information of approximately four million individuals, including names, addresses, dates of birth, credit card numbers with expiration dates, demographic information, clinical information, and health insurance information.

Through its investigation, OCR determined that Advocate failed to comply with HIPAA in a variety of ways. Notably, the settlement agreement highlighted Advocate’s alleged failure to conduct an accurate and thorough risk analysis that included all of its facilities and systems using electronic-protected health information—an issue that OCR has raised time and again in its enforcement actions. In its press release announcing the settlement, OCR cited the extent and duration of the alleged noncompliance (dating back to the inception of the HIPAA security rule in some cases) as factors contributing to the record-breaking penalty. OCR also highlighted the involvement of the Illinois Attorney General in a corresponding investigation, the large number of individuals whose information was affected, and the size of Advocate.

In addition to high-profile settlements, OCR undertook several efforts aimed at improving compliance, including an initiative to more widely investigate the root causes of small breaches (i.e., those affecting fewer than 500 individuals) and the second phase of its audit program. OCR also provided industry guidance on several rapidly evolving issues, including ransomware and cloud computing.

Click here for our prior coverage of HIPAA enforcement actions, including the Advocate settlement.

Election Results Portend Significant Changes in Healthcare Policy

Lastly, the election of Donald Trump and Republican majorities in both houses of Congress has created substantial uncertainty regarding future federal healthcare policy. The new government leaders have already begun efforts to repeal the Affordable Care Act: On January 12, the Senate approved a budget establishing a process to repeal the Act, and on January 20, President Trump signed an executive order instructing federal agencies to “waive, defer, grant exemptions from or delay the implementation of any provision or requirement of the Act that would impose a fiscal burden on any State or a cost, fee, tax, penalty, or regulatory burden on individuals, families, healthcare providers, health insurers, patients, recipients of healthcare services, purchasers of health insurance, or makers of medical devices, products, or medications.” The breadth of the order, combined with differing accounts of what, if any, measures would replace a repealed Affordable Care Act, have left industry stakeholders paralyzed. While it is difficult to predict the specific impact of these steps, their message is clear: U.S. healthcare is about to change dramatically.