Indiana Law Review


Survey of Recent Developments in
Health Care Law

Hall, Render, Killian, Heath & Lyman, P.C.

Introduction

Arguably, no other period since the adoption of the Social Security Act in

1965 has seen more developments in health care law than 2009-10. Health care

is always an evolving and changing body of law at both the state and federal

levels. But 2010 saw President Obama sign the Patient Protection and
Affordable Care Act into law—a truly sweeping change in our nation's health
care system. Although not an exhaustive review, this Survey summarizes many
of the recent and more significant developments in various areas of health law,
including fraud and abuse, labor and employment, tax, health information

technology, and privacy rights.

I. Health Care Reform

The Patient Protection and Affordable Care Act' and the Health Care and
Education Reconciliation Act of 2010^ are the result of a decade-long effort by

various interests to reform the United States health care system (referred to

collectively as the "PPACA"). In what began life as a campaign promise of
President Obama, then taking on several iterations before being signed into law
on March 23, 2010, the PPACA is a true behemoth of federal legislation.
Generally speaking, the PPACA was designed to target the areas ofaccess, cost,
and quality.^

Although the legislative process for such expansive legislation may have
outwardly seemed efficient given the compressed time period in which the

PPACA was adopted, it was not without controversy. Namely, there was
significant dispute regarding whether there would be a public health insurance
option, how health insurance exchanges would be structured, concerns over
federal funding for abortion coverage, and the use of circuitous parliamentary

* The following Hall, Render, Killian, Heath & Lyman attorneys contributed to the research
and drafting ofthis Survey Article: Michael T. Batt, Brian C. Betner, Calvin R. Chambers, Kendra

L. Conover, Thomas M. Donohoe, Natalie L. Dressel, Erin M. Drummy, Ammon R. Fillmore,
Robin E. Ludlow, Colleen M. Powers, Jeff W. Short, Mark J. Swearingen, and Allison L. Taylor.

1

.

Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1 - 1 48, 1 24 Stat. 1 1 9 (20 1 0)

(to be codified at 42 U.S.C. §1320a-7a).

2. Health Care and Education Reconciliation Act of 2010, Pub. L. No. 1 1 1-152, 124 Stat.

1029.

3. While the cited policy and legislative bases are numerous, the Obama administration

generally touts the laws as giving all Americans "better health security by putting into place

comprehensive health insurance reforms that help to hold insurance companies accountable, lower

health care costs, guarantee more choice, and enhance the quality ofcare for all Americans." U.S.

Dep't. of Health & Human Servs., The Affordable Care Act—What It Means for You 1
(2010), available at http://www.healthcare.gov/center/brochures/for_you.pdf



1288 INDIANA LAW REVIEW [Vol. 44: 1287

procedure. In the end, the PPACA was adopted relying solely on Democrat
support."^

The PPACA contains significant expansions of health care access and
insurance coverage for most Americans and adds numerous provisions that
address federal health care program integrity and reimbursement restructuring.

While this survey focuses on many developments in health care law (as they may
impact providers), many provisions of the law reach beyond providers.^
Significant provisions include the following:

(1) increased access and coverage to health care through various

insurance market reforms ranging from a prohibition on lifetime

coverage limits, insurance rescission, and preexisting condition

exclusion;^

(2) creation ofAmerican Health Benefit Exchanges and Small Business
Health Options Program Exchanges in each state to facilitate

individual and small employers to purchase qualified health plans;
''

(3) penalties for individuals who fail to have minimum essential health
insurance coverage for themselves or their dependents;^

(4) significant expansion of individuals eligible for coverage under

Medicaid;^

(5) accelerated Medicare and Medicaid reimbursement reform;
^^

(6) narrowed definition of the so-called Medicare Part D drug benefit
"donuthole'V

(7) significant improvements in health care workforce development;^^

and

(8) enhancement and extension of the federal government's fraud and

abuse capabilities and providers' program integrity obligations.^^

As may be expected with legislation that is both far-reaching and controversial,
many legal challenges followed the PPACA's enactment. During the preparation
of this Survey, no fewer than twenty seven states sued or joined in litigation

4. See U.S. Senate Roll Call Votes 11 1th Congress—1st Session, U.S. SENATE, http://www.
senate.gov/legislative/LIS/roll_call_lists/roll_call_vote_cfm.cfm?congress=lll&session=l&vot

e=00396 (last visited Aug. 2, 201 1) (showing voting summary for the PPACA).

5. Given the scope and breadth of the PPACA, this Survey focuses on many of the more

significant provisions that impact health care providers of all types and does not discuss many

provisions within the PPACA such as insurance market reform, affordability ofcoverage, Medicare
Part D improvements, disease prevention, and wellness, among others.

6. See generally Patient Protection and Affordable Care Act §§ 1 101-05.

7. Id. §§ 1301-43.

8. Id. §§ 1501-15.

9. Id. §§ 2001-07.

10. Id §§2001-07,3001-27.

11. Id §§2301-04.

12. Id §§ 5001-701.

13. Id §§6001-801.



2011] HEALTH LAW 1 289

against the federal government challenging the constitutionality of

PPACA—with others, including the U.S. Supreme Court, expected to also
intervene.

^"^
Constitutional scholars appear to be evenly split on the merits and

likelihood of success of these challenges, which are based substantially on

whether the individual mandate to obtain minimum essential health insurance
coverage is constitutional.

IL Fraud & Abuse

A. Expansion ofthe False Claims Act

2009 ushered in many changes to health care fraud and abuse laws, the most
significant ofwhich can be found in the federal False Claims Act (FCA).^^ The

FCA is the most widely utilized enforcement tool of the Department of Justice.
On May 20, 2009, the strength of the FCA was enhanced by the passage of the
Fraud Enforcement and Recovery Act (FERA).^^ Some of the key impacts that
FERA had on the FCA include:

1. Obligation to Repay.—Before the passage of FERA, there was much
debate over what constituted an obligation to repay funds. FERA clarifies that
failure to repay any known overpayment constitutes a false claims violation. ^^

The PPACA further clarified what constitutes an obligation to repay by defining
"obligation" to require the return of all known overpayments within sixty days
of the identification of the overpayment.'^

2. Reverse False Claim.—One of the most significant changes ofFERA is
the establishment of the "reverse false claim." Ignoring or decreasing an

obligation to repay monies owed to the government now constitutes a false
claim.

'^

3. Request for Payment Does Not Need to Be Submitted Directly to the
Government.—FERA clarifies that a party does not need to submit a claim
directly to, or deal directly with, the federal government in order to trigger a

violation ofthe FCA. Rather, the FCA is triggered whenever a person knowingly
makes a false claim to obtain money or property—any part ofwhich is provided
by the government—^without regard to whether the wrongdoer deals directly with
the federal government, with an agent acting on the government's behalf, or with

a third-party contractor, grantee or other recipient of such money or property.^^
Previously, a claim needed to be presented to an officer or employee of the

14. See Florida ex rel. Bondi v. U.S. Dep't of Health & Human Servs., No. 3:10-CV-91-
RV/EMT, 2011 WL 723117 (N.D. Fla. Mar. 3, 2011); see also Virgina ex rel Cuccinelli v.
Sebelius, 728 F. Supp. 2d 768 (E.D. Va. 2010).

15. False Claims Act, 3 1 U.S.C. §§ 3729-3 1 (West, Westlaw through 201 1 legislation).

16. Fraud Enforcement and Recovery Act of 2009, Pub. L. No. 1 1 1-121, 123 Stat. 1617.

17. 31 U.S.C. § 3729(b)(l)-(3) (West, Westlaw through 201 1 legislation).

18. Patient Protection and Affordable Care Act § 1 128J(d)(2).

19. 31 U.S.C. § 3729(a)(1)(G).

20. Id. § 3729(a)(1)(D).



1290 INDIANA LAW REVIEW [Vol. 44: 1287

federal government in order for the FCA to be triggered. It remains to be seen
how far downstream the government will reach into a financial relationship
involving federal funds to allege a violation of the FCA.

4. Eliminating the Defenses.—As indicated above, prior to the enactment of
FERA, a claim needed to be submitted directly to the federal government in order
for the FCA to be triggered. The requirement that the claim be submitted directly
to the government served as the basis for the intent requirement in the U.S.

Supreme Court decision Allison Engines Co. v. United States ex rel. Sanders?-^
FERA clarifies that a statement only needs to have a "natural tendency to
influence, or be capable of influencing,"^^ the payment of government funds.

5. Whistleblower Protections.—The whistleblower protections under the
FCA were greatly expanded to cover not only employees, but also contractors or
agents. Specifically, 31 U.S.C. § 3730(h) now provides that

[a]ny employee, contractor, or agent shall be entitled to all relief

necessary to make that employee, contractor, or agent whole, if that
employee, contractor, or agent is discharged, demoted, suspended,

threatened, harassed, or in any manner discriminated against in the terms
and conditions of employment because of lawful acts done by the
employee, contractor, agent, or associated others in furtherance of an

action under this section or other efforts to stop . . . [one] or more

violations . . . }^

This revision goes to the underlying purpose of FCA, which is to foster the
disclosure of fraud and abuse.^"^

There are still many open issues with regard to how the FCA will be
interpreted. For example, FERA does not establish when a payment becomes a
"known" overpayment, prompting the following question: is it the point when
the parties discover the potential overpayment? Further, if due to a Stark

violation, is it when the potentially noncompliant relationship is discovered, or
is it after the parties complete their research and affirmatively conclude that a

Stark violation occurred? Additionally, the process for establishing a repayment

has not yet been determined.

B. OIG 'S Exclusionary Authority

Under Section 1 128 ofthe Social Security Act (SSA), the Office ofInspector

General (DIG) has the ability to exclude entities and individuals from

participating in federal health care programs via mandatory and permissive

21. 553 U.S. 662, 668 (2008) ("Eliminating this element of intent, as the [c]ourt of [a]ppeals

did, would expand the FCA well beyond its intended role of combating 'fraud against the
[gjovemment.'").

22. False Claims Act, 3 1 U.S.C. § 3729(b)(4) (West, Westlaw through 201 1 legislation).

23. 31 U.S.C. § 3730(h)(1) (2010).

24. See, e.g.. Why the False Claims Act?, FALSE CLAIMSACTLEGALCtr., http://www.taf.org/

whyfca.htm (last visited Aug. 2, 201 1).



2011] HEALTH LAW 1291

exclusionary authority.^^ The SSA identifies criteria that, ifmet, are grounds for
exclusion from participation in federal health care programs.^^ Mandatory

criteria generally include convictions ofpatient abuse or neglect, felonies relating

to health care fraud, and criminal offenses related to Medicare or state health care

programs.^^ The permissive criteria under the SSA give the OIG the ability to
exclude individuals and entities for a number ofreasons.^^ The PPACA expands
the list of permissive criteria that may be considered, as outlined below.

First, a new subsection was added to 42 U.S.C. 1320a-7(b), permitting the
OIG to exclude

[a]ny individual or entity that knowingly makes or causes to be made any
false statement, omission, or misrepresentation of a material fact in any

application, agreement, bid, or contract to participate or enroll as a

provider of services or supplier under a Federal health care program . .

. and entities that apply to participate as providers of services or

suppliers in such managed care organizations and such plans.^^

Section 1128(c)(3)(B) of the SSA addresses when an exclusion may go into
effect. It also outlines the duration of the exclusion and grants the Secretary of

Health and Human Services (the "Secretary") the ability to grant a waiver
exclusion under certain circumstances.^^ Prior to the PPACA, this section
waived the provider's exclusion if it could be demonstrated that the exclusion

would impose a hardship on beneficiaries under Medicare Parts A or B.^' Now,
the exception applies if the exclusion would impose hardship on beneficiaries
under any federal health care program,^^ thus broadening the exclusion exception.

Section 1 128(b)(l 1) of the SSA formerly allowed the Secretary to exclude

[a]ny individual or entity furnishing items or services for which payment
may be made under subchapter XVIII of this chapter or a State health
care program that fails to provide such information as the Secretary or

the appropriate State agency finds necessary to determine whether such

payments are or were due and the amounts thereof, or has refused to
permit such examination of its records by or on behalf of the Secretary
or that agency as may be necessary to verify such information.^^

The PPACA broadens the scope of this statute to apply not only to the entity

25. 42 U.S.C. § 1320a-7 (2010).

26. Id. § 1320a-7(a)(l)-(4).

27. Id.

28. Id § 1320a-7(b)(lH16).

29. Id. § 1320a-7(b)(16); see also Patient Protection and Affordable Care Act, Pub. L. No.

1 1 1-148 § 5001-701, 124 Stat. 1 19 (2010) (to be codified at 42 U.S.C. § 1320).

30. 42 U.S.C. § 1320a-7(c)(3)(B).

31. See John T. Brennan, Jr. &Robert G. Homchick, FraudandAbuse in HealthCare
Reform 2-3 (2010).

32. Patient Protection and Affordable Care Act § 6402(k).

33. 42 U.S.C. § 1320a-7(b)(ll) (2006).



1292 INDIANA LAW REVIEW [Vol. 44: 1287

furnishing the service, but to persons "ordering, referring for furnishing, or

certifying the need for items or services for which payment may be made" under
a federal or state health care program.^"^ This amendment is effective for any
referrals, orders, and certifications made on or after January 1, 2010.^^

Section 6408(c) of the PPACA amended 42 U.S.C. § 1320a-7(b)(2) of the
SSA, which gives the OIG the ability to exclude an "individual or entity that has
been convicted, under Federal or State law, in connection with the interference

with or obstruction ofany investigation" into a criminal offense related to health

care fraud, or those activities that constitute grounds for mandatory exclusion.^^

This provision was revised to apply not only to criminal investigations, but also
to investigations regarding the "use offunds received, directly or indirectly, from

any Federal health care program."^^

C. Stark Law Update

The federal Stark Law prohibits a physician from making a referral to an
entity for the furnishing of certain "designated health services" (DHS) ^^ for
which payment may be made under Medicare ifsuch physician (or the immediate
family member of such physician) has a "financial relationship" with the DHS
entity, unless an exception applies.^^ Further, the DHS entity may not bill
Medicare for DHS furnished pursuant to a prohibited referral, unless one of the
Stark exceptions applies.

"^^

1. Overview.—^As part of the PPACA, the Centers for Medicare and
Medicaid Services (CMS) recently released final regulations implementing
several changes to the federal Stark Law. First, the PPACA amended the Stark
Law to further restrict the ability ofphysicians to own an interest in hospitals to
which they refer. "^^ Second, the PPACA amended the Stark Law's in-office
ancillary services exception by adding new patient disclosure requirements."^^
The PPACA also established a new "self-referral disclosure protocol" for actual
or potential Stark Law violations."^^

2. Changes to Physician-OwnedHospital Exceptions.—Section 600 1 (a)(3)
ofthe PPACA recommended a new § 1 877(i) to the SSA, imposing a number of

34. Patient Protection and Affordable Care Act § 6406(c).

35. M§ 6406(d).
36. 42 U.S.C. § 1320a-7(b)(2) (2010).

37. Patient Protection and Affordable Care Act § 6408(c).

38. 42 U.S.C. § 1395nn(h)(6) (West, Westlaw current through 201 1). The term "designated

health services" includes such items as radiology, clinical laboratory services, physical and

occupational therapy services, inpatient and outpatient hospital services, and durable medical

equipment and supplies. Id.

39. See generally id.

40. Id.

4 1

.

Patient Protection and Affordable Care Act § 600 1

.

42. /J. §6003.

43. Id. § 6409(a)(1).



2011] HEALTH LAW 1293

new requirements for a hospital to meet in order to qualify for an exception to the
prohibition of physician ownership of rural providers and hospitals."^"^ Most

notably, this addition prohibits expansion ofphysician-owned hospitals that rely

on the "whole hospital" or "rural provider" exceptions in order to comply with

the law."*^ CMS recently issued the final regulations implementing these changes
to the "whole hospital" and "rural provider" exceptions."^^ Hospitals must be in

compliance with the requirements below no later than September 23, 201 1."^^

Notably, the PPACA provided for requirements to be put into place that would
permit expansion of certain applicable hospitals and high-Medicaid facilities to

be implemented by August 1, 2011,"*^ but CMS has not yet issued final
regulations implementing such requirements.

a. General requirements.—The following general requirements have
accompanied the changes to this portion of the law:

(1) The hospital must have been physician-owned as of December 31,
2010 with a valid Medicare provider agreement in effect as of such

date."'

(2) The hospital is not permitted to increase the number of operating
rooms, procedure rooms, and beds beyond the number for which it was
licensed as of March 23, 2010 (or, in the case of a hospital that did not
have a provider agreement in effect after such date but before December
31, 2010, the effective date of such agreement).^^ "Procedure room
means a room in which catheterizations, angiographies, angiograms, and
endoscopies are performed, except such term shall not include an

emergency room or department (exclusive of rooms in which
catheterizations, angiographies, angiograms, and endoscopies are

performed)."^
^

(3) The hospital cannot have previously operated as an ambulatory
surgical center and converted to a hospital on or after March 23, 2010.^^

b. Conflicts of interest.—To address conflicts of interest, the following
changes were also proposed:

44. /J. § 6001(a)(3).

45. Id.

46. See Regulations Ensuring Bona-Fide Investment, 75 Fed. Reg. 72,249, 72,249-56 (Nov.

24, 2010); Exceptions to the Referral Prohibition Related to Ownership or Investment Interests, 75

Fed. Reg. 72,260, 72,260 (Nov. 24, 2010) (citing 42 C.F.R. § 41 1.356(3)(iv) (201 1)).

47. Exceptions to the Referral Prohibition Related to Ownership or Investment Interests, 75

Fed. Reg. at 72,260.

48. Patient Protection and Affordable Care Act § 6001(a)(3)(A)(iii).

49. Additional Requirements Concerning Physician Ownership and Investment in Hospitals,

75 Fed. Reg. 72,260, 72,260 (citing 42 C.F.R. § 41 1.362(b)(1)).

50. Id. (citing 42 C.F.R. § 41 1.362(b)(2)).

51. Id (citing 42 C.F.R. § 411.362(a)).

52. Id at 72,261(citing 42 C.F.R. § 41 1.362(b)(6)).



1294 INDIANA LAW REVIEW [Vol. 44:1287

(1) In order to protect patients from a potential conflict of interest

arising from ownership by referring physicians, CMS will require each
hospital to submit a report on an annual basis describing the identity of
ownership and the nature and extent of all physician ownership in the

hospital.

(2) Not later than September 23, 2011, the hospital must require
physician-owners to disclose in writing to patients referred to the

hospital such ownership or investment interest in the hospital as a

condition of medical staff membership. Such disclosure shall also

include, if applicable, the ownership or investment interest of any

treating physician. The required disclosure must be made at such time
as to provide the patient the opportunity "to make a meaningful decision
regarding the receipt of care" from such physician and hospital.^^

(3) The hospital cannot condition physician ownership or investment
directly or indirectly on the physician "making or influencing referrals

to the hospital or otherwise generating business for the hospital.
"^"^

(4) Not later than September 23, 2011, the hospital must provide
disclosure of its physician ownership on the hospital website and in any

public advertising.^^

c. Ensuring bona fide investment.—In order to show that a bona fide
investment by physician-owners exists, the following criteria must be met:

(1) There may be no increase in the aggregate percentage of physician
ownership or investment in the hospital (or in an entity whose assets
include the hospital) from the percentage that existed as of March 23,
2010.'^

(2) A hospital may not offer ownership or investment in the hospital to
a physician on more favorable terms than those which would be offered
to non-physicians."

(3) The hospital (or any owner or investor in the hospital) does not
provide loans or financing for investment in the hospital by a

physician.^^

(4) The hospital (or any owner or investor in the hospital) does not
guarantee a loan or make a payment toward a loan for any individual
physician or group of physicians if the loan is geared toward acquiring

any ownership or investment interest in the hospital.
^^

(4) Distributions are made to owners or investors in the hospital in an

53. Id. (citing 42 C.F.R. § 41 1.362(b)(3)(ii)(A)).

54. Id. (citing 42 C.F.R. § 41 1.362(b)(3)(ii)(B)).

55. Id. (citing 42 C.F.R. § 41 1 .362(b)(3)(ii)(C) (201 1)).

56. Id (citing 42 C.F.R. § 41 1.362(b)(4)(i)).

57. Id (citing 42 C.F.R. § 41 1.362(b)(4)(ii)).

58. Id (citing 42 C.F.R. § 41 1.362(b)(4)(iii)).

59. Id (citing 42 C.F.R. § 41 1.362(b)(4)(iv)).



2011] HEALTH LAW 1295

amount that is "directly proportional to the ownership or investment

interest of such owner or investor in the hospital."^^

(5) Physician owners or investors do not receive a guaranteed receipt of

or right to purchase other business interests related to the hospital, such

as real property.^^

(6) "The hospital does not offer a physician owner or investor the

opportunity to purchase or lease property ... on more favorable terms

than the terms offered to an individual who is not a physician."^^

d. Patient safety.
^^—With patient safety becoming an ever-increasing

concern, the regulations address the issue as follows:

(1) Effective September 23, 201 1, if a physician is not available on site

at the hospital during all hours in which the hospital is providing patient

care services, the hospital must disclose this information to the patient.

Such disclosure (and written acknowledgement of the receipt of the

disclosure by the patient) must be received prior to providing services to

the patient.
^"^

(2) Effective September 23, 201 1, the hospital must have the capacity

to provide initial assessments and treatment for patients, and it must have

made arrangements to refer or transfer patients who require other
services not provided by that hospital.^^

3. Physician Disclosure Requirements for MRI, CT, and PET.—Section
6003 of the PPACA amended the federal Stark Law statutory exception for in-
office ancillary services to require physicians to provide patients with written

notice, at the time ofthe referral for certain imaging services, that such services

may be obtained by a person or entity other than the physician or that physician's
group. Such imaging services include magnetic resonance imaging (MRI),

computed tomography (CT), and positron emission tomography (PET), as well

as other DHS as designated by the Secretary of Health and Human Services.^^
The PPACA further requires a referring physician to provide a list of alternate
suppliers who provide these imaging services in the local area.^^ CMS recently
issued the final regulations implanting these changes to the in-office ancillary

services exception, effective January 1, 201 1.^^

60. Id. (citing 42 C.F.R. § 41 1.362(b)(4)(v)).

61. Id. (citing 42 C.F.R. § 41 1.362(b)(4)(vi)).

62. Id (quoting 42 C.F.R. § 41 1.362(b)(4)(vii)).

63. Id (citing 42 C.F.R. § 41 1.362(b)(5)).

64. Id (citing 42 C.F.R. § 41 1.362(b)(5)(i)).

65. Id at 72,260-61 (citing 42 C.F.R. § 41 1.362(b)(5)(ii)).

66. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148 § 6003(a), 124 Stat. 1 19

(2010).

67. Id

68. Disclosure Requirements for In-Office Ancillary Services Exception to the Prohibition

on Physician Self-Referral for Certain Imaging Services, 75 Fed. Reg. 73,443, 73,443 (Nov. 29,



1 296 INDIANA LAW REVIEW [Vol. 44: 1 287

a. Services triggering disclosure.—As noted above, the PPACA provided
that the new disclosure requirements apply to MRI, CT, and PET services as well
as such other radiology or imaging services as the Secretary determines

appropriate.^^ CMS declined to expand the list ofservices in the final regulations
and limited the disclosure requirements to MRI, CT, and PET services that are
"identified as 'radiology and certain other imaging services' on the [l]ist ofDHS
CPT/HCPCS [c]odes."''

b. Form/timing of notice.—The required notice "should be written in a
manner sufficient to be reasonably understood by all patients" and be given to the

patient "at the time of the referral."^' Importantly, there is no exception to the

disclosure requirement for MRI, CT, or PET services furnished on an
"emergency or time-sensitive" basis.^^ Where there are subsequent referrals for
advance imaging services by such physician, separate notices must be provided

to the patient.^^ If the referrals are by phone, the obligation to provide a written

disclosure still exists, but it may be mailed or emailed to the patient once the
patient has been notified verbally.

'''^

The notice must indicate to the patient that the services may be obtained from
a person or entity other than the referring physician or physician's group practice

and include a list of other suppliers who provide the service being referred.^^
c. Types andnumber ofsuppliers.—Suppliers must be "located within a 25-

mile radius of the physician's office at the time of the referral" regardless of

whether the office is in an urban or rural area, and the list must include no fewer

than five alternative suppliers.^^ If there are not five other suppliers in the 25-

mile radius, the physician must supply a list of all alternative imaging services

providers within such area^^ If there are no qualifying suppliers within this

radius, the physician is not required to provide a list, but he must still notify the

patient that the services may be provided by another supplier, and he must

2010); Financial Relationships Between Physicians and Entities Furnishing Designated Health

Service, 75 Fed. Reg. 73,616, 73,616 (Nov. 29, 2010) (citing 42 C.F.R. § 41 1.355).

69. Patient Protection and Affordable Care Act § 6003(a).

70. General Exceptions to the Referral Prohibition Related to Both Ownership/Investment

and Compensation, 75 Fed. Reg. at 73,616 (citing 42 C.F.R. ^A\\.?>55{h){l)i\))',seealso Code List

for Certain Designated Health Services (DHS), Ctrs. FOR MEDICARE & MEDICAID Servs.,
http://www.cms.gOv/PhysicianSelfReferral/40_List_of_Codes.asp#TopOfPage (last visited Aug.

3,2011).

7 1

.

Disclosure Requirement for Certain Imaging Services, 75 Fed. Reg. at 73,6 1 6 (citing 42

C.F.R. §411. 355(b)(7)(i)).

72. See id.

73. General Disclosure Requirements, 75 Fed. Reg. at 73,445.

74. Id

75. Disclosure Requirement for Certain Imaging Services, 75 Fed. Reg. at 73,616 (citing 42

C.F.R. §411. 355(b)(7)(i)).

76. List ofAlternate Suppliers, 75 Fed. Reg. at 73,445 (citing 42 C.F.R. § 41 1 .355(b)(7)(i)).

77. Id (citing 42 C.F.R. § 41 1.355(b)(7)(ii)).



2011] HEALTH LAW 1297

document the disclosure.^^ The list ofsuppliers must include the "name, address,

[and phone] number" of each supplier at the time of the referral.''^

d. Documentation}^—^No patient signature is required to document that the
disclosure requirements have been satisfied. ^^ However, CMS advises that
"physicians should be able to document or otherwise estabhsh that they have

complied with the disclosure requirement."^^

4. CMSIssues StarkLaw Voluntary Disclosure Protocol.—Section 6409 of
the PPACA required the Secretary to develop a protocol, in cooperation with the
Office of Inspector General (OIG) of the Department of Health and Human
Services, to enable health care providers "to disclose an actual or potential

violation of the federal Stark Law.^^ On September 23, 2010, CMS published
the Self-Referral Disclosure Protocol (the "Protocol") online.

^'^

Importantly, the PPACA authorized the Secretary to reduce payment and
penalty amounts for violations of the Stark Law.^^ In determining the amount

due for a violation, the Secretary was instructed to consider (i) "[t]he nature and
extent of the improper or illegal practice"; (ii) "[t]he timeliness of such self-

disclosure"; (iii) the provider's cooperation in supplementing information as

needed; and (iv) any "other factors" the Secretary deems appropriate.^^

The PPACA also established a deadline for reporting and returning
overpayments by the later of: (1) "[sixty] days after the date on which the

overpayment was identified"^^ or (2) "the date any corresponding cost report is
due, if applicable."^^ Importantly, such sixty-day period is tolled at the time the

provider receives e-mail confirmation from CMS that the disclosure has been
received.

a. In general.—The Protocol is available to all health care providers and
suppliers (collectively, "Disclosing Parties"), including Disclosing Parties

already subject to government investigation.^^ Failure to fully cooperate in the

self-disclosure process or "to circumvent an ongoing [government] inquiry" will

result in removal from the Protocol.^^

78. Id.

79. Id. (citing 42 C.F.R. § 41 1.355(c)).

80. Documentation of Disclosure, 75 Fed. Reg. 73, 447 (Nov. 29, 2010).

81. Id

82. Id

83

.

Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1 - 1 48 § 6409(a)( 1 ), 1 24 Stat.

119(2010).

84. Ctrs. for Medicare & Medicaid Servs., CMS Voluntary Self-Disclosure
Protocol, (2010), available at http://www.cms.gov/PhysicianSelfReferral/Downloads/6409_

SRDP_Protocol.pdf [hereinafter Self-Referral Disclosure Protocol].

85. Patient Protection and Affordable Care Act § 6409(b).

86. Id § 6409(b)(l)-(4).

87. Id § 1125J(d)(2)(A).

88. Id § 1128J(d)(2)(B).

89. Self-Referral Disclosure Protocol, supra note 84, at 2.

90. Id



1298 INDIANA LAW REVIEW [Vol. 44:1287

The Protocol is not intended as an advisory process by CMS or to determine
"whether an actual or potential violation" of the Stark Law exists.^' Rather,
submissions under the Protocol should be made to resolve liability for actual or
potential violations.^^

CMS will review the circumstances surrounding the disclosed matter but "is
not bound by any conclusions made by the [D]isclosing [PJarty under . . . [this
protocol] and is not obligated to resolve the matter in any particular manner."^^

Medicare contractors may be responsible for processing any identified
overpayment, and Disclosing Parties must acknowledge "that no appeal rights

attach to claims relating to the conduct disclosed ifresolved through a settlement

agreement."^"* However, an appeal of any overpayment demand letter is
permitted if the Disclosing Party withdraws or is removed from the Protocol.^^

Further, the reopening rules at 42 C.F.R., sections 405 .980 through 405 .986, shall

apply if the Disclosing Party is denied acceptance into the Protocol, withdraws

from the Protocol, or is removed from the Protocol by CMS.^^
2. Cooperation with the OIG and the Department ofJustice.—The Protocol

is limited to Stark Law violations.^^ Alternatively, "[t]he OIG's Self-Disclosure
Protocol is available for disclosing conduct that raises potential liabilities under

other federal criminal, civil, or administrative laws."^^ Conduct that raises

liability risks under the Stark Law and under the OIG's civil monetary penalty
authorities, including the federal Anti-Kickback Statute, should be disclosed

through the OIG's self-disclosure protocol.^^ The same conduct should not be
disclosed under both the Protocol and OIG's self-disclosure protocol. ^^^ When
appropriate, CMS may coordinate with the OIG and the Department of Justice
(DOJ) to prepare a recommendation to such entities for the resolution of the

False Claims Act, any civil monetary penalty, or other liability.
^^^

If a Disclosing Party has a corporate integrity agreement (CIA) or

certification of compliance agreement (CCA) with the OIG, disclosures shall
comply with the terms of those agreements. ^^^ "Effective September 23, 2010,
a reportable event solely related to a Stark issue should be disclosed to CMS
using the requirements set forth in this self-disclosure protocol with a copy [of

the disclosure sent to the] [D]isclosing [P]arty's OIG monitor."*^^

91. Id.

92. Id.

93. Id

94. Id

95. Id

96. Id

97. See id.

98. Id.; see also Provider Self-Disclosure Protocol, 63 Fed. Reg. 58,399 (Oct. 30, 1998).

99. See Self-Referral Disclosure Protocol, supra note 84, at 2.

100. Id

101. Mat 3.
102. Id

103. Id



2011] HEALTH LAW 1299

3. Instructions Regarding the Voluntary Disclosure Submission.—
Disclosures pursuant to the Protocol must be sent to CMS electronically, along
with the original disclosure and one additional copy sent by U.S. mail.'^"^ "After

reviewing the submission, CMS will send a letter to the [D]isclosing [PJarty or
its representative either accepting or rejecting the disclosure."^^^

The submission shall include a description of the actual or potential

violation(s), including: identifying information of the Disclosing Party; a

description of the nature of the matter being disclosed; a statement from the

Disclosing Party regarding why it believes a violation may have occurred;
circumstances under which the matter was discovered and measures taken upon
discovery to address the issue; a statement identifying whether there is a history

of similar conduct; descriptions of the existence and adequacy of a pre-existing

compliance program; description of appropriate notices provided to other

government agencies in connection with the disclosed matter; an indication of

whether the Disclosing Party has knowledge that the matter is under current

inquiry by a government agency or contractor, and a description of any such

inquiry.
^^^

The Disclosing Party must also conduct a financial analysis that "[sets] forth
the total amount . . . that is actually or potentially due and owing" based upon the

period of time during which the Disclosing Party may not have been in
compliance. '^^ The Disclosing Party must also "[d]escribe the methodology used
to set forth the amount that is actually or potentially due and owing" and

"[p]rovide a summary of any auditing activity undertaken and a summary ofthe
documents the [D]isclosing [P]arty . . . relied upon."^'^^ Finally, the Disclosing

Party must submit "a signed certification stating that, to the best of the

individual's knowledge, the information provided contains truthful information

and is based on a good faith effort to bring the matter to CMS'[s] attention for
purposes of resolving any potential liabilities . . . ."^^^

4. CMS Verification.—"Upon receipt ofa [D]isclosing [P]arty's submission,
CMS will begin its verification ofthe disclosed information."^ ^^ The quality and
thoroughness ofthe submission will determine CMS ' s verification effort. * ' ^ New
issues identified during the verification process, which are outside the scope of
the initial disclosure, may be treated as new matters outside the Protocol.' ^^

"CMS is prepared to discuss with a [D]isclosing [P]arty's counsel ways to gain
access to underlying information without waiver of protections provided by an

104. Id

105. Id

106. Mat 3-4.
107. Mats.
108. Id

109. Id

110. Id

111. Id

112. Id



1 300 INDIANA LAW REVIEW [Vol. 44: 1287

appropriately asserted claim of privilege."^
*^

5. Payments.—"CMS will not accept payments ofpresumed overpayments
determined by the [DJisclosing [PJarty prior to the completion of CMS'[s]
inquiry."^

^"^ During the verification process, "the [D]isclosing [P]arty must

refrain from making payments relating to the disclosed matter to the Federal
health care programs or their contractors without CMS'[s] prior consent."' ^^

6. Cooperation and Removal from the Protocol and Timeliness of
Disclosures.—CMS expects to receive documents and information from the
Disclosing Party voluntarily.

'^^
Failure to cooperate with CMS during the

disclosure process will be assessed during CMS's consideration of the
appropriate resolution of the matter. '''' Intentional submission of false

information or intentional omission ofrelevant information will be referred to the

DOJ or other federal agencies.''^
7. Factors Considered in Reducing the Amounts Owed.—In determining the

amounts owed, CMS may consider the following factors:

(1) the nature and extent of the improper or illegal practice; (2) the

timeliness of the self-disclosure; (3) the cooperation in providing

additional information related to the disclosure; (4) the litigation risk

associated with the matter disclosed; and (5) the financial position ofthe

[DJisclosing [PJarty. While CMS may consider these factors in
determining whether reduction in any amounts owed is appropriate,
CMS is not obligated to reduce any amounts due and owing.' '^

D. Anti-Kickback Statute

The Medicare and Medicaid Patient Protection Act of 1987, as amended by
42 U.S.C. Section 1 320a-7b (the "Anti-Kickback Statute"), prohibits the knowing

and willful solicitation, receipt, offer, or payment of remuneration in exchange

for or to induce the provision of items or services that are reimbursable under

Medicare, Medicaid, or other government health care programs. '^^ Prohibited

remuneration may be direct or indirect, overt or covert, and made in cash or in
kind.'^' Violation of the Anti-Kickback Statute can result in both criminal and

civil liability. The violation, which is considered a felony, can result in up to five

113. Id.

114. Mat 6.
115. Id.

116. Id

117. Id

118. Id

119. Id

1 20. Medicare-Medicaid Anti-Fraud and Abuse Amendments, Pub. L. No. 95- 1 42 § 4(b)( 1 ),

91 Stat. 1 175, 1 181 (1977) (codified as amended at 42 U.S.C. § 1320a-7b (2010)).

121. See generally id.



2011] HEALTH LAW 1301

years imprisonment, with fines up to $25,000 and/or civil monetary penalties.
^^^

Offenders may also be excluded from participation in Medicare, Medicaid, or
other government health care programs.

^^^

1. Overview.—^As demonstrated by the PPACA's sweeping impact on the
Stark Law, the PPACA also made significant reforms to the Anti-Kickback
Statute. First, the PPACA created a direct connection between violations ofthe
Anti-Kickback Statute and a subsequent submission ofa false claim. '^"^ Second,

the PPACA amended the intent requirement under the Anti-Kickback Statute. ^^^

The PPACA also created a new statutory exception for prescription discounts for
certain government health care beneficiaries.

^^^

2. False Claims Correlation.—The PPACA clarified that a violation of the
Anti-Kickback Statute is considered a false or fraudulent claim. ^^^ The new 42
U.S.C. Section 1320(a)-7b(g) provision provides that "a claim that includes items

or services resulting from a violation of . . . [the Anti-Kickback Statute]

constitutes a false or fraudulent claim for purposes of . . . [the False Claims

Act]."'^^ Prior to this new language, violations of the Anti-Kickback Statute
were argued to also evidence a false claim under the "implied certification"

theory. ^^^ However, this theory is not infallible, given the knowledge

requirement under the False Claims Act.'^^ The new provision set forth by the
PPACA fiarther supports the notion that a violation ofthe Anti-Kickback Statute
results in false claims.

3. Changes in Intent Requirement.—In interpreting the Anti-Kickback
Statute, the OIG has historically relied on United States v. Greber,^^^ the
landmark case regarding the scope ofthe Anti-Kickback Statute. In Greber, the

Third Circuit Court ofAppeals established the "one purpose" test.'^^ Under the
"one purpose" test, "ifone purpose ofthe payment was to induce future referrals,
the [M]edicare statute has been violated."^^^ However, in Hanlester Network v.
Shalala,^^"^ the Ninth Circuit Court of Appeals interpreted the Anti-Kickback

122. Id

123. Id § 1320a-7b(a)(6).

1 24. Patient Protection and Affordable Care Act, Pub. L. No. 11 1 - 1 48 § 6402(f)( 1 ), 1 24 Stat.

119(2010).

125. See id.

126. See id.

127. See id.

128. Id

129. *See/«rePharm. Indus. Average Wholesale Price Litig., 491 F. Supp.2d 12, 18(D. Mass.

2007) (stating that the "government can state a claim under the FCA for an antecedent violation of
the Anti-Kickback Statute for claims submitted through the Medicare program" because the

Medicare program requires providers to certify their Anti-Kickback Statute compliance).

130. See3\ U.S.C. § 3729 (2006).

131. 760 F.2d 68 (3d Cir. 1985).

132. Mat 69.
133. Id

134. 51 F.3d 1390 (9th Cir. 1995).



1302 INDIANA LAW REVIEW [Vol. 44: 1287

Statute to require "specific intent" to violate the law.^^^ In Hanlester, the court

found that the offender must have knowledge ofthe specific referral prohibitions

contained in the Anti-Kickback Statute and violate the law with specific intent

to do so.*^^ The holding in Hanlester sharply contrasted the broader
interpretation of intent under the Third Circuit's holding in Greber.

The PPACA amended the actual language of the Anti-Kickback Statute,
significantly diminishing this intent requirement and providing an additional

means to establish a false claim.
^^^

Section 6402(f)(2) ofthe PPACA adds a new
subsection, which states, "With respect to violations of this section, a person

need not have actual knowledge of this section or specific intent to commit a
violation ofthis section."'^^ The change to the intent requirement has effectively
overruled Hanlester, as a party may now be held liable regardless ofwhether he
or she has actual knowledge of the Anti-Kickback Statute or specific intent to

violate the law. This amendment lessens the burden on the government to
demonstrate a violation ofthe Anti-Kickback Statute and establish a false claim.

Such changes to the intent threshold have the potential to increase both criminal

and civil liability exposure with regard to many hospital and physician
transactions.

4. New Exception to the Anti-Kickback Statute.—The PPACA also added a
new exception to the Anti-Kickback Statute to permit prescription discounts for
certain beneficiaries participating in Medicare's coverage gap discount

program.
'^^ The new exception states that the negotiated price of an applicable

drug of a manufacturer that is furnished to an applicable beneficiary under the

Medicare coverage gap discount program under section 1860D-14A, regardless

ofwhether part of such costs were paid by a manufacturer under such program,

will not be subject to the Anti-Kickback Statute. ^"^^ For purposes of the new
exception to the Anti-Kickback Statute, the PPACA also established new
definitions, which include:

a. Applicable beneficiary.—The term "applicable beneficiary" means
an individual who, on the date of dispensing an applicable drug . . . (A)

is enrolled in a prescription drug plan or an MA-PD plan; (B) is not
enrolled in a qualified retiree prescription drug plan; (C) is not entitled

to an income-related subsidy under section 1860D-14(a); (D) is not

subject to a reduction in premium subsidy under section 1 839(i); and (E)
who (i) has reached or exceeded the initial coverage limit under section
1860D-2(b)(3) during the year; and (ii) has not incurred costs for

covered part D drugs in the year equal to the annual out-of-pocket

135. Id. at 1400.

136. Id.

137. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148 § 6402(f)(2), 124 Stat.

119(2010).

138. Id

1 39. Patient Protection and Affordable Care Act § 3301(c).

140. Id



2011] HEALTH LAW 1303

threshold specified in section 1860D-2(b)(4)(B).'^*

b. Applicable drug.—The term "applicable drug" means
with respect to an applicable beneficiary, a covered part D drug . . . (A)
approved under a new drug application under section 505(b) of the
Federal Food, Drug, and Cosmetic Act or, in the case of a biologic

product, licensed under section 351 of the Public Health Service Act

(other than a product licensed under subsection (k) ofsuch section 351);

and (B)(i) if the PDP sponsor of the prescription drug plan or the MA
organization offering the MA-PD plan uses a formulary, which is on the
formulary of the prescription drug plan or MA-PD plan that the
applicable beneficiary is enrolled in; (ii) if the PDP sponsor of the
prescription drug plan or the MA organization offering the MA-PD plan
does not use a formulary, for which benefits are available under the

prescription drug plan or MA-PD plan that the applicable beneficiary is
enrolled in; or (iii) is provided through an exception or appeal.

'"^^

E. Civil Monetary Penalties Law

Under the federal Civil Monetary Penalties (CMP) law, monetary sanctions
may be imposed against any person who gives "remuneration" to a Medicare or
Medicaid participant that the person knows or should know will likely influence
the participant's selection of a particular practitioner, provider, or supplier of a

service paid for by Medicare or Medicaid.
^"^^

1. Overview.—The PPACAmade several sweeping changes to the CMP law.
More specifically. Section 6402 of the PPACA clarifies the definition of
"remuneration" as used in the administration of the CMP law.^"^"^ The PPACA
also created new civil monetary penalties and amended existing ones.

2. CMP Definition ofRemuneration: New Exceptions.—Under the CMP
law, any hospital that "knowingly makes a payment, directly or indirectly, to a
physician [and any physician that receives such a payment] as an inducement to

reduce or limif items or services to Medicare or Medicaid beneficiaries under

the physician's direct care may be subject to civil monetary penalties. ^"^^

"Remuneration" includes the provision or transfer ofitems or services "for other

than fair market value."^"^^ Nevertheless, the OIG has stated that providing
"nominal" gifts is not likely to induce a beneficiary to use a particular provider,

practitioner, or supplier.
^"^^ The OIG interprets nominal value to include items

141. Id. § 1860D-14A(g)(l).

142. Id. § 1860D-14A(g)(l).

143. 42 U.S.C. § 1320a-7a(a) (2006).

144. Patient Protection and Affordable Care Act § 6402(d)(2)(B).

145. 42 U.S.C. § 1320a-7a(b).

146. Id § 1320a-7a(i)(6).

147. See OFFICE OF INSPECTOR GEN., SPECIAL ADVISORY BULLETIN: OFFERING GIFTS AND

Other Inducements to Beneficiaries 4 (2002), available at http://oig.hhs.gov/fraud/docs/



1304 INDIANA LAW REVIEW [Vol. 44:1287

of value no greater than $10 each and $50 aggregated annually. ^"^^ Given this
interpretation, health care providers who provide charitable assistance to patients
in excess ofthese monetary limits (e.g., free transportation, lodging, medication,

gift cards for food and gasoline) may risk violation ofthe CMP law. In addition
to this "nominal value" exception, there are several very narrow statutory and

regulatory exceptions for: waiving cost-sharing amounts for those with financial

need; disclosed health plan copayment differentials; items or services that
promote the delivery of preventative care, as determined by CMS; practices
authorized under the Anti-Kickback Statute; or waiving hospital outpatient

copayments that exceed minimum copayments.'"^^
Section 6402(d)(2)(B) of the PPACA provides additional options for health

care providers to offer certain charitable assistance or other items or services for

free or below fair market value.
^^^

Notably, Section 6402(d)(2)(B) excludes from

the definition of remuneration:

(1) items or services that promote access to care and pose a low fraud

and abuse risk;

(2) offering items or services for free or less than fair market value, if

the items or services consist of coupons, rebates, or other rewards from

a retailer;

the items or services are offered or transferred on equal terms available

to the general public, regardless of health insurance status; and

the offer or transfer of the items or services is not tied to the provision

of other items or services reimbursed in whole or in part by the program

under title XVIII or a State health care program (as defined in section

1128(h))'V'^

(3) offering items or services for free or less than fair market value, if

the items or services are not offered as part of any advertisement or

solicitation;

the items or services are not tied to the provision of other services

reimbursed in whole or in part by the program under title XVIII or a

State health care program (as so defined);

there is a reasonable connection between the items or services and the

medical care of the individual; and

the person provides the items or services after determining in good faith

that the individual is in financial need."^^^

In light of these new exclusions, providers may have greater freedom to
design a program aimed at assisting those in financial need or a program that

alertsandbulletins/SABGiftsandlnducements.pdf.

148. Id. at 2.

149. Id.

150. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148 § 6402(d)(2)(B), 124

Stat. 1 19, 758-59 (2010) (to be codified at 42 U.S.C. §1320a-7a).

151. Id

152. Id



2011] HEALTH LAW 1305

improves access to health care without risk ofmonetary penalties under the CMP
law.

3. New and Amended Civil Monetary Penalties in Section 6402 of the
PP^C/4.—Section 6402(d)(2) of the PPACA creates three new CMPs for the
purpose ofenhancing Medicare and Medicaid program integrity.

^^^ The PPACA
also amended Section 1 128A(a)(l)(D)oftheCMPlaw.'^^ As amended, the CMP
law now includes the following additional CMPs:

a. New section 1128A(a)(8).—This section imposes CMPs on any person
who "orders or prescribes a medical or other item or service during a period in
which the person was excluded from a Federal health care program (as so
defined)," when such person knows or should have known that a claim would be
made under a Federal health care program. ^^^ The penalty for violating this new
section 1 128A(a)(8) is no more than $10,000 per item or service, plus no more
than three times the amount claimed for such item or service.

^^^

b. New section 1128A(a)(9).—This section imposes CMPs on any person
who "knowingly makes or causes to be made any false statement, omission, or
misrepresentation of a material fact in any application, bid, or contract to

participate or enroll as a provider of services or a supplier under a Federal health

care program (as so defined)."^^^ Violations of this new CMP can result in
penalties of no more than $50,000 for each instance, plus no more than "[three]
times the total amount claimed for each item or service for which payment was
made based upon the application containing the false statement or
misrepresentation of a material fact."^^^

c. New section 1128A(a)(10).—This section imposes CMPs on any person
who "knows ofan overpayment (as defined in paragraph (4) ofsection 1 128J(d))
and does not report and return the overpayment in accordance with such

section."' ^^ The penalty for violating new section 1 128A(a)(10) is no more than
$10,000 per item or service, plus no more than three times the amount claimed
for such item or service.

'^^

d. New section lI28J(d).—SQCtion 6402(a) of the PPACA created new
section 1 128J(d), which requires a person to "report and return the overpayment

to the Secretary, the State, an intermediary, a carrier, or a contractor" and provide

an explanation to the same entity as to why there was an overpayment.'^' An
"overpayment" is "any fiinds that a person receives or retains under title XVIII

or XIX to which the person, after applicable reconciliation, is not entitled under

1 53. Patient Protection and Affordable Care Act § 6402(d)(2)(A).

154. Id

155. Patient Protection and Affordable Care Act § 6402(d)(2)(A)(iii).

156. 42 U.S.C. § 1320a-7a(a) (2006).

157. Patient Protection and Affordable Care Act § 6402(d)(2)(A)(iii).

158. Id § 6402(d)(2)(A)(iv)-(v).

159. Id § 6402(d)(2)(A)(iii).

160. 42 U.S.C. § 1320a-7a(a)(10) (2006).

161. Patient Protection and Affordable Care Act § 6402(a).



1306 INDIANA LAW REVIEW [Vol. 44: 1287

such title. "^^^ For purposes of this new provision, the term "person" does not
include beneficiaries.'^^

The PPACA also amends section 1128A(a)(l)(D) of the CMP law, which
imposes CMPs on persons who knowingly present, or cause to be presented,
claims for items or services provided "during a period in which the person was
excluded" pursuant to a determination by the Secretary under a list of statutory
provisions.

'^"^ The PPACA amends this provision by replacing the list ofstatutes
with "from the Federal health care program (as defined in section 1128B(f))

under which the claim was made pursuant to Federal law."'^^ This amendment
broadens the application of section 1 128A(a)(l)(D) of the CMP law.

4. New Civil Monetary Penalties in Section 6408 ofthe PPACA.—Section
6408(a) of the PPACA creates new CMPs for false statements or delaying OIG
inspections.'^^ As amended, the CMP law now includes the following additional
CMPs:

a. New section 1128A(a)(8).—This section imposes CMPs on any person
who "knowingly makes, uses, or causes to be made or used, a false record or
statement material to a false or fraudulent claim for payment for items and

services furnished under a Federal health care program.
"'^^

b. New section 1128A(a)(9).—This section imposes CMPs on any person
who "fails to grant timely access, upon reasonable request ... to the Inspector
General of the Department of Health and Human Services, for the purpose of
audits, investigations, evaluations, or other statutory functions of the Inspector

General of the Department of Health and Human Services."'^^
c. Penalties.—The penalties imposed for violating these new CMPs are

$50,000 for each false record or statement under new section 1 128A(a)(8) and
$15,000 for each day the person fails to grant timely access under new section
1128A(a)(9).'''

F. Office ofInspector General Work Planfor Fiscal Year 2010

On October 1, 2009, the OIG published its proposed Work Plan for Fiscal
Year 2010 ("Work Plan"), which describes new and ongoing audit and
enforcement priorities of the OIG.'^^ Important focus areas for providers and

suppliers include, but are not limited to:

1. ''Hospital Admissions with Conditions Coded Present-on-Admission

162. Id.

163. Id.

164. 42U.S.C. § 1320a-7a(a)(8).

165. Patient Protection and Affordable Care Act § 6402(d)(2)(A)(i).

166. Id § 6408(a).

167. Id § 6408(a)(2).

168. Id

169. Id § 6408(a)(3)(B).

1 70. Office of Inspector Gen., FY 20 1 Office of Inspector Gen. Work Plan (20 1 0),
available at http://oig.hhs.gov/publications/docs/workplan/20 1 0/Work_Plan_FY_20 1 0.pdf



2011] HEALTH LAW 1307

(POA).
"^^^—The OIG will review Medicare claims to determine the number of

inpatient hospital admissions for which certain diagnoses are coded as POA and
the conditions that are most frequently coded as POA.^^^ The OIG will also
determine which types offacilities are most frequently transferring patients with

a POA diagnosis specified by CMS to hospitals and whether specific providers
transferred a high number of patients to hospitals with POA diagnoses. ^^^

2. "Payments for Services Ordered or Referred by Excluded

Providers.
"^^^—Entities or providers that are excluded from Medicare or

Medicaid may not receive payment for items furnished, ordered, or prescribed by
the excluded party. ^^^ Under the Work Plan, the OIG will review Medicare
payments ordered or referred by excluded providers and will examine CMS's
oversight mechanisms for identifying improper payments.

^^^

3. "Medicare Incentive Paymentsfor E-Prescribing. "*
^^—^Under the Work

Plan, the OIG "will review Medicare incentive payments made in 20 1 to eligible
health care professionals for their 2009 electronic prescribing (e-prescribing)

activities.
"'^^ Physicians will be eligible for incentive payments beginning in

2010 if they are "successful electronic prescribers."'^^

4. "Physician Reassignment ofBenefits.
"^^^—Unless an exception applies,

physicians providing Medicare services may not reassign their right to payment
to another entity.'^' The OIG will review the extent to which Medicare
physicians reassign their benefits to other entities and the extent to which

physicians are aware of their reassignments.^^^

III. Labor AND Employment

A. Racial Preferences ofMedical Facility Residents

In Chancy v. Plainfield Healthcare Center,
^^^

the United States Court of

Appeals for the Seventh Circuit held that a nursing home's policy ofnot allowing

African-American certified nursing assistants (CNAs) to provide care to residents
who had requested that they not be treated by African-American CNAs
constituted a hostile work environment.

171. Mat 6.
172. Id.

173. Id.

174. Mat 18.
175. Id

176. Id

111. Id at 14.

178. Id

179. Id

180. Mat 17.
181. Id

182. Mat 18.
183. 612 F.3d 908 (7th Cir. 2010).



1308 INDIANA LAW REVIEW [Vol. 44: 1287

Brenda Chaney ("Chaney") was a CNA at Plainfield Healthcare Center
("Plainfield").'^'* Plainfield had a policy ofpermitting residents to express their

racial preferences and honoring those preferences in assigning health care

providers. '^^ The residents' racial preferences, if any, were listed on the
assignment sheets ofthe CNAs, which were provided to the CNAs upon arriving
at work. "In the case of Marjorie Latshaw, a resident in Chaney' s unit, the

[assignment] sheet instructed nurse aides that Latshaw 'Prefers No Black
CNAs.'"'^^ Plainfield acknowledged that the assignment sheet effectively

banned Chaney, who was African-American, from assisting Latshaw. ^^^ "For
fear of being fired, Chaney went along with the policy" and "refrained from
assisting . . . [Latshaw], even when she was in the best position to respond."'^^

Plainfield argued that its policy of honoring racial preferences of residents

was necessary to avoid "violating state and federal laws that grant residents the
rights to choose providers, to privacy, and to bodily autonomy."^^^ Specifically,

Plainfield stated that its policy was a reasonable and good faith effort to comply
with title 410, section 1 6.2-3 . 1 -3(n)( 1 ) ofthe Indiana Administrative Code, which

provides residents the right to "choose a personal attending physician and other

providers of services."'^^ The court, however, disagreed, finding that Plainfield
was a racially hostile workplace because it "acted to foster and engender a
racially-charged environment through its assignment sheet that unambiguously,

and daily, reminded Chaney and her co-workers that certain residents preferred
no black CNAs" and stating that the policy was unreasonable and unnecessary
to comply with applicable laws.'^^

The court noted that Plainfield' s reading ofthe Indiana regulation conflicted
with Title VII, and "[w]hen two laws conflict, one state, one federal, the

Supremacy Clause dictates that the federal law prevails."^^^ While acceding to

a patient's preference regarding the gender of a health care provider can be

legitimate under Title VII, it is never legitimate on the basis of race. ^^^ Further,

"Indiana's regulations do not require Plainfield to instruct its employees to

accede to the racial preferences of its residents"—^they merely require Plainfield
"to allow residents access to health-care providers oftheir choice."'^"^ That is, the

184. Mat 910.
185. Id.

186. Id.

187. Id

188. Id

189. Id

190. Id. at 913-14; 5eefl/5o 410 IND. Admin. Code 1 6.2-3. l-3(n)(l) (20 10) ("The resident has

the right to . . . [c]hoose a personal attending physician and other providers of services.").

191. Mat 912-13.
192. Id at 914 (citing U.S. Const, art. VI, cl. 2).

1 93

.

See id. at 9 1 3- 1 4. The court cited Rucker v. Higher Educational Aids Board, 669 F.2d

1 179 (7th Cir. 1982), to show that Title VII forbids employers from using race as a bona fide

occupational qualification or a legitimate criterion for accommodating patients' privacy interests.

194. Chaney, 612 ¥.3d at 914.



2011] HEALTH LAW 1309

regulations do not require Plainfield to accede to the racial preferences of

residents with respect to its own employees. The court stated that

[i]f a racially-biased resident wishes to employ at her own expense a
white aide, Indiana law may require Plainfield to allow the resident
reasonable access to that aide. But the regulations do not say that a

patient's preference for white aides that Plainfield employs trumps

Plainfield' s duty to its employees to abstain from race-based work
assignments.

^^^

Next, Plainfield argued that its policy was legitimate under 42 U.S.C. §
13951, "which provides that Medicare beneficiaries in long-term care facilities

have a right to choose 'a personal attending physician. '"'^^ The court rejected

this argument, stating that "[t]he law is silent about a beneficiary's right to

choose other service providers, such as CNAs."^^^

Finally, Plainfield attempted to defend its policy by arguing that without the

policy, Plainfield risked exposing black employees to racial harassment from the

residents, thus "exposing itself to hostile workplace liability. "'^^ The court

rejected this argument as well and offered several alternative ways that Plainfield

could have confronted hostile residents. For instance, the court suggested

"wam[ing] residents before admitting them of the facility's nondiscrimination

policy, securing the resident's consent in writing."'^^ In sum, the court held that

Plainfield' s policy created a racially-charged workplace in contravention ofTitle

VII.

B. TRICARE and Affirmative Action Considerations

Another labor and employment case—^this time in the affirmative action
arena—that affects the health care industry both in Indiana and across the nation
is In re Office of Federal Contract Compliance Programs, United States

Department ofLabor v. Florida Hospital ofOrlando}^^ There, an administrative
lawjudge (ALJ) considered whether a not-for-profit hospital was a subcontractor
to a government contractor and, as a result, was subject to federal affirmative
action and nondiscrimination requirements.

TRICARE Management Activity (TMA) is a federal financial assistance

195. Id.

196. Id.

197. Id; see also 42 U.S.C. § 1395i-3(c)(l)(A)(i) (2010) ("A skilled nursing facility must

protect and promote the rights of each resident, including ... the right to choose a personal

attending physician ....").

198. Chaney,6\2¥.3dat9l4.

1 99. M at 9 1 5 . In addition, the court suggested attempting to reform residents' post-admission
behavior, assigning staff "based on race-neutral criteria that minimize the risk of conflict", and

advising Plainfield employees "that they could ask for protection from racially harassing residents."

Id

200. Fla. Hosp. of Orlando, U.S. Dep't of Labor, No. 2009-OFC-00002 (Oct. 18, 2010).



1310 INDIANA LAW REVIEW [Vol. 44: 1287

program that administers health care for active duty and retired military and their
families under the TRIGARE program.^^' To assist with the administration ofthe
program, TMA contracts with managed care support contractors, who are
responsible for "enrollment, referral management, medical management, claims
processing and customer service," as well as "[underwriting] healthcare costs and

establish[ing] networks of providers who agree to follow rules and procedures
of the TRICARE program when treating TRICARE patients. "^^^ Beginning in
August 2003, Humana Military Healthcare Services, Inc. (HMHS) contracted
with TMA "to provide networks of health care providers" to TRICARE
beneficiaries.^^^ The TMA-HMHS contract provided that "HMHS shall provide
a managed, stable high-quality network or networks of individual and

institutional health care providers" and must "establish provider networks

through contractual arrangements.
"^^"^

The defendant in this case, Florida Hospital ofOrlando, is an acute care, not-
for-profit hospital with more than fifty employees located in Orlando, Florida.^^^
This hospital had a hospital agreement with HMHS since April 2005, pursuant
to which the hospital agreed to become a participating hospital and "provide
health care services for beneficiaries designated as eligible to receive benefits

under the agreement between HMHS and TRICARE in accordance with the
TRICARE rules, regulations, policies and procedures."^^^ Under the TMA-
HMHS contract, HMHS paid the hospital $ 1 00,000 or more annually for medical
services provided to TRICARE beneficiaries from January 1 , 2006 onward.

On August 14, 2007, the Office of Federal Contract Compliance Programs
(OFCCP) initiated compliance reviews of the hospital and requested
documentation to show that the hospital was complying with the affirmative
action and equal employment opportunity obligations set forth in Executive
Order 11, 246.'"'

The hospital refused to provide any information requested by OFCCP and
argued that the OFCCP lackedjurisdiction over the hospital. Because Executive
Order 1 1 ,246 applies only to government contractors and subcontractors, the

hospital raised two arguments in support of its position that it is not a covered

201. Mat 2.
202. Id.

203. Id.

204. Id. (internal citation omitted).

205. Id

206. Id

207. Id. at3;5eea/50 Exec. Order No. \ \,lA6,3>C.Y.K.^Z'}>9{\96A-65\ as amendedby Exqc.

Order No. ll,375,3C.F.R.§684(1966-70);Exec. Order No. 12,086, 3 C.F.R. §230. Specifically,

the Executive Orders, as codified at 41 C.F.R. §§ 601.3, 60-250.2, and 741.2, require that any

government contractors or subcontractors must establish written affirmative action employment

programs (AAPs). OFCCP sought information about the hospital' s AAPs and requested "( 1 ) a copy
of Defendant's Executive Order . . . [AAP]; (2) a copy of Defendant's § 503 (38 U.S.C. § 4212)

AAP(s) prepared according to 41 CFR parts 60-741 and 60-250; and (3) support data specified in
an enclosed itemized listing." Fla. Hosp. ofOrlando, No. No. 2009-OFC-00002, at 3.



2011] HEALTH LAW 1311

subcontractor under the statutes.^^^ First, the hospital argued that it was not a

"covered contractor" because it did not enter into a subcontract as defined in 41

C.F.R. §§ 60-1.3, 60-250.2, and 741.2. Under the regulations, a "subcontract"

is defined as:

[a]ny agreement or arrangement between a contractor and any person .

. . (1) For the purchase, sale or use ofpersonal property or nonpersonal

services which, in whole or in part, is necessary to the performance of

any one or more contracts; or (2) Under which any portion of the

contractor's obligation under any one or more contracts is performed,

undertaken or assumed.^^^

But the ALJ, relying on OFCCP v. UPMC Braddock,^^^ found that the hospital
did perform a portion of the contractor's obligation under its contract with

TRIGARE. Specifically, the ALJ stated that under the hospital agreement, the
hospital contracted "to provide medical services to TRICARE's beneficiaries
under the agreement between HMHS and . . . [TMA]."^' ^ Therefore, the hospital
was a subcontractor under HMHS's contract with TRIGARE because it
performed "'a portion of the contractor's obligations' by providing some of the
medical services to TRIGARE's beneficiaries which HMHS has contracted to
provide."^

'^

The second argument raised by the hospital was that its participation in the
TRIGARE program constituted the receipt of federal financial assistance, and
OFGGP did not have jurisdiction over businesses that receive federal financial
assistance. In 1993, OFGGP issued a statement that "OFGGP lacks jurisdiction
over businesses if their only relationship with the federal government is as a

recipient of federal financial assistance, be it from Medicare or other federal

programs."^'^ As a result, the hospital argued that TRIGARE is "essentially
indistinguishable" from Medicare, and thus, receipt offederal funding under this

program did not constitute a subcontractor relationship.

In response to the hospital's second argument, the ALJ again disagreed and
found that Medicare and TRIGARE are substantially different; while "Medicare
does not provide medical services to its beneficiaries . . . TRIGARE is the
uniformed services health care program for active duty service members and their
families. . . . That Medicare may be considered federal financial assistance has
no relevance to TRIGARE. They are totally different programs."^^"^ Ultimately,

208. Id. at 4.

209. Id.

210. UPMC Braddock, No. 08-048 (May 29, 2009) (holding that defendant hospitals were
subcontractors to a government contract where the hospital contracted with an HMO to provide
services to federal employees pursuant to an agreement between the HMO and the Office of
Personnel Management).

211. Fla. Hosp. ofOrlando, No. 2009-OFC-00002, at 4.

212. Mat 4-5.
213. Mat 5.
214. M at 5-6 (internal citation omitted). Note that this holding is contrary to the Department



1312 INDIANA LAW REVIEW [Vol. 44:1287

the hospital was ordered to give OFCCP access to its facilities and otherwise
permit OFCCP to conduct and complete its compliance audit. The hospital has
appealed the ALJ's opinion to the Administrative Review Board.

In light ofthe OFCCP decision, and subject to the outcome ofthe hospital's
appeal to the administrative review board, the number of health care providers
that are now subject to affirmative action requirements appears to have been
dramatically increased.

C Amendments to the Fair Labor Standards Act of1938 in Light ofthe
Patient Protection and Affordable Care Act

While the majority of the provisions in the PPACA are aimed at improving
health care access and quality and reducing cost, the PPACA also made
amendments to the Fair Labor Standards Act of 1938 (FLSA).^^^ The four
amendments concern automatic enrollment ofemployees for health care benefits
with an "opt-out" mechanism,^'^ a requirement that employers inform employees

of insurance exchanges,^ ^^ anti-retaliation and whistleblower protection,^ ^^ and

lactation accommodations for nursing mothers.^ '^ With the exception of the
provision concerning notice of insurance exchanges (which becomes effective

March 1, 2013), none of these provisions have express effective dates and
presumably require employers to comply immediately.

PPACA § 1 5 1 1 adds § 2 1 8a to the FLSA.^^^ Under this section, an employer
with more than 200 full-time employees that offers one or more health benefit
plans must automatically enroll newly hired full-time employees in one of the

plans offered. However, the employer must provide adequate notice of the

enrollment as well as an opportunity for the employee to opt out ofthe coverage

in which he or she was automatically enrolled.^^*

PPACA § 1512 adds § 218b to the FLSA,^^^ which requires an employer to
provide written notice of the existence of an insurance exchange to newly hired

employees and all current employees.^^^ As stated above, this provision is not

ofDefense's position—the ALJ noted that "TRICARE's position ... is that 'it would be impossible
to achieve the TRIGARE mission ofproviding affordable health care for our nation's active duty
and retired military members and their families if onerous federal contracting rules were applied

to the more than 500,000 TRIGARE providers in the United States" and that "it was never the
agency's intent to do so." Id. at 3 (internal citation omitted).

215. Fair Labor Standards Act of 1938, 29 U.S.G. § 201 (2006).

216. Pub. L. No. 1 1 1-148, tit. I, § 151 1, 124 Stat. 252 (2010) (amending 29 U.S.G. § 218a).

217. Id. § 1512 (amending 29 U.S.G. § 218b).

218. Id § 1558 (amending 29 U.S.G. § 218c).

219. Pub. L. No. 111-148, tit. IV, § 4207, 124 Stat. 577 (2010) (amending 29 U.S.G. §

207(r)(l)(A)).

220. Id § 1511.

221. Id

111. Id § 1512.

223. Id



2011] HEALTH LAW 1313

effective until March 1, 2013.^^^

PPACA § 1558, which adds § 218c to the FLSA,^^^ prohibits employer
discrimination or retaliation against any employee who has received a tax credit
or subsidy for a health plan.^^^ The employer is also prohibited from

discriminating or retaliating against an employee who has provided (or is about
to provide) the federal government or state attorney general information

concerning the employer's action or inaction that the employee reasonably

believes to be a violation of the PPACA.^^^ An employee who believes that he
or she has been discriminated or retaliated against in violation ofthis section may
seek relief using the procedures outlined in 15 U.S.C. §2087(b).^^^

Finally, PPACA § 4207 adds § 207(r)(l)-(4) to the FLSA.^^' Under this
provision, an employer must provide "reasonable break time ... [to allow a

mother] to express breast milk for her nursing child" as often as the mother needs

to do so for one year after the child's birth.^^^ However, the employer is not

required to compensate the employee during this time.^^' The employer must
provide the employee with "a place, other than a bathroom, that is shielded from

view and free from intrusion from coworkers and the public" in which to express

breast milk.^^^ An employer with fewer than fifty employees is not subject to
these requirements if the requirements cause undue hardship by imposing

significant difficulty or expense in relation to the employer's "size, financial

resources, nature, or structure ofthe employer's business."^^^ This section does

not preempt state law that provides greater protection for employees^^^ (such as

requiring compensation during breaks or requiring breaks past the child's first

birthday).

D. Immigration: Impact ofNeufeld Memorandum on Physicians

The H-IB program is one ofthe avenues for non-U. S. citizens coming to the
United States to obtain temporary work authorization. The H-IB regulations
specifically authorize the use of this program by physicians.^^^ H-IB work
authorization is employer-specific. To constitute an "employer" for purposes of
the H-IB program, a petitioner must establish that a valid employer-employee
relationship exists between the U.S. employer and prospective H-IB

224. Id.

225. Id. § 1558.

226. Id

227. Id

228. Id.; see also 15 U.S.C. § 2087(b) (addressing whistleblower protections).

229. Pub. L. No. 1 1 1-148, tit. IV, § 4207, 124 Stat. 577 (2010) (adding 29 U.S.C. § 207(r)).

230. Id

231. Id

232. Id

233. Id

234. Id

235. 8 C.F.R. § 214.2(h)(4)(viii)(2010).



1314 INDIANA LAW REVIEW [Vol. 44: 1 287

beneficiary.^^^ In the past, United States Citizenship and Immigration Services

(USCIS) examined the employer-employee relationship under the "conventional

master-servant relationship as understood by the common-law agency
doctrine."^^^

Despite the previously relied upon common law principles of agency, on
January 8, 2010, USCIS released a memorandum stating that there is a lack of
formal guidance for determining whether the required employer-employee

relationship exists between the petitioner and H-IB beneficiary.^^^ This lack of
guidance causes problems, particularly for certain types ofH-IB petitions, such
as where the H-IB beneficiary is placed at a third-party worksite.^^^ According
to the memorandum, while some third-party worksite arrangements are based on
valid employer-employee relationships, other relationships do not meet this

baseline test.^"^^ To create additional guidance, the memorandum delineated the
following eleven factors to be considered in evaluating whether a valid employer-

employee relationship exists:

( 1

)

Does the petitioner supervise the beneficiary and is such supervision

off-site or on-site?

(2) If the supervision is off-site, how does the petitioner maintain such
supervision, i.e. weekly calls, reporting back to main office routinely, or

site visits by the petitioner?

(3) Does the petitioner have the right to control the work of the

beneficiary on a day-to-day basis if such control is required?

(4) Does the petitioner provide the tools or instrumentalities needed for

the beneficiary to perform the duties of employment?

(5) Does the petitioner hire, pay, and have the ability to fire the

beneficiary?

(6) Does the petitioner evaluate the work-product ofthe beneficiary, i.e.

progress/performance reviews?

(7) Does the petitioner claim the beneficiary for tax purposes?

(8) Does the petitioner provide the beneficiary any type ofemployment

benefits?

(9) Does the beneficiary use proprietary information ofthe petitioner in

order to perform the duties of employment?

236. Id. § 2 14.2(h)(4)(ii)(4) (defining employer as "a person, firm, corporation, contractor, or

other association or organization in the United States which . . . [ejngages a person to work within

the United States; [h]as an employer-employee relationship with respect to employees"; and has an

Internal Revenue Service tax identification number).

237. See Memorandum fi-om Donald Neufeld, Associate Director of Service Center

Organizations, to Service Center Directors ofU.S. Citizen & Immigration Services 3 (Jan. 8, 201 0),
available at http://www.uscis.gov/USCIS/Laws/Memoranda/20 1 0/H 1 B%20Employer-Employee%

20MemoO 10810.pdf(quoting Nationwide Mut. Ins. Co. v. Darden, 503 U.S. 318, 322-23 (1992)).

238. Id. at 2.

239. Id at 2.

240. Id



2011] HEALTHLAW 1315

(10) Does the beneficiary produce an end-product that is directly linked

to the petitioner's line of business?

(11) Does the petitioner have the ability to control the manner and

means in which the work product ofthe beneficiary is accomplished?^"^*

The employer will meet the relationship test if it is able to establish its right to

control the H-IB beneficiary, as determined by the totality of circumstances.^"*^
Contrary to the intent of the memorandum, this eleven-factor test creates a

potential conflict where the H-IB beneficiary provides services at a third-party
worksite. Physicians fall into this potential conflict arena, as they are often

employed by one entity and provide services at a third-party hospital or medical

clinic. In these situations, the H-IB process is significantly more document-
intensive. To establish a valid employer-employee relationship under the eleven-
factor test, the petitioner must submit evidence of the right to control the H-IB
beneficiary's work, "including the ability to hire, fire, and supervise the

beneficiary", and evidence that the employer maintains responsibility "for the

overall direction of the beneficiary's work."^"*^ This is complicated in the

physician setting, where physicians are employed by one entity but perform their

duties at a third-party medical facility.

The memorandum lists several types of evidence which may help establish
the employer-employee relationship, including a signed employment agreement,

position description, contracts between the petitioner and third-party worksite

which evidence the petitioner's right to control the H-IB beneficiary, and a copy
of the organizational chart, demonstrating the H-IB beneficiary's supervisory
chain, among other items.^"*"* Because each H-IB petition involving a physician
and third-party worksite is evaluated on a case-by-case basis, no specific

combination of evidence will suffice for every petition.

Where the petitioner is unable to establish the right to control the H-IB
beneficiary, per the eleven factors outlined in the memorandum, USCIS may
issue a request for evidence (RFE)^"*^ in connection with the petition, or the

petition may be denied for failure to satisfy these requirements.^'*^

IV. Tax

A. New Requirementsfor Tax-Exempt Hospitals

The landscape for hospital organizations in Indiana and across the country
that are exempt from tax under Section 501(c)(3) of the Internal Revenue Code
of 1986, as amended (the "Code"), changed significantly with the enactment of
the PPACA. Section 9007 ofthe PPACA adds Section 50 1 (r) to the Code, which

241. Mat 3-4.
242. Id at 4.

243. Id at 8 (citing 8 C.F.R. § 214.2(h)(4)(ii)).

244. Id at 8-9.

245. Id at 10.

246. Id. at 8.



1316 INDIANA LAW REVIEW [Vol. 44: 1287

contains four new requirements that hospital organizations must satisfy in order
to attain or maintain their tax-exempt status. Hospital organizations subject to

Code Section 501(r) are now required to do the following: adopt a written
financial assistance policy; limit charges for emergency or other necessary care;

refrain from engaging in extraordinary collection efforts; and conduct a

community health needs assessment once every three years.^"^^ Except for the
community health needs assessment requirement, these provisions apply for tax
years beginning after the date of enactment of the PPACA (March 23, 2010).

B. Applicability ofCode Section 501 (r) and Definition ofHospital

The requirements ofCode Section 501(r) apply to any organization exempt
from tax under Code Section 501(c)(3) that operates a facility which is required
by a state to be licensed, registered or similarly recognized as a hospital, or
otherwise has hospital care as its principal function or purpose constituting the

basis for its exemption under Code Section 501(c)(3). The PPACA does not
address or define what "similarly recognized" means, nor does it address what

constitutes "hospital care" for purposes of these new requirements. Notably,
under Code Section 501(r)(2)(B), if a hospital organization operates more than
one hospital facility, then each separate facility must meet the new
requirements.

^"^^

C. New Requirements

L FinancialAssistance Policy.—Hospital organizations must have a written
financial policy in place that establishes:

(i) eligibility criteria for financial assistance, and whether such

assistance includes free or discounted care;

(ii) the basis for calculating amounts charged to patients;

(iii) the method for applying for financial assistance;
(iv) in the case ofan organization which does not have a separate billing

and collections policy, the actions the organization may take in the event
of non-payment, including collections action and reporting to credit

agencies; and

(v) measures to widely publicize the policy within the community to be

served by the organization.^"^^

In addition, hospital organizations must have a written policy requiring the

organization to provide care for emergency medical conditions to individuals

regardless of their eligibility under the aforementioned financial assistance

policy.

2. Limitation on Charges.—Hospital organizations must limit the amount

247. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148 § 9007, 124 Stat. 1 19

(2010).

248. I.R.C. § 502(r)(2)(B) (West, Westlaw through 201 1 legislation).

249. Id. § 501(r)(4).



2011] HEALTH LAW 1317

they charge for emergency or other medically necessary care to those individuals

who are eligible for assistance under a financial assistance policy to "not more
than the amounts generally billed to individuals who have insurance covering
such care."^^^

3. Billing and Collections.—Hospital organizations may not engage in
"extraordinary" collections efforts unless they have made "reasonable efforts"
to determine whether an individual is eligible for their financial assistance

policy.
^^^

4. Community Health Needs Assessment.—Within three taxable years
following the PPACA's date of enactment and no less than every three years
thereafter, hospital organizations must conduct a community health needs

assessment.^^^ This assessment must take into account input from persons with

a broad range of interests in the communities they serve and include individuals

with expertise in public health. The assessments must be made widely available
to the public, and hospital organizations must adopt an implementation strategy

to address the community health needs identified in the assessments.^^^ Failure

to comply with this requirement can result in a $50,000 excise tax to the hospital

organization.

Hospital organizations will also be required to file in each taxable year a

description ofhow they are addressing community health needs identified in the
assessment, any identified needs not being addressed and the reasons why they
are not being addressed, and audited financial statements. This description and

the audited financial statements will be reported as part of the organization's

Form PQO.^^"* The PPACA further mandates that the Internal Revenue Service
(IRS) review the community benefit activities of each hospital organization at
least once every three years.^^^

D. Impact on Indiana Hospital Organizations

Hospital organizations in Indiana may have a head start on compliance with
some of the PPACA's new requirements. Specifically, the community health
needs assessment requirement under the PPACA is similar to a requirement
under Indiana law for Indiana nonprofit hospitals to develop and report on a

community benefits plan. Indiana law requires nonprofit hospitals^^^ to develop

250. Id § 501(r)(5).

251. Id §501(r)(6).

252. Id § 501(r)(3).

253. Id § 501(r)(3)(B).

254. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148 § 9007, 124 Stat. 1 19

(2010).

255. Id

256. The Indiana Code defines a "nonprofit hospital" as "a hospital that is organized as a

nonprofit corporation or a charitable trust under Indiana law or the laws of any other state or

country and that is: (1) eligible for tax exempt bond financing; or (2) exempt from state or local

taxes." IND.CODE § 16-21-9-3 (2011).



1318 INDIANA LAW REVIEW [Vol. 44: 1 287

a community benefits plan that these hospitals will use to address the health care
needs of the communities they serve.^" When developing this community
benefits plan, nonprofit hospitals must consider the health care needs of the
communities they serve "as determined by communitywide needs
assessments."^^^ The community benefits plan must consist of"( 1 ) [m]echanisms
to evaluate the plan's effectiveness, including a method for soliciting the views
of the communities served by the hospital[;] (2) measurable objectives to be

achieved within a specified time frame[; and] (3) a budget for the plan."^^'^

Finally, nonprofit hospitals must file an annual report ofthe community benefits
plan with the Indiana State Department of Health and make the report widely
available to the public by posting it in prominent places, including the emergency
room waiting area and the admissions office waiting area.^^^

When one compares the requirements of Code Section 501(r)(3) regarding
a community health needs assessment to the Indiana state law requirements
regarding a community benefits plan, several similarities can be found. The
Indiana Code provisions require, as part of the community benefits plan, that
nonprofit hospitals conduct communitywide needs assessments, and these
communitywide assessments may be similar to what is ultimately required in a
community health needs assessment under Code Section 501(r)(3). Further, the
Indiana Code requires that the community benefit report, which may include the
communitywide assessments, be made widely available to the public, which is
similar to the new requirements in Code Section 501(r)(3). Lastly, the Indiana
Code requires that nonprofit hospitals file an annual community benefit report,
which, depending on further guidance from the Treasury and the IRS, may be
similar to the reporting requirements of Code Section 501(r)(3). In sum, the
existing Indiana Code requirements, while not identical, are similar to the new
requirements of Code Section 501(r)(3) and may make it easier for Indiana
hospital organizations to comply with the new requirements under the PPACA
for community health needs assessments.

Meanwhile, the applicability ofCode Section 501(r) to some Indiana county
and community hospitals remains unclear. While Code Section 501(r) will
require hospitals exempt from taxation under Section 501(c)(3) of the Code to
comply with the new requirements of Code Section 501(r), it does not address
whether hospitals exempt from taxation under another section of the Code,

including many Indiana county or community hospitals, have the same
responsibility.^^' These hospitals are exempt from taxation under Code Section
1 15 or via Treasury Regulation Section 1.1 03-1(b). However, they may have
sought and received rulings that they also qualify as exempt organizations under

Code Section 501(c)(3) in order to offer certain employee benefit plans. Given
that these hospitals do not derive their exempt status from Section 501(c)(3), it

257. Id. § 16-21-9-4.

258. Id. § 16-21-9-5.

259. Id § 16-21-9-6.

260. Id § 16-21-9-7.

261

.

See generally I.R.C. § 502(r) (West, Westlaw through 201 1 legislation).



2011] HEALTH LAW 1319

is unclear whether such hospitals will be subject to the requirements and

penalties contained in Code Section 501(r). Additional guidance regarding this
aspect ofthe law will provide welcome clarity for these particular organizations.

E. Guidance on the Horizon

Hospital organizations can expect that the IRS and the Department of the

Treasury will issue proposed Treasury Regulations that provide clarification on

a number of issues, as evidenced by the issuance of Notice 2010-39 (the

"Notice") in May of this year to solicit comments regarding the application
various aspects of the new requirements on Hospital Organizations.^^^ The
Notice specifically requested comments by July 22, 2010, regarding: (1) the
appropriate requirements for a community health needs assessment;^^^ (2) what
constitutes "reasonable efforts" in determining eligibility for assistance under a

hospital's financial assistance policy (for purposes of the new billing and
collection rule);^^"^ (3) where a hospital organization operates more than one
hospital facility, the consequences of that organization's failure to comply with

the new rules with respect to some, but not all, of its hospital facilities;^^^ and (4)
input for particular areas in need of additional guidance.

With the close ofthe public comment period in July of20 1 0, initial guidance
from the IRS and the Department of the Treasury should be produced in the

coming months.

F. Next Steps

Until guidance is released by the IRS and the Department of the Treasury,

hospital organizations need to be evaluating whether their current policies

address the basic components of the new requirements. Particular attention
should be paid to the requirements for financial assistance policies, limitations

on charges, and billing and collections practices because they are effective for tax

years starting after the date of enactment of the PPACA (March 23, 2010).
Hospital organizations should also begin considering who will perform
community health needs assessments and how they will be performed—these are
optional now and will become mandatory for tax years beginning after March 23,
2012.

V. Health Information Technology

When implemented properly and widely adopted, health information
technology (HIT) is accepted as a means to increase health care system

262. Internal Revenue Serv., Notice 2010-39: Request for Comments Regarding

Additional Requirements for Tax-Exempt Hospitals (2010), available at http://www.irs.

gov/pub/irs-drop/n- 1 0-39.pdf.

263. Id. at 1-2.

264. Mat 3.
265. Id. at 4.



1320 INDIANA LAW REVIEW [Vol. 44: 1287

efficiency, improve patient care and quality, and bend the cost curve.^^^ HIT
allows health care professionals to manage patient care through integrated data
sources like electronic health records (EHRs), decision support systems, and

physician order entry at multiple practice sites through synchronized state and

national health information exchanges.^^^ The development and implementation
ofHIT continues to expand due in large part to the financial incentives unveiled
in this past year's statutory and regulatory developments at the federal level.^^^

The following presents a briefsurvey ofkey HIT developments affecting Indiana
health professionals from October of 2009 to September of 2010.

A. Federal HIT Statutory & Regulatory Development

Since October of 2009, both the federal legislature and administrative

agencies' actions continued to stimulate HIT implementation at the local,
regional, and national level. The promulgation of regulations for the Medicare
and Medicaid Electronic Health Record Incentive Programs ("EHR Incentive

266. Health Information Technology: Can HITLower Costs and Improve Quality?, RAND

Corp. (2005), http://www.rand.org/pubs/research_briefs/RJB9 1 36/indexl .html ("Ifall hospitals had

a HIT system including Computerized Physician Order Entry, around 200,000 adverse drug events

could be eliminated each year, at an annual savings ofabout $1 billion. Most ofthe savings would

be generated by hospitals with more than 100 beds.") (internal citation omitted). But see Spencer

S. Jones et al. Electronic Health Record Adoption and Quality Improvement in US Hospitals, 16

Am. J. Managed Care 64 (2010), available at http://www.ajmc.com/supplement/managed-

care/2010/AJMC_10dec_HIT/AJMC_10decHIT_Jones_SP64to71 ("Mixed results suggest that

current practices for implementation and use of EHRs have had a limited effect on quality

improvement in US hospitals. However, potential 'ceiling effects' limit the ability of existing

measures to assess the effects that EHRs have had on hospital quality. In addition to the

development of standard criteria for EHR functionality and use, standard measures of the effect of
EHRs are needed.").

267. Health information exchanges are organizations that connect health care providers and

enable medical information to follow a patient regardless ofthe treatment location. In Indiana, the

Indiana Health Information Exchange, a nonprofit organization, is one of the largest health

information exchanges in the United States—with a network ofalmost seventy hospitals and 1 9,000
physicians serving over twelve million patients with approximately 2.5 million pieces ofdata added

daily. IND. Health Info. Exchange, Overview, available at http://www.ihie.org/pdfs/IHIE-

Overview.pdf (last visited Aug. 6, 201 1); Rand Corp., supra note 266.

268. Richard Hillestad et al.. Can Electronic MedicalRecordSystems Transform Health Care?

Potential Health Benefits, Savings, and Costs, 24.5 HEALTHAFFAIRS 1003, 1004 (2005) (discussing

benefits and barriers to EHR implementation); see generally David Blumenthal & Marilyn
Tavenner, The "Meaningful Use " Regulationfor Electronic Health Records, 363:6 NEW Eng. J.
Med. 501-04 (2010) (discussing the EHR Incentive Program); see also Interest-free Loans
Available to Help Physicians Adopt Electronic Health Records, UNITEDHEALTH GROUP (Jan. 1 1

,

20 1 0), http://www.unitedhealthgroup.coni/newsroom/news.aspx?id=2 1 9ef4ce-ac 1 e-4dea-8e6d-

aa5c76614a92 (discussing newly available interest-free financing to health care providers to

purchase select EHR technology).



2011] HEALTH LAW 1321

Program") and the comprehensive reform efforts of the PPACA were the
prominent catalysts behind HIT advancement and expansion.

B. EHR Incentive Program

The EHR Incentive Program was established in February of2009 under the
American Recovery and Reinvestment Act of 2009 and the Health Information

and Technology Act (HITECH).^^^ This past year, under HITECH's statutory
authority, both the federal Department ofHealth and Human Services (HHS) and
the Office of the National Coordinator for Health Information Technology

(ONC) released administrative regulations detailing the EHR Incentive
Program.

^^^

In June 2010, ONC issued final rules, standards, and implementation
measures for a temporary certification program for EHR Incentive Program
technology.^^^ Health professionals must use certified EHR technology to
receive the incentive payments.^^^ In July 2010, HHS released the final rules
implementing the EHR Incentive Program, which provide incentive payments
totaling up to twenty-seven billion over the next ten years for eligible

professionals, eligible hospitals, and critical access hospitals participating in the

Medicare and Medicaid programs that adopt, implement, and successfiilly

demonstrate "meaningful use" of certified EHR technology.^^^ Successful
"meaningful use" requires showing that certified EHR technology can be
measured in both quantity and quality by fulfilling two sets of objective
measures: the core set and the menu set.^^"^ The core set consists of basic
measurements such as patient's vital signs, demographic information, and active

medications.^^^ The menu set offers professionals the option to chose from a list
ofapplicable tasks such as drug formulary checks or recording advance directives

for patients sixty-five years of age or older.^^^ Practitioners can expect HHS to
expand and require additional measures in 2013 and 2015 for both sets in order

269. Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5,

123 Stat. 115(2009).

270. Registration/or the Medicare andMedicareEHR Incentive Program IsNow Open, Ctrs.
FOR Medicare & Medicaid Servs., https://www.cms.gov/EHRIncentivePrograms/20_
RegistrationandAttestation.asp (last modified July 29, 201 1).

271. Establishment of the Temporary Certification Program for Health Information

Technology, 75 Fed. Reg. 36,158 (June 24, 2010) (to be codified at 42 C.F.R. pt. 170).

272. Mat 36,160.
273

.

Medicare and Medicaid Programs; Electronic Health Record Incentive Program, 75 Fed.

Reg. 44,314 (July 28, 2010) (to be codified at 42 C.F.R. pts. 412, 413, 422, and 495).

274. CMS EHR Meaningful Use Overview, Ctrs. FOR MEDICARE & MEDICAID Servs.,
https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asp (last modified Apr. 20,

201 1) (discussing meaningful use requirements).

275. Blumenthal & Tavenner, supra note 268, at 502.
276. Mat 503.



1322 INDIANA LAW REVIEW [Vol. 44: 1287

to continuously improve quality care metrics
277

C Patient Protection and Affordable Care Act of2010
The passage of the PPACA in March of 2010 further encouraged the

deployment and adaptation ofHIT by healthcare professionals.^^^ The PPACA'

s

impact on and advancement of HIT is threefold: (1) quality of health care; (2)
operating rules and standards; and (3) HIT availability and workforce.

^^^

Professionals can expect administrative regulations to expand upon these areas
in the coming years.

1. Quality ofHealth Care.—The PPACA emphasizes HIT as a principal
component to improve the quality of reporting, accuracy, and efficiency of data
collection and management.^^^ Under the PPACA, HHS and ONC will develop
national standards for data collection, interoperability, and security measures for

data management systems.^^^ The PPACA will also require collection and public
reporting of certain performance information summarizing data on quality

measures that are in turn aligned with the HIT expansion and interoperability
efforts like the EHR Incentive Program.^^^ In addition, professionals and entities
who receive technical assistance grants under PPACA § 934 (quality
improvement technical assistance and implementation) to demonstrate the

capability to provide information and technical assistance to healthcare providers

are required to coordinate with HIT regional extension centers regarding quality
improvement and system delivery reform.^^^

2. Operating Rules and Standards.—PPACA § 1561 requires HHS and the
HIT policy and standards committees to develop interoperable and secure
standards for enrolling individuals in federal and state health and human service
programs.^^"^ Also, Section 1 104 requires establishing a single set of operating

277. See id. at 504. Meaningful use measurements and criteria will be implemented in three

stages, with each stage adding additional requirements. Currently, Stage 1 is set for 20 1 1 - 1 2, Stage

2 will be implemented in 2013, and Stage 3 in 2015. CMSEHR Meaningful Use Overview, supra
note 274.

278. Patient Protection and Affordable Care Act, Pub. L. No. 1 1 1-148, 124 Stat. 1 19 (2010);

see also HEALTHCARE Info. & Mgmt. Sys. Soc'y, The Patient Protection and Affordable
Care Act: Summary of Key Health Information Technology Provisions (20 1 0), available

a? http://www.himss.org/content/files/PPACA_Summary.pdf(providing a more detailed discussion

of HIT utilization under the PPACA).

279. Id. atl.

280. Id

28 1

.

Patient Protection and Affordable Care Act § 4302(a)(3).

282. Id §§ 399JJ, 10305.

283. Id § 934.

284. The Health IT Standards Committee is responsible for making recommendations to the

National Coordinator for HIT Standards. Health IT Standards Committee (a Federal Advisory'

Committee), OFFICE OFTHENAT'L COORDINATORFOR HEALTH iNFO. TECH., http://healthit.hhs.gOv/

portal/server.pt?open=512&objID=1271&parentname=CommunityPage&parentid=6&mode=2(last



2011] HEALTH LAW 1323

rules to simplify health care administration for actions such as electronic funds

transfers, healthcare payments, health claims, and referral authorization.^^^

3. HITAvailability &. Workforce.—SimilaY to HITECH, the PPACA makes
available grants for qualifying long-term care facilities to acquire certified EHR
technology.^^^ In addition, HHS is seeking to improve HIT availability under the
authority ofPPACA § 61 14, which authorizes a demonstration project to develop
best practices in skilled nursing facilities for the use ofHIT to improve resident
care.^^^ As HIT becomes more available, the health care workforce will face new
tasks and potentially new employment duties requiring the use of HIT. For
example, the PPACA authorized under § 3502 the creation ofcommunity-based
"health teams" comprised of health care professionals from multiple disciplines

and expertise who can competently use HIT in delivery patient care.^^^

D. Indiana State HITDevelopments

This past year, the State ofIndiana began to take steps towards implementing

federally initiated HIT programs. As required by HITECH in order to be eligible
to receive grant awards, Indiana selected Indiana Health Information Technology,

Inc as the qualified state-designated entity.^^^ In March of20 1 0, ONC announced
that Indiana Health Information Technology, Inc. received a $10,300,000 grant

under the HITECH State Health Information Exchange Cooperative Agreement
Program (SHIECAP). SHIECAP is designed to further advance both state and
regional health information exchanges while continuing to work towards unified
nationwide interoperability.^^^ Also, in 2010, HHS awarded $16,008,431 to the
Indiana Health Information Exchange as one of seventeen HIT Beacon
Communities under HITECH.^^^ In addition, the Indiana Medicaid office is in

modified June 30, 2011). The Health Policy Committee is responsible for making

recommendations to the National Coordinator for HIT Standards on issues of policy. Health IT

Policy Committee (a Federal Advisory Committee), OFFICE OF THE Nat'L COORDINATOR FOR

HealthInfo. Tech., http://healthit.hhs.gov/portal/server.pt?open=5 12&objID=1269&parentname

=CommunityPage&parentid=5&mode=2 (last modified July 23, 201 1).

285. Patient Protection and Affordable Care Act § 1 104.

286. Id §2041.

287. Id §6114.

288. Id § 3502.

289. See id §2041.

290. State Health Information Exchange Cooperative Agreement Program, OFFICE OF THE

Nat'L Coordinator for Health Info. Tech., http://healthit.hhs.gov/portal/server.pt?open=

512&objID=1336&mode=2&cached=true (last modified Jan. 19, 201 1).

291. The HITECH Beacon Communities primarily "focus on specific and measurable
improvement goals in the three vital areas for health systems improvement in the Beacon

Community"—quality, cost efficiency, and population health—^to demonstrate HIT's function in
transforming the local health care systems. Beacon Community Program: Improving Health

Through Health Information Technology, OFFICE OF THE Nat'L COORDINATOR FOR HEALTH iNFO.

Tech., http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov onc_



1324 INDIANA LAW REVIEW [Vol. 44: 1287

the planning phases of readiness for the EHR Incentive Program.^^^

E. 2011 Developments and Beyond

From October 2009 to September 20 1 0, as a result offederal efforts (but also
key operations at the state and local level), Indiana took significant steps towards

making HIT a more central component for health professionals' daily patient
care. In the near future, health professionals can expect HIT implementation to
continue to expand with additional federal administrative regulations for both the

EHR Incentive Program and PPACA programs. As this trend continues, Indiana
health professionals can expect increased legislative, administrative, and possible

judicial action in regard to HIT both locally and nationally.

VI. Health Insurance Portability and Accountability Act (HIPAA)
AND Privacy Updates

A. HITECH

Recently, significant developments have occurred within the area ofHIPAA
enforcement. On February 17, 2009, President Obama signed into law the
American Recovery and Reinvestment Act of 2009 (the "Recovery Act").

^^^

Title XIII of the Recovery Act is known as the Health Information Technology
for Economic and Clinical Health Act (HITECH). Among other provisions,
HITECH makes several changes to the administrative simplification provisions
of the Health Insurance Portability and Accountability Act of 1996

(HIPAA)—more specifically, the privacy and security rules.^^"^ These changes
include: extending the applicability of certain of the privacy and security rules'

requirements to the business associates of covered entities; requiring HIPAA-
covered entities and business associates to provide for notification of breaches

of protected health information (PHI) that is unsecured; establishing new

beacon_community_program improving_health_through_health_it/l 805 (last modified May 1 9,
2011).

292. Indiana Electronic Health Records (EHR) Incentive Program, INDIANA MEDICAID FOR

Providers, http://provider.indianamedicaid.com/general-provider-services/ehr-incentive-

program.aspx (last visited Aug. 6, 201 1).

293. American Recovery and Reinvestment Act of 2009, Pub. L. No. 1 1 1-5, 123 Stat. 115.

294. The administrative simplification provisions of HIPAA provided for the establishment

ofnational standards for the electronic transmission ofcertain health information, such as standards

for certain health care transactions conducted electronically and code sets and unique health care

identifiers for health care providers and employers. These provisions also required the

establishment of national standards to protect the privacy and security of personal health

information and established civil money and criminal penalties for violations. The provisions apply

to three types ofentities known as "covered entities' ' : health care providers who conduct covered

health care transactions electronically, health plans, and health care clearinghouses. HIPAA

Administrative Simplification Statute and Rules, U.S. Dep'T OF HEALTH & HUMAN Servs.,
http://www.hhs.gov/ocr/privacy/hipaa/administrative/index.html (last visited Aug. 6, 201 1).



2011] HEALTH LAW 1325

limitations on the use and disclosure of PHI for marketing and fundraising
purposes; prohibiting the sale of PHI; requiring the consideration of a limited

data set as the minimum necessary amount of information; and expanding
individuals' rights to access and receive an accounting of disclosures of their

PHI, and to obtain restrictions on certain disclosures of PHI to health plans.^^^
In addition, HITECH adopts provisions designed to strengthen and expand
HIPAA's enforcement provisions.

Certain HITECH provisions have already been the subject of rulemakings
and related actions, as published by HHS as interim final regulations.

1. Breach Notification.—On August 24, 2009, HHS published interim final
regulations to implement the breach notification provisions ofHITECH.^^^ This

interim final regulation was effective September 23, 2009.
In general, the interim final rule requires covered entities to notify affected

individuals and HHS in the event of a breach^^^ of unsecured PHP^^ that
compromises the security or privacy of the PHI, unless an exception applies.

Accordingly, in order to determine if notice is required under this interim final

rule, a covered entity must make the following three determinations: ( 1 ) whether
a breach of PHI occurred; (2) whether the PHI was unsecured; and (3) whether
an exception applies.^^^ The interim final rule clarified and reasserted the three
exceptions contained in HITECH. Those exceptions are as follows:

(1) Unintentional acquisition, access, or use of PHI by a workforce
member acting under the authority of a covered entity or business
associate, if done in good faith and the information was not further used
or disclosed;

(2) Inadvertent disclosure ofPHI by a person authorized to access PHI
at a covered entity or business associate to another person authorized to

access PHI at the same covered entity, business associate, or organized
health care arrangement, and the PHI was not further used or disclosed;
and

(3) A disclosure ofPHI where there is a good-faith beliefby the covered
entity or business associate that an unauthorized person to whom the
disclosure was made would not reasonably have been able to retain such

295. See generally American Recovery and Reinvestment Act of 2009, tit. XIII.

296. Breach Notification for Unsecured Protected Health Information, 74 Fed. Reg. 42,740

(Aug. 24, 2009) (to be codified at 45 C.F.R. pts. 160, 164).

297. The interim final rule defines "breach" as the "acquisition, access, use, or disclosure of

protected health information" in a manner not permitted by the HIPAA Privacy Rule, "which
compromises the security or privacy of the PHI." Id. at 42,743.

298. The interim rule defines "unsecured PHI" as PHI that is not rendered unusable,

unreadable or indecipherable to unauthorized individuals through the use of a technology or

methodology specified by the Secretary of HHS. Accordingly, if PHI is secured by one of the

methods or technologies listed above, notification is not required under the rule, even if the PHI

was used or disclosed in violation ofthe HIPAA privacy rule. Id. at 42,748.
299. See generally id.



1326 INDIANA LAW REVIEW [Vol. 44: 1287

information.
300

If any of these exceptions applies, notification is not required under the interim

fmal rule. Otherwise, a covered entity must notify affected individuals and HHS
for all breaches under the interim fmal rule.^^^ Depending on the size of the
group affected and the availability ofcontact information, media notice may also
be required. ^^^ All notifications must be given to the affected individual without

unreasonable delay, but no later than sixty days after discovery. A breach is
considered "discovered" on the first day the breach is known, or by reasonable
diligence would have been known, to the covered entity. ^^^ The interim final rule
requires business associates to notify the covered entity under the same standard.
Business associates are not required to provide the notifications themselves.

A covered entity must notify an affected individual via first-class mail at his
or her last known address or, if the individual has agreed to receive electronic
notice, via e-mail.^^"^ The interim final rule specifies that for deceased
individuals, the covered entity must provide the notification to the individual's

next of kin or personal representative.^^^ The notice must contain at least the
following elements, in plain language:

(1) A brief description of what happened, including the date of breach
and the date of discovery of the breach;

(2) A description of the types of unsecured PHI involved in the breach
(i.e., whether full name, Social Security number, date of birth, home
address, account number, diagnosis, disability code or other types of

information were involved);

(3) Any steps that individuals should take to protect themselves from
potential harm resulting from the breach;

(4) A briefdescription ofwhat the covered entity is doing to investigate
the breach, to mitigate the harm to individuals and to protect against any
further breaches; and

(5) Contact procedures for individuals to ask questions or learn

additional information, which must include a toll-free telephone number,

an e-mail address, Web site, or postal address.^^^

Similarly, on August 25, 2009, the Federal Trade Commission (FTC) published
final regulations implementing the breach notification provisions for personal

300. Id. at 42,746-47.

301. M at 42,748-49.
302. For breaches involving more than 500 residents, a covered entity must also notify

prominent media outlets. In such instances, a covered entity must also notify HHS at the same time,
in the manner and form to be prescribed on HHS's website. Id. at 42,75 1

.

303. Mat 42,749.
304. Id at 42,750.

305. Id

306. Id. The interim fmal rule specifies that the requisite information may be given in separate

notices, if necessary.



20 1 1
]

HEALTH LAW 1327

health record vendors and their third party service providers.^^^ This interim final

rule was effective September 24, 2009.

For purposes of determining the information to which the HHS and FTC
breach notification regulations apply, HHS also issued—first on April 27,
2QQ9 308 ^j^j ^j^gj^ j^^gj, ^j|.j^ j|.g jntgj-ji^ final j^lg—tjig guidance required by the
HITECH Act specifying the technologies and methodologies that render PHI
unusable, unreadable, or indecipherable to unauthorized individuals.

2. Increased Civil Monetary Penalties.—To conform the provisions of the
enforcement rule to the new tiered and increased civil money penalty structure
made effective by the HITECH Act on the day after enactment (February 18,
2009), HHS published an interim final rule on October 30, 2009 that became
effective November 30, 2009.^^^

3. 2010 Notice ofProposedRulemaking.—On July 14, 2010, HHS formally
published its proposed regulations implementing changes made to the privacy,
security, and enforcement rules by HITECH.^ '^ When finalized, the new
regulations will implement the statutory amendments made to HIPAA under
HITECH. The proposed rules concern the privacy and security standards issued
pursuant to HIPAA, as well as the enforcement rules that implement HIPAA's
civil money penalty authority.

Although the effective date of February 17, 2010 for many HITECH
provisions has passed, the proposed rules and final rule (expected in March of
201 1) provide specific information regarding the expected date of compliance

and enforcement ofthe new requirements. HHS has recognized that it would be
difficult for covered entities and business associates to comply with the new
regulations until after these rules are finalized. Therefore, for most provisions,

HHS intends to set the effective date for compliance at 1 80 days after the final
rule is published.

4. Extending Privacy Requirements to Business Associates.—Historically,
HIPAA applied to business associates only indirectly through business associate
agreements with covered entities. HITECH requires business associates to
comply not only with the privacy terms required in HIPAA business associate
agreements, but also with "additional" privacy requirements.^'^ The proposed
rules modify the privacy rule in several ways to address the permitted and
required uses and disclosures of PHI by business associates.^ '^

307. Health Breach Notification Rule, 74 Fed. Reg. 42,962 (Aug. 25, 2009).

308. Guidance Specifying the Technologies and Methodologies That Render Protected Health

Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, 74 Fed. Reg.

19,006(Apr. 27, 2009).

309. HIPAA Administration Simplification: Enforcement, 74 Fed. Reg. 56,123 (Oct. 30,
2009).

3 1 0. Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health
Information Technology for Economic and Clinical Health Act, 75 Fed. Reg. 40,868 (July 14,

2010) (to be codified at 45 C.F.R. pts. 160, 164).

311. American Recovery and Reinvestment Act of 2009, tit. XIII, § 13404.

312. ^'ee 45 C.F.R. § 164.502.



1328 INDIANA LAW REVIEW [Vol. 44: 1287

First, HHS proposes to modify the rules to clarify that a business associate,
like a covered entity, may only use or disclose PHI as permitted or required by
the privacy rule or the enforcement rule.^^^ The proposed changes also clarify the
particular sections of the privacy rule that apply only to covered entities.^^"^

Second, HHS proposes that business associates may use or disclose PHI only
as permitted or required by the business associate agreement, for the business
associate's own management and administration, or for the provision of data
aggregation services relating to the health care operations ofthe covered entity.^

'^

If the business associate and covered entity have failed to enter into a business

associate agreement or other arrangement, then the business associate may use
or disclose the PHI only as necessary to perform its obligations for the covered
entity.^ '^ The proposed rule continues to place the burden on the covered entity
to obtain a business associate agreement.^ '^ Notably, however, a person or entity

that meets the definition of"business associate" under the regulations would still
be required to follow the applicable portions of the privacy rule regardless of

whether a business associate agreement is in place. The proposed rule also
makes it clear that a business associate would not be permitted to use or disclose
PHI in a way that would violate the requirements of the privacy rule.^^^

Third, business associates also would be required to disclose PHI to the
Secretary ofHHS to investigate or determine the business associate's compliance
with the privacy rule.^^^ Business associates also would be required to disclose
PHI to the covered entity, individual, or individual's designee, as necessary, to
satisfy the covered entity's obligations to respect an individual's request for an

electronic copy of PHI.^^^

Finally, the proposed rule also would apply the minimum necessary standard
directly to business associates.^^^

5. Proposed Security Rule Changes Affecting Business Associates.—
HITECH applies the primary requirements of the HIPAA security rule to
business associates, including the requirement that business associates implement

administrative, physical, and technical safeguards and meet the policies and

documentation standards. The proposed rule introduced an expansion of the

statutory requirement under HITECH by proposing that a business associate
would be required to comply with the entire HIPAA security rule.^^^

313. Id.

314. Id.

315. Mat 40,9 19-20.
316. Mat 40,919.
317. Mat 40,9 19-20.
318. Mat 40,919.
319. M
320. Id.

321. Id

322. Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health

Information Technology for Economic and Clinical Health Act, 75 Fed. Reg. 40,868, 40,872 (July

14,2010).



201 1] HEALTH LAW 1329

Also, to be consistent with the privacy rule, the proposed security rule

revisions also would require business associates to have business associate

agreements with their subcontractors, as discussed in more detail below.

6. New "Subcontractor" Category?^^—The regulations propose to expand
the definition of "business associate" to include the new category of
"subcontractors," which are individuals or agencies that act on behalf of a

business associate in a manner that requires access by the subcontractor to the

covered entity's protected health information. Under the proposed language, a
subcontractor need not have entered into a formal business associate agreement

to be subject to the same rules and regulations that apply to the business
associate.^^"^ Accordingly, any such individual or agent is included under the

proposed definition.

7. RequirementsforBusinessAssociateAgreements.
^^^—^Under the proposed

rules, covered entities will no longer be required to report to HHS when a pattern
or practice of a business associate violates the business associate agreement and

termination of the arrangement is not feasible. According to commentary
contained in the proposed regulations, such a requirement is no longer necessary

in light of the breach notification rule and the direct liability of business

associates under HITECH.
Business associates will be required to take reasonable steps to cure

violations of a business associate subcontractor agreement if the business

associate becomes aware of a pattern or practice of a subcontractor that violates

the agreement.^^^ This provision simply requires business associates to respond

to noncompliance by their subcontractors in the same way that covered entities
are required to respond to noncompliance by their business associates.
Business associate agreements will be required to include provisions providing

that business associates will do the following:

(1) Comply with the security rule with regard to electronic protected
health information;

(2) Report breaches ofunsecured PHI to covered entities in accordance
with the breach notification rule;

(3) Ensure that their subcontractors agree to the same restrictions and
conditions as apply to the business associate; and

(4) Comply with the privacy rule requirements as if it were the covered
entity in those instances when the business associate is carrying out the
covered entity's obligation under the privacy rule.^^^

The proposed rules also stipulate that business associate subcontractor
agreements will be required to meet all ofthe requirements applicable to business
associate agreements.

323. Mat 40,873.
324. Id.

325. See generally id. at 40,887.

326. Id at 40,888.

327. Mat 40,889.



1330 INDIANA LAW REVIEW [Vol. 44: 1287

HHS has acknowledged the anticipated administrative burden and cost to
implement the revised business associate agreement provisions ofthe privacy and

security rules. Therefore, the proposed rules introduce transition provisions that

allow covered entities and business associates to continue to operate under

certain existing contracts for up to one year beyond the compliance date.^^^

B. Other Changes to the Privacy Rule

1. Access to Electronic Protected Health Information.—Currently, the
privacy rule provides individuals with the right to access and request copies of

their PHI.^^^ The proposed rules state that covered entities must provide access
to hard copy or electronic PHI in both the form and format requested by the
individual, if such PHI is readily available in that form or format. If it is not, the
covered entity must provide access to a legible alternative form and format

agreed upon by the individual and the covered entity.^^^ Additionally, ifthe PHI
requested is maintained electronically and the individual requests it in electronic

form, the covered entity must provide the PHI in the electronic form requested
if it is readily producible in that form. If it is not readily producible in that form,

the covered entity must provide the PHI in an alternate electronic form. The
covered entity may still charge a reasonable cost-based fee for any electronic
media it provides.^^^ The proposed rules also provide that covered entities must
honor patients' written requests to transmit PHI to another designated individual,
provided that the request contains the patient's signature and clearly identifies

the recipient and where to send a copy of the PHI.

2. Restrictions on PHI Disclosures for Services Paid Out of Pocket in
Full?^^—HIPAA provides an individual the right to request restrictions on how
a covered entity uses and discloses his or her PHI, but covered entities are not

required to agree to such requests. HITECH, however, changed this for
disclosures relating to services for which the individual paid out of pocket in

full.^^^ The proposed rules implement that change and clarify that covered
entities are required to comply with a patient's request to restrict disclosure of

PHI to a health plan if: the PHI relates exclusively to health care items or
services provided; the patient (or an individual on the patient's behalf) paid for

the items or services in full; and disclosure is not otherwise legally required.

Covered entities are also prohibited from disclosing the restricted PHI to the
health plan's business associates.

3. Additional Provisions in Notices ofPrivacy Practices.—The proposed
rules require covered entities to ensure that their notices of privacy practices

include language stating that:

328. Id.

329. Mat 40,901.
330. Id.

331. Mat 40,902.
332. Mat 40,905.
333. M



2011] HEALTH LAW 1331

(1) Most disclosures of PHI for remuneration will require the
individual's authorization;

(2) Most uses and disclosures of psychotherapy notes will require the
individual's authorization;

(3) Most uses and disclosures for marketing purposes will require the
individual's authorization; and

(4) The individual has the right to request restrictions on PHI disclosures
for services paid out-of-pocket in full.^^"^

Additionally, ifa health care provider intends to send communications regarding

treatment alternatives or other health-related products or services and the

provider will receive financial remuneration in return for making the

communication, the provider's notice of privacy practices must inform the

individual of that intention as well as the individual's ability to opt out of

receiving such communications.

4. Marketing.—The new rules revise the definition ofmarketing to exclude
certain types of communications from the term. Under HIPAA, marketing is
defined as "a communication about a product or service that encourages

recipients of the communication to purchase or use the product or service."^^^

HITECH maintained that definition but clarified that "marketing" does not
include several types of communications. First, it does not include

communications for treatment of an individual by a health care

provider
—

"including case management or care coordination for the individual,
or to direct or recommend alternative treatments, therapies, health care providers,
or settings of care to the individual."^^^ Second, it does not include

communications to "provide refill reminders or otherwise communicate about a

drug or biologic that is currently being prescribed for the individual, only if any

financial remuneration received by the covered entity in exchange for making the
communication is reasonably related to the covered entity's cost of making the
communication.

"^^^

Furthermore, communications for the following health care operations

activities are not "marketing," except where the covered entity receives financial

remuneration in exchange for making the communication:

(A) To describe a health-related product or service (or payment for such
product or service) that is provided by, or included in a plan of benefits

of, the covered entity making the communication, including
communications about: The entities participating in a health care
provider network or health plan network; replacement of, or

enhancements to, a health plan; and health-related products or services

available only to a health plan enrollee that add value to, but are not part

334. Id.

335. Mat 40,918.
336. Id.

337. Id



1332 INDIANA LAW REVIEW [Vol. 44: 1287

of, a plan ofbenefits; or (B) For case management or care coordination,
contacting of individuals with information about treatment alternatives,

and related functions to the extent these activities do not fall within the

definition of treatment.^^^

Ifmarketing involves direct or indirect financial remuneration, the authorization

obtained from the individual must disclose that such remuneration is involved.^^^

a. Sale ofPHI.—Under the proposed rules, the sale ofPHI for any direct or
indirect financial remuneration generally would necessitate a prior written
authorization, which must explain that the covered entity will receive

remuneration for the disclosures.^"*^ Such PHI could be exchanged for direct or
indirect remuneration in the following circumstances without prior written

authorization:

(1) Disclosures of PHI for public health activities;

(2) Disclosures of PHI for research purposes if the remuneration
received is a reasonable cost-based fee to cover the actual cost of

providing the PHI;

(3) Disclosures of PHI for treatment or payment purposes;

(4) Disclosures of PHI for "the sale, transfer, merger, or consolidation
of all or part of the covered entity and for related due diligence";

(5) Disclosure of PHI to the individual or to provide an accounting of
disclosures to the individual;

(6) Disclosures required by law;

(7) Disclosures otherwise permitted by the privacy rule; and

(8) Disclosures of PHI for payment purposes.^"**

b. Fundraising.—The proposed rules require a covered entity's notice of
privacy practices to disclose that the individual may be contacted for fundraising
purposes and that the individual may opt out of being contacted at any time.^"*^
In addition, every fundraising communication must include a "clear and

conspicuous" option to opt out offurther fundraising communications. The opt-
out method cannot be unduly burdensome or cause the individual to incur more

than a nominal cost.^"*^

c. Minimum necessary rule.—The HITECH Act currently provides that a
covered entity will be deemed to have complied with the minimum necessary
principle if it limits uses and disclosures ofPHI to a limited data set, to the extent

338. Id.

339. For these purposes, "financial remuneration" means "direct or indirect payment from or

on behalf of a third party whose product or service is being described. Direct or indirect payment

does not include any payment for treatment of an individual." Id. at 40,919.

340. Mat 40,890.
341. Id

342. Id at 40,896.

343. Id



2011] HEALTH LAW 1333

practicable.^'^'^ This statutory requirement is currently effective but will sunset

on the effective date of guidance HHS is required to issue on this topic. To
prepare for its release of that guidance, HHS has requested comments on what
aspects of the minimum necessary standard covered entities and business
associates would find most helpful to have HHS address, as well as any questions
about how to appropriately determine what constitutes the "minimum necessary"
to comply with the privacy rule.^"^^

d. Compound authorization for research.^^^—In general, authorizations
required by the privacy rule cannot be combined with other documents, and the

provision oftreatment or payment, enrollment in a health plan, or eligibility for

benefits may not be conditioned on receipt of an authorization unless the
treatment is research-related. In the proposed rule, HHS set forth limited
exceptions for research authorizations whereby covered entities would be
permitted to combine conditioned and unconditioned authorizations presented for

research purposes—^provided that the authorizations clearly denote which, ifany,
research components are conditioned upon receipt of authorization and clearly

disclose individuals' right to opt in to any unconditioned research activity. In

addition, HHS is seeking comment on whether and how the privacy rule could
be amended to permit authorization for fixture or secondary research uses of
PHI.'"'

e. Decedent 's health information.
-^^^—HHS has proposed to remove from the

definition ofPHI decedent's health information after fifty years ofthe decedent's
death. Also, the proposed rule revises the definition of"individually identifiable

health information" so that information regarding persons who have been
deceased for more than fifty years will not constitute PHI.^"^^ Also, the proposed
rule will expand access to a decedent's PHI to family members and others
involved in the care of the patient prior to death, unless doing so is inconsistent

with the decedent's previously expressed preference.

/ Disclosure of student immunization records.—The proposed rule
acknowledges that state law may now require schools to acquire student
immunization records prior to enrollment.^^^ In states with such requirements,

covered entities would be permitted to disclose student immunization records to
schools based on a parent's oral agreement, as opposed to written
authorization.^^*

g. Changes to the enforcement rule.^^^—HITECH modified the potential
civil money penalties under HIPAA, creating a structure whereby penalties are

344. Id.

345. Id.

346. Mat 40,907.
347. Id

348. Id at 40,894. '

349. Id

350. Mat 40,895.
351. Id (with codification to be at 45 C.F.R. § 164.512(b)).

352. Id at 40,875.



1334 INDIANA LAW REVIEW [Vol. 44: 1287

tiered based on the covered entity's perceived culpability for the violation.
Accordingly, violations would become more severe based on whether the
circumstances involved "reasonable cause" or "willful neglect."^" HHS
published an interim final rule in October of 2009 clarifying the penalty
structure,^^"^ and the proposed rule further clarified that structure.

The proposed rule modified the definition of"reasonable cause" to mean "an
act or omission in which a covered entity or business associate knew, or by
exercising reasonable diligence would have known, that the act or omission
violated an administrative simplification provision, but in which the covered
entity or business associate did not act with willful neglect."^^^

VII. Indiana Legislative Update

A. Bodily Substance Samples Procedures in Hospitals

Effective March 12, 2010, Senate Enrolled Act 342 amends a provision of
the state's implied consent law, clarifying that bodily substance samples taken

in a hospital may be taken by any person who is trained in taking such samples
and who is acting under the direction of, or under a protocol approved by, a
physician.^^^ The clarification in the law was sought by the Indiana Prosecuting
Attorneys Council as a result of a 2009 Indiana Court of Appeals case in which
the court ruled that blood drawn by a certified lab technician within a hospital
was inadmissible as evidence in a criminal investigation because a "certified lab
technician" was not listed in the law as an individual authorized to take samples
for evidentiary purposes.^^^ In addition, the court held that the evidence was
inadmissible because the certified lab technician did not technically adhere to the

hospital's physician-approved protocol when drawing the blood. ^^^

B. Paternity Affidavits Executed in Hospitals

Effective July 1, 2010, Senate Enrolled Act 178 made changes to the legal
consequences of paternity affidavits executed for children bom out ofwedlock,
ultimately allowing the mother and the supposed father to agree to share joint

legal custody of the child.^^^ Notably for hospitals and their staff, paternity

affidavits executed in the hospital within seventy-two hours of the child's birth

must be presented to the mother and the supposed father separately before they

are signed.^^*^ In addition, hospital staff must offer individuals under the age of

353. Id

354. HIPAA Administrative Simplification: Enforcement, 74 Fed. Reg. 56,123 (Oct. 30,
2009).

355. 75 Fed. Reg. at 40,878.

356. See generally IND. CODE § 9-30-6-6(j) (201 1).
357. Brown v. State, 91 1 N.E.2d 668, 673 (Ind. Ct. App. 2009).

358. Id at 672-73.

359. See generally 2010 Ind. Acts 321-27, 329-30.

360. Ind. Code § 16-37-2-2.1(p).



2011] HEALTH LAW 1335

eighteen an opportunity to consult with an adult regarding the contents of the

paternity affidavit before signing it.^^'

C Uniform Cease and Desist Order

Effective July 1, 2010, Senate Enrolled Act 356, the state's omnibus

professional licensing bill, made several changes that will affect the state's health
care practitioners. Most notably, the act establishes a uniform procedure to allow
the board of a regulated profession to issue a cease and desist order against a

person who is participating in activities that require a license, certification, or
registration.^^^ The uniform process will allow a board to file a complaint with

the attorney general.^^^ The attorney general will then investigate and may file
a motion for a cease and desist order with the appropriate board.^^"^ The board

will have the option ofholding a "show cause" hearing, and based on the findings
of that hearing, it may issue a cease and desist order regarding the same.^^^ A
cease and desist order issued under the new uniform process is enforceable in the
circuit or superior courts.

^^^

D. Dispensing to an Individual Unknown to a Retail Pharmacist

Effective July 1, 2010, Senate Enrolled Act 356 also prohibits a retail

pharmacist, pharmacy technician, or person authorized by a pharmacist to
dispense a controlled substance ("dispensing individual") from dispensing a

controlled substance to a customer who is not personally known to the dispensing
individual, unless the customer provides proof of identification.^^^

E. INSPECT: Good Faith Reporting to Law Enforcement

Effective July 1, 2010, Senate Enrolled Act 356 also amends the state's
collection and tracking program (INSPECT) by attempting to grant practitioners
civil and criminal immunity when they, in good faith, report possible drug
seeking patients to law enforcement.^^^ It should be noted that despite the civil

and criminal immunity, practitioners are still bound by state and federal privacy
laws, including HIPAA.^^^ As a result, practitioners will still need to have either
the patient's authorization or meet a HIPAA exception prior to releasing any
INSPECT information to law enforcement.

361. Id. § 16-37-2-2. l(r).

362. See generally 20\Q Ind. Acts 932-1010, 947-48.

363. Ind. Code § 25-l-7-14(a).

364. Id. §25-l-7-14(a)(l).

365. Id §25- 1-7- 14(a)(2).

366. Id § 25- 1-7- 14(d).

367. See generally 2010 Ind. Acts 932-1010, 1002.

368. See generally id. 2ii\0Q6.

369. See generally id. dLX\002-Q6.



1336 INDIANA LAW REVIEW [Vol. 44:1287

F. Abandoned Medical Records

Effective July 1, 2010, Senate Enrolled Act 356 establishes procedures for

the attorney general to take possession of, store, maintain, transfer, protect, and

destroy abandoned health records and other records containing personally

identifying information.^^^ The law requires the attorney general to make
reasonable efforts to notify the patients named in the records that the attorney
general has taken possession ofthe records.^^^ Unless prohibited by law, the law

also authorizes the attorney general to notify professional organizations,

hospitals, law enforcement agencies, and government units, "who may be able
to assist in notifying persons whose records were abandoned and secured by the
attorney general.

"^^^

370. See generally id. at 933-35.

371. IND. Code § 4-6-14-7(a).

372. Id. § 4-6-14-7(b).