News / Resources

Welcome to this week's edition of the Health Law Update. Topics covered today include:

• NLRB Drastically Alters Unit Determination Rules for Long-Term Acute Care and Nonacute Care Facilities
• Dramatic Increase in Healthcare Fraud Prosecutions
• Medicaid RAC Program Final Rule Released 
• Direct Patient Access to Laboratory Test Results
• Ohio Supreme Court Allows Providers to Seek Deeper Pockets
• E-Prescribing Incentive Program Final Rule Makes Changes Clarifying Relationship to EHR Incentives and Adds Hardship Exemptions
• California Strengthens Breach Notification Requirements
• Cloud Computing in Healthcare: HIPAA, HITECH and Contracting Considerations
• Events Calendar

NLRB DRASTICALLY ALTERS UNIT DETERMINATION RULES FOR LONG-TERM ACUTE CARE AND NONACUTE CARE FACILITIES

On August 26, 2011, the National Labor Relations Board (Board) issued two decisions which drastically alter the unit determination rules for long-term acute care and nonacute care facilities. As Member Brian Hayes noted in one of his dissents, these rulings appear intended to reverse years of declining union representation in the United States, both within and outside the healthcare industry.

Section 9 of the NLRA and 1974 Amendments for the Healthcare Industry

Section 9 of the National Labor Relations Act (the Act) discusses employee representation by unions and recognition of employee bargaining units, including who may be in a bargaining unit, and what happens when the employer disagrees with the bargaining unit proposed by a union. The Board usually is the final arbiter of what is an "appropriate unit," subject to judicial review.

In 1974, Congress amended the Act to address concerns in the healthcare industry. The amendments did not alter the Board’s ability to make unit determinations, but the legislative history of the amendments noted concern about the undue proliferation of bargaining units in healthcare. Partly in response, in 1989, the Board promulgated Rule 103.30, which discusses appropriate bargaining units in acute care hospitals (the Healthcare Rule). The Healthcare Rule identifies eight appropriate bargaining units as the only units the Board may recognize, except in extraordinary circumstances or where there is an existing nonconforming unit.

The Board did not issue a similar rule for nonacute healthcare, but in a 1991 decision, Park Manor Care Center, the Board adopted a "pragmatic" or "empirical" "community of interest" standard for nonacute healthcare facilities. Specifically, the Board directed that unit determinations should consider not just the "community of interest" among the employees, but also information obtained about the long-term care industry when the Board issued the Healthcare Rule and in Board decisions issued before the Healthcare Rule (i.e., when the Board was looking into possible undue proliferation of bargaining units and the effect of unionization on the industry).

This was the backdrop for the Board’s August 2011 decisions.

Specialty Hospital of Washington Hadley, LLC: Union May Unilaterally "Perfect" Inappropriate Acute Care Unit

Specialty Hospital of Washington-Hadley, LLC, and 1199 SEIU, United Healthcare Workers East involved the acquisition of an acute care facility and the question of whether the entity acquiring the hospital had a duty to recognize, and bargain with, the union representing a unit of mostly technical employees at the facility. The successor, Specialty Hospitals of America, LLC, acquired the assets of Hadley Memorial Hospital in Washington, D.C., creating a successor entity, Specialty Hospital of Washington-Hadley (Specialty Hospital). Prior to the acquisition, the SEIU, United Healthcare Workers East (the Union) had been certified as the exclusive representative of a group of employees working at Hadley Memorial. In addition to technical workers, the unit included guards and pharmacists. Before the acquisition, the Union and Hadley Memorial had begun, but had not completed, negotiations for a collective bargaining agreement.

There was no dispute that Specialty Hospital was a successor employer under the Act; witness testimony and party stipulations established clear continuity of operations before and after the acquisition. In addition, there was no dispute that the bargaining unit certified before the acquisition was inappropriate under Section 9. The unit included guards, excluded by Section 9(b)(3), and it also included pharmacists, who are professional employees. Under Section 9(b)(1), professional employees may not be included in a bargaining unit with nonprofessional employees without first having been given the opportunity to vote separately on the question of representation.

Shortly after consummation of the sale, a representative of the Union spoke with the attorney for Specialty Hospital and informed the attorney that the Union was prepared to begin bargaining with the new owner. Approximately two weeks later, Specialty Hospital’s attorney responded in writing, stating that Specialty Hospital was not prepared to recognize the Union as the exclusive representative because it was an inappropriate bargaining unit under the Act. Three months later, the Union renewed its request to bargain, stating that it was willing to disclaim interest in representing the guards. The Union also was willing to disclaim its interest in representing the pharmacists or to give them the opportunity to vote on their inclusion in the unit.

Specialty Hospital declined the offer, and the Union filed an unfair practice charge alleging that the employer, by refusing to bargain, had violated Sections 8(a)(5) and (1) of the Act. The matter proceeded to hearing before an Administrative Law Judge (ALJ) who concluded that the Union had "perfected" the bargaining unit by disavowing any interest in representing the guards and the pharmacists or agreeing to afford the pharmacists the opportunity to decide whether they wanted to be part of the unit.

When an employer acquires only a portion of a predecessor’s operation, it may nonetheless be considered a "successor" under the Act and have a duty to bargain with the existing union. The ALJ found no "significant difference" between that situation and the case before him, where the Union unilaterally dropped certain positions from the predecessor employer’s unit.

Moreover, the ALJ rejected the employer’s argument that Section 9 and the Healthcare Rule precluded the NLRB from recognizing the new "perfected" unit. The ALJ determined that because the facility combined acute care and long-term care, the Healthcare Rule did not apply. And even if it did apply, it would not control here because the unit was an "existing nonconforming unit." The fact that the "perfected" unit was different than the unit that had been recognized by the predecessor employer was of no import.

Therefore, the ALJ found that the employer had violated Sections 8(a)(5) and 8(a)(1) of the Act when it refused to bargain with the Union.

In a 2-1 decision, with Member Hayes dissenting, the Board agreed. First, it found "no persuasive reason" why the Union’s alteration of the unit should be treated any differently from an employer’s acquisition of less than the entire operation of its predecessor. Therefore, the Board would presume that union representation reflected the will of the majority in the altered bargaining unit.

Second, the Board agreed that the perfected unit was an "existing nonconforming unit" and therefore one of the exceptions to the Healthcare Rule. Apart from its internal inconsistency, this portion of the ruling is difficult to understand as anything other than an abdication of the Board’s duties under Section 9. The Board did not address the ALJ’s ruling that the Healthcare Rule did not apply at all because the facility combined long-term care and acute care facilities.

The logic of the holding is difficult to follow. The "perfected" unit and the "existing" unit could not be the same, absent some "de minimis" exception not contained in the Act. What the Board seems to have done is allow the union to perform the Board’s obligations under Healthcare Rule 103.30 section (c). So, although the ALJ and the Board found the perfected unit to be appropriate, the process for determining exclusive representation set forth in Section 9 was not followed.

The majority expressed the view that its holding would promote industrial peace because employees would not be subject to the vagaries of corporate acquisitions. As the dissent pointed out, the decision seems to undermine industrial peace, raising a myriad of unanswered questions, such as what changes will "perfect" a nonconforming unit and under what circumstances the Board might allow unilateral "perfection."

NLRB Overturns Park Manor and Finds Overwhelming Community of Interest Necessary to Trump Presumptively Appropriate Unit Organized by Union

In Specialty Healthcare and Rehabilitation Center of Mobile and United Steelworkers, District 9, the Board overturned a 20-year-old precedent applicable to nonacute care facilities. In so doing, once again, the Board reflects a high level of deference to unions’ bargaining unit determinations.

Specialty Healthcare and Rehabilitation Center of Mobile (Specialty) operated a nursing home and rehabilitation center; the union sought recognition of a bargaining unit comprised solely of Certified Nursing Assistants (CNAs). In an acute care setting, CNAs typically would be included in a bargaining unit of technical employees. When the Regional Director sided with the union, Specialty petitioned the Board for reconsideration, arguing that the smallest appropriate unit included both CNAs and other technical employees at the facility. The Board affirmed the decision of the Regional Director, and the employer filed a petition for review.

Rather than simply deciding the issue at hand, the Board issued a notice and request for amici to respond to eight separate questions. The questions included whether the Board should reconsider the test in Park Manor and, ominously, "where there is no history of collective bargaining, should the Board hold that a unit of all employees performing the same job at a single facility is presumptively appropriate if...the employees in the proposed unit [share] a community of interest."

As foreshadowed by these questions, the resultant decision did away with Park Manor, which the Board expressly overruled. It also significantly raised the bar for employers who challenge bargaining units organized by unions, which the Board will consider "presumptively appropriate." Now, in all cases where the Healthcare Rule does not apply, the traditional community of interest test will apply, and the Board no longer will consider empirical evidence about the industry and the workplace. In addition, where the employer contends that the bargaining unit proposed by the union is inappropriate because it excludes certain employees, the employer will have to demonstrate an "overwhelming" community of interest between the unit organized by the union and the excluded employees.

Once again, it is difficult to square the Board’s stated rationale with its actual decision. For example, while the Board said that it overruled Park Manor and that it would look solely at the community of interest among putative unit members, the Board recited at length from amici briefs about significant differences between nonacute long-term care facilities and acute care hospitals, which can affect staffing patterns and duties. This harkens to the "empirical community of interest" standard the Board purports to reject.

In addition, the Board gave lip service to Section 9(c)(5) of the Act, which states that in determining appropriate units, "the extent to which the employees have organized should not be controlling." But when it concluded that a unit organized by a union is "presumptively" appropriate, the practical effect was to make the "extent to which employees have organized" controlling, unless the employer can show some "overwhelming" reason why that should not be the case.

It remains to be seen whether this decision will be limited in the future to nonacute care settings. In his dissent, Member Hayes expressed concern that all bargaining unit determinations now will be subject to the "overwhelming" community of interest standard where the employee believes a bargaining unit should include other employees. The breadth of the opinion suggests that this might indeed be the case.

Conclusion

The Board’s extreme deference to unions’ decisions about who belongs in a bargaining unit (and who does not) seems driven by a desire to lower barriers to organizing contained in the Act itself. That being the case, employers must look either to the courts or to Congress for relief. In the meantime, all employers acquiring entities with unions in place would be well advised to resolve bargaining unit questions during due diligence. For nonacute care facilities, Specialty Healthcare and Rehabilitation Center of Mobile suggests that it may too late to prevent CNAs from organizing separately from other technical employees.

The attention the Board has focused on unit determinations is all the more troubling in light of new rules the Board has proposed for union representation elections. If they become effective in their current form, these rules will defer resolution of most employer objections until after the election. The rare exception is for bargaining unit determinations. These two decisions suggest that such challenges now may be even more difficult for employers to win.

For more information, please contact Ellen J. Shadur, or 310.442.8816.

top of page

DRAMATIC INCREASE IN HEALTHCARE FRAUD PROSECUTIONS

In the first eight months of fiscal year 2011, the U.S. Department of Justice (DOJ) has prosecuted 903 cases of healthcare fraud, according to a recent report by the Transactional Records Access Clearinghouse. Assuming the government prosecutions continue at such pace, the report projects a total of 1,400 healthcare prosecutions for fiscal year 2011, an 85 percent increase over fiscal year 2010. Such a dramatic increase in prosecutions can be at least partially attributed to the work of the joint DOJ-Health and Human Services Medicare Fraud Strike Force (Strike Force). The Strike Force is a team of federal, state and local investigators designed to combat Medicare fraud through the use of Medicare data analysis techniques and an increased focus on community policing. Since their inception in March 2007, Strike Force operations in nine locations have charged more than 1,140 defendants who collectively have been accused of falsely billing the Medicare program for more than $2.9 billion.

A recent nationwide coordinated takedown by Strike Force operations in eight cities resulted in charges against 91 defendants, including doctors, nurses and other medical professionals for their alleged participation in Medicare fraud schemes involving approximately $295 million in false billing. Additionally, Strike Force agents executed 18 search warrants in connection with ongoing Strike Force investigations. The DOJ advises this coordinated takedown involves the highest amount of false Medicare billings in a single takedown in Strike Force history. The charges alleged are based on a variety of purported fraud schemes involving various medical treatments and services such as home healthcare, physical and occupational therapy, mental health services, psychotherapy and durable medical equipment (DME). The DOJ warns that, in many cases, the indictments and complaints allege that patient recruiters, Medicare beneficiaries and other co-conspirators were paid cash kickbacks in return for supplying beneficiary information to providers, so that the providers could submit fraudulent bills to Medicare for services that were medically unnecessary or never provided. A Houston area defendant is alleged to have sold beneficiary information to 100 different Houston area home healthcare agencies in exchange for illegal payments. This defendant and one other Houston area individual are alleged to have perpetrated fraudulent schemes involving $62 million in false billings for home healthcare and DME.

Attorney General Eric Holder cautions such increased enforcement efforts will be continuing, "Our highly coordinated, nationwide Strike Force operations are working aggressively to combat Medicare fraud and our anti-healthcare fraud efforts have never been more innovative, collaborative, aggressive -- or effective." In the face of such "innovative and aggressive" enforcement activities, providers should review their existing compliance plans and ensure such plans adhere to current guidelines. We have helped numerous clients evaluate and implement compliance plans and activities. Such compliance efforts can prove to be an important step in mitigating compliance risk, as well as protecting the company from potential liability.

For more information, please contact B. Scott McBride, or 713.646.1390 or Summer D. Swallow, or 713.646.1306.

top of page

MEDICAID RAC PROGRAM FINAL RULE RELEASED

The U.S. Department of Health and Human Services (HHS) has released its final rule on the Medicaid Recovery Audit Contractor (Medicaid RAC) program. HHS expects the Medicaid RAC program to save $2.1 billion in waste over the next five years, of which $900 million will be returned to states. Many providers had expressed concerns that the proposed Medicaid RAC program -- unlike its sister Medicare RAC program -- lacked standardization and would thus subject multi-state providers to varying Medicaid RAC rules and processes. While the final rule did provide for some standardization, many of the elements of the Medicaid RAC program remain under the purview of the states. The following are highlights from the final rule:

Look-Back Period. RACs are limited to a three-year claims look-back period.

Limits on Medical Record Requests. States will establish the limits on the number and frequency of medical records requested by a RAC. However, RACS are required to accept submissions of electronic medical records on CD/DVD or via fax at the provider’s request.

Deadlines. RACs must notify providers of overpayment findings within 60 calendar days.

Appeals. States are required to have an adequate appeals process for adverse Medicaid RAC decisions; however, the final rule notes that states maintain complete flexibility regarding the design and administration of such appeals processes.

RAC Staffing Requirements. RACs must hire a full-time contractor medical director who is an MD or DO in good standing, as well as certified coders, unless the state determines that coders are not required.

Customer Service Measures. RACs must compile and maintain provider-approved addresses and points of contact.

Education and Outreach. RACs must work with states to develop educational and outreach programs that include notification of audit policies and audit protocols.

Reporting Fraud. States, not RACs, have the responsibility to make referrals of suspected fraud to the State Medicaid Fraud Control Unit or other appropriate law enforcement agency.

Coordination of Audits. States and their RACs are required to coordinate auditing efforts with those of other entities conducting audits of providers receiving payments for Medicaid claims.

Contingency Fee Limits. RACs must return contingency fees within a reasonable timeframe as prescribed by the state if their determination is reversed at any level of appeal.

The original April 1, 2011, RAC Medicaid implementation date was delayed in part to ensure states would be able to comply with the provisions of the final rule. The final rule requires implementation by January 1, 2012.

For more information, please contact B. Scott McBride, or 713.646.1390 or Ameena N. Ashfaq, or 713.646.1329.

top of page

DIRECT PATIENT ACCESS TO LABORATORY TEST RESULTS

On September 12, the Centers for Medicare and Medicaid Services (CMS) proposed amending the Clinical Laboratory Improvement Amendments of 1988 (CLIA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule regulations to permit laboratory results to be sent directly to the patient and/or their personal representative at the patient’s request. Prior to implementation of the proposed changes, laboratory test results in states that did not provide for an individual’s access to his or her own laboratory test results could only be sent to an "authorized person" (generally the treating physician, but defined as the individual authorized under state law to order or receive test results), the person responsible for using the test results for treatment and, in the case of reference laboratories, the referring lab. Patients in these states generally were required to receive laboratory results through the ordering provider.

The proposed HIPAA changes generally would preempt state laws that prohibit HIPAA-covered laboratories from providing laboratory test results directly to patients.

If the proposals are finalized, many of the affected laboratories will be required to develop procedures to provide direct patient access to test reports for approximately 6.1 billion tests annually.

For more information, please contact Robert M. Wolin, or 713.646.1327.

top of page

OHIO SUPREME COURT ALLOWS PROVIDERS TO SEEK DEEPER POCKETS

On August 30, 2011, the Ohio Supreme Court held that healthcare providers may seek payment from an individual’s automobile insurer for healthcare claims where the individual also has health insurance. King v. ProMedica Health Sys., Inc., Slip Opinion No. 2011-Ohio-4200. The plaintiff in the case, Virginia King, had been involved in an automobile accident and was treated at Toledo Hospital, which is part of ProMedica Health System. King informed the hospital that she had health insurance, but the hospital billed King’s automobile insurer for her medical claims.

King sought a class action lawsuit on a variety of claims, with each related to the interpretation of O.R.C. Section 1751.60(A). This section provides, in part, that "every provider or health care facility that contracts with a health insuring corporation to provide health care services to the health insuring corporation’s enrollees or subscribers shall seek compensation for covered services solely from the health insuring corporation and not, under any circumstances, from the enrollees or subscribers, except for approved copayments and deductibles." Originally dismissed by the trial court, the appellate court reversed, holding that providers who have entered into agreements with health insuring corporations may only bill the health insuring corporation for treatment of a member of the health insuring corporation.

The Ohio Supreme Court reversed, finding that ProMedica did not violate O.R.C. Section 1751.60(A) because ProMedica did not seek payment from King, the subscriber, for her healthcare costs, but rather from her automobile insurer. Additionally, the court did not believe the term "solely," as used in the statute, precluded recovery from the automobile insurer. Rather, the court found that the proper construction of the statute is that as among the provider, the member and the health insuring corporation, the provider must seek payment from the health insuring corporation, as opposed to the member, for payments other than co-payment or deductibles. Because the automobile insurer is not part of that contractual triangle, the provider is not precluded by statute from seeking payment from the automobile insurer.

For more information, please contact Steven A. Eisenberg, or 216.861.7903.

top of page

E-PRESCRIBING INCENTIVE PROGRAM FINAL RULE MAKES CHANGES CLARIFYING RELATIONSHIP TO EHR INCENTIVES AND ADDS HARDSHIP EXEMPTIONS

On September 1, 2011, CMS finalized changes to the 2011 Electronic Prescribing Incentive Program (eRx Program) to address several concerns raised by participants regarding the impact of payment adjustments (i.e., reductions) scheduled to occur in 2012 for those providers who did not become significant eRx prescribers during the 2011 reporting period of January 1, 2011, through June 30, 2011. The final regulations, which were published in the Federal Register, clarify the relationship between the eRx Incentive Program and the Medicare and Medicaid Certified Electronic Health Records (EHR) Incentive Program enacted under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), and add four new hardship exemptions allowing eligible professionals who qualify for such exemptions to avoid the 2012 payment adjustments.

Background

Section 1848 of the Social Security Act, as enacted under Section 132 of the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA), established a new reporting and financial incentive program for qualifying physicians (referred to as "eligible professionals") who are successful electronic prescribers, which began on January 1, 2009. As of 2011, eligible professionals or a group practice meeting the requirements for successful eRx prescribing could earn a one percent incentive payment (based on the allowed Medicare Part B charges of the professional or group practice, as determined by the Secretary of HHS).

After 2011, MIPPA called for a Medicare Physician Fee Schedule (MPFS) payment adjustment to eligible professionals (or their group practice) who are not successful electronic prescribers, as defined in the Calendar Year (CY) 2011 MPFS final rule. For eligible professionals who are subject to the 2012 eRx Program payment adjustment, the fee schedule adjustment would be comprised of a one percent reduction from the MPFS amount reported and that would otherwise apply for 2012. For CYs 2013 and 2014, the potential MPFS reductions are 1.5 percent and 2 percent, respectively, applied to those eligible professionals or their group practices which fail to demonstrate successful e-prescribing during the applicable reporting periods.

Final Rule Changes

In brief, the final eRx Program regulations for the 2011 reporting period make four significant changes to the Program’s measurement, hardship, timing and documentation requirements.

Measurement Criteria Changed to Allow for Use of Certified EHR Technology

With the enactment in July 2010 of the final regulations specifying the "meaningful use" measurement criteria under the Medicare and Medicaid financial incentive program for the meaningful use of Certified EHR Technology under the HITECH Act, uncertainty was created as to whether and how the two incentive programs (eRx Program and EHR Meaningful Use) could be reconciled, or whether providers would be forced to adapt their e-prescribing systems to meet two separate criteria. Under the eRx Program final regulations published September 1, the existing electronic prescribing measure has been revised to state that a qualified electronic prescribing system now includes either a qualified electronic prescribing program that performs the four functionalities originally described in the eRx Program quality measures published in the 2011 MPFS Final Rule (November 29, 2010), or a system comprising "certified EHR technology" as defined under the EHR incentive program regulations at 45 C.F.R. § 495.4 and 45 C.F.R. § 170.102. Thus, by becoming a "meaningful user" of "certified EHR technology" under the EHR Meaningful Use incentive program, an eligible professional also may qualify as a successful eRx prescriber under the eRx Program.

Additional Hardship Exemptions for the 2012 Payment Adjustment

To avoid payment reductions in 2012 under Medicare, an eligible professional or group practice must satisfy and report one of the following exemptions for the 2011 reporting period:

• The eligible professional is (or the group’s eligible professionals are) registered in the Medicare or Medicaid EHR Incentive Programs and adopted certified EHR technology;
• The eligible professional or group practice is unable to electronically prescribe due to local, state or federal law or regulation;
• The eligible professional or group practice had limited prescribing activity; or
• There were insufficient opportunities to report the electronic prescribing measure.

The above exemptions are in addition to the two exemptions originally contained in the 2011 eRx Incentive Program final regulations published in MPFS Final Rule on November 29, 2010. Those exemptions are: (1) the practice is located in a rural area without high speed internet access, or (2) the practice is located in an area without sufficient available pharmacies for electronic prescribing. See 42 C.F.R. § 414.92 (as amended).

In sum, an eligible professional or group practice will not be subject to the 2012 payment adjustment if any one of the following applies:

• The eligible professional reports a significant hardship under the exemptions described above, and CMS determines that the hardship code applies and approves the exemption;
• The eligible professional demonstrates successful electronic prescribing by satisfying the electronic prescribing measure with respect to claims for at least ten unique electronic prescribing events, as reported in the denominator of the eRx Program measure during the 2011 reporting period;
• The eligible professional does not have at least 100 cases containing an encounter code in the electronic prescribing measure’s denominator;
• The eligible professional’s allowed charges for covered professional services submitted for the eRx Program’s e-prescribing measure denominator is less than 10 percent of the total 2011 Medicare Part B PFS allowed charges for the eligible professional;
• The professional is not an "eligible professional" (e.g., a physician (MD, DO or podiatrist), nurse practitioner or physician assistant) as of June 30, 2011, as determined using the primary taxonomy code in the National Plan and Provider Enumeration System (NPPES) and does not hold prescribing privileges. The professional must report g-code G8644 (defined as not having prescribing privileges) at least one time on an eligible claim prior to June 30, 2011.

A participating group practice will not be subject to the 2012 payment adjustment if one of the following applies and is reported to CMS:

• The group practice satisfies and reports a significant hardship, as described above, in the 2011 self-nomination letter for participation in the eRx Incentive Program and CMS grants the exemption; or
• The group practice achieves and reports successful e-prescribing by satisfying the e-prescribing measure with respect to claims representing between 75 to 2,500 unique e- prescribing events (depending on the size of the group practice), as reported in the denominator of the e-prescribing measure during the 2011 reporting period.

Extension of Deadline for Requesting Hardship Exemptions

The final regulations extend the deadline for requesting significant hardship exemptions to November 1, 2011. This extended deadline applies to the two significant hardship exemptions established in the 2011 eRx Incentive Program requirements contained in the 2011 MPFS Final Rule, as well as the four additional significant hardship exemptions outlined above.

Web-Based Tool for Requesting Significant Hardship Exemption

To avoid the 2012 eRx payment adjustment, individual eligible professionals will be required to submit significant hardship exemption requests via a web-based tool, and group practices will be required to mail a letter requesting such exemption. Exemption requests are required under MIPPA to be reviewed on a case-by-case basis. Instructions on how to request a hardship via the web-based tool will be available on the eRx Incentive Program website.

For more information, please contact John S. Mulhollan, or 216.861.7484.

top of page

CALIFORNIA STRENGTHENS BREACH NOTIFICATION REQUIREMENTS

This week, California Governor Jerry Brown signed into law a new data breach statute that strengthens notification requirements for residents of California. California currently has some of the most prolific and detailed consumer protection-oriented laws impacting privacy and breach protection in the country. The current law requires any entity that owns or licenses computerized data containing personal information to notify affected individuals of any breach of the security of that data and whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. Personal information includes the following unencrypted data elements: (1) social security number; (2) driver’s license or California identification number; (3) account number, credit/debit card number in combination with security code, access code or password of a person’s financial account; and (4) medical information.

The new law details the specific notification requirements when such a breach occurs. The law states that notification shall:

• Be made in the most expedient time possible, but without unreasonable delay (subject to a law enforcement delay);
• Be in writing in plain language;
• Include the name and contact information for the involved entity;
• List the types of personal information subject to the breach;
• State the date of the breach, if known;
• State whether there was a law enforcement delay;
• Generally describe the breach incident; and
• Provide toll-free numbers and addresses for the major credit reporting agencies if social security, driver’s license or California identification numbers are involved.

The law goes on to state that, at the discretion of the entity, the notification also may include information about the steps the entity has taken to protect the affected individuals and any advice on steps individuals may take to protect themselves.

The statute further requires that when more than 500 California residents are affected, the entity also must submit electronically a sample copy of the breach notification letter to the California Attorney General, so that law enforcement has a better sense of the big picture of breaches across the state. Healthcare providers and other HIPAA-covered entities that provide breach notification under the HITECH Act are deemed to have complied with the new California law so long as they have complied with the HITECH Act notification requirements. This statute does not obviate the need to report certain healthcare breaches to the California Department of Public Health. The new law affects not just companies located in California, but those that do business with residents of California. The new law goes into effect on January 1, 2012.

For more information or assistance with breach notification, please contact Lynn Sessions at or 713.646.1352.

top of page

CLOUD COMPUTING IN HEALTHCARE: HIPAA, HITECH AND CONTRACTING CONSIDERATIONS

Join us for a Webinar on Wednesday, September 21, 2011.

Speakers: Lynn Sessions, John S. Mulhollan and Peter Brown

1:00 - 2:00 PM EDT

This webinar will discuss main components of a cloud computing platform and its potential ramifications and risks for healthcare providers, health plans and business associates under HIPAA, the HITECH Act and various other laws. Key discussions will focus on the healthcare and business considerations, contracting, negotiation, risk and liability aspects of a cloud computing platform. We will also discuss the common data breach and privacy and security issues that have often occurred.

The webinar has been approved for 1.0 hour CLE credit in New York and California. CLE credit is pending in Texas and Florida.

Register for Webinar.

top of page

EVENTS CALENDAR

October 10

Houston partner Susan Feigin Harris will speak on "ACOs: Fact or Fiction?" at the 2011 Health Law Conference sponsored by the Texas Hospital Association in Austin, Texas.

Houston partner Donna Clark will speak on "Stark/Anti-Kickback Update" at the 2011 Health Law Conference sponsored by the Texas Hospital Association in Austin, Texas.

October 13

Houston counsel Lynn Sessions will speak on "Landmines for Litigators: What You Need to Know About HIPAA and HITECH" at the section luncheon of the Houston Bar Association Litigation Section in Houston, Texas.

November 4

Houston counsel Lynn Sessions will speak on "Healthcare Cyber Risks and Privacy Breaches -- Emergent Problem or Chronic Condition?" at the Professional Liability Underwriters Society annual conference in San Diego, California.

top of page

Baker & Hostetler LLP publications are intended to inform our clients and other friends of the Firm about current legal developments of general interest. They should not be construed as legal advice, and readers should not act upon the information contained in these publications without professional counsel. The hiring of a lawyer is an important decision that should not be based solely upon advertisements. Before you decide, ask us to send you written information about our qualifications and experience. © 2011 Baker & Hostetler LLP