News / Resources

Topics covered in this issue of the Health Law Update include:

• Medicare DSH Alert: CMS Finalizes New SSI Ratio Methodology 
• FDA and Recalls: Do Signs Point Toward Criminal Prosecutions for Offenders? 
• OIG Opines that Drug and Device Funded Foundation is OK 
• To Notify … Or Not: HHS Withdraws HIPAA Breach Notification Final Rule 
• Events Calendar

MEDICARE DSH ALERT: CMS FINALIZES NEW SSI RATIO METHODOLOGY

In the preamble to the final inpatient prospective payment system (IPPS) rule, the Centers for Medicare & Medicaid Services (CMS) finalized its proposed methodology for calculating providers’ SSI Ratios (aka Medicare Fractions) for purposes of the Medicare disproportionate share hospital (DSH) adjustment. 75 Fed. Reg. at 50,275 (Aug. 16, 2010).

As promised by CMS in its recent Ruling 1498-R (April 28, 2010), the preamble contains details relating to the new SSI Ratio calculation process, which will be utilized by CMS and the Medicare administrative contractors on a going-forward basis and when recalculating providers’ DSH adjustments for pending administrative appeals and open cost reports. The new process was initially prompted by the D.C. district court’s ruling in Baystate Medical Center v. Leavitt, 545 F.Supp.2d 20 (D.D.C. 2008), in which the court held that the agency’s prior data-matching process did not utilize the best available data to match Medicare patient day information with SSI eligibility data when calculating SSI Ratios.

Going forward, CMS has pledged to use a wider range of databases (the SSI eligibility data file, the Medicare Enrollment Database (EDB), and the MedPAR file) in performing its revised match process, and has delayed the timing of the data match to 15 months after the close of the federal fiscal year in order to obtain more accurate and complete data (the agency previously used data updated only six months after the close of the federal fiscal year). The methodology outlined in the preamble to the final rule is virtually identical to the proposed rule; the only modification being the adoption of a policy to exclude a record from the data-matching process if CMS finds a Health Insurance Claims Account Number (HICAN) in the MedPAR file that cannot be located in the EDB (an unlikely scenario, according to CMS).

The preamble to the proposed rule also is significant in that CMS finalized regulatory amendments “clarifying” that days relating to Medicare Advantage patients belong in the SSI Ratio portion of the DSH calculation—as opposed to the Medicaid Fraction—because Medicare Advantage patients are still “entitled” to Medicare Part A. This interpretation is currently the subject of litigation.

For more information, please contact Gregory N. Etzel, or 713.646.1316 or Krista M. Barnes, or 713.646.1352.

FDA AND RECALLS: DO SIGNS POINT TOWARD CRIMINAL PROSECUTIONS FOR OFFENDERS?

It seems as though one cannot watch or read the news without learning of the recall of another FDA-regulated product. From eggs contaminated with salmonella to deli meats bearing listeria, to the litany of products, including over-the-counter drugs and medical devices like contact lenses and hip implants, it appears as though the FDA’s capacity to safeguard the country’s food and drug supply is at an all time low. The number of recalled products has skyrocketed, with nearly 1000 food and drug products recalled already in 2010.

The FDA, aware of its weak public perception, is actively investigating again using its criminal prosecutory authority aggressively under the Park Doctrine. Stemming from the Supreme Court’s decision in United States v. Park, 421 U.S. 658 (1975), the Park Doctrine allows the FDA to seek misdemeanor convictions of executives of entities found to have violated the Federal Food, Drug, and Cosmetic Act if the executives possessed the authority to stop or prevent the violations and failed to act. The executives may be convicted even if they were not aware of the violations.

While the Park Doctrine was applied widely at one time, it fell out of favor in the 1980s, and by the early 1990s most FDA prosecutions were reserved for cases of fraud rather than manufacturing violations. Speaking at the 2010 Food and Drug Law Institute Annual Conference, the FDA’s deputy chief counsel for litigation, Eric Blumberg, stated that he expects to see the first of many prosecutions of corporate executives, and in a letter to Sen. Charles Grassley (R-Iowa), Commissioner Margaret Hamburg wrote that the FDA will be considering misdemeanor prosecutions as an enforcement tool for corporate accountability.

For more information, please contact Kathryn M. Tarallo, or 202.861.1522.

OIG OPINES THAT DRUG AND DEVICE FUNDED FOUNDATION IS OK

A recent Advisory Opinion posted by the Office of Inspector General (OIG) found that a proposal by a charitable organization (Foundation) to establish a patient assistance program for financially-needy brain tumor patients would not run afoul of the anti-kickback statute. The Foundation, which is a nonprofit, tax-exempt entity, would be funded primarily by drug and device makers, a long-standing concern of the OIG.

The OIG concluded that the Foundation had taken the appropriate steps to ensure the integrity of donor contributions and grants to federal healthcare program beneficiaries. Specifically, the Foundation would help insured, financially-needy brain tumor patients pay for the drugs and devices needed in their treatment, as well as conditions that result from the treatment, such as chemotherapy-induced nausea. The beneficiaries of the program would include, but not be limited to, those enrolled in public insurance, thereby implicating the anti-kickback statute.

The OIG cited several favorable factors. First, the Foundation established objective criteria by which it would award grants to applicants on a first-come, first-served basis, and it also would have full, absolute discretion with respect to use of the contributions. Additionally, the Foundation would create an “ethical wall” between the patient assistance program and its other programs and services through the use of separate websites, project teams, data intake and storage and other measures.

For more information, please contact Steven A. Eisenberg, or 216.861.7903.

TO NOTIFY … OR NOT: HHS WITHDRAWS HIPAA BREACH NOTIFICATION FINAL RULE

Under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), covered entities must notify individuals and HHS of any unauthorized acquisition, access, use or disclosure of the individual’s unsecured protected health information (PHI) which “compromises the security or privacy of such information.” HITECH Act, § 13400. The breach notification law applies to PHI in any format or media, including written or electronic PHI. When issuing the Interim Final Rule for breach notification last year, HHS interpreted the HITECH Act to require notification of breach only if a covered entity determined that the violation or breach poses a “significant risk of financial, reputational or other harm to the individual.” 45 C.F.R. § 164.402(1)(i). The preamble to the Interim Final Rule states that notification may not be required if a covered entity, such as a hospital or insurer, determines, after a risk assessment, that the individual whose PHI was accessed, used or disclosed will not be harmed. See 75 Fed. Reg. 42740, 42744 (August 24, 2009).

In response to opposition by several members of Congress and privacy advocates over the risk of harm standard under the HIPAA breach notification Interim Final Rule, the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) recently withdrew its final breach notification rule to “allow for further consideration, given the Department’s experience to date in administering the regulations”—perhaps creating pressure on HHS/OCR to craft a more stringent final rule.

Covered entities should note that the obligation to report breaches of unsecured PHI, which took effect on September 23, 2009, following the publication of an Interim Final Rule promulgated under the HITECH Act, remains in effect. All covered entities, and their business associates, should have in place and/or adhere to an effective Breach Notification Policy containing appropriate procedures to investigate, report and mitigate breaches of privacy or security of PHI.

For more information, please contact John S. Mulhollan, or 216.861.7484.

EVENTS CALENDAR

October 1

Houston partner Susan Feigin Harris will speak on “Health Reform and Its Impact On Children’s Hospitals,” at a “brown bag” telephone presentation sponsored by the Children’s Hospital Affinity Group of the American Health Lawyers Association.

October 11

Houston partner Susan Feigin Harris will speak on “Healthcare Reform—What’s Next?” at the 2010 Health Law Conference sponsored by the Texas Hospital Association in Austin, Texas.

Houston partner Donna Clark will speak on “Fraud and Abuse Update” at the 2010 Health Law Conference sponsored by the Texas Hospital Association in Austin, Texas.

Baker & Hostetler LLP publications are intended to inform our clients and other friends of the Firm about current legal developments of general interest. They should not be construed as legal advice, and readers should not act upon the information contained in these publications without professional counsel. The hiring of a lawyer is an important decision that should not be based solely upon advertisements. Before you decide, ask us to send you written information about our qualifications and experience. © 2010 Baker & Hostetler LLP