Health Law Update—January 5, 2012

Alerts / January 5, 2012

Welcome to this week's edition of the Health Law Update. Topics covered today include:

We hope you find this information helpful. Please contact any member of Baker Hostetler's Healthcare Team with questions.


The U.S. Department of Health & Human Services (HHS) Office of Inspector General (OIG) recently has commenced audits under its 2012 Work Plan of hospitals and Medicare and Medicaid contractors. These audits are focused on preventing the loss of protected health information (PHI) stored on portable devices and media, such as laptops, jump drives, backup tapes and equipment considered for disposal. Our healthcare clients already have started receiving notice of these audits, with as little as a week's advance notice. The audits are unrelated to the HHS Office for Civil Rights (OCR) covered entity audit program, but OIG can refer findings to OCR and the Centers for Medicare and Medicaid Services (CMS). Although the audits are being described as "routine," our experience has been different. The audits are based on breach reporting history, size of the organization and risks involved. The audits comprise employee interviews, document requests and random testing of electronic devices in the organization for security failures. If you are contacted about one of these audits, or if you would like to prepare for this type of audit, our privacy and healthcare teams are prepared to assist you.

Please contact Ted Kobus at or 212.271.1504 for more information, or any member of our Healthcare Industry or Privacy, Security and Social Media Teams.

top of page


The HHS Office of the National Coordinator for Health IT (ONC) recently announced the establishment of the "ONC Health IT Dashboard" (hereafter, Dashboard), a new system of records that ONC will use for creating datasets to assess, improve and publicize the effectiveness of ONC health IT grants to states and state-designated entities. The Dashboard, which is designed to act as a report card of sorts, seeks to fulfill the following objectives:

  1. Aggregate data to create national- and state-level estimates about health IT adoption;
  2. Identify participants in other health IT-related programs that could be assisted by ONC grantees; and
  3. Verify the integrity of grant payments made to ONC grantees.

The system will contain information about individual healthcare providers, including demographic information, specific contact information, National Provider Identifiers and IT implementation information, such as functionalities that are being used within a provider's electronic health record system.

Parties receiving grants and implementation assistance, including hospitals and physicians, will be included in the Dashboard and protected by the Privacy Act, which governs the means by which the federal government collects, maintains and uses information about individuals. While some of the datasets will contain individually identifying information about the healthcare providers registered to receive health IT implementation assistance from ONC grantees, the system will not contain information about patients. To that end, ONC will use the identifying information on a "need-to-know" basis for the following purposes:

  1. Evaluate the state of the health IT implementation by parties registered to receive electronic health record assistance;
  2. Compare grantees' progress reports in order to validate claims submitted for grant payments;
  3. Share the evaluations with the grantees to help improve grant performance; and
  4. Make aggregate data publicly available on ONC's website.

An ONC grantee will receive individually identifying information only about providers that are within the grantee's geographic service area. The agency also will provide access to its contractors, consultants and grantees that have been engaged by ONC to assist with implementation. Additionally, ONC will disclose identifying information to other federal and state agencies to assist with the accurate disbursement of grant funds and the administration of federal healthcare programs.

ONC indicates that appropriate physical, technical and administrative safeguards will be in place to protect against unauthorized access to or disclosure of individually identifiable information. A provider may contest the content of the information in the system; however, the right to contest records is limited to information that is incomplete, irrelevant, incorrect or untimely.

If you need assistance with health information exchanges, electronic health record incentive payments or other ONC issues, please contact Lynn Sessions at or 713.646.1352.

top of page


Privacy class action litigation is hot in California and a new wave of lawsuits is being filed under California's 2003 "Shine the Light" law, codified in Cal. Civ. Code Section 1798.83. Healthcare providers are not excluded.

This privacy law affects most businesses with as few as 20 employees and allows individuals to learn about how a business sells and shares their personal information. Companies that do business with California residents must either allow their customers an opportunity to opt out (without charge) of having their information shared, or the company must make a detailed disclosure of how personal information was shared in the past calendar year for direct marketing purposes. For businesses without a storefront operation, there may be additional requirements for disclosing the business's privacy policy, including a detailed posting on its website. Some of this is already covered by HIPAA but extends beyond the HIPAA requirements.

Personal information is broadly defined in the statute and includes:

  • Name and address
  • Email address
  • Age or date of birth
  • Names of children
  • Email or other addresses of children
  • Number of children
  • The age or gender of children
  • Height
  • Weight
  • Race
  • Religion
  • OccupationTelephone number
  • Education
  • Political party affiliation
  • Medical condition
  • Drugs, therapies, or medical products or equipment used
  • The kind of product the customer purchased, leased or rented
  • Real property purchased, leased or rented
  • The kind of service provided
  • Social security number
  • Bank account number
  • Credit card number
  • Debit card number
  • Bank or investment account, debit card or credit card balance
  • Payment history
  • Information pertaining to the customer's creditworthiness, assets, income or liabilities 

Once per calendar year, a consumer has the right to request and receive, within 30 days of the request, information about how the consumer can exercise opt-in or opt-out rights or the type of personal information shared for direct marketing purpose and with whom it was shared.

Violations of the Shine the Light law are hefty, as civil penalties are available under Cal. Civil Code Section 1798.84, and they range between $500 and $3,000 per violation, plus attorneys' fees and costs. Businesses may have a 90-day safe harbor to correct an untimely or inaccurate notification. Since damages are so difficult to prove in privacy lawsuits, plaintiff attorneys are looking to laws with statutory damages in place (such as Song-Beverly, the Video Privacy Protection Act and the Confidential Medical Information Act). It is no surprise that plaintiff attorneys are trolling websites to see if businesses are displaying an appropriate privacy policy. If a business is not, a putative class action lawsuit likely will be filed seeking millions, or even billions, of dollars in statutory penalties without proof of actual damages. If a review of your privacy policies was not on your list of 2012 New Year's resolutions, it should be quickly added.

Baker Hostetler assists healthcare industry and other clients that do business in California in responding to allegations of privacy violations and related class action litigation. For further information or representation on privacy class action litigation, please contact Ted Kobus at or 212.271.1504, or any member of our Healthcare Industry or Privacy, Security and Social Media Teams.

top of page


In the article entitled "The Controversy Over State-Based Health Insurance Exchanges: Politics As Usual, Or Dangerous Brinksmanship?" published in the December 8, 2011, issue of the Health Law Update, we pointed out potentially dramatic differences between a health insurance exchange (HIX) organized and operated by an individual state and a HIX organized and operated by HHS. The potential differences were discussed in the context of reports by officials in some states announcing they will not organize and/or operate a state-based HIX, either for financial or philosophical reasons (or both).

Another Problem

Yet another potentially dramatic difference has surfaced: whether the "premium assistance credit" -- the refundable federal tax credit found in Section 36B of the Internal Revenue Code (IRC), which is expected to make health insurance coverage affordable for tens of millions of Americans living at or slightly above the poverty line -- will be available only to those Americans who enroll in coverage being offered for sale on a state-sponsored HIX or any coverage offered on any HIX, such as an HHS-organized HIX. While that would seem like a distinction without a difference, it is not.

The answer to this question potentially poses substantial consequences, not just for financially-pressed Americans who have to shop for affordable coverage in any state where HHS is compelled to organize and operate a HIX, but also for the employers and insurers operating in such states. That is because the refundable tax credit -- like the individual mandate which penalizes individuals who fail to buy health insurance coverage -- is just as important and just as intertwined with the Patient Protection and Affordable Care Act's (PPACA's) other provisions. If the refundable tax credit were found to be available only to individuals who purchase coverage on a state-established HIX, it could destabilize the individual and small group insurance markets operating in those states. This latest problem raises the stakes even further for state officials who fail, or refuse, to establish and operate a HIX at the state level.

The Statutory Problem and the Attempted Regulatory Fix

There can be no question that a statutory problem exists. While the problem surfaced shortly after PPACA was enacted in March 2010, a November 16, 2011, Wall Street Journal article ("Another ObamaCare Glitch") brought the statutory problem widespread attention. That article also pointed out a recent attempt by the Obama administration to fix the problem through rulemaking.

The statutory problem is straightforward. PPACA § 1311 authorizes states to sponsor and maintain a HIX, while PPACA § 1321(c) authorizes HHS to establish and operate a HIX if a state fails or refuses to do so. And, on its face, the refundable tax credit is only available to individuals who shop for coverage on a HIX that a state has established under PPACA § 1311. The operative tax statute says as much in at least three separate places. The passage used to define the "amount" of the refundable tax credit is both representative and illustrative:

(2) Premium Assistance Amount. -- The premium assistance amount determined under this subsection with respect to any coverage month is the amount equal to the lesser of—

(A) the monthly premiums for such month for 1 or more qualified health plans offered in the individual market within a State which cover the taxpayer, the taxpayer's spouse, or any dependent (as defined in section 152) of the taxpayer and which were enrolled in through an Exchange established by the State under [section] 1311 of the Patient Protection and Affordable Care Act . . .".

IRC § 36B(b)(2)(A) (emphasis supplied).

The regulatory attempt to fix the statutory problem is a little more obfuscated -- perhaps, because a legal challenge has been anticipated. The proposed regulations issued by the U.S. Treasury on August 17, 2011, which interpret and enforce the refundable tax credit, completely gloss over the statutory problem found throughout IRC § 36B, by providing that the refundable tax credit is available to any qualifying taxpayer where the taxpayer (or the taxpayer's spouse or a dependent) "is enrolled in one or more qualified health plans through an 'Exchange.'" (See Proposed Income Tax Reg. § 1.36B-2(a)(1).) However, the tax regulation defines "Exchange" by reference to the regulations that HHS separately proposed on July 15, 2011, to explain how health insurance exchanges generally were to work. (See Proposed Income Tax Reg. § 1.36B-1(k), which simply provides as follows: "Exchange has the same meaning as in 45 C.F.R. 155.20.") [NOTE: The proposed Treasury regulations can be found in the Federal Register at 76 Fed. Reg. 50931. The proposed HHS regulations can be found in the Federal Register at 76 Fed. Reg. 41866 -- and the specific discussion of "Exchange" can be found on page 41868.]

Would Anyone Care?

Some posit that a decision by the U.S. Treasury, in regulations, to adopt an expansive view of the term "Exchange" is almost unassailable, and point to the fact that the courts routinely give Treasury regulations a fair amount of interpretive latitude, most recently in Mayo Foundation for Medical Educ. & Research v. United States, 562 U.S. ___, 131 S.Ct. 704 (2011). [NOTE: In Mayo Foundation, the U.S. Supreme Court decided a year ago that Treasury regulations are entitled to the so-called "Chevron" deference. The Chevron doctrine was established in Chevron U.S.A. Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984).] Others suggest that the millions of individuals in line to benefit from such governmental largesse are unlikely to complain about the IRS being too generous, and that they, in any event, have no legal standing to seek a more miserly interpretation.

Both arguments have their flaws, and neither accounts for the tendency of some elected officials to espouse positions simply because they are politically expedient.

First, while it is true that individuals who stand to benefit from a regulation that provides them with a tax subsidy due to an over-expansive reading of the statute are unlikely to look a gift horse in the mouth (even if it is the IRS), there are other taxpayers who have a legitimate reason to complain. Not the least of them are the hundreds of thousands of midsized and large employers currently scheduled to pay potentially substantial tax penalties, starting in 2014, if one of their full-time employees qualifies to receive (or receives) a refundable tax credit on a HIX, either because they were not offered qualifying coverage by the employer or were not offered such coverage on a sufficiently affordable basis. Since the employer's tax sanction is triggered only if the employee qualifies for or receives the refundable tax credit -- and if there is no refundable tax credit, there can be no tax sanction -- it is not inconceivable that Treasury's reading could be challenged by some employer that finds itself in a state where HHS has had to establish the HIX, either in an attempt to avoid PPACA's employer mandate requirement or in defense of its failure to provide the indicated coverage to all of the indicated individuals.

Second, even tax regulations are not unassailable—not when the statute is unambiguous. As the Supreme Court's opinion in Mayo Foundation made clear, the Chevron doctrine is two-pronged, and it begins by asking whether Congress has "directly spoken to the precise question at issue." Chevron, 467 U.S. 837, at 842-43. Black-and-white statutory text, which appears three times in the operative statute (each, referring just to "exchange[s] established under Section 1311 of [PPACA]"), could be quite persuasive.

Practical Fallout

Given that the current Treasury position could well be legally unsustainable and certainly appears capable of being challenged, the stakes thus continue to rise for those states (and state officials) who currently refuse to take steps to establish a HIX at the individual state level. Who is most likely to win and who is most likely to lose from this particular stand-off? It would appear that everyone involved could end up a loser. Indeed, if PPACA were to take effect in 2014 without such key provisions as (1) the individual mandate (which has been the subject of numerous challenges, one of which will be heard by the U.S. Supreme Court later this year), and (2) the refundable tax credit (in those states that failed to timely establish their own HIX), the following consequences would appear to be almost inevitable:

  • A number of the "large" employers operating in those states would decide not to provide (or would not even offer to provide) qualifying health coverage to all their full-time employees because those employers would not have to worry about incurring the federal tax penalties that PPACA put in place to enforce the so-called "employer mandate." Such employers would realize that the federal tax penalties are triggered only if a refundable tax credit actually is allowed or paid with respect to one of their full-time employees. And if enough employers were to do so, it would add to the number of individuals left without employer-provided (and partially-paid) health insurance coverage. [NOTE: The two federal tax penalties PPACA prescribes are (1) a potentially punitive $2,000/employee tax penalty, which is assessable under IRC § 4980H(a) on any "large" employer that fails to provide qualified health plan coverage to all or substantially all of its full-time employees; and (2) a less punishing $3,000/electing employee tax penalty, which is assessable under IRC § 4980H(b) on any "large" employer that fails to provide "affordable" coverage to all of its full-time employees (i.e., offers the benefit but charges the employee too much for the coverage as a percentage of such employee's household income).]
  • The financially-challenged individuals and families who reside in such states doubtlessly would go without health insurance coverage -- at least until a family member were injured or became ill -- because they would not be able to purchase taxpayer-subsidized health insurance coverage and would not face any tax penalties as a result of their failing to do so. Rather, such individuals would be encouraged by the healthcare providers treating them (who, after all, want to be paid) to purchase just-in-time coverage, since all pre-existing condition rules and medical underwriting rules by then will have been outlawed.
  • The health insurance issuers operating in those states increasingly would find the community-rated pools more toxic than ever, as escalating claims costs and diminishing reserves (stemming from a steady erosion of healthy, premium-paying individuals) took their toll. Those carriers that could withdraw from those states increasingly would do so.

Eventually, the individual and small group health insurance markets within such states would turn into the health insurance equivalent of the Salton Sea: they would devolve into high-risk pools, populated only by last minute purchasers willing to tolerate the increasingly unsustainable coverage cost(s). [For those geographically challenged, the Salton Sea is that inland salt lake, found about 100 miles east of Los Angeles, which, over time, has become largely incapable of supporting life due to more evaporation than replenishment.] That result likely would not earn kudos for any elected official involved in the fracas, either from healthy individuals or from small businesses. Both would find the resulting insurance pool(s) too toxic and too pricey to afford, and it is unlikely that blame for the resulting problem could be laid at the feet of those who decided to challenge the validity of the over-broad Treasury regulations, since the problem would not exist in any state that actually set up its own HIX.

In the end, this simply is another instance where it is possible that politics might trump common sense, as the political factions continue to wage war over PPACA without regard to the long-term, practical consequences. Only one thing appears certain. If things end badly, there will be plenty of blame to go around and nothing for any politico to brag about.

For more information, please contact John J. McGowan, Jr., or 216.861.7475.

top of page


The year 2011 saw increased activity in the area of provider and religious employer conscience exceptions under federal law. Healthcare providers, health plans and employers should take steps to become familiar with these new mandates and the revised conscience exceptions and anticipate the administrative policy changes and oversight that will be required to ensure compliance.


By way of background, HHS issued a final rule in December 2008 interpreting a trio of statutes (collectively, the "Church Amendments," the "Weldon Amendment" and Section 245 of the Public Health Service Act) that allow for provider conscience protections when delivering or receiving payment for federally funded healthcare services (hereafter the 2008 Rule). Together, these statutes provide that healthcare providers (both individuals and entities) may not be required to perform or assist in, or make their facilities available for, a sterilization or abortion procedure if it would be contrary to the provider's religious beliefs or moral convictions. The 2008 Rule finalized a proposed rule and comment period issued in August 2008.

Further, under these laws, federal and state agencies administering federally funded healthcare benefits and entities receiving such benefits are prohibited from discriminating against a physician or other healthcare personnel in employment, promotion, termination of employment or the extension of medical staff or other privileges because the person either performed or assisted in a sterilization or abortion procedure or because the person refused to perform or assist in such procedures on religious or moral grounds. The statutes also prohibit discrimination in research funding and participation in research based on a person or entity performing or assisting in, or refusing to perform or assist in, abortion or sterilization procedures.

According to the 2008 Rule, HHS sought to increase awareness and open communications under the federal provider conscience protection statutes by clarifying the definitions of terms contained in the statutes, addressing their applicability and adopting new certification and enforcement mechanisms for ensuring compliance. 73 Fed. Reg. 78072, 78074 (Dec. 19, 2008). In February 2009, the Obama administration announced its intention to reverse the 2008 Rule citing differences of interpretation of the federal statutes.

The following year, Section 1303(b)(4) of PPACA added a federal conscience protection clause related to benefits offered under the new health insurance exchanges which stated that "No qualified health plan offered through an Exchange may discriminate against any individual health care provider or health care facility because of its unwillingness to provide, pay for, provide coverage of, or refer for abortions." In addition, on March 24, 2010, President Obama issued Executive Order 13535, which reiterated the long-standing federal prohibition on use of federal funds to procure or pay for abortions. Thus, with the passage of PPACA, the announcement of EO 13535 and the Obama administration's expressed intention to revisit the federal conscience protection statute implementing rules, the stage was set for the development of a revised federal framework governing provider conscience exceptions.

2011 Developments

In February 2011, HHS published a regulation that essentially restored the status quo of the federal provider conscience exception statutes to where they existed prior to the 2008 Rule (hereafter, the February 2011 Rule). 76 Fed. Reg. 9968 (Feb. 23, 2011). HHS chose not to formulate a new rule to replace the provisions rescinded in the 2008 Rule, determining instead to rely upon administrative interpretation of the federal statutes on a case-by-case basis. The February 2011 Rule also delegated enforcement of the federal provider conscience protection statutes to OCR. In August 2011, HHS issued an interim final rule under PPACA for the coverage of women's preventative healthcare services by group health plans and health insurance issuers (the August 2011 Rule). 76 Fed. Reg. 46621 (Aug. 3, 2011). Under the August 2011 Rule, health plans and health insurance issuers must offer a wide range of women's preventative services without cost-sharing by beneficiaries under guidelines published concurrently by the Health Resources Administration (HRSA), including "all FDA approved contraceptive methods, sterilization procedures, and patient education and counseling for all women with reproductive capacity." With respect to conscience protections, the August 2011 Rule excludes from application of the guidelines, "group health plans established or maintained by religious employers and health insurance coverage provided in connection with group health plans established or maintained by religious employers with respect to any requirement to cover contraceptive services under such guidelines." 76 Fed. Reg. 46621, 46626. Key to the conscience exemption under the August 2011 Rule is the four-pronged definition of "religious employer" which limits the exemption to nonprofit organizations formed for the purpose of religious inculcation and who employ and serve primarily those persons who share the organization's religious tenets.

Going Forward

Across the culturally and religiously diverse landscape of providers, health plans and employers participating in or offering healthcare services or insurance coverage, there is a need to remain apprised of the evolving federal conscience protections and religious employer exceptions as new developments are likely in 2012 and ensuing years as PPACA becomes operational.

For more information, please contact John S. Mulhollan, or 216.861.7484.

top of page


February 9

Houston counsel Lynn Sessions will speak at a webinar on "The Enterprise Risk of Drug Shortages in Hospitals" at the February meeting of the American Health Lawyers Association's Enterprise Risk Management Task Force.

February 10

Cleveland partner Steve Eisenberg will speak on "Co-Management Arrangements: Getting Beyond a Medical Director Arrangement to a True Accountable Care Steppingstone" at the Hospitals and Health Systems Law Institute sponsored by the American Health Lawyers Association in Orlando, Florida.

top of page

Baker & Hostetler LLP publications are intended to inform our clients and other friends of the Firm about current legal developments of general interest. They should not be construed as legal advice, and readers should not act upon the information contained in these publications without professional counsel. The hiring of a lawyer is an important decision that should not be based solely upon advertisements. Before you decide, ask us to send you written information about our qualifications and experience. © 2012 Baker & Hostetler LLP

Related Industries