Skip to content
Lawwise
    Lawwise

      Subjects

      This handbook

      Subject

      Healthcare Regulation

      Facility licensure and survey, protected health information and breach notification, referral and remuneration prohibitions, billing integrity and overpayment refunds, provider enrollment and revocation, and telehealth practice across state lines.

      01
      Healthcare Regulation

      Using Health Information Without Written Authorization

      A covered entity may use or disclose protected health information without authorization to the individual, for treatment, payment and health care operations, under an opportunity to agree or object, and for an enumerated set of public interest purposes. Everything outside that list requires a written authorization, and psychotherapy notes, marketing and any sale of information require one regardless. Permitted disclosures are separately limited to the minimum necessary to accomplish the purpose.

      5 min readFederal and state

      02
      Healthcare Regulation

      The Self-Referral Prohibition and the Exceptions to It

      Where a physician or an immediate family member holds an ownership interest in or a compensation arrangement with an entity, the physician may not refer designated health services to that entity for federal payment and the entity may not present a claim for them, unless the arrangement satisfies an exception in full. Liability does not depend on intent. Amounts collected on prohibited referrals must be refunded, and knowing violations carry additional penalties.

      5 min readFederal and state

      03
      Healthcare Regulation

      Provider Enrollment, Revalidation and Revocation

      Enrollment establishes the effective date from which claims may be paid, and certain practitioner types may bill retrospectively for up to thirty days before it. Enrollment must be revalidated every five years, or every three for equipment suppliers, and a revalidation request must be answered within sixty calendar days. Revocation carries a reenrollment bar of one to ten years, extended to twenty for a second revocation, and it takes effect thirty days after the notice is mailed.

      5 min readFederal and state

      04
      Healthcare Regulation

      Overpayments: The Identification Date and the Sixty-Day Clock

      A person who receives an overpayment must report and return it by the later of sixty days after the overpayment was identified or the date any corresponding cost report is due. An overpayment is identified when it is knowingly received or retained, using the knowledge standard of the false claims statute. The deadline can be suspended during a timely good-faith investigation of related overpayments, and by a self-disclosure or an extended repayment request. The lookback period runs six years.

      5 min readFederal and state

      05
      Healthcare Regulation

      Telehealth: Where the Patient Is, and Which License Applies

      State law almost uniformly treats the practice of medicine as occurring at the patient's location, so a clinician furnishing a remote encounter needs a license in the patient's state. Interstate compacts reduce the cost of obtaining one but work differently by profession: some expedite full licensure in each state, others confer a privilege to practice on a single home-state license. Prescribing authority, payment rules and malpractice coverage are separate questions with separate answers.

      5 min readState law

      06
      Healthcare Regulation

      Corrective Action Plans and Integrity Agreements

      Health care enforcement rarely ends with money alone. A plan of correction answers a survey citation. A corrective action plan attached to a settlement imposes policy, training and reporting duties for a defined period. An integrity agreement runs longer, adds independent review and screening obligations, and is the consideration for an agency's agreement not to seek exclusion. Missing an obligation triggers stipulated penalties, and a material breach restores the exclusion avoided.

      5 min readFederal and state

      07
      Healthcare Regulation

      Facility Licensure and the Survey and Deficiency Process

      Operating a health care facility requires a state license and, for federal payment, a provider agreement conditioned on the conditions of participation. Compliance is verified by survey. Findings are recorded on a statement of deficiencies, and the facility answers in a plan of correction on the same form. Where noncompliance reaches immediate jeopardy the agreement terminates within twenty-three calendar days unless the jeopardy is removed; lesser noncompliance allows six months.

      6 min readState law

      08
      Healthcare Regulation

      Remuneration Prohibitions and the Safe Harbors

      It is a felony to knowingly and willfully offer, pay, solicit or receive remuneration to induce or reward referrals of items or services payable by a federal health care program. Liability turns on purpose, and an arrangement offends the statute where even one purpose of the payment is to induce referrals. Regulatory safe harbors describe arrangements that are protected absolutely, but an arrangement outside a safe harbor is not unlawful for that reason; it is judged on its facts.

      5 min readFederal and state

      09
      Healthcare Regulation

      Reassignment of Benefits and Who May Bill

      The program does not pay amounts due a supplier to anyone else under reassignment, power of attorney or any other direct arrangement, except in defined cases. The two that matter are payment to an employer where the clinician must turn over fees as a condition of employment, and payment to an enrolled entity under a contractual arrangement. Billing entity and clinician are jointly and severally liable for any overpayment, and the clinician keeps access to the claims.

      5 min readFederal and state

      10
      Healthcare Regulation

      Business Associate Agreements and Downstream Liability

      A person who creates, receives, maintains or transmits protected health information on behalf of a covered entity for a regulated function is a business associate, and so is any subcontractor doing the same for that associate. A written agreement containing specified terms is the condition on which the disclosure is permitted. Business associates are directly liable for defined obligations, and a covered entity that knows of a pattern of material breach and does nothing is itself in violation.

      6 min readFederal and state

      11
      Healthcare Regulation

      When Exposure of Health Information Must Be Reported

      An acquisition, access, use or disclosure of protected health information not permitted by the privacy rule is presumed a breach unless the entity documents a low probability of compromise using four factors: the nature of the information, who received it, whether it was actually acquired or viewed, and the extent of mitigation. Individual notice is due no later than sixty calendar days after discovery, with separate media and federal tiers keyed to the number affected.

      6 min readFederal and state