Question Of The Week

August 13, 2026

Posted on by Courtney Patterson

QUESTION:
While conducting an affiliation verification for a recent applicant, we learned that he is subject to a one year “Conditional Appointment” at another hospital where he has held privileges for 12 years.  When this application goes to the Credentials Committee next week, does the failure to disclose the Conditional Appointment constitute grounds to deny the application and, if so, do we have to give the applicant a hearing?

ANSWER FROM HORTYSPRINGER ATTORNEY RACHEL REMALEY:
Should you be interested and/or concerned that an applicant for Medical Staff membership and/or clinical privileges is subject to a “Conditional Appointment” at another hospital?  Yes, of course.  If another hospital has some sort of question or concern about that individual (which can be the only explanation for a Conditional Appointment), that is something you should know about before you proceed.  So, at the very least you will want to place this application on hold and not process it any further until you figure out more details (this means the application should be taken off the agenda for the upcoming Credentials Committee meeting).

With that said…whether or not the failure to disclose, in and of itself, is worthy of any sort of action depends on whether the applicant had a duty to disclose the Conditional Appointment to you.  And that depends on what your application forms ask.  Do your forms simply ask whether applicants have ever had Medical Staff membership or clinical privileges revoked, restricted, denied, or suspended?  If so, the application failed to ask about Conditional Appointments and, in turn, the applicant would have been justified in answering, “No.”  If, on the other hand, your application also asks if applicants are currently, or have ever been, under investigation, subject to a formal performance improvement plan, been subject to written conditions, or been subject to a short-term or conditional term of Membership or privileges, then the applicant clearly should have answered, “Yes.”

The questions on the application form should be a reflection of the information that your hospital and its credentialers want to know.  This means the questions should be worded to obtain, at minimum, information about all of the threshold eligibility criteria set forth in your Medical Staff Bylaws and/or Credentials Policy.  In addition, application forms are often more broadly drafted to ask about additional matters that may fall outside of the threshold eligibility criteria, but still be of interest when considering the applicant’s qualifications.  For example, if the threshold criteria simply stated that an applicant may have never been convicted of, or pled guilty or no contest to, a felony, your application form may still ask the applicant about any convictions or pleas for both felonies and misdemeanors.

Once you have determined whether the applicant’s failure to disclose the Conditional Appointment is actionable, the question then turns to whether the appropriate action is for the Credentials Committee to deny the application.

The appropriate response to an omission on an application form depends on your Medical Staff Bylaws, Medical Staff Credentials Policy, and/or related Medical Staff governance documents.  We recommend these documents include provisions stating that if a misstatement or omission is identified with respect to any information provided on an application form or during the course of the application process, the applicant will be provided Notice and be given an opportunity to submit an explanation.  That explanation will then be considered (often by the Chief of Staff and/or CMO) and a decision will be made about whether to process the application further.  The Bylaws/Credentials Policy should clearly state that, in addition, the applicant will then become ineligible to have another application for Medical Staff membership or clinical privileges processed at the hospital (and many organizations go a step further and state that the applicant will also become ineligible to have an application processed at any affiliated entity within the health care system).  The Bylaws/Credentials Policy should be clear that refusal to process an application because of the discovery of an omission/misrepresentation is an administrative matter and that does not constitute an adverse professional review action based on a judgment about the applicant’s competence or conduct (and, in turn, does not result in any hearing rights).

If your organization does not have language stating that omissions and misstatements during the application process result in failure to process the application, then any discovery of an applicant’s failure to disclose credentials will have to be managed like other negative information in the credentialing process.  This may include determining that the application is incomplete while you follow up with the applicant about the discrepancy and combing through the application with a fine tooth comb to make sure that each and every credential has been independently verified with third party original sources (since you know you cannot count on the applicant to provide complete and accurate information about his or her credentials).  Ultimately, if after gathering additional information, you decide to deny the application because you consider the omission to constitute unprofessional conduct, the procedures set forth in the Bylaws for “denials” of applications would apply, including those related to hearings and appeals.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

July 30, 2026

Posted on by jwilbert

QUESTION:
A patient recently requested a list of all individuals who accessed her medical record.  Do we have to give it to her?

ANSWER FROM HORTYSPRINGER ATTORNEY DAN MULHOLLAND:
A patient has the right of access under HIPAA to her protected health information (PHI) contained in a “designated record set.” 45 CFR §164.524(a)(1).  A “designated record set” is defined as including:

    • Medical records and billing records about individuals maintained by or for a covered health care provider.
    • Enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan.
    • Other records used, in whole or in part, by or for the covered entity to make decisions about individuals.

The patient in question seems to be requesting copies of the audit logs showing who accessed her records and when.  The audit logs are security/audit controls required under the HIPAA Security Rule (45 CFR §164.312(b)) for compliance and breach detection, not for clinical or decision-making purposes.  Therefore, they are not part of a “designated record set” and thus the patient does not have a right of access to that information.

Another section of the HIPAA regulations gives patients the right to ask for an accounting of disclosures of their PHI.  45 CFR §164.528(a).  However, this does not include disclosures for treatment, payment or health care operations.  The audit log would record access for treatment, payment or health care operations so the information in the audit log would not be subject to the disclosure accounting rule.

Of course, if the patient brought suit against the hospital, she would be able to get access to the audit logs and other parts of the electronic health record through normal discovery procedures.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

July 23, 2026

Posted on by Courtney Patterson

QUESTION:
Is it true that significant changes are coming to the rules for provider-based status locations?

ANSWER FROM HORTYSPRINGER ATTORNEY NICHOLAS CALABRESE:
Yes, it’s true.  Many hospitals operate outpatient clinics, among other things, off-site from the main hospital campus.  If these sites qualify for “provider-based status” under federal regulations, they can bill as part of the hospital and receive a higher level of reimbursement.  Basically, CMS treats an off-site location as a department of the hospital instead of a freestanding facility if it has provider-based status.

Currently, hospitals voluntarily submit a formal declaration, known as an “attestation,” to its Medicare Administrative Contractor stating that it is in compliance with all provider-based requirements (licensure, financial integration and other requirements), and bill under the hospital’s National Provider Identifier (“NPI”).

However, on February 3, 2026, the 2026 Consolidated Appropriations Act (“CAA”) became law.  Section 6225 of the CAA requires hospitals to submit mandatory attestations confirming compliance with Medicare’s provider-based regulations for all off-campus hospital outpatient departments and to obtain distinct NPIs for each such location.  Hospitals that fail to meet both requirements by January 1, 2028, will lose eligibility for that higher level of reimbursement.

CMS has issued proposed regulations and is accepting public comments until August 31, 2026.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

June 25, 2026

Posted on by Courtney Patterson

QUESTION:
Our MEC is considering action against a physician based on his longstanding and persistent pattern of low-level concerns including untimely H&Ps and op notes, meaningless progress notes, slow responses to calls/texts from staff, and minor professionalism issues.  We know that none of these concerns, standing alone, justify formal action.  But we want to know whether we can rely on these concerns, in the aggregate, to start an investigation, take disciplinary action, or even impose a summary suspension.

ANSWER FROM HORTYSPRINGER ATTORNEY SUSAN LAPENTA:
This is a great question, and it reflects a pretty common scenario.  As a word of caution, it is important not to react to the proverbial “straw that broke the camel’s back.” Taking action because Medical Staff Leaders are frustrated is understandable, but this can have long-term consequences for everyone, especially if that action is a summary or precautionary suspension.  As one court said in refusing to grant immunity to Medical Staff Leaders: “Once the damage is done, it is hard to undo.”

As a first step, you should chronicle all the concerns that have been raised about the physician going back at least three or four years.  This will help you identify patterns or trends in the kinds of concerns at issue.

As part of this chronology, you also want to include the interventions and actions that have been taken by your Medical Staff Leaders to address the concerns.  Oftentimes, when we dig into the details, we learn that while there has been a steady stream of safety reports or incident reports, there has been little or no follow-up with the physician.  Or perhaps Medical Staff Leaders met with the physician but there is no documentation of those meetings.  Or maybe there were follow-up letters to the physician, but the letters were light and casual and didn’t send a clear message about expectations and consequences if those expectations were not met.

Once you have prepared your chronology, you will have a better idea of the kind and frequency of the concerns that have been raised and the interventions that have been taken.  You will then be in a better position to decide what kind of remediation is needed.

We recommend that before you start an investigation or consider adverse action, including a precautionary suspension, consider the adoption of a performance improvement plan (PIP) (aka focused professional practice evaluation plan or voluntary enhancement plan).  It is important that the PIP be thorough, rigorous, and detailed.  For each concern you want to address, the PIP should identify a proposed condition as a form of remediation.

For instance, if there are concerns about the timeliness of the physician’s documentation, the PIP can incorporate language from your rules and regulations with the required time frames spelled out.  If the concern is about the substance of the physician’s documentation, the PIP might require the physician to complete approved CME on medical record documentation.  If the concerns are about professionalism, the PIP might require the physician to attend a specific course that focuses on the importance of effective communication in a health care setting.

The key to drafting an effective PIP is to be as specific as possible.  It is also important for the physician to understand that their compliance with the elements of the PIP will be monitored on an ongoing basis.  The results of the monitoring should be shared with the physician on a somewhat regular basis.  When the physician knows that they are being monitored, their performance is more likely to improve.

Another important component of the PIP is that it is voluntary.  The physician is given the chance to agree to abide by the PIP.  The PIP should clearly notify the physician that if they refuse to sign the PIP, the matter will be escalated, typically to the MEC, according to the Bylaws documents.

With few exceptions, when presented with the option of a PIP or escalation to the MEC, most physicians agree to the PIP.  And, importantly, we have found that, more often than not, physicians demonstrate substantial compliance with the PIP and improve enough to stay off the radar screen of Medical Staff Leaders.  Sometimes, there are setbacks and the PIP has to be expanded to capture new concerns or extended for longer periods of time.

Occasionally, there is a physician who can’t or won’t comply with the PIP and there are continued violations, and you may have to go down the path of a formal investigation and then disciplinary action.  But in those rare situations, you will have a detailed record that shows you have communicated concerns, expectations, and consequences to the physician.  This detailed record of your effort to work with the physician and the physician’s refusal to abide by clear, objective, established standards will be invaluable should you need to take disciplinary action.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

May 28, 2026

Posted on by Courtney Patterson

QUESTION:
We’ve had some debate over who can order therapeutic diets. Can you help explain the rules on this issue?

ANSWER FROM HORTYSPRINGER ATTORNEY IAN DONALDSON:
Historically, CMS has restricted the ability to order therapeutic diets to “practitioners responsible for the care of the patient.”  This generally meant physicians.  However, in 2014, CMS changed its position on this matter, and revised 42 C.F.R. §482.28(b)(2) to read “All patient diets, including therapeutic diets, must be ordered by a practitioner responsible for the care of the patient, or by a qualified dietician or qualified nutrition professional as authorized by the medical staff and in accordance with State law governing dieticians and nutrition professionals.”  (Emphasis added.)

This change came about largely in recognition of the fact that registered dietitians and other types of nutritionists are trained to assess the nutritional and therapeutic needs of patients.  As such, CMS notes in its Interpretive Guidelines that “[t]he hospital’s governing body may choose, when permitted under State law and upon recommendation of the medical staff, to grant qualified dietitians or qualified nutrition professionals diet-ordering privileges.”

As indicated above, your state law may still limit a dietitian’s scope of practice, so be aware of any restrictions at the state law level.

If you have a quick question about this, e-mail us at info@hortyspringer.com.

February 12, 2026

Posted on by Courtney Patterson

QUESTION:
What is the Joint Commission’s initiative for AI use in healthcare all about?

ANSWER FROM HORTYSPRINGER ATTORNEY MOISES TONOC BONILLA:
Recently, the Joint Commission and the Coalition for Health AI (“CHAI”) released an initial, high-level guidance document titled, “The Responsible Use of AI in Healthcare” (the “RUAIH Guidance”).  The RUAIH Guidance is intended to ultimately serve as internal guidance to help U.S. health systems safely and effectively implement AI in healthcare.

Importantly, the RUAIH Guidance does not (1) direct the development of AI tools or (2) validate the effectiveness of any AI tools used at a particular facility.  Rather, the RUAIH Guidance is designed to identify the responsible use and implementation of AI-enabled tools that health care organizations may ultimately use.  Moreover, the Joint Commission and CHAI anticipate developing a “Responsible Use of AI” playbook and voluntary “Use of AI” certification program sometime in the future.  But for now, the RUAIH Guidance identifies seven elements of responsible AI use in health care, including “Patient Privacy and Transparency”; “Data Security and Data Use Protections”; “Ongoing Quality Monitoring”; and “Risk and Bias Assessment.”  These elements, according to RUAIH Guidance, aim at reducing risks with AI error and improving administrative, operational, and patient outcomes by leveraging AI’s potential.  The RUAIH Guidance can be found here.

If you have a quick question about this, e-mail Moises at mtonocbonilla@hortyspringer.com.

December 11, 2025

Posted on by Courtney Patterson

QUESTION:
Our health system employs doctors through a “captive PC” where the CMO is the sole shareholder of the professional corporation but has no right to any distribution of profits or other rights normally related to ownership in a private medical group.  Does the Stark Law still apply to arrangements between the hospitals in our system and the captive PC?

ANSWER FROM HORTYSPRINGER ATTORNEY
DAN MULHOLLAND:
No.  In 2020, the definition of “ownership or investment interest” for the purpose of the Stark Law was amended to state that it does not include:  “A titular ownership or investment interest that excludes the ability or right to receive the financial benefits of ownership or investment, including, but not limited to, the distribution of profits, dividends, proceeds of sale, or similar returns on investment.”  42 CFR §411.354(b)(3)(vi).  This codified the conclusion of CMS Advisory Opinion AO-2005-08-01.  In that Advisory Opinion, CMS  concluded that stock ownership by physicians in a nonprofit corporation did not constitute an ownership or investment interest for the purposes of the Stark Law because the stock held by the physician-shareholders exhibited none of the benefits typical of stock ownership.

So, the fact that the hospitals in your situation may subsidize losses incurred by the captive PC would not, in and of itself, have Stark Law implications as it would if the hospital was subsidizing an independent practice.  However, to the extent that there would likely be indirect compensation arrangements between the hospitals and the employed physicians, it would still be necessary to make sure the compensation paid to the doctors reflects the fair market value of their services and is commercially reasonable.

If you have a quick question about this, e-mail Dan Mulholland at dmulholland@hortyspringer.com.

August 14, 2025

Posted on by Courtney Patterson

QUESTION:
We just discovered that we hired a nurse who was listed on the OIG’s List of Excluded Individuals and Entities while she worked for us.  What do we need to do and how does the OIG determine damages for a provider such as a nurse who does not make referrals of federal health care program beneficiaries to the Hospital?

ANSWER FROM HORTYSPRINGER ATTORNEY HENRY CASALE:
Unfortunately, if a hospital or other provider who received federal health care program reimbursement such as Medicare, Medicare and/or Tri-Care employs or contracts with  an individual or entity that is listed on the OIG’s List of Excluded Individuals and Entities (the “LEIE”), once discovered, the health care entity must make a self-disclosure to the Office of Inspector General (“OIG”) using the OIG’s self-disclosure protocol.

There is a section of the OIG’s protocol that specifically addresses self-disclosures involving excluded individuals. That Section of the Protocol states that the self-disclosure must include: the identity of the excluded person and any provider identification number; the job duties performed by that person; the dates of the person’s employment or contractual relationship; a description of any background checks that the disclosing party completed before and/or during the person’s employment or contract; a description of the disclosing party’s screening process (including any policy or procedure that was in place) and any flaw or breakdown in that process that led to the hiring or contracting with the excluded person; a description of how the conduct was discovered; and a description of any corrective action (including a copy of any revised policy or procedure) implemented to prevent future hiring of excluded persons.

One additional requirement that you might not expect is that the OIG also requires that before a self-disclosure involving an excluded individual or entity can be submitted to the OIG, the disclosing party must screen all current employees and contractors against the LEIE.

OK so once you have this information, you need to provide damage information.  Typically, damages for a self-disclosure are based on the items or services furnished, ordered, or prescribed by the excluded person.  However, the OIG understands that when the excluded person provided items or services that are not billed separately to Federal health care programs, such as your self-disclosure that is due to your hiring an excluded nurse, the damages amounts can be difficult to quantify.

In this instance, the OIG requires you to first determine your total costs of employment or contracting during the period of exclusion which includes all salary and benefits and other money or items of value, health insurance, life insurance, disability insurance, and employer taxes paid related to employment of the person such as the employer’s share of FICA and Medicare taxes.

This total amount is then multiplied by the disclosing party’s revenue-based Federal health care program payor mix for the period of time that the excluded individual was employed by the hospital.

If the disclosing party can measure the Federal payor mix for the department or unit in which the excluded person worked, it is appropriate to apply that payor mix. If the departmental payor mix cannot reasonably be measured, the disclosing party must apply the payor mix for the whole hospital. When the disclosing party is using a Federal health care program payor mix, the disclosure must include a separate calculation for each Federal health care program. For example, if the disclosing party’s Federal payor mix is 60 percent, the disclosure should break down how the Federal health care programs make up that 60 percent, such as 40 percent Medicare, 10 percent Medicaid State A, 5 percent Medicaid State B, and 5 percent TRICARE.

The resulting amount will be used as a proxy for the amount paid and the single damages to the Federal health care programs resulting from the employment of the excluded person.   The OIG Self-Disclosure Protocol states “The specific multiplier that we accept may vary depending on the facts of each case. OIG’s general practice in CMP settlements of SDP matters is to require a minimum multiplier of 1.5 times the single damages, although we determine in each individual case whether a higher multiplier may be warranted.”

So prepare yourself − this self-disclosure will not be inexpensive to resolve.  But take solace in knowing that by submitting the self-disclosure, you will put this unfortunate issue behind you, and the corrective actions that must be implemented as a result of the OIG’s Self-Disclosure Protocol should prevent you from ever having to submit another self-disclosure due to your hiring or contracting with an excluded individual or entity.

If you have a quick question about this, e-mail Henry Casale at HCasale@hortyspringer.com.

July 24, 2025

Posted on by jwilbert

QUESTION:
How far back do we have to go when verifying affiliations for locum tenens physicians during the credentialing process?

ANSWER FROM HORTYSPRINGER ATTORNEY CHARLIE CHULACK:
Unfortunately, there aren’t any hard and fast rules or guidance when it comes to this question.  The Joint Commission acknowledged this in an FAQ that was first published on April 11, 2016, by noting that “[t]here is no standard requirement to verify hospital/other healthcare organization affiliations, clinical affiliations, clinical responsibilities, or work history for an applicant.”  The FAQ can be found here.

If you are performing delegated credentialing (i.e., payor enrollment), the NCQA standards (which apply to insurers and their delegates) do have a discrete requirement which provides as follows:  “The organization obtains a minimum of the most recent 5 years of work history as a health professional through the practitioner’s application or CV.  If the practitioner has fewer than 5 years of work history, the time frame starts at the initial licensure date.”

That being said, many hospitals go back ten years when verifying affiliations, and this is the recommendation of at least one national credentialing organization.  However, a time frame of ten years can result in a hospital needing to verify an overwhelming number of affiliations for locum tenens who often practice at numerous hospitals each year.  Because of this, a hospital may want to focus on and require affiliation verifications for the ten most recent and/or active affiliations for a locum tenens applicant or ten affiliations where the locum tenens had the most activity/practiced for the longest period within the previous ten years.  This should give you sufficient information to get a good picture of their practice and if it doesn’t, your policy language should permit you to verify additional affiliations.  Finally, remember, if there are any questions or concerns raised about the locums’ practice, you can ask follow-up questions; the burden is on the applicant to provide information to resolve those questions, and their application should be held incomplete until such information is furnished.

If you have a quick question about this, e-mail Charlie Chulack at cchulack@hortyspringer.com

July 17, 2025

Posted on by Courtney Patterson

QUESTION:
Is our responsibility under EMTALA complete once we conduct an Emergency Screening Exam and determine that since we do not have the ability to treat the patient, the patient will be transferred to another hospital?

ANSWER FROM HORTYSPRINGER ATTORNEY HENRY CASALE:
No.  There are two separate duties under EMTALA – the duty to conduct an Emergency Medical Screening Exam and a duty to stabilize the patient – your obligations under EMTALA are not complete until both duties have been satisfied in a reasonable manner.

A hospital must satisfy EMTALA’s first duty by providing an appropriate Medical Screening Examination (“MSE”) to any individual who comes to the hospital’s Emergency Department requesting examination or treatment.  While an MSE is not required to be conducted by a physician, if a non-physician will conduct the MSE, they must be qualified, and have been approved by the Board, to perform an MSE.

It is important to note that EMTALA does not impose a national standard of care on how to screen patients.  Therefore, a hospital is not required to provide an MSE that is comparable to an MSE offered in other hospitals, nor is a hospital required to provide more than an initial MSE.  However, if the screening is so cursory that it is not designed to identify a patient’s acute and severe symptoms to alert the ED personnel of the need for immediate medical attention to prevent serious bodily injury, the hospital may be found to have failed in its duty to conduct an MSE.

Once the MSE determines that the patient is suffering from an emergency medical condition, the next obligation that EMTALA imposes on the hospital is to provide such further medical examination and treatment as may be required to stabilize the patient’s emergency medical condition, either for admission or to transfer the patient to another medical facility.  (BREAKING NEWS – be sure to read next week’s HLE as a court just found, for what we can determine is the first time, that a court has disagreed with HHS’s long held position that EMTALA’s obligations end once a patient is admitted to a hospital.)

EMTALA imposes strict guidelines on patient transfers.  A patient in an emergency medical condition may be transferred to another medical facility if after being informed of the risks of transfer and of the hospital’s treatment obligations, the individual requests to be transferred (“patient-initiated transfer”), or based on the information available at the time of transfer, the physician determines that the medical benefits to be received at another medical facility outweigh the risk to the patient of being transferred (including, in the case of a woman in labor, the risks to the unborn child) and a certification to this effect is signed by the physician (“physician-initiated transfer”).

Where a transfer is permitted, the hospital’s duty to stabilize the patient prior to transfer requires the hospital’s ED to provide “such medical treatment of the condition as may be necessary to assure, within reasonable medical probability, that no material deterioration of the condition is likely to result from or occur during the transfer of the individual from a facility.”

Therefore, a hospital may not transfer a patient with an emergency medical condition which has not been stabilized.  The hospital’s duty under EMTALA to “stabilize” the patient prior to transfer includes: (i) appropriate treatment of the patient while awaiting transfer: (ii) taking the steps reasonably required to minimize the risks associated with the transfer; and (iii) making sure that the patient is transported in an appropriate manner that takes into account the patient’s emergency medical condition.

A patient will have a claim against the hospital for a breach of EMTALA’s duty to stabilize pending transfer where the patient is able to show that the hospital did not satisfy this duty.

If you have a quick question about this question, please e-mail Henry Casale at hcasale@hortyspringer.com.