August 10, 2023

One of our medical staff members asked if, under the Health Insurance Portability and Accountability Act (“HIPAA”), he can inform a patient he is currently treating about the cancer history of a former, deceased patient who was a family member of the current patient.  The physician believes that this information will assist the patient in making choices about the direction of her treatment. Can he do that?

The HIPAA Privacy Rule protects “individually identifiable health information,” which is defined to include a patient’s past physical health condition.  Thus, the deceased patient’s cancer history meets this definition.  However, since the patient is deceased, is the information still protected under the HIPAA Privacy Rule?  The answer to this question is “yes.”  The HIPAA Privacy Rule protects individually identifiable health information of deceased patients for 50 years following the date of the death of the individual.  Assuming the patient hasn’t been dead for 50 years, the patient’s individually identifiable health information is subject to the protections of the HIPAA Privacy Rule.

It is certainly important that a patient understand their family history, including risks for certain diseases and disorders so that they can proactively address those risks.  Here, the treating physician’s hands aren’t completely tied when it comes to counseling the patient on such matters.  He has a few options.  The physician can rely on an exception to the HIPAA Privacy Rule, which permits the disclosure of protected health information for treatment activities.  According to guidance issued by the United States Department of Health and Human Services, the “treatment” exception “allow[s] use and disclosure of protected health information about one individual for the treatment of another individual.”  If the physician is concerned that counseling on a family member’s cancer history does not definitively meet the definition of “treatment” under HIPAA, he has other options.  First, and most obviously, the physician can ask the patient if she is aware of any family history of cancer.  If not, the physician can obtain a written HIPAA authorization from a personal representative (e.g., the deceased patient’s executor or administrator) to disclose the information.  If the physician is unable to obtain a written authorization for whatever reason (such as an inability to locate the personal representative) or believes this is too burdensome, the physician can still make treatment recommendations without disclosing health information protected under HIPAA.  For example, the physician may recommend more frequent cancer screenings based on the family history to which he is privy.

If you have a quick question about this, e-mail Charlie Chulack at

August 18, 2022

Our On-Call Policy requires physicians to have 30 admissions or operating cases at the hospital per year to participate in the on-call schedule. The Policy also gives discretion to the department chairs, who develop the call schedules, to limit the ability of a particular physician to participate in the schedule for a number of reasons, some of which have nothing to do with the quality of care being provided. Do these provisions in our Policy pose any legal concerns?

Yes. First, conditioning participation in the call schedule on admissions at, or procedures done in, the hospital could be interpreted as conditioning participation on referrals to the hospital. Such a requirement could present compliance issues with the federal Anti-Kickback Statute. In Supplemental Compliance Program Guidance for Hospitals, the Department of Health and Human Services Office of Inspector General (“OIG”) cautioned that “conditioning privileges on a particular number of referrals or requiring the performance of a particular number of procedures, beyond volumes necessary to ensure clinical proficiency, potentially raise substantial risks under the [Anti-Kickback] statute.” Some state courts have found that participation on the call-coverage roster constitutes a “privilege.”

This issue is something that is on the Department of Justice’s radar as well.  For example, in 2010, a hospital agreed to pay the United States $108 million to settle claims that it violated the Anti‑Kickback Statute and the False Claims Act by limiting the opportunity to work at an outpatient cardiology testing unit to cardiologists who referred business to the hospital, giving the cardiologists a percentage of time in the testing unit which corresponded with the gross revenue attributed to the cardiologists’ referrals.  Conditioning participation on the call roster on admissions or performing cases at the hospital presents similar risks.

If compensation is involved in the call coverage arrangements, there is further concern under the Anti‑Kickback Statute. The OIG has warned that under the Anti-Kickback Statute there is “considerable risk” in conditioning compensation for on-call coverage on “doing business at a hospital.”

Finally, giving the department chairs the discretion to limit the ability of a physician to take call poses anticompetitive concerns. While there may be legitimate reasons to limit the ability of a physician to take call, such as issues with a physician’s quality of care, such decisions should not be made solely by potential competitors in the department.

October 28, 2021

I noticed that part two of the surprise billing rules were published.  Do these new rules require any action prior to their January 1, 2022 effective date?

The surprise billing saga continues! Are you ready for January 1?

By way of background, on July 13, 2021, the Departments of Health and Human Services, Labor, and Treasury published an interim final rule implementing certain provisions of the No Surprises Act, which was enacted as part of the Consolidated Provisions Act of 2021.  Effective January 1, 2022, the interim final rule affords patients protection against balance billing and cost sharing for certain out-of-network services, prohibits out-of-network providers and health care facilities from balance billing patients under specific circumstances absent notice and consent, and requires providers to disclose federal and state patient protections against balance billing.  You can tune in to our audio conference or read about it here to learn more about what part one of the Surprise Billing rules require of you.

On September 30, 2021, the Departments issued a second interim rule with additional provisions aimed at protecting consumers from surprise medical bills under the No Surprises Act.  Among other things, this rule removes the consumer from payment disputes by requiring providers and health plans to follow outlined payment dispute processes to resolve any remaining costs for out‑of-network services not billed to the patient.

In addition, beginning January 1, 2022, providers will be required to provide uninsured and self‑pay consumers “good faith” estimates of expected charges for items or services within one business day after scheduling or within three business days after the consumer requests the estimate.  A “good faith” estimate should include an itemized list of and expected charges for the scheduled item or service and any other related item or service likely to be provided.

In anticipation of these rules taking effect, you should begin to review the dispute resolution language in your payor contracts, if such language exists, to ensure that it is aligned with the processes outlined in the second interim rule.  You should also begin drafting a good faith estimate form or adopt CMS’ template, which can be found here.

Tune in to our next surprise billing audio conference on January 4, 2022 for more information on the implementation of the Surprise Billing rules.

August 12, 2021

“What about those surprise billing rules?  We heard they aren’t effective until January 1, 2022.  Should we be doing anything now to prepare?”

The Surprise Billing Rules are a big deal!  And there are steps you can take to be prepared for January 1, 2022.

On July 13, 2021, the Departments of Health and Human Services, Labor, and Treasury published an interim final rule implementing certain provisions of the No Surprises Act, which was enacted as part of the Consolidated Provisions Act of 2021.  Effective January 1, 2022, the interim final rule affords patients protection against balance billing and cost sharing for certain out-of-network services, prohibits out-of-network providers and health care facilities from balance billing patients under specific circumstances absent notice and consent, requires providers to disclose federal and state patient protections against balance billing, and sets forth complaint and dispute resolution processes for patients, payers, and provides to address potential violations of the protections against balance billing and cost sharing under the No Surprises Act.

Among other protections, the Interim Final Rule prohibits balance billing for non-emergency services furnished at an in-network facility by an out-of-network provider, absent notice and consent.  In addition, out-of-network providers may only bill the patient such cost-sharing amounts similar to what the patient would pay had they received those services in-network.  This restriction includes out-of-network charges for ancillary services (e.g., radiology, anesthesiology, pathology, cardiology, and emergency medicine) provided at in-network facilities.  Any charges left over, however, may not be balanced billed to the patient.

In anticipation of these rules taking effect, you should review your hospital-based provider contracts.  If the contracts are silent on how those providers can bill patients, you could build language into the contracts requiring the provider to contract with every health plan that the hospital contracts with.  You can also put language in the contact prohibiting the out-of-network provider from balance billing.

This is one of several issues hospitals should be considering in preparation for the surprise billing rules’ January 1, 2022 effective date.  For more information on the Surprise Billing Rules, tune in to our audio conference. If you have any questions, or if you would like help reviewing your provider agreements, feel free to reach out to Mary Paterni at

May 6, 2021

QUESTION:    “We are in the midst of a review of our Medical Staff Bylaws and one of the Bylaws Committee members said that she heard that we shouldn’t be including our hospital’s Institutional Review Board (“IRB”) in the Bylaws with all of the other medical staff committees. Is that true?”

ANSWER:       Yes.  The federal Food and Drug Administration regulations pertaining to IRBs, 21 C.F.R. §56.101 et seq., define an IRB as “any board, committee, or other group formally designated by an institution to review, to approve the initiation of and to conduct periodic review of biomedical research involving human subjects.”  The Department of Health and Human Services’ regulations echo the “institutional” aspect of the formal designation of IRBs (45 C.F.R. Part 46).  Federal regulations require the IRB to be a committee formally designated by a hospital’s Governing Board to review biomedical research involving human subjects at the hospital.

This issue has been gaining momentum lately in research audits performed by both the Office of Human Research Protections and the Food and Drug Administration in which the agency has taken issue with the fact that the institutions included their IRBs as one of several “medical staff committees” that lived in a medical staff governance document like the bylaws.  The auditors pointed generally to the regulatory language, that it is an institutional responsibility to maintain an appropriate IRB, not a medical staff responsibility.  As a practical matter, the concern is that (while very unlikely) if the IRB procedures need to be revised because of a regulatory change, the medical staff could refuse to do so, as is contemplated by the amendment process to these rules.  By comparison, if the IRB is a hospital committee, hospital administration and/or the Board could implement a change on its own action.  Again, while the likelihood of a Medical Executive Committee or a medical staff as a whole acting in such an obstructionist manner is very slim, in the eyes of the audit agencies, it is a valid concern.

Therefore, we recommend that the IRB be created by a Board resolution and thereafter function as a committee of the hospital, rather than the medical staff, with its independent authority derived from the Board.  There may be substantial overlap of the IRB membership with that of a medical staff committee.  However, the IRB should be constituted as a separate committee of the Board in accordance with the membership requirements set forth in the federal regulations.

January 30, 2020

QUESTION:        I heard that the Department of Health and Human Services released a new rule on partial fills of opioid prescriptions.  Can you give me a brief overview of the change?

ANSWER:          Yes.  The Department of Health and Human Services (“HHS”) has issued a final rule designed to improve tracking of transactions involving Schedule II drugs.  Briefly stated, this change requires certain covered entities to report “quantity prescribed” data for transactions involving Schedule II drugs.  The data will track whether the prescription was partially filled (which is legal under some circumstances) or refilled (which can potentially be a violation of the Controlled Substances Act).

If your organization is covered by HIPAA and has a retail pharmacy that dispenses Schedule II drugs, you should check to see whether this law may have an impact on your workflows and recordkeeping.  The final rule is available here.

March 7, 2019

QUESTION:        The Department of Health and Human Services requires us to take reasonable steps to provide meaningful access to Limited English Proficient (“LEP”) persons.  Can we rely on a patient’s family members or friends to help with this?

ANSWER:            No.  The only exception is if it is an emergency or if the patient specifically requests otherwise.  All entities that receive federal financial assistance from the Department of Health and Human Services (“HHS”) are generally prohibited from requiring patients with limited English proficiency to use family members or friends as interpreters.  HHS acknowledges in its regulatory guidance that there may be times when a patient feels more comfortable having a trusted friend or family member act as interpreter — under these circumstances, you can honor the request.  However, you should consider factors such as competency, confidentiality, privacy, and/or conflicts of interest.

Your legal obligations will vary depending on the size of your organization and the patients you typically encounter.  This area of the law is developing quickly and we expect to see more case law on this topic in the next few years.  In the meantime, we encourage you to review your policies on this matter and have your lawyers assess whether you are in compliance with all federal regulatory obligations.