Saturday, June 22, 2024

Mark Hall on HCA's Acquisition of Tax-Exempt Health System

Wake Forest law professor Mark Hall has released the latest chapter in his exhaustive preliminary report on the 2019 acquisition of Asheville, North Carolina's tax-exempt Mission Health System. As he writes in this new chapter: "As a result, Mission’s flagship facility became the fifth largest for-profit hospital in the country. Prior to HCA’s purchase, Mission had been operated as a nonprofit “charitable” organization ever since its founding in 1885." Prof. Hall's goal is to describe in as much detail as possible the decision-making process that led to the acquisition, how Mission Health performed before the acquisition, and how the system has performed over the next 5 years. (McKenzie Wicker wrote a comprehensive piece for the Asheville Citizen Times in 2020. Mission Health has been a major news story for the five years since the acquisition. See also NBC News, Nov. 13, 2023 and related stories.)
 
The hospital world is divided into three types of entity: public hospitals, private for-profit hospitals, and private nonprofit (and almost always tax-exempt) hospitals. For-profits are expected to generate net revenues that may be put to various uses but are also expected to be distributed to investors (increased share values, dividends, etc.). Nonprofits are also expected to generate net revenues, but are barred from benefitting private interests by state and federal laws (including § 501(c)(3) of the Internal Revenue Code, which is applicable to most nonprofit hospitals). A major question that garners the attention of state courts and legislatures as well as members of Congress from time to time is whether the tax subsidies that flow to tax-exempt hospitals are justified by a corresponding benefit to the public (principally but not exclusively improved access to care, higher quality of care, lower prices for that care, medical education, medical research, and charity care). Across the country, the answer appears to be mixed: sometimes yes, sometimes no.

These three categories are not impermeable spheres. Various combinations are permitted and mostly take the form of joint ventures, mergers, or acquisitions. These different arrangements raise all sorts of legal and public-policy issues. To perform any sort of useful analysis, however, we need facts. 

With mergers and joint ventures, policy-makers tend to be most concerned with making sure the nonprofit/tax-exempt entity doesn't become a profit-making (and profit-distributing) arm of its for-profit partner. 

With outright acquisitions, the issues are different because the acquired tax-exempt entity will be operated as a for-profit business. Prof. Hall is analyzing each one in a separate release. As described by the Nonprofit Law Blog (as of May 30, 2024), the entries so far are these:

To this list we can now add Thursday's entry, Mission Hospital’s Decision to Sell to HCA. Working Draft (2024). by Professor Mark Hall.

Wednesday, June 19, 2024

HIPAA Violation Alleged Against Texas Physician

We all know HIPAA, the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), because seemingly every visit to every doctor starts with an HIPAA authorization form that allows patients to designate persons with whom personal health information (PHI) can be shared. The statute is pretty bare-bones, but it authorizes HHS to issue rules, which it did from 2000 to 2013 (summarized at the bottom of this post*). 

The cardinal rule for health care professionals is pretty simple: Don't access or spread the PHI of patients unless there's a need to know (with respect to the person accessing the PHI and the person on the receiving end). There are a gazillion technical aspects to the rule, but my version will cover the vast majority of situations in which a person who is covered by the rule (including health care professionals) seeks access to PHI.

A violator of HIPAA faces civil and criminal prosecution that may result in fines or even jail time. A medical resident at Baylor College of Medicine has been indicted for alleged HIPAA violations and if convicted faces the possibility of a $250,000 penalty and up to ten years in prison. Here's DOJ's summary of the case:

A Houston doctor has been indicted for obtaining protected individual health information for patients that were not under his care and without authorization, announced Alamdar S. Hamdani.

The four-count indictment alleges [Ethan] Haim[, Dallas,] obtained personal information including patient names, treatment codes and the attending physician from Texas Children’s Hospital’s (TCH) electronic system without authorization. He allegedly obtained this information under false pretenses and with intent to cause malicious harm to TCH.

 According to the indictment, Haim was a resident at Baylor College of Medicine and had previous rotations at TCH as part of his residency.

In April 2023, Haim allegedly requested to re-activate his login access at TCH to access pediatric patients not under his care. The indictment alleges he obtained unauthorized access to personal information of pediatric patients under false pretenses and later disclosed it to a media contact.

According to Becker's Hospital Review (June 17),  

[Haim] is accused of violating HIPAA by leaking internal documents from Houston-based Texas Children's Hospital concerning gender-affirming services. . . . 

This unauthorized access allegedly allowed him to obtain patients' personal health information, including names, treatment codes and details of the attending physicians. . . . 

In May 2023, Dr. Haim shared these internal documents with Christopher Rufo, a senior fellow at the Manhattan Institute in New York City. . . .

Although a HIPAA violation is a violation, not all violations are created equal. Inadvertence, carelessness, a desire to be helpful -- none of these excuses a violation of HIPAA, but the key to this case is likely to be the apparently political nature of Dr. Haim's alleged breach and this sentence in the DOJ press releasee: "He allegedly obtained this information under false pretenses and with intent to cause malicious harm to TCH." If true, not a good way to start a career in medicine!
____________________________

*HHS's HIPAA rules (source):

  • HHS published a final Privacy Rule in December 2000, which was later modified in August 2002. This Rule set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.  Compliance with the Privacy Rule was required as of April 14, 2003 (April 14, 2004, for small health plans).
  • HHS published a final Security Rule in February 2003. This Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information. Compliance with the Security Rule was required as of April 20, 2005 (April 20, 2006 for small health plans).
  • The Enforcement Rule provides standards for the enforcement of all the Administrative Simplification Rules.
  • HHS enacted a final Omnibus rule that implements a number of provisions of the HITECH Act to strengthen the privacy and security protections for health information established under HIPAA, finalizing the Breach Notification Rule.
  • View the Combined Regulation Text - PDF (as of March 2013). This is an unofficial version that presents all the HIPAA regulatory standards in one document. The official version of all federal regulations is published in the Code of Federal Regulations (CFR). View the official versions at 45 C.F.R. Part 160 - PDF, Part 162 - PDF, and Part 164 - PDF.

Tuesday, June 18, 2024

COVID-19 Vaccine Fraud: The Worst of the Worst?

Here's the case summary from USDOJ (Office of Public Affairs, June 17, 2024):

A New York woman pleaded guilty today to fraudulently destroying over 2,600 COVID-19 vaccines and issuing a corresponding number of fraudulent COVID-19 vaccination record cards.

According to court documents, Kathleen Breault, 66, of Cambridge, a midwife at Sage-Femme Midwifery PLLC (Safe-Femme), an authorized COVID-19 vaccine administration site in Albany, New York, conspired to obstruct the government’s distribution of COVID-19 vaccines by providing COVID-19 vaccination record cards to individuals who were not vaccinated, including to minors who were at the time ineligible to be vaccinated and to Canadian citizens who were not present in the United States when they were purportedly vaccinated. In addition to destroying COVID-19 vaccines and issuing fraudulent vaccination record cards, Breault and her co-conspirators made over 2,600 false entries into a New York State database that tracked COVID-19 vaccine distribution. Breault agreed to pay more than $37,000 in restitution for the destroyed vaccines.    

Breault pleaded guilty to conspiring to defraud the United States and its departments and agencies. She is scheduled to be sentenced on Sept. 18 and faces a maximum penalty of five years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors. 

The worst of the worst? It's up there. 

Most health care fraud is about money -- ill-gotten gains obtained by billing for services that were never rendered or that were not medically necessary and appropriate. Individual patients are sometimes harmed in these schemes (denied care they actually needed or exposed to treatment risks that were unnecessary), and then there are the addiction cases that -- in addition to the risk of death or serious injury -- often harm not only individuals but also families and contribute to the harm to whole communities. Even "pure financial fraud" harms insurance programs by taking away funds that could otherwise pay for the provision of medical care to patients in need of it.

This case adds another dimension to fraud-based community harms: public health and safety. Falsely documenting vaccinations and diverting thousands of doses of vaccine to the trash is doubly harmful. It allows unvaccinated individuals to work and play within communities that depended on the widest possible rate of vaccination. And many communities at times throughout the worst of the pandemic experienced vaccine shortages. This case isn't only about money. It's about a kind of depraved indifference to communal well-being that is hard to fathom.

Sunday, June 16, 2024

The Bump Stock Case: Is SCOTUS a Public Health Menace (Part II)?

The latest blockbuster decision from SCOTUS is "the bump stock case," Garland v. Cargill, U.S. No. 22-976 (June 14). There isn't much to add to the voluminous media coverage of this case, in which the six conservatives on the Court struck down a 2018 BATF regulation that banned bump stocks because they turned semiautomatic rifles into machineguns, which Congress severely restricted in 1934 (see definition of machinegun in National Firearms Act of 1934, 26 U. S. C. §5845(b)). The majority (in a highly technical and narrow decision by Justice Thomas*) disagreed with BATF and held that bump-stock-equipped rifles are not machineguns. To be fair, the Obama administration came to the same conclusion when it decided against a regulation that would have classified bump-stock-equipped rifles as machineguns. 

Writing for the three liberal justices in dissent, Justice Sotomayor wrote:

A machinegun does not fire itself.  The important question under the statute is how a person can fire it.  A weapon is a “machinegun” when a shooter can (1) “by a single function of the trigger,” (2) shoot “automatically more than one shot, without manually reloading.”  26 U. S. C. §5845(b).  The plain language of that definition refers most obviously to a rifle like an M16, where a single pull of the trigger provides continuous fire as long as the shooter maintains backward pressure on the trigger.  The definition of “machinegun” also includes “any part designed and intended . . . for use in converting a weapon into a machinegun.”  Ibid.  That language naturally covers devices like bump stocks, which “conver[t]” semiautomatic rifles so that a single pull of the trigger provides continuous fire as long as the shooter maintains forward pressure on the gun. 

This is not a hard case.  All of the textual evidence points to the same interpretation.  A bump-stock-equipped semiautomatic rifle is a machinegun because (1) with a single pull of the trigger, a shooter can (2) fire continuous shots without any human input beyond maintaining forward pressure.  The majority looks to the internal mechanism that initiates fire, rather than the human act of the shooter’s initial pull, to hold that a “single function of the trigger” means a reset of the trigger mechanism.  Its interpretation requires six diagrams and an animation to decipher the meaning of the statutory text.  Then, shifting focus from the internal mechanism of the gun to the perspective of the shooter, the majority holds that continuous forward pressure is too much human input for bump-stock-enabled continuous fire to be “automatic.” [emphasis added]

Justice Sotomayor rejects the majority's technical analysis with her customary flair:

Today, the Court puts bump stocks back in civilian hands.  To do so, it casts aside Congress’s definition of “machinegun” and seizes upon one that is inconsistent with the ordinary meaning of the statutory text and unsupported by context or purpose.  When I see a bird that walks like a duck, swims like a duck, and quacks like a duck, I call that bird a duck.  A bump-stock-equipped semiautomatic rifle fires “automatically more than one shot, without manual reloading, by a single function of the trigger.”  §5845(b).  Because I, like Congress, call that a machinegun, I respectfully dissent. 

At a minimum, doesn't the 6-3 split in this case suggest that it's plausible -- even reasonable --  to define bump-stock-enhanced rifles as machineguns, even if there is a plausible -- even reasonable -- contrary argument? Given the room for argument, isn't this just the sort of case in which generalist judges, with or without technical drawings and a video, should defer to the expertise of the agency (with or without Chevron)?

Last Father's Day, I posted about the Supreme Court's obstinate Second Amendment jurisprudence ("2nd Amendment thoughts -- The Constitution is not a suicide pact (or is it?)" (June 18, 2023).) Breaking no new ground whatsoever, I wrote that gun violence is not only a criminal-justice matter, it's also a matter of public health law. The statistics are stunning. So far this year, there have been 225 mass shootings in this country. Granted, few if any involved a bump-stock-equipped rifle, but the 2017 shooting at a Las Vegas music festival (in which 58 people were killed and over 500 injured by a shooter using weapons enhanced by bump stocks) demonstrates the lethality of bump stocks. And with over 700,000 of these things already in circulation (ABC News (June 14, 2024)), to build on Justice Sotomayor's analogy, we are all sitting ducks. 

So this Father's Day, I revisit the issue of gun violence and ask last year's question one more time: Don't we owe more to our children (and their children) than a world in which assault rifles are legal in 40 states and anyone with a driver's license can turn their assault rifle into a machinegun?

____________________

* There is a random connection between machineguns (especially the Thompson machinegun) and Dallas. The father of the late Cary Maguire -- Dallas oilman and philanthropist par excellence -- supplied Allied forces with the Tommy gun during WWII:


NY Times, Nov. 11, 1966 (obituary, J. Russell Maguire, (behind a paywall)).


Friday, June 14, 2024

NEWS FLASH: Telehealth Fraud is Health Fraud. Full Stop.

Here's the headline from DOJ, along with excepts from the news release announcing the arraignment of two principals of a telehealth company in California:

Founder/CEO and Clinical President of Digital Health Company Arrested
for $100M Adderall Distribution and Health Care Fraud Scheme

The founder and CEO (He) of a California-based digital health company and its clinical president (Brody) were arrested today in connection with their alleged participation in a scheme to distribute Adderall over the internet, conspire to commit health care fraud in connection with the submission of false and fraudulent claims for reimbursement for Adderall and other stimulants, and obstruct justice. . . .

“The individuals charged today allegedly disregarded the first rule of medical care—do no harm—in order to maximize profits, and there is no place for such fraud in our healthcare system,” said Secretary of Homeland Security Alejandro N. Mayorkas. . . . 

“As alleged in the indictment, the defendants provided easy access to Adderall and other stimulants by exploiting telemedicine and spending millions on deceptive advertisements on social media. They generated over $100 million in revenue by arranging for the prescription of over 40 million pills,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “These charges are the Justice Department’s first criminal drug distribution prosecutions related to telemedicine prescribing through a digital health company. As these charges make clear, corporate executives who put profit over the health and safety of patients—including by using technological innovation—will be held to account.”

According to court documents, He and Brody allegedly conspired with others to provide easy access to  Adderall and other stimulants in exchange for payment of a monthly subscription fee. The indictment alleges that the conspiracy’s purpose was for the defendants to unlawfully enrich themselves by, among other things, by increasing monthly subscription revenue and thus increasing the value of the company. Done allegedly arranged for the prescription of over 40 million pills of Adderall and other stimulants, and obtained over $100 million in revenue. 

He and Brody allegedly obtained subscribers by targeting drug seekers and spending tens of millions of dollars on deceptive advertisements on social media networks. They also allegedly intentionally structured the Done platform to facilitate access to Adderall and other stimulants, including by limiting the information available to Done prescribers, instructing Done prescribers to prescribe Adderall and other stimulants even if the Done member did not qualify, and mandating that initial encounters would be under 30 minutes. To maximize profits, He allegedly put in a place an “auto-refill” function that allowed Done subscribers to elect to have a message requesting a refill be auto-generated every month. He wrote that Done sought to “use the comp structure to dis-encourage follow-up” medical care by refusing to pay Done prescribers for any medical visits, telemedicine consultation, or time spent caring for patients after an initial consultation, and instead paying solely based on the number of patients who received prescriptions.

“The defendants in this case operated Done Global Inc., an online telehealth website that prescribed Adderall and other highly addictive medications to patients who bought a monthly subscription. The defendants allegedly preyed on Americans and put profits over patients by exploiting telemedicine rules that facilitated access to medications during the unprecedented COVID-19 public health emergency,” said DEA Administrator Anne Milgram. “Instead of properly addressing medical needs, the defendants allegedly made millions of dollars by pushing addictive medications. In many cases, Done Global prescribed ADHD medications when they were not medically necessary. In 2022 the FDA issued a notice of shortages in prescription stimulants, including Adderall. Any diversion of Adderall and other prescription stimulant pills to persons who have no medical need only exacerbates this shortage and hurts any American with a legitimate medical need for these drugs. The DEA will continue to hold accountable anyone, including company executives, that uses telehealth platforms to put profit above patient safety”. . . .

He and Brody allegedly persisted in the conspiracy even after being made aware that material was posted on online social networks about how to use Done to obtain easy access to Adderall and other stimulants, and that Done members had overdosed and died. They also allegedly concealed and disguised the conspiracy by making fraudulent representations to media outlets to forestall government investigations and action and induce third parties to continue doing business with Done. . . .

This isn't just about money. It's about enabling addiction and about killing patients. I am amazed at the sociopathic conduct alleged here, and even more amazed that a digital company thought it could (allegedly) engage in massive on-line health fraud without leaving a digital trail  that would lead directly back to the company and its leaders. Hubris? Stupidity? Both?

Thursday, June 13, 2024

SCOTUS: Mifepristone Remains Available Despite 5th Circuit Ruling

A unanimous Supreme Court today reversed a Fifth Circuit opinion that held that various actions taken by the FDA with respect to its regulation of mifepristone were arbitrary and capricious.

The court's opinion -- which all nine justices joined -- found that the plaintiffs lacked Article III standing to press their claim that the FDA acted unlawfully when it approved, and then loosened, restrictions on the way the abortion drug may be prescribed. I usually feel that the Court uses (and misuses) standing doctrine to avoid deciding questions it would rather not decide. In this case, though, the plaintiffs' standing theories were pretty farfetched and the Court wasn't buying any of them.

The basic problem with this case was that the doctors couldn't point to any harm, injury, or hardship the FDA's approval imposed on them:

[T]he plaintiffs do not prescribe or use mifepristone. And FDA is not requiring them to do or refrain from doing anything. Rather, the plaintiffs want FDA to make mifepristone more difficult for other doctors to prescribe and for pregnant women to obtain.  Under Article III of the Constitution, a plaintiff ’s desire to make a drug less available for others does not establish standing to sue. [emphasis in original]

On the merits (which the Court did not address), I think the FDA's handling of the demonstrably safe and effective mifepristone was unassailable, but a win is a win.

The next question is: If these plaintiffs don't have standing to challenge the FDA's actions, who does? The answer might well be noöne:

For starters, it is not clear that no one else would have standing to challenge FDA’s relaxed regulation of mifepristone.  But even if no one would have standing, this Court has long rejected that kind of “if not us, who?” argument as a basis for standing. The “assumption” that if these plaintiffs lack “standing to sue, no one would have standing, is not a reason to find standing.” Rather, some issues may be left to the political and democratic processes: The Framers of the Constitution did not “set up something in the nature of an Athenian democracy or a New England town meeting to oversee the conduct of the National Government by means of lawsuits in federal courts.” [citations omitted]

That said, three states have intervened in this case, which is pending in federal district court in Amarillo. Why Amarillo? Because conservative plaintiffs know they have a judge there who will lend a sympathetic ear to their cause. See Texas Tribune, April 11, 2024. 

As reported by Bloomberg News:

Missouri, Idaho, and Kansas have already intervened in the case before the district court, alleging their own unique harms. The states claim their residents are suffering serious medical complications that require emergency care after taking mifepristone that they’ve obtained through the mail and the states are having to pay for much of that care through Medicaid.

Stay tuned . . . .

Saturday, June 08, 2024

"Private Equity and the Practice of Medicine"

Harvard Magazine has published a useful summary of the quality issues that appear to arise when private equity firms invest in health care facilities:

According to associate professor of health care policy and medicine Zirui Song and other Harvard researchers, patients in hospitals owned by private equity firms suffered significantly more hospital-acquired adverse events than those being cared for in similar hospitals with no such investor participation. [Song] analyzed more than 4.8 million Medicare claims tied to hospital stays between 2009 and 2019. Patients in the hospitals acquired by private equity firms experienced 25.4 percent more hospital-acquired conditions. Underlying that alarming overall difference was a 37.7 percent increase in central-line associated bloodstream infections and a 27.3 percent increase in falls, compared to peer hospitals with no private equity involvement.

The problem is particularly acute when the private equity firm employs a leveraged buy-out to acquire the facility. The investor funds the acquisition with debt that goes onto the facility's books. The equity partners typically do quite well with their investment, but servicing that debt often requires cuts in services and staff. And some facilities don't survive, removing a health care provider from the community. The closures haven't discouraged private equity investors from seeking profits from health care providers, with "investors taking a $1-trillion stake during the past decade in everything from nursing homes and rehabilitation facilities to physicians’ practices and hospitals. According to the nonprofit Private Equity Stakeholder Project, approximately 460 U.S. hospitals are currently owned by private equity firms, representing eight percent of all private hospitals and 22 percent of all proprietary for-profit hospitals."

Song and his colleagues have a few suggestions for reform:

  • "[S]tates could better enforce existing regulations designed to prevent commercial exploitation of physicians, though most states have broad exceptions to these “corporate practice of medicine” laws."
  • "States might also grant their attorneys general more authority to block private equity healthcare deals they deem harmful to patients or to competition. Federal policymakers and legal scholars have put forth similar views."
  • "Critics also suggest lowering the threshold for mandatory reporting of private equity deals to the Securities and Exchange Commission, established by the Hart-Scott-Rodino Antitrust Improvements Act of 1976. Currently, that ceiling, which changes yearly, stands at $119.5 million. Song notes, 'Most private equity acquisitions, especially of physician practices, are well below that threshold, so they never get reported."
A similar concern with quality after private equity comes on the scene was expressed by Edward P. Hoffer, "Private Equity and Medicine: A Marriage Made in Hell," 137 Am. J. Med. 5 (Jan. 2024) (may be behind a paywall).

Friday, June 07, 2024

Health Care Fraud: The Beat Goes On (and On and On)

 

More enforcement news from the HHS Office of Inspector General:

These aren't huge amounts of money, as far as health care fraud goes in this country. What impresses (and depresses) me is the steady drumbeat of criminal activity in this sector. With all the money sloshing around in the industry that counts for the largest percentage of our GDP, the lure of easy money is apparently irresistible. 

Thursday, June 06, 2024

SCOTUS (5-4) Rules in Favor of Indian Nations in Health Care Funding Dispute

Feb 28, 2023Feb 28, 2023 

The Supreme Court today decided a statutory interpretation case in which millions of dollars were at stake. Without getting too far into the weeds, the issue was whether the federal government is obligated to pay the costs incurred by Indian tribes to administer health programs funded by Medicare, Medicaid, and private insurers. The majority ruled that the statute in question -- the  Indian Self-Determination and Education Assistance Act ("ISEA"), 25 U. S. C. §5301 et seq. -- requires (unambiguously, apparently) the U.S. to reimburse the tribes for those administrative costs.

The Court's analysis (written by Chief Justice Roberts) invoked the text of the statute, the policy Congress sought to further when it passed the ISEA, and the history of the statutory provisions in question. The analysis is pretty mainstream for the Court, although originalists often abjure policy and legislative history as too squishy to be relied upon.

As the Court's opinion points out, there is an interpretive tool called "the Indian canon," which calls for statutory language that is ambiguous to be construed in favor of Indian tribes. One of the courts of appeals relied on the Indian canon to rule against the federal government. The other lower court produced three opinions in which one of the judges in the majority found the statute to be ambiguous and subject to the Indian canon, while the other judge in the majority thought the provision unambiguously supported the tribe. 

The SCOTUS majority, after mentioning the Indian canon in its description of the rulings below, never went back to it. Maybe the Court found the statute's meaning to be unambiguous. And maybe the Chief decided to skip the canon in order to keep Justice Kavanaugh as the all-important fifth vote. 

Canons of statutory interpretation are getting increased scrutiny at the Court, as evidenced by a recent concurring opinion by Justice Kavanaugh (Rudisill v. Secretary, Dep't of Veterans Affairs, April 16, 2024; see also Daniel Harawa, Justices lean toward narrow reading of aggravated identity theft, SCOTUSBlog, Feb 28, 2023 ("In many ways, Monday’s oral argument in Dubin v. United States felt like a legislation class in law school, with various canons of statutory construction being bandied about"; the defendant prevailed in this identity-fraud case in a 9-0 opinion by Justice Sotomayor that Professor Harawa described as "a tutorial in statutory interpretation"). 

Is a free-for-all over competing interpretive canons evidence that canons are alive and well? Or that interpretive canons are seen as makeweights with little more than rhetorical value?