"Private Equity and the Practice of Medicine"

Harvard Magazine has published a useful summary of the quality issues that appear to arise when private equity firms invest in health care facilities:

According to associate professor of health care policy and medicine Zirui Song and other Harvard researchers, patients in hospitals owned by private equity firms suffered significantly more hospital-acquired adverse events than those being cared for in similar hospitals with no such investor participation. [Song] analyzed more than 4.8 million Medicare claims tied to hospital stays between 2009 and 2019. Patients in the hospitals acquired by private equity firms experienced 25.4 percent more hospital-acquired conditions. Underlying that alarming overall difference was a 37.7 percent increase in central-line associated bloodstream infections and a 27.3 percent increase in falls, compared to peer hospitals with no private equity involvement.

The problem is particularly acute when the private equity firm employs a leveraged buy-out to acquire the facility. The investor funds the acquisition with debt that goes onto the facility's books. The equity partners typically do quite well with their investment, but servicing that debt often requires cuts in services and staff. And some facilities don't survive, removing a health care provider from the community. The closures haven't discouraged private equity investors from seeking profits from health care providers, with "investors taking a $1-trillion stake during the past decade in everything from nursing homes and rehabilitation facilities to physicians’ practices and hospitals. According to the nonprofit Private Equity Stakeholder Project, approximately 460 U.S. hospitals are currently owned by private equity firms, representing eight percent of all private hospitals and 22 percent of all proprietary for-profit hospitals."

Song and his colleagues have a few suggestions for reform:

• "[S]tates could better enforce existing regulations designed to prevent commercial exploitation of physicians, though most states have broad exceptions to these “corporate practice of medicine” laws."
• "States might also grant their attorneys general more authority to block private equity healthcare deals they deem harmful to patients or to competition. Federal policymakers and legal scholars have put forth similar views."
• "Critics also suggest lowering the threshold for mandatory reporting of private equity deals to the Securities and Exchange Commission, established by the Hart-Scott-Rodino Antitrust Improvements Act of 1976. Currently, that ceiling, which changes yearly, stands at $119.5 million. Song notes, 'Most private equity acquisitions, especially of physician practices, are well below that threshold, so they never get reported."

A similar concern with quality after private equity comes on the scene was expressed by Edward P. Hoffer, "Private Equity and Medicine: A Marriage Made in Hell," 137 Am. J. Med. 5 (Jan. 2024) (may be behind a paywall).

SEC's Final Cybersecurity Rule and the Health Care Industry

Rachel Rose and Bob Chaput have written a helpful guide to the SEC's new final rule on cybersecurity and related issues (most especially reporting cyber breaches): "The Nexus Between the SEC’s Final Rule and the Health Care Industry" in the American Health Law Association's Health Law Weekly (Aug. 4, 2023). The first couple of paragraphs serve as an abstract for the piece (footnotes omitted):

In March 2023, we wrote the article, Why ALL Health Care Organizations Must Care About SEC Proposed Cybersecurity Rule Changes, which highlighted the U.S. Securities and Exchange Commission’s (SEC’s) March 9, 2022 announcement of its proposed rules related to cybersecurity requirements (i.e., risk management, corporate governance, and incident disclosures).

While testifying in front of the U.S. Senate Committee on Banking, Housing, and Urban Affairs, SEC Chairman Gary Gensler stated, “[t]he proposed amendments are intended to better inform investors about a registrant’s risk management, strategy, and governance and to provide timely notification of material cybersecurity incidents.” The wait is over. On July 26, 2023, the SEC released its final rule related to cybersecurity. Specifically, the final rule requires registrants and foreign issuers alike “to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.”

This article highlights some of the key areas that health care sector participants—public, private, and not-for-profit—should consider in relation to enterprise risk management and policies and procedures.

Before those of you who don't represent clients whose shares are registered with the SEC conclude this article doesn't apply to those companies, NOT SO FAST. One of the major takeaways of this article -- which is brief and to the point -- is that there is enough potential liability to go around.

The article is available to AHLA members only, which is reason enough to join if you haven't already!