Healthcare Law Update – April 2024

The Federal Trade Commission on April 23, 2024 adopted a broad regulation that will void employer contracts, workplace policies, and compensation arrangements that prohibit, penalize, or in practice prevent a worker from working elsewhere (save for a few limited exceptions) when – and if – the ban goes into effect as scheduled in mid-August 2024. Please find Brach Eichler’s in-depth alert to this topic by clicking on this link. Please join us on May 9th for a live webinar to answer all your questions on this topic. Please click here to register!

On February 20, 2024, Disability Rights New Jersey, a federally funded advocacy group for people with disabilities, filed a lawsuit against the New Jersey Department of Health and Department of Human Services and the State of New Jersey. The lawsuit alleges that individuals confined in New Jersey psychiatric hospitals are subjected to abusive conditions (including violence and sexual abuse) and inappropriately prolonged involuntary confinement (even though they no longer meet the requirements for confinement) due to a lack of mental health resources in the community. Disability Rights New Jersey alleges that these conditions violate these individuals’ rights under the Fourteenth Amendment of the United States Constitution, the Americans with Disabilities Act, and Section 504 of the Rehabilitation Act. Relief requested by Disability Rights New Jersey include: the establishment of a stakeholder advisory group that includes individuals

On February 22, 2024, the United States Attorney’s Office for the District of New Jersey announced that a New Jersey physician and his practice have settled allegations that they upcoded services, billed for services beyond what is feasible in a single day, and billed for services that were never rendered, all violations of the False Claims Act.

The settlement addresses three sets of allegations spanning from January 1, 2017 to June 1, 2022:

1. The defendants purportedly upcoded certain Current Procedural Terminology (CPT) codes to bill for more complex and lengthier evaluation and management services than actually rendered.

2. The defendants submitted Medicare claims for services or procedures purportedly performed by the physician in a single day that exceeded the number of hours in a day.

3. The physician purportedly furnished services to Medicaid beneficiaries in New Jersey on days when he was not physically present in the United States.

The defendants have agreed to pay nearly $700,000 to settle these claims without any determination of liability.

On March 19, 2024, the United States Attorney’s Office for the District of New Jersey announced that an owner of a New Jersey counseling center admitted to fraudulently submitting numerous false claims to insurance carriers. The owner pleaded guilty to criminal charges and admitted that for years she submitted claims to private health insurance plans for counseling sessions that she never provided and submitted claims for patients when they had actually been out of the country, had terminated their relationship with the counseling center, or had never visited the counseling center. The owner faces a maximum penalty of 10 years in prison and a fine of up to $250,000 or two times the financial gain or loss resulting from the crime, whichever is greater.

CarePoint Health System, a nonprofit hospital system that operates three hospitals in Hudson County New Jersey, has confirmed that it is collaborating with Insight, a Michigan based for-profit health management organization, in order to help stabilize the struggling hospital system’s finances. However, CarePoint has not disclosed exactly what is the extent of the collaboration. Earlier this year, the New Jersey Department of Health (DOH) demanded that CarePoint must deliver a disaster plan based on the DOH’s assessment that the CarePoint hospitals were at risk of further deterioration and closure due to CarePoint’s financial problems, an assertion that CarePoint was quick to deny. Recently, CarePoint asked the State for an infusion of $130 Million in State funding in order to continue to provide critical care services. The State has already provided almost $10 Million in funding to CarePoint over the last several months in order to help

On April 1, 2024, the New Jersey Department of Health (NJDOH) proposed amendments to the licensing standards for Assisted Living Facilities/Residences and Comprehensive Personal Care Homes. The proposed amendments would establish a new procedure by which a facility could apply for “deemed status,” which would consist of the NJDOH’s acknowledgment of a facility’s compliance with licensure standards because the facility holds accreditation from a NJDOH-recognized accreditation organization. The proposal would replace the State’s previous Advanced Standing program, which ended last year, with a new “deemed status” program. Participation in the “deemed status” program would be voluntary and similar to the Advanced Standing Program, in which 150 of the 250 assisted living providers in New Jersey previously participated.

The “deemed status” program would establish a procedure for facilities to establish that a location is accredited by a third-party organization, such as the Joint Commission , and therefore would not have to undergo biennial inspections, although the NJDOH would continue to investigate complaints and conduct inspections prior to initial licensure. According to the NJDOH, the Joint Commission and other reputable agencies would bring a number of benefits to assisted living settings, including quality assurance, accreditation for meeting or exceeding industry-recognized standards, regulatory compliance, continuous improvement, consumer confidence, professional development and peer benchmarking.

• requiring physicians to provide patients with a written notice of their right to have an observer present during sensitive examinations and post the notice in a way that ensures that patients are aware of their rights;

• requiring physicians to make the notice available in English, Spanish, and any of the 10 or more other languages identified by the Director of the Division as the first language of a significant number of persons in the state;

• requiring physicians to confirm that patients have read and understood the notice before proceeding with a sensitive examination;

• removing any reference to “males” or “females” in establishing the right to an observer to afford all patients these rights, regardless of gender identity or expression;

• mandating that observers be health care professionals licensed by the BME or the Board of Nursing, or Certified Medical Assistants; and

• requiring physicians to complete two (2) continuing medical education credit hours in programs or topics related to sexual misconduct prevention.

All comments regarding the proposed rule are due by June 14, 2024.

On April 1, 2024, the United States Department of Health and Human Services (HHS) issued new guidance clarifying the obligation of hospitals to obtain a patient’s written consent prior to performing certain sensitive exams, such as pelvic, breast or prostate exams, particularly with respect to patients who are under anesthesia during the exam. The new guidance was issued as a result of public scrutiny regarding the practice of allowing practitioners or supervised medical, advanced practice providers or other healthcare students to perform sensitive examinations that are not related to the condition for which the patient is seeking treatment, such as breast, pelvic, prostate, and rectal examinations, for training and education purposes, including on patients who are under anesthesia. In its new guidance, HHS emphasizes that a hospital’s informed consent policy and process, and all informed consent forms, must ensure that patients are provided with sufficient information to allow them to make informed decisions regarding the full scale of care they are to receive. Hospitals that fail to adhere to the updated informed consent guidelines may be subject to investigations, fines and sanctions.

Recently, hospitals in New York and Florida filed complaints against affiliates of North American Partners in Anesthesia (NAPA) alleging that the anesthesia provider’s non-compete agreements were unenforceable. The claims made by the hospitals largely mirror the claims made in the summer of 2022 by RWJBarnabas Health against the NAPA affiliate in New Jersey.

Specifically, the hospitals allege that NAPA failed to properly staff their anesthesia departments and failed to share in the risk of excessive costs. Instead, NAPA simply demanded that the nonprofit hospitals continue to pay increased costs for diminishing services. In response, the hospitals attempted to negotiate a separation from the anesthesia provider. NAPA, in turn, demanded millions of dollars to waive underlying noncompete agreements. The hospitals took action and sued NAPA challenging the enforceability of NAPA’s noncompete agreements.

On March 19, 2024, a New York District Court denied NAPA’s application seeking temporary enforcement of the noncompete agreement during the pendency of the lawsuit. The Court found that NAPA failed to establish (1) that it would be irreparably harmed if the noncompete agreements were not enforced and (2) that NAPA had a likelihood of success on the merits. In its opinion, the Court noted that this is not a dispute between physicians; rather, this is a dispute between a hospital and an anesthesia management company. NAPA then made an application for the same relief on a permanent basis. The motion is set for argument before the Court on May 1, 2024.

These cases are significant, because they challenge the enforceability of noncompete agreements held by unlicensed management companies against licensed professionals.

On March 21, 2024, the Centers for Medicare and Medicaid Services (CMS) announced that Wegovy, a prescription weight loss medication developed by Novo Nordisk, would now be eligible for coverage under Medicare Part-D for the specific use of reducing the risk of death attributable to cardiovascular disease in overweight or obese individuals. Medicare currently is not permitted by law to cover drugs used solely for chronic weight management, although Medicare may cover a drug that is used for weight loss if it also receives U.S. Food and Drug Administration (FDA) approval for another medically accepted use, like treating cardiovascular disease.

CMS’ approval of coverage for Wegovy comes less than 2 weeks after the FDA announced that it would approve Wegovy for the preventative treatment of cardiovascular disease in those who are obese or overweight. The FDA’s approval was based on an international, multiyear study of 17,000 overweight or obese patients, with results showing that those individuals taking Wegovy had a 20% lower risk of an adverse cardiac event, such as heart attack or stroke, than those taking a placebo. Despite a current supply shortage, the demand for Wegovy has never been higher, even with the average current cost of the drug exceeding $1,000 per month. The continuous surge in demand can likely be attributed to America’s ongoing obesity crisis. According to the latest statistics, it is estimated that nearly half of all adults in the U.S. have some form of cardiovascular disease, while 73.1% of all U.S. adults are considered overweight or obese. Even with the “limited scope” of coverage approval by CMS, most private insurers have indicated a reluctance to follow suit.

Senate Bill 3011, introduced in the New Jersey Senate on April 8, 2024, would permit the Department of Labor and Workforce Development, with the Department of Health and Department of Human Services, to establish a multimedia campaign to attract candidates to health care professions. This campaign is in response to the shortages experienced during the Covid-19 pandemic. Marketing would be geared to increase recruitment from underrepresented racial groups and to increase recruitment for high-demand fields.

Senate Bill 3060, introduced in the New Jersey Senate on April 8, 2024, would require health, hospital, and medical service corporations, health maintenance organizations, and commercial payors to provide coverage for annual prostate screening without cost-sharing for men who are been the ages of 40-75. The proposed Bill expands the definition of “prostate cancer screening” to mean medically viable methods for detection and diagnosis of prostate cancer, including digital rectal exam, prostate- specific antigen test, and associated laboratory work.

Assembly Bill 4109, introduced in the New Jersey Assembly on April 4, 2024, would permit paramedics to administer vaccines during outbreaks of communicable diseases. A paramedic would be permitted to administer a vaccine to any patient, regardless of age, unless age restrictions are in place from the Advisory Committee on Immunization Practices. A vaccine would be administered pursuant to an individual prescription, a standing order, or an immunization program or other program sponsored by an authorized governmental agency that is not patient specific.

On April 22, 2024, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) announced a final rule, titled HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule). The rule will become effective 60 days after formal publication in the Federal Register, with a final compliance deadline of 240 days after publication, except for certain requirements that must be complied with by February 16, 2026. Please find Brach Eichler’s in-depth alert to this topic by clicking on this link.

On April 19, 2024, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) posted a new webpage containing frequently asked questions (FAQs) concerning HIPAA and the Change Healthcare cybersecurity incident. The FAQs, in part, address the fact that on March 13, 2024, the OCR published a “Dear Colleague Letter” advising that the OCR was aware of the Change Healthcare cybersecurity incident that occurred in late February 2024 “that is disrupting health care and billing information systems nationwide.”

Some of the FAQs covered include:

• Why did OCR issue the March 13, 2024, “Dear Colleague Letter”?

• Why is OCR initiating an investigation and what does it cover?
• Has OCR received breach reports from Change Healthcare, UHG, or any affected health care providers?
• Are covered entities that are affected by the cyberattack involving Change Healthcare and UHG required to file breach notifications?
• What HIPAA breach notification duties do covered entities have with respect to the Change Healthcare cyberattack?
• What HIPAA breach notification duties do business associates have with respect to the Change Healthcare cyberattack?

On April 22, 2024, UnitedHealth Group issued a press release announcing that:

“Based on initial targeted data sampling to date, the company has found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. To date, the company has not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.” Although UnitedHealth states that “Change Healthcare has made continued strong progress restoring services impacted by the event,” the far-reaching consequences of the event are still unfolding. The company set up a dedicated support website to provide support for people concerned about their personal data due to the attack, as well as a call center hotline number, 1-866-262-5342.

Dozens of class action lawsuits have been filed in different districts around the United States against Change Healthcare relating to the cyber attack announced by the company in late February 2024. On April 3, 2024, Change Healthcare filed a Motion seeking to consolidate the cases to its home town district, the United States District Court for the Middle District of Tennessee. While some of these class actions were filed by providers affected by the disruption to payments for medical services rendered, others were filed by individuals alleging the company did not have sufficient cybersecurity measures in place to prevent the data breach, allowing threat actors to potentially expose sensitive health and personal
information. The filing of additional lawsuits is likely as the facts continue to evolve.

On April 4, 2024, the U.S. Department of Homeland Security published a proposed rule to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CIRCIA requires any critical infrastructure company (a covered entity under the statute) to report to the Cybersecurity and Infrastructure Security Agency (CISA) within certain prescribed timeframes any substantial cyber incident (a covered event), ransom payment made in response to a ransomware attack, and any substantial new or different information discovered related to a previously submitted report.

CISA estimates that the proposed rule will apply to approximately 316,000 covered entities, whom are in one of 16 enumerated Critical Infrastructure sectors and either (i) do not qualify as a small business as defined by the Small Business Administration, or (ii) meet a sector-based criterion. According to CISA under the Healthcare and Public Health (HPH) Sector-Specific Plan, the “HPH Sector is large, diverse, and open, spanning both the public and private sectors. It includes publicly accessible healthcare facilities, research centers, suppliers, manufacturers, and other physical assets and vast, complex public-private information technology systems required for care delivery and to support the rapid, secure transmission and storage of large amounts of HPH data.”

CISA’s summary of the rule proposal may be found here and Critical Infrastructure Sector information may be found here.

On March 18. 2024, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) published updated guidance regarding the use of online tracking technologies by HIPAA covered entities and business associates. In short, “[r]egulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules. For example, disclosures of PHI to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures” under HIPAA.

On April 7, 2024, the U.S. Senate Committee on Commerce, Science, & Transportation issued a press release about the proposed American Privacy Rights Act. “This comprehensive draft legislation sets clear, national data privacy rights and protections for Americans, eliminates the existing patchwork of state comprehensive data privacy laws and establishes robust enforcement mechanisms to hold violators accountable, including a private right of action for individuals.” In short summary, the proposed law (i) establishes foundational

uniform national data privacy rights for Americans, (ii) gives Americans the ability to enforce their data rights, (iii) protects Americans’ civil rights, (iv) holds companies accountable and establishes strong data security obligations, and (v) focuses on the business of data, not Mainstreet business. Under the bill, covered data is “information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked or reasonably linkable to one or more individuals” residing in the US. Sensitive covered data includes, among other data, government identifiers. A covered entity under the bill is any entity that determines the purpose and means of collecting, processing, retaining, or transferring covered data and is subject to the FTC Act, including common carriers and certain nonprofits.

EDWARD HILZENRATH

What is an interesting trend in Healthcare Law?

The consolidation of the healthcare industry has continued in 2024. Payers, hospitals and private equity roll-ups of medical practices continue to look for acquisition targets and strategic partners. While consolidation can lead to efficiencies and increased profits, there is new scrutiny from the Federal and State governments on the impact of consolidation on health care consumers.

What achievement are you most proud of?

I am most proud of when clients call me for follow up work or recommend me to their colleagues. It is tremendously gratifying to know when work we have done is impactful and valued by our clients and that they want to continue working with us and have their colleagues work with us as well.

COLLEEN BUONTEMPO

What is an interesting trend in Healthcare Law?

Currently, in the PIP realm of healthcare law, the current trend is whether low-speed vehicle (i.e. e-bikes, motorized scooters) accident victims are entitled to PIP coverage. There is a pending New Jersey Supreme Court decision in Goyco v. Progressive Insurance Company that could change the course of insuring these types of vehicles and covering the injuries sustained while operating them.

What achievement are you most proud of?

Graduating college. Common to a lot of people, but I am the only one in my immediate family to achieve a Bachelor’s Degree. It inspired my pursuit of higher education.

On April 18, Healthcare Law Member Carol Grelecki moderated the 2024 Health Law Symposium. Sponsored by Brach Eichler and the Garden State Bar Association, the topics discussed included the impact of restrictive covenants, physician burnout, and healthcare transactions.

On April 1, Brach Eichler Managing Member and Healthcare Law Chair John D. Fanburg was quoted in an article for Modern Healthcare entitled “Change Healthcare breach already impacting healthcare M&A.”

On March 25, Brach Eichler LLC announced the selection of 21 of the firm’s attorneys for inclusion in the 2024 New Jersey “Super Lawyers” list. Congratulations to Healthcare law attorneys Shannon Carroll, Paul J. DeMartino, Jr., Lani M. Dornfeld, John D. Fanburg, Michael C. Foster, Joseph M. Gorrell, Carol Grelecki, and Cynthia J. Liba.