On-Site Medical Clinic Guidelines

Transcription

1 On-Site Medical Clinic Guidelines Amy Gordon, Partner Daniel Gottlieb, Partner Dale Van Demark, Partner July 24, Boston Brussels Chicago Düsseldorf Frankfurt Houston London Los Angeles Miami Milan Munich New York Orange County Paris Rome Seoul Silicon Valley Washington, D.C. Strategic alliance with MWE China Law Offices (Shanghai) 2013 McDermott Will & Emery. The following legal entities are collectively referred to as McDermott Will & Emery, McDermott" or the Firm : McDermott Will & Emery LLP, McDermott Will & Emery AARPI, McDermott Will & Emery Belgium LLP, McDermott Will & Emery Rechtsanwälte Steuerberater LLP, McDermott Will & Emery Studio Legale Associato and McDermott Will & Emery UK LLP. These entities coordinate their activities through service agreements. McDermott has a strategic alliance with MWE China Law Offices, a separate law firm. This communication may be considered attorney advertising. Prior results do not guarantee a similar outcome.

2 On-Site Medical Clinic Guidelines Privacy Issues Legal and Regulatory Issues Structure Issues and Best Practices 2 2

3 Different Levels of Service Different compliance concerns apply depending on the services provided by the on-site clinic On-site clinics that are limited to providing first aid and treating minor illness and injury at the workplace will be exempt from some of the federal laws discussed On-site clinics that participate only in the employer s plan may avoid some federal regulations Trend towards greater medical services being offered on-site 3

4 HIPAA Standards Health Insurance Portability and Accountability Act of 1996, Health Information Technology for Economic and Clinical Health Act and their implementing regulations ( HIPAA ) establish standards for Electronic transactions (i.e., data exchanges) between health care providers and health plans that are covered entities Protecting the privacy of protected health information (PHI) in oral, paper and electronic form Protecting the security of PHI in electronic media (EPHI) Notification of breaches of unsecured PHI 4

5 Does HIPAA apply to on-site medical clinics? A clinic must comply with HIPAA standards applicable to covered entity health care providers if the clinic engages in any of the HIPAA-standardized electronic transactions (i.e., information exchanges), which include: Health Care Claims or Equivalent Encounter Information Eligibility for a Health Plan Referral Certification and Authorization Health Care Claim Status Enrollment and Disenrollment in a Health Plan Health Care Payment and Remittance Advice Health Plan Premium Payments Coordination of Benefits 5

6 Does HIPAA apply? (cont d) Electronic claims for reimbursement (on electronic equivalent to CMS 1500 claim form) to the employer s employee health benefit plan or any other health plan makes clinic subject to HIPAA Workers compensation claims to a WC carrier are not HIPAA-standardized transactions that would cause a clinic to be subject to HIPAA Cash, check or credit card transactions with employees or their dependents are not HIPAA-standardized transactions 6

7 HIPAA Privacy Standards The HIPAA privacy standards Generally permit a clinic to use and disclose PHI for treatment, billing, clinic operations and certain other enumerated exceptions to the general rule of non-disclosure Require minimum necessary request, use and disclosure of PHI for non-treatment purposes Establish certain patient rights, including to access PHI in clinic records, request amendments to clinic records and obtain a list of disclosures that are not for treatment, billing or operations purposes and receive a Notice of Privacy Practices Require a clinic to enter into a written agreement containing mandated business associate agreement provisions with a vendor that provides services to the clinic involving PHI 7

8 Exceptions to Confidentiality under HIPAA Employment records are not PHI, including preemployment physicals and other health-related HR records HIPAA permits clinic to make disclosures required by state workers compensation laws HIPAA permits clinic to disclose certain PHI relating to medical surveillance of the workplace or evaluation of whether an employee has a work-related illness or injury for employer s OSHA compliance purposes Note that workers compensation carriers are not covered entities, but clinic s disclosures to carrier are subject to HIPAA if clinic is a covered entity 8

9 HIPAA Security Standards HIPAA security standards require a clinic to implement reasonable and appropriate technical, physical and administrative safeguards to assure the confidentiality, availability and integrity of electronic PHI (EPHI) The safeguards must be based on a comprehensive security risk analysis of the threats, risks and vulnerability to the security of EPHI EPHI may be maintained in an electronic health record system, a billing system or other electronic record systems utilized by the clinic 9

10 State Privacy and Security Laws State Privacy and Security Laws State privacy, and security laws may apply to the clinic and its health care professionals even if they not subject to HIPAA State laws relating to the privacy and security of health information may be more stringent than HIPAA, including extra protections for mental health information, HIV/AIDS test results, genetic test results or other categories of sensitive information Many states have laws requiring special handling of Social Security Numbers (SSN) State security breach notification laws require notification of a breach of a SSN, driver s license number and certain other personal information that may not be health information 10

11 Next Steps HIPAA Covered Entities Security risk assessment Security Policies Privacy policies Minimum necessary protocols Firewalls between clinic and employer McDermott can help We have available a security risk self-assessment tool for use by IT professionals and legal counsel Template privacy policies Template security policies 11

12 Privacy Issues Federal Laws (other than HIPAA) Impacting Confidentiality of Employee Medical Records An on-site clinic must keep its medical records confidential from the employer An employer is prohibited by the Americans with Disabilities Act from using such information in making decisions regarding hiring, promotion or termination De-identified disclosures are fine 12

13 Regulatory Concerns Genetic Information Nondiscrimination Act of 2008 (GINA) Limits disclosure of a person s genetic information, including family medical history, and prohibits discrimination based on genetic information in any aspect of employment, including hiring, promotions, terminations, and salary 13

14 Regulatory Concerns Employee Retirement Income Security Act of 1974 ( ERISA ) ERISA exempts certain on-site clinics from the definition of an employee welfare benefit plan To qualify for this exemption, the treatment must be limited to minor injuries or illness or the rendering of first aid in the case of accidents occurring during working days There is no definition in ERISA as to what constitutes the treatment of minor injuries or illness for purposes of this exemption On-Site Clinics providing check ups, primary care services, screenings, diagnostic services and wellness exams, is likely subject to ERISA 14

15 Regulatory Concerns ERISA Structural Concerns Can make the on-site clinic a stand alone welfare benefit plan Need separate plan document, SPD and Form 5500 filing Can include the on-site clinic under an existing medical plan Allows combined medical plan document, SPD and Form 5500 filing 15

16 Regulatory Concerns Consolidated Omnibus Budget Reconciliation Act of 1985 ( COBRA ) Federal law that permits continuation of group health plan coverage based on a qualifying event If stand alone welfare benefit plan, separate COBRA rights If part of the medical plan, COBRA rights combined with the medical plan 16

17 Regulatory Concerns Internal Revenue Code ( Code ) Employer-paid medical expenses for services provided by the on-site clinic are generally not taxable to employees under Code Section 213(d) An employer is permitted to deduct the cost of an on-site clinic as a business expense under Code Section 162 Services that do not qualify as medical care are taxable to employees and subject to withholding 17

18 Regulatory Concerns Federal and State Health Regulatory Issues On-site clinics are likely be subject to a variety of state and local laws and regulations that govern specific aspects of the clinics operations e.g., laboratory services, disposal of biomedical waste, and potentially the dispensing (as opposed to administering) of pharmaceuticals and medical devices 18

19 Regulatory Concerns State Corporate Practice of Medicine Many states have laws prohibiting a corporation from providing health care services (including through employed physicians) State laws govern a physician s practice of medicine and/or splitting professional fees with non-licensed individuals or entities State laws impact the credentialing, oversight and supervision requirements for mid-level providers, which may impact the onsite clinic s staffing models e.g., Doctor to NP / PA ratios. Corporate practice laws may also govern how the on-site clinic may be held-out to employees e.g., a number of states require medical clinics affiliated with lay corporations to have a separate entrances, signage, etc. 19

20 Regulatory Concerns If the employer is also a manufacturer of pharmaceuticals certain government price reporting obligations apply Need to coordinate with employees responsible for drug price reporting to ensure compliance 20

21 Regulatory Concerns Federal and State Fraud and Abuse Laws On-site clinic may be subject to fraud and abuse laws Anti-Kickback Statute makes it a felony for any person to knowingly and willfully offer, pay, solicit or receive any remuneration, in cash or in kind, in exchange for (i) referring an individual to a person for the furnishing or arranging of any item or service for which payment may be made under a federal health care program; or (ii) furnishing or arranging for any item or service for which payment may be made under a federal healthcare program All-Payer state laws and regulations 21

22 Structure Issues and Best Practices Employerowned and managed Full-service vendor Contracted Services Scope of services Competence Patient Population Start-up Operations Termination 22

23 Structure Issues and Best Practices 23

24 Structure Issues and Best Practices Employee Engagement The Clinic is treated as a network provider in the employer s medical plan s network of health care providers Need for adequate incentives to support utilization Employer, vendor, plan and clinic relationships structured to support specific employer goals (e.g., cost reduction - short and long-term and improved quality of care) 24

25 Structure Issues and Best Practices Medical Malpractice Must conduct thorough due diligence of the qualifications and backgrounds of potential providers employed by the on-site clinic If an employee or family member is injured through a misdiagnosis or inappropriate treatment, there is a high probability that the employer will be named in any lawsuit In addition to conducting thorough due diligence of potential providers, it is critical to have strong contractual protections (e.g., indemnification) and appropriate insurance coverage for all parties e.g., Employer as an additional insured 25

26 Structure Issues and Best Practices Fraud and Abuse Fraud and abuse issues are implicated at every stage start-up, operations and wind-down Many employers lack healthcare fraud and abuse compliance experience Vendor value-add (?) Compliance training for employer Experienced advisors 26

27 Structure Issues and Best Practices Business Terms Term and termination provisions need to take into consideration key performance goals as well as the practical requirements associated with replacing services Patient-provider relationship can be critical for success for employer goals; vendors may be asked to ensure consistency in staffing Utilization is critical for employer, provider and vendor success if you build it they may not come. Everyone must participate in the clinic marketing 27

28 Structure Issues and Best Practices Business Terms Depending on the structure and staffing of the on-site clinic, it may be important to build in a non-solicitation provision Prevent the Friendly PC and/or the vendor from soliciting clinic staff, including mid-level providers e.g., NPs and PAs for a period of time following the termination of the agreement with such vendor and/or Friendly PC 28

29 Structure Issues and Best Practices May want to include a non-competition provision that prohibits the vendor and/or Friendly PC from competing with the on-site clinic after the termination of the agreement 29

30 Structure Issues and Best Practices Vendor and Provider Conflicts The vendor or provider may provide other health products and services Utilization of these additional services and products may be part of the value of working with the vendor or provider Careful review of employer goals and vendor/provider resources is recommended 30

31 Questions 31