Boston Brussels Chicago Düsseldorf Frankfurt Houston London Los Angeles Miami Milan Munich New York Orange County Paris Rome Seoul Silicon Valley Washington, D.C.
Strategic alliance with MWE China Law Offices (Shanghai)
On-Site Medical Clinic GuidelinesAmy Gordon, PartnerDaniel Gottlieb, PartnerDale Van Demark, Partner
July 24, 2013
2
On-Site Medical Clinic Guidelines
▪ Privacy Issues ▪ Legal and Regulatory Issues▪ Structure Issues and Best Practices
2
3
Different Levels of Service
▪ Different compliance concerns apply depending on the services provided by the on-site clinic
▪ On-site clinics that are limited to providing first aid and treating minor illness and injury at the workplace will be exempt from some of the federal laws discussed
▪ On-site clinics that participate only in the employer’s plan may avoid some federal regulations
▪ Trend towards greater medical services being offered on-site
4
HIPAA Standards
▪ Health Insurance Portability and Accountability Act of 1996, Health Information Technology for Economic and Clinical Health Act and their implementing regulations (“HIPAA”) establish standards for– Electronic transactions (i.e., data exchanges) between health
care providers and health plans that are “covered entities”– Protecting the privacy of protected health information (PHI) in
oral, paper and electronic form– Protecting the security of PHI in electronic media (EPHI)– Notification of breaches of unsecured PHI
5
Does HIPAA apply to on-site medical clinics?
▪ A clinic must comply with HIPAA standards applicable to “covered entity” health care providers if the clinic engages in any of the HIPAA-standardized electronic transactions (i.e., information exchanges), which include:– Health Care Claims or Equivalent Encounter Information– Eligibility for a Health Plan– Referral Certification and Authorization– Health Care Claim Status– Enrollment and Disenrollment in a Health Plan– Health Care Payment and Remittance Advice– Health Plan Premium Payments– Coordination of Benefits
6
Does HIPAA apply? (cont’d)
▪ Electronic claims for reimbursement (on electronic equivalent to CMS 1500 claim form) to the employer’s employee health benefit plan or any other health plan makes clinic subject to HIPAA
▪ Workers compensation claims to a WC carrier are not HIPAA-standardized transactions that would cause a clinic to be subject to HIPAA
▪ Cash, check or credit card transactions with employees or their dependents are not HIPAA-standardized transactions
7
HIPAA Privacy Standards
▪ The HIPAA privacy standards – Generally permit a clinic to use and disclose PHI for treatment,
billing, clinic operations and certain other enumerated exceptions to the general rule of non-disclosure
– Require minimum necessary request, use and disclosure of PHI for non-treatment purposes
– Establish certain patient rights, including to access PHI in clinic records, request amendments to clinic records and obtain a list of disclosures that are not for treatment, billing or operations purposes and receive a Notice of Privacy Practices
– Require a clinic to enter into a written agreement containing mandated “business associate agreement” provisions with a vendor that provides services to the clinic involving PHI
8
Exceptions to Confidentiality under HIPAA
▪ Employment records are not PHI, including pre-employment physicals and other health-related HR records
▪ HIPAA permits clinic to make disclosures required by state workers compensation laws
▪ HIPAA permits clinic to disclose certain PHI relating to medical surveillance of the workplace or evaluation of whether an employee has a work-related illness or injury for employer’s OSHA compliance purposes
▪ Note that workers compensation carriers are not covered entities, but clinic’s disclosures to carrier are subject to HIPAA if clinic is a covered entity
9
HIPAA Security Standards
▪ HIPAA security standards require a clinic to implement reasonable and appropriate technical, physical and administrative safeguards to assure the confidentiality, availability and integrity of electronic PHI (EPHI)
▪ The safeguards must be based on a comprehensive security risk analysis of the threats, risks and vulnerability to the security of EPHI
▪ EPHI may be maintained in an electronic health record system, a billing system or other electronic record systems utilized by the clinic
10
State Privacy and Security Laws
▪ State Privacy and Security Laws – State privacy, and security laws may apply to the clinic and its
health care professionals even if they not subject to HIPAA– State laws relating to the privacy and security of health
information may be more stringent than HIPAA, including extra protections for mental health information, HIV/AIDS test results, genetic test results or other categories of sensitive information
– Many states have laws requiring special handling of Social Security Numbers (SSN)
– State security breach notification laws require notification of a breach of a SSN, driver’s license number and certain other personal information that may not be health information
▪ Federal Laws (other than HIPAA) Impacting Confidentiality of Employee Medical Records – An on-site clinic must keep its medical records confidential from
the employer– An employer is prohibited by the Americans with Disabilities Act
from using such information in making decisions regarding hiring, promotion or termination
– De-identified disclosures are fine
13
Regulatory Concerns
▪ Genetic Information Nondiscrimination Act of 2008 (GINA)─ Limits disclosure of a person’s genetic information, including
family medical history, and prohibits discrimination based on genetic information in any aspect of employment, including hiring, promotions, terminations, and salary
14
Regulatory Concerns
▪ Employee Retirement Income Security Act of 1974 (“ERISA”) – ERISA exempts certain on-site clinics from the definition of an
employee welfare benefit plan– To qualify for this exemption, the treatment must be limited to
minor injuries or illness or the rendering of first aid in the case of accidents occurring during working days
– There is no definition in ERISA as to what constitutes the treatment of minor injuries or illness for purposes of this exemption
– On-Site Clinics providing check ups, primary care services, screenings, diagnostic services and wellness exams, is likely subject to ERISA
15
Regulatory Concerns
▪ ERISA Structural Concerns– Can make the on-site clinic a stand alone welfare benefit plan
▪ Need separate plan document, SPD and Form 5500 filing
– Can include the on-site clinic under an existing medical plan▪ Allows combined medical plan document, SPD and Form 5500 filing
16
Regulatory Concerns
▪ Consolidated Omnibus Budget Reconciliation Act of 1985 (“COBRA”) – Federal law that permits continuation of group health plan
coverage based on a qualifying event– If stand alone welfare benefit plan, separate COBRA rights– If part of the medical plan, COBRA rights combined with the
medical plan
17
Regulatory Concerns
▪ Internal Revenue Code (“Code”)– Employer-paid medical expenses for services provided by the
on-site clinic are generally not taxable to employees under Code Section 213(d)
– An employer is permitted to deduct the cost of an on-site clinic as a business expense under Code Section 162
– Services that do not qualify as medical care are taxable to employees and subject to withholding
18
Regulatory Concerns
▪ Federal and State Health Regulatory Issues – On-site clinics are likely be subject to a variety of state and local
laws and regulations that govern specific aspects of the clinics operations▪ e.g., laboratory services, disposal of biomedical waste, and potentially
the dispensing (as opposed to administering) of pharmaceuticals and medical devices
19
Regulatory Concerns▪ State Corporate Practice of Medicine
– Many states have laws prohibiting a corporation from providing health care services (including through employed physicians)
– State laws govern a physician’s practice of medicine and/or splitting professional fees with non-licensed individuals or entities
– State laws impact the credentialing, oversight and supervision requirements for mid-level providers, which may impact the on-site clinic’s staffing models▪ e.g., Doctor to NP / PA ratios.
– Corporate practice laws may also govern how the on-site clinic may be held-out to employees▪ e.g., a number of states require medical clinics affiliated with lay
corporations to have a separate entrances, signage, etc.
20
Regulatory Concerns
▪ If the employer is also a manufacturer of pharmaceuticals certain government price reporting obligations apply
▪ Need to coordinate with employees responsible for drug price reporting to ensure compliance
21
Regulatory Concerns
▪ Federal and State Fraud and Abuse Laws – On-site clinic may be subject to fraud and abuse laws– Anti-Kickback Statute makes it a felony for any person to
knowingly and willfully offer, pay, solicit or receive any remuneration, in cash or in kind, in exchange for▪ (i) referring an individual to a person for the furnishing or arranging
of any item or service for which payment may be made under a federal health care program; or
▪ (ii) furnishing or arranging for any item or service for which payment may be made under a federal healthcare program
– “All-Payer” state laws and regulations
22
Structure Issues and Best Practices
• Employer-owned and managed
• Full-service vendor
• Contracted Services
• Scope of services
• Competence• Patient
Population
• Start-up• Operations• Termination
23
Structure Issues and Best Practices
24
Structure Issues and Best Practices
▪ Employee Engagement– The Clinic is treated as a network provider in the employer’s
medical plan’s network of health care providers▪ Need for adequate incentives to support utilization
– Employer, vendor, plan and clinic relationships structured to support specific employer goals (e.g., cost reduction - short and long-term and improved quality of care)
25
Structure Issues and Best Practices
▪ Medical Malpractice – Must conduct thorough due diligence of the qualifications
and backgrounds of potential providers employed by the on-site clinic
– If an employee or family member is injured through a misdiagnosis or inappropriate treatment, there is a high probability that the employer will be named in any lawsuit
– In addition to conducting thorough due diligence of potential providers, it is critical to have strong contractual protections (e.g., indemnification) and appropriate insurance coverage for all parties▪ e.g., Employer as an additional insured
26
Structure Issues and Best Practices
▪ Fraud and Abuse– Fraud and abuse issues are implicated at every stage –
start-up, operations and wind-down– Many employers lack healthcare fraud and abuse
compliance experience– Vendor value-add (?)– Compliance training for employer– Experienced advisors
27
Structure Issues and Best Practices
▪ Business Terms− Term and termination provisions need to take into
consideration key performance goals as well as the practical requirements associated with replacing services
− Patient-provider relationship can be critical for success for employer goals; vendors may be asked to ensure consistency in staffing
− Utilization is critical for employer, provider and vendor success – if you build it they may not come. Everyone must participate in the clinic “marketing”
28
Structure Issues and Best Practices
▪ Business Terms– Depending on the structure and staffing of the on-site
clinic, it may be important to build in a non-solicitation provision▪ Prevent the Friendly PC and/or the vendor from soliciting
clinic staff, including mid-level providers– e.g., NPs and PAs for a period of time following the termination of the
agreement with such vendor and/or Friendly PC
29
Structure Issues and Best Practices
▪ May want to include a non-competition provision that prohibits the vendor and/or Friendly PC from competing with the on-site clinic after the termination of the agreement
30
Structure Issues and Best Practices
▪ Vendor and Provider Conflicts– The vendor or provider may provide other health
products and services– Utilization of these additional services and products
may be part of the value of working with the vendor or provider
– Careful review of employer goals and vendor/provider resources is recommended
