Around the Web

If passed as is, the Senate's current healthcare reform bill will put physician-owned hospitals on the endangered species list. Under the bill, physician-owned hospitals must meet a list of five "allowable growth criteria" if they want to continue receiving Medicare and Medicaid funding.

That doesn't sound horribly unreasonable until you learn that not one existing physician-owned hospital will be able to meet those criteria, says Molly Sandvig, Esq., executive director of Physician Hospitals of America (PHA), a Sioux Falls, SD-based advocacy group for the physician-owned hospital industry.

Some lawmakers are eager to put the kibosh on physician-owned hospitals because of a debate that has been raging in the field since physician-owned hospitals started cropping up in the 1990s. Opponents, including the American Hospital Association, believe that physician-owned hospitals enable physicians to perform unnecessary procedures so they can pocket more profit, says Terry Woodbeck, CEO of physician-owned Tulsa Spine & Specialty Hospitals.

Naysayers also fear that physicians with an ownership interest in a hospital will refuse to refer patients to other hospitals, even if doing so is in the best interest of patients.

Woodbeck disagrees with these arguments.

"Physicians live on physician referrals. If you get the reputation that you are a cutter, your referrals are going to dry up quickly and you are going to be nailed with a number of malpractice suits for doing unnecessary surgeries," he says.

Woodbeck adds that physician-owned hospitals provide some of the highest quality patient care in the country, and are a venue in which physicians and hospital administrators can align their financial interests to reduce the cost of care.

Regardless of the political motivations behind imposing growth restrictions on physician-owned hospitals, they will have a serious impact. Physician-owned hospitals that do not meet the five criteria would not be permitted to add beds and services to meet their communities' needs.

"If you can't grow and meet market demand, you become stagnant. You either sell your hospital, thus dissolving the physician-ownership model, or you go bankrupt," Sandvig explains.

In addition, if the bill passes as is, the percentage of physicians who have an ownership stake in any particular hospital will be chiseled in stone. For example, if 49% of a hospital is owned by physicians, the hospital would not be allowed to increase that number as of the date of the bill's passage.

Physician-owned hospitals that are currently under development will be grandfathered in if they are Medicare certified by August 1, 2010, but about 75 hospitals currently under development won't make the cut, says Sandvig. "These hospitals have steel in the ground, they are financed, and they have construction workers on site. There are over 25,000 construction and healthcare jobs that could be lost."

If physician-owned hospitals want to no longer receive funding from Medicare and Medicaid, they could grow unrestricted. However, that's not a feasible option for many physician-owned hospitals for whom Medicare and Medicaid constitute up to 40% of the bottom line.

"We don't want to be forced to pick our patients," says Sandvig. "The government is penalizing Medicare and Medicaid recipients at a time when hospitals are trying to figure out how to create greater access to quality care."

Another consequence of imposing growth limitations on physician-owned hospitals is that if they drop their Medicare and Medicaid coverage in favor of freedom to expand, they may be perceived by the public—particularly recipients of Medicare and Medicaid—as exclusive hospitals that are unwilling to greet patients who don't have bulging wallets. "It makes the physicians guilty of something that is imposed by the government," Sandvig says.

PHA is lobbying aggressively to convince lawmakers to amend the current bill and considering legal challenge, says Sandvig. "I'm not certain we will go forward with that at this point, but it is not out of the question."

---

Liz Jones is an associate editor at HCPro, Inc. She writes Medical Staff Briefing, Hospitalist Leadership Advisor, and co-writes Credentialing and Peer Review Legal Insider. She can be reached at ejones@hcpro.com.

As you likely know, the American Recovery and Reinvestment Act of 2009 significantly changed provisions in the HIPAA Privacy and Security Regulations, broadening their applicability and creating new provisions that place new requirements on those covered by the rules, such as physicians. These laws had not undergone revision since they were enacted years ago.

For years, physicians have had to ensure that appropriate agreements were in place with their business associates, which includes anyone who provides legal, accounting, consulting, financial, quality assurance, or billing services, among others. These agreements have a great amount of standard language and require the business associate to secure the physician's protected health information and use and disclose it only as appropriate.

Prior to the stimulus package, the HIPAA rules did not directly apply to business associates, as they were only subject to the contract provisions mentioned above. Regulatory authorities could not enforce the provisions against or sanction a business associate. The stimulus package changed this by:

• Extending many provisions of the HIPAA rules to business associates
• Expanding civil and criminal penalties for violation of the applicable rules to business associates
• Requiring periodic compliance audits of business associates by the United States Department of Health and Human Services.

The stimulus package also created the first comprehensive security breach notification requirements for the unauthorized acquisition, access, use, or disclosure of protected health information, where the breach compromises security or privacy. These new rules require notification to patients and the HHS Secretary in the event of a breach. Depending on the number of individuals impacted, other notifications may be required.

In addition, penalties will be increased up to a maximum of $1.5 million depending on certain factors. Some groups have criticized those that enforce the rules for the limited number of enforcement actions taken. The new law gives state attorneys general the authority to bring suit in federal district court against any person violating the rules on behalf of state residents to stop further violation or to obtain damages on behalf of such residents. The court will be allowed to award attorneys fees to the state in such actions.

Physicians should now take certain steps with respect to the compliance of its business associates, including:

• Business Associate Agreements should be amended to ensure that the business associate is specifically required to comply with relevant provisions.
• Business Associate Agreements should now contain language which requires the business associate to inform the physician within a certain period of time (the shorter the better for the physician) of a breach.

Among other provisions that physicians may want to consider with their attorney for inclusion are:

• Requiring business associates to maintain sanctions against agents and subcontractors that violate the terms of the Business Associate Agreement.
• Allowing the physician to inspect and request information of the business associate to ensure compliance.
• Stating that the business associate has no ownership rights over the protected health information.
• Allowing the physician to terminate the agreement if the business associate is named as a defendant in a criminal proceeding for a violation of the rules or a finding or stipulation that business associate has violated the rules has been entered in an administrative or civil proceeding.
• Provisions allowing for injunctive relief (the prevention of further breaches).
• Indemnification provisions.
• Provisions requiring business associate to make it and those associated with it available to physician as needed in the event of litigation or administrative proceedings being commenced related to the rules.
• Language stating that the agreement is not meant to allow a non-party to the agreement the opportunity to sue the parties.

It is important to note that physicians are not required to monitor or oversee the ways that their business associates carry out privacy safeguards or the extent to which the business associate abides by the Business Associate Agreement.

Physicians are not responsible or liable for the actions of their business associates. However, if a physician finds out about a material breach or violation of the contract by the business associate, he or she must take certain steps required by the rules and the agreement.

Given the increased expected enforcement, the now greater penalties and the increasing interest of patients in privacy rights, it is important that physicians appropriately amend Business Associate Agreements. This will give physicians a sense of whether his or her business associates are ready and willing to agree to the new provisions. In addition, if physicians have any concerns about the policies or practices of a business associate, the physician should make efforts to obtain further information and terminate the contract if warranted.

In this climate, it is important that physicians both update and reinvigorate their own HIPAA compliance plan and ensure business associates do the same.

---

Melissa M. Zambri is a partner in the law firm Hiscock & Barclay, LLP in its Albany, NY office. She is a member of the firm's Health Care and Human Services Practice Area and is the Chair of the New York State Bar Association's Health Law Section Committee on Fraud, Abuse and Compliance.

---

For information on how you can contribute to HealthLeaders Media online, please read our Editorial Guidelines.