General Medical Practice Law News & Developments

In April, the FDA released its “Medical Device Safety Action Plan,” a short to mid-term vision for increasing the safety of medical devices.  In it, the FDA acknowledges that enhancements and changes in its approach to device safety are necessary to ensure that it is “vigilant” in keeping up with the developments in the complexity and number of medical devices.

Key to the FDA’s new approach is focusing on the “Total Product Life Cycle (TPLC)” of each type of medical device, so that safety issues are not left unaddressed following a device’s approval by the FDA.  In this effort, the FDA will emphasize timely communication and resolution of new safety issues and help to advance innovations in technology that result in safer and more effective devices.

How will this impact physicians?

Medical devicesThe Plan sets forth certain action items that the FDA will be addressing over the next few years.  Each of these items could impact physicians who use medical devices in treating patients.  Some of these matters (such as additional training for physicians) will likely require new regulations.  Others may require only funds from Congress.  Highlights include:

  1. The FDA is considering a new regulatory approach to issuing additional safety requirements for devices with newly-discovered or increased safety risks. Instead of working on a one-off basis with individual manufacturers to address safety concerns, the FDA would like to issue regulations to address new safety matters.  These regulations (called “special controls”) could require manufacturers to conduct additional training for physicians who implant the devices.

 

  1. The FDA would like to facilitate the approval of devices that appear safer than devices that are currently on the market, so that government is less of a barrier to the entry of safer devices into the market.

 

  1. The FDA would like to focus on improving the safety of medical devices implanted in women, generally, as there have been many issues with these types of devices over the years.

 

  1. The FDA would like to expand its support for a public-private system called NEST (National Evaluation System for Health Technology), which is designed to monitor insurance claims, electronic health records and other data for early signs of device problems. The project will cost $250 million over 5 years, and device manufacturers are slated to contribute $30 million to the effort.

 

  1. The FDA would like to require cybersecurity features for electronic devices, such as pacemakers and defibrillators. In response to the growing awareness of the security risks of medical devices that connect to the Internet (and, therefore, become part of the “Internet of Things”), the FDA recognized the need for a long-term focus on pre-market and post-market actions to continually address cybersecurity threats.  Expect a CyberMed Safety Analysis Board to be formed to not only evaluate cybersecurity risks of electronic devices, but serve as a “go-team” deployed into the “field” by the FDA to investigate suspected compromises to electronic device security.

More details on the Plan can be accessed on the FDA website.  Stay tuned to the Fox Rothschild Physician Law Blog for updates on how the FDA’s implementation of the Plan could impact physicians.

The transportation landscape in America has evolved and these developments are now impacting health care. With about 75 percent of the U.S. population living in a county with access to an on-demand ride-hailing service, many patients are turning to ride-share services, like Uber and Lyft, as a means to obtain their medical care.

The idea of partnering ride-sharing and health care is not new. Over the past few years, ride-sharing companies have been edging their way into the health care realm. Both Uber and Lyft have been testing pilot programs involving nonemergency medical transportation (NEMT) and other non-traditional health care transportation models with major providers, institutions, insurers, and transportation brokers nationwide. Until recently, most of these programs have been limited in scope to specific health care facilities, by service (e.g., concierge services that ferry flu shots to people, or enabling users to request a doctor to provide on-demand diabetes and thyroid tests) and by patient population (e.g., Medicare Advantage, Medicaid, and limited commercial payors).

Recognizing the need for accessible and cost-efficient health care transportation is not unique to Uber and Lyft. A number of revolutionary NEMT companies have emerged in various markets to supplement traditional health care transportation options and the “Big Two” ride-share companies have partnered with many of these outside vendors to enhance an established and (presumably) compliant service offering in specific markets. Certain NEMT companies, like Veyo, American Medical Response, and Circulation, have made their own name in the NEMT space. Interestingly, both Uber (in 2016) and Lyft (in 2017) announced partnerships with Circulation, utilizing Circulation’s customizable NEMT platform to integrate with each ride-sharing companies’ application program interfaces (API) and connecting with the interfaces of the health care systems’ they service.

With these numerous initiatives, it was unsurprising this year when the Big Two made their entrance into the entire health care market official. By expanding beyond outsourced NEMT ridesharing services to predetermined health care facilities, both Uber and Lyft have launched their own platforms to allow all health care providers to schedule rides for their patients.

In March, Uber introduced and launched “Uber Health,” a distinct application from the traditional Uber app, which provides a digital portal allowing health care organizations to book rides for a patient or caregiver who need help getting to and from medical appointments. Through Uber Health, unlike traditional NEMT services (where government and certain commercial payors may reimburse the transportation company for the rides), Uber bills the health care providers who sign up for Uber health monthly based on the cost of their patients’ rides, which are on par with standard Uber rates at the time of the ride booking.

On the other hand, in 2016 Lyft first introduced a service called “Concierge,” which similarly allows health care providers to set up rides for patients to get to appointments; however, also in March of this year, Allscripts and Lyft announced their partnership to incorporate the Concierge patient transportation interface directly into Allscripts Sunrise EHR so that when a patient’s transportation needs are noted in his or her medical record, a Lyft is automatically scheduled for that patient. Similar to Uber Health, under Lyft’s Concierge service, the providers pay for the rides.

This shift in health care transportation was inevitable and providers are now able to leverage the convenience of these ubiquitous apps to ensure better experience and care for their patients; however, caution should be taken to ensure that these patient rideshares are done in a legally compliant way.

Primarily, these ride-share services raise concerns under fraud and abuse regulations. Because health care providers coordinate patient transportation through the applications, providers need to be careful about offering free or discounted rides to patients which could trigger the federal anti-kickback law. Providers who treat state and federal program beneficiaries will need to ensure that the method of delivery adheres (or as closely as possible) to the Office of Inspector General’s (OIG) safe harbor regulations applicable to free or discounted local transportation. As outlined in a prior post on this Blog, in 2016 the OIG announced a safe harbor that protects a health care provider or other eligible entity (i.e., any individual or entity, except those who primarily supply health care items) from Anti-Kickback Statute (AKS) and Civil Monetary Penalty (CMP) penalties if it provides free or discounted local transportation to Medicare patients and other federal health care program beneficiaries, so long as all of a number of conditions are met. These conditions require, among other things, that there be a written policy in place which restricts how transportation services are used and advertised, and that the transportation be available only to “established patients.” Therefore, if a health care provider attempts to advertise the availability of free rides as an inducement to grow its patient base, it could quickly find themselves paying fines, including treble damages.

Additionally, many states have their own kickback prohibitions, potentially placing limitations or restrictions on the utilization of ride-share platforms for professional services. If no government beneficiaries are seen by a provider, the provider can ultimately decide whether to pay for the service or pass some or all of the cost on to their patients. Therefore, a state-by-state analysis should be performed to assess appropriate practices prior to offering ride-share services to patients. These payment and kickback concerns will continue to develop as private insurers assess reimbursement eligibility for ride share services.

One population that has been left out of the trend to partner ride-sharing with providers are those in wheelchairs or who need transportation accommodations due to a disability. Uber, was recently sued by a San Francisco-based advocacy group for not providing wheelchair-accessible transportation, and the company is now piloting such vehicles in several cities. To the extent a health care practice is “participating” in a ride-share platform, any acts of non-compliance by the ride-share company, depending on the terms of the arrangement (or lack thereof), could potentially flow to the provider, as the ride-share companies, acknowledging their status as Business Associates, are ultimately performing the services on behalf of the provider.

This Business Associate recognition prompts the overarching patient privacy concerns inherent in the ride-sharing services. Since ride-sharing companies (and their drivers) will have access to individually identifiable and/or protected health information, providers must have appropriate Business Associate Agreements (BAAs) in place to comply with the Health Insurance Portability and Accountability Act (HIPAA). Both Uber and Lyft have touted their proactive and preemptive compliance with HIPAA and publicized engagements of third-party HIPAA compliance companies to ensure development, implementation, and customization of the necessary safeguards for data security in the distinct APIs for their new platforms.

Uber asserts that Uber Health drivers won’t know which of their passengers are using Uber Health. Like a typical Uber ride, only a passenger’s name, pickup and drop-off addresses will be given to the Uber Health driver and Uber drivers are not able to opt into or out of the health service the same way that they can with Uber Eats, an affiliated food delivery service. Therefore, on a trip to a hospital or medical practice, a driver won’t know whether a rider is traveling to the health care facility using the traditional Uber app—to commute to work, for example—or is meeting a doctor through the health care platform.

The logic (or belief) is that although the ride-share companies are Business Associates, the companies’ drivers are not given any medical information and are not even informed that a ride is under the health care platform; therefore, the drivers are not Business Associates (or “subcontractors” under HIPAA). This concept has seemingly satisfied the outsourced risk and compliance assessments; however, the government has yet to opine as to whether individually identifiable health information (not just “medical information”) is truly kept private under HIPAA’s somewhat ambiguous standard of requiring only a “reasonable basis to believe the information can be used to identify the individual.”[42 CFR 160.103 (Individually identifiable health information)]

Additionally, to address obligations under the Health Information Technology for Economic and Clinical Health (HITECH) Act, Uber is storing data from Uber Health in separate servers, meaning that only select Uber employees and the health care providers have access to patient data. Furthermore, Uber is housing everything itself and is not sharing Uber Health data with anyone downstream in its supply chain, thereby eliminating obligations to manage the transfer of data or implementing third-party vendor risk management programs. Accordingly, a breach in Uber’s servers presumably should not compromise Uber Health’s data.

Despite these safeguards and demonstrated HIPAA-compliance, risks still remain (e.g., potential data breaches). Not that long ago, Uber was hit by a cyberattack exposing the personal information of 57 million riders and drivers, and the company’s delayed public notification of the incident was disconcerting to many. Providers, as Covered Entities, participating in these ride-share platforms risk potential imposition of stiff penalties for data breaches, increasing the importance of entering into a well-drafted BAA with the ride-share company.

Uber has stated they are “pleased to sign BAAs with all participating healthcare organizations” and the Uber Health’s Dashboard Terms and Conditions provide that the “Terms shall automatically terminate upon the termination of the Business Associate Agreement that the parties separately entered into…” This acknowledgement is the first step, but it is unclear as to whether Uber has their own form BAA or will accept a provider’s form/terms for each individual relationship.

The incorporation of ride-sharing transportation into the delivery of health care services can provide benefits to both providers and their patients; however, the array of health care regulatory issues should be evaluated and assessed before signing up for such programs. If you or your practice have any questions or are interested in offering a patient ride-share program, please contact Michael Bassett at mbassett@foxrothschild.com or 215.444.7191, or any member of Fox Rothschild’s Health Law Group.

 

Last month, Apple issued a long awaited announcement of their move into the medical records field, by debuting new functions in the updated Health app for the iOS 11.3 beta, allowing users to view and aggregate their medical records on their iPhones.

The new “Health Records” features within the Health app brings together hospitals, clinics and the existing Health app to make it easy for consumers to see their available medical data from multiple providers whenever they choose. Now, consumers will have medical information from various institutions organized into one view covering allergies, conditions, immunizations, lab results, medications, procedures and vitals, and will receive notifications when their data is updated. The Health Records data is encrypted and protected with the user’s iPhone passcode.

To launch the beta version that features the new “Health Records” section, Apple partnered with 12 major health systems[1] and leading EHR vendors Cerner and Epic, using Fast Healthcare Interoperability Resources (FHIR) to facilitate the transfer of medical records. In the coming months, more medical facilities will connect to Health Records offering their patients access to this feature.

The goal is for consumers to have their medical information from various institutions organized into one view covering allergies, conditions, immunizations, lab results, medications, procedures and vitals. It all works when a user opens the iPhone’s health app, navigates to the Health Record section, and, on the new tool, adds a health provider. From there, the user is connected to Apple’s software system to obtain their records and even incorporate new data. Patients will also receive notifications when new information is added to their record.

Regulators and patient advocates have for years pushed for data-sharing standards within the medical sector to make it easier for records to flow between hospitals and doctors’ offices. The lack of interoperability has led to inefficiencies in care and frustrations from both providers and consumers. This move by Apple could effectively pressure EHR vendors to open up access to patients’ digital records and truly force EHR vendors to provide access to their data through open application programming interfaces (API) as mandated by the 21st Century Cures Act.

 

[1] The following participating hospitals and clinics are among the first to make this beta feature available to their patients:

  1. Johns Hopkins Medicine – Baltimore, Maryland
  2. Cedars-Sinai – Los Angeles, California
  3. Penn Medicine – Philadelphia, Pennsylvania
  4. Geisinger Health System – Danville, Pennsylvania
  5. UC San Diego Health – San Diego, California
  6. UNC Health Care – Chapel Hill, North Carolina
  7. Rush University Medical Center – Chicago, Illinois
  8. Dignity Health – Arizona, California and Nevada
  9. Ochsner Health System – Jefferson Parish, Louisiana
  10. MedStar Health – Washington, D.C., Maryland and Virginia
  11. OhioHealth – Columbus, Ohio
  12. Cerner Healthe Clinic – Kansas City, Missouri

Earlier this month, Attorney General Jeff Sessions issued a Memorandum rescinding the Obama Administration’s “hands off” policy with respect to the prosecution of licensed cannabis distribution in states where medical or recreational marijuana are legalized.  Our sister blog, “In the Weeds” has covered the issuance of this new Memorandum extensively, including how it may affect state medical marijuana programs around the country.

Medical marijuana in jar lying on prescription form
Copyright: megaflopp / 123RF Stock Photo

So far, U.S. Attorneys in many of the states that have legalized medical marijuana (including Pennsylvania) have made public statements to the effect that they are not interested in prosecuting violations of federal law with respect to cannabis, especially if the activity involved is in compliance with state law.

  • For more information on the Sessions Memorandum, please see this post.
  • For more information on the responses to the Memorandum from U.S. Attorneys (including the U.S. Attorney for Pennsylvania’s Middle District), please see this post.
  • For Pennsylvania physicians, it appears that the medical marijuana program continues to be on track for implementation on April 1, 2018.  Pennsylvania Gov. Wolf issued a statement in response to the Sessions Memorandum confirming that he would seek legal action against the federal government to the extent that the federal government interferes with Pennsylvania’s medical marijuana program.  [See Governor Wolf’s statement].

Stay tuned to Fox Rothschild’s Physician Law Blog for updates on how the Sessions Memorandum will affect state medical marijuana programs.