The transportation landscape in America has evolved and these developments are now impacting health care. With about 75 percent of the U.S. population living in a county with access to an on-demand ride-hailing service, many patients are turning to ride-share services, like Uber and Lyft, as a means to obtain their medical care.

The idea of partnering ride-sharing and health care is not new. Over the past few years, ride-sharing companies have been edging their way into the health care realm. Both Uber and Lyft have been testing pilot programs involving nonemergency medical transportation (NEMT) and other non-traditional health care transportation models with major providers, institutions, insurers, and transportation brokers nationwide. Until recently, most of these programs have been limited in scope to specific health care facilities, by service (e.g., concierge services that ferry flu shots to people, or enabling users to request a doctor to provide on-demand diabetes and thyroid tests) and by patient population (e.g., Medicare Advantage, Medicaid, and limited commercial payors).

Recognizing the need for accessible and cost-efficient health care transportation is not unique to Uber and Lyft. A number of revolutionary NEMT companies have emerged in various markets to supplement traditional health care transportation options and the “Big Two” ride-share companies have partnered with many of these outside vendors to enhance an established and (presumably) compliant service offering in specific markets. Certain NEMT companies, like Veyo, American Medical Response, and Circulation, have made their own name in the NEMT space. Interestingly, both Uber (in 2016) and Lyft (in 2017) announced partnerships with Circulation, utilizing Circulation’s customizable NEMT platform to integrate with each ride-sharing companies’ application program interfaces (API) and connecting with the interfaces of the health care systems’ they service.

With these numerous initiatives, it was unsurprising this year when the Big Two made their entrance into the entire health care market official. By expanding beyond outsourced NEMT ridesharing services to predetermined health care facilities, both Uber and Lyft have launched their own platforms to allow all health care providers to schedule rides for their patients.

In March, Uber introduced and launched “Uber Health,” a distinct application from the traditional Uber app, which provides a digital portal allowing health care organizations to book rides for a patient or caregiver who need help getting to and from medical appointments. Through Uber Health, unlike traditional NEMT services (where government and certain commercial payors may reimburse the transportation company for the rides), Uber bills the health care providers who sign up for Uber health monthly based on the cost of their patients’ rides, which are on par with standard Uber rates at the time of the ride booking.

On the other hand, in 2016 Lyft first introduced a service called “Concierge,” which similarly allows health care providers to set up rides for patients to get to appointments; however, also in March of this year, Allscripts and Lyft announced their partnership to incorporate the Concierge patient transportation interface directly into Allscripts Sunrise EHR so that when a patient’s transportation needs are noted in his or her medical record, a Lyft is automatically scheduled for that patient. Similar to Uber Health, under Lyft’s Concierge service, the providers pay for the rides.

This shift in health care transportation was inevitable and providers are now able to leverage the convenience of these ubiquitous apps to ensure better experience and care for their patients; however, caution should be taken to ensure that these patient rideshares are done in a legally compliant way.

Primarily, these ride-share services raise concerns under fraud and abuse regulations. Because health care providers coordinate patient transportation through the applications, providers need to be careful about offering free or discounted rides to patients which could trigger the federal anti-kickback law. Providers who treat state and federal program beneficiaries will need to ensure that the method of delivery adheres (or as closely as possible) to the Office of Inspector General’s (OIG) safe harbor regulations applicable to free or discounted local transportation. As outlined in a prior post on this Blog, in 2016 the OIG announced a safe harbor that protects a health care provider or other eligible entity (i.e., any individual or entity, except those who primarily supply health care items) from Anti-Kickback Statute (AKS) and Civil Monetary Penalty (CMP) penalties if it provides free or discounted local transportation to Medicare patients and other federal health care program beneficiaries, so long as all of a number of conditions are met. These conditions require, among other things, that there be a written policy in place which restricts how transportation services are used and advertised, and that the transportation be available only to “established patients.” Therefore, if a health care provider attempts to advertise the availability of free rides as an inducement to grow its patient base, it could quickly find themselves paying fines, including treble damages.

Additionally, many states have their own kickback prohibitions, potentially placing limitations or restrictions on the utilization of ride-share platforms for professional services. If no government beneficiaries are seen by a provider, the provider can ultimately decide whether to pay for the service or pass some or all of the cost on to their patients. Therefore, a state-by-state analysis should be performed to assess appropriate practices prior to offering ride-share services to patients. These payment and kickback concerns will continue to develop as private insurers assess reimbursement eligibility for ride share services.

One population that has been left out of the trend to partner ride-sharing with providers are those in wheelchairs or who need transportation accommodations due to a disability. Uber, was recently sued by a San Francisco-based advocacy group for not providing wheelchair-accessible transportation, and the company is now piloting such vehicles in several cities. To the extent a health care practice is “participating” in a ride-share platform, any acts of non-compliance by the ride-share company, depending on the terms of the arrangement (or lack thereof), could potentially flow to the provider, as the ride-share companies, acknowledging their status as Business Associates, are ultimately performing the services on behalf of the provider.

This Business Associate recognition prompts the overarching patient privacy concerns inherent in the ride-sharing services. Since ride-sharing companies (and their drivers) will have access to individually identifiable and/or protected health information, providers must have appropriate Business Associate Agreements (BAAs) in place to comply with the Health Insurance Portability and Accountability Act (HIPAA). Both Uber and Lyft have touted their proactive and preemptive compliance with HIPAA and publicized engagements of third-party HIPAA compliance companies to ensure development, implementation, and customization of the necessary safeguards for data security in the distinct APIs for their new platforms.

Uber asserts that Uber Health drivers won’t know which of their passengers are using Uber Health. Like a typical Uber ride, only a passenger’s name, pickup and drop-off addresses will be given to the Uber Health driver and Uber drivers are not able to opt into or out of the health service the same way that they can with Uber Eats, an affiliated food delivery service. Therefore, on a trip to a hospital or medical practice, a driver won’t know whether a rider is traveling to the health care facility using the traditional Uber app—to commute to work, for example—or is meeting a doctor through the health care platform.

The logic (or belief) is that although the ride-share companies are Business Associates, the companies’ drivers are not given any medical information and are not even informed that a ride is under the health care platform; therefore, the drivers are not Business Associates (or “subcontractors” under HIPAA). This concept has seemingly satisfied the outsourced risk and compliance assessments; however, the government has yet to opine as to whether individually identifiable health information (not just “medical information”) is truly kept private under HIPAA’s somewhat ambiguous standard of requiring only a “reasonable basis to believe the information can be used to identify the individual.”[42 CFR 160.103 (Individually identifiable health information)]

Additionally, to address obligations under the Health Information Technology for Economic and Clinical Health (HITECH) Act, Uber is storing data from Uber Health in separate servers, meaning that only select Uber employees and the health care providers have access to patient data. Furthermore, Uber is housing everything itself and is not sharing Uber Health data with anyone downstream in its supply chain, thereby eliminating obligations to manage the transfer of data or implementing third-party vendor risk management programs. Accordingly, a breach in Uber’s servers presumably should not compromise Uber Health’s data.

Despite these safeguards and demonstrated HIPAA-compliance, risks still remain (e.g., potential data breaches). Not that long ago, Uber was hit by a cyberattack exposing the personal information of 57 million riders and drivers, and the company’s delayed public notification of the incident was disconcerting to many. Providers, as Covered Entities, participating in these ride-share platforms risk potential imposition of stiff penalties for data breaches, increasing the importance of entering into a well-drafted BAA with the ride-share company.

Uber has stated they are “pleased to sign BAAs with all participating healthcare organizations” and the Uber Health’s Dashboard Terms and Conditions provide that the “Terms shall automatically terminate upon the termination of the Business Associate Agreement that the parties separately entered into…” This acknowledgement is the first step, but it is unclear as to whether Uber has their own form BAA or will accept a provider’s form/terms for each individual relationship.

The incorporation of ride-sharing transportation into the delivery of health care services can provide benefits to both providers and their patients; however, the array of health care regulatory issues should be evaluated and assessed before signing up for such programs. If you or your practice have any questions or are interested in offering a patient ride-share program, please contact Michael Bassett at mbassett@foxrothschild.com or 215.444.7191, or any member of Fox Rothschild’s Health Law Group.

 

Kristen Marotta writes:

Recently on Fox’s HIPAA & Health Information Technology blog, we discussed the privacy and security issues arising from the growth of telemedicine, as well as the general benefits that such growth could have for recent medical graduates. Now, with more funding and attention being given to telemedicine, new physicians will have the opportunity to make a difference in rural health care and move the industry into an entirely new direction.

The New York City skyline, including the Empire State BuildingIn New York, recent funding has been made available through the New York Office of Mental Health (OMH) to expand the use of telemedicine in the treatment of mental health patients. This new funding stream for “telepsychiatry” provides a new avenue for the practice of psychiatry in New York and provides a unique consideration for New York physicians considering the practice of psychiatry for their long-term career.

Psychiatrists or physicians considering the practice of psychiatry should familiarize themselves with the OMH’s regulations on telepsychiatry services set forth in Title 14 of the New York Code, Rules and Regulations (NYCRR), including Part 596, which recently expanded the ability of physicians to practice telepsychiatry outside of outpatient clinic settings, including between OMH-licensed sites and provider sites enrolled in New York State Medicaid. A summary of the current regulations, as well as additional guidance on telepsychiatry in New York, can be found on the OMH website. In particular, we note a comprehensive checklist and guidance published by the OMH in early 2017 regarding provider responsibilities in practicing telepsychiatry.  We also note that privacy and security concerns are discussed in this checklist. Providers rendering telepsychiatry services must comply with all federal HIPAA laws and regulations, in addition to New York’s Mental Hygiene Law Section 33.13.

Due to the nature of telepsychiatry (or any type of telemedicine), it is important for providers to remember that there are two physical locations where protected health information of patients is potentially used and disclosed. For telepsychiatry in New York, the policies and procedures at the distant site must match those of the originating site exactly. In addition, both sites must meet “the minimum standards for privacy expected for patient-clinical interaction at a single Office of Mental Health licensed location.” [14 NYCRR 596.6(b)(2)(ii)]. For confidentiality purposes, when physicians practice telemedicine of any type, they should abide by the same rules as they would for written clinical medical records.

In addition to the highly technical components discussed in the OMH’s guidance, providers will also need to substantively update their policies and procedures. Two examples that providers should note are as follows. First, written protocols and procedures relating to telepsychiatry should be developed and followed. These policies and procedures should include a special provision for obtaining a patient’s informed consent before recording telepsychiatry sessions. Second, staff trainings must include the topic of telepsychiatry and technical training of telepsychiatry equipment. Staff will also need to be “immediately available” to attend to emergencies and other concerns during the patient’s actual telepsychiatry session. [14 NYCRR 596.6(b)(7)(iii).]

Stay tuned to Fox Rothschild’s Physician Law blog for updates on how developments in the practice of telemedicine in New York and other states affect physicians.


Kristen A. Marotta is an associate in the firm’s Health Law Department, based in its New York office.

On the firm’s HIPAA & Health Information Technology blog, associate Kristen Marotta discussed the privacy and security issues arising from the growing use of telemedicine, particularly for mental health treatment. Kristen examines the myriad considerations doctors should address in setting up a telemedicine model for their practices, and notes federal funding recently made available via New York State’s Office of Mental Health to expand the use of mental health-focused telemedicine in the state.

We invite you to read Kristen’s piece, and stay tuned for an upcoming post on this blog delving into New York’s regulations surrounding telepsychiatry.

Fox Rothschild’s HIPAA & Heath Information Technology Blog recently published two posts directly relevant to physicians and medical practices.  The first post, 5 Common HIPAA Mistakes to Avoid in 2018, addresses some typical misconceptions regarding disclosure of protected health information (PHI) and offers some ideas regarding how to avoid them.

The second post, New HIPAA Guidance on Disclosure of PHI related to Opioid Abuse and Mental Health, touches on the most recent HIPAA guidance released by the U.S. Department of Health and Human Services, Office of Civil Rights (OCR) regarding when and to whom PHI of patients suffering from addiction and mental illness may be shared.  Among other things, the guidance addresses disclosure of PHI to family members or friends of patients in situations where the patient is incapacitated or there is a serious or imminent threat to the patient’s health.  The guidance also addresses HIPAA’s rules on sharing PHI regarding a patient’s substance abuse or mental health with other treating physicians.

The OCR has published webpages on its website to make this guidance easily accessible and understandable to health care professionals and patients.

As always, if you have a specific question regarding your practice, please consult a knowledgeable attorney.