1. 3 rd ANNUAL VENDOR ADVISORY COUNCILSeptember 2012 exploring the future of vendor credentialing HEALTHCARE REFORM AND ITS IMPACT ON HOSPITALS AND VENDORS PRESENTED BY:Michele Madison, Healthcare Partner, Morris, Manning and Martin, LLP

2. OVERVIEW »Health Care Reform legislation enacted March 23, 2010; amended March 26, 2010 »Innovation Initiatives »Business Associates »Health Care Reform »Current Status

3. SUPREME COURT »Challenged by 26 States and 4 Individuals »Hearings held March 26-29 th »Decision on June 28, 2012 »Upheld Healthcare Reform (although part of Medicaid expansion provision deemed unconstitutional)

4. ANTI-INJUNCTION ACT Reconstruction-era statute bars courts from considering the constitutionality of tax laws until payments are due. It will apply here if the court deems the individual mandate’s penalty provision a “tax.”

5. INDIVIDUAL MANDATE This provision of the health law requires people not covered by group plans to buy government-approved health insurance by 2014 or pay a penalty.

6. INDIVIDUAL MANDATE STAYS…AS A TAX. The chief justice ruled the Supreme Court could uphold the law accepting that the PPACA’s “penalty” for adults who fail to purchase health insurance is essentially a tax in sheep’s clothing. It’s a tax to incentivize people — much like the cigarette tax aims to get people to quit smoking. In the case of the PPACA’s tax, it’s meant to encourage individuals not covered by Medicaid or Medicare to purchase insurance.

7. MEDICAID EXPANSION A provision requiring states to extend Medicaid coverage to people with incomes up to 133 percent of the federal poverty level in order for the states to keep their federal matching Medicaid funds. Some states say this will compel them to spend too much on their share of the match.

8. MEDICAID EXPANSION Seven of the Supreme Court justices found the Medicaid expansion unconstitutional because the penalty for states failing to expand was overreaching. The PPACA originally imposed a penalty that would have taken away all Medicaid payments from states that didn’t expand.

9. 9 INNOVATIVE INITIATIVES

10. ACCOUNTABLE CARE ORGANIZATIONS SECTION ONE

11. SHARED SAVINGS PROGRAM 11 »Accountable Care Organizations –New Legal Entity –Minimum of 5,000 lives –Primary Care Involvement »Medical Home for the Patient

12. BASIC REQUIREMENTS 12 1.Accountable for the quality, cost, and the overall care of the Medicare fee-for-service (FFS) beneficiaries assigned to it. 2.Enter into an agreement with the Secretary to participate in the program for not less than a 3-year period. 3.Formal legal structure that would allow the organization to receive and distribute payments for shared savings to participating providers of services and suppliers. 4.Include primary care professionals that are sufficient for the number of Medicare FFS beneficiaries assigned to the ACO (at least 5,000 beneficiaries).

13. BASIC REQUIREMENTS 13 5.Provide the Secretary with such information regarding ACO professionals participating in the ACO as the Secretary determines necessary to support the assignment of Medicare fee-for-service beneficiaries to an ACO, the implementation of quality and other reporting requirements, and the determination of payments for shared savings. 6.Maintain leadership and management structure that includes clinical and administrative systems. 7.Define processes to promote evidence-based medicine and patient engagement.

14. BASIC REQUIREMENTS 14 8.Report on quality and cost measures, and coordinate care, such as through the use of telehealth, remote patient monitoring, and other such enabling technologies. 9.Demonstrate to the Secretary that the ACO meets patient- centeredness criteria specified by the Secretary, such as the use of patient and caregiver assessments or the use of individualized care plans.

15. ACO MODELS 15 »Pioneer ACO Demonstration Project »April 1, 2012 – 60 ACO Programs

16. CENTERS FOR MEDICARE AND MEDICAID INNOVATION SECTION TWO

17. CMI 17 »The CMI will be the major focal point for the identification of problem areas in health care delivery and identification and testing of new models to improve program performance. »To design, implement and evaluate Medicare and Medicaid demonstrations and pilot programs to test the feasibility, cost effectiveness and quality outcomes of new health care delivery models. Creation of Centers for Medicare and Medicaid Innovation (CMI)

18. CMI 18 »To promote research and demonstration transparency by disseminating findings to inform law makers and interested parties about health care delivery issues, new innovative concepts, and demonstrations and pilot programs »Evaluative findings to develop new objectives for basic research and new research demonstrations »Has the authority to extend and expand the operation of successful models

19. Episode of care as the acute care hospital stay only (Model 1) The acute care hospital stay plus post-acute care associated with the stay (Model 2), Just the post- acute care, beginning with the initiation of post- acute care services after discharge from an acute inpatient stay (Model 3). Just the post- acute care, beginning with the initiation of post- acute care services after discharge from an acute inpatient stay (Model 3). 124 BUNDLED PAYMENTS 19 3 A single, prospective bundled payment that would encompass all services furnished during an inpatient stay by the hospital, physicians and other practitioners.

20. PARTNERSHIP FOR PATIENTS »A new public-private partnership that will help improve the quality, safety and affordability of health care for all Americans. »The Partnership for Patients has the potential to save up to $35 billion in U.S. health care costs, including up to $10 billion for Medicare »$500 million in funds to test different models for improving patient care and patient engagement to reduce hospital-acquired conditions and improve care transitions

21. PARTNERSHIP FOR PATIENTS 21 »Keep patients from getting injured or sicker. By the end of 2013, preventable hospital-acquired conditions would decrease by 40% compared to 2010. »Help patients heal without complication. By the end of 2013, preventable complications during a transition from one care setting to another would be decreased so that all hospital readmissions would be reduced by 20% compared to 2010.

22. OTHER MODELS 22 Independence at home demonstration program Applicants February 6, 2012 Hospital readmissions reduction program October 1, 2012 Community-Based Care Transitions Program Currently in effect Extension of gainsharing demonstration

23. MEDICAID 23 »Pediatric Accountable Care Organization Demonstration Project »Demonstration project to evaluate integrated care around a hospitalization »Global Payment System Demonstration Project »Medicaid emergency psychiatric demonstration project

24. PAYMENT MODELS »Linking payment to quality »Enhanced quality reporting for physicians and hospitals »Be ready for HIPAA 5010 enforcement –Delayed 3 months »ICD-10 delayed one year

25. BUSINESS ASSOCIATES SECTION THREE

26. EXPANDED BUSINESS ASSOCIATES Each organization “that provides data transmission of Protected Health Information to such entity or its Business Associate and that requires access on a routine basis to such Protected Health Information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing, Gateway, or each vendor that contracts with a Covered Entity to allow that Covered Entity to offer a personal health record to patients as part of its electronic health record and it is required to enter into a Business Associate Agreement.”

27. BUSINESS ASSOCIATES 27 »Must comply with certain HIPAA security standards –Administrative safeguards –Technical safeguards –Physical safeguards »As a matter of law, must comply with privacy duties established by BA contract, including new duties established by HITECH »Covered entities will need to incorporate HITECH provisions into BA contracts HHS will issue annual guidance on these and other HIPAA security standards

28. » Business Associates are now directly subject to specific requirements » Penalties directly apply to Business Associates » Increased penalties » Enhanced enforcement activities INCREASED ENFORCEMENT 28

29. PRIVACY PROVISIONS AND PENALTIES TO BA »Proposed that Business Associate is responsible for subcontractors »Proposed Rule expands definition of Business Associate »Direct enforcement

30. ENFORCEMENT ACTIVITIES SECTION FOUR

31. CRIMINAL PENALTIES »Covered Entities should be aware of the additional penalties and the enforcement activities: –Enhanced Criminal Penalties –Willful neglect standard

32. PENALTY TIERED INCREASE 32 MINIMAL LEVELS OF PENALTIES BASED ON INTENT: $100 - $25,000Person did not know and would not have known $1,000 - $100,000Reasonable cause and not willful neglect $10,000 - $250,000Willful neglect $50,000 -$1,500,000Willful neglect and not corrected

33. STATE ATTORNEY GENERAL »Permits civil actions on behalf of patients –May enjoin the actions; and –Obtain damages not to exceed $25,000 annually »Attorneys fees may be recovered by State »Each State Attorney General has been Trained on HIPAA

34. FUTURE ENFORCEMENT TOOLS »Additional funding for Enforcement Activities »In 3 years, the “individual harmed” may receive a percentage of the CMP collected from the offense

35. AUDIT PROGRAM »Federal Government granted two contracts related to auditing and enforcement –Booze Allen –KPMG

36. AUDIT PROGRAM »November – December 2011 –Pilot Program 150 audits –20 initial audits –Covered entities initially »Program will expand to business associates

37. OCR ENFORCEMENT RESULTS »HHS / OCR has investigated and resolved over 15,176 cases by requiring changes in privacy practices and other corrective actions by the covered entities »7,894 cases, OCR found no violation had occurred

38. OCR ENFORCEMENT ACTIVITIES »514 complaints alleging a violation of the Security Rule. »323 complaints closed after investigation and appropriate corrective action. »As of December 31, 2011, OCR had 266 open complaints and compliance reviews.

39. HITECH PENALTIES »$4.3 Million Fine Cignet »$1.0 Million Fine Mass General »$865,500 Fine UCLA

40. NOTIFICATION SECTION FIVE

41. SECURITY AND NOTICE REQUIREMENTS »Security provisions of HIPAA now apply to a Business Associate of a Covered Entity in the same manner that such sections apply to the Covered Entity. »Business associates subject to same penalties as Covered Entities »Also applies to vendors of personal health records

42. SECURITY AND NOTICE REQUIREMENTS Unsecured Protected Health Information means: (Section 13402(h)) Protected health information that is not secured through the use of a technology or methodology specified by the Secretary in the guidance issued under this section.

43. SECURITY AND NOTICE REQUIREMENTS »Obligation to notify triggers upon discovery of a breach –Discovery determined to be the first day on which such breach is known or should reasonably have been known to such entity or associate to have occurred –Knowledge by any person that is an employee, officer or other agent of the entity or associate

44. SECURITY AND NOTICE REQUIREMENTS »Notice to individual must include: –Identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed during such breach –Brief description of what happened, including the date of the breach and the date of discovery of the breach –Description of the types of unsecured protected health information that were involved

45. SECURITY AND NOTICE REQUIREMENTS »Steps the individual should take to protect themselves from potential harm resulting from the breach »Description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches »Contact procedures for individuals to ask question or learn additional information

46. SECURITY AND NOTICE REQUIREMENTS NOTICE PROCESS 46 »Notice Timing: –Notice must be made without unreasonable delay and in no case later than 60 calendar days after discovery of a breach –Delay allowed if a law enforcement official determines that a notification, notice or posting would impede a criminal investigation or cause damage to national security »Methods of Notice: –Written notification by first class mail to individual –Substitute notice process for insufficient or out-of-date contact information »Media notice information for 500 individuals or more

47. “SAFE HARBOR” 47 »Safe Harbor from Notification Requirement is to ensure the data is maintained in a “secure” manner. »June 2009 – Requested comments on the proposed form of “secure” data. –Encryption –De-Identification

48. This presentation is provided as a general informational service to clients and friends of Morris, Manning & Martin LLP. It should not be construed as, and does not constitute, legal advice on any specific matter, nor does this message create an attorney-client relationship. These materials may be considered Attorney Advertising in some states. Please note, prior results discussed in the material do not guarantee similar outcomes. HEALTHCARE PRACTICE Michele Madison | 404.504.7621 mmadison@mmlaw.com 48 questions