On June 13, 2024, the Justice Department announced arrests in what it called the nation’s first criminal case against digital health company executives over allegations that those executives caused illegal prescriptions for controlled substances to be ordered by way of telehealth visits.

While the Justice Department has previously brought charges in telehealth cases involving things like orthotic braces or genetic testing, a case against digital health executives involving telehealth-prescribed controlled substances is a first.

This post is the first in a series dedicated to Colorado’s Medicaid finance and payment systems, challenges faced by those programs, and opportunities for expansion.

The Colorado Healthcare Affordability and Sustainability Enterprise (CHASE) oversees Colorado’s hospital provider tax and the use of those taxes to support Medicaid supplemental payments. CHASE uses the largest portion of those taxes to generate payments targeting the cost shortfalls from treating Medicaid and uninsured patients. Broadly speaking, federal regulations (see 42 C.F.R. §§ 447.272, 447.321) allow each class of institutional providers to be paid for Medicaid services (on a fee-for-service basis) to a level that approximates what could have been paid under Medicare payment principles. This is known as the Upper Payment Limit (UPL). For the past several years, CHASE has limited these payments to less than the full amount permitted by federal law out of concerns about potential overpayments and statewide recoupment risks. The Colorado Hospital Association (CHA) is currently advocating for CHASE to increase payments to 100% of the UPL—i.e. “the full UPL.”

What Are the Changes?

On April 26, 2024, the U.S. Department of Health and Human Services (“HHS”) issued a final rule (the “Final Rule”) along with guidance updating the Health Insurance Portability and Accountability Act (“HIPAA”) regulations at 45 C.F.R. Parts 160 and 164 (the “Privacy Rule”). The Final Rule prohibits the use or disclosure of protected health information (“PHI”) for the purpose of (1) conducting criminal, civil, or administrative investigations into, or (2) imposing criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that is legal when provided. The Final Rule also prohibits the use or disclosure of PHI in order to (3) identify any person for any of those purposes (the “Prohibition”).[1]

On May 16, 2024, the California Office of Health Care Affordability (“OHCA”) released proposed emergency regulations to update its existing rules for the reporting of certain health care transactions to OHCA for consideration of whether a Cost and Market Impact Review (“CMIR”) is warranted under the California Health Care Quality and Affordability Act. The current CMIR regulations became effective January 1, 2024, for transactions with a proposed closing date on or after April 1, 2024.

On April 29, 2024, the Food and Drug Administration (FDA) announced a Final Rule amending regulations to make explicit that in vitro diagnostic products (IVDs) are devices under the Federal Food, Drug, and Cosmetic Act including when the manufacturer of the IVD is a laboratory. Under the new rule, the FDA will phase out its laboratory developed test (LDT) enforcement discretion policy over a four-year period. The phaseout policy “applies to IVDs that are manufactured and offered as LDTs by laboratories that are certified under CLIA[1] and that meet the regulatory requirements under CLIA to perform high complexity testing, and used within such laboratories, even if those IVDs do not fall within FDA’s traditional understanding of an LDT because they are not designed, manufactured, and used within a single laboratory.”

Capitol American Flag

Section 1557 of the Affordable Care Act prohibits discrimination in healthcare based on a number of characteristics including race, color, national origin, sex, age, and disability. On April 26, 2024, the Department of Health and Human Services (HHS) issued a Final Rule that according to HHS provides clarity on Section 1557 with a goal of ensuring nondiscriminatory access to care for all, including women, people with disabilities, LGBTQI+ people, people with limited English proficiency (LEP), people of color, and people regardless of age. The first Section 1557 final rule was published in 2016 followed by a second final rule in 2020 that rescinded large sections of the 2016 rule. The 2024 Final Rule restores those provisions and enhances them.

On February 8, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) finalized long-awaited modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2, which requires individuals or entities that receive federal funding and provide SUD treatment to implement additional privacy protections and obtain specific consent before using and disclosing SUD treatment records (see 42 C.F.R. § 2.11).

While Monty Hall (or for the current generation, Wayne Brady) was nowhere in sight, it was difficult not to think about the show “Let’s Make a Deal” while sitting in the audience at the American Bar Association’s 39th National Institute on White Collar Crime. During the Institute, one of the featured speakers, Deputy Attorney General Lisa Monaco, announced a new DOJ-led whistleblower rewards program.

“Incident to” billing is widely practiced, and its regulations are generally well-known. But one Arizona physician recently found himself pleading guilty in federal court on April 3, 2024, to a criminal healthcare fraud charge over improperly billing Medicare and private payors for healthcare services that failed to abide by the rules over “incident to” billing. This blog post explores how this lack of compliance resulted in such a serious criminal consequence.