The Office of Civil RIghts (“OCR”) recently announced that Phase 2 of the HIPAA audits would be further delayed because the audit portals and project management tools that are needed to initiate the audit process are not ready and available for usage. Phase 2 of the HIPAA audits was initially slated to begin in the fall of 2014 and was subsequently moved to late 2014 or early 2015. Currently, no timeline has been provided as to when the next round of audits will officially begin.
A delay in Phase 2 of the OCR HIPAA Audits does not mean that covered entities and business associates should not continue to make sure they are in compliance with all HIPAA regulations. The potential consequences for failure to comply with HIPAA regulations are significant. While the audit portals are still under development, it is a good time for covered entities to (i) make sure their HIPAA policies and procedures are up to date and meet the latest privacy and security requirements, (ii) create a list of all business associates that provide services to the covered entity, and (iii) conduct an internal risk assessment to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.
Among other things, Parker Poe’s healthcare attorneys advise our healthcare clients about (i) compliance with HIPAA’s privacy requirements as they affect healthcare information, including preparing employee and patient notices, plan policies and procedures, plan amendments and authorization and other forms, and (ii) HIPAA compliance requirements for business associates.
Here is a common scenario: A behavioral healthcare provider has committed substantial resources into developing specialized behavioral healthcare services in the counties managed by a Managed Care Organization (“MCO”) under the Medicaid Waiver Program. The provider has a contract with the MCO to provide these services and has a good quality track record. Unexpectedly, the provider receives a letter from the MCO stating that the provider’s contract is being terminated – either because the provider’s contact is ending by its terms or because the MCO has decided to terminate the provider’s contract with 30 or 60 days’ notice. Question: Does the provider shut down its operations and transition its consumers, or does the provider have other options?
The simple answer: There are other options. Although some MCOs in North Carolina believe that the concept of a “closed network” allows them to eliminate providers when they choose to do so, there are many cases in which providers have successfully challenged those MCOs’ decisions.
Under North Carolina’s Medicaid laws, providers that receive adverse determinations from the Department’s contractors, including MCOs, have the right to a contested case hearing under the Administrative Procedure Act. N.C. Gen. Stat. § 108C-12. The venue for these hearings is the Office of Administrative Hearings (“OAH”). Administrative Law Judges (“ALJs”) with OAH have presided over dozens of cases by providers challenging adverse decisions of MCOs. Adverse determinations made by MCOs can be reversed when those determinations violate law, are erroneous, arbitrary and capricious, or failed to use proper procedure. N.C. Gen. Stat. § 150B-23(a). Some MCOs are completely ignoring the specific procedures that must be followed under State and federal law and regulations before deciding to eliminate a provider from their networks.
In numerous appeals to OAH that have been filed by providers, MCOs have argued unsuccessfully that the provisions in their contracts with providers or the law allowing them to operating “closed networks” permits them to terminate providers with no appeal rights. In one of those cases in which attorneys at Parker Poe represented the provider, the ALJ reversed the decision terminating the provider and the MCO appealed to Superior Court on the issue of whether the provider had the right to challenge the MCO’s decision. The Superior Court recognized the provider’s right to challenge the MCO’s decision. Yelverton’s Enrichment Services, Inc. v. PBH, 13 CVS 11337 (March 11, 2014).
In the Yelverton’s case, the Honorable Donald W. Stephens, Senior Resident Superior Court Judge in Wake County, concluded that contract provisions cannot override or negate the protections provided under North Carolina law, specifically the appeal rights set forth in North Carolina’s Medicaid law. In cases brought by providers since Judge Stephens’ decision, Administrative Law Judges have cited and relied upon that decision and have concluded that providers have the right to challenge an MCO’s decision to terminate or not renew a provider’s contract, notwithstanding the language in the provider’s contract.