June Washington, D.C. Update

Heading into the summer, Congress has remained focused on completing the national defense authorization bill, appropriations for Fiscal Year 2019 (FY 2019), and advancing legislation to address opioid abuse. Lawmakers are eager to demonstrate action prior to the upcoming midterm elections, prompting Senate Majority Leader Mitch McConnell (R-KY) to issue a statement canceling the majority of the Senate’s August recess. At the same time, the Trump Administration continues to generate major news on immigration, foreign policy, and trade, including the recent high-profile summit between President Trump and North Korea’s Kim Jong-un and new tariffs announced on China, the European Union, Canada, and Mexico. The Administration has also continued to promote its drug-pricing plan and recently released new widely anticipated regulations on association health plans.

In this month’s Washington, D.C. Update, we examine:

Please feel free to reach out for additional information on these topics or other issues of importance.

Sheila Burke
Chair, Government Relations and Public Policy
Baker Donelson

Senate Passes Defense Authorization Bill, Including Penalties on China’s ZTE and New Authority for CFIUS

On June 18, the U.S. Senate voted 85-10 to approve the annual National Defense Authorization Act (NDAA), authorizing a total of $716 billion in Fiscal Year 2019 (FY 2019) for national defense. The NDAA authorizes a base defense budget of $639 billion for the Department of Defense and national security programs at the Department of Energy. The NDAA also authorizes $69 billion for Overseas Contingency Operations. Next, a joint conference committee will meet to resolve differences between the House and Senate bills, a process House Armed Services Committee Chairman Mac Thornberry (R-TX) hopes to finish by the end of July. However, many observers do not expect final resolution until the end of the year.

Trump Administration Releases Regulations to Expand Association Health Plans

On June 19, the Department of Labor (DOL) released a final rule to expand access to association health plans (AHPs), which allow employers to form groups to collectively purchase health coverage for their employees. The new AHPs will not be subject to the full coverage or non-discrimination requirements under the Affordable Care Act (ACA), allowing these plans more flexibility on benefit designs and premiums. The Administration and Republican lawmakers argue that expanding AHPs will provide cheaper alternatives for small businesses and self-employed individuals that have struggled to find affordable options in the ACA’s insurance exchanges. However, Democrats, state regulators, and many health care stakeholders warn that expanding AHPs is likely to drive up premiums in the ACA’s insurance exchanges by siphoning off younger and healthier consumers.

Baker Donelson issued an overview of the new regulations on AHPs on June 20, available here.

The Congressional Budget Office estimates that the new regulations will result in approximately four million additional individuals enrolling in AHPs by 2023, including approximately 400,000 previously uninsured individuals. However, CBO also projects that due to the new regulations on AHPs and Short-Term Limited Duration Insurance Plans, average premiums will increase two to three percent in the ACA insurance exchanges.

House Passes First Appropriations Bills of the Cycle; Rescissions Package Passes House, Senate Prospects Unclear

On Friday, June 8, the House passed a roughly $147 billion three-bill FY 2019 spending package on a 235 to 179 vote, overcoming Democratic objections to environmental policy riders and funding priorities in the GOP-drafted Energy-Water title. The “minibus,” which also includes the Military Construction-VA and Legislative Branch measures, is the first of what House GOP leaders expect to be a series of three-bill packages to try to expedite passage of at least a few of the 12 annual spending bills before the end of the fiscal year on September 30. On final passage, 16 Republicans crossed the aisle to vote “no” on the package, but these votes were outweighed by 23 Democratic votes in favor of the minibus.

Opioids Focus in Congress: House Passes Dozens of Opioids Bills; Senate Finance and HELP Committees Advance Draft Legislation

Given broad interest in addressing opioid abuse and growing public pressure, both the House and Senate are considering a broad range of bills designed to address opioids, with lawmakers working to pass legislation during the summer to demonstrate action before the midterm elections.

The House passed 39 opioids-related bills last week, including incremental measures to reduce excess and unused prescription opioids in circulation, increase access to addiction treatment and alternative pain treatments, restrict imported fentanyl arriving through international mail, and expand coverage for telehealth treatment for substance use disorder. The House advanced most of the bills by a voice vote. On June 14, Ways and Means Committee Chairman Kevin Brady (R-TX) and Ranking Member Richard Neal (D-MA), and Energy and Commerce Committee Chairman Greg Walden (R-OR) and Ranking Member Frank Pallone Jr. (D-NJ) introduced H.R. 6, the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment (SUPPORT) for Patients and Communities Act. House Leadership intends for H.R. 6 to serve as the underlying vehicle for the majority of House-passed bills on opioids. The House has continued voting on dozens of additional proposals this week and aims to wrap up the focus on opioids legislation, including voting on H.R. 6, by the end of the week.

Azar Targets Drug Rebates and Medicare Part B for Drug Pricing Policy Changes

Health and Human Services (HHS) Secretary Alex Azar has continued to promote and expand on the Trump Administration’s new Drug Pricing Blueprint through media appearances and congressional testimonies over the past several weeks.

In a Senate Health, Education, Labor and Pensions (HELP) Committee hearing on June 12, Azar called particular attention to the idea of eliminating drug rebates to pharmacy benefit managers (PBMs) and encouraging a pricing system “where PBMs and drug companies just negotiate fixed-price contracts.” Under the current system, drug manufacturers set initial list prices and PBMs negotiate discounts or rebates down from those list prices. Azar contended that eliminating drug rebates and using fixed-price discounts would better incentivize companies to set lower list prices. Azar believes HHS has the regulatory authority to eliminate rebates in Medicare Part D. Replacing the drug rebate system with a fixed-price contract system may have major implications for the drug industry. There is uncertainty regarding the details of how a fixed-price contract system would operate and whether the Trump Administration could implement such a change without Congress.

Trade Tensions Escalate After Trump Administration Imposes Steel and Aluminum Tariffs on Allies and Technology Tariffs on China

On Thursday, May 31, President Trump announced he would impose tariffs on imported steel and aluminum from the European Union, Canada, and Mexico, triggering immediate retaliation from U.S. allies and protests from American businesses and farmers. The tariffs – 25 percent on steel and 10 percent on aluminum – took effect at midnight that night, marking a major escalation of the tension between the United States and its top trading partners. Stung by the U.S. action, the allies quickly hit back. The E.U. stated it would impose import taxes on politically sensitive items like bourbon from Senate Majority Leader Mitch McConnell’s home state of Kentucky. Mexico said it would levy tariffs on American farm products, while Canada zeroed in on the same metals that Trump had targeted.

Department of Justice’s Stance on Legal Challenge to ACA Reignites Fight over Protections for Pre-Existing Conditions

On June 7, the Department of Justice (DOJ) filed a legal brief in support of a lawsuit from 20 states seeking to invalidate the Affordable Care Act (ACA), urging the federal court considering the case to strike down the ACA’s protections for pre-existing conditions. The Texas-led lawsuit, Texas v. United States Department of Health and Human Services, claims that Congress’s recent elimination of the ACA’s individual mandate penalty means that the individual mandate is now unconstitutional. As a result, the plaintiffs argue that the entire statute is now invalid because the individual mandate is central to the law. The Trump Administration agreed in its filing that the individual mandate is unconstitutional and claims that the federal court should also strike down the ACA’s guaranteed issue and community rating provisions because those provisions are too closely tied to the individual mandate. In a letter to House Speaker Paul Ryan, Attorney General Jeff Sessions acknowledged that the executive branch typically defends existing federal law, but stated that this is a “rare case where the proper course” is to forgo a defense.

Dodd-Frank Law Loosened by the House; Volcker Rule Changes Proposed by the Fed

On May 22, by a vote of 258-159, the House approved a Senate-passed bill to free thousands of small and medium-sized banks from strict rules that had been enacted in 2010 as part of the Dodd-Frank law intended to prevent another financial crisis. The bipartisan passage in both the House and the Senate handed a significant victory to President Trump, who promised to undo the Dodd-Frank regulations. The bill stopped short of unwinding the toughened regulatory regime put in place to prevent the nation’s biggest banks from engaging in risky behavior, but it still represents a substantial change to the Obama-era rules governing a large swath of the banking system. The legislation will leave fewer than ten big banks in the United States subject to stricter federal oversight, freeing thousands of banks with less than $250 billion in assets from the restrictions.

About the Authors

Sheila P. Burke
Washington, D.C.
202.508.3457
sburke@bakerdonelson.com

Sam E. Sadle
Washington, D.C.
202.508.3476
ssadle@bakerdonelson.com

Amit Rao
Washington, D.C.
202.508.3472
arao@bakerdonelson.com

May 16, 2018

GOVERNMENT RELATIONS AND PUBLIC POLICY

President Trump Releases Drug Pricing Blueprint

By Sheila Burke, Niki Carelli, Tiffani Williams, Jeff Davis, and Amit Rao

On Friday, May 11, President Donald Trump and Department of Health and Human Services (HHS) Secretary Alex Azar presented the Administration’s long-awaited plan to address drug pricing. The proposed framework, entitled, “American Patients First: The Trump Administration Blueprint to Lower Drug Prices and Reduce Out-of-Pocket Costs” aims to achieve four goals:

Increase competition for generic and biosimilar drugs;
Improve drug price negotiation in Medicare Part B and Part D;
Provide incentives for drug manufacturers to lower list prices; and
Reduce consumer out-of-pocket spending.

While the blueprint is fairly high-level and will require additional administrative and congressional action over time to implement, the proposed plan represents a pivotal step in the drug pricing debate and opens the door for stakeholders to weigh-in on the proposed policies. To that end, on May 14, HHS issued a Request for Information (RFI) on dozens of drug pricing proposals with a 60-day comment period.

HHS Solicits Comments on Possible 340B Program Changes to Reduce Drug Prices

By Jeff Davis, Sheila Burke, and Amit Rao

The Department of Health and Human Services (HHS) is soliciting comments from the public on the Administration’s proposals to reduce drug prices and is targeting the 340B drug pricing program as an area of focus. The 340B program requires drug manufacturers to sell outpatient drugs at discounted rates to certain public and non-profit hospitals that treat high volumes of low-income patients or are located in rural areas and other safety net providers that receive federal grant funding.

On May 14, 2018, HHS issued a request for information (RFI) to help the agency develop future policies to address high drug prices. HHS will formally publish the RFI in the Federal Register on May 16, 2018 and will allow 60 days for comments. The RFI largely mirrors the Administration’s blueprint issued last week in conjunction with President Trump’s speech on drug prices. See Baker Donelson’s Summary of Trump Administration Drug Pricing Blueprint.

The blueprint questioned whether growth in the 340B program has contributed to higher drug prices, stating that the “additional billions of dollars in discounted sales and the cross-subsidization necessary may have created additional pressure on manufacturers to increase list price[s].” President Trump also alluded to the 340B program in his speech, mentioning that his administration “reformed the Drug Discount Program for safety net hospitals to save senior citizens hundreds of millions of dollars on drugs this year alone.”

The RFI outlines actions the Administration may take to address high drug prices and poses questions related to other actions under consideration. HHS includes a discussion of the 340B program in the section listing other actions under review. Below is a summary of the questions raised related to 340B.

About the Authors

Sheila P. Burke
Washington, D.C.
202.508.3457
sburke@bakerdonelson.com

Nicole D. Carelli
Washington, D.C.
202.508.3451
niki@daschlegroup.com

Tiffani V. Williams
Washington, D.C.
202.508.3428
tiffani@daschlegroup.com

Jeffrey I. Davis
Washington, D.C.
202.508.3414
jeffdavis@bakerdonelson.com

Amit Rao
Washington, D.C.
202.508.3472
arao@bakerdonelson.com

www.bakerdonelson.com

May 8, 2018

Laboratory Compliance – Intent to Comply Insufficient to Avoid Medicare Enrollment Revocation

Robert Mazer | May 3, 2018

Honest Mistakes Can Result in Loss of Medicare Billing Privileges

For many compliance-related purposes, so-called legal “intent” is key in determining the consequences of an improper action. An erroneous claim for payment can result in a simple claim for repayment, monetary penalties under the False Claims Act, or imprisonment depending upon whether it reflected an honest mistake, reckless disregard regarding the claim’s accuracy, or knowing and willful behavior.

MedPAC Recommends Elimination of MIPS

Report to the Congress • March 2018

The Medicare Payment Advisory Commission (MedPAC) is required by law annually to review Medicare payment policies and make recommendations to the Congress. In the March 2018 report, MedPAC makes payment policy recommendations for nine provider sectors in fee-for-service (FFS) Medicare and reviews the status of Medicare Advantage (MA) and Medicare’s prescription drug benefit (Part D). MedPAC also recommends changing the way Medicare pays for clinician services in FFS by moving beyond the Merit-based Incentive Payment System (MIPS), recommends changes to MA and Part D to improve the equity and efficiency of those programs, and responds to a Congressional mandate on telehealth in Medicare. In the Bipartisan Budget Act of 2018, Congress enacted several policies that are similar to recommendations contained in this report.

View the report summary here.

View the entire report here.

February 12, 2018

Bipartisan Budget Act of 2018: Major Impacts on Health Care

By Sheila P. Burke, Amit Rao and Sam E. Sadle

After a brief federal government shutdown overnight, Congress passed and the President signed into law the Bipartisan Budget Act of 2018 on February 9, 2018. The Senate voted 71-28 and the House voted 240-186 to approve the legislation. This major legislation provides for a two-year budget agreement that increases the budget caps, resulting in approximately $300 billion in additional federal spending. The legislation increases both defense and domestic spending, suspends the federal debt ceiling until March 2019, and funds hurricane and wildfire disaster relief, among other programs. The measure extends stopgap funding through March 23, 2018 to keep the federal government fully operating and to give Congress time to enact a full-year omnibus appropriations measure for Fiscal Year 2018 (FY18).

The measure also extends and modifies dozens of health care programs, including extending funding for two years for community health centers and extending the Children’s Health Insurance Program (CHIP) for an additional four years through FY27. Similar to the House-passed Continuing Resolution (CR) from earlier this week, the bill provides funding for a number of Medicare extenders and incorporates policy reforms from the CHRONIC Care Act and the Medicare Part B Improvement Act – affecting Stark Law compliance, physician payment plans, telehealth, home health services, and other programs. The bipartisan legislation also includes funding for the National Institutes of Health (NIH) and for efforts to combat the opioid crisis. Finally, the legislation repeals the Affordable Care Act’s (ACA) Independent Payment Advisory Board (IPAB) and eliminates the Medicaid Disproportionate Share Hospital (DSH) reductions scheduled for FY18 and FY19. Of note, the legislation does not include ACA market stabilization measures to address ongoing uncertainty and turmoil in the individual insurance market.

Sheila P. Burke
Washington, D.C.
202.508.3457
sburke@bakerdonelson.com

Amit Rao
Washington, D.C.
202.508.3472
arao@bakerdonelson.com

Sam E. Sadle
Washington, D.C.
202.508.3476
ssadle@bakerdonelson.com

January 24, 2018

Washington, D.C. Update: 2018 Health Care Outlook

After a brief federal government shutdown, Congress has passed and President Trump has signed a Continuing Resolution (CR) to fund the government until February 8. The CR includes a six-year funding reauthorization for the Children’s Health Insurance Program (CHIP). Federal funding for CHIP, which covers nearly nine million children nationwide, expired on September 30, 2017. The reinstatement of federal funding will likely provide significant relief to the states, as they risked running out of money and being forced to reduce coverage. The CR also includes suspension of three ACA-related taxes, some of which went into effect for 2018:

Medical Device Tax: A two-year moratorium on the 2.3 percent medical device excise tax for 2018 and 2019;
Cadillac Tax: A two-year delay of the Cadillac tax (now first effective in 2022 rather than 2020 as scheduled); and
Health Insurance Tax: A one-year moratorium on the health insurance tax for 2019.

Moving forward, Congress and the Administration have a full agenda of health care issues to consider. In the near-term, Congress must still address certain expired health programs, including funding for community health centers and Medicare extenders. Longer-term, Republicans remain divided over whether to continue pursuing Affordable Care Act repeal and replace efforts or whether to turn to other legislative priorities. Given the upcoming midterm elections and the smaller 51 to 49 Republican majority, major legislation will likely be more difficult to pass this year. In 2018, we may likely see more significant health policy changes from the Administration through new rules and regulations, especially following the expected confirmation of Health and Human Services (HHS) Secretary nominee Alex Azar.

In the linked articles below, we highlight what we expect to see in health care policy for the coming year.

Please feel free to reach out for additional information on these topics or other issues of importance.

Sheila Burke
Chair, Government Relations and Public Policy
Baker Donelson

Challenges for the Affordable Care Act Remain in 2018

After repeated attempts to repeal failed in 2017, overarching federal reform of the Affordable Care Act (ACA) appears unlikely in 2018. However, ongoing uncertainty and turmoil in the individual insurance market will ensure that the ACA remains on Congress’ radar. Rising premiums and declining plan choices, likely exacerbated by repeal of the individual mandate penalty starting in 2019, will provide a strong incentive for Congress to consider two bipartisan market stabilization measures…

Trump Administration Asserts New Vision for Medicaid

In 2018, Congress may revisit proposals to enact either per capita caps or a block grant for Medicaid and offer broader flexibility on Medicaid expansion rules. However, major structural reform to Medicaid remains unlikely this year. Instead, we expect the Administration to take significant action to grant states new Medicaid program flexibilities through regulations and section 1115 and 1332 demonstration waivers…

Future of Medicare: Funding for Extenders and Payment Policy Priorities

Health care stakeholders are increasing pressure on Congress to continue funding for a series of Medicare “extenders” – Medicare program and payment policies that expired at the end of 2017. Some examples of the extenders include the physical, occupational, and speech language therapy cap exception process; the Medicare low-volume hospital add-on payments; and Authority for Medicare Advantage Special Needs Plans. Congress last extended these provisions in the Medicare Access and CHIP Reauthorization Act (MACRA) of 2015. Both the House Ways and Means Committee and Senate Finance Committee released agreements on a Medicare extenders package, but debate continues on what will be included in a final package and how to pay for it…

Drug Pricing May Return to HHS Agenda in 2018

Despite President Trump’s pledge to rein in prescription drug pricing, the Administration did not take substantial action to address this issue in 2017. With the expected confirmation of Alex Azar – who is a former Eli Lilly executive – as the new Secretary of HHS, the Administration may initiate action…

Opioid Epidemic Continues to Worsen

Health care stakeholders, the Administration, and Congress are likely to continue responding to the worsening nationwide opioid abuse epidemic. Last October, President Trump declared a Nationwide Public Health Emergency to address the opioids crisis, but did not make a request to Congress for additional emergency funding. The public health emergency expires after 90 days, so it will need to be renewed. Congress has already held several hearings on the opioid crisis this year, indicating broad interest in this important issue. It remains to be seen whether Congress will appropriate further funding to respond to the epidemic…

Continued Contention over CMS 340B Drug Payment Policy

In a major development last fall, the Centers for Medicare and Medicaid Services (CMS) finalized its proposal to pay hospitals less for certain physician-administered drugs purchased through the 340B Drug Discount Program. Starting January 1, 2018, CMS would begin reimbursing separately payable, non-pass-through drugs and biologicals purchased through the 340B program at a rate of average sales price (ASP) minus 22.5 percent, rather than the current reimbursement rate of ASP plus six percent…

About the Authors

Sheila P. Burke
Washington, D.C.
202.508.3457
sburke@bakerdonelson.com

Sam E. Sadle
Washington, D.C.
202.508.3476
ssadle@bakerdonelson.com

Amit Rao
Washington, D.C.
202.508.3472
arao@bakerdonelson.com

December 18, 2017December 18, 2017

DATA PROTECTION, PRIVACY AND CYBERSECURITY

Alert Series
Cyber-Threats: What You Need to Know to Protect Your Business Now

Year-end is an excellent opportunity to reflect and get organized for the coming year. While making your list of New Year’s resolutions, consider potential cyber and data security threats to you and your business and prepare for what we expect to be a tumultuous year filled with malware attacks, data security breaches and cybersecurity challenges.

To get you started, here is a recap of the top five tips we covered in our 2017 Cybersecurity Alert series, which addressed significant cyber-threats to your business and discussed ways you can protect your business with thoughtful and timely planning before an emergency arises. We offered guidance on establishing a smart data management plan, securing your company’s portable devices, evaluating vendor relationships, handling disgruntled employees, and testing for data security events.

Sam Felker
Nashville
615.726.5558
samfelker@bakerdonelson.com

Brad Moody
Jackson
601.351.2420
bmoody@bakerdonelson.com

Cyber-Threats: Five Tips for Data Protection We Learned in 2017

1. Plan Now for Data Security Events

As the number of data security breaches grows, it’s not a matter of if your company will experience a security event, but when and to what degree. Is your company ready? Get your plan together.

Identify potential security events. Know what data you have and where it’s stored. Identify how access is granted, and to whom. Look for vulnerabilities in everything from your network to your employees’ mobile devices to your company’s website.
Develop a two-part plan: prevention and reaction. Take steps to secure your platforms and data, and devise processes for remediation and notification in the event of a breach or other malicious attack.
Review and test the plan. Document your data security policies and processes, and review them with your users, vendors and legal counsel. Continually test your information systems by simulating data security events.
Revise and repeat. Data security plans should be continually reviewed, revised and updated – especially when technology is updated, a new category of data is retained or storage solutions change.

Read on: “Ready, Set, Go: Preparing and Testing for Data Security Events”

2. Keep Only the Data You Need

Companies are continually building out their IT infrastructure with new applications, networks and platforms. As a result, they’re amassing enormous volumes of data, making compliance with data privacy law and regulations more challenging than ever.

What’s a company to do? Keep it simple by keeping only what you need.

Know what types of data your company has. Identifying and managing data at a granular level helps you strike a balance between regulatory compliance and operational efficiency.
Automate your information governance. Cloud-based solutions, in-place records management and AI can trim the fat from both your data storage and your data management processes.
Get your data practices in line now because the EU’s General Data Protection Regulation will be enforced beginning on May 25, 2018.

Read on: “Keep Only What You Need – Information Management in the Digital Age”

3. Secure Your Company’s Portable Devices

Don’t assume your laptop or phone can’t be compromised just because it’s safely in your possession. Beyond the risk of physical theft, those devices can be hacked. Know these eight keys for protecting your portable devices.

Make sure your data is encrypted, both upon transmittal and at rest. Most laptops, phones and other portable devices have some form of encryption built in – but if you’re storing sensitive and confidential data, consider adopting more advanced options through a third-party encryption service.
Require users to create complex passwords that must be changed frequently. Add further protection by adopting multi-factor authentication (MFA), which requires something in addition to a password, like a fingerprint, phone call or additional passcode generated from another source.
Decide which users should have access to your data through portable devices, and which information they should be allowed to access. Create and monitor access logs to watch out for unauthorized access.
Back up your devices and then secure those backups. Backups should be treated no differently than the original data; they should be encrypted and password protected.
Remember to install updates and patches from the device manufacturers to stave off viruses, backdoors and malware. Inventory your devices regularly, and revoke from your network any that don’t have the latest security updates.
Use mobile device management (MDM) solutions, which offer a range of options, including allowing devices to be remotely controlled or wiped, setting minimum security requirements or requiring external drives to be password protected.
Create written policies governing access to your company’s data on portable devices. Clarify what’s permitted and what’s not. Disclaim liability for damage to employee-provided devices. Make clear that there’s no right to privacy on devices that access a company’s networks. Require users to execute an acknowledgment of the policies.

Read on: “Eight Keys to Securing Portable Devices”

4. Vet Your Vendors Carefully

Vendors and third-party service providers that have access to your company’s platforms and customer data pose unique security risks. Take steps to minimize risks when allowing access to your company’s data.

Before hiring a vendor, do a thorough review of its data security policies, procedures and controls.
Be sure your vendor contracts provide for data security reporting standards, non-disclosure clauses, the right to require changes as the digital space evolves and a provision for your organization to have access to your vendors’ systems.
Even after a vendor is engaged, plan on continued oversight to ensure vendors are honoring their commitments and adhering to standards and processes outlined in your agreements

Read on: “Vendor Relations – Your Best Friends Really Can Hurt You”

5. Beware of Internal Threats

Disgruntled, financially-motivated or even careless employees can cause significant disruption and damage to your digital property. Employees know their way around your company’s platform and data, and as such, have an advantage in launching malicious attacks against your information systems. Be on your guard for – and take steps to prevent – internal threats.

Require non-disclosure agreements with new employees.
Train your workforce to prevent unintended disclosure of confidential information.
Protect devices and encrypt those that store your company’s most sensitive data.
Monitor user behavior and identify any unusual patterns.
Manage access by regularly checking that user permissions are granted only for needed job responsibilities.
Disable unnecessary accounts promptly.

Read on: “Disgruntled Employees and Other Internal Threats to Your Cybersecurity”

www.bakerdonelson.com

November 10, 2017

DATA PROTECTION, PRIVACY AND CYBERSECURITY

Alert Series

Cyber-Threats: What You Need to Know to Protect Your Business Now

Baker Donelson’s Data Protection, Privacy and Cybersecurity attorneys are pleased to continue a series of client alerts that address significant cyber-threats to your business and discuss ways you can protect your business with thoughtful and timely planning before an emergency arises. Proper planning includes recognition of the threats, assessment of the risk, and then examination of the facts and tools at your disposal to mitigate the risks. The series will address your options, from adopting appropriate IT policies and procedures to acquiring contractual indemnity and insurance for specific loss risks. When there is a recommended technical solution available, we will consult with leading expert vendors and provide their input. We often hear that in today’s tech environment, it’s not a matter of whether you will be hacked or attacked, but when; therefore, we want to help you be well prepared for future challenges.

Our series will help you get ahead of the game. We offer guidance on shopping for cybersecurity insurance; protecting your business from DDoS attacks and ransomware; establishing a smart data management plan; evaluating vendor relationships; handling disgruntled employees and other internal threats; and testing for data security events.

Brad Moody
Jackson
601.351.2420
bmoody@bakerdonelson.com

Sam Felker
Nashville
615.726.5558
samfelker@bakerdonelson.com

Ready, Set, Go: Preparing and Testing for Data Security Events

By Zachary Busey, CIPP/US

Target, Ashley Madison, Sony, Home Depot – these events define the last few years of data security. With 2017 nearing an end, Verizon, the IRS, Equifax, and the SEC have joined this list. These events draw our attention because they are large-scale and highly publicized. Absent from this list are the thousands of events impacting day-to-day operations of companies across the country. In today’s tech environment, it’s not a matter of if your company will experience a data security event, but when and to what degree. Is your company ready?

Companies prepare for events all the time: power outages, product launches, hiring and firing of staff, inclement weather, theft, media announcements, etc. While companies do so in different ways, from large scale to small, the steps are the same: (1) identify potential security events; (2) develop a plan; (3) review and test the plan; (4) revise the plan; and (5) repeat as needed.

Identify Potential Security Events

When it comes to data security, identifying potential security events starts with knowing the data a company has and where it is stored. Say, for example, a company keeps hardcopies of personnel and employee medical files. Those files could be copied or physically taken. At the same time, when a company’s website is susceptible to a DDoS attack, their wireless devices can be overtaken and used during that DDoS attack. Electronic data can be copied by employees or stolen by hackers, as the system has become unsecure. Additionally, electronic data, when shipped or transmitted – whether internally or externally – can be intercepted. Finally, an employee could click on a malicious link or download a file which would allow outsiders access to the company’s system. The scope and severity of the event(s) will vary based on the size of the company and the nature of their business.

Develop a Plan

Your plan has two parts. The first part is prevention. The hard copies of personnel and employee medical files should be secured in locked file cabinets and in a file room to which access is monitored and logged. Website traffic is evaluated and additional server resources are available in the event of a DDoS attack. Wireless devices are protected by passwords, preventing their use in a DDoS attack. A company’s most sensitive electronic data is encrypted. Networks are secured with passwords; and access is monitored and logged. Third-party providers and outside holders of electronic data sign agreements affirming the implementation of controls and security, and employees are trained and regularly reminded to avoid malicious links and downloads.

The second part is reaction. When a hard copy file is stolen or electronic data is copied, a company has to know who to notify, internally, externally, or both. In the event of a DDoS attack, an individual or provider has to be told to allocate additional server resources. Statutes and regulations also drive reactions, often requiring companies to notify state agencies, consumers, or both in the event data is stolen. A reaction plan should include when legal counsel is consulted. Engaging counsel early in the process better positions a company to maintain confidentiality over certain communications about the event.

Review and Test the Plan

It seems obvious, but a plan should be reduced to writing and distributed to those involved. Your plan should also be reviewed by those involved, including legal counsel. Like any workplace policy, those involved should acknowledge in writing their receipt and review of the plan. This written acknowledgment provides the basis of discipline, up to and including termination, should an employee or third-party vendor fail to execute their responsibilities under the plan.

Testing the plan is vitally important. As with every part of this process, the extent and sophistication of any testing will vary from company to company. Testing can be simple, such as talking through reactionary measures on a call or in a meeting. A company, however, should not stop at simple. More sophisticated testing has become commonplace. Companies need to simulate events, and whether staging a file theft or a hacking incident, companies need to experience these events in real time. Penetration testing (or pen testing) can be utilized. Pen testing is typically done with the assistance of a third party and often without company employees knowing the test is occurring. The goal of a pen test is to determine vulnerabilities in a company’s systems and network. Common approaches mimic hacks and other cyber events, such as DDoS and brute force attacks. Other examples include staging the theft of a hard copy file, sending an email to test whether employees click malicious links, or calling employees to see if they provide access credentials.

The harder a company tests a plan – i.e., closely simulating real-world, real-time scenarios – the better a plan will be. Briefings for board members and the c-suite help companies ensure that these issues are taken seriously and given the necessary resources. The ultimate goal is to identify strengths and weaknesses of any plan, and then develop options for emphasizing strengths and addressing weaknesses.

Revise and Repeat

A plan’s first draft should not be the only draft. Through testing and review, plans should be revised and updated. In general, this process should be repeated regularly. It must be repeated each time technology is updated; a company decides to retain a new category of data; or a company begins storing data in a different way. If you have any questions or would like additional information regarding event planning and testing, please contact Zachary Busey, CIPP/US or any member of the Firm’s Data Protection, Privacy, and Cybersecurity Team.

About the Author

Zachary Busey, CIPP/US
Memphis
901.577.8164
zbusey@bakerdonelson.com

www.bakerdonelson.com

October 25, 2017October 25, 2017

Payment Matters

Will CMS Consider Your Institution to Be a Hospital? Guidance on the “Primarily Engaged In” Standard

Thomas W. Coons, 410.862.1189, tcoons@bakerdonelson.com

Recent guidance from CMS suggests that some hospitals, and particularly specialty hospitals that provide mostly outpatient care, may soon find themselves the focus of surveyors’ scrutiny. In early September, CMS issued guidance addressing what it means to be “primarily engaged in” the provision of inpatient services, a Medicare requirement for a facility’s payment as a hospital. That guidance is found in a memorandum to State Survey Agency Directors and in the revisions to the State Operations Manual, and it highlights many of the considerations that CMS and its surveyors will take into account in determining whether a facility qualifies as a Medicare “hospital.”
READ MORE

OIG Finds Continued Procedural Errors in Hospital Outlier Payment Reconciliations

Bryna Shmerling, 202.326.5012, bshmerling@bakerdonelson.com Reviewed by Leslie Demaree Goldsmith, 410.862.1133, lgoldsmith@bakerdonelson.com

The U.S. Department of Health and Human Services, Office of Inspector General (OIG) recently released a Report concluding that there are vulnerabilities in the process of reconciling Medicare hospital outlier payments. The report summarizes the results of a previous 2012 OIG audit of outlier reconciliations, in which the OIG reviewed outlier payment data submitted to CMS by a sample of Medicare contractors during the audit period of October 1, 2003 through December 31, 2008, and a series of subsequent reviews of outlier payments. The OIG looked into whether (1) “Medicare contractors had referred qualified cost reports to CMS for reconciliation in accordance with Federal guidelines” and (2) “outlier payments associated with qualifying cost reports had been reconciled.” As discussed in more detail below, the OIG indicated that there are still vulnerabilities in Medicare hospital outlier payments – within CMS and by the Medicare contractors – and issued recommendations to remedy the vulnerabilities.
READ MORE

OIG Finds Acute Care Hospitals Improperly Billed for Outpatient Services Provided to Inpatients of Other Hospitals

Matthew F. Smith, 615.726.5560, msmith@bakerdonelson.com Reviewed by Leslie Demaree Goldsmith, 410.862.1133, lgoldsmith@bakerdonelson.com

Acute care hospitals that provide Medicare outpatient services to inpatients of other hospitals should be billing and collecting payment from the other inpatient hospitals and not from Medicare.

In a Report released on September 18, the Office of the Inspector General (OIG) found CMS had inappropriately paid more than $51.6 million between January 2013 and August 2016 for outpatient services acute care hospitals provided to Medicare beneficiaries who were inpatients at facilities other than acute care hospitals. The Report examined four types of non-acute care hospitals: (1) long term care hospitals; (2) inpatient rehabilitation facilities; (3) inpatient psychiatric facilities; and (4) critical access hospitals. In addition to payments from Medicare, the acute care hospitals collected $14.4 million in deductible and co-insurance amounts for these services from Medicare beneficiaries. While the Report noted the possibility that the acute care hospitals received payment from both Medicare and an under arrangement contract, the OIG did not verify whether the inpatient facilities paid the acute care facilities for the services rendered or if the inpatient facilities included the outpatient services on their Part A claims.
READ MORE

October 25, 2017

October Washington, D.C. Update

With never a dull moment in Washington, D.C., the past month has proven that anything and everything is possible. After repeated attempts to repeal the Affordable Care Act (ACA), most observers had written off this partisan effort. Yet unexpectedly in mid-September, Senate Republicans made another ultimately unsuccessful attempt at repealing the ACA.

In other surprising news this month, the White House, without consulting with congressional Republicans, reached an agreement with congressional Democrats to extend fiscal year 2017 (FY17) spending levels and suspend the debt ceiling for three months. The deal was reportedly reached during an Oval Office meeting with House and Senate congressional leadership when President Trump unexpectedly sided with “Chuck and Nancy,” (Senate Minority Leader Chuck Schumer (D-NY) and House Minority Leader Nancy Pelosi (D-CA)) ignoring advice from House Speaker Paul Ryan (R-WI) and Senate Majority Leader Mitch McConnell (R-KY) that the GOP maintain a united front and push for Democratic concessions, including extending the debt limit until after the 2018 elections.

Looking forward, Congress faces a full calendar for October and November, including a new December 8 deadline for FY18 appropriations measures and an extension of the National Flood Insurance Program, as well as reauthorization of the Children’s Health Insurance Program (CHIP). Add to that agenda consideration of the Administration’s $29 billion appropriations request for recovery efforts related to recent hurricanes and wildfires (including Hurricane Maria’s impact on Puerto Rico), a potential bipartisan ACA market stabilization measure, and congressional Republicans’ desire to move forward with tax reform.

In this month’s Washington, D.C. Update, we examine:

Please feel free to reach out for additional information on these topics or other issues of importance.

Sheila Burke
Chair, Government Relations and Public Policy
Baker Donelson

White House Reaches Deal with Congressional Democrats to Keep Government Open and Suspend Debt Limit Until December

President Trump came to an agreement with congressional Democrats to extend FY17 federal appropriations and suspend the debt limit until December 8. The deal, which took congressional Republicans by surprise, was paired with a federal emergency appropriation for hurricane relief in the southeastern United States and passed the Senate by a vote of 80 to 17 and the House by a vote of 316 to 90 with all dissenting votes coming from Republican members. The three-month duration of the agreement, which opened a significant rift between Republican congressional leadership and the White House, gives Congress the rest of the fall to come to some sort of agreement over FY18 appropriations and the debt ceiling…
READ MORE

Congressional Republicans and White House Release Outline of Tax Reform Proposal

On September 27, the White House and its allies on Capitol Hill released the outline of their long-promised tax reform proposal. Generally, the outline seeks to create three individual income tax rates (12, 25, and 35 percent), eliminate many personal exemptions and deductions, lower the corporate tax rate to 20 percent, and implement a territorial tax system. The plan is primarily based on House Speaker Ryan’s “A Better Way” with the exception of the Border Adjustment Tax, which was not included. The proposal was only an outline and much of the plan will need to be worked out by the tax-writing committees in the House and Senate. Look for the debate over tax reform to be intense as congressional Republicans attempt to move the measure through the streamlined reconciliation process over the coming months…
READ MORE

Graham-Cassidy Falters; Bipartisan Talks Restart on Market Stabilization

Following defections from Senators Rand Paul (R-KY), John McCain (R-AZ), and Susan Collins (R-ME), Senate Republican leaders announced on September 26 that they did not have the votes for the Graham-Cassidy plan – the last attempt to push ACA repeal on a partisan vote before the Fiscal Year (FY) 2017 Budget Reconciliation expired on September 30. After initial talks halted due to the Graham-Cassidy push, Senate Health, Education, Labor and Pensions (HELP) Committee Chair Lamar Alexander (R-TN) and Ranking Member Patty Murray (D-WA) reportedly restarted negotiations to find consensus on a limited bipartisan stabilization plan for the individual market. A key sticking point in the debate is the level of state flexibility to waive ACA insurance regulations. Even if a deal were reached, Senate Republicans would need to overcome resistance from conservatives and skeptical House Republicans to achieve passage…
READ MORE

HHS Secretary Tom Price Resigns and the Search Begins for Replacement

Department of Health and Human Services (HHS) Secretary Tom Price resigned on September 29, following the collapse of Republicans’ efforts to repeal-and-replace the Affordable Care Act (ACA) and revelations that he spent more than $1 million on charter and military airplane travel at taxpayers’ expense. Price’s resignation has significant implications for HHS’s regulatory priorities, including enforcement of the ACA, regulatory flexibility on physician practices and the broader health care industry, efforts to combat opioid abuse and childhood obesity, and other HHS initiatives…
READ MORE

Federal Funding for CHIP Expires, Pending Congressional Reauthorization

Federal funding for the Children’s Health Insurance Program (CHIP) – which covers nearly nine million children nationwide at a total cost of approximately $14 billion per year – expired on September 30 as congressional action was sidelined by the focus on Republicans’ ACA repeal-and-replace efforts. On October 4, the Senate Finance and House Energy and Commerce Committees held their respective markups and advanced legislation for a five-year CHIP reauthorization. Congress is seeking to quickly pass an extension of CHIP funding this fall before states run out of money and are forced to reduce coverage, but reaching agreement on fiscal offsets for the legislation is likely to prove contentious…
READ MORE

Trump Administration Broadens Employer Exemption from ACA’s Contraceptive Coverage Requirements

On October 6, the Trump Administration issued two new interim final rules that significantly expand exemptions for employers to the ACA’s requirements to provide free contraceptive coverage. The new regulations, effective immediately, allow exemptions for 1) any employer or university with a health plan with objections to contraception based on religious beliefs, and 2) any non-profit or closely-held for-profit employer with moral objections. These regulations represent a significant departure from the previous standard, under which exemptions were limited to closely-held employers’ religious beliefs only (in addition to churches and some religious organizations that have always been exempt). Under the new interim final rules, many more employers may elect to withhold no-cost contraceptive coverage from their health plans…
READ MORE

Trump Executive Order Expected to Expand Association Health Plans and Short-Term Coverage

President Trump is expected to issue an executive order in the coming days that would direct federal agencies to expand access to association health plans (AHPs), which would be exempt from the ACA’s coverage requirements and eligible to be sold across state lines. The executive order would also expand access to short-term health plans, previously limited to 90 days, by allowing these plans to be purchased for up to a year. Expanding access to AHPs and short-term insurance plans would likely create cheaper, less comprehensive insurance options. However, this new policy may also encourage adverse selection that could increase premiums on the individual market if healthier consumers flock to these plans, leaving behind only sicker, more expensive consumers purchasing comprehensive coverage through the ACA’s insurance exchanges…
READ MORE

Lawmakers Approve a Six-Month Extension of FAA Authorization

On September 28, Congress approved a six-month extension to the Federal Aviation Administration (FAA) authorization, heading off a partial shutdown of the FAA. Expect negotiations over House Transportation and Infrastructure Chairman Bill Schuster’s (R-PA) proposal to spin off the FAA’s Air Traffic Control to a non-profit entity to continue into the spring. Congress now has until the end of March 2018 to come up with a solution to the stalemate or pass another short-term extension…
READ MORE