HHS is Gearing Up for HIPAA Audits

The Office of Civil Rights (“OCR”) of the U.S. Department of Health and Human Services (“HHS”) is preparing to resume its Health Insurance Portability and Accountability Act (“HIPAA”) compliance audit program. In a notice published in the February 24, 2014 Federal Register, OCR announced its plans to conduct a pre-audit survey of up to 1,200 organizations. The purpose of this pre-audit survey is to gather information about survey respondents to enable OCR to identify candidates for audit under the OCR HIPAA Audit Program. HHS is accepting comments regarding the pre-audit survey until April 25, 2014.

The OCR Pilot Audit Program concluded in December 2012. Since the Pilot Audit Program ended, OCR has been working on the development of protocol for the permanent HIPAA Audit Program. The Pilot Audit Program evaluated 115 HIPAA covered entities (health plans, health care providers and health care clearinghouses). This time around, OCR is selecting both covered entities and business associates for audit. While the precise audit schedule has not been released, the pre-audit survey will serve as an initial step toward finalizing audit plans for 2014.

Posted in HIPAA | Tagged , , , , , , , , | Leave a comment

IRS Snubs Public Schools On Employer Penalties

The Internal Revenue Service issued final regulations on February 10, 2014 regarding the employer penalties under the Patient Protection and Affordable Care Act (“PPACA”).  A copy of the final regulations is available here.

Over the past year, Indiana public school administrators, school boards and employees have encouraged the IRS to modify the proposed regulations on the employer penalties, which were originally published on December 28, 2012.  The proposed regulations imposed a special rule on educational institutions that prohibited them from utilizing summer break to average hours to satisfy the 30 hour full-time threshold.

The concerted effort by Indiana public schools has been significant and has received national attention.  Education Week published an article that suggested that “the most obvious battleground over districts’ implementation of the law is Indiana.”  Notwithstanding the efforts of many (including more than 100 letters, oral comments delivered by 3 school administrators during the April 23, 2013 IRS public hearing and communications by federal legislators), the IRS restricted its discussion of the issue to a single sentence in the 227 page final regulations.

“However, some employers and some employees also suggested that the employment break period rule would not result in an expansion of coverage to employees not currently offered coverage, but rather in limiting hours to ensure that those employees were not classified as full-time employees.”

The IRS subsequently upheld its rule prohibiting educational institutions from utilizing employment break periods in averaging hours.

The final regulations are substantially similar to the proposed regulations that were published more than thirteen months ago.  However, there are some provisions that are worthy of mention:

  • The final regulations contain good news for public schools and other employers with 50 to 99 full-time equivalent employees.  For this limited group, the IRS has determined that the employer penalties will not apply until 2016.
  • Most Indiana public school corporations employ more than 100 full-time equivalent employees.  The IRS still takes the position that the employer penalties for these school corporations will continue to take effect in 2015.  However, the Sledgehammer (Part A) penalty for schools with more than 100 full-time equivalent employees will only apply if the school fails to offer coverage to at least 70% of its full-time employees.  This threshold will rise to 95% in 2016.  The 70% threshold in 2015 may provide opportunities for schools, but even if the test can be met, the school will still be subject to the Mallet (Part B) penalty if one or more full-time employees receives a subsidy through the marketplace.  Note that the State of Indiana and 39 Indiana public schools filed a lawsuit in 2013 against the IRS regarding the application of the employer penalty and that lawsuit is currently pending.
  • The final regulations now provide that bona fide volunteers for government or tax-exempt entities will not be counted for purposes of the employer penalties.  A lay coach will generally be considered a bona fide volunteer even if the coach receives reasonable benefits or a nominal fee.  However, classified employees who coach will continue to have coaching and other extracurricular hours counted for purposes of the 30 hour threshold.
  • Some schools with non-calendar year plans will not be required to comply with the final regulations until the start of their respective plan years beginning in 2015.
  • Schools may utilize a 6 month measurement period in 2014 that will translate into a 12 month stability period in 2015.

The United States Treasury also published a fact sheet on the final regulations, which is available here.  We will provide more guidance on these final regulations in the coming days.

Posted in Patient Protection and Affordable Care Act | Tagged , , , , , , , , , , , , , , , | Leave a comment

Dermatology Practice Settles Potential HIPAA Violations

The Department of Health and Human Services (“HHS”) announced on December 26th that Adult & Pediatric Dermatology, P.C. (“APDerm”) has agreed to a $150,000 settlement to resolve potential violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy, Security, and Breach Notification Rules. APDerm is a private practice that delivers dermatology services in four locations in Massachusetts and two in New Hampshire. This is the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”).

The HHS Office of Civil Rights (“OCR”) investigation began as a result of a report that an unencrypted thumb drive containing the electronic protected health information (“ePHI”) of approximately 2,200 individuals was stolen from an APDerm staff member’s vehicle. The thumb drive was never recovered.  After investigation, the OCR determined that APDerm had not conducted an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality of ePHI and did not fully comply with requirements of the Breach Notification Rule to have in place written policies and procedures and train workforce members. OCR Director, Leon Rodriguez, stated in the HHS press release that “…a good risk management plan is all about – identifying and mitigating risk before bad things happen. Covered entities of all sizes need to give priority to securing electronic protected health information.”

The HHS press release as well as the resolution agreement with corrective action plan between OCR and APDerm can be found here.

Posted in HIPAA | Tagged , , , , , , , , , , , , , , | Leave a comment

Number of Indiana Public Schools Joining the Lawsuit Against IRS Over Employer Mandate More Than Doubles

Twenty-four additional Indiana public schools have joined the original 15 Indiana public school corporations and the State of Indiana in a federal lawsuit against the Internal Revenue Service, the United States Department of the Treasury, the United States Department of Health and Human Services and the United States Department of Labor in connection with the Affordable Care Act. An amended complaint including the additional public schools was filed in federal court on December 9, 2013. The State of Indiana serves as the lead plaintiff in the lawsuit.

The lawsuit, originally filed on October 8, 2013, challenges new IRS regulations implementing the Affordable Care Act. In addition, the lawsuit challenges the authority of the federal government to impose the employer mandate upon the State of Indiana and Indiana public school corporations. The employer mandate, one of the law’s core provisions, declares that applicable large employers are required to offer full-time employees health insurance. If large employers, such as school districts, do not meet that requirement, and workers in turn receive federal subsidies to obtain coverage through the new exchanges, the employers may be subject to significant financial penalties.

“It is unprecedented in the history of the United States that 39 public schools have joined together in a single lawsuit against the IRS. The significant participation of Indiana public schools in this lawsuit underscores the debilitating impact that the employer penalties are having upon public education,” said Jim Hamilton, an attorney at Bose McKinney & Evans LLP representing the public schools.  “All Indiana public school corporations provide comprehensive health insurance coverage to most of their employees. However, the practical reality is that most Indiana public school corporations do not have the financial resources to provide affordable, minimum value coverage to all employees who work in excess of 30 hours of service per week.”

“The State of Indiana and 15 public schools joined together as the original plaintiffs in this lawsuit,” Hamilton continued. “However, after the lawsuit was filed, several other public schools have stepped forward to support this important effort.  It is imperative that our elected officials in Washington understand the impact that this law is having in the heartland.”

The State of Indiana is represented by Indiana Attorney General Gregory F. Zoeller. The public school corporations are represented by Bose McKinney & Evans LLP.


  • Area 30 Career Center Education Interlocal
  • Charles A. Beard Memorial School Corporation
  • Cloverdale Community School Corporation
  • Daleville Community Schools
  • Eastern Howard School Corporation
  • East Porter County School Corporation
  • Eminence Community School Corporation
  • Fayette County School Corporation
  • Greencastle Community School Corporation
  • Monroe Central School Corporation
  • Nettle Creek School Corporation
  • Northeastern Wayne School Corporation
  • North Putnam Community School Corporation
  • Northwestern School Corporation
  • North West Hendricks School Corporation
  • Old National Trail Special Services Cooperative
  • Salem Community Schools
  • Shelby Eastern School Corporation
  • South Gibson School Corporation
  • South Putnam Community School Corporation
  • Taylor Community School Corporation
  • Union School Corporation
  • Western School Corporation
  • Western Wayne Schools


  • Benton Community School Corporation
  • Community School Corporation of Eastern Hancock County
  • John Glenn School Corporation
  • Madison Consolidated Schools
  • Metropolitan School District of Martinsville
  • Monroe-Gregg School District
  • Mooresville Consolidated School Corporation
  • North Lawrence Community Schools
  • Northwestern Consolidated School District of Shelby County
  • Perry Central Community Schools
  • Shelbyville Central Schools
  • South Henry School Corporation
  • Southwest Parke Community School Corporation
  • Southwestern Jefferson County Consolidated School Corporation
  • Vincennes Community School Corporation
Posted in Patient Protection and Affordable Care Act | Tagged , , , , , | Leave a comment

HHS Announces Intent to Exempt Some Self-Insured Plans from Reinsurance Fees

Yesterday, the U.S. Department of Health and Human Services (“HHS”) published a rule finalizing a number of policies related to the implementation of the Patient Protection and Affordable Care Act (“Program Integrity Rule”).  In the Preamble of the Program Integrity Rule, HHS indicates that it plans to propose future rulemaking to change how the $63 per covered life reinsurance fee will be collected, and that certain self-insured, self-administered plans will be exempted from the fee for 2015 and 2016 benefit years.

Employers that self-insure will still need to pay the transitional reinsurance fee for 2014. A blog that discusses transitional reinsurance fees can be found here.  For 2015 and 2016, it is not clear at this time how broadly HHS intends to apply the exemption.

With regard to the collection of the reinsurance fees, HHS states that to alleviate the upfront burden of the reinsurance contributions, HHS intends to adopt a new payment schedule and collect reinsurance contributions in two installments.  First, the reinsurance contributions for reinsurance payments and administrative expenses would be collected at the beginning of the calendar year following the applicable benefit year.  Second, the contributions for payments to the U.S. Treasury would be collected at the end of the calendar year following the applicable benefit year.

The Program Integrity Rule can be found here.

Posted in Patient Protection and Affordable Care Act | Tagged , , , , , , , , | Leave a comment

HIPAA Compliance: Model Notice of Privacy Practices Released

On September 16, 2013, the Health and Human Services Office of Civil Rights (“OCR”) in collaboration with the Office of the National Coordinator for Health Information Technology (“ONC”) released two sets of model Notice of Privacy Practices.  One set is for health care providers and the other set is for health plans.  The model Notices incorporate the regulatory changes of the Final HIPAA Omnibus Rule published January 25, 2013.  The model Notices may be used as templates by health care providers and health plans working to come into compliance with the new requirements.

The model Notices are available in different formats and are customizable.  The Notices are available in booklet style, layered notice style and full page style.  The model Notices are also available in text version.  Covered entities may use the models by entering their specific information into the model such as name and contact information, and then printing for distribution and posting on their websites.

The HIPAA Privacy Rule gives individuals a right to be informed of the privacy practices of health plans and health care providers and of their privacy rights regarding their protected health information.  Health plans and health care providers are required by HIPAA to develop and distribute a notice that provides an easy to understand explanation of these rights and privacy practices.  The model Notices may serve as a baseline for health plans and health care providers when drafting their own Notice of Privacy Practices.

View the model Notices and corresponding instructions.

Posted in Uncategorized | Leave a comment

NACUBO quotes attorney Jim Hamilton in Affordable Care Act article

Bose McKinney & Evans attorney Jim Hamilton is quoted in an article on the Patient Protection and Affordable Care Act (PPACA) in the recently released summer 2013 issue of HR Horizons, published by NACUBO.

Posted in Patient Protection and Affordable Care Act | Tagged , , , , | Leave a comment