The NJ BPU’s new Competitive Solicitation Incentive (CSI) Program, mandated by the New Jersey Solar Act of 2021, is available to qualifying grid supply projects, with or without energy storage, and net-metering installations in excess of 5 MWs. The deadline to submit applications to earn solar renewable energy certificates under the program is March 31, 2023. This Client Alert by our partner Barbara J. Koonz provides an overview of this new incentive opportunity and other related details.

In the wake of the New Jersey Supreme Court’s 2017 decision in Allstate Insurance Company v. Northfield Medical Center, P.C., management services organizations (MSOs), physicians, private equity funds, and practicing healthcare attorneys should keep the following “do’s and don’ts” in mind when structuring their MSO arrangements to comply with New Jersey corporate practice of medicine (CPOM) rules:

Do’sDon’ts
Allocate the majority of shares and/or voting rights in the medical practice to the plenary licensed physician-owner(s)Allocate more than a minority of shares or voting rights to any limited licensed professionals and never to an unlicensed individual
Require the physician-owner(s) to contribute start-up capital to the medical practiceThe management contract should not contain a provision allowing the termination and replacement of the physician-owner in the event of a conflict of interest between proper medical judgment and cost-containment
Clearly delineate the roles between the physician-owner’s clinical activities and the management company’s administrative activitiesPay all remaining medical practice profits after expenses to the management company in exchange for the provision of management services, leased space, and leased equipment
Physician-owner(s) should participate in or oversee day-to-day patient care and supervision of clinical personnelRequire the physician-owner of the medical practice to pre-sign undated documents or certificates which permit physician’s removal from the practice
Physician-owner(s) should retain the right to terminate the management contractIncorporate a “break fee” in the management agreement, space rental, or equipment lease which is intended to penalize the medical practice’s physician-owner for breaking the management agreement or lease
The medical practice must pay fair market value for management servicesA management company should not make above-market loans to a medical practice
Monies earned from the provision of patient services should be kept within the medical practice and used to pay salaries, bills, and other medical practice expensesIf possible, a medical practice should not contract with the management company that also leases space and equipment to the medical practice

By following these simple do’s and don’ts the ownership, control, and direction of a medical practice will stay in the hands of the plenary licensed physician-owner, giving the MSO structure the greatest chance of being upheld by a court if ever challenged.

Healthcare employers are among the many members of New Jersey’s business sector who will be impacted by the newly-signed Temporary Workers’ Bill of Rights, which requires temporary workers to be paid the same average compensation rates (or cash equivalent) that is paid to permanent employers. This requirement, and other implications of the bill signed into law by Governor Murphy on February 6, are discussed in this Client Alert by Greenbaum associate Mitchell J. Horner on behalf of the firm’s Employment Law Department.

On February 10, 2023, the United States National Security Agency (NSA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of Health and Human Services (HHS), the Republic of Korea (ROK) National Intelligence Service (NIS), and the ROK Defense Security Agency (DSA) issued a joint Cybersecurity Advisory (CSA) to highlight ongoing ransomware activity against healthcare and public health sector organizations and other critical infrastructure sector entities.

Given the multi-national involvement in this CSA, healthcare organizations should take particular note of the importance of its contents.

The intent of the CSA is to supplement prior reports on actions of the Democratic People’s Republic of Korea (DPRK), namely Maui and H0lyGh0st ransomware. The CSA highlights additional observed tactics, techniques, and procedures by DPRK cyber actors suspected to be targeting South Korean and U.S. healthcare systems.

Included in the CSA are a list of potential tactics, techniques, and procedures observed in ransomware efforts, including efforts to:

  • acquire infrastructure;
  • obfuscate identities;
  • purchase VPNs and VPSs; and
  • expose vulnerabilities to gain access.

The CSA also offers a list of mitigations to help protect an organization. Many of these should already be in place, but if not should be considered by an organization with urgency:

  • Limit access to data by authenticating and encrypting connections with network services, Internet of Things (IoT) medical devices, and the electronic health record system
  • Implement the principle of least privilege by using standard user accounts on internal systems instead of administrative accounts, which grant excessive system administration privileges
  • Turn off weak or unnecessary network device management interfaces and secure with strong passwords and encryption when enabled
  • Protect stored data by masking the permanent account number when displayed and rendering it unreadable when stored
  • Secure the collection, storage, and processing practices for personally identifiable information (PII)/protected health information (PHI)
  • Secure PII/ PHI at collection points and encrypt the data at rest and in transit using technologies. Only store personal patient data on internal systems that are protected by firewalls, and ensure extensive backups are available.
  • Create and regularly review internal policies that regulate the collection, storage, access, and monitoring of PII/PHI.
  • Implement and enforce multi-layer network segmentation with the most critical communications and data resting on the most secure and reliable layer
  • Use monitoring tools to observe whether IoT devices are behaving erratically due to a compromise

The CSA concludes by outlining a list of actions to prepare for potential ransomware attacks, including the following:

  • Maintaining isolated backups of data, and regularly testing the backup and restoration
  • Creating, maintaining, and exercising a basic cyber incident response plan
  • Installing software updates as soon as they are released
  • Implementing user training programs
  • Requiring strong passwords
  • Auditing user accounts
  • Installing and regularly updating anti-virus and anti-malware software

Organizational leadership and IT professionals within healthcare organizations should be aware of this CSA and its contents to ensure all possible protective actions have been taken. Continued and persistent vigilance is critical as these cyberattacks seem to only be getting more frequent and more sophisticated in their efforts.

Case in point: On February 15, 2023, it was reported that Community Health Systems, a large Tennessee-based healthcare organization with close to 80 hospitals in 16 states, confirmed that criminal hackers accessed the personal and protected health information of up to 1 million patients. While this breach appears to have been the work of a Russia-linked ransomware group, it serves to highlight how these risks can impact even the largest and most sophisticated organizations. Thus, continued vigilance is critical.

With New Jersey annually ranked as having one of the highest average effective tax rates in the country, NJ-based healthcare entities are impacted by high property taxes across the state, notwithstanding the tax-exempt status of certain hospitals and satellite emergency care facilities pursuant to New Jersey statute. Please join us on Wednesday, March 1 at 12:00pm for a 30-minute lunchtime webinar which will provide an overview of seven things that need to be considered when contemplating a commercial property tax assessment appeal. More details about the program and registration here.

.

Providers practicing in New York State who are enrolled in Medicaid should strongly consider revisiting their compliance programs following the recent issuance of new requirements by the New York State Office of the Medical Inspector General (OMIG).

On December 28, 2022, the OMIG issued new regulations (18 NYCRR 521-1.1, et seq.) requiring Medicaid-enrolled providers practicing in New York State to maintain their compliance programs in accordance with newly detailed standards and codifying the obligation of providers to self-disclose Medicaid overpayments.

On January 31, 2023, OMIG released three guidance documents to assist providers in ensuring they meet the new obligations. In reviewing the guidance, OMIG states that an effective compliance program:

  • is well-integrated into the company’s operations and supported by the highest levels of the organization, including the chief executive, senior management, and the governing body;
  • promotes adherence to the provider’s legal and ethical obligations; and
  • is reasonably designed and implemented to prevent, detect, and correct non-compliance with Medicaid program requirements, including fraud, waste, and abuse most likely to occur for the provider’s risk areas and organizational experience.

The guidance further provides examples and details of what OMIG considers the necessary items to properly satisfy the seven essential elements of a compliance program, which are:

  1. Written Policies, Procedures, and a Code of Conduct
  2. Establishment of a Compliance Officer and Compliance Committee
  3. Effective Compliance Training and Education
  4. Proper Lines of Communication for Reporting
  5. Defined Disciplinary Standards
  6. Routine Auditing and Monitoring
  7. Established Processes for Responding to Compliance Issues

Of further importance, OMIG has defined the steps it will follow in conducting routine reviews of provider compliance programs. These steps include:

  • Written notification of the review to the required provider;
  • Requiring the provider to download a module from OMIG’s website, complete the module, and submit supporting documentation to OMIG within 30 days for OMIG’s review; and
  • OMIG’s written compliance program assessment, recommendations for improvement, and a numerical scorecard indicating whether the required provider satisfactorily met the compliance requirements for each month of the review period (not to exceed 12 months).

Providers should expect OMIG to increase its reviews and thus should take advantage of the 30-day period to reassess their compliance programs and make the necessary changes.

The self-disclosure obligations included in the revised regulations largely codify what was already required of providers under the Affordable Care Act (ACA), which is that self-disclosure and repayment of Medicaid overpayments is mandatory. Providers should recognize this as a sign that the OMIG intends to more closely scrutinize inaction by providers in the face of identified overpayments. Accordingly, providers have an obligation to report, return, and explain any overpayment they receive from the New York State Medicaid program. These repayments must be returned the later of (i) 60 days after the overpayment is identified or (ii) the date any corresponding cost report is due with the overpayment being deemed identified when a person has identified, or “should have” identified, the overpayment “through the exercise of reasonable diligence.” The new regulations specify that a self-disclosure statement must contain a “detailed explanation” of the circumstances giving rise to the overpayment, how the overpayment was discovered, the provider’s corrective action taken, and other elements. By pursuing a self-disclosure, a provider may request a waiver of interest and a repayment plan for return of the overpayment. See 18 NYCRR 531-3.1, et seq.

While the regulations discussed herein became effective immediately upon issuance, OMIG announced in its guidance that it has given providers until March 28, 2023, to adopt and implement the necessary changes to their compliance programs to bring them into conformity with the new regulatory requirements.

Providers would be wise to consult counsel and closely analyze their compliance programs to identify any potential gaps and strengthen their programs now, rather than awaiting the day when an issue arises.

Whether or not explicit in the contract, all contracts have a mechanism for resolving disputes, the default being litigation. Left to their own devices, plaintiffs will select the forum most convenient and perceived to be most friendly to themselves that has jurisdiction over the parties and subject matter. The great majority of payer-provider contracts have some constraints over the law which may be applied, and/or provide for the use of an alternate mechanism for resolving disputes. This article takes a look beneath the hood of these contract provisions.

Businesspeople negotiating contracts are understandably focused on how the arrangement will function in the normal course – pricing, deliverables, term, etc. Less attention is paid to provisions that get handed off to the lawyers under an umbrella term like “general provisions.”  Put this under the category of provisions, like entire contract clauses, assignment provisions, indemnification provisions, compliance, record maintenance, governing law, notices, that really don’t matter to most businesspeople. That is, until they do.

Choice of Law

Even absent some alternate dispute resolution language, the party writing the contract will want to control to some extent where actions may be brought, and what laws will apply. A “Choice of Law” provision may look like the following:

“Choice of Law and venue. This Agreement shall be governed in all respects by the applicable laws and regulations of the State of New Jersey and/or federal law, as applicable, without regard to conflict of law principles, and any claim arising out of or relating to this Agreement shall be brought in the State or Federal courts of New Jersey.  The invalidity or unenforceability of any terms or provisions hereof shall in no way affect the validity or enforceability of any other term or provision.”

The county in which actions may be brought may be further defined.

An important consideration for a contract reviewer is the convenience or inconvenience of the named governing law and venue. A payer with locations in multiple states may well prefer a state in a location distant from the provider and its counsel. Depending upon the complexity and duration of the ensuing legislation, this could require distant travel by the provider’s officers and witnesses for appearances and depositions and battling time zones for status calls and other required teleconferences.

A good managed care contract lawyer can help negotiate changes up front, before the provision is triggered by a dispute.

Alternative Dispute Resolution

Anyone who has been involved in a civil lawsuit knows that years can pass between the time a plaintiff files a complaint and the time the dispute is resolved by a court judgment. Meeting all the requirements for pleadings, answers, counterclaims, cross-claims and other motion practice can be enormously expensive. In an effort to cut down on time and expense, many contracts permit or require alternative dispute resolution (ADR) methods, which are any nonjudicial method of resolving civil disputes. For example, parties usually first try to settle their disputes themselves by means of formal or informal negotiations (i.e., “out of court”). Mediation and arbitration are two other common forms of dispute resolution in payer-provider contracts.

Mediation is a process in which an impartial third party, known as a mediator, facilitates negotiations between the parties in an effort to create a mutually agreeable resolution of the dispute. If the parties are not able to resolve their dispute through mediation, they typically have the right to arbitration or civil litigation.

Arbitration is a process in which impartial third parties, known as arbitrators, evaluate the facts in dispute and render a decision that usually is binding on the parties. Appeals of arbitrators’ decisions are generally possible only if the arbitration was conducted improperly. Contracts often require that any disputes that arise between the contracting parties be resolved through arbitration rather than through civil litigation.

A threshold issue for anyone reviewing a provider contract is whether there should be a mediation and/or arbitration provision at all. State and federal rules of evidence, for example, do overlay time-consuming and expensive steps, but those steps also force discipline into the process and ensure thorough development of facts and sworn development of testimony.  Mediation and arbitration shortcut much of this development. Mediation is non-binding, but helps both parties understand the other’s positions and likely posture in any subsequent more-formal dispute resolution forum.

A “Dispute Resolution” provision may look like the following:

“Dispute Resolution. Payer will provide an internal mechanism under which Provider can raise issues, concerns, controversies or claims regarding the obligations of the Parties under this Agreement. If after at least 30 days following the date one party sent written notice of the dispute to the other party, the dispute is not resolved, and if any party wishes to pursue the dispute, it shall be submitted to mediation, and if unsuccessful, to binding arbitration in accordance with the rules of the American Arbitration Association (AAA). The arbitrator may award only compensatory damages for breach of contract, and is not empowered to award punitive, exemplary or extra-contractual damages.”

A few points of note:

  • Mediators and arbitrators are generally jointly agreed upon by the parties and a just outcome is very much reliant on the skill of the decisionmaker. Experience, judiciousness, and an ability to quickly grasp issues must be carefully considered when proposing or selecting among proposed arbitrators, and the authority of the provider to participate in the process must be clearly understood.
  • The parties should agree that any discussions and negotiations held will be treated as settlement negotiations and be inadmissible into evidence in any court proceeding. This should be made plain in the contract.
  • The contract could provide for a single arbitrator, except that claims over a threshold amount would be decided by a larger panel, for example, a panel of three arbitrators.
  • While mediation is non-binding, arbitration usually is.

Providers should strongly consider coordinating their payer contract reviews with counsel to ensure all of the provisions, which often start with the boilerplate of payer templates, protect their interests and work in the context of their own business models.

Healthcare entities that diligently monitor medical staff members and take timely actions to protect patients from substandard care are entitled to immunity from frivolous and retaliatory claims if the healthcare entity engaged in a good faith peer review pursuant to the Health Care Quality Improvement Act of 1986 (HCQIA). The HCQIA was enacted to encourage good faith peer review activities because healthcare entities, and medical staff members, are vulnerable to certain risks of liability when participating in peer reviews that adversely affect medical staff membership or clinical privileges.

The HCQIA established the National Practitioner Data Bank (NPDB) as a means of accumulating and disseminating information related to adverse peer review actions that impact clinical privileges. Adverse actions include reducing, restricting, suspending, revoking, or denying the clinical privileges of a physician or dentist.

Pursuant to the HCQIA, healthcare entities must report adverse actions in three situations. First, there is an obligation to report any “professional review action” that adversely affects clinical privileges for more than thirty days based on professional competence or conduct that impacts the health or welfare of a patient. Second, a healthcare entity must report a physician or dentist’s surrender of clinical privileges while under investigation for incompetence or improper professional conduct, or to avoid investigation. Third, healthcare entities must report any revisions to the above-referenced actions previously reported. 

In these instances, if the healthcare entity submitted a report, the HCQIA will provide immunity if the physician who was adversely affected files suit unless the report was false, and the healthcare entity knew it was false. To improve the quality of healthcare and protect patients, the immunity is given to encourage good faith peer review because a failure to report can result in a healthcare provider losing its immunity under the HCQIA for three years and/or becoming the subject of an investigation by the U.S. Department of Health and Human Services (HHS).

However, the immunity is not absolute and certain aspects of its application lack clarity. Most recently, the California Third District Court of Appeal provided some clarity by dismissing a case against a healthcare entity that properly filed a report with the NPDB when a surgeon, who resigned while under investigation (the second scenario listed above) filed suit against it. In Wisner v. Dignity Health, the healthcare entity filed a motion to dismiss because the complaint arose out of a protected activity under the HCQIA. The surgeon argued that he was not under investigation and that he resigned in good standing. Therefore, the case hinged on the term “investigation” because it was undefined by state and federal law. Relying on guidance published by HHS in the NPDB Guidebook, the court defined an investigation as the result of “a formal, targeted process” that “is used when issues related to a specific practitioner’s professional competence or conduct are identified” and that a “routine review of a particular practitioner is not an investigation.” In Wisner, the court found that the healthcare entity had engaged in a targeted review of a specific provider, the surgeon/plaintiff, and that it was a precursor to an adverse action against the surgeon’s clinical privileges. Therefore, the court held that the surgeon was under investigation and that his resignation triggered a duty to report him to the NPDB.

This case demonstrates the legal mechanism available to a healthcare entity for a good faith peer review reporting to the NPDB because of the protections afforded by the HCQIA. In other words, a good faith peer review report to the NPDB can dispose of frivolous and retaliatory claims.  Additionally, in highlighting a gap in the reporting requirements where the term “investigation” is undefined, hospitals should consider defining “investigation” in its medical staff bylaws. While the definition of “investigation” in the medical staff bylaws will not control the analysis, and is not a determinative factor, to the extent the term remains undefined – and inasmuch as the court sought guidance from another source – a definition in the bylaws could be the guidance the court uses to ultimately dismiss a case because the report is a protected action entitled to immunity. 

On January 5, 2023, Governor Phil Murphy signed into law an Act amending New Jersey’s Uniform Construction Code Act (UCC) to facilitate expedited construction inspections, as explained in this week’s Client Alert by attorneys in the firm’s real estate practice. Healthcare entities undertaking construction projects for new or renovated facilities in New Jersey should be aware of these UCC amendments, which seek to remedy the existing lack of strict timeframes requiring public construction officials to respond promptly to construction inspection requests by providing the option to utilize an authorized private inspection company upon implementation of the Act.

In a case of first impression, the Superior Court of New Jersey in Atlantic Plastic & Hand Surgery, P.A. v. Ralling held that a parent who is the named insurance policyholder is not liable for unreimbursed medical expenses incurred by an emancipated child who is a covered “adult child” dependent pursuant to the Patient Protection and Affordable Care Act (ACA) and may not be considered a guarantor under the Statute of Frauds without the requisite written instrument. This decision was made in a summary judgment ruling on November 16, 2021, with the opinion approved for publication on December 9, 2022.

Section 300gg-14 of the ACA requires that individual and group insurance plans that provide “dependent coverage of children . . . continue to make such coverage available for an adult child until the child turns 26 years of age.” Before the ACA, many health plans and insurers could, and did, remove young adults from their parents’ policies because of their age, leaving many college graduates and others with no insurance. Since its enactment in March 2010, there has been limited judicial consideration of this section of the ACA. The implementing federal regulation makes it clear that an insurer may not define eligibility for dependency by factors other than the relationship between the child and the subscriber.

The pertinent facts of Atlantic were that in October 2017, 24-year-old William Ralling sustained significant facial, elbow, and hand injuries in a skateboarding accident. He was taken to the emergency room at Riverview Hospital. His mother joined him and was present for the examination by Dr. Risin, a surgeon with Atlantic Plastic & Hand Surgery, P.A.  Dr. Risin informed William and his mother that he was an out-of-network provider in their health insurance plan. During the conversation, the mother commented that they had insurance and that Dr. Risin should take care of William. In the ensuing litigation, Dr. Risin took the position that he understood that comment to be a guarantee of payment by the parent for any unreimbursed expenses.

Atlantic submitted a claim with the insurer for $50,626.38 as its usual and customary charges for the services rendered to William. The insurer, however, only paid $1,423.29 with a check payable to the parent policyholder, which was forwarded to the medical practice. After attempts to negotiate a resolution for the remaining balance of $49,202.47, a lawsuit was commenced against William and his parents. The complaint set forth theories of breach of contract, book account, unjust enrichment, and quantum meruit.

The defendants contended that to the extent that the mother’s comments in the emergency room constituted a guarantee of William’s unreimbursed medical expenses, such a claim was barred by the Statute of Frauds. The court described the issue of whether a family member’s oral guaranty of payment can be enforceable where the promisor has no pecuniary interest as also being a question of first impression. The opinion provides an extended review and analysis of the Statute of Frauds going back to its modeling after the English Parliament in 1677 and its evolution through case law and statutory amendments. It found that the presence of some pecuniary interest on the part of the putative guarantor—triggering the “leading object” exception—was a recurring requirement in the statutes and case law. The court found that the only thing William’s mother had to gain was the non-financial parental benefit of a child receiving care for facial injuries. Thus, the court concluded that the oral promise supported by familial bonds does not satisfy the Statute of Frauds’ exception to the requirement of a writing and, accordingly, the claim was unenforceable.

Turning to the other issue of first impression concerning policyholder liability, the court began its analysis with the observation that as of his 18th birthday, William was an adult. It also observed that there was no dispute that William was emancipated and had the ability to contract for care in his own right. In a footnote, the court declined to “wade into the waters” of what result would occur where a child’s parents were not married, the child was not emancipated, or where the parental obligation to provide for the child’s basic necessities was apportioned by a court through an order or a consensual agreement between the parents.

The court recognized that the pertinent provision of the ACA “imposes no obligation on a policyholder, but merely mandates that the insurer make the specified coverage available.” Also, the ACA is silent as to the imposition of financial obligations on parental policyholders for unreimbursed medical expenses provided to an adult child at the request of and with the parents’ approval. In the absence of a viable guaranty, the court held that there was no authority supporting the theory of liability against the parents. It noted that Atlantic cited no supporting authority, and the court’s own research did not find any. In fact, the only published opinion that could be found was the New York Supreme Court’s 2019 decision in Westchester County Health Care Corp. v. Ceus, which in construing the ACA similarly rejected the providers’ claims of an obligation on the parental policyholder.

The grant of summary judgment as to the Atlantic complaint was only as to the parents. Summary judgment in favor of William was denied. Following arbitration proceedings, the case against William was settled.