How Will the Cannabis World Look When Marijuana Is Rescheduled?
A few weeks ago, someone at a holiday party asked “Whitt, why doesn’t Budding Trends take on the weighty legal issues of the day and instead resort to cheap pop culture references and puns?” I thought about responding with a quote from “Run Like an Antelope” but then it hit me: Maybe we should give some thought to a more high-minded discussion about the practical implications of marijuana rescheduling. (Editor’s note: This exchange did not actually happen.) So, I guess set the gear shift for the high gear of your soul, and let’s dive in.
It has been said that our greatest hopes and our worst fears are seldom realized. I think the recent efforts by DEA to reschedule marijuana from Schedule I to Schedule III is a good example of both. Those looking for news that marijuana is soon to be freely available nationwide will be disappointed, as, we suspect, will those who fear that rescheduling will immediately destroy the existing marijuana industry. It’s like Tom Petty reminded us, “most things I worry about, never happen anyway.”
None of This Matters if Marijuana Is Not Rescheduled, and That’s Far from a Settled Question
All of this is, of course, moot if marijuana is not rescheduled. While rescheduling is considered by many to be a fait accompli (oh yeah, Budding Trends dropping French on you) – and I agree it is more likely than not that marijuana will be rescheduled, although not in 2025 – there are a number of potential roadblocks standing in the way. We previously wrote about the process here.
But even if marijuana is not rescheduled in the near future, hopefully the discussion below will be helpful in thinking through the practical implications if marijuana is rescheduled in the future.
280E in the Rearview
It is widely assumed by many that one of the certain impacts of rescheduling is that marijuana operators would no longer be subject to the draconian tax consequences of 280E.
We previously wrote on the subject:
One of the most significant impediments to the growth of marijuana operators, and dispensaries in particular, is 26 U.S.C 280E. That one-sentence provision may be the biggest hurdle to the development of the marijuana industry in the United States. It dictates that:
“No deduction or credit shall be allowed for any amount paid or incurred during the taxable year in carrying on any trade or business if such trade or business (or the activities which comprise such trade or business) consists of trafficking in controlled substances (within the meaning of schedule I and II of the Controlled Substances Act) which is prohibited by Federal law or the law of any State in which such trade or business is conducted.”
280E has crippled the marijuana industry, often exacting an effective tax rate north of 60% for operators. “Within the meaning of schedule I and II of the Controlled Substances Act” is the ballgame. If marijuana is rescheduled to Schedule III, 280E would no longer apply and marijuana operations would be taxed as normal businesses – provided that Congress did not specially enact a marijuana tax.
Obviously, state tax laws may still penalize marijuana businesses akin to 280E, but some states proactively exempted licensed cannabis businesses from those impacts.
One question that has stuck in my mind is whether rescheduling marijuana to Schedule III would remove state-legal operators from the ambit of 280E, or would that benefit only be afforded to businesses who manufactured, distributed, and sold FDA-approved Schedule III products (i.e., not most state-licensed operators at present)?
This is a question of statutory interpretation, and I think it comes down to how the government characterizes marijuana that is not compliant with Schedule III requirements. Is non-compliant marijuana still a Schedule III substance? If so, does it somehow become Schedule I or II? If not, then it would appear that that 280E does not capture non-compliant marijuana because that provision appears to be limited on its face to Schedule I and II substances. I think the better reading is that, while non-compliant marijuana operators may face consequences as discussed immediately below, 280E will no longer include marijuana.
Another related question of great interest to marijuana operators currently sitting on huge overdue tax bills is whether rescheduling marijuana would have a retroactive effect eliminating the existing tax liabilities for marijuana operators. Generally speaking, changes to tax laws are not retroactive unless Congress expressly says so. It strikes me as very unlikely that lawmakers will be interested in allowing marijuana operators who have not paid their full tax bills for years (and in some instances publicly admitted as much) to simply walk away from those obligations.
State Medical Programs
So, if marijuana is rescheduled, what happens to existing marijuana businesses operating under the auspices of state laws? This, as well as the fate of adult-use operators discussed immediately below, may be the most consequential yet unclear aspects of rescheduling.
State-licensed marijuana operators have existed in a sort of legal limbo since their inception. How, if at all, will the rules change for state-licensed operators if marijuana is rescheduled?
The way I see it, there are three paths forward for state-licensed marijuana operators if marijuana is rescheduled:
The federal government, in a break from more than a decade of quasi-official federal policy, could actually follow the Controlled Substances Act and require marijuana operators to meet the requirements for Schedule III substances.
There is no practical change and the federal policy of non-enforcement of most marijuana operations remains in place, along with a similar posture from the states with marijuana regimes.
There is no immediate change in federal enforcement policy, but states tighten marijuana rules over time to allow for a gradual change such that access to marijuana is not immediately shut off as the federal government and marijuana operators take the steps necessary to treat marijuana like other Schedule III substances.
In a nutshell, the path chosen will answer what I believe is the most interesting and critical question in this whole discussion: Does the government intend for marijuana scheduling to be a dead letter or does the government intend to regulate marijuana as a controlled substance?
That answer will govern whether and, if so, how the federal government will regulate state-licensed cannabis operators – including potential enforcement actions.
Of the three paths above, the first strikes me as the least likely and the last strikes me as the most likely. Why? I am skeptical that the federal government would shut down existing access to marijuana (i.e., state-licensed operators) under the guise of making marijuana more available. That certainly does not comport with the statements of the political supporters of rescheduling or the spirit of rescheduling. And make no mistake, it will take years of clinical trials and FDA approval for the first marijuana medication (in a specific formulation with a specific indication) to be approved for use by patients.
I do think, however, that there will be political pressure from certain companies that do develop FDA-approved marijuana medications to curtail the state markets. Why would a company spend the substantial time and money to develop a Schedule III medication for FDA approval for a specific indication when someone can just buy marijuana to be used for any purpose from a dispensary down the street?
State Adult-Use Programs
Like state-licensed medical marijuana operators, state-licensed adult use operators have also been operating in legal purgatory, albeit with probably less legal certainty than medical operators.
To be very clear: Rescheduling marijuana under the Controlled Substances Act will do absolutely nothing to the legality of adult-use marijuana. Schedule III regulates medications prescribed by physicians and does not contemplate the recreational use of any Schedule III product.
But what does this actually mean for adult-use programs and individual operators as a practical matter? Well, as with several of the points above, we’ll see.
It is certainly possible that the federal government will continue its hands-off approach to adult-use marijuana programs. It is also possible that the federal government – and potentially some state governments – will use the ability to access federally legal marijuana by prescription to scrap existing adult-use programs. But if I was a betting man (and I am), I would bet that at least in the short term there would not be much impact, if any, to adult-use regimes.
Interstate Commerce
When it comes to transporting marijuana across state lines with Schedule III approval and appropriate federal and state licenses, interstate commerce should not be a problem.
When it comes to transporting unlicensed marijuana, theoretically it would remain illegal, and it will come down to the federal government’s appetite to enforce interstate transportation of marijuana.
Banking
Here is another instance where it depends on whether the federal government insists that marijuana products comply with the rules of Schedule III.
If the federal government insists on strict compliance with Schedule III, then any non-conforming products would likely fall within the ambit of anti-money laundering statutes. If, on the other hand, the government treats all marijuana as Schedule III, then banks may be able (albeit perhaps uninterested initially) to bank all marijuana businesses.
Private Investment
I expect there will be an immediate influx of private capital to marijuana businesses if marijuana is rescheduled. Momentum will (at least appear to) be on the side of marijuana businesses. A number of funds that have formal or informal policies governing investment in marijuana businesses will immediately investigate the opportunities. And investors will be even more motivated because it appears that 280E would no longer provide a substantial tax headwind for growth of those businesses.
This could all be thwarted if the federal government immediately makes clear that it will vigorously enforce the requirements of Schedule III, meaning that it will be extremely cash-intensive to develop profit-generating products. As noted above, I think that is unlikely, but it would certainly be an impediment to obtaining private capital.
Big Pharma/Pharmacies
The multibillion-dollar question: What role, if any, will big pharmaceutical companies and pharmacies play in the event marijuana is rescheduled?
I suspect big pharma won’t rush into the marijuana space, in part because of all the uncertainties discussed above and in part for reputational reasons. But I will be on the lookout for quiet investments by Big Pharma in companies researching and developing marijuana formulations that meet the requirements of Schedule III.
If things break a certain way, you may be able to get the best weed ever made courtesy of a brand-name pharmaceutical company. But I do believe we are years away from that happening.
Intellectual Property
This area of the law could be particularly interesting because the USPTO will have a layer of input on top of the Department of Justice and state regulators. If a product complies with Schedule III, it will have the ability to be protected by United States intellectual property laws, including trademarks and patents. If it does not comply with Schedule III, the USPTO could independently conclude that such products may not avail themselves of those protections.
Conclusions
[Deep exhale] For years, cannabis activists and legal scholars have debated the possibility and the wisdom of rescheduling marijuana. Now that we may – and I stress may – be on the horizon, it seems there are just as many questions as answers about what the implications of that change would be. So much of those implications depend on things that we do not yet know. For example, will a Trump HHS/DOJ/DEA take a different position than the Biden HHS/DOJ/DEA? Will states change their rules in response to rescheduling? And how will financial institutions and private investors react to those developments.
Trending in Telehealth: December 18, 2024 – January 6, 2025
Trending in Telehealth highlights state legislative and regulatory developments that impact the healthcare providers, telehealth and digital health companies, pharmacists, and technology companies that deliver and facilitate the delivery of virtual care.
Trending in the past weeks:
Reimbursement parity
Provider telehealth education
A CLOSER LOOK
Proposed Legislation & Rulemaking:
In Ohio, Senate Bill 95 passed both the House and Senate chambers. This bill will allow for remote pharmacy dispensing, as current state law prohibits the dispensing of a dangerous drug by a pharmacist through telehealth or virtual means.
In Oregon, the Oregon Health Authority, Health Systems Division: Medical Assistance Programs proposed rule amendments to clarify the telehealth rule definitions, including adding cross-references to established definitions in OAR 410-120-0000.
In New York, the Department of Public Health (DPH) proposed two new amendments to the Medicaid State Plan for non-institutional services:
To comply with the 2024-2025 enacted budget, DPH proposed a clarification to the March 27, 2024, notice provision regarding provider rates for early intervention services. This clarification includes a decrease to provider rates for early intervention services delivered via telehealth, with rate decreases as high as 20% in some regions.
DPH also proposed to reimburse Federally Qualified Health Centers and Rural Health Clinics a separate payment in lieu of the prospective payment system rate for non-visit services, such as eConsults and remote patient monitoring.
Finalized Legislation & Rulemaking Activity:
In Illinois, an amendment to the Illinois Public Aid Code went into effect on January 1, 2025. Passed in June of 2024, Senate Bill 3268 provides that the Department of Human Services will pay negotiated, agreed-upon administrative fees associated with implementing telehealth services for persons with intellectual and developmental disabilities receiving Community Integrated Living Arrangement residential services.
Also in Illinois, an amendment to the Illinois Physical Therapy Act went into effect January 1, 2025. Passed in August of 2024, House Bill 5087 significantly limits the ability of physical therapists to provide telehealth services to patients in the state. For more information on the effects of this bill, please read our article discussing its implications.
In Kentucky, Senate Bill 111 went into effect January 1, 2025. This bill requires health benefit plans, limited health service benefit plans, Medicaid and state health plans to provide coverage for speech therapy provided via telehealth.
Missouri’s emergency rule amendments for virtual visit coverage under the Missouri Consolidated Health Care Plan took effect as of January 1, 2025. For more information on this bill, please see our related article from last month.
In New Jersey, Assembly Bill 3853 was signed into law by the governor. The legislation extends certain pay parity regarding telemedicine and telehealth until July 1, 2026, meaning that New Jersey health plans shall reimburse telehealth and telemedicine services at the same rate as in-person services.
In New York, Assembly Bill 6799, was signed into law by the governor. The legislation establishes a drug-induced movement disorder screening education program and specifically includes services provided via telehealth.
In Vermont, House Bill 861 went into effect January 1, 2025. This bill requires health insurers to reimburse telemedicine and audio-only telephone services the same as in-person visits. However, there is an exception for value-based contracts for services delivered by audio-only telephone.
Why it matters:
States are taking action to ensure reimbursement parity for telehealth services. While there is still debate surrounding reimbursement parity for telehealth services (e., mandating reimbursement at the same rate as equivalent in-person services), several states are making strides toward ensuring equal reimbursement rates for both in-person and telehealth services. Bills requiring reimbursement parity in Illinois, Kentucky, and Vermont have taken effect in 2025. Additionally, New Jersey’s decision to extend the reimbursement parity mandate for telemedicine and telehealth services until mid-2026 illustrates the push towards reimbursing healthcare services at the same rate, regardless of the delivery medium.
States are taking measures to not only recognize telehealth, but also to educate providers on telehealth as an effective care delivery method. New York’s decision to include healthcare provider educational materials for providing telehealth services for drug-induced movement disorders underscores the growing trend and importance of educating providers on the appropriate manner for providing such treatment services.
CFPB Finalizes Rule Removing Medical Bills from Credit Reports
On January 7, 2025, the CFPB announced the finalization of a rule amending Regulation V, which implements the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., to prohibit the inclusion of medical bills on credit reports used by lenders and prevent lenders from using medical information in lending decisions. According to the Bureau, the final rule (previously discussed here) will remove an estimated $49 billion in medical bills from the credit reports of about 15 million Americans.
The Bureau noted that medical debts are not effective predictors of whether a borrower will repay a debt. Consumers frequently report that they receive inaccurate bills or are asked to pay bills that should have been covered by insurance. The CFPB estimates that this rule will result in the approval of approximately 22,000 additional mortgages each year and increase credit scores for those with medical debt by an average of 20 points.
This rule follows changes by three nationwide credit reporting companies and two major credit scoring companies to reduce the impact of medical debt on credit reports and scores. Specifically, the final rule will:
Prohibit lenders from considering medical information. The rule will amend Regulation V and prohibit creditors from using certain medical information and data when making lending decisions, including information about medical devices that could be used as collateral for a loan.
Ban medical bills on credit reports. The rule prohibits consumer reporting agencies from including medical debt information on credit reports and credit scores sent to lenders. The Bureau seeks to prevent debt collectors from using the credit reporting system to pressure consumers to pay medical bills, regardless of their accuracy.
The rule is effective 60 days after publication in the Federal Register.
Putting It Into Practice: The final rule is another example of the CFPB’s increased focus on regulating the credit reporting industry. (previously discussed here). However, immediately after the Bureau finalized the rule, it was hit with two separate lawsuits by trade associations challenging the rule.
Listen to this post
Building a Smarter Long-Term Care System in New York
New York State has a long-standing commitment to supporting its most vulnerable populations through Medicaid-funded services for older adults and those requiring long-term care. However, rising costs and an increasingly complex healthcare landscape have created challenges that demand innovative solutions. As New York seeks to align its healthcare system with evolving needs, the time has come to adopt integrated care models that promote sustainability, efficiency, and improved outcomes.
The Program of All-Inclusive Care for the Elderly (PACE) offers a clear path forward. This model has consistently demonstrated its ability to reduce healthcare costs while enhancing patient outcomes by integrating medical, social, and behavioral health services under one umbrella. PACE allows older adults to age in place by expanding access to home- and community-based services (HCBS). These services empower individuals to remain in their homes rather than institutional settings, which not only aligns with patient preferences but also reduces system-wide costs. Despite these clear benefits, New York has not approved a new PACE program since 2011, leaving this proven model underutilized in the state.
Integrated care models like PACE deliver significant advantages. By addressing social determinants of health—such as transportation, housing, and nutrition—these programs take a whole-person approach that improves both health outcomes and quality of life. At the same time, they streamline administrative processes, reducing bureaucracy for patients and providers alike. Nationally, PACE has shown remarkable success in reducing duplicative services, unnecessary hospitalizations, and other inefficiencies that drive up costs in fragmented care systems.
As the state considers reforms, it should prioritize integrated care models that promote collaboration, simplify care delivery, and align incentives across payers and providers. This could include a phased approach to transition eligible individuals from partial capitation and fee-for-service models to fully integrated plans, such as PACE or Medicare Advantage Plus (MAP). By setting clear benchmarks for integration and incentivizing innovation, the state can create a roadmap for meaningful progress.
To fully realize the potential of integrated care, New York must also address existing barriers to expanding PACE programs. Simplifying the regulatory framework and providing financial incentives for organizations willing to invest in PACE would go a long way toward increasing access, especially in underserved areas. Additionally, collaboration between managed long-term care plans and PACE could enhance the continuum of care for patients, ensuring they benefit from the strengths of both models. Nonprofit and community-based organizations, which have a history of delivering high-quality, cost-effective care, should also be given opportunities to expand their reach and impact.
Addressing misaligned incentives between Medicaid, which is state-funded, and Medicare, which is federally funded, remains a critical priority. Strengthening partnerships between state and federal entities will enable shared savings arrangements that reward innovative, high-performing care models. New York has an opportunity to lead the way in aligning these funding streams to support integrated care more effectively.
As Medicaid cost control becomes a pressing issue, piecemeal reforms that add complexity without meaningful benefits must be avoided. Instead, the state should take bold, decisive action to embrace integrated care models that deliver both financial sustainability and improved outcomes. By prioritizing proven programs like PACE, fostering collaboration among stakeholders, and removing barriers to innovation, New York can honor its commitment to aging populations and build a long-term care system that is both effective and enduring.
Listen to this post
Second Circuit Adopts “At Least One Purpose” Rule for False Claims Act Cases Premised on Anti-Kickback Statute Violations
On December 27, 2024, the U.S. Court of Appeals for the Second Circuit held in U.S. ex rel. Camburn v. Novartis Pharmaceuticals Corporation that a relator adequately pleads a False Claims Act (“FCA”) cause of action premised on violation of the Anti-Kickback Statute (“AKS”) by alleging, with sufficient particularity under Federal Rule of Civil Procedure 9(b) (“Rule 9(b)”), that at least one purpose (rather than the sole or primary purpose) of the alleged kickback scheme was to induce the purchase of federally reimbursable health care products or services.[1]
In doing so, the Second Circuit joins seven other Circuit Courts—the First, Third, Fourth, Fifth, Seventh, Ninth, and Tenth Circuits—in adopting the “at least one purpose” rule. This ruling lowers the bar in the Second Circuit for relators pleading AKS-based FCA claims.
Interplay Between FCA and AKS Violations
Under the AKS, “a claim that includes items or services resulting from a violation [of the AKS] … constitutes a false or fraudulent claim” under the FCA.[2]
The AKS prohibits persons from, among other things, “knowingly and willfully” soliciting or receiving “any remuneration (including any kickback, bribe, or rebate) directly or indirectly, overtly or covertly, in cash or in kind—
in return for referring an individual to a person for the furnishing or arranging for the furnishing of any item or service for which payment may be made in whole or in part under a federal health care program, or
in return for purchasing, leasing, ordering, or arranging for or recommending purchasing, leasing, or ordering any good, facility, service, or item for which payment may be made in whole or in part under a Federal health care program[.]”[3]
Alleged “Sham” Speaker Events & Excessive Compensation
In U.S. ex rel. Camburn, the relator, a former Novartis sales representative, filed a qui tam action in the U.S. District Court for the Southern District of New York alleging violations of the FCA premised on violations of the AKS. The relator alleged that Novartis operated a kickback scheme with the intent of bribing providers to prescribe Gilenya, a multiple sclerosis drug. Specifically, the relator alleged that Novartis operated a sham peer-to-peer speaker program that served as a mechanism for the company to offer remuneration to physicians in exchange for prescribing Gilenya. The relator alleged that the payments made to providers under the guise of this speaker program “caused pharmacies and physicians to submit false claims to the government and to the states for healthcare reimbursement under programs including Medicare Part D, Medicaid, and TRICARE.”[4]
U.S. District Court’s Dismissal with Prejudice
The federal government, as well as 29 states and the District of Columbia, among other parties, declined to intervene in the lawsuit. After granting the relator multiple opportunities to amend his complaint to plead factual allegations with sufficient particularity required by Rule 9(b), the district court held that the relator still failed to adequately plead the existence of a kickback scheme. Because the relator’s FCA claim was based on violations of the AKS, the district court dismissed the relator’s Third Amended Complaint with prejudice and did not address whether the relator sufficiently pled the remaining elements of his FCA claim.
Second Circuit’s Adoption of “At Least One Purpose” Rule
On appeal, the Second Circuit adopted the “at least one purpose” rule and found that, to survive dismissal, the relator “needed only to allege that at least one purpose of the remuneration was to induce prescriptions, without alleging a cause-and-effect relationship (a quid pro quo) between the payments and the physicians’ prescribing habits.”[5] Applying this standard, the Second Circuit concluded that the relator adequately pleaded an AKS violation with respect to the following three categories of allegations: (1) holding “sham” speaker events with no legitimate attendees, (2) excessively compensating physician speakers for canceled events, and (3) deliberately selecting and retaining certain speakers to induce a higher volume of prescriptions of Gilenya.
Specifically, the Second Circuit found that the relator’s “illustrative examples” of physician-speakers presenting solely to other Novartis speakers or to members of their own practice over lavish restaurant meals supported a strong inference that at least one purpose of the speaker program was to provide kickbacks to prescribers. The panel also found that the relator’s allegations that the compensation paid to physician speakers for canceled events ($20,000 to $22,500 to each speaker) over a two-year period in comparison to the dollar value of the allegedly fraudulent claims submitted to the government for reimbursement (between to $1 to $1.7 million) during that same period gave rise “to a strong inference that the payments constituted, at least in part, unlawful remuneration.”[6] Likewise, the relator’s inclusion of testimony from two Novartis sales representatives regarding the company’s alleged practice of offering speaking engagements to physicians to incentivize them to prescribe Gilenya suggested that these engagements were organized to induce providers to prescribe the drug.
The Second Circuit held that these allegations, accepted as true for purposes of the motion to dismiss, “plausibly and ‘strongly’ suggest Novartis operated its speaker program at least in part to remunerate certain physicians to prescribe Gilenya.”[7] Accordingly, the Second Circuit remanded the case to the district court to determine whether the relator sufficiently pleaded the remaining elements of his FCA claim and to weigh the adequacy of the claims under state and municipal law.
The Second Circuit affirmed, however, the district court’s conclusion that the relator “failed to link Novartis’s DVD initiative, ‘entertainment rooms,’ visual aids for billing codes, and one-on-one physician dinners with a strong inference that Novartis used these tools, at least in part, to induce higher prescription-writing,” with the caveat that another FCA claim predicated on an AKS violation may in fact survive dismissal if similar facts were pleaded with greater particularity.[8]
Practical Takeaways
This case highlights the importance of drug manufacturers and other regulated entities’ duty to implement robust and ongoing health care compliance programs in order to continuously and thoroughly evaluate enforcement and whistleblower risk relative to marketing and other business activities.
This decision’s adoption of the “at least one purpose” rule lowers the bar for relators in the Second Circuit to plead FCA violations premised on noncompliance with the AKS. Indeed, the Second Circuit rejected arguments that remuneration is unlawful under the AKS only if the “sole purpose” or “primary purpose” of the payment is to induce health care purchases. As eight circuits across the country have now held, allegations involving a single improper purpose can allow a case to survive dismissal. In these circuits, a relator merely needs to allege that at least one purpose of the remuneration was to induce the purchase of federally reimbursable health care products or services.
The heightened Rule 9(b) pleading standard fully applies in FCA cases premised on AKS violations. While the “at least one purpose” rule broadens liability, the district court and Second Circuit made clear that FCA allegations will be scrutinized to ensure they comport with the heightened Rule 9(b) pleading requirements.
Epstein Becker Green Attorney Ann W. Parks contributed to the preparation of this post.
ENDNOTES
[1] 2024 WL 5230128 (2d Cir. Dec. 27, 2024).
[2] 42 U.S.C. § 1320a-7b(g).
[3] Id. at § 1320a-7b.
[4] Camburn, 2024 WL 5230128, at *2.
[5] Id. at *4.
[6] Id. at *6.
[7] Id. at *6 (cleaned up) (quoting Hart, 96 F.4th 145, 153 (2d Cir. 2024)).
[8] Id. at *19.
HHS Proposed Rule Would Increase Cybersecurity Requirements for Electronic Health Data
The U.S. Department of Health and Human Services (HHS) recently released a proposed rule to better protect electronic health data from cybersecurity threats. The proposed rule would apply to health plans, healthcare providers, healthcare clearinghouses, and their business associates, such as billing companies, third-party administrators, and pharmacy benefit managers.
Quick Hits
HHS has proposed a rule to shore up cybersecurity protections for electronic health records under the Health Insurance Portability and Accountability Act (HIPAA).
The new rules would apply to HIPAA-regulated entities, such as healthcare providers, hospitals, and others that handle electronic medical data.
The public can submit comments on the proposed rule until March 7, 2025.
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule has not undergone a major overhaul since 2013. However, in response to rising cybersecurity threats across the healthcare industry, on January 6, 2025, HHS published a proposed rule that would update and bolster cybersecurity protections for personal health information that’s collected by healthcare providers, hospitals, insurers, and other companies. The public has until March 7, 2025, to submit comments on the proposal.
If finalized, these changes would apply to all HIPAA-covered entities and their business associates, imposing stricter requirements around risk assessments, data encryption, multifactor authentication, and more. Importantly, the proposed rule would eliminate the distinction between “required” and “addressable” implementation specifications, making all implementation specifications required. This shift would remove much of the discretion that HIPAA-regulated entities presently have in determining whether to implement “addressable” measures, instead introducing more granular, prescriptive requirements to ensure compliance with all security standards.
The proposed rule also would require:
written documentation of policies, procedures, plans, and analyses related to complying with the HIPAA Security Rule;
covered entities to develop and update a technology asset inventory and a network map that illustrates the movement of electronic health information throughout the electronic information system;
covered entities to conduct a more robust risk analysis than under the current rule, including incorporation of the entity’s technology asset inventory and network map; identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of electronic health information; and an assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each threat will exploit vulnerabilities;
encryption of electronic health information at rest and in transit;
the use of multifactor authentication;
covered entities to use anti-malware protections and remove extraneous software from electronic information systems;
an audit at least once per year to confirm compliance with the HIPAA Security Rule;
covered entities at least once per year to obtain written certification from business associates that they have deployed the technical safeguards required by the HIPAA Security Rule;
covered entities to review and test the effectiveness of certain security measures at least once every twelve months;
vulnerability scanning at least every six months and penetration testing at least once every twelve months;
network segmentation and separate technical controls for backup and recovery of electronic health information and electronic information systems;
covered entities to establish written procedures to restore the loss of certain electronic information systems and data within seventy-two hours, and document how employees should report security incidents and how the regulated entity will respond to security incidents. Business associates would have to notify covered entities upon activating their security contingency plans no later than twenty-four hours after activation;
covered entities to cut off a former employee’s access to personal health information no later than one hour after the employment has been terminated; and
group health plans to include in their plan documents requirements for their plan sponsors to comply with the administrative, physical, and technical safeguards of the HIPAA Security Rule.
Next Steps
Employers and the public have until March 7, 2025, to submit comments about the proposed rule. The final rule would take effect sixty days after being published in the Federal Register. The existing HIPAA Security Rule remains in effect while the rulemaking is underway.
HIPAA-covered entities (and employers that sponsor them) may wish to review their cybersecurity practices and policies as they relate to electronic health information and evaluate gaps between existing practices and documentation and the rules as proposed. While some of the proposed changes reflect common security measures already implemented by many HIPAA-covered entities, if the proposed rule takes effect, employers can expect to incur extra costs to align their practices with those outlined by the proposed rules. This is especially true for large employers that offer self-insured health plans to their workers, since employers are generally responsible for HIPAA compliance for the self-insured health plans they sponsor.
McDermott+ Check-Up: January 10, 2025
THIS WEEK’S DOSE
119th Congress Begins. The new Congress began with key membership announcements for relevant healthcare committees.
Cures 2.1 White Paper Published. The document outlines the 21st Century Cures 2.1 legislative proposal, focusing on advancing healthcare technologies and fostering innovation.
Senate Budget Committee Members Release Report on Private Equity. The report, released by the committee’s chair and ranking member from the 118th Congress, includes findings from an investigation into private equity’s role in healthcare.
HHS OCR Proposes Significant Updates to HIPAA Security Rule. The US Department of Health & Human Services (HHS) Office for Civil Rights (OCR) seeks to address current cybersecurity concerns.
HHS Releases AI Strategic Plan. The plan outlines how HHS will prioritize resources and coordinate efforts related to artificial intelligence (AI).
CFPB Removes Medical Debt from Consumer Credit Reports. The Consumer Financial Protection Bureau (CFPB) finalized its 2024 proposal largely as proposed.
President Biden Signs Several Public Health Bills into Law. The legislation includes the reauthorization and creation of public health programs related to cardiomyopathy, autism, and emergency medical services for children.
CONGRESS
119th Congress Begins. The 119th Congress began on January 3, 2025. Lawmakers reelected Speaker Johnson in the first round of votes and adopted the House rules package. The first full week in session was slow-moving due to a winter storm in Washington, DC; funeral proceedings for President Jimmy Carter; and the certification of electoral college votes. Committees are still getting organized, and additions to key health committees include:
House Energy & Commerce: Reps. Bentz (R-OR), Houchin (R-IN), Fry (R-SC), Lee (R-FL), Langworthy (R-NY), Kean (R-NJ), Rulli (R-OH), Evans (R-CO), Goldman (R-TX), Fedorchak (R-ND), Ocasio-Cortez (D-NY), Mullin (D-CA), Carter (D-LA), McClellan (D-VA), Landsman (D-OH), Auchincloss (D-MA), and Menendez (D-NJ).
House Ways & Means: Reps. Moran (R-TX), Yakym (R-IN), Miller (R-OH), Bean (R-FL), Boyle (D-PA), Plaskett (D-VI), and Suozzi (D-NY).
Senate Finance: Sens. Marshall (R-KS), Sanders (I-VT), Smith (D-MN), Ray Luján (D-NM), Warnick (D-GA), and Welch (D-VT).
Senate Health, Education, Labor & Pensions: Sens. Scott (R-SC), Hawley (R-MO), Banks (R-IN), Crapo (R-ID), Blackburn (R-TN), Kim (D-NJ), Blunt Rochester (D-DE), and Alsobrooks (D-MD).
Congress has a busy year ahead. The continuing resolution (CR) enacted in December 2024 included several short-term extensions of health provisions (and excluded many others that had been included in an earlier proposed bipartisan health package), and these extensions will expire on March 14, 2025. Congress will need to complete action on fiscal year (FY) 2025 appropriations by this date, whether by passing another CR through the end of the FY, or by passing a full FY 2025 appropriations package. The short-term health extenders included in the December CR could be further extended in the next appropriations bill, and Congress also has the opportunity to revisit the bipartisan, bicameral healthcare package that was unveiled in December but ultimately left out of the CR because of pushback from Republicans about the overall bill’s size.
The 119th Congress will also be focused in the coming weeks on advancing key priorities – including immigration reform, energy policy, extending the 2017 tax cuts, and raising the debt limit – through the budget reconciliation process. This procedural maneuver allows the Senate to advance legislation with a simple majority, rather than the 60 votes needed to overcome the threat of a filibuster. Discussions are underway about the scope of this package and the logistics (will there be one reconciliation bill or two?), and we expect to learn more in the days and weeks ahead. It is possible that healthcare provisions could become a part of such a reconciliation package.
Cures 2.1 White Paper Published. Rep. Diana DeGette (D-CO) and former Rep. Larry Bucshon (R-IN) released a white paper on December 24, 2024, outlining potential provisions of the 21st Century Cures 2.1 legislative proposal expected to be introduced later this year. This white paper and the anticipated legislation are informed by responses to a 2024 request for information. The white paper is broad, discussing potential Medicare reforms relating to gene therapy access, coverage determinations, and fostering innovation. With Rep. Bucshon’s retirement, all eyes are focused on who will be the Republican lead on this effort.
Senate Budget Committee Members Release Report on Private Equity. The report contains findings from an investigation into private equity’s role in healthcare led by the leaders of the committee in the 118th Congress, then-Chair Whitehouse (D-RI) and then-Ranking Member Grassley (R-IA). The report includes two case studies and states that private equity firms have become increasingly involved in US hospitals. They write that this trend impacts quality of care, patient safety, and financial stability at hospitals across the United States, and the report calls for greater oversight, transparency, and reforms of private equity’s role in healthcare. A press release that includes more documents related to the case studies can be found here.
ADMINISTRATION
HHS OCR Proposes Significant Updates to HIPAA Security Rule. HHS OCR released a proposed rule, HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (ePHI). HHS OCR proposes minimum cybersecurity standards that would apply to health plans, healthcare clearinghouses, most healthcare providers (including hospitals), and their business associates. Key proposals include:
Removing the distinction between “required” and “addressable” implementation specifications and making all implementation specifications required with specific, limited exceptions.
Requiring written documentation of all Security Rule policies, procedures, plans, and analyses.
Updating definitions and revising implementation specifications to reflect changes in technology and terminology.
Adding specific compliance time periods for many existing requirements.
Requiring the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, but at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
Requiring notification of certain regulated entities within 24 hours when a workforce member’s access to ePHI or certain electronic information systems is changed or terminated.
Strengthening requirements for planning for contingencies and responding to security incidents.
Requiring regulated entities to conduct an audit at least once every 12 months to ensure their compliance with the Security Rule requirements.
The HHS OCR fact sheet is available here. Comments are due on March 7, 2025. Because this is a proposed rule, the incoming Administration will determine the content and next steps for the final rule.
HHS Releases AI Strategic Plan. In response to President Biden’s Executive Order on AI, HHS unveiled its AI strategic plan. The plan is organized into five primary domains:
Medical research and discovery
Medical product development, safety and effectiveness
Healthcare delivery
Human services delivery
Public health
Within each of these chapters, HHS discusses in-depth the context of AI, stakeholders engaged in the domain’s AI value chain, opportunities for the application of AI in the domain, trends in AI for the domain, potential use-cases and risks, and an action plan.
The report also highlights efforts related to cybersecurity and internal operations. Lastly, the plan outlines responsibility for AI efforts within HHS’s Office of the Chief Artificial Intelligence Officer.
CFPB Removes Medical Debt from Consumer Credit Reports. The final rule removes $49 billion in unpaid medical bills from the credit reports of 15 million Americans, building on the Biden-Harris Administration’s work with states and localities. The White House fact sheet can be found here. Whether the incoming Administration will intervene in this rulemaking remains an open question.
President Biden Signs Several Public Health Bills into Law. These bills from the 118th Congress include:
H.R. 6829, the HEARTS Act of 2024, which mandates that the HHS Secretary work with the Centers for Disease Control and Prevention, patient advocacy groups, and health professional organizations to develop and distribute educational materials on cardiomyopathy.
H.R. 6960, the Emergency Medical Services for Children Reauthorization Act of 2024, which reauthorizes through FY 2029 the Emergency Medical Services for Children State Partnership Program.
H.R. 7213, the Autism CARES Act of 2024, which reauthorizes, through FY 2029, the Developmental Disabilities Surveillance and Research Program and the Interagency Autism Coordinating Committee in HHS, among other HHS programs to support autism education, early detection, and intervention.
QUICK HITS
ACIMM Hosts Public Meeting. The HHS Advisory Committee on Infant and Maternal Mortality (ACIMM) January meeting included discussion and voting on draft recommendations related to preconception/interconception health, systems issues in rural health, and social drivers of health. The agenda can be found here.
CBO Releases Report on Gene Therapy Treatment for Sickle Cell Disease. The Congressional Budget Office (CBO) report did not estimate the federal budgetary effects of any policy, but instead discussed how CBO would assess related policies in the future.
CMS Reports Marketplace 2025 Open Enrollment Data. As of January 4, 2025, 23.6 million consumers had selected a plan for coverage in 2025, including more than three million new consumers. Read the fact sheet here.
CMS Updates Hospital Price Transparency Guidance. The agency posted updated frequently asked questions (FAQs) on hospital price transparency compliance requirements. Some of the FAQs are related to new requirements that took effect January 1, 2025, as finalized in the Calendar Year 2024 Outpatient Prospective Payment System/Ambulatory Services Center Final Rule, and others are modifications to existing requirements as detailed in previous FAQs.
GAO Releases Reports on Older Americans Act-Funded Services, ARPA-H Workforce. The US Government Accountability Office (GAO) report recommended that the Administration for Community Living develop a written plan for its work with the Interagency Coordinating Committee on Healthy Aging and Age-Friendly Communities to improve services funded under the Older Americans Act. In another report, the GAO recommended that the Advanced Research Projects Agency for Health (ARPA-H) develop a workforce planning process and assess scientific personnel data.
VA Expands Cancers Covered by PACT Act. The US Department of Veterans Affairs (VA) will add several new cancers to the list of those presumed to be related to burn pit exposure, lowering the burden of proof for veterans to receive disability benefits. Read the press release here.
HHS Announces $10M in Awards for Maternal Health. The $10 million in grants from the Substance Abuse and Mental Health Services Administration (SAMHSA) will go to a new community-based maternal behavioral health services grant program. Read the press release here.
Surgeon General Issues Advisory on Link Between Alcohol and Cancer Risk. The advisory includes a series of recommendations to increase awareness of the connection between alcohol consumption and cancer risk and update the existing Surgeon General’s health warning label on alcohol-containing beverages. Read the press release here.
SAMHSA Awards CCBHC Medicaid Demonstration Planning Grants. The grants will go to 14 states and Washington, DC, to plan a Certified Community Behavioral Health Clinic (CCBHC). Read the press release here.
HHS Announces Membership of Parkinson’s Advisory Council. The Advisory Council on Parkinson’s Research, Care, and Services will be co-chaired by Walter J. Koroshetz, MD, Director of the National Institutes of Health’s National Institute of Neurological Disorders and Stroke, and David Goldstein, MS, Associate Deputy Director for the Office of Science and Medicine for HHS’s Office of the Assistant Secretary for Health. Read the press release here.
NEXT WEEK’S DIAGNOSIS
The House and Senate are in session next week and will continue to organize for the 119th Congress. Confirmation hearings are expected to begin in the Senate for President-elect Trump’s nominees, although none in the healthcare space have been announced yet. On the regulatory front, CMS will publish the Medicare Advantage rate notice.
New Changes to ACA Reporting Requirements Offer Welcome Relief to Employers and Others
Four changes have been made to the employer reporting requirements under the Affordable Care Act (ACA) for 2025.[1] These changes aim to simplify the reporting processes for employers.
Form 1095 Distribution – Effective for the 2024 reporting year, employers are no longer required to distribute Form 1095-C to all full-time employees (and plan sponsors of self-insured plans do not have to distribute Form 1095-B to individuals[2]). Instead, these forms only need to be provided upon request. In order to avail yourself of this new rule, you must:
Post a notice of availability that is “clear, conspicuous and accessible notice (at such time and in such manner as the Secretary may provide).” While the IRS has been instructed to issue guidance as to how and when the notice must be distributed, no such guidance has been issued as of the date of this alert.
Upon receipt of an employee request, distribute the form within 30 days or, if later, by January 31. Electronic distribution is permitted if the employee consents (which is valid until withdrawn in writing).
Employers must still prepare and file Forms 1095-C and 1095-B with the IRS eachyear (generally due to be filed with the Form 1094-C/1094-B transmittal form byMarch 31).
Reporting for Self-Insured Plans – Effective for the 2024 reporting year, employers and plan sponsors issuing Form 1095-C for self-insured plan coverage of spouses and dependents can use the individual’s full name and date of birth if their social security number (SSN) or other taxpayer identification number (TIN) cannot be obtained. This change eases the burden on employers who have experienced problems obtaining the necessary TIN from nonresident aliens with no SSN or TIN. The new rule avoids the need for employers to establish reasonable cause before they are able to use a date of birth.
Longer Response Time for ACA Penalty Letters – Employers who receive a Letter 226J from the IRS proposing assessment of employer shared responsibility payments under Section 4980H of the Internal Revenue Code (“ACA Penalties”) will now have 90 days to respond. This is an increase from the prior 30-day window, which often left employers without sufficient time to review and address issues. This new time limit applies to assessment proposed in taxable years beginning after December 23, 2024 (for calendar year plans, this would be 2025).
6-Year Statute of Limitations for ACA Penalties – A new 6-year statute of limitations will apply to the IRS’ assessment of ACA Penalties. This new time limit runs from the due date for the return (or the return filing date, if later) and applies to returns due after December 31, 2024. Previously, the IRS took the position there was no statute of limitations.
It is important to note that these changes only impact employers’ reporting requirements under federal law. Several states have their own reporting requirements (e.g., CA, MA, NJ, RI, D.C.), so employers will need to continue to comply with those state laws, where applicable.
Action Steps
In light of these changes, employers and plan sponsors with ACA reporting responsibilities should consider taking the following steps:
1. Update Processes and Post Notice. If you want to take advantage of the new exemption from distributing Forms 1095-C (or Forms 1095-B, where applicable):
Draft and post your notice of availability of Form 1095-C (or Forms 1095-B, where applicable). If you wish to post a notice before the IRS guidance is issued, you should consider following prior IRS guidance that was issued to address similar notice provisions that apply to Form 1095-Cs issued by reporting entities to covered nonemployees and non-full-time employees. Under this prior guidance, the notice must be posted prominently in a location on the reporting entity’s website that is reasonably accessible to all individuals who would be entitled to receive the form and must be retained in that same location through October 15 following the calendar year for which the statement was issued (or, if October 15 is a Saturday, Sunday or legal holiday, the next business day). The notice must state that the individual may obtain a copy upon request, include an email address and physical address to which the request may be submitted, and provide a telephone number for any questions. Even if you follow this prior guidance, however, you should still stay alert for IRS guidance that specifically applies to the current rule and act quickly to make any changes to your notice or its posting to the extent necessary to achieve full compliance.
Check with any vendors that you use to prepare your ACA reporting and update any existing processes as necessary, including the need to annually post the notice and keep it posted for the required time period.
Establish a process for timely responding to requests to obtain a copy of the form and, if you want to be able to provide the form electronically, draft a valid consent form.
2. Continue to Prepare and File Forms 1095-C and 1095-B with the IRS. Remember that you still have an obligation to file these statements with the IRS, with the required transmittal form (generally due by March 31).
3. Obtain Full Names and Dates of Birth. If you sponsor a self-insured plan and anticipate that you may have covered individuals who do not have a SNN or TIN, adopt procedures to obtain full names and dates of birth.
[1] These changes were part of the recently enacted Employer Reporting Improvement Act and the Paperwork Burden Reduction Act.
[2] The exemption for Forms 1095-B already existed under IRS guidance, but is now made part of the law.
Delaware Bankruptcy Court Denies Healthcare Debtors’ Request to Enter into Nonbinding Commitment Letter (US)
The goal of a sale process under section 363 of the United States Bankruptcy Code is for a debtor to maximize the value of estate property for the benefit of all parties-in-interest. But what happens when the only party that is interested in purchasing the estate property is a former insider who is unwilling to submit a binding offer without certain bid protections, such as a breakup fee and expense reimbursement? This is the predicament that the Bankruptcy Court for the District of Delaware (the “Bankruptcy Court”) recently faced, ultimately denying such protections without prejudice. The decision serves as a helpful reminder of how debtors should conduct a bidding process, evaluate bids, and what terms interested parties should expect a bankruptcy court to find improper.
Background
Between September 19, 2023, and October 20, 2023, UpHealth Holdings, Inc. and six of its affiliates (collectively, “UpHealth”) filed chapter 11 bankruptcy petitions in the Bankruptcy Court. On July 17, 2024, UpHealth filed a bidding procedures motion to market, auction, and sell its equity interests in a non-debtor subsidiary, TTC Healthcare, Inc. (“TTC”), which provides behavioral inpatient and outpatient treatment programs and was previously referred to as UpHealth’s “crown jewel.” However, UpHealth had no stalking horse bidder for TTC, so it enlisted the help of its investment banker to market TTC’s equity. The Bankruptcy Court approved the bidding procedures motion on August 6, 2024.
NewCo’s Commitment Letter
Unfortunately, despite contacting over 150 prospective buyers and executing 50 non-disclosure agreements, UpHealth only reported one meaningful indication of interest (the “Commitment Letter”) before the September 12, 2024, bid deadline. The Commitment Letter was from a newly organized special purpose acquisition entity (“NewCo”) formed by UpHealth’s former CEO and TTC’s former chairman, Martin S.A. Beck, and Freedom 3 Capital. NewCo proposed to purchase TTC’s equity for a cash purchase price of $11 million.
Unlike a traditional qualified bid to purchase a debtor’s marketed assets under section 363 of the Bankruptcy Code, NewCo’s Commitment Letter was not a binding commitment. Instead, the Commitment Letter stated that NewCo’s “goal is to execute a definitive share purchase agreement,” and contained the following terms:
Exclusivity Period: For up to four weeks after execution of the Commitment Letter, UpHealth and TTC shall not solicit, discuss, negotiate, facilitate any submission of a proposal, or consummate any agreement related to TTC’s equity with any other party other than with NewCo.
Right of First Refusal “ROFR”: NewCo has the right of first refusal related to any competing bid UpHealth receives for TTC’s equity during the Exclusivity Period.
Prior Approval: Before executing any definitive share purchase agreement, Freedom 3 Capital must first obtain final approval from its Investment Committee.
Breakup Fee: $750,000.
Expense Reimbursement: $500,000 cap.
On September 22, 2024, UpHealth filed a supplement to its bidding procedures motion requesting that the Bankruptcy Court authorize UpHealth to enter into, and perform under, the Commitment Letter and for the Commitment Letter to be binding on UpHealth (the “Private Sale Supplement”).
U.S. Trustee’s Objection to Private Sale Supplement
On October 7, 2024, the United States Trustee (the “U.S. Trustee”) objected to the Private Sale Supplement. In its objection, the U.S. Trustee argued that the breakup fee and expense reimbursement are (i) a “poison pill” meant to “chill the bidding process,” (ii) “value-destructive to the estates,” and (iii) “serve as a penalty against [UpHealth] for evaluating any other late materializing interest.” Moreover, the objection cited Third Circuit caselaw in support of the position that breakup fees are only allowable when such fees are “necessary to preserve the value of the estate” and an inducement for a party to negotiate an agreement, conduct due diligence, and submit a bid. In this case, the U.S. Trustee asserted that no such inducement was necessary because (i) the marketing process for TTC’s equity concluded with “no other actionable proposals identified” by UpHealth, and (ii) as TTC’s former chairman and UpHealth’s former CEO, Mr. Beck, “did not need to undertake any due diligence to make a bid, did not need an incentive to make a bid, and does not need expense reimbursement.”
Denial of Private Sale Supplement
At the October 9, 2024 hearing, the Bankruptcy Court denied UpHealth’s proposed Private Sale Supplement. Siding with the U.S. Trustee, the Bankruptcy Court found the breakup fee, expense reimbursement, Exclusivity Period, and ROFR “too rich” for an “uncommitted” indication of interest subject to further diligence.
Specifically, the Bankruptcy Court stated that it had not seen a “no shop” provision, i.e., the Exclusivity Period and ROFR, since the 1980s and did not understand why such provision was necessary. Moreover, the Bankruptcy Court noted that Mr. Beck’s Commitment Letter was “problematic” from a “bankruptcy court systemic perspective,” given Mr. Beck’s status as a former insider. Accordingly, the Bankruptcy Court concluded that UpHealth had not demonstrated that the Commitment Letter’s bid protections were necessary to preserve the value of the estates, declined to approve such protections, and noted that the parties could come back to seek approval of the bid protections after NewCo signs a definitive agreement or there is an alternative transaction.
On November 29, 2024, NewCo notified UpHealth that it was discontinuing its efforts to purchase TTC and no sale of TTC or any portion thereof was consummated, resulting in TTC’s operations being shut down.
Takeaways
This decision demonstrates the limitations of nonbinding bids to purchase estate property. Receiving no offers for assets that were formerly referenced as an estate’s “crown jewel” is disappointing to say the least. Although it is unclear why NewCo’s bid was not binding, it is possible that after a dismal marketing process, Mr. Beck, as TTC’s former chairman, agreed to publicly disclose an indication of interest in the hope of encouraging at least some of the 50 parties that executed non-disclosure agreements to reconsider whether to submit a bid. Not only would a binding bid liquidate one of UpHealth’s remaining assets, but it would also likely produce a public benefit by keeping a treatment facility open for its patients who may not have access to alternative healthcare services. Indeed, the continuation of TCC as a going concern is likely far superior to the alternative—liquidation and reduced healthcare services to the impacted community. As a court of equity, this is likely one factor the Bankruptcy Court considered before denying UpHealth’s requested relief.
Regardless of the parties’ intent, and notwithstanding potential public health benefits, future debtors can take heed that a court will not likely approve the entry of an order allowing a debtor to enter into a nonbinding commitment letter that (i) is contingent on further diligence and third-party approval, (ii) is from a former insider that does not need to conduct diligence, (iii) stems from a bidding process where no party submitted a bid for the assets, and (iv) when the case is over one year old, there is no conceivable need to rush the process, and the parties-in-interest can afford to grant a prospective bidder more time.
Moreover, even if the Commitment Letter had been binding, the Bankruptcy Court took issue with NewCo’s requested bid protections, the Exclusivity Period, and ROFR. First, when requesting bid protections, especially if the bidder is a former insider, the bidder should ensure that the breakup fee and expense reimbursements are arguably “necessary to preserve the value of the estate” and a percentage of the purchase price that aligns with recent comparable sales. Potential bidders and debtors should question whether the protections are necessary on account of the interested party’s diligence and negotiation expenses, or if the party will incur minimal expenses. Furthermore, bidders should be thoughtful before incorporating an Exclusivity Period or ROFR, as such provisions may be scrutinized by a court, especially in the context of a non‑binding bid.
Massachusetts Governor Maura Healey Signs into Law a Sweeping Health Care Market Oversight Bill
On January 8, 2025, Massachusetts Governor Maura Healey signed into law House Bill No. 5159, “An Act enhancing the health care market review process” (“H. 5159”), which was passed by the Massachusetts legislature in the last few days of 2024.
The bill will implement greater scrutiny of certain health care entities and affiliated companies—including private equity sponsors, significant equity investors, health care real estate investment trusts (“REITs”), and management services organizations (“MSOs”)—as well as pharmaceutical companies and pharmacy benefit management companies (“PBMs”) in the Commonwealth.
The passage of H. 5159 follows debate between the House and Senate earlier in 2024 over similar bills, which failed to pass during the summer legislative session. Notably, similar bills included debt limitations on certain private investor-backed entities and bans of certain private equity investments, as well as significant restrictions on the MSO business model. However, these restrictions (among various others) were stripped from H. 5159.
Although H. 5159 has widespread implications for health care entities in the Commonwealth, a significant portion of the bill is clearly aimed at increasing regulatory oversight of for-profit-backed health care organizations through increased regulatory oversight of certain health care transactions and expanded reporting obligations. The bill also seeks to contain health care costs, including by increasing oversight of pharmaceutical company and PBM arrangements.
Below in this alert we highlight some of the more significant provisions of H. 5159.
Health Policy Commission – Notices of Material Change
H. 5159 extends the authority of the Health Policy Commission (“HPC”) in the context of notices of material change under M.G.L. c. 6D § 13 (“Notices of Material Change”) to indirect owners and affiliates of health care providers, such as private equity companies, significant equity investors, MSOs, and health care REITs.
The bill also broadens the transactions that are subject to the HPC’s Notice of Material Change requirements to include (i) significant expansions in capacity of a provider or provider organization; (ii) transactions involving a significant equity investor resulting in a change of ownership or control of a provider or provider organization; (iii) real estate sale lease-back arrangements and other significant acquisitions, sales, or transfers of assets; and (iv) conversions of a provider or provider organization from a non-profit to a for-profit.
In the context of the HPC’s review of a Notice of Material Change, the HPC will be authorized to require the submission of documents and information from significant equity investors, such as information regarding the significant equity investor’s capital structure, financial condition, ownership and management structure, and audited financials.
H. 5159 also implements other related changes, such as reducing the market share threshold for mergers or acquisitions to be subject to the Notice of Material Change process (from “near majority” to “dominant” market share), enhancing the HPC’s authority to monitor post-transaction impacts, and expanding the review criteria for a cost and market impact review.
Health Policy Commission – Registration of Provider Organizations
Under H. 5159, the data and information collected under the HPC’s Massachusetts Registration of Provider Organizations Program (“MA-RPO Program”) will now also cover ownership, governance, and operational structure information of significant equity investors, health care REITs, and MSOs. H. 5159 also amends the MA-RPO Program reporting threshold to include revenue generated from payers other than commercial payers, such as governmental payers.
Health Policy Commission – Annual Cost Trends Hearing
As a complement to the increased authority discussed above, the list of stakeholders required to testify at the HPC’s Annual Cost Trends Hearing is expanded to include, among others, significant equity investors, health care REITs, and MSOs as well as PBMs and pharmaceutical companies.
Testimony from significant equity investors, health care REITs, and MSOs must cover topics such as health outcomes, prices, staffing levels, clinical workflow, financial stability and ownership structure of associated providers or provider organizations, dividends paid out to investors, and compensation (e.g., base salaries, incentives, bonuses, stock options, deferred compensation, benefits, and contingent payments to officers, managers, and directors of provider organizations owned or managed by the significant equity investors, health care REITs, or MSOs.
Testimony from PBMs and pharmaceutical companies must cover topics such as factors underlying drug costs and price increases as well as the impact of aggregate manufacturer rebates, discounts, and other price concessions on net pricing (provided that the testimony will not undermine the financial, competitive, or proprietary nature of the data).
H. 5159 further expands the topics covered by HPC’s Annual Cost Trends Hearings to expressly include costs, prices, and cost trends of providers, provider organizations, private and public payers, pharmaceutical companies, and PBMs as well as any impact of significant equity investors, health care REITS, or MSO on those costs, prices, and cost trends.
Health Policy Commission and CHIA – Operations Assessments
H. 5159 expands the categories of entities required to pay assessments to help fund the HPC and Center for Health Information and Analysis (“CHIA”) to include “non-hospital provider organizations,” pharmaceutical companies, and PBMs. A “non-hospital provider organization” is defined as any provider organization registered under the MA-RPO Program that is a non-hospital-based physician practice with annual gross patient service revenue of at least $500 million, a clinical laboratory, an imaging facility, or a network of affiliated urgent care centers. The methodology for calculating the amount assessed against each entity is based on entity type and the total amount appropriated by the Massachusetts legislature for the operation of HPC and CHIA.
CHIA – Reporting Requirements
Under H. 5159, CHIA will collect additional information from acute and non-acute care hospitals regarding their parent organizations and significant equity investors, health care REITs, and MSOs. Such information includes the audited financial statements of parent organizations’ out-of-state operations, significant equity investors, health care REITs, and MSOs, as well as financial data on margins, investments, and any relationships with significant equity investors, health care REITs, and MSOs.
H. 5159 also expands the scope of CHIA’s data collection under the MA-RPO Program. Notably, information subject to annual reporting will include, in relevant part, (i) comprehensive financial statements that include data on parent entities (including their out-of-state operations), corporate affiliates (including significant equity investors, health care REITs, and MSOs, as applicable), annual costs, annual receipts, realized capital gains and losses, accumulated surplus, and accumulated reserves; and (ii) information regarding other assets and liabilities that may affect the financial condition of the provider organization or the provider organization’s facilities (e.g., real estate sale-leaseback arrangements with health care REITs).
H. 5159 further provides that CHIA may require in writing, at any time, such additional information as CHIA deems reasonable and necessary to determine a registered provider organization’s organizational structure, business practices, clinical services, market share, or financial condition, including information related to its total adjusted debt and total adjusted earnings.
CHIA will also have the authority to require registered provider organizations with private equity investment to report required information on a quarterly basis and require disclosure of relevant information from any significant equity investor associated with a registered provider organization. CHIA may also assess increased penalties for non-compliance with these reporting requirements.
Acute and non-acute care hospitals and registered provider organizations should note that, pursuant to M.G.L. c. 12C § 17, the Massachusetts Attorney General (“AG”) may review and analyze any information submitted to CHIA under M.G.L. c. 12C §§ 8, 9, and 10. Thus, the AG may review and analyze all information regarding significant equity investors, health care REITs, and MSOs submitted to CHIA under H. 5159’s expanded reporting requirements.
Department of Public Health (“DPH”) – Determinations of Need
With exceptions, existing Massachusetts law forbids entities from making substantial capital expenditures for the construction of a health care facility or substantially changing the service of the facility unless DPH has approved a determination of need application (“DON”). H. 5159 expands and clarifies DPH considerations in reviewing a DON. These include (i) the state health resource plan; (ii) the Commonwealth’s cost containment goals; (iii) the impacts on the applicant’s patients, including considerations of health equity, the workforce of surrounding health care providers and on other residents of the commonwealth; and (iv) any comments and relevant data from CHIA and the HPC, and any other state agency. H. 5159 codifies a current DPH regulation allowing the period of time DPH has to review a DON to toll if an independent cost-analysis is required and clarifies the effective date of a determination of need issued to holders subject to cost and market impact reviews and/or performance improvement plans. Finally, the legislation adds that a party of record may review a DON for which it is appropriately registered and provide written comment or specific recommendations for consideration by DPH.
Department of Public Health – Licensure of Acute-Care Hospitals
H. 5159 adds provisions to the licensure process of acute-care hospitals, mandating that no original license shall be granted or renewed to establish or maintain such facilities if the main campus of the acute-care hospital is leased from a health care REIT (with an exemption for those acute-care hospitals leasing a main campus from a health care REIT as of April 1, 2024). An exempt acute-care hospital shall remain exempt “after a transfer to any transferee and subsequent transferees,” and those transferees shall be issued a license upon meeting all other requirements. “Main campus” is defined in H. 5159 as “the licensed premises within which the majority of inpatient beds are located.” Additional new licensure requirements for acute-care hospitals mandate the disclosure of documents to DPH relating to leases, licenses, or other agreements for the use, occupancy, or utilization of the premises occupied by the acute-care hospital. Acute-care hospitals also must remain in compliance with applicable reporting requirements.
Department of Public Health – Licensure of Office-Based Surgical Centers
H. 5159 mandates that DPH, in consultation with the Massachusetts Board of Registration in Medicine, establish rules, regulations, and practice standards for the licensing of office-based surgical centers by October 1, 2025. Such licensure will be effective for an initial period of two years and subject to renewal. Pursuant to H. 5159, DPH may impose a fine of up to $10,000 on (1) a person or entity advertising, announcing, establishing, or maintaining an office-based surgical center without a license and (2) a licensed office-based surgical center that violates DPH’s forthcoming rules and regulations. Each day during which a violation continues will constitute a separate offense, and DPH may conduct surveys and investigations to enforce compliance. Notwithstanding the foregoing, H. 5159 permits DPH to grant a one-time provisional license to applicant office-based surgical centers if such applicants hold a (1) current accreditation from the Accreditation Association for Ambulatory Health Care, American Association for Accreditation of Ambulatory Surgery Facilities, or the Joint Commission; or (2) current certification for participation in Medicare or Medicaid, and DPH determines that such applicants meet all other licensure requirements.
Attorney General’s Office – False Claims Statute
H. 5159 amends the Massachusetts False Claims Statute to extend potential liability to those with an “ownership or investment interest” in an entity that violates the statute, if such owner or investor knows of the violation and fails to disclose it to the Commonwealth within 60 days of identifying the violation. As a result, the AG has broadened authority to pursue actions against private equity companies and other owners or investors for not addressing a violation of the False Claims Act of which they are aware, regardless of whether the private equity company or other owner or investor caused the violation. Notably, the definition of “ownership or investment interest” captures significant equity investors, as defined elsewhere in the bill, as well as private equity companies with any investment or ownership interest in an entity that violates the statute.
Primary Care Payment and Delivery Task Force
H. 5159 also establishes a 23-member primary care payment and delivery task force (“Task Force”) charged with (i) studying primary care access, delivery, and payment; (ii) developing and issuing recommendations to stabilize and strengthen the primary care system and increase recruitment and retention of primary care workers; and (iii) increasing investment in, and patient access to, primary care in the Commonwealth.
Among other recommendations, the Task Force must create a primary care spending target for private and public payers that takes into account the cost to deliver evidence-based, equitable, and culturally competent primary care services and propose payment models to increase private and public reimbursement for primary care services.
The bill requires the Task Force to issue its first recommendations by September 15, 2025, and requires recommendations to be issued in a sequential manner thereafter, through May 15, 2026.
Takeaways
The true impact of H. 5159 will depend in large part on the regulatory bodies tasked with enforcement and implementation of its provisions. Importantly, we expect that HPC, which has been petitioning the legislature for greater oversight authority over the past several years to review private equity health care investments in Massachusetts, will play a central role in determining the level of scrutiny for-profit investors in hospital systems and provider organizations will face moving forward.
Ann W. Parks contributed to this article
Solo Aging: Planning for Your Best Life
More and more of the clients I see lately are solo agers. A recent study found that 34 percent of older adults do not have a spouse, significant other or children who can provide their care. Although historically children and close relatives were the primary support for aging adults, there are many ways to fill that gap. Whether through informal networks of friends and “found” families, or through the guidance of professionals like our firm, it is important to plan.
When you live alone, you need to plan for aging differently than someone who is married or has a life-partner. In most instances, those with a partner can rely on them to help out with expenses and be a caregiver, if they should become ill. However, when you are single, especially if you do not have close family, you need to plan in advance and you need to plan better.
Most important of all: make sure that decisions about your health and well-being are made the way you want them to be made, if there comes a time you are not able to make them for yourself. That means picking a person you trust and giving them everything they need to act on your behalf. Your surrogate needs to know about your finances, your health information, your values and goals, so they can step into your shoes.
New Jersey law provides several tools to allow individuals to plan for their future and legacy wishes. In addition to a Will, POA, and health proxy, revocable trusts and health care instruction directives can be very useful for directing your surrogate as to how and where you want to be cared for if you need long term care. Solo agers will be best served if they think beyond basic formulaic legal documents. Because New Jersey does not have required statutory forms, estate planning documents can build in protections against financial exploitation such as trust protectors or advisors, POA monitors or tie-breakers, or trusted contacts. A POLST (Practitioner Order on Life Sustaining Treatment) is another great tool in New Jersey to ensure your treatment wishes are followed. Because it is a medical order, it is more likely to be honored than a Living Will. New Jersey also allows individuals to name a Funeral Representative in their Wills which can be essential for those who want to designate someone other than their next of kin to handle their arrangements.
Getting estate planning documents completed is important but it is not the only thing to consider. You need a care plan which addresses emergencies as well as a financial plan. You may want to consider long term care insurance. Someone turning 65 has a nearly 70% chance of needing long-term care in their remaining years. Solo agers are more likely to need to rely on paid professional caregivers. It’s important to consider your options for care before you need it. You also should discuss these issues with your friends or family who you have nominated to make decisions for you, so they know your wishes. No one likes to think about these issues, but studies show that individuals who have not created a care plan and designated a surrogate often end up receiving care they did not want and are more likely to end up in an institutional setting.
There are a growing array of resources and options available to individuals who are ready to put together an aging life care plan and a team to support them along the way. Being proactive will give you the peace of mind to know you do not have to face aging and illness alone.
Federal Government Urges Court of Appeals to Uphold Constitutionality of FCA Qui Tam Provisions
Headlines that Matter for Companies and Executives in Regulated Industries
Federal Government Urges Court of Appeals to Uphold Constitutionality of FCA Qui Tam Provisions
In a brief filed earlier this week, the US federal government has urged the Eleventh Circuit Court of Appeals to uphold the constitutionality of the False Claims Act’s (FCA) qui tam provisions, challenging a Florida district court’s ruling that found them to be unconstitutional.
The appeal stems from an underlying case with relator Clarissa Zafirov, who filed a qui tam action in 2019 against several health care entities, accusing them of misrepresenting patient conditions to Medicare. While the government initially declined to intervene, it later elected to defend the constitutionality of the FCA’s provisions.
At the district court level, the court found that whistleblowers are officers of the United States and must be appointed according to the appointments clause, leading to the dismissal of Zafirov’s suit. Per the government’s appellate brief, the district court decision is an “outlier ruling” that contradicts US Supreme Court precedent. The government specifically pointed to the decision in Vermont Agency of Natural Resources v. United States ex rel. Stevens, 529 US 765 (2000), in which the Supreme Court held that the FCA’s qui tam provisions are consistent with Article III and argued that this makes clear that relators do not exercise executive power when they sue under the Act. Instead, relators are “pursuing a private interest in the money they will obtain if their suit prevails.” As such, they do not exercise executive power and do not require appointment under the appointments clause.
The government further emphasized that qui tam actions are subject to government oversight and cannot proceed without the government’s decision on intervention. Accordingly, the federal government now seeks to reverse the district court’s decision and has urged the Eleventh Circuit Court of Appeals to maintain the established legal framework supporting whistleblower actions under the FCA.
The case is Clarissa Zafirov v. Florida Medical Associates LLC et al., Nos. 24-13581 and 24-13583, in the US Court of Appeals for the Eleventh Circuit. The government’s appellate brief is available here.
Community Health Network Reaches Third FCA Settlement in 10 Years, Agreeing to Pay $135 Million to Resolve Outstanding Claims
In a deal reached two years after the Indiana health care system agreed to pay $345 million to settle FCA allegations with the federal government, Community Health Network has now agreed to pay $135 million to resolve federal health care fraud claims brought by its former chief financial officer.
Over 10 years ago, in 2014, Community Health CFO and COO Thomas Fischer filed a lawsuit under the FCA’s qui tam provisions, alleging that Community Health overpaid physicians to secure referrals in violation of state and federal laws, including the federal Stark Law and Anti-Kickback Statute (AKS). Per the complaint, Community Health utilized an “aggressive strategy” to grow its physician network and garner referrals, including the recruitment of doctors by providing payment in excess of the market rate through large base salaries and sizable bonuses, among other means.
The US Department of Justice (DOJ) elected to intervene in the case. The $345 million settlement addressed some of Fischer’s claims, leaving others unresolved. In 2020, the district court allowed Fischer to file an amended complaint that asserted additional FCA claims separate from those pursued by the government. This latest settlement with Community Health resolves those remaining claims. Among other things, the deal resolves claims that (1) Community Health paid above fair-market value rent to a physician-owned real estate partnership to induce those doctors to refer patients to a Community Health-owned ambulatory surgical center in violation of the AKS, and (2) Community Health overpaid physicians employed by the organization and also by an independent oncology group that contracted exclusively with the health nonprofit.
Notably, Community Health additionally reached a $20.3 million settlement with the DOJ in 2015 to resolve civil allegations that the health nonprofit submitted false claims to Medicare and Medicaid programs. All told, Community Health has now paid more than half a billion dollars to resolve three FCA matters over the past 10 years. Nonetheless, Community Health has emphasized that all claims were resolved with no finding of wrongdoing, and the issues were unrelated to the quality or appropriateness of the health care provided by Community Health to its patients.
The case is US and State of Indiana ex rel Fischer v. Community Health Network, Inc., et al., Case No. 1:14-cv-1215, in the US District Court for the Southern District of Indiana.
The DOJ’s press release on the 2015 $20.3 million settlement is available here. The DOJ’s press release on the 2023 $345 million settlement is available here.
Athira Pharma Inc. Agrees to Pay Over $4 Million to Settle FCA Allegations
Athira Pharma Inc., based in Bothwell, Washington, has agreed to pay $4,068,698 to settle allegations that it violated the FCA.
Per the DOJ, this settlement will resolve allegations that, between January 1, 2016, and June 20, 2021, Athira failed to report allegations of research misconduct regarding grant applications and grant award progress reports and assurances to both the National Institutes of Health (NIH) and the US Department of Health and Human Services (HHS) Office of Research Integrity. The alleged misconduct included that Athira’s former CEO, Leen Kawas, falsified and manipulated scientific images in her doctoral dissertation and in published research papers that were referenced in several grant applications submitted to NIH, including in a grant that NIH funded in 2019.
Notably, Athira immediately notified NIH of the research misconduct after the full board of directors learned of it. Underscoring the significance of cooperation credit, the DOJ noted specifically that “the company’s transparency significantly helped Athira mitigate its damages and demonstrated its resolve towards coming into compliance with the relevant law and regulations.”
The settlement additionally resolves claims brought under the FCA’s qui tam provisions, with whistleblower Andrew P. Mallon, Ph.D., receiving $203,434.
The DOJ’s press release is available here.
Iron Man 2 Actor Sentenced for COVID-19 Scam
Earlier this week, Keith Lawrence Middlebrook, a bodybuilder and actor known for his role in Iron Man 2, was sentenced to over eight years in prison for attempting to defraud investors by falsely claiming he had discovered a cure for COVID-19 and that National Basketball Association legend Magic Johnson was a major investor.
Middlebrook was arrested in March 2020, becoming the first person in the United States charged with a COVID-19-related scam. The case included recorded calls with an undercover FBI agent where Middlebrook claimed his treatments could generate significant profits. Middlebrook’s scheme involved promoting fake COVID-19 treatments and soliciting investments through social media and other channels, falsely claiming Johnson’s involvement to lend credibility.
The recent sentencing follows a guilty verdict on all 11 counts of wire fraud faced by Middlebrook, rendered by a 12-person jury after a three-day trial. During sentencing, and among other things, Middlebrook denied any wrongdoing and claimed to have a relationship with Johnson, who testified that he did not recall meeting Middlebrook. While video evidence showed Middlebrook and Johnson at the same event, the court was unmoved by the defense counsel’s suggestion at trial that Johnson gave false testimony. Specifically, the court noted that it was “inconceivable” that Johnson would have forgotten some of the lengthy interactions that Middlebrook had alleged occurred between them.
In the end, the court’s sentence of 98 months aligned with the sentence sought by the prosecutors.
The case is USA v. Keith Middlebrook, No. 2:20-cr-00229, in the US District Court for the Central District of California.