The Healthcare Law Review: USA


i Overview of the US healthcare system

The US healthcare industry remains at a crossroads. The healthcare reform legislation passed under President Barack Obama in 2010, officially called the Patient Protection and Affordable Care Act (ACA) but widely referred to in the United States as 'Obamacare', resulted in significant changes in the US healthcare system. These changes included a dramatic expansion in the number of insured patients, contributing to increased demand for services. Many of these newly insured are covered by the joint state-federal Medicaid programme, which generally covers low-income patients as an entitlement programme, and reimburses at the lowest rates in most markets. However, the ACA has created a number of challenges for the US healthcare system as well, owing to both increased demand driven by newly insured patients and a view by many providers that the rates paid by many payers for healthcare services are inadequate.

After four years of Donald J Trump as US President, the future of the US healthcare system remains uncertain. Trump, a Republican, campaigned on a promise to 'repeal and replace' the ACA legislation. Although his administration's efforts to completely repeal the law failed, his efforts significantly weakened the programme. Most significantly, the tax reform legislation passed at the end of 2017 repealed the 'individual mandate' to purchase health insurance, a cornerstone of the ACA (see Section II.iii). Most recently, in a US Supreme Court case (California v. Texas) the Trump administration argued that the ACA was only constitutional under the taxing power and that because the individual mandate was repealed, the entire legislation is invalid. However, the Court sidestepped the substance of this argument and instead held that the plaintiffs had no standing to bring the case because, as the tax was repealed, they lacked any type of injury.

Despite Trump and Republicans' attempt to weaken if not destroy the programme, the focus of US politics has shifted since the election of President Joe Biden in the 2020 presidential election. Biden was Vice President to Barack Obama, who signed the ACA into law and a vocal supporter of the ACA since its inception. Biden's healthcare platform centres on protecting and expanding the ACA, particularly in furthering the ACA's goal of increasing access to health insurance and affordable healthcare. Biden's platform includes plans to create a public health insurance option like Medicare, provide families with premium tax credits to make coverage more affordable, and double down on high pharmaceutical prices. Within his first 100 days in office, Biden and his administration began rolling back certain Trump-era policies, such as Medicaid waivers granted to states intending to impose work requirements as a condition of Medicaid enrolment, the 'gag rule' restricting grantees of the Title X family planning programme from referring patients to abortion providers, and various restrictive methodologies and procedures of the insurance and exchange enrolment processes.

The debates over the US healthcare system have been further exacerbated by the 2020 coronavirus (covid-19) global pandemic, the greatest challenge the US healthcare system has faced in decades. The US quickly became the covid-19 capital of the world, with the most infected individuals and reported deaths of any country at the time of publication.2 In the US, the covid-19 pandemic took the largest toll on older Americans, resulting in a wave of infections and deaths in nursing homes and long-term care facilities across the country.3 While many dedicated healthcare providers, emergency service personnel, and essential workers quickly engaged in covid-19 relief efforts, the federal government failed to contain the pandemic, and left the 50 states to design their own strategies for containing the virus. State responses varied along political lines, with governors aligned with Trump following his lead of downplaying the virus, and those in 'blue states' adopting more restrictive policies of 'social distancing'.

The devastation from covid-19 is unmatched in the last century, and the federal government's failed response is easily comparable to the HIV/AIDS epidemic of the 1980s.4 At that time, President Ronald Reagan failed to take quick action to respond to the crisis, including failing to provide the Centers for Disease Control and Prevention (CDC), the federal agency charged with protecting the nation's health, with adequate funds to respond to the epidemic, and failing to publicly discuss the disease until four years after its emergence.5 Instead, President Reagan's Administration advanced a narrative of fear and divisiveness, laughing off AIDS as the 'gay plague' and causing Americans across the country to fear homosexual members of their communities.6

Trump's response to covid-19 is equally as disappointing as Reagan's treatment of the AIDS epidemic. Trump quickly branded covid-19 the 'China virus' and the more racist-termed 'Kung Flu', falsely claimed that the disease was under control in the US, refused to wear a protective facial covering, advocated for slowing testing down to reduce evidence of the prevalence of the virus, promoted public gatherings for his campaign and convention without social distancing, and failed to take a strong stance against states' decisions to reopen communities and businesses during the peak of the epidemic. The administrative agencies responding to the crisis under Trump's leadership failed to contain the virus. The CDC failed to take necessary measures to understand covid-19's spread by maintaining control of all diagnostic testing at a time when widespread testing was needed, and by developing faulty test kits.7 Moreover, Trump significantly restricted the CDC's capability to respond to a potential pandemic prior to the covid-19 outbreak by removing CDC officers who had been stationed in China, rendering the US response to covid-19 even more delayed.8

Since Biden has held the presidency, there has been a significant change in the response to the pandemic. In particular, the nationwide rollout of covid-19 vaccination programmes has resulted in decreases in the spread of covid-19 as well as its mortality rate, which has allowed most if not all states to relax restrictions and regain control of the outbreak. However, the full impact of the pandemic has yet to be determined.

Notwithstanding these challenges, prior to the covid-19 pandemic, the US healthcare system experienced a period of sustained growth of approximately 6 per cent per year over the past several years. The authors expect this pattern to resume once the pandemic is under control. This growth has been coupled with a trend towards consolidation in recent years, which has only intensified due to the increasing difficulty for independent hospitals and medical groups to survive. As a result of these trends, healthcare presents an attractive area for investment in the United States. This will further encourage consolidation, along with an increasing acceptance of for-profit buyers and investors by state regulators and local communities. Financial losses by hospitals in 2020 will accelerate this trend.

Another major trend in the US healthcare system is a drive towards value-based care and reducing costs in other ways. This has spurred the development of several alternative payment models, which intend to compensate providers based on the outcomes – or value – of the care they provide, rather than the volume of services. Government and private healthcare payers alike are increasingly turning towards these alternative payment models in an effort to reduce the overall costs associated with healthcare while improving the outcomes associated with such care. This trend has also resulted in increased scrutiny of certain aspects of the healthcare system that are some of the biggest cost drivers, such as drugs, and in novel ways of providing care, such as through telehealth services.

The following sections seek to put the larger healthcare services sector in the United States into context, focusing on these and other broad business and regulatory trends, while also understanding the organisational fundamentals.

ii Delivery of healthcare in the United States

Hospitals with inpatient, outpatient and diagnostic capacities are the 'work benches' for the delivery of healthcare in the United States, although the physicians and other professionals who treat patients there are critical parts of the care delivery system as well. Physicians are also sometimes referred to as the 'captains of the ship' in the hospital context, though other non-physician practitioners are gaining prominence in the institutional and community healthcare setting. Non-physician practitioners, sometimes called mid-level practitioners, include nurse practitioners, physician assistants, certified registered nurse anaesthetists, nurse midwives and others. These practitioners are licensed in their respective states by the state professional board, such as the medical board or the nursing board, or by the state department of health or another agency within the government.

To help ensure that patients are adequately protected from substandard care provided by deficient practitioners, hospitals and other healthcare facilities in the United States are required by law to perform 'peer review' and 'quality assurance' activities. Compliance with specific procedures required by these laws qualifies the organisation and its physicians who participate in peer review for immunity from liability under antitrust and certain other laws. Physicians and other practitioners who are disciplined and do not prevail in their hearings are listed on a nationwide databank that warns other institutions and prospective employers regarding a practitioner's professional shortcomings.

However, there is a growing trend towards services provided in other care settings, coupled with a drive towards lower costs. This has spurred on the presence and success of telehealth services, which may offer increased efficiency and also lower the total cost of care. These trends came into sharp relief in 2020 with the covid-19 pandemic pushing hospital capacities to care for infected patients, with some hospitals entirely full of covid-19 infected patients. Patients seeking care for other diagnoses turned quickly to alternative care models such as telehealth, or went without care entirely.

iii Payment for healthcare services

Healthcare services in the United States are paid for primarily by (1) government programmes such as Medicare and Medicaid and (2) private insurance organisations. These public and private organisations are collectively known as 'third-party payers' or simply 'payers'. Most third-party payer arrangements have some element of 'managed care', which means that care is provided subject to utilisation review, such as primary care physicians acting as gatekeepers to specialists. Managed care plans typically enter into contracts with providers to provide services at a discounted rate, sometimes in exchange for an expectation of increased volume from the payer. Government and private healthcare payers alike in the United States are increasingly focused on the value of services, which has contributed to the rapid expansion of alternative payment models that offer incentives to providers for better care outcomes, and in some cases penalise poor outcomes through reduced payments.

iv Regulation of healthcare

Because the government spends so much on Medicare, Medicaid and other programmes, it has taken aim at fraud and abuse and made concerted efforts to reduce provider misconduct and to recover funds inappropriately paid by these programmes. This regulation is carried out by a number of regulatory bodies. At the federal level, most laws affecting the structure and payment of healthcare are promulgated by the Centers for Medicare and Medicaid Services (CMS). The CMS is a division of the Department of Health and Human Services (HHS), which has a separate oversight arm – the Office of Inspector General (OIG). (Many state and federal agencies have inspectors general to oversee the operations and fight fraud within the agencies.)9 The OIG fights fraud, abuse and other forms of waste in government healthcare programmes and provides oversight by carrying out audits, investigations, and evaluations and develops resources for the healthcare industry.

At the state level, state government agencies oversee issues such as Medicaid rules and payment requirements along with provider licensing, and often also enforce state-level versions of some of the major federal compliance rules and regulations. This two-tiered structure creates a complicated patchwork of healthcare laws, often with significant variations among the 50 states and the District of Columbia.

The healthcare economy

i General

The US healthcare industry is one of the most closely watched and fastest growing sectors of the nation's economy. There are many stakeholders in the US healthcare system, many of which have dramatically differing interests. These include, but are not limited to:

  1. enterprises that operate hospitals and health systems;
  2. manufacturers and developers of medical devices, pharmaceuticals and other biotechnology products;
  3. academic institutions that provide care while training healthcare professionals;
  4. information technology firms, construction companies and other infrastructure providers;
  5. insurance companies, self-insured employers and other third-party payers;
  6. labour unions representing the employees of healthcare organisations;
  7. medical entrepreneurs and investors (including private equity and venture capital) who finance the healthcare system;
  8. healthcare trade associations;
  9. patient advocates and special interest healthcare advocacy organisations; and
  10. patients and their families.

In addition, there is substantial government involvement in healthcare in the United States, with the government serving as a major payer, as well as a provider and regulator in various parts of the market.

ii The role of health insurance

Most medically necessary healthcare services in the United States are paid for by government or private third-party payers, including insurance companies, self-insured employer plans, health maintenance organisations (HMOs), Medicare and Medicaid, Tri-Care, the Veterans Administration and workers' compensation programmes. Most third-party payer arrangements are either managed care indemnity arrangements or involve monthly pre-payments known as 'capitation'. Private third-party payers are heavily regulated by state insurance commissioners, or the United States Department of Labor with respect to employer-sponsored plans, known as ERISA plans (short for the Employee Retirement Income Security Act).

Medicare and Medicaid

The two major government healthcare payment programmes in the United States are Medicare and Medicaid. Medicare is a federal programme that primarily provides coverage for individuals who are age 65 and over, disabled or have end-stage renal disease. Medicare is currently the largest (in total dollars) federal healthcare programme, providing health insurance for the elderly and certain other individuals. Medicare offers a number of payment arrangements, including traditional indemnity fee-for-service coverage (Traditional Medicare) and Medicare HMOs, known as Medicare Advantage plans. Medicare beneficiaries may choose between the two types of plans.

Under Traditional Medicare, inpatient services for most hospitals (i.e., other than 'excluded hospitals' that have special status under the law because of their specific types of service, such as cancer care) are reimbursed under the Inpatient Prospective Payment System (IPPS). Under the IPPS, hospitals are paid a prospectively determined case rate based on the patient's diagnosis – a diagnosis-related group (DRG). There are certain add-on payments to the DRG, such as 'outlier' cases, where the patient requires medically necessary hospital services for a longer time than is normally the case. Provider-based hospital outpatient services under Traditional Medicare are reimbursed under the outpatient prospective payment system (OPPS), which is also based on a prospectively determined case rate. Outpatient services that are not 'provider-based' are reimbursed under the Medicare Physician Fee Schedule or the ambulatory surgical centre payment rules, which are less generous than the provider-based rules, discussed further below.

Some outpatient procedures can either be performed (1) outside and independent of a hospital (e.g., in a freestanding clinic or physician's office) and are reimbursed under the Medicare Physician Fee Schedule; or (2) in a hospital-affiliated and hospital-operated site included on the hospital's licence and generally referred to as 'provider-based'. Reimbursement for provider-based facilities under the OPPS methodology is generally higher than comparable rates for the same procedures if performed in a freestanding facility under the Physician Fee Schedule. However, to qualify for provider-based reimbursement, the outpatient site must meet a number of requirements, some of which are somewhat onerous.10 A hospital that operates a surgery centre also has the option of operating that facility as provider-based, thereby permitting use of the OPPS payment structure.

A significant change in Medicare policy affecting outpatient services was implemented through Section 603 of the Bipartisan Budget Act of 2015, capping the ability of hospitals to add new off-campus outpatient departments and have them reimbursed under the favourable OPPS rates. Unless grandfathered or meeting limited exceptions, these new off-campus facilities are reimbursed at lower, freestanding rates (site-neutral rates). CMS decreased the outpatient hospital rates subject to Section 603 to 40 per cent of the current OPPS rates, a major hardship for land-locked hospitals or those in communities with changing demographics and geographies, and further expanded 'site-neutrality' rate cuts for all off-campus hospital departments. Site neutrality has been embraced by private payers and state Medicaid programmes; however, site neutrality has faced significant opposition, particularly from the American Hospital Association (AHA), which has legally challenged these rules. Initially, the AHA was successful, as courts held that HHS exceeded its statutory authority, but in December 2019, the same judge from previous cases allowed site neutrality policy to move forward in CMS's 2020 payment structure, clarifying that the earlier decisions applied to 2019 payments only. In November 2019, CMS issued a Final Rule (that was reissued with a correction in January 2020) that included site-neutral payment policy, and the Supreme Court declined to take up the lawsuit – effectively ending the dispute.11

Medicaid is a joint state and federal programme traditionally for certain indigent or impoverished individuals who are aged, blind or disabled, or members of indigent families with dependent children that meet income and resource standards set by the state Medicaid agency. Medicaid today covers more individuals than Medicare, making it the largest single payment system in the United States, in terms of persons served.12 The federal government contributes roughly half of the reimbursement for the Medicaid programmes, though some US states with struggling economies receive higher reimbursement than others. Although the rates payable by Medicaid in most states are notoriously low (some falling short of the provider's costs), the rates will be increased for a number of years under the ACA, possibly making the programme more attractive for primary care physicians and others who are either in scarce supply or simply do not wish to treat these low-income patients.

Under the ACA, the rules governing Medicaid eligibility were substantially relaxed, thereby making it possible for millions of additional Americans to qualify for the programme even though they do not meet these traditional criteria. While the Trump administration attempted to roll back some of these protections by allowing states to pursue demonstration projects that impose work requirements as part of their Medicaid plan, the Biden administration has since sent letters to all states with work requirements to begin withdrawing the waivers that these states relied on.

Commercial and private insurance

HMOs and preferred provider organisations

Although there remain some 'pure indemnity' arrangements (wherein the beneficiary is reimbursed for all healthcare expenses he or she incurred regardless of the provider who rendered the care), most third-party payer arrangements involve some element of managed care, meaning that the healthcare services are provided subject to utilisation review procedures such as a primary care physician serving as a 'gatekeeper' for specialists, and typically create certain constraints on the beneficiary's choice of provider, usually as a result of network or panel arrangements established by the payer.

There are two primary types of managed care arrangements: HMOs and preferred provider organisations (PPOs). An HMO typically requires the beneficiaries or members to exclusively use providers that have signed a contract with the HMO to receive a discounted or capitated amount for its services. The HMO will not pay for services provided by a non-contracted provider except when the services were performed in an emergency or the HMO does not have a needed specialist in its contracted network.

PPOs are delivery systems wherein the plan assembles a contracted provider network from which the member can receive care on a discounted fee-for-service basis; however, the beneficiary also has the option of going outside the network if he or she is willing to shoulder a greater share of the cost of care, typically in the form of a higher co-payment. There are also 'point-of-service' (POS) plans, which are a hybrid of an HMO and a PPO. Under a POS plan, the member usually receives capitated care but has the option of receiving care from a non-contracted out-of-network provider if he or she is willing to pay a substantial portion of the provider's fee-for-service charges.

Consumer-driven health plans

An increasingly popular type of insurance arrangement combines a 'high deductible health plan' with a 'health savings account' (HSA). The HSA is similar to an individual retirement account in that it permits individuals to save, on a tax-sheltered basis, through the establishment of a special account. The member funds the HSA with up to the maximum permitted by law (US$3,600 for an individual and US$7,200 for a family in 2021; US$3,650 for an individual and US$7,300 for a family in 2022).13 Those funds can only be used to pay for healthcare items and services that would be deductible under federal tax rules if incurred by a taxpayer, as well as to pay down the deductible until the funds in the HSA are exhausted. The beneficiary must exhaust the high deductible in the health plan and spend down the HSA before receiving the full benefit of the health plan's coverage. Unused HSA funds are carried forward to the next year. These are sometimes called consumer-driven health plans because the beneficiary controls the expenditure of his or her healthcare dollars to a much greater extent than under a traditional plan. To the extent that those providers include domestic or overseas providers, these consumer-driven plans may be a catalyst for the growth of overseas medicine in the United States. Patient advocates are concerned that high deductible plans, coupled with insufficiently funded HSAs, have caused a spike in consumer bankruptcy filings. Indeed, many view medical debt as one of the leading causes of personal bankruptcy in the United States.

iii Funding and payment for specific services

Healthcare reform, including the ACA and any new healthcare legislation that may ultimately be passed under a Republican-controlled Senate, has and will continue to have a major impact on healthcare delivery and expenditures. The ACA's overarching objective was to expand coverage to 31 million uninsured Americans, primarily through the individual mandate, employer mandate, expansion of Medicaid and establishment of subsidies (i.e., tax credits) to purchase plans in the health insurance marketplace established by each participating state, or by the federal government. The law establishes a minimum of 10 categories of 'essential health benefits' for plans: (1) ambulatory patient services; (2) emergency services; (3) hospitalisation; (4) maternity and newborn care; (5) mental health and substance use disorder services, including behavioural health treatment; (6) prescription drugs; (7) rehabilitative and habilitative services and devices; (8) laboratory services; (9) preventive and wellness services and chronic disease management; and (10) paediatric services, including oral and vision care. However, other types of healthcare services for adults, such as dental care and vision care, are typically paid for by individuals personally or through other types of private insurance plans that cover such services.

However, with the passage of the Tax Cuts and Jobs Act, which was signed into law by Trump on 22 December 2017, the individual mandate was repealed effective in 2019. The mandate, which subjects individuals without health insurance coverage to tax penalties (US$695 or 2.5 per cent of household income, whichever is greater), has long been seen as a cornerstone of the ACA, as the expanded coverage provisions of the programme are subsidised by requiring all individuals to pay into the system. Despite the perception that the mandate is essential to the functioning of ACA, health coverage held relatively steady in 2019 even after the mandate was repealed, suggesting it may not be as essential as originally thought.14

Another important development includes the introduction of alternative healthcare plans into the US healthcare market. As background, the ACA prohibits a health plan from establishing limits on the dollar value of these essential health benefits. It requires the plans to provide coverage for and to all individuals, and prohibits cost-sharing requirements for certain preventive services and immunisations. Further, it requires health plans that provide independent coverage of children to extend that coverage to adult children up to the age of 26. It establishes a minimum payment for primary care Medicaid services. The ACA further looks to novel healthcare delivery models to reimburse providers based on improved health outcomes, prevent preventable hospital readmissions, improve patient safety and reduce medical errors, as well as promote wellness. Health plans are prohibited from imposing pre-existing condition exclusions or discriminating on the basis of any health status-related factor, including genetic factors.15

The trend toward alternative payment models has strengthened in recent years, with recent data demonstrating that US healthcare payments associated with alternative payment models are steadily increasing.16 However, despite the appeal of certain alternative payment models (also known as value-based payment models), particularly those offering higher payments to providers who demonstrate a higher quality of care, providers have been reluctant to participate in programmes imposing full capitated risk. As a result, CMS has announced several new initiatives, including bundled payment models for certain clinical areas and a new direction for the Medicare Shared Savings Program, pushing accountable care organisations (the most popular type of alternative payment model, involving a group of providers that takes responsibility for the cost and quality of care in exchange for a portion of the savings) into a two-sided risk model more quickly than before. Other laws passed in recent years, including the Medicare Access and CHIP Reauthorisation Act of 2015 (MACRA), have established new ways of paying for care that focus on value instead of volume. Under MACRA, CMS has implemented a quality payment incentive program that rewards quality care and outcomes via two different methods: Merit-based Incentive Payment System (MIPS) and Advanced Alternative Payment Models (APMs).

Despite these requirements of the programme and other initiatives, changes to the ACA introduced under the Trump administration have cut away at other features of the ACA. For instance, in August 2018, HHS promulgated regulations allowing for alternative health plans in the form of short-term plans lasting just under one year (under the previous administration, the duration of short-term plans was limited to 90 days, making them exceptionally unattractive to consumers). Such short-term plans intend to create a competitive, lower-priced alternative to the plans available under Obamacare because they are not subject to the same requirements as full-scale health plans. However, because these short-term plans do not face the same requirements, short-term plans may exclude people with pre-existing conditions, undercutting one of the most popular protections of the ACA. Additionally, beneficiaries may experience gaps in coverage and catastrophic costs, and adverse selection may lead to higher premiums for the traditional healthcare coverage available on the marketplace. For these reasons, some states have elected not to offer short-term, limited-duration plans. Currently, 39 states and the District of Columbia offer these short-term insurance plans.

Another change introduced by the Trump administration in June 2018 was the option for 'association health plans', which allowed small businesses to band together based on common geography or industry and collectively purchase health insurance as a larger employer might. Although the association health plans are not able to discriminate based on an employee's health status or any 'health factor', they may be able to offer health insurance that does not include all the essential health benefits required by the ACA. In March 2019, a federal judge found major provisions of the rule to be unlawful and remanded the rule to the Department of Labor to determine how the rule's severability provision affects the remaining provisions. Following the decision, the Department of Labor released guidances describing resulting changes to its enforcement policy. At the time of this writing, association health plans are permitted within certain parameters.

After Biden's election, he directed the federal agencies to re-examine current policies that may undermine the ACA and health insurance exchanges, including short-term health plans and association health plans. However, even if Biden reverses Trump's policies, it will take time for any changes to be promulgated through the US rulemaking process.

iv Pricing transparency

At the end of the Trump administration, the US HHS issued a final rule called Transparency in Coverage as part of the federal government's initiative to increase transparency in healthcare pricing. Typically, healthcare prices are negotiated between insurers and providers and not easily accessible, but these new rules require health insurance issuer and group health plans to disclose certain pricing and cost-sharing information and publicly disclose a variety of information about in-network, out-of-network and pharmaceutical prices. Some of these requirements specifically related to hospitals came into effect on 1 January 2021, and CMS has begun sending warning letters to hospitals not in compliance.

Primary/family medicine, hospitals and social care

i Hospitals and primary care

As noted above, hospitals are the work benches for the delivery of healthcare in the United States. Further, the Emergency Medical Treatment and Labor Act, a federal law mandating that anyone who arrives at a hospital emergency department must be medically screened and provided stabilising treatment, regardless of their insurance status, has contributed to the use of hospital emergency departments for all types of care. However, there has been an increased focus on primary care, particularly under the ACA. Not only has the ACA expanded the number of insured patients, thereby increasing the number of patients able to access primary care, but provisions of the law have also specifically addressed the types of primary care and other preventive services that must be covered by insurance and have set minimum payment rates for primary-care Medicaid services.

Further, under most types of third-party payment arrangements, there is an element of managed care, meaning that the healthcare services are provided subject to utilisation review procedures such as a primary care physician serving as a gatekeeper for specialists. Such care arrangements typically place restrictions on the beneficiary's choice of provider, usually as a result of network or panel arrangements established by the payer. Thus, although it is possible to have direct access to different healthcare providers, for many insureds, access to a specialist is only possible through a referral by that individual's primary care provider.

There have recently been further developments in this area, as innovators from other sectors of the economy become more involved in the delivery of healthcare. Capitalising on improvements in technology in this way can present opportunities to offer increased access to primary care services, particularly in areas where providers are scarce or patients are not easily able to travel to provider offices. For instance, there has been a growing movement towards telemedicine, whereby providers and patients interface virtually rather than through an in-person office visit. The covid-19 pandemic accelerated this movement, as telemedicine became necessary overnight. States facilitated the use of telemedicine by, for example, expanding scope of practice, relaxing in-person visit requirements and allowing controlled substances prescribing via telehealth.

ii Electronic health records and privacy

Although many healthcare facilities and providers in the United States are individually moving towards use of electronic medical records, there has not yet been a sustained effort to implement a universal electronic medical record.

Healthcare organisations are subject to a plethora of federal and state privacy and security laws pertaining to health information maintained by the organisation. The most comprehensive federal law that applies to healthcare organisations is the Health Information Portability and Accountability Act of 1996 (HIPAA), as modified by the Health Information Technology for Economic and Clinical Health (HITECH) Act. These laws and their implementing regulations provide federal protections for the privacy of individually identifiable health information or protected health information (PHI) held by covered entities (e.g., health plans, healthcare clearinghouses and most healthcare providers) and give patients an array of rights with respect to such information. The HIPAA Security Rule specifies a series of administrative, physical and technical safeguards that covered entities must implement to ensure the confidentiality, integrity and availability of electronic PHI.

HIPAA, along with other federal and state privacy and security laws, imposes liability on healthcare organisations for technical violations of the required privacy protections and security safeguards, and for any unauthorised access, use or disclosure (i.e., breach) of confidential health or medical information. If a healthcare organisation violates HIPAA, the Secretary of Health and Human Services may impose civil monetary penalties or corrective action plans on a covered entity and the business associates with which it contracts. The secretary may also refer criminal violations to the Department of Justice (DOJ). State attorneys general also have a right to bring a cause of action on behalf of residents of their states under HIPAA. State laws vary considerably, but in some states, a healthcare organisation is also subject to state civil penalties and damages in any action brought by an individual whose privacy was compromised as the result of a violation of state privacy law. In addition to any potential liability for their own actions, healthcare organisations may also bear liability for the actions of their subcontractors for violations of state privacy laws. Notably, during the covid-19 pandemic, HHS issued a notice that it was exercising its enforcement discretion to permit some sharing of PHI that would otherwise constitute a HIPAA violation, as described in Section IX, below.17

In 2018, the European Union General Data Protection Regulation (GDPR) imposed various requirements applicable to companies that monitor or process the personal data of European citizens. Initially, most US healthcare providers (e.g., hospitals, physicians and skilled nursing facilities) determined that they are not subject to GDPR and did not at first voluntarily comply. However, since the passage of GDPR, some US states have passed similarly stringent privacy laws, leading to many healthcare providers adjusting their business practices in efforts to comply. One of the more comprehensive of these laws is the California Consumer Privacy Act of 2018, which provides California residents with similar rights to those that GDPR provides to EU citizens, including the right to access personal data an organisation has collected and the right to have that personal data deleted.

The licensing of healthcare providers and professionals

i Regulators

Licensure of healthcare providers and professionals is primarily regulated at the state level, typically by the state departments of health, departments of public health, boards of registration, or similarly titled agencies. Such agencies serve as the primary authority that promulgates and enforces licensure requirements for healthcare facilities and individual providers, including physicians, nurses, physician assistants, pharmacists and other healthcare professionals. In some states, accreditation by a private accreditation agency, discussed below, creates 'deemed' compliance status for the provider. Regulatory boards, usually made up of other licensed practitioners, guard the 'scope of practice', often fighting to exclude new, competing professionals, like new categories of non-physician practitioners (referred to above).

Usually, licences are limited to a specified period (e.g., one to three years) and must be renewed on a periodic basis. Each type of healthcare facility and provider has its own set of licensure requirements, although there are some types of requirements that are common to all.

ii Institutional healthcare providers


As indicated above, the licensing of hospitals and other types of healthcare facilities is regulated at the state level, resulting in at least 51 different sets of licensure requirements for institutional healthcare providers. Notably, even the types of healthcare facilities that require a licence to operate vary from state to state, which can become particularly challenging as more and more healthcare providers move towards consolidation. In general, states will require licensure of hospitals (both general and specialism), nursing homes, ambulatory surgical centres, healthcare clinics (though the specific types of licensure and restricted activities can vary widely from state to state), pharmacies and other similar healthcare facilities.

For hospitals and other health facilities, the licensure laws typically cover issues such as professional and non-professional staffing; physical plant requirements; required clinical services; administrative capabilities; and a vast array of other requirements. In most states, in addition to hospital licensure, full-service hospitals require other licences and permits, such as laboratory permits, permits relating to hazardous wastes, food service permits, and transportation licences for hospital-affiliated ambulances. Other residential healthcare facilities, such as nursing homes or behavioural health homes, are typically subject to similar requirements.

States also generally impose sanctions for the provision of healthcare services without a licence by a facility, which often include penalties per violation or per day in operation without a licence. State licensure authorities also have individualised procedures for the issuance, suspension or termination of a facility licence, which typically provide for an appeal by a provider that is refused a licence or has its licence suspended or terminated. As described in Section IX below, many state governments waived certain facility licensure and operational requirements during the covid-19 public health emergency.

Certificate of need laws

There are also a number of other healthcare-related restrictions that may preclude the construction of a hospital or other health facility. In this regard, a small number of states have certificate of need (CON) (sometimes called 'determination of need') laws that regulate the construction and licensing of new hospitals and other types of healthcare facilities and the addition of new beds to existing facilities. These laws are aimed at avoiding excess capacity and inefficiencies in the delivery of healthcare.

A federal law enacted in 1974 provided for the establishment of CONs by the states. That law was repealed in 1986 and, since that time, a number of other states have repealed their CON laws or dialled back the types of healthcare facilities requiring a CON. However, despite the gradual fading of CONs during the 1990s and 2000s, as states seek to find ways to contain costs as Medicaid and private employer spending on healthcare becomes a serious budgetary concern, some states are revisiting their CON laws.

Certification and accreditation

In addition to the licensure requirements administered by the states, Medicare, Medicaid and other government reimbursement programmes rely on the 'power of the purse' in regulating healthcare providers in their delivery of services. These programmes impose 'conditions of participation' and 'conditions of payment', which essentially mandate providers' compliance with specified standards set out in the government programme's regulations and policies in order to be reimbursed. The process of determining compliance by a hospital or other healthcare provider with the programme's rules is known as 'certification', which is a right to participate in the government payment systems, distinct from state 'licensure' and private 'accreditation'. In most cases, hospitals will possess all three: certification, licensure and accreditation, although there are hospitals that do not.

Although they are ultimately responsible for granting certification, the Medicare and Medicaid programmes delegate much of this responsibility to private accreditation agencies and state 'survey agencies'. The two primary private accreditation bodies in the United States are the Joint Commission (TJC) (previously referred to as the Joint Commission on Accreditation of Health Care Organisations, or JCAHO), which surveys most hospitals and other healthcare institutions, and the American Osteopathic Association (AOA), which surveys osteopathic hospitals. Foreign healthcare organisations may be most familiar with Joint Commission International, or JCI, affiliated with TJC. Compliance with TJC or AOA standards affords a hospital 'deemed status', meaning that a hospital has complied with Medicare, and usually Medicaid, requirements. Accreditation expires no later than three years from the date of the most recent survey of the hospital. As noted above, accreditation also confers deemed status for state licensure purposes in some jurisdictions.

Hospitals are not required to seek private accreditation. The process of seeking accreditation is lengthy and expensive. The accrediting bodies charge considerable fees for the survey process, and also sell a variety of consulting services to accredited hospitals. Some smaller organisations seeking to reduce their expenses forego accreditation and rely on the surveys by the state survey agencies. The federal Medicare programme has contracted with the state healthcare agency in every state (usually a Department of Public Health) to be the official state survey agency for the CMS. These state survey agencies will visit and approve the certification in the Medicare programme free of charge for the hospital, other than nominal licensing fees.

The OIG has criticised the relationship between TJC and hospitals as being too 'collegial',18 and TJC surveys became harsher in response. Consequently, more hospitals are considering relying on the state survey rather than TJC accreditation status to achieve Medicare certification.

iii Healthcare professionals

Health practitioners are subject to licensure by their respective state boards. These typically include the medical board for physicians, the nursing board for nurses, and other boards for other types of licentiates. In some states, the state department of health performs this function for some professional categories. These boards establish and enforce the criteria for initial and ongoing licensure, as well as a process for revoking such licensure or taking other disciplinary action, such as the imposition of probation. In response to the covid-19 pandemic, many state medical and nursing boards waived certain licensure requirements, as described in Section IX, below.

Although each state issues its own licence, some states permit reciprocity by honouring each other's licences. For example, there is a Nursing License Compact (NLC), under which 35 member states recognise the nursing licences granted by all the other member states (New Jersey and Guam, a US territory, have only partially implemented the NLC). In addition, some states honour each other's medical licences or permit physicians who are licensed in another jurisdiction to practise medicine across their state lines using telemedicine.

In addition to government licensing and certification requirements, 'credentialling' of individual professionals occurs at the facility level. Compliance with standards and requirements established by individual health facilities permits individual licentiates to perform services within those facilities. Health plans, professional associations and licensed outpatient facilities usually also impose such requirements.

State and federal statutes applicable to physicians and certain other licentiates provide hearing and appeals rights when a state agency denies, or proposes to deny or revoke, licensure or certification. Similarly, hospitals, health plans and certain other providers or professional organisations are required by state and federal law to have formal peer review and quality assurance or quality improvement procedures in place whereby they determine whether to permit a new practitioner to provide services to their patients. These procedures also govern any adverse disciplinary actions against practitioners, such as the revocation or restriction of their clinical privileges. Under a federal law called the Health Care Quality Improvement Act (HCQIA), and under state laws in many jurisdictions, these organisations must follow specified procedures in making adverse decisions affecting a practitioner's privileges. In most states, practitioners must go through or 'exhaust' these administrative appeal procedures before they can challenge the denial or revocation of privileges or other adverse action in court. Because failure to follow these rules can result in liability to the organisation, it is incumbent on hospitals and other healthcare organisations that are subject to these rules to have a compliant peer review and appeals process in place prior to commencing operations.

Pursuant to the reporting provisions of the HCQIA, practitioners who either do not challenge adverse actions or who are unsuccessful in their challenges are identified on the National Practitioner Data Bank so that other prospective employers or hospitals become aware of any competence or conduct issues before permitting such practitioners to join their staffs. The HCQIA also confers immunity on hospitals and certain other organisations that perform peer review and on the individuals who participate in that process as long as certain conditions are met, including adequate notice and an opportunity for the affected practitioner to be heard.

As is the case with health facilities, individual healthcare licentiates enrol in Medicare and other government payment programmes if they want to participate in these programmes. They must also meet specified requirements, such as licensure under state law.

Negligence liability

One characteristic of the US healthcare system that is viewed by many as contributing to its exorbitant cost is professional liability ('medical malpractice'). Under the US professional liability system, any patient who believes he or she has been hurt or injured by the professional negligence or wilful misconduct of a healthcare provider is entitled to damages if he or she demonstrates that it is more likely than not that the negligence or wilful misconduct caused the patient's hurt or injury. As a result, in a practice called 'defensive medicine', many physicians order tests that are not medically necessary out of fear that the theory or failure to order the test will be second-guessed if the patient has a bad outcome.

Some states, including California, have enacted caps on non-economic damages in professional liability cases. This reduces the exposure that practitioners face when performing medical services. Fortunately, most states in the United States also have 'good Samaritan' laws that permit physicians and other healthcare practitioners to render aid at the scene of an emergency, or to assist in the rescue of an individual, without incurring liability.

In addition to provider liability, medical devices and pharmaceuticals experience liability for patient injuries on some different theories, most notably 'products liability'.

Despite some calls for reform, medical malpractice suits continue to be a frequent presence, based in part on real concerns regarding medical errors. A recent study by Johns Hopkins University found that more than 250,000 patient deaths per year in the United States are a result of medical error, making these types of errors the third leading cause of death in the country.19

The covid-19 pandemic led the federal government and many states to pass measures waiving or limiting provider liability for care provided during the public health emergency. These measures are discussed in more detail in Section IX, below.

Ownership of healthcare businesses

i Types of ownership and management

The trend toward consolidation of the healthcare industry in the United States has created a number of different ownership and management models. Entities entering the healthcare market typically acquire a healthcare business though an asset acquisition, a stock or limited liability company acquisition, a merger, or a true consolidation that forms a new entity.

In addition to the foregoing organisational changes, control of a hospital can be transferred or shared through the formation of a joint venture or the establishment of a management or co-management relationship. Joint ventures are a common vehicle for extending the reach of an existing hospital into new neighbourhoods and markets, or for leveraging the assets of multiple (usually two) existing market participants to enhance the collective ability of those participants to serve their combined communities. Another vehicle for entering the marketplace, potentially with minimal assets, is a management agreement. Under the terms of a typical management agreement, one party with special expertise in the operation and management of a hospital will essentially assume control of the assets and personnel of an existing facility.

It has also become increasingly common over the past two decades for government hospitals to enter into management agreements with private parties, with the private entity managing the government hospital. These public–private partnerships raise complex issues under the special laws that apply to government agencies. These include laws that: require most governing body meetings to be public; require public disclosure of most of the agency's documents; provide special liability protections for the entity and its employees; and, similar to the laws protecting the assets of tax-exempt organisations, protect the assets of the government entity from exploitation by private parties, and prevent 'gifts of public funds' or the 'lending of the government entity's credit'.

Hospitals seeking lawfully to partner with their physicians may also enter into 'co-management agreements'. These are contractual arrangements under which certain physicians in a particular speciality (e.g., cardiology, oncology, gastroenterology) agree to provide certain management services to a service line of a hospital. The purpose of the agreements is to develop and manage the service line collaboratively, and to improve its quality and efficiency of delivery.

As the US$69 billion merger between health insurance giant Aetna and pharmacy chain CVS (as well as the similar US$67 billion merger between health insurer Cigna and pharmacy benefit manager Express Scripts) indicates, other areas of the healthcare industry have also been swept up in the move toward greater consolidation. Under the terms of the merger, Aetna became a subsidiary of CVS, which the companies stated would provide for better coordination and continuity of care by helping patients to adhere to their medication regimens. Given the size of the deal, the merger required federal antitrust approval. The DOJ and later a federal judge approved the transaction – indicating that the trend toward consolidation (even large-scale consolidation) in healthcare will continue.

ii Restrictions on ownership

A number of states prohibit 'corporate practise of medicine' (CPOM), which is generally defined as the operation of a medical practice, or the employment of physicians (or other licensed practitioners of the healing arts), by lay corporations and entities that are not themselves licensed to practise medicine. The US states have wildly divergent degrees of CPOM regulation, with states such as California having the strictest prohibition on physician employment, and Florida having, perhaps, the most lax (the first and third most populous US states, respectively).

The CPOM is typically articulated in state statutes and regulations, case law, attorneys' general opinions and medical board guidance. There are usually limited exceptions to the CPOM in those states that enforce the prohibition. The rationale for the CPOM is that commercial business issues (revenue generation, profit and loss, etc.) should not be permitted to intrude on the physician–patient relationship. In theory, the corporate practice prohibition ensures that physicians are able to put the medical interests of their patients above all other concerns, unfettered by the demands of a corporate entity employer. Depending on the state, violations of the CPOM can result in injunctive relief, civil penalties and criminal enforcement. Despite CPOM prohibitions, the need to access capital and innovate in the delivery of medical services has introduced private equity, venture capital and publicly traded investors into the medical marketplace. There are generally two strategies deployed in the US to comply with CPOM while permitting lay investment: seeking state licensure as a healthcare facility or designing a management company and contractually tied-in professional corporation (a 'friendly PC').

Commissioning and procurement

Most hospitals make purchasing decisions individually with the manufacturers and distributors of medical supplies and products. The large federal systems, such as the Veterans Administration hospitals, purchase through government procurement contracts.

To address the disparity of bargaining power by private hospitals, many hospitals have banded together in 'group purchasing organisations' (GPOs) that retain a percentage of the total spent (e.g., 3 per cent) and then negotiate large contracts of multiple hospitals. The GPOs retain significant influence in the healthcare industry, though commenters note that physicians' preference for expensive technologies continues to drive needless expense and waste in the industry.

Marketing and promotion of services

There are a number of laws that restrict the promotion and advertising of healthcare services and business, particularly to the extent that any arrangements of this kind involve 'remuneration' in exchange for a referral for particular types of healthcare services. In general, remuneration means the payment or transfer of anything of value, directly or indirectly, overtly or covertly, in cash or in kind.

i The Federal Anti-Kickback Statute

The Anti-Kickback Statute prohibits any person from 'knowingly and wilfully' paying, offering, soliciting or receiving any remuneration, directly or indirectly, overtly or covertly, in cash or in kind, in exchange for or to induce the referral of, any item or service covered by a federal healthcare programme, or in exchange for arranging for or recommending purchasing, leasing or ordering any good, facility, service or item covered by a federal healthcare programme, including Medicare and Medicaid. Violation of the Anti-Kickback Statute is punishable by a US$100,000 fine, imprisonment for up to ten years or both, and may subject a violator to civil monetary penalties as well. Moreover, violation of the Anti-Kickback Statute is also grounds for exclusion from participation in the Medicare and Medicaid programmes and other federal healthcare programmes. The ACA amended the Anti-Kickback Statute to provide that items or services resulting from a violation of the Anti-Kickback Statute can constitute false claims for the purposes of the False Claims Act (FCA), discussed below. Thus, violations of the Anti-Kickback Statute can also lead to substantial civil liability under the FCA. Several US states have 'all payer' anti-kickback statutes, punishing similar activities when commercial payers are involved.

The Anti-Kickback Statute is an intent-based statute. Consequently, whether an arrangement violates the statute depends on the facts and circumstances of a particular arrangement and, more specifically, whether the parties entered into the arrangement with the intent to induce referrals. Further, the Anti-Kickback Statute contains several statutory exceptions. Given the potential breadth of the Anti-Kickback Statute, Congress authorised HHS to promulgate regulatory safe harbours that would provide additional guidance regarding arrangements that are not subject to the Anti-Kickback Statute. There are a number of regulatory safe harbours, covering arrangements such as recruitments, electronic health records subsidies, discounts and certain investment interests. Effective 19 January 2021, providers may take advantage of new safe harbours to the Anti-Kickback statute, including safe harbours that protect certain care coordination and value-based arrangements.20 With these new safe harbours, HHS aims to improve (1) patients' ability to understand their care plan; (2) coordination between providers and among providers and patients; and (3) information sharing to facilitate efficient care.21

Importantly, the OIG has stated that the failure of an arrangement to fit squarely inside a safe harbour does not mean that the arrangement is illegal; it means only that the arrangement does not have guaranteed protection and must therefore be evaluated on a case-by-case basis, taking into account the facts of the particular arrangement.

Thus, unlike the Stark Law (discussed below), the failure to comply with an Anti-Kickback Statute exception or regulatory safe harbour does not necessarily mean that an arrangement violates the statute. The absence of a bright-line rule regarding failure to comply with the Anti-Kickback Statute exceptions can make it particularly difficult to analyse whether certain arrangements comply with the law. If an arrangement does not comply with each and every requirement of an Anti-Kickback Statute exception or safe harbour, the exception or safe harbour will not apply to the arrangement. However, as noted, the arrangement does not automatically violate the statute simply because an exception or safe harbour does not apply.

ii The Federal Physician Self-Referral Law (the Stark Law)

The Federal Physician Self-Referral Law (commonly referred to as the Stark Law, after the late Congressman Fortney 'Pete' Stark, who introduced the legislation) prohibits a physician from referring Medicare22 beneficiaries for certain 'designated health services', including all inpatient and outpatient hospital services, to entities with which the physician has a financial relationship (and prohibits billing for services provided pursuant to such a referral), unless an exception applies. The Stark Law defines 'physician' as a doctor of medicine or osteopathy, a doctor of dental surgery or dental medicine, a doctor of podiatric medicine, a doctor of optometry or a chiropractor. Violations of the Stark Law may result in penalties that include denial of payment, civil monetary penalties of up to US$15,000 per service (and US$100,000 for schemes that are designed to circumvent the Stark Law), and exclusion from the Medicare and Medicaid programmes.

A financial relationship under the Stark Law can be created through a direct or indirect ownership or compensation arrangement between a healthcare entity and physicians. There are several exceptions, covering arrangements such as space leases, bona fide employment relationships, isolated transactions, and recruitment arrangements. In addition, there are numerous regulatory exceptions. Although each exception is different, most of the 'compensation arrangement' exceptions require that the arrangement be (1) in writing, (2) signed by the parties, (3) commercially reasonable without regard to referrals, and (4) at fair market value. Notably, CMS introduced a new exception to the Stark Law effective 19 January 2021, to allow payment of remuneration under certain value-based arrangements.23 In particular, this exception protects physician compensation arrangements that set forth certain value-based activities undertaken under the agreement and how those activities further the value-based purpose, among other requirements.24

Unlike the Anti-Kickback Statute, the Stark Law is often viewed as a strict liability law (i.e., the intent of the parties is irrelevant). If the elements of the Stark Law are met, namely that a financial relationship exists between a physician and a healthcare entity pursuant to which the physician makes referrals of designated health services that are payable by Medicare, then an exception must be met to avoid penalties. Because of its broad scope, the Stark Law can implicate many financial arrangements that may seem relatively innocuous. A number of practices present risk under the Stark Law (and potentially under the federal Anti-Kickback Statute, as well), and have been the source of government investigations, enforcement actions and settlements. Such practices as the giving of free items and services, undocumented arrangements, failure to adhere to contract terms, and lack of fair market value are all subject to a high degree of scrutiny.

Free items and services

Under the Stark Law, compensation is broadly defined to include 'any payment or other benefit made directly or indirectly, overtly or covertly, in cash or in kind'. Free items and services provided to physicians are generally treated as compensation to physicians, and, therefore, must meet a Stark Law exception to avoid compliance issues. For example, if a hospital administrator provides a physician with free football tickets, the physician is deemed to receive compensation because the free items and services have an independent value to the physician. Although the Stark Law contains a 'non-monetary compensation' exception that permits gifts of non-monetary items (e.g., meals and theatre tickets) valued at up to US$429 (in 2021) in the aggregate over the course of a year, this amount is relatively easy to exceed.

Lack of fair market value

An important requirement of many Stark Law exceptions is that payments under an arrangement constitute fair market value payment for goods or services. Fair market value in this context generally means the price that an asset would bring, or the compensation that would be included in a service agreement, as the result of bona fide bargaining between well-informed parties to an agreement who are not otherwise in a position to generate business for the other parties on the date of acquisition of the asset or at the time of the service agreement. If a healthcare entity undercharges or overpays a physician, then the healthcare entity bestows a financial benefit on the physician that the government could view as being in exchange for patient referrals. Thus, it is very important that financial arrangements between a healthcare entity and a physician (e.g., space leases, professional services agreements, equipment leases and employment agreements) contain compensation that is fair market value.

iii The Eliminating Kickbacks in Recovery Act of 2018

The Eliminating Kickbacks in Recovery Act of 2018 (EKRA), which became law in October 2018, is a criminal statute passed as part of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (the SUPPORT Act). EKRA was passed in order to prevent kickbacks paid to patient brokers who recruit patients for expensive recovery homes and other addiction treatment centres. Specifically, EKRA prohibits recovery homes, clinical treatment facilities, and laboratories from knowingly and wilfully paying kickbacks in exchange for referrals. EKRA violations result in a fine not exceeding US$200,000, a prison sentence not exceeding 10 years, or both, for each occurrence. EKRA does provide for certain exceptions, including bona fide employment relationships and certain discounts, provided those discounts are disclosed. Due to a likely drafting error, the provisions of EKRA appear to extend to laboratories irrespective of whether they are processing tests for substance use identification, leading some laboratories to have to make changes to employee compensation programs relating to sales and marketing efforts.

iv Penalties

The Civil Monetary Penalty Law

The Civil Monetary Penalty Law (CMPL) is a civil statute that prohibits various forms of inappropriate activities, such as the submission of false claims, contracting with an individual who has been excluded from federal or state healthcare programmes, violating the Anti-Kickback Statute, denying access to the OIG during an audit, or failing to return any overpayment.

One particular area of concern related to the CMPL is the prohibition on patient or beneficiary inducements. The CMPL prohibits the offering or transferring of remuneration to any individual eligible for benefits under Medicare or Medicaid that the offeror 'knows or should know' is likely to influence that individual to order or receive from a particular provider, practitioner, or supplier any item or service for which payment may be made, in whole or in part, under Medicare or Medicaid. Remuneration is defined to include (among other things) the waiver of co-payments and deductible amounts. Violation of the CMPL is punishable by a monetary penalty of US$20,866 per item or service, damages of up to three times the amount claimed for the item or service, and potential exclusion from Medicare. Similar to the Anti-Kickback Statute, there are several exceptions to the CMPL that, if met, protect the arrangement. Advertising and other promotional materials provided to patients present one example of potential risk under the CMPL's patient inducement prohibition. Although these items or services can be structured to comply with an exception to the CMPL's prohibition on patient inducements, arrangements of this kind warrant particular attention from a compliance standpoint.

The False Claims Act

The FCA prohibits a variety of fraudulent conduct with respect to federal programmes, purchases or contracts. A person or entity can violate the FCA through a variety of methods, including knowingly: (1) submitting a false claim for payment; (2) making or using a false record or statement to obtain payment for a false claim; (3) conspiring to make a false claim or get one paid; or (4) making or using a false record material to an obligation to pay the government, or concealing or avoiding such an obligation. Either the attorney general or a private person through a private whistleblower action can bring a lawsuit for violation of the FCA. The FCA imposes penalties of US$11,665 to US$23,331 per claim, plus three times the amount of damages to the government.

Providers also have an obligation under the FCA to refund and report Medicare and Medicaid overpayments by 60 days after the overpayment is identified or the date the corresponding cost report is due. This is a significant new source of liability and wrongful retention of overpayments is considered a 'reverse false claim'.

Covid-19 and the US healthcare system

The covid-19 pandemic profoundly tested the strength of the US healthcare system.25 In order to assist healthcare providers and essential workers on the frontline of the disease, the US Congress and federal executive agencies passed relief measures and waived regulatory barriers. State governments also enacted significant changes to existing healthcare laws in order to provide local systems and providers with needed flexibility to address covid-19. The United States had over 33 million reported cases of covid-19 and over 605,000 reported deaths as of 6 July 2021.26

The financial impact of the covid-19 pandemic has been extreme. The American Hospital Association estimated a total financial impact of at least US$323 billion in losses resulting from covid-19 expenses and lost revenue for hospitals and health systems in 2020. A similar analysis projected an additional US$53 to US$122 billion decrease in hospital and health systems' revenue in 2021.27 For hospitals, much of the loss was caused by the cessation of elective, often outpatient, hospital procedures to prevent exposure of patients to covid-19. These elective procedures are often the more financially positive services offered by hospitals, cross-subsidising other money-losing services.

i Federal legislative measures

The US Congress passed several measures to aid healthcare systems and providers during the public health emergency. Congress appropriated approximately US$2.6 trillion via the Families First Coronavirus Response Act (FFCRA), Coronavirus Aid, Relief, and Economic Security (CARES) Act, the Paycheck Protection Program and Health Care Enhancement Act, and the Coronavirus Preparedness and Response Supplemental Appropriations Act 2020, a portion of which went directly to healthcare providers, and much to other industries and individuals.28 The FFCRA also required health insurers, including Medicare, Medicaid and private payers, to cover covid-19 testing at no cost to consumers and prohibited some payers from requiring patient cost sharing for covid-19 testing.

The CARES Act addressed shortages of healthcare supplies and provided immunity from liability for healthcare volunteers (as discussed below, state governments quickly extended immunity to providers and institutions caring for covid-19 patients). As part of CARES, HHS received approximately US$1.3 billion for the 'prevention, diagnosis and treatment of covid-19' and distributed these funds to providers across the country. Additionally, CARES protected access to necessary healthcare by requiring Medicare to cover some telehealth services and waiving requirements for face-to-face consultations in some instances.

ii Federal regulatory waivers

Numerous federal agencies waived regulations that could encumber rapid response to the covid-19 pandemic. For instance, CMS issued 'blanket waivers' that eased Medicare enrolment, expanded the ability for facilities to provide long-term care services, and enhanced the ability for Medicare providers to utilise telehealth.29 Additionally, the blanket waivers loosened requirements surrounding emergency room care, medical records, reporting requirements, and physician licensure for a variety of provider types, including hospitals, nursing facilities, home health, and hospice.

The waivers also covered certain provisions of the Stark Law, including certain remuneration and referral relationships providing healthcare systems and providers with much needed flexibility for staffing as long as the providers acted with good faith and a 'covid-19 purpose'. The waivers allowed for increased physician pay, provision of 'comfort items' to healthcare providers, including meals and child care services, and rental of office space to providers at rates below fair market value, all of which could constitute Stark violations absent the waiver.30

Likewise, HHS exercised its enforcement authority to effectively waive certain HIPAA provisions during the public health emergency.31 Pursuant to the HHS announcement of limited enforcement, business associates could disclose certain PHI for public health and health oversight purposes even where not permitted by a written business associate agreement. Business associates had to disclose the PHI in good faith and inform the covered entity within 10 days of the use or disclosure.

The US Food & Drug Administration (FDA), an agency within HHS, was critically involved in the nation's covid-19 response because of the agency's role in regulating drugs and medical devices. Specifically, the FDA issued numerous emergency use authorisations (EUAs) that allowed device suppliers to modify certain devices for use as ventilators and clinical laboratories to test for covid-19. Moreover, the FDA granted EUAs to several vaccine manufacturers that allowed for the country's relatively fast roll out of vaccines to prevent against covid-19.32

The regulatory waivers will expire automatically at the end of the public health emergency. Currently, the public health emergency is extended until 17 October 2021 and is expected to last the entire 2021 calendar year. It is predicted that some federal agencies may formalise certain changes in healthcare regulations arising from these temporary waivers. However, providers may struggle to roll back reliance on the temporary covid-19 waivers upon their expiration, and increased government enforcement may result.

State legislative and regulatory measures

State governments enacted legislation and amended regulations in response to the covid-19 pandemic, with those states most seriously impacted by the virus responding with the most significant measures to combat the disease. State actions included provider and facility licensure waivers, telehealth expansions, and provider liability protections. For instance, numerous states relaxed licensure requirements for physicians, nurses, respiratory therapists, and mental and behavioural health providers, among other practitioners, in order to ensure the state had an adequate number of healthcare professionals to respond to the crisis.33 Prior to the pandemic, most states required providers to obtain licensure in the state in order to practice. Moreover, many states loosened requirements regarding facility capacity and staffing in order to ensure facilities were able to expeditiously and safely treat an increased number of patients.34

Due to shortages of PPE, the need to socially distance, and the increased importance of limiting disease exposure for vulnerable populations, many state departments of health and professional licensing boards loosened regulations that restricted the use of telemedicine.35 For instance, many states waived requirements that providers see patients in person prior to a telehealth visit and expanded the list of permissible telehealth modalities. Additionally, many states mandated public and private coverage of telehealth services at rates equal to in-person visits.

State governments also took various measures to limit healthcare provider liability due to concerns that fear of reprisal would cause providers and facilities to refuse to accept and treat covid-19 patients. Many states enacted legislation and executive orders to limit healthcare provider liability for covid-19 related care absent wilful misconduct or gross negligence.36 In many states, this immunity from suit extended to healthcare facilities, including hospitals, nursing facilities, long-term care facilities, and hospice.

Future outlook and new opportunities

Much is uncertain for the future of the US healthcare system because of the monumental impact of the covid-19 pandemic. It is difficult to imagine a time when change in the US healthcare system will not be related, at least in part, to the pandemic or its fallout. However, many of the regulatory changes put in place to help control the virus may persist after covid-19 is eradicated. For instance, federal and state actions to advance telehealth could signal a new status quo for healthcare delivery in the US. Many of the telehealth measures, including payment parity between in-person and telehealth visits, mandatory coverage of telehealth services, and expansion of permissible telehealth modalities, represent important advancements in the US healthcare system's capacity to serve patients in vulnerable populations, rural communities, and high-risk settings. Moreover, the healthcare system will undoubtedly change under the Biden administration. In his platform during the 2020 presidential campaign, President Biden pledged to give every American access to affordable health insurance and to simplify the healthcare system.

Despite the unprecedented legislative measures to help the healthcare industry, the covid-19 pandemic resulted in a 1.2 percentage point decrease in median hospital operating margin (according to one American consulting firm) and at least 36 hospitals going into bankruptcy as of November 2020 (according to the American Hospital Association).37 Conversely, other players in the US healthcare industry including telemedicine, testing and home-based services experienced unprecedented opportunities. Time will tell if those opportunities will remain for the longer term.

Finally, it is impossible to provide a thorough overview of the US healthcare system without discussing the racial disparities in healthcare that were highlighted during the covid-19 pandemic. Covid-19 disproportionately affected people of colour, with American Indian, Alaskan Native, African American, Hispanic and Latino communities especially affected.38 While these communities suffered from huge numbers of infection and death, there is hope that their disproportionate suffering will spark necessary change. The aftermath of the covid-19 pandemic may present a fertile time for the US healthcare system to address racial disparities in health.

Probably the single largest challenge of the US healthcare system continues to be the management of cost. While beyond the scope of this chapter, it is well accepted that the cost per capita in the United States is significantly higher than in the other Western democracies and other countries discussed in The Healthcare Law Review. The causes for that cost increase are many and complex, and often attributed to the core structural issues discussed above, such as the dependence on high-cost, brick-and-mortar hospitals, achievements in high-end diagnostics, and expensive pharmaceuticals sold in the US at prices many times those offered to other countries. Other causes are more uniquely American, such as the notion of the patient as an individual entitled to the best possible cure for disease and prolongation of life, as opposed to more communitarian notions that might look to the overall public health as the ultimate goal of the healthcare system. But whatever the cause, the result has been a materially more expensive system that has an arguably (questionably) superior outcome across the board. Thus, when the ACA was being debated, a 'triple aim' was proposed as a goal: improving the patient experience of care (including quality and satisfaction); improving the health of populations; and reducing the per capita cost of healthcare.39 The ACA addressed the patient access issue, but cost containment, and likely patient experience improvements, remain elusive, and it is not yet clear whether recent reforms to the system will improve these features of the healthcare system. Innovators, disruptors or other investor-backed initiatives seeking to address cost are likely the most important frontier for new healthcare service businesses in the United States for the foreseeable future.

A number of initiatives have tried to address concerns about cost in different ways. Most notably, the expansion of alternative payment models that reward volume over value have proliferated and matured, with many payers – especially CMS – increasingly focused on getting providers to accept downside risk in addition to the opportunity for shared savings. Another result has been a focus on care settings and options to provide care in lower-cost settings, particularly through telehealth services. And in some cases, there has been increased scrutiny on the prices themselves, particularly for high-cost items such as expensive pharmaceuticals. There have been numerous efforts, including at the state level, to tamp down the cost of drugs, such as by establishing upper payment limits. Although relatively few changes have actually been made to date, drug pricing will certainly be an area to watch in the coming years.


The US healthcare system is made up of a complex set of provider types and payer types, and is set against a backdrop of overlapping and interconnected federal and state laws. Further complicating the system is the move towards greater consolidation, with more and more facilities and medical groups coming into common control. This movement has created a number of interesting types of ownership and management structures.

Relatedly, rising healthcare costs remain a significant issue for the US healthcare system. This has driven in part a number of laws targeting fraud and abuse in the provision of healthcare, particularly related to referral practices. The Anti-Kickback Statute, the Stark Law, EKRA, and the related penalty provisions, can be difficult for providers to navigate when structuring financial arrangements. Nevertheless, given the complex causes for cost increases, the United States will likely need to look to innovators, disruptors, or other investor-backed initiatives to address rising costs in the healthcare system.

Undoubtedly, the covid-19 pandemic represents a milestone in the history of American health law. The US healthcare system failed to contain the crisis quickly, and the federal and state governments had to scramble to pass needed legislation and regulatory changes to protect the American people. Importantly, healthcare providers must focus on returning operations to compliance as federal and state regulatory waivers expire upon the termination of the covid-19 public health emergency. How the US healthcare system will change and adapt in the longer term because of the devastating impact of covid-19 is yet to be seen.


1 Lawrence W Vernaglia is a partner and Olivia R King and Stephanie J Schwartz are associates at Foley & Lardner LLP. Alexandra B Maulden served as a summer associate at Foley & Lardner LLP in 2021. The authors would like to acknowledge the significant contributions of their friend and colleague R Michael Scarano for his work on several sections of this chapter. Mr Scarano was a pre-eminent healthcare lawyer in the San Diego office of Foley & Lardner who trained generations of healthcare lawyers and zealously served healthcare provider clients at the highest levels. Mike is sorely missed by his peers, and we dedicate this chapter to his memory and friendship. The authors would also like to thank their colleague Anna S Ross for her material contribution to the prior editions of this chapter.

2 See Johns Hopkins University & Medicine, COVID-19 Dashboard by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins, (last visited 15 June 2021).

3 See Centers for Medicare & Medicaid Services, COVID-19 Nursing Home Data (15 July 2021),

4 See Zack Beauchamp, Trump is mishandling the coronavirus the way Reagan botched the AIDS epidemic, Vox (30 March 2020),

5 See the Lancet Editorial Board, Reviving the US CDC, 395 Lancet 1521 (2020); see also See Daniel M. Fox, AIDS and the American Health Polity: The History and Prospects of a Crisis of Authority, Millbank Quarterly 83, at 12 (2005).

6 See Tim Fitzsimons, LGBTQ History Month: The early days of America's AIDS crisis, NBC News (15 October 2018),

7 See the Lancet Editorial Board, Reviving the US CDC, 395 Lancet 1521 (2020).

8 See id.

9 See Inspector General Act of 1978, 92 Stat. 1101 (1978).

10 42 C.F.R. § 413.65.

11 See Medicare Program: Changes to Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems and Quality Reporting Programs, 84 Fed. Reg. 61,142 (12 November 2019),

12 See The Henry J Kaiser Family Foundation, Medicaid Pocket Primer (updated 9 June 2017; last accessed 16 June 2021),

13 Internal Revenue Service, Rev. Proc. 2020-32 (8 June 2020) (2021 maximums); Internal Revenue Service, Rev. Proc. 2021-25 (2022 maximums).

14 Sarah Kliff, Republicans Killed Obamacare Mandate. New Data Shows it Didn't Really Matter, N.Y. Times: The Upshot (18 September 2020),

15 For more information about the ACA, see the CMS Center for Consumer Information & Insurance Oversight, Patient's Bill of Rights, (last accessed 16 June 2021).

16 Health Care Payment Learning & Action Network, Measuring Progress: Adoption of Alternative Payment Models in Commercial, Medicaid, Medicare Advantage, and Medicare Fee-for-Service Programs (22 October 2018).

17 See US Department of Health & Human Services, Notification of Enforcement Discretion under HIPAA to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to covid-19 (16 June 2021),

18 See 'The External Review of Hospital Quality: A Call for Greater Accountability', (July 1999 OEI-01-97-00050) ('As the system increasingly tilts toward the collegial mode, however, it could result in insufficient attention to investigatory efforts intended to protect patients from questionable providers and substandard practices.').

19 Vanessa McMains, Johns Hopkins University HUB, 'Johns Hopkins study suggests medical errors are third-leading cause of death in US' (3 May 2016), available at (last accessed 11 June 2019).

20 See 42 C.F.R. §§ 1001.952(ee), (ff) and (gg); see also 85 Fed. Reg. 77,684 (20 December 2020).

21 See 85 Fed. Reg. at 77,687.

22 There is a related Medicaid Stark provision, but it has rarely been enforced against healthcare providers.

23 See 85 Fed. Reg. 77,492 (Dec. 2, 2020).

24 See 42 C.F.R. § 411.357(aa).

25 See Johns Hopkins University & Medicine, COVID-19 Dashboard by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins, (last visited 16 June 2021).

26 See COVID-19: Opportunities to Improve Federal Response and Recovery Efforts, Report to Congress,

GAO-20 -625 (25 June 2020) [hereinafter June 2020 GAO report]; see Johns Hopkins University & Medicine, COVID-19 Dashboard by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins, (last visited 16 June 2021).

27 See Hospitals Face Continued Financial Challenges On Year into the COVID-19 Pandemic, American.

Hospital Assn. (March 2021).

28 See June 2020 GAO Report.

29 See Centers for Medicare and Medicaid Services, COVID-19 Emergency Declaration Blanket Waivers for Health Care Providers (25 June 2020),

30 See id.

31 See US Department of Health & Human Services, Notification of Enforcement Discretion under HIPAA to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19 (2 April 2020),

32 See US Food & Drug Administration, Ventilators and Ventilator Accessories EUAs (29 June 2020),; see also US Food & Drug Administration, Policy for Coronavirus Disease-2019 Tests During the Public Health Emergency (Revised), Immediately in Effect Guidance for Clinical Laboratories, Commercial Manufacturers, and Food and Drug Administration Staff (11 May 2020),

33 In a move that confused many, Vice President Mike Pence issued an announcement that HHS would issue a regulation allowing medical professionals to practise across state lines to assist with the covid-19 pandemic. However, this authority is generally held by states, and HHS issued no such regulation. See Remarks by President Trump, Vice President Pence, and Members of the Coronavirus Task Force in Press Briefing (18 March 2020),; see also Federation of State Medical Boards, US State and Territories Modifying Licensure Requirements for Physicians in Response to COVID-19 (last updated 22 June 2020),

34 See, e.g., State of Texas Executive Department, Executive Order GA 15 (17 April 2020); State of Rhode Island and Providence Plantations, Executive Order 20-21 (10 April 2020); State of Illinois, Executive Order 2020-26 (16 April 2020); Commonwealth of Virginia, Executive Order Number Fifty-Two (2020) (20 March 2020); Commonwealth of Massachusetts, Order of the Commissioner of Public Health Exempting Hospitals from the Requirements of M.G.L. c. § 111, 231 (24 March 2020).

35 See Federation of State Medical Boards, US States and Territories Modifying Requirements for Telehealth in Response to COVID-19 (last updated 26 June 2020),

36 See, e.g., State of Arizona, Executive Order 2020-27 (9 April 2020); State of Connecticut, Executive Order 7U (5 April 2020); State of Illinois, Executive Order 2020-19 (1 April 2020); State of New Jersey, Executive Order No. 112 (1 April 2020).

37 See Kaufman Hall, Nat'l. Hosp. Flash Rep.,; see also COVID-19 Pandemic Results in Bankruptcies or Closures for Some Hospitals, American Hospital Assn. (November 2020).

38 See Centers for Disease Control & Prevention, COVID-19 in Racial and Ethnic Minority Groups, (updated 25 June 2020).

39 See, e.g., Institute for Healthcare Improvement, The IHI Triple Aim, (last viewed 20 July 2020).

The Law Reviews content