Management of Human Resources and Health Professionals
There are consistent changes with labor laws and various other regulatory requirements in healthcare, which forces the workforce engagement departments to make policy updates. Using this week’s reference materials, provide a scenario or recent change in your organization’s workforce. What was the change? Would you have handled it differently? If so, why? Please use this week’s references to support your response.
5Journal of Health Care Compliance — September–October 2019 5
Skilled Nursing Required
Compliance and Ethics
Programs—Changes and Key
Components
John Dailey is president of
Management Advisors Inc. He can be
reached at 859/353-2900.
John Dailey / Sean Fahey
P
rior to July 2019, the skilled nursing world had its
countdown clock set for November 28, 2019, as the
implementation date for the new compliance and
ethics program requirement. There was a collective gasp
when the announcement was made on that mid-July
day that the Centers for Medicare & Medicaid Services
(CMS) would be issuing revisions to the new require-
ment. Almost three years earlier, the October 4, 2016
Federal Register spelled out, in detail, the new require-
ment that each skilled nursing facility in the country
create and implement an effective compliance and eth-
ics program. Skilled nursing facility (SNF) providers had
a new lexicon thrust upon them with words like compli-
ance liaison and compliance officer. As quickly as those
words appeared in the 2016 final rule, they vanished in
the 2019 proposed rule. So, exactly what changed, what
didn’t, and how does all of this impact a skilled nursing
facility’s compliance efforts? A look to the past may shed
some light on where we are headed.
A Look BAck
In 2000, the Department of Health and Human Services
(HHS) Office of Inspector General (OIG) issued its
memo titled “Publication of the OIG Compliance
Program Guidance for Nursing Facilities” (OIG Memo).
The voluntary guidance contained elements that the
OIG determined to be necessary for an effective com-
pliance program for nursing facilities, including specific
risk areas. In 2008, the OIG issued supplemental guid-
ance with new compliance recommendations and an
expanded list of risk areas. As in 2000, this supplemen-
tal guidance was voluntary.
The benefits of creating and implementing a compli-
ance program in SNFs may seem common sense today,
but prior to the OIG guidance, few SNF providers had
Sean Fahey is an attorney with Hall,
Render, Killian, Heath & Lyman, P.C and
can be reached at 317/977-1472 or by
email at sfahey@hallrender.com.
mailto:sfahey@hallrender.com
Journal of Health Care Compliance — September–October 20196
Skilled Nursing Required Compliance and Ethics Programs
a formal compliance plan. While many of
the compliance elements, like auditing and
monitoring, have been a staple of SNF oper-
ations for years, the concept of a formalized
“Compliance Program” was foreign to many
in the nursing facility world. Nevertheless,
some providers did begin implementing
programs based on the 2000 and 2008 volun-
tary OIG guidance. Others took a wait-and-
see approach. The waiting ended with the
passage of the Affordable Care Act (ACA).
SNFs were first required to create and
maintain compliance and ethics programs
under Section 6102 of the ACA, which
added Subsection 1128I(b) to the Social
Security Act. The ACA called for SNF
compliance and ethics programs to be
reasonably designed, implemented, and
enforced so that they are likely to be effec-
tive in preventing and detecting criminal,
civil, and administrative violations under
the ACA and in promoting quality of care.
In 2016, CMS issued final regulations to
Part 483 to Title 42 of the Code of Federal
Regulations the Requirements for States
and Long-Term Care Facilities (RoPs) that
included compliance and ethics program
regulations. These RoP changes were
the first major change in almost three
decades. The first requirements for nurs-
ing facilities were published in 1989 with
few revisions and updates since that time.
Substantial changes have taken place in
this service delivery setting with increas-
ing diversity and clinical complexity of
the nursing facility population. The 2016
regulatory changes were so sweeping that
the implementation dates were divided
into three phases. The compliance and
ethics program requirements were under
Phase 3 with a date of November 28, 2019.
JuLy 2019 ProPosed ruLe
On July 18, 2019, CMS released proposed
revisions (proposed rule) to the RoPs. CMS
stated that it identified a number of existing
SNF requirements that could reduce unnec-
essary burdens on facilities if they were
simplified or eliminated. The proposed
rule would alter over a dozen sections of
the RoPs, including: (1) resident rights; (2)
admissions transfers and discharges; (3)
quality of care; (4) nursing services; (5)
behavioral health; (6) pharmacy services;
(7) food and nutrition services; (8) facil-
ity assessments; (9) physical environment;
(10) compliance and ethics programs;
(11) Quality Assurance and Performance
Improvement (QAPI) programs; and (12)
infection control. The proposed rule also
proposes to delay implementation to some
of these Phase 3 provisions until one year
following the effective date of the pro-
posed rule. One of the areas significantly
impacted by the proposed rule includes
compliance and ethics programs (§483.85).
The ACA and proposed rule call for
skilled nursing compliance and ethics pro-
grams to be reasonably designed, imple-
mented, and enforced so that they are
likely to be effective in preventing and
detecting criminal, civil, and administra-
tive violations under the ACA and in pro-
moting quality of care.
The statutory and regulatory require-
ments for skilled nursing compliance and
ethics programs are different from volun-
tary compliance programs of many health
care providers. SNF providers need to
consider establishing a separate program
and operations for their skilled nursing
facilities.
required comPonents under the
ProPosed ruLe
The regulations set out 10 required compli-
ance and ethics program components: In
outlining each of the components, note the
references to the proposed rule (2019),
the final rule prior regulations (2016), and
the voluntary guidance OIG Memos (2000
and 2008).
1. Assignment of Oversight of
Compliance and Ethics Program
Section 483.85(c)(2) of the proposed
rule demands that a facility assign the
Journal of Health Care Compliance — September–October 2019 7
Skilled Nursing Required Compliance and Ethics Programs
overall responsibility to oversee compli-
ance with the operating organization’s
compliance and ethics program’s stan-
dards, policies, and procedures to a spe-
cific individual or individuals within the
high-level personnel of the operating
organization.
The proposed rule removed prior regu-
lations that identified that the individual
who oversees the compliance and ethics
program may be: (a) the chief executive
officer (CEO); (b) a member of the board
of directors; or (c) a director of major
divisions in the operating organization.
The proposed rule continues to define
a “high-level personnel” as an individ-
ual who has substantial control over
the operating organization or who has
a substantial role in the making of pol-
icy. All facilities must have an employee
that has specific compliance oversight
responsibilities.
In its 2000 OIG Memo regarding vol-
untary compliance, the OIG set out a
list of the compliance officer’s recom-
mended primary responsibilities, which
include: (a) reporting on a regular basis
to the facility’s governing body, CEO, and
compliance committee (if applicable) on
the progress of implementation; (b) peri-
odically revising the program in light of
changes in the organization’s needs and in
the law and policies of government and
private payor health plans; and (c) devel-
oping, coordinating, and participating in
a multifaceted educational and training
program.
2. Written Compliance and Quality of
Care Policies and Procedures
The proposed rule requires that the operat-
ing organization for each facility develop,
implement, maintain, and establish writ-
ten compliance and ethics standards, pol-
icies, and procedures that are reasonably
capable of reducing the prospect of crim-
inal, civil, and administrative violations
under the Act.
The voluntary guidance found in the
2000 OIG Memo may shed more light
on the written policies and procedures
requirement calling for facilities to
develop a “Code of Conduct,” a corporate
statement of principles that will guide
the operations of the facility. The Code
of Conduct acts as a constitution, a foun-
dational document that details the facil-
ity’s fundamental principles, values, and
framework for actions.
3. Sufficient Resources and Authority
to Ensure Compliance
Section 483.85(c)(3) of the proposed
rule requires that each facility develop,
implement, maintain, and establish an
effective compliance and ethics pro-
gram that contains sufficient resources
and authority to its “high-level person-
nel” to reasonably assure compliance
with the facility’s compliance and eth-
ics program standards, policies, and
procedures. The OIG Memo recognized
that some nursing facilities might not
be able to adopt certain elements to the
same degree as others with more exten-
sive resources.
4. Screening Process for Positions with
Discretionary Authority
The proposed rule requires that a facility
take care not to delegate substantial dis-
cretionary authority to individuals who
the facility knew, or should have known
through the exercise of due diligence, had
a propensity to engage in criminal, civil,
and administrative violations under the
Social Security Act. OIG and CMS have
identified patient abuse, patient neglect,
and misappropriation of property as
widespread problems that cause harm to
long-term-care residents. The OIG Memo
identifies that facilities are required by
federal, and in some cases state, law to
investigate the background of certain
employees.
Journal of Health Care Compliance — September–October 20198
Skilled Nursing Required Compliance and Ethics Programs
5. Effective Communication and
Training of Compliance Standards to
Staff, Contractors, and Volunteers
The proposed rule requires that a facility
take steps to effectively communicate the
standards, policies, and procedures of the
compliance and ethics program to the staff;
individuals providing services under a
contractual arrangement; and volunteers,
consistent with the volunteers’ expected
roles. The communication requirements
include mandatory participation in train-
ing or orientation programs or dissemi-
nating information that explains, in a
practical manner, what the compliance
program requires.
This component relates to the train-
ing regulation at 42 C.F.R. Sec. 483.95(f)
in the proposed rule, which requires that
a facility have an effective way to com-
municate that program’s standards, poli-
cies, and procedures through a training
program or in another practical manner
which explains the requirements under
the program.
The OIG Memo emphasized that spe-
cific training on issues such as claims
development and submission processes,
residents’ rights, and marketing practices
should be targeted at those employees and
contractors whose job requirements make
the information relevant.
6. Procedures to Promote
Compliance—May Include Monitoring
and Auditing Systems
The proposed rule also requires that facil-
ities utilize auditing and monitoring sys-
tems that are designed to detect criminal,
civil, and administrative violations under
the Act. The auditing and monitoring sys-
tem is to ensure compliance with facility
policies and procedures and applies to staff
and individuals providing services under a
contract.
The regulations detail the type of
auditing and monitoring that is required,
which includes: (a) implement an
auditing and monitoring system rea-
sonably capable of detecting violations
under the Act; (b) the system of audit-
ing and monitoring to detect suspected
violations applies to staff, individu-
als providing services under a contrac-
tual arrangement, or volunteers; and
(c) implement a reporting system that
allows individuals to report suspected
violations within the operating organiza-
tion without fear of retribution.
The OIG Memo recommends that the
extent and frequency of the monitor-
ing should take into account the facil-
ity’s resources, prior compliance history,
and other risk factors particular to the
facility.
7. Consistently Enforced Disciplinary
Actions
The proposed rule requires that a facility
have consistent disciplinary mechanisms
in place, including, as appropriate, disci-
pline of individuals responsible for the fail-
ure to detect and report a violation (which
the ACA describes as an “offense”) to the
compliance and ethics program contact in
the organization.
The OIG Memo advises that each situa-
tion be addressed on a case-by-case basis
to determine the appropriate disciplinary
measures and that the written standards
of conduct address how disciplinary prob-
lems will be handled and who is respon-
sible for handling them.
8. Appropriate Response to Violations
and Prevention of Similar Future
Violations
The proposed rule requires that after
a violation is detected, the facility take
all reasonable steps identified in its pro-
gram to respond appropriately to the
violation and to prevent further simi-
lar violations, including any necessary
modification to the operating organi-
zation’s program to prevent and detect
Journal of Health Care Compliance — September–October 2019 9
Skilled Nursing Required Compliance and Ethics Programs
criminal, civil, and administrative viola-
tions under the Act.
The OIG Memo provides that, once
reports of suspected violations are
received, it expects the compliance offi-
cer to immediately investigate to deter-
mine if a violation has occurred. The type
of corrective action would be determined
on a case-by-case basis but would include
a corrective action plan, return of any
overpayments, reports to state and local
government or a referral to criminal or
civil law enforcement.
9. Alternate Method of Reporting
Suspected Violations Anonymously
The proposed rule requires that the facil-
ity have an alternate method of reporting
suspected violations anonymously. While
this requirement may pose some chal-
lenges to some operators, it echoes the
voluntary 2000 OIG Memo for the creation
and maintenance of an effective line of
communication, including a process, such
as a hotline or other reporting system, to
receive complaints, and the adoption of
procedures to protect the anonymity of
complainants and to protect whistleblow-
ers from retaliation.
10. Periodic Review and Update of the
Compliance Program
The proposed rule requires that a facil-
ity review its compliance and ethics pro-
gram periodically and revise its program as
needed to reflect changes within the oper-
ating organization and its facilities. The
prior regulations required that the operat-
ing organization for each facility review its
compliance and ethics program annually
and revise its program as needed to reflect
changes in all applicable laws or regula-
tions and within the operating organization
and its facilities to improve its performance
in deterring, reducing, and detecting vio-
lations under the ACA and in promoting
quality of care.
AdditionAL requirements for
orgAnizAtions with five or more
fAciLities And fAciLities with corPorAte
LeveL mAnAgement of muLti-unit
chAins
The proposed rule addresses additional
requirements for operating organizations
with five or more facilities and facilities
with corporate level management of multi-
unit nursing home chains. An operating
organization is defined as the individual(s)
or entity that operates the facility. The
regulations set forth what is required for
operating organizations with five or more
facilities and facilities with corporate level
management of multi-unit nursing home
chains, which includes: (a) having a more
formal program that includes established
written policies defining the standards and
procedures to be followed by its employees;
and (b) developing a compliance and eth-
ics program that is appropriate for the com-
plexity of the operating organizations and
its facilities. The prior regulations required
these operating organizations and facilities
to (a) conduct a mandatory training on the
operating organization’s compliance and
ethics program; (b) designate a compliance
officer that reports directly to the operating
organization’s governing body, who must
not be subordinate to the general counsel,
chief financial officer, or chief operating
officer; and (c) compliance liaisons must
be located at each of the operating organi-
zation’s facilities.
interAction with qAPi ProgrAm And
fAciLity Assessment
In CMS’s responses to public comments on
the RoPs, CMS wrote that facilities should be
integrating the information and data they
collect or that arises out of their compli-
ance and ethics programs into their Quality
Assurance and Performance Improvement
(QAPI) program. The proposed rule revised
many of the requirements of QAPI, and
providers need to carefully review the
impact of these changes on their program.
CMS also expects that all facilities will also
Journal of Health Care Compliance — September–October 201910
Skilled Nursing Required Compliance and Ethics Programs
use the Facility Assessment when develop-
ing and maintaining their compliance and
ethics programs.
risk Assessment
Although not addressed in the proposed
rule or prior regulations, the risk assess-
ment is an important piece of develop-
ing an effective compliance program. For
those skilled nursing facilities that are just
getting started or for those that are looking
to make their program more effective, an
accurate risk profile is essential to a healthy
compliance program. Taking the time to
assess common industry risks (external)
and the risks specific to each SNF (internal)
can reap huge benefits. A risk assessment
also guides application of the required ele-
ments. What policies are needed? What
should be audited? What content is crucial
in education and training? Look to the risk
assessment for answers. Start with a simple
list of both internal and external risks and
rank according to potential impact at the
facility level.
engAgement
It’s no secret that skilled nursing facili-
ties have a multitude of regulations. New
requirements often mean new policies.
New policies require new procedures.
There is a tendency when new regulations
and laws are made to write the policy, put
it in a binder, and file it away. The check-
mark is made, and operators move to the
next thing on their ever-growing “to-do”
list. The Phase 3 Compliance and Ethics
Program requirement is not just a checklist
item. Providers who take the time to build
an effective program can potentially reap
benefits in all areas of operations, includ-
ing improved quality of care, better regula-
tory outcomes, protecting reimbursement,
and guarding the organization’s reputation.
To have a truly effective compliance and
ethics program, it must start at the top with
company owners, boards, and executives.
If leadership does not think it’s important,
the workforce will know. If compliance
becomes a paperwork checklist item, the
frontline folks will know. Top leadership
must believe in the value of compliance
and engage the entire organization to have
a truly effective program.
imPLementAtion timefrAme And survey
guidAnce
Under the proposed rule, beginning on
November 28, 2020, surveyors determine
whether a facility’s compliance and eth-
ics program fulfills the requirements in the
proposed rule. CMS, however, has not yet
issued significant interpretive guidance on
Section 483.85.
where we go from here
Although some requirements of the com-
pliance and ethics component of the RoP
have changed and effective dates delayed,
skilled nursing facilities that do not already
have a compliance and ethics program
should begin putting one in place so that
they are ready for survey enforcement.
Facilities that have implemented compli-
ance and ethics programs should review the
proposed rule requirements against their
existing programs and revise as necessary.
Reviewing the voluntary OIG Guidance
memos from 2000 and 2008 may also help
enrich a facility’s compliance plan. Using
QAPI and the Facility Assessment can help
enhance compliance efforts. Consider the
risk assessment as a starting point for the
rest of the program. Engage top leadership
so that the plan is truly effective. Finally,
don’t forget to reset your countdown clock!
Copyright of Journal of Health Care Compliance is the property of Aspen Publishers Inc. and
its content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder’s express written permission. However, users may print, download, or email
articles for individual use.
35Journal of Health Care Compliance — July–August 2
0
19 35
Health care attorney Laura F. Fryan
works with health care providers,
hospitals, health plans, and health care
companies to solve complex problems
and to facilitate transactions, includ-
ing joint ventures, leasing of physician
practices, and the buying and selling
of hospitals, physician groups, and
other health care-related entities. She
advises clients on HIPAA, Stark, and
anti-kickback compliance, vendor
agreements and employment con-
tracts, overpayments and government
investigations, reimbursement from
commercial and government payors,
facility bylaws and peer review plans,
and state and federal licensing.
Patient Visits
lAuRA f. fRyAn
Going Viral: Not Always
a Good Thing
Medical Facilities Should Address Patient
Recordings and Photography and Implement a
Suitable Policy
Remember when the passenger on an overbooked United
Airlines flight was forcibly removed from the plane and
videos of the incident went viral on social media? Viral
videos are made in an instant, but the impressions they
leave can be long-lasting, and this is only one example of
the power of a video recording.
In this day and age, the widespread use of record-
ings, photography, and even live-streaming poses a
significant concern to many businesses, including med-
ical practices, hospitals, and other health care facilities.
Multiple news stories in recent years—including a man
who recorded audio of physicians making derogatory
remarks during his colonoscopy and a woman who
recorded audio of physicians disparaging her race and
physical appearance during an abdominal surgery—
have highlighted the need for practitioners to address
patient recordings during office visits and procedures.
This article will discuss patient- and visitor-initiated
recording and photography during a medical visit and
ways practitioners can proactively address this emerg-
ing issue.
Points to PondeR
State recording laws are the first place to look to deter-
mine whether patient recording or photography is
permissible. Many states, including Ohio, allow the
recording of a conversation if one participant consents
to the recording. In practical terms, this means that a
person recording a conversation does not need to have
the consent of anyone else that is part of the conversa-
tion. Thus, a patient or visitor can record a physician or
other staff member at a medical practice without anyone
else’s consent. Unfortunately, it can be difficult to pre-
vent a patient or visitor from recording audio or video or
taking photographs. If asked, however, physicians and
Journal of Health Care Compliance — July–August 201936
Patient Visits
staff members have the right to say no to a
recording or picture.
to PRohiBit oR PeRMit?
Ultimately, the decision to prohibit or per-
mit recordings and photography is up to
the medical practice or facility, though it
is important to develop policies and pro-
cedures ahead of time to ensure that phy-
sicians and staff respond to recording
situations appropriately. These are a few
considerations for each side of the coin.
Prohibit All Patient Recordings and
Pictures
There are advantages to having a bright-
line approach. For example, prohibiting all
recordings and photography means less of
a risk that other, nonrecording (and non-
consenting) patients are inadvertently
recorded or photographed. Additionally, a
bright-line policy accompanied by a signed
patient acknowledgement of that policy
could help limit or mitigate provider liabil-
ity arising from in-office patient recordings.
There are also several drawbacks to
an absolute ban on patient recording and
photography. First, when a patient refuses
to comply, there are no good options from
a business or patient-relationship per-
spective. Patient refusal to comply with
an anti-recording and photography pol-
icy is often resolved with isolation of the
patient within the facility, removal from
the premises, or removal from the prac-
tice. In other words, providers should be
mindful of the ways an anti-recording
and photography policy may undermine
efforts to ensure patient comfort and
develop trust during a visit. Second, since
it is impossible to prevent patients or visi-
tors from using less conspicuous means to
record a visit, providers lose the chance to
have more control over the recording or
photograph—a matter discussed in more
detail later in this article.
Implementing an anti-recording and
photography policy should include posting
a statement about the prohibition in prom-
inent places and preparing personnel to
politely address recording situations and
answer any questions patients or visitors
may have about why recordings and pho-
tography are prohibited. An anti-recording
and photography policy also should con-
tain appropriate procedures for address-
ing refusal to comply; some facilities even
have patients read and sign an acknowl-
edgment notifying them that recordings
and photography are not permitted. These
policies and procedures can help alleviate
the surprise or distress patients, visitors,
or medical personnel might experience as
the result of an anti-video recording and
photography policy.
Regulate Patient Recording/Photos
With more patients seeking to record vis-
its, now may be the time to embrace the
value of recordings and regulate this prac-
tice effectively. Allowing patients to record
or photograph their visits can contribute to
patient peace of mind, and the increased
transparency of the medical practice can
help build trust between physicians and
patients. Implementing permissive patient
recording and photography regulations can
result in more control over the process by
practitioners and facilities. In addition to
having patients sign an acknowledgment
of the policy, some offices include a release
that expressly waives patient claims result-
ing from subsequent dissemination and use
of the recording or photograph. By regulat-
ing instead of prohibiting patient record-
ing and photography, a medical practice
or facility can gain more control over the
recording process, thereby gaining more
control over the recording itself.
Of course, permitting patient record-
ings and photographs is not without
risks. As previously mentioned, allow-
ing patient recordings and photographs
means that there is an ever-present risk
that other, nonconsenting patients may
Continued on page 49
Journal of Health Care Compliance — July–August 2019 47
12. Id.
13. Id. at 9.
14. Id.
15. Id.
16. Id.
17. Id.
18. Id. at 37.
19. 45 C.F.R. § 160.10.
20. Id. at 29.
21. Id.
22. Id.
23. Id. at 22.
24. Id.
25. In fact, the updated Code’s definition of “Medical
Technology” acknowledges this increasing com-
plexity. Both the current and updated Codes refer-
ence specific examples in the definition, including
implantables, surgical devices, and noninvasive
reagents, instrumentation, and/or software. The
updated Code also includes, however, a reference
to digital technology and software platforms that
aid in the monitoring, diagnosing, and treating of
patients, and a general definition not present in the
current Code, which references “medical devices
and products, technologies, digital and software
platforms, and related services, solutions, and
therapies used to diagnose, treat, monitor, manage,
and alleviate health conditions and disabilities.”
Code at 6.
26. Id. at 12.
27. Id.
28. Id. at 13.
29. Meske Testimony at 5 (referencing a settlement with
multiple hip and knee device manufacturers).
30. Id. at 14.
31. Id. at 13-14.
32. Id.
33. Id.
34. Id.
35. Id. at 26.
36. Id. at 15.
37. Id. at 16.
38. Id. at 17.
39. Id. at 16.
40. Id. at 20.
41. Id. at 21.
42. See Prior Code at 10; Code at 33.
43. Id.
44. Id.
45. 42 U.S.C. § 1320a-7a(a).
46. 31 U.S.C. §§ 3729-3733.
47. 42 U.S.C. § 1320a-7b(b).
48. See e.g., United States v. Nagelvoort, 856 F.3d 1117
(7th Cir. 2017); United States v. McClatchey, 217 F.3d
823 (10th Cir. 2000); United States v. Davis, 132 F.3d
1092 (5th Cir. 1998); United States v. Kats, 871 F.2d
105 (9th Cir. 1989); United States v. Greber, 760 F.2d
68 (3d Cir. 1985), cert. denied, 474 U.S. 988 (1985).
49. U.S. Public Law 111-148, March 23, 2010, § 6402(f )(2).
A violation of the AKS is a felony and may be
punished by fines of up to $100,000 and/or impris-
onment for up to 10 years. In addition, the federal
government may impose civil monetary penalties of
up to $100,000 per kickback and damages calcu-
lated at three times the amount of the remuneration
and exclude violators from participation in federal
health care programs. Furthermore, violations of
the AKS also may expose an individual or entity to
liability under the federal False Claims Act, includ-
ing via qui tam action, for knowingly presenting, or
causing to be presented, to the government a false
or fraudulent claim for payment or approval, which
imposes penalties of not less than $11,181 and not
more than $22,363 per claim, plus three times the
amount of damages that the government sustains
because of the submission of the false claim.
50. 42 C.F.R. § 1001.952(d).
51. OIG, Medicare and State Health Care Programs:
Fraud and Abuse; Clarification of the Initial OIG Safe
Harbor Provisions and Establishment of Additional
Safe Harbor Provisions Under the Anti-Kickback
Statute, 64 Fed. Reg. 63518, 63526 (Nov. 19, 1999).
52. OIG, Compliance Guidance for Pharmaceutical
Manufacturers, 68 Fed. Reg. 23731 (May 5, 2003).
53. Id. at 23742.
54. OIG, Compliance Program Guidance for Hospitals,
63 Fed. Reg. 8987 (Feb. 23, 1998); Supplemental
Compliance Program Guidance, 70 Fed. Reg. 4858
(Jan. 31, 2005).
55. OIG, Compliance Guidance for Individual and Small
Group Physician Practices, 65 Fed. Reg. 59,434 (Oct.
5, 2000).
56. 68 Fed. Reg. at 23,738.
57. 68 Fed. Reg. at 23734; 70 Fed. Reg. 4864.
58. OIG, Roadmap for New Physicians: Avoiding
Medicare and Medicaid Fraud and Abuse, available
at oig.hhs.gov/compliance/physician-education/
roadmap_web_version .
59. Id. at 22. The OIG further warns physicians (in bold
type): “If your contribution is your ability to prescribe
a drug or use a medical device or refer your patients
for particular services or supplies, the proposed con-
sulting arrangement likely is one you should avoid
as it could violate fraud and abuse laws.” Id. at 23.
60. Id. at 25.
61. Id.
62. Provisions of the Code that have not changed
from the current version include Educational &
Patient Benefit Items; Clinical Studies and Research
Arrangements (though now in narrative form rather
than only in the “Frequently Asked Questions”);
Prohibition on Gifts; Prohibition on Entertainment &
Recreation; Travel & Lodging; and Venue. While we
have not included these areas of the Code in this
summary, HCPs should ensure that any arrange-
ments with companies are compliant with these
guidelines as well.
MediCal teChnology
Continued from 16
0
Journal of Health Care Compliance — July–August 201948
programs], to prevent any of them from implement-
ing their own laws that authorize the use, distribu-
tion, possession, or cultivation of medical marijuana.”
Consolidated Appropriations Act, 2019, Pub. L. No.
116-6, § 537, available at www.govtrack.us/congress/
bills/116/hr21/text.
9. See United States v. McIntosh, 833 F.3d 1163 (9th Cir.
2016). Three caveats are important to note. First, the
Ninth Circuit’s decision may be persuasive for, but
is not binding on, other federal appellate courts.
Therefore, another appellate circuit court could
interpret the Rohrabacher provision’s scope differ-
ently, although district courts in other circuits have
adopted the Ninth Circuit’s interpretation. Second,
most courts considering the issue have decided that
the criminal defendant, not the government, has the
burden to prove strict compliance with state law. See
United States v. McIntosh, No. 14-cr-00016 (N.D. Cal.
Mar. 20, 2017); United States v. Daleman, No. 1:11-
CR-00385, 2017 WL 1256743 (E.D. Cal. Feb. 17, 2017);
United States v. Gentile, No. 1:12-cr-00360, 2017 WL
1437532 (E.D. Cal. Apr. 24, 2017); but see United States
v. Samp, No. 16-cr-20263, 2017 WL 1164453 (E.D.
Mich. Mar. 29, 2017) (burden of proof on govern-
ment). Third, the Ninth Circuit noted in the McIntosh
opinion that the Rohrabacher provision protects
against prosecution only while the provision is in
place; if it were not continued at any point, the DOJ
could prosecute any past conduct within the statute
of limitations. McIntosh, 833 F.3d at 1179 n.5. see also
United States of Am. v. Marin All. for Med. Marijuana,
139 F. Supp. 3d 1039 (N.D. Cal. 2015), appeal dis-
missed No. 15-17486 (9th Cir. Apr. 12, 2016).
10. See supra n.8.
11. SAFE Banking Act of 2019. H.R. 1595, 116th Cong.
§ 1 (2019), www.congress.gov/bill/116th-congress/
house-bill/1595.
12. Strengthening the Tenth Amendment Through
Entrusting States Act, H.R. 2093, 116th Cong. § 1
(2019), available at www.congress.gov/bill/
116th-congress/house-bill/2093/text.
13. Kyle Jaeger, Top Congressional Democrats Announce
Bill To Federally Deschedule Marijuana, marijuana
moment (May 9, 2019), www.marijuanamoment.net/
top-congressional-democrats-announce-bill-to-
federally-deschedule-marijuana/.
14. See Rick Schettino, Marijuana Freedom and
Opportunity Act introduced to federally decriminalize
cannabis, www.potnetwork.com/news/marijuana-
freedom-and-opportunity-act-introduced-federally-
decriminalize-cannabis.
15. 42 C.F.R. § 482.25.
16. Durkin M., Medical marijuana . . . in the hospital? As
states legalize marijuana, hospitals develop policies
on inpatient use. ACP Hospitalist. January 2017.
acphospitalist.org/archives/2017/01/marijuana-
policies-hospital.htm.
17. Minnesota Hospital Associate, Medical Cannabis
Template Policy (June 17, 2015), available at www.
mnhospitals.org/Portals/0/Documents/patient-
safety/MedCannabis/Medical%20Cannabis%20
Documentation .
18. Washington Health Care Association, Draft Medical
Marijuana Policy, available at www.whca.org/files/
2013/04/sample-medical-marijuana-policy .
19. As previously stated, entities that are only
involved in the medical side of the cannabis
industry have federal protection under the Joyce
Amendment (previously the Rohrabacher-Farr
Amendment), which prevents the DOJ from
spending money to prosecute those in strict
compliance with state medical cannabis laws. This
does not apply to the FDA, which is not restricted
in this fashion.
20. See supra n.2.
21. Statement from FDA Commissioner Scott Gottlieb,
M.D., on signing of the Agriculture Improvement Act
and the agency’s regulation of products containing
cannabis and cannabis-derived compound, dated
Dec. 20, 2018, available at www.fda.gov/NewsEvents/
Newsroom/PressAnnouncements/ucm628988.htm.
22. Id.
23. Links to Gottlieb’s prepared testimony and to a
video of the committee hearing can be found here:
www.appropriations.senate.gov/hearings/review-of-
the-fy2020-budget-request-for-the-fda. Even though
Gottlieb has stated multiple times that congressional
action would be needed for a speedy solution, con-
gressional observers believe that the current 116th
Congress is not likely to act on CBD regulation.
24. Statement from FDA Commissioner Scott Gottlieb,
M.D., on new steps to advance agency’s continued
evaluation of potential regulatory pathways for
cannabis-containing and cannabis-derived products,
available at www.fda.gov/NewsEvents/Newsroom/
PressAnnouncements/ucm635048.htm.
25. The Health Insurance Portability and Accountability
Act of 1996. Pub. L. 104-191. Stat. 1936; 45 C.F.R. Part
160 and Subparts A and E of Part 164.
26. 45 C.F.R. § 160.103.
27. A health care provider means a provider of medical
or health services (as defined in Section 1861(s) or
Section 1861(u) of the Social Security Act) and any
other person or organization who furnishes, bills, or
is paid for health care in the normal course of busi-
ness. 45 C.F.R. § 160.103.
28. HIPAA-covered transactions include the follow-
ing types of information transmission: (1) health
care claims or equivalent encounter information;
(2) health care payment and remittance advice;
(3) coordination of benefits; (4) health care claim
status; (5) enrollment and disenrollment in a health
plan; (6) eligibility for a health plan; (7) health plan
premium payments; (8) referral certification and
authorization; (9) first report of injury; (10) health
are u.S. health Care
Continued from 22
0
www.govtrack.us/congress/bills/116/hr21/text
www.govtrack.us/congress/bills/116/hr21/text
www.congress.gov/bill/116th-congress/house-bill/1595
www.congress.gov/bill/116th-congress/house-bill/1595
www.congress.gov/bill/116th-congress/house-bill/2093/text
www.congress.gov/bill/116th-congress/house-bill/2093/text
www.marijuanamoment.net/top-congressional-democrats-announce-bill-to-federally-deschedule-marijuana/
www.marijuanamoment.net/top-congressional-democrats-announce-bill-to-federally-deschedule-marijuana/
www.marijuanamoment.net/top-congressional-democrats-announce-bill-to-federally-deschedule-marijuana/
www.potnetwork.com/news/marijuana-freedom-and-opportunity-act-introduced-federally-decriminalize-cannabis
www.potnetwork.com/news/marijuana-freedom-and-opportunity-act-introduced-federally-decriminalize-cannabis
www.potnetwork.com/news/marijuana-freedom-and-opportunity-act-introduced-federally-decriminalize-cannabis
acphospitalist.org/archives/2017/01/marijuana-policies-hospital.htm
acphospitalist.org/archives/2017/01/marijuana-policies-hospital.htm
www.mnhospitals.org/Portals/0/Documents/patientsafety/MedCannabis/Medical%20Cannabis%20Documentation
www.mnhospitals.org/Portals/0/Documents/patientsafety/MedCannabis/Medical%20Cannabis%20Documentation
www.mnhospitals.org/Portals/0/Documents/patientsafety/MedCannabis/Medical%20Cannabis%20Documentation
www.mnhospitals.org/Portals/0/Documents/patientsafety/MedCannabis/Medical%20Cannabis%20Documentation
www.whca.org/files/2013/04/sample-medical-marijuana-policy
www.whca.org/files/2013/04/sample-medical-marijuana-policy
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm628988.htm
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm628988.htm
www.appropriations.senate.gov/hearings/review-of-the-fy2020-budget-request-for-the-fda
www.appropriations.senate.gov/hearings/review-of-the-fy2020-budget-request-for-the-fda
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm635048.htm
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm635048.htm
Copyright of Journal of Health Care Compliance is the property of Aspen Publishers Inc. and
its content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder’s express written permission. However, users may print, download, or email
articles for individual use.
17Journal of Health Care Compliance — July–August 2019 17
In the Weeds: Are U.S. Health
Care Companies Ready for a
Legal Cannabis Market?
Three Potential Compliance Issues that Health Care
Industry Participants Should Anticipate
Joanne Caceres / Michael Montgomery
T
he trend of legalizing the distribution and use of
medical cannabis in the United States has main-
tained momentum, positioning the industry for
continued rapid growth that will have increasingly wide-
spread regulatory and compliance implications across
the health care sector. As of May 2019, 33 states and four
territories, including the District of Columbia, have to
some extent legalized cannabis for medical uses, and
13 other states permit access to oils high in cannabidiol
(CBD) and low in tetrahydrocannabinol (THC), the main
psychoactive component of cannabis. While the scope
and exact requirements of such laws vary state to state,
the accompanying regulatory schemes have called for
significant and ongoing adaptation by most major health
care players, including physicians, hospitals, and phar-
maceutical companies.1
Despite the liberalization at the state level, federal
law vis-à-vis the Controlled Substances Act (CSA) cur-
rently classifies cannabis, including its component
parts, as an illegal “Schedule I” substance deemed to
have no acceptable medical use.2 This categorization,
coupled with other federal statutes and regulations,
has created an uncertain, disadvantageous, and even
hostile environment for the integration of medical can-
nabis into the health care space. Due to these inherent
compliance risks, most health care industry players,
who already operate in a highly regulated environ-
ment, have either shied away or severely limited their
interaction and involvement with medical cannabis.
Pending federal bills, including the Secure And Fair
Enforcement (SAFE) Banking Act3 and the Strengthening
the Tenth Amendment Through Entrusting States
(STATES) Act,4 signal that the United States may now be
at a tipping point for reforms that would align federal
law more closely with the states and aim to disentangle
Joanne Caceres is a Managing
Associate in Dentons’ Cannabis Group,
Illinois. She advises large publicly
traded companies, investors, vapor-
izer manufacturers, and companies
operating dispensaries on cannabis
and hemp related regulatory and com-
pliance matters. She can be reached
at 312/876-2862 or joanne.caceres@
dentons.com.
Michael Montgomery is a member of
Dentons’ Health Care practice group,
resident in the San Francisco office.
Michael’s practice focuses on trans-
actional matters in the health care
industry and includes advising hospital
and health system clients on mergers
and acquisitions, joint ventures, and
corporate governance matters as well
as related regulatory and compliance
matters. He can be reached at 415/882-
0375 or michael.montgomery@
dentons.com.
mailto:joanne.caceres@dentons.com
mailto:joanne.caceres@dentons.com
mailto:michael.montgomery@dentons.com
mailto:michael.montgomery@dentons.com
Journal of Health Care Compliance — July–August 201918
Are U.S. Health Care Companies Ready for a Legal Cannabis Market?
cannabis from federal criminal statutes alto-
gether. With these pending pieces of legis-
lation in mind, this article previews three
potential compliance issues that health care
industry participants should anticipate and
prepare for: (1) the need to re-think policies
for the use of medical cannabis onsite at hos-
pital facilities; (2) the opening of pathways
toward U.S. Food and Drug Administration
(FDA) approval for new drugs and prod-
ucts; and (3) the increased attention that
will be called for under federal health care
privacy laws, such as the Health Insurance
Portability and Accountability Act of 1996
and its implementing regulations (collec-
tively, “HIPAA”).
BACkgRound—the MediCAl CAnnABis
RegulAtoRy enfoRCeMent enviRonMent
Over the last several years, the federal gov-
ernment has not enforced the CSA against
persons or entities complying with state
cannabis laws. A 2013 U.S. Department
of Justice (DOJ) memorandum issued by
Deputy Attorney General James M. Cole
(the “Cole Memo”) identified eight enforce-
ment priorities in reference to cannabis-
related activities “that are particularly
important to the federal government,”5 and
led the federal government not to enforce
against state law compliant entities. On
January 4, 2018, however, then Attorney
General Jeff Sessions rescinded the Cole
Memo, directing prosecutors instead to
prosecute “marijuana activities” by follow-
ing “the well-established principles that
govern all federal prosecutors.”6 Attorney
General William Barr has since testified
in his confirmation hearing that he will
not upset “settled expectations,” “invest-
ments,” or other “reliance interest[s]” aris-
ing as a result of the Cole Memo and that
he does not intend to use federal resources
to enforce federal cannabis laws in states
that have legalized cannabis “to the extent
people are complying with the state laws.”7
While the DOJ has sent somewhat
mixed messages, entities strictly com-
plying with state medical cannabis laws
have benefitted from additional pro-
tection at the federal level. Since 2014,
federal spending bills have contained a
provision8 which has been interpreted
to prohibit the DOJ and the U.S. Drug
Enforcement Administration (DEA)
from prosecuting anyone who strictly
complies with a state medical cannabis
law.9 The provision was most recently
extended through short-term appropria-
tions legislation until September 30,
2019.10 Notwithstanding the efforts to
clarify and focus cannabis enforcement
priorities, conflict remains both within
sources of federal law and guidance as
well as with state laws.
Pending fedeRAl legislAtion—the
sAfe BAnking ACt, stAtes ACt, And
MoRe
Federal cannabis legislation may be
approaching an inflection point. Industry
observers believe that the SAFE Banking Act
of 2019 has the best chance of passing this
or next year. The SAFE Banking Act would
“create protections for depository institu-
tions that provide financial services to can-
nabis-related legitimate businesses and
service providers for such businesses…”11
Effectively, upon passage, no one in the can-
nabis industry conducting business consis-
tent with state law would face uncertainty
around federal anti-money laundering
crimes. While the legislation would not fully
harmonize federal and state laws (e.g., the
bill does not absolve cannabis companies
from CSA violations or providers from incho-
ate liability under the CSA), it comes close
to doing so. Increased legal certainty around
federal law is likely to lead established play-
ers, including banks and public companies,
to become more involved in the space.
Although less likely to pass in 2019,
the STATES Act would go even further to
align federal and state law.12 The bill pro-
vides in relevant part that the provisions of
the CSA, as applied to cannabis, “shall not
apply to any person acting in compliance
Journal of Health Care Compliance — July–August 2019 19
Are U.S. Health Care Companies Ready for a Legal Cannabis Market?
with State law relating to the manufacture,
production, possession, distribution, dis-
pensation, administration, or delivery of
marihuana.” Even though cannabis would
remain a Schedule I controlled substance,
the STATES Act makes state legal cannabis
activities federally permissible by creating
a carve-out to the CSA (nullifying concerns
about violations of the CSA, including
inchoate offense liability for service pro-
viders). By allowing continued prohibition
to be a choice by the individual states, the
STATES Act does not fully legalize cannabis
on a national level. Nonetheless, for fully
compliant state regulated businesses, there
would be no federal criminal risk.
These are also several other laws pro-
posed at the federal level with the goal of
eliminating the conflict between state and
federal law. In early May, top congressional
democrats announced they would be rein-
troducing legislation that would go even
further than the STATES Act.13 The pro-
posed legislation, “Marijuana Freedom And
Opportunity Act,”14 would remove cannabis
from the CSA altogether, a process known
as descheduling. States would then have
the ability to regulate cannabis as they
see fit.
thRee CoMPliAnCe ConCeRns foR heAlth
CARe entities to ConsideR
These bills represent significant strides
toward reconciling the divergence between
deeply engrained federal law and the many
constantly evolving bodies of state law.
Although the precise fate of these laws
remains uncertain, it is becoming increas-
ingly more likely that at some point, fed-
eral law will become more permissive.
When that happens, the barriers that have
held the health care industry back will for
the most part disappear or change signifi-
cantly. Below, we briefly discuss three top-
ics that the health care industry will have
to face. Health care industry participants
would be well served to consider and pre-
pare for these issues sooner rather than
later.
Hospital Onsite Use of Medical
Cannabis
Should a hospital permit the presence and
consumption of medical cannabis by inpa-
tients? If so, where in the hospital would
use and/or storage be authorized and in
what forms of delivery? What role should
physicians, nurse practitioners, and other
facility staff play in oversight and admin-
istration? And, considering cannabis cur-
rently remains a Schedule I controlled
substance under the CSA, what level of
risk could the onsite use of medical can-
nabis pose to a hospital’s federal fund-
ing, licenses, and programs, including
its Medicare enrollment? These are just
a few of the baseline questions hospitals
and other providers are grappling with as
state legalization and regulation of medi-
cal cannabis continues to mature. Not sur-
prisingly, legal uncertainty has led many
providers to mitigate risk by defaulting
to outright prohibition, or in some cases,
adopting an informal “don’t ask, don’t tell”
approach.
The Centers for Medicare & Medicaid
Services (CMS), despite being the single
largest payer and one of the most impor-
tant regulatory bodies in the U.S. health
care system, has to-date been mostly
silent and not issued specific guidance on
medical cannabis matters. CMS does, how-
ever, require that providers contracting
with and billing Medicare and Medicaid
agree to “Conditions of Participation,”
pursuant to which such providers must
certify their general compliance with all
state and federal laws and regulations.15
This, of course, includes compliance with
the CSA. Accordingly, beyond Medicare
and Medicaid not covering medical canna-
bis treatments, the use or even presence
of cannabis in health care facilities runs
the risk of financial penalties, lost federal
funding, and the potential revocation of a
provider’s Medicare enrollment and other
various categories of federal licenses and
accreditations.
Journal of Health Care Compliance — July–August 201920
Are U.S. Health Care Companies Ready for a Legal Cannabis Market?
With the political climate and pend-
ing federal legislation trending toward
greater if not total deference to state
law, however, hospitals should consider
establishing medical cannabis policies
and procedures carefully tailored to
satisfy the regulatory regimes in their
respective state jurisdictions. Health
care organizations in a few states have
offered model policies that may serve
as useful starting points. For example,
the Minnesota Hospital Association has
published several templates designed
to align with state law, including poli-
cies that outline how certain “qualified”
patients might be verified for eligibility
to receive the assistance of a nurse in
administering or otherwise self-adminis-
ter their own supply of medical canna-
bis.16 Similarly, the Washington Health
Care Association has published a model
policy directed toward long-term care
facilities,17 while select Mayo Clinic
facilities in Minnesota have established
a process for certifying and dispensing to
Minnesota residents with certain quali-
fying conditions in the Minnesota medi-
cal cannabis program.18
The varying approaches to handling
the risk of uncertainty where CMS regula-
tions potentially stand at odds with state
law are indicative of legal quagmires that
are likely to be addressed and resolved
through the STATES Act or similar leg-
islation. Clear guidelines as to when a
health care facility would be jeopardiz-
ing its accreditation status and access to
federal funding will allow hospitals and
other providers the opportunity to build
on existing model policies to construct
or rebalance their own approach to inpa-
tient-use of medical cannabis. In doing
so, providers may soon have more free-
dom to shift away from technical compli-
ance with competing bodies of law and
focus on the health, rights, and inter-
ests of patients, as well as the providers’
own financial and operational goals and
circumstances.
FDA Regulatory Pathways for Cannabis
Products
The FDA has not attempted to regulate, or
enforce rules against, state medical canna-
bis programs, despite a clear authority to do
so under federal law.19 It has and continues
to address, however, the budding market
for CBD derived from hemp.20 By under-
standing how the FDA has approached CBD
in hemp, we can make predictions about
how the FDA may react to certain cannabis
derived extracts, once and if they become
available outside of a state-regulated mar-
ket. Cannabis dispensing organizations will
need to “catch up” to these regulations to
the extent they do not anticipate them.
The FDA has issued statements remind-
ing the public of the FDA’s continued
authority “to regulate products contain-
ing cannabis or cannabis-derived com-
pounds under the United States Federal
Food, Drug, and Cosmetic Act (FDCA) and
section 351 of the Public Health Service
Act.”21 Under the FDCA, it is unlawful “to
introduce food containing added CBD or
THC into interstate commerce, or to mar-
ket CBD or THC products, as, or in, dietary
supplements, regardless of [the source of
the substance].”22 This is because, regard-
less of whether health claims are made,
CBD (and THC) are active ingredients in
FDA-approved drugs and have been the
subject of public substantial clinical inves-
tigations. Therefore, the FDA’s position
has been that, prior to introduction into
interstate commerce, any cannabis prod-
uct, whether derived from hemp or other-
wise, marketed with a disease claim (e.g.,
therapeutic benefit, disease prevention)
must first be approved by the FDA for
its intended use through one of the drug
approval pathways.
It seems that current political pressure
caused a shift in the FDA’s prohibitive
position. As a result, the FDA has formed
a working group to evaluate how best to
regulate CBD products but has added
that the working group will likely take a
Journal of Health Care Compliance — July–August 2019 21
Are U.S. Health Care Companies Ready for a Legal Cannabis Market?
number of years to develop and implement
a new regulatory strategy, unless Congress
passes CBD-specific legislation that forces
it to act within a specified timeframe.23
The agency has taken several steps in its
continued evaluation of possible regula-
tory pathways for cannabis- containing
and cannabis-derived products: (1) it has
noticed a public hearing date, May 31,
2019, to discuss the safety, manufactur-
ing, product quality, marketing, labeling,
and sale of products containing cannabis
or cannabis-derived compounds; (2) it has
formed a high-level internal agency work-
ing group tasked with exploring potential
pathways for the legal marketing of foods
and/or dietary supplements containing
CBD; (3) it updated FAQs on the FDA Web
site related to this topic; and (4) it issued
warning letters to three companies mar-
keting CBD products using claims viewed
as egregious and targeted at particularly
vulnerable populations.24
The health care industry, especially
drug manufacturers, has a vested inter-
est in the outcome of this FDA action for
several reasons. First, drug manufacturers
already do and increasingly will have to
compete with medical cannabis products,
which may, due to an unusual regulatory
history, have less restrictive barriers to
approval under the FDCA, further disad-
vantaging competing therapies. Second,
the FDA may set a precedent for certain
products to be approved with less effort
and expense than other products, an out-
come that may or may not be welcome by
industry participants. Therefore, regard-
less of whether or not any particular drug
manufacturer has an interest or desire to
participate in the cannabis industry post-
legalization, decisions that will affect the
regulatory landscape in the future are
happening now.
Medical Cannabis and HIPAA
The medical cannabis state programs raise
questions about compliance with HIPAA’s
privacy protections.25 There appears to
be a misconception in the industry that
because HIPAA is a federal law, and can-
nabis remains federally illegal, medical
cannabis dispensaries are not subject to
HIPAA. While this correlation is without
merit (consider that these companies are
still beholden to federal tax laws, for exam-
ple), it is likely the case that the vast major-
ity of medical cannabis dispensaries are
not presently subject to HIPAA. In order
for a dispensary (or any other entity) to be
subject to HIPAA, the entity must meet the
definition of a “covered entity” or a “busi-
ness associate” as defined by the law.
A HIPAA-covered entity is defined as a
health plan, health care clearinghouse, or
health care provider who transmits any
health information in electronic form in
connection with particular transactions
subject to HIPAA.26 While a dispensary
might meet the definition of a health care
provider,27 it most likely fails the second
required component of the definition
to be a covered entity; namely that the
health care provider transmit health infor-
mation in electronic form in connection with
particular transactions subject to HIPAA.28
Similarly, a dispensary is unlikely to meet
the definition of a HIPAA business asso-
ciate, which is generally any entity that
performs a covered function or activity on
behalf of a covered entity that involves the
use or disclosure of protected health infor-
mation (PHI).29
Nonetheless, from a policy perspective,
medical cannabis should theoretically be
subject to HIPAA. Doing so would serve to
further protect the privacy, security, and
confidentiality of dispensary customers. It
also would place restrictions on how cus-
tomers’ information could be used and dis-
closed and would afford such customers
additional rights regarding their identifi-
able information maintained by the dis-
pensary. As noted by the U.S. Department
of Health and Human Services (HHS),
health care providers have a strong tradi-
tion of safeguarding private health infor-
mation, and the consequences of not
Journal of Health Care Compliance — July–August 201922
Are U.S. Health Care Companies Ready for a Legal Cannabis Market?
doing so could cause significant negative
outcomes for the patient.30
Once medical cannabis programs
become federally legal, this question is
likely to come to a head. Again, partici-
pants in the health care industry should
have a vested interest in ensuring that
medical cannabis facilities are subject to
HIPAA and safeguard PHI, especially as
those organizations become more con-
nected to other health care institutions.
Furthermore, health care industry law-
yers are uniquely suited to help dispens-
ing organizations come into compliance.
While many medical cannabis busi-
nesses have not focused on HIPAA
requirements, they would be well served
to reassess their operations so as to ensure
compliance with HIPAA and state health
privacy laws. The passage of something
similar to the STATES Act would elimi-
nate the veil of illegality, bringing in more
institutional actors, including health care
providers such as hospitals and nursing
homes, who will already be HIPAA com-
pliant and require any entities they asso-
ciate with to do the same.
ConClusion
Some level of cannabis legalization or at
least decriminalization, which used to
seem impossible, now seems likely if not
inevitable in the United States. The pend-
ing federal bills at the very least signal a
directional change in federal politics, as
more and more legislators appear ready
to consider making changes to federal
law. Furthermore, many different indus-
tries, including food, tobacco, and alcohol
may enter the fray (and certain forward-
thinking companies have already begun
experimenting in Canada). The health care
industry will inevitably more frequently
and deeply be impacted directly and indi-
rectly by the cannabis industry and the
increased use of cannabis for health and
wellness. Indeed, health care providers are
uniquely positioned to and should provide
leadership on the issue.
Endnotes
1. For example, in all states that have legalized medi-
cal cannabis, doctors need to identify and certify
or recommend patients to relevant programs (see,
e.g., Florida (Fla. Stat. Ann. § 381.986(4)), describing
physician certification); some states additionally
require employment of a physician to supervise the
activities of a medical cannabis dispensing organi-
zation (e.g., Florida (Fla. Stat. Ann. § 381.986(8)(b)
(9))); and some states require that the cannabis be
dispensed by a pharmacist (e.g., Connecticut, (CT
ADC §21a-408h(b)(B)), Minnesota (Minn. Stat. Ann. §
152.29, subd. 3) and New York (10 NYCRR § 1004.12)).
2. 21 U.S.C 801 et seq. Until recently, hemp (defined
by the U.S. Government as Cannabis sativa L. with a
THC concentration of not more than 0.3 percent on
a dry weight basis) and hemp’s extracts were illegal
Schedule I controlled substances, along with canna-
bis generally, under the CSA (except mature stalks,
fiber produced from the stalks, oil or cake made
from the seeds, and any other compound, manu-
facture, salt derivative, mixture, or preparation of
such parts). In December 2018, the U.S. government
changed the legal status of hemp. The Agriculture
Improvement Act of 2018, Pub.L. 115-334 (the
“Farm Bill”), removed hemp and extracts of hemp,
including CBD, from the CSA schedules. Accordingly,
the production, sale, and possession of hemp or
extracts of hemp, including CBD, no longer violate
the CSA.
3. SAFE Banking Act of 2019. H.R. 1595, 116th Cong.
§ 1 (2019), www.congress.gov/bill/116th-congress/
house-bill/1595.
4. Strengthening the Tenth Amendment Through
Entrusting States Act, H.R. 2093, 116th Cong. § 1
(2019), available at www.congress.gov/bill/
116th-congress/house-bill/2093/text.
5. See Memorandum from James M. Cole, Deputy Att’y
Gen., to U.S. Atty’s, 1 (Aug. 29, 2013), www.justice.
gov/iso/opa/resources/3052013829132756857467 .
6. Jefferson B. Sessions, III, U.S. Dep’t of Justice,
Memorandum for All U.S. Att’ys re: Marijuana
Enforcement (Jan. 4, 2018), available at www.justice.
gov/opa/press-release/file/1022196/download.
7. See Attorney General William Barr Confirmation
Hearing, available at www.c-span.org/video/
?456626-1/attorney-general-nominee-william-barr-
confirmation-hearing (“My approach to this would be
not to upset settled expectations and the reliance
interest that have arisen as a result of the Cole
Memorandum and investments have been made
and so there has been reliance on it, so I don’t think
it’s appropriate to upset those interests.”).
8. The provision, now called the Joyce Amendment
(previously the Rohrabacher Amendment), states:
“None of the funds made available under this Act
to the Department of Justice may be used, with
respect to any of the [states with medical cannabis
Continued on page 48
www.congress.gov/bill/116th-congress/house-bill/1595
www.congress.gov/bill/116th-congress/house-bill/1595
www.congress.gov/bill/116th-congress/house-bill/2093/text
www.congress.gov/bill/116th-congress/house-bill/2093/text
www.justice.gov/iso/opa/resources/3052013829132756857467
www.justice.gov/iso/opa/resources/3052013829132756857467
www.justice.gov/opa/press-release/file/1022196/download
www.justice.gov/opa/press-release/file/1022196/download
www.c-span.org/video/?456626-1/attorney-general-nominee-william-barr-confirmation-hearing
www.c-span.org/video/?456626-1/attorney-general-nominee-william-barr-confirmation-hearing
www.c-span.org/video/?456626-1/attorney-general-nominee-william-barr-confirmation-hearing
Journal of Health Care Compliance — July–August 201946
Access to Services
immediate threat of injury” from the hos-
pital’s actions. The couple contended that
the fiancé’s medical condition will likely
require hospital services, but as pleaded,
that claim was not sufficient to demon-
strate future harm. The court explained
that the allegations did not establish that
the fiancé will require hospitalization or
otherwise return to Memorial for services,
and accordingly, the couple was granted
leave to replead the claim.
intentionAl disCRiMinAtion
Under the Rehabilitation Act and the ACA,
intentional discrimination is a necessary
element to prove in addition to deliber-
ate indifference. The couple’s allegation
that the hospital repeatedly failed to pro-
vide interpreters after being repeatedly
informed that they were necessary for
communication with the couple was suffi-
cient under governing appellate case law.
Thus, Memorial’s motion to dismiss was
denied on this issue.
Endnotes
1. Ayling v. Memorial Health System, May 23, 2019,
Schanzle-Haskins, T.
2. 42 U.S.C. ¶ 12131.
3. 29 U.S.C. § 704.
4. 42 U.S.C. § 18116.
Copyright of Journal of Health Care Compliance is the property of Aspen Publishers Inc. and
its content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder’s express written permission. However, users may print, download, or email
articles for individual use.