Category Archives: Administrative Law

AHCA Recommends New Medicaid Payment System to Legislature

UPDATE: The Agency for Health Care Administration (AHCA) held their final public meeting on November 20, 2015, to wrap-up their discussion and submit recommendations to the Legislature for the development of an Outpatient Prospective Payment System (OPPS) to replace the current “cost-based per visit” rate methodology for Florida’s Medicaid program. AHCA’s recommendation will be to adopt a modified Enhanced Ambulatory Patient Grouping system (EAPG), which involves bundling procedures and medical visits that share similar characteristics and pays one base rate to the provider to cover all of the bundled services. The new system is expected to be implemented on July 1, 2016.

Tom Wallace, Bureau Chief of AHCA’s Medicaid Program Finance, along with members of Navigant Healthcare, the private consulting company contracted to develop the new payment system were looking at two primary model options for the OPPS: 1) the EAPG, which requires proprietary software (most likely from Navigant) that will need to be purchased by providers; and 2) the Ambulatory Payment Classification (APC) model, which is linked to Medicare’s OPPS system. By the last meeting in October, it was clear that AHCA and Navigant preferred the EAPG system to the APC model. The recommendation presented at the final meeting confirmed the agency’s preference for the EAPG model.

Significantly, the consulting company provided a simulation of how the EAPG system would pay claims to hospitals based on data collected by AHCA in accordance with the current payment system. Navigant provided charts of the top 20 hospitals and ambulatory surgical centers (ASCs) that would see the biggest payment increases and decreases. (See pages 23-26 of attached workshop presentation.) According to the simulation compiled by Navigant using previous years data, the greatest increases in payments will be seen by Ocala Regional Medical Center, Bethesda Hospital East, St. Vincent’s Medical Center and Bayfront Health – St. Petersburg. The greatest decreases will be seen by Jackson Memorial Hospital, Florida Hospital, Homestead Hospital and Sacred Heart Hospital. (Full simulation results are attached here and here as Exel spreadsheets.) Approximately 18 hospitals were excluded from the simulation (including University Behavioral Hospital, Windmoor Healthcare, Emerald Coast Behavioral, UF Health Shands, UF Health Jacksonville, and others) because approximately 33-percent or more of their prior claims data were missing procedure codes. (See page 18 of attached workshop presentation for complete list.) It was suggested at the meeting that the committee reach out to the hospitals to get their procedure codes so that they can be included in the simulation.

Additional recommendations that will be provided to the Legislature include the following:

  1. No outlier payments from Medicare OPPS (payments above or beyond scope of EAPG system);
  2. No service line adjusters and only one provider-specific adjuster for hospitals with high Medicaid outpatient utilization (Nemours Children’s Hospital, Nicklaus Children’s Hospital and All Children’s Hospital);
  3. No “charge cap” with the EAPG payment methodology to allow payment of the lessor of submitted charges or Medicaid-allowed amount;
  4. Allow a 5-percent adjustment to the EAPG base rate to account for anticipated documentation and coding improvement (consistent with the value used in the first year of APR-DRG implementation); and
  5. Applicable claims paid between July 1, 2016, and the date of implementation will be adjusted to apply EAPG pricing (retroactive to July 1, 2016).

AHCA will submit its recommendations to the Florida Legislature by November 30, 2015. Legislation regarding a new payment system is expected to be passed during the 2016 Session, with the new program to be effective on or about July 1, 2016.

For more information about AHCA’s development of the OPPS, please contact an attorney at Smith & Associates.

A Year in Review: AHCA’s Managed Medical Assistance Program

AHCA presented a Post-Award Forum for Florida’s 115 Managed Medical Assistance (MMA) Waiver during the Medical Care Advisory Committee meeting on October 13, 2015. The forum provided a platform for AHCA to showcase data of the MMA program’s success and hear comments from the public regarding specific areas where the program fell short.

Medicaid is a federal/state entitlement program which is jointly financed by state and federal funds. Federal law requires the coverage of certain eligibility groups and services (mandatory), and states have the option of covering additional eligibility groups and services (optional). Florida implemented the MMA program as a way to incentivize higher quality care without causing inflation. In February 2015, AHCA signed contracts with MMA insurance providers to deliver a system of care to residents in each of the 11 AHCA districts in Florida.

In analyzing Florida’s average annual cost for Medicaid care, AHCA representative Beth Kidder presented a graph showing that the cost per person dropped from $6,564 per person in year 2010-11 to an anticipated $5,878 in 2015-16. AHCA also showcased an increased rate of participation by physicians and dental care providers. From November 2013 to June 2015, AHCA noted an increase of 7.43-percent increase in MDs and DOs providing services to Medicaid recipients. During the same time period, AHCA stated that total participating dentists increased by 23.09-percent.

Most of the public comments regarding the MMA program focused on the failure to ensure payment by providers to Emergency Transport Services (EMS) in Florida. Several groups representing EMS providers throughout Florida complained about improperly denied reimbursement for medical transports and the categorical denial of transports of more than 30 miles. The EMS providers pointed out that Medicare reimbursed such transports, and so should the MMA program providers. One EMS provider suggested a rule or statutory revision to require hospitals and nursing homes to obtain pre-authorization for a transfer request so that EMS is ensured reimbursement.

The Agency will be releasing a series of quarterly reports on the Statewide Medicaid Managed Care program. Reports for the first two quarters are available on the Agency’s website. The Agency also began publishing a consumer-focused health plan report card which includes annual ratings on how Florida’s health plans are faring with regards to providing preventative health care services to women and children (i.e., well-child visits, prenatal care for pregnant women). Plan effectiveness is measured through the Healthcare Effectiveness Data and Information Set (HEDIS), which is a standardized set of performance measures by the National Committee for Quality Assurance and used by more than 90-percent of the health plans in the U.S.

For more information about the MMA program in Florida or any other issue, please contact an attorney at Smith & Associates.

AHCA Preliminary Decisions on Skilled Nursing Facilities

View PDF Version here.

AHCA has issued its State Agency Action Reports announcing the preliminary results on CON Applications submitted for Skilled Nursing Facilities. Below is a summary of the winners and losers listed by Sub-district. For a summary of the process for challenging AHCA’s preliminary decisions, please see our prior Newsletter Article attached.

Sub-district 1-1

Approved Application:

NF Bay, LLC/NF Bay, LLC Establish a new 90-bed community nursing home

Denied Application:

PruittHealth – Escambia County, LLC/PruittHealth – Escambia County, LLC Establish a new 90-bed community nursing home

Sub-district 3-1

Approved Application:

SF Brevard, LLC/SF Brevard, LLC Establish a new 113- bed community nursing home

Withdrawn Application:

Terrace Enterprises, LLC/Terrace Enterprises, LLC Establish a new community nursing home of up to 120 beds

Sub-district 3-2

Approved Applications:

Oak Hammock at the University of Florida, Inc./Oak Hammock at the University of Florida Add 17 community nursing home beds through the conversion of 17 sheltered nursing home beds
Palm Garden of Gainesville, LLC/Palm Garden of Gainesville, LLC Add 30 community nursing home beds

Withdrawn Application:

Innovative Medical Management Solutions, LLC/Innovative Medical Management Solutions, LLC Establish a new 47-bed community nursing home

Sub-district 3-3

Approved Application:

Crestwood Nursing Center, Inc./Crestwood Nursing Center Add 29 community nursing home beds

Sub-district 4-1

No Approved Applications

Denied Application:

Innovative Medical Management Solutions, LLC/Innovative Medical Management Solutions, LLC Establish a new 14-bed community nursing home

Sub-district 7-2

Approved Applications:

Presbyterian Retirement Communities, Inc./Westminster Towers Add 30 community nursing home beds through the conversion of 30 sheltered nursing home beds
Presbyterian Retirement Communities, Inc./Westminster Winter Park Add 17 community nursing home beds through the conversion of 17 sheltered nursing home beds

Denied Applications:

MF Orange, LLC/MF Orange, LLC Establish a new 90-bed community nursing home
Orange SNF, LLC/Orange SNF, LLC Establish a new 118-bed community nursing home

Sub-district 7-4

Approved Application:

Lifespace Communities, Inc./Village on the Green Add 30 community nursing home beds through the conversion of 30 sheltered nursing home beds

Withdrawn Application:

Innovative Medical Management Solutions, LLC/Innovative Medical Management Solutions, LLC Establish a new 33-bed community nursing home

Sub-district 8-2

Denied Application:

Pelican Bay Retirement Services/Premier Place at the Glenview Add 14 community nursing home beds through the conversion of 14 sheltered nursing home beds

Sub-district 9-1

Approved Application:

Palm Garden of Vero Beach, LLC/Palm Garden of Vero Beach, LLC Add nine community nursing home beds

Sub-district 11-1

Approved Application:

Florida Medical Systems, LLC/Florida Medical Systems, LLC Add 45 community nursing home beds

Denied Application:

Palm Garden of Aventura, LLC/Palm Garden of Aventura, LLC Add 45 community nursing home beds

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law for over 20 years.

View PDF Version here.

New ALF Rules May Be Coming Soon

View PDF Version here.

The Department of Elder Affairs is holding a public workshop to consider new regulations that may have a significant impact on Florida assisted living facilities (“ALFs”). Significant changes being discussed at the workshop include changes to record keeping requirements, staff competency and training requirements, medication practices, and patient safety and quality of care processes. The first workshop on the proposed rules is scheduled for July 13, 2015 from 9:30 a.m. to 11:30 a.m., at the Department of Elder Affairs, 4040 Esplanade Way, Tallahassee, FL 32399. There is currently no draft proposed rule.

The Rulemaking Process

Rulemaking is required and governed by the Florida Administrative Procedure Act, which provides: “rulemaking is not a matter of agency discretion.” A grant of rulemaking authority is necessary, but not sufficient to allow an agency to adopt a rule. Rulemaking also requires a specific law to be implemented. An agency may only adopt rules that implement or interpret the specific powers and duties granted by the enabling statute. An invalid exercise of delegated legislative authority is an action that goes beyond the powers, functions, and duties delegated by the Legislature.

Agencies’ rulemaking authority is also invalid if it fails to adhere to strict procedural requirements. For example, not less than 28 days prior to the intended adoption, amendment, or repeal of any rule (other than an emergency rule) an agency must give notice of its intended action, including an explanation of the purpose and effect of the proposed action, the full text of the proposed rule or amendment, and a summary of the proposed rule or amendment. The notice must include an estimate of the regulatory cost of implementation.

Where there is a likely impact on small businesses, the agency must consider each of the following methods for reducing the impact: (1) establishing less stringent compliance or reporting requirements in the rule; (2) establishing less stringent schedules or deadlines in the rule for compliance or reporting requirements; (3) consolidating or simplifying the rule’s compliance or reporting requirements; (4) establishing performance standards or best management practices to replace design or operational standards in the rule; and (5) exempting small businesses, small counties, or small cities from any or all requirements of the rule.

Within 21 days of the publication of the notice, any affected person may request a public hearing. When an agency receives such a request it must hold at least one public hearing. In many instances the agency will hold multiple public hearings and may allow written comments to be submitted at or after the public hearing. Substantially affected persons also have the right to challenge a proposed rule under Florida Statute §120.56 as an invalid exercise of delegated legislative authority and have the right to a formal hearing before the Division of Administrative Hearings (“DOAH”). The timing of filing a challenge to a proposed rule varies based upon several criteria, the most common being dependent upon whether a hearing was requested or whether there are amendments to the proposed rule that require it to be republished. In most instances, challenges to proposed rules should either be filed within the same 21 day period or within 10 days after the public hearing is held.

To initiate a formal challenge, a substantially affected person must file a petition at DOAH. Within 10 days after receiving the petition, the matter must be assigned to an administrative law judge who shall conduct a hearing within 30 days and render a final decision within 30 days from the end of the hearing, unless these time frames are extended by agreement of the parties or for good cause, which is routine.

These hearings are de novo, meaning the agency has no presumption of correctness in its proposed rule. The standard of proof is a preponderance of the evidence. Hearings are conducted in the same manner as other 120.569 and 120.57, hearings, with one important exception, the administrative law judge’s order shall be a final agency action instead of a recommendation to be considered by the agency in a final order. The petitioner and the agency whose rule is challenged shall be adverse parties and other substantially affected persons may join the proceedings as intervenors in support of or against the proposed rule. There are opportunities to challenge a proposed rule after it becomes final, but the burden of proof becomes more difficult to challenge an existing rule than a proposed rule.

Be a Part of the Process

Rulemaking is the opportunity for facilities that will be affected by the regulatory changes to protect their interests and have input into the rules that will be implemented. Providers know better than the agencies that regulate them the true impacts of the proposed regulation. FALA and other associations are an important part of the process, but they may not know and understand the unique issues your facility faces with regard to proposed regulatory changes. The best regulations are fully vetted through multiple workshops, where stakeholders from diverse backgrounds and facility sizes participate.

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law for over 20 years.

View PDF Version here.

Defending Alleged Survey Deficiencies at Assisted Living Facilities (ALFs) and Skilled Nursing Facilities (SNFs)

View PDF Version here.

You have probably seen the full page newspaper advertisements by certain law firms trying to solicit Plaintiffs to sue your ALF or nursing home, and placing your recent Survey Deficiencies in big bold print for all the world to see.   These tactics highlight the importance of knowing your rights as an ALF or SNF operator.  Whether to challenge a statement of deficiencies or an Administrative Complaint by the Agency for Health Care Administration is an important decision with far reaching consequences.  You should know your rights and make an informed decision.

Inspections and Survey Deficiencies: Know Your Rights

Assisted Living Facilities (“ALFs”) (governed by Chapter 429, Part I, Florida Statutes, in addition to Chapter 408, Florida Statutes) and Skilled Nursing Facilities (“SNFs”) (governed by Chapter 400, Part II, Florida Statutes, in addition to Chapter 408, Florida Statutes) need to be aware of their legal rights and responsibilities regarding Agency for Health Care Administration (AHCA or Agency) inspections, surveys, and enforcement actions.

With regard to inspections, pursuant to Florida Statutes, AHCA may conduct unannounced inspections of ALFs and SNFs1. If faced with an inspection, an ALF/SNF operator has no legal right to refuse to allow the inspectors access to the facility2.  During the inspection, AHCA is entitled to have access to copies of all provider records required during the inspection3.  An ALF/SNF operator may request that an Administrator  or  other  designated  representative  accompany  the  inspectors  while  at  the facility.  It is advisable that the ALF/SNF operator immediately consult with legal counsel if an unannounced AHCA inspection is made.  During an exit interview, the AHCA representatives should explain their findings, including any alleged deficiencies that were found.

Subsequent to an inspection, AHCA will provide the ALF/SNF Administrator with a survey report that provides a detailed written explanation of the findings made during an inspection. If a violation of a regulation is found during an inspection or investigation, it is cited as a deficiency on the Statement of Deficiencies.  Any deficiency must be corrected within 30 calendar days after the provider is notified of inspection results unless an alternative timeframe is approved by the agency4. The ALF/SNF will be given 10 calendar days in which to present a Plan of Correction5.  ALFs/SNFs must maintain for a three-year period, and make available upon request, records of all inspection reports pertaining to that provider that have been filed by the agency unless such reports are exempt from public disclosure6.

Although seldom asserted, an ALF/SNF operator may assert a legal right to challenge a survey report and petition for a formal administrative hearing pursuant to Section 120.569 and 120.57(1), Florida Statutes, if the provider believes that there were in fact no deficiencies that should result in a Plan of Correction being submitted.  However, in most instances, the results of a licensure or complaint survey can be resolved through submission and implementation of a Plan of Correction.

Statutory Framework Regarding AHCA’s Issuance of Deficiencies

Emergency License Suspension Orders

In the event of alleged severe deficiencies which AHCA claims threaten the health, safety or welfare of an ALF/SNF resident, AHCA can impose an immediate moratorium on admissions or an emergency order of license suspension7.   However, the right to take such emergency action is limited, and  such orders can be challenged legally.  AHCA is required by Section 120.60(6), Florida Statutes, to make specific findings that document the existence of the emergency situation, and may take only such action as is required to address the emergency. An improper Emergency Suspension Order or Moratorium may be immediately appealed to the District Court of Appeal, and there are numerous decisions where Agency action that is not based on a true emergency is reversed and set aside.

Further, AHCA must also provide an ALF/SNF operator faced with an emergency moratorium, or suspension order, or any other effort to suspend or revoke a license with the opportunity to file a Petition for Formal Administrative Hearings to challenge the validity of AHCA’s action or proposed action on the license8.  Hearings on license proceedings are held before an independent administrative law judge at the Division of Administrative Hearings.  Such hearings are an opportunity to prove that the true facts do not support a moratorium, suspension or revocation of the ALF/SNF license.

In addition to or in lieu of taking direct action against an ALF/SNF operator’s license, AHCA may also seek imposition of civil penalties for alleged violation of licensure rules and standards.

Administrative Fines and Classification of Deficiencies

AHCA imposes administrative fines for violations according to a classification system in statute, based on the nature of the violation and the gravity of its probable effect on facility residents.  The agency shall indicate the classification on the written notice of the violation9.   In addition, the scope of the violation may be cited as an isolated deficiency (affecting a very limited number of clients), a patterned deficiency (repeated violations affecting more than a limited number of clients), or a widespread deficiency (pervasive or systemic failures that have the potential to affect a large portion of clients)10.

Assisted Living Facilities (ALFs) and Chapter 429, Florida Statutes

Pursuant to sections 408.813 (AHCA’s “Core Licensure Act”) and 429.19, Florida Statutes (which governs the operations of an ALF), the “classifications” assigned to the alleged violation and the attendant administrative fines are as follows:

Class I violations: present an imminent danger to clients or a substantial probability that death or serious physical or emotional harm would result.  These violations must be corrected within 24 hours.  Imposition of a fine is mandatory in an amount not less than $5,000 and not exceeding $10,000 per violation, even if the violation is corrected11.

Class II violations:  directly threaten the physical or emotional health, safety or security of clients (other than Class I).  Imposition of a fine is mandatory in an amount not less than $1,000 and not exceeding $5,000 per violation, even if the violation is corrected12.

Class III violations: indirectly or potentially threaten the physical or emotional health, safety or security of clients (other than Class I or Class II).   AHCA shall impose a fine in an amount not less than $500 and not exceeding $1,000 per violation, unless the violation is corrected within the time specified for correction in the citation13. [Note: ALF statute (Ch. 429) provides that fines are mandatory for Class III and Class IV violations, but the core licensure statute (Ch.  408) says that the fine will not be imposed if corrected within a specified time, see discussion below.]

Class IV violations:  pertain to reports, forms or documents that do not have the potential of negatively affecting clients (purely paperwork type violations).  These violations are those that AHCA has determined do not threaten the health, safety, or security of clients.  AHCA shall impose a fine in the amount not less than $100 and not exceeding $200 per violation, unless the violation is corrected within the time specified for correction in the citation14.

Section 408.813, Florida Statutes, expressly provides that no fines shall be imposed for timely corrected Class III and Class IV violations.  However, AHCA has been known to take a contrary view, and the specific fine amounts for violation of ALF licensure standards are stated in mandatory language in Chapter 429, Florida Statutes.  Section 408.832, Florida Statutes, provides that when the AHCA Core Licensing Act conflicts with the specific facility governing statutes (such as the ALF statute) then the Core Licensure Act should prevail.  Applying that principle, then no fines should be imposed for minor Class III and IV violations when they are timely corrected by the ALF.  If AHCA were to impose fines for Class III and Class IV violations, the ALF would have appropriate grounds for challenging such fines.

In determining if a penalty is to be imposed and in fixing the amount of the fine, AHCA shall consider the following factors:

  • the severity of the violation and the extent to which the provision of the applicable laws were violated,
  • actions taken by the ALF administrator to correct violations,
  • previous violations,
  • the financial benefit to the facility of committing the violation, and
  • the licensed capacity of the facility15.

Additionally, each day of continuing violation after the date determined by AHCA for termination of the violation, constitutes an additional, separate, and distinct violation16.

Because AHCA considers previous violations when imposing penalties, it is important that ALF Administrators ensure that they quickly address and resolve all minor violations so that these will not later serve as a basis for imposing more severe sanctions.  Additionally, ALF administrators shall document in writing all actions to correct violations and these shall be verified through AHCA follow up visits.  AHCA may impose a fine, and in some instances, revoke or deny a facility’s license when a facility administrator fraudulently misrepresents action taken to correct a violation17.

Additionally, AHCA may impose administrative fines in an amount not to exceed $500 per violation for violations that are not designated as Class I, II, III, or IV violations. Unclassified violations include, but are not limited to: violating a condition of the license, violating statutes or rules, exceeding license capacity, and providing services beyond the scope of the license.

Skilled Nursing Facilities (SNFs) and Chapter 400, Florida Statutes

Skilled Nursing Facilities (SNFs) are governed by Chapter 400, Part II, Florida Statutes, as well as Chapter 408, Part II, Florida Statutes.  In accordance with section 400.23(7), Florida Statutes, AHCA shall, at least every 15 months, evaluate all nursing home facilities and make a determination as to the degree of compliance.  The agency’s determination shall be based on the most recent inspection report, as well as findings from other reports and investigations.  In addition to the license classification categories authorized under part II of chapter 408 (discussed above), AHCA shall assign either a “standard licensure status” or a “conditional licensure status” to each nursing home18. A “standard licensure status” means that a facility has no class I or class II deficiencies and has corrected all class III deficiencies within the time established by the agency.  A “conditional licensure status” means that a facility, due to the presence of one or more class I or class II deficiencies, or class III deficiencies not corrected within the time established by the agency, is not in substantial compliance at the time of the survey19.

The current licensure status of each facility shall be indicated in bold print on the face of the facility’s license, and a list of the deficiencies of the facility shall be posted in a prominent place that is in clear and unobstructed public view at or near the place where residents are being admitted to that facility20.

Licensees receiving a conditional licensure status for a facility shall prepare, within 10 working days after receiving notice of deficiencies, a plan for correction of all deficiencies and shall submit the plan to the agency for approval21.

An operator has the right to challenge a Conditional license rating through the filing of a Petition for Formal Administrative Hearing and a trial before an independent Administrative Law Judge.

Classification and Civil Penalties/Administrative Penalties

The “classification” system and attendant penalties for SNF deficiencies are found in section 400.23(8), Florida Statutes, and outlined below.  The classifications are similar to that of ALFs, though not identical, and the attendant penalties are quite different.  Of note, the SNF statute expressly provides for different levels of fines depending on the whether the deficiency was isolated, patterned, or widespread.  Moreover, for Class I, II, and III deficiencies, section 400.23(8), Florida Statutes, provides that “the fine amount shall be doubled for each deficiency if the facility was previously cited for one or more class I or class II deficiencies during the last licensure inspection.”

Class I deficiency: a deficiency requiring immediate corrective action because the facility’s noncompliance has caused, or is likely to cause, serious injury, harm, impairment, or death to a resident receiving care in a facility. A class I deficiency is subject to a civil penalty of $10,000 for an isolated deficiency, $12,500 for a patterned deficiency, and $15,000 for a widespread deficiency. The fine amount shall be doubled for each deficiency if the facility was previously cited for one or more class I or class II deficiencies during the last licensure inspection or any inspection or complaint investigation since the last licensure inspection. A fine must be levied notwithstanding the correction of the deficiency22.

Class II deficiency: a deficiency that the agency determines has compromised the resident’s ability to maintain or reach his or her highest practicable physical, mental, and psychosocial well-being. A class II deficiency is subject to a civil penalty of $2,500 for an isolated deficiency, $5,000 for a patterned deficiency, and $7,500 for a widespread deficiency. The fine amount shall be doubled for each deficiency if the facility was previously cited for one or more class I or class II deficiencies during the last licensure inspection or any inspection or complaint investigation since the last licensure inspection. A fine shall be levied notwithstanding the correction of the deficiency23.

Class III deficiency: a deficiency that the agency determines will result in no more than minimal physical, mental, or psychosocial discomfort to the resident. A class III deficiency is subject to a civil penalty of $1,000 for an isolated deficiency, $2,000 for a patterned deficiency, and $3,000 for a widespread deficiency. The fine amount shall be doubled for each deficiency if the facility was previously cited for one or more class I or class II deficiencies during the last licensure inspection or any inspection or complaint investigation since the last licensure inspection. If a class III deficiency is corrected within the time specified, a civil penalty may not be imposed24.

Class IV deficiency: a deficiency that the agency determines has the potential for causing no more than a minor negative impact on the resident. If the class IV deficiency is isolated, no plan of correction is required25.

In addition to the above, section 400.121, Florida Statutes, provides for the denial, suspension, or revocation of nursing home and related health care facility licenses, and also provides for administrative fines.  In accordance with section 400.121(1), Florida Statutes, AHCA may revoke or suspend a license, or impose administrative fines not to exceed $500 per violation per day.  Section 400.121(2), Florida Statutes, states:

“Except as provided in 400.23(8), a $500 fine shall be imposed for each violation.  Each day a violation of this part or part II of chapter 408 occurs constitutes a separate violation and is subject to a separate fine, but in no event may any fine aggregate more than $5,000.”

This section further provides:

“A fine may be levied pursuant to this section in lieu of and notwithstanding the provisions of s. 400.23.”26

Thus, the statutes governing administrative fines for skilled nursing facilities appear to be inconsistent and afford the agency significant discretion.  On the one hand, it states that “except as provided in 400.23(8), a $500 fine shall be imposed,” but, on the other hand, it also appears to state that the $500 per day fine not to exceed the $5,000 in aggregate may be imposed in lieu of the fines provided for in Section 400.23(8) above.  An experienced health care attorney can help to navigate these somewhat confusing and contradictory statutes, and seek to have them interpreted and applied in a manner most beneficial to the provider.

Revocation and Suspension:  With respect to revoking a SNF license, AHCA may revoke a license where the facility: has had two moratoria issued for substandard care within any 30-month period; is conditionally licensed for 180 continuous days; is cited for two unrelated Class I deficiencies during the same survey; or is cited for two Class I deficiencies arising from separate surveys within a 30-month period.27  If AHCA has placed a moratorium on a facility two times within a 7-year period, AHCA may suspend the nursing home license.  The licensee may present factors in mitigation of revocation, and AHCA may determine not to revoke the license based upon the facility’s mitigating factors.

Any action to suspend or revoke a facility’s license under Chapters 400 or 408 shall be heard by the Division of Administrative Hearings within 60 days after the assignment of an administrative law judge (ALJ), unless the time limitation is waived by both parties, and the ALJ shall render a decision with 30 days after receipt of the proposed recommended order.28  Agency action may be overcome by the licensee upon a showing by a preponderance of evidence to the contrary.29

Challenging a Statement of Deficiencies

Existing case law allows a provider to challenge the issuance of Statement of Deficiencies prior to AHCA filing an Administrative Complaint. See e.g., W. Frank Wells Nursing Home v. Ag. for Health Care Admin., 27 So. 3d 73, 74 (Fla. 1st DCA 2009) (holding that a statement of deficiencies constituted agency action and could be challenged in an administrative hearing).  However, the decision to file a petition to challenge a Statement of Deficiencies has significant implications on the burden of proof at hearing.  AHCA Final Orders have indicated that a party challenging a Statement of Deficiencies has the burden to show that no violations occurred by a preponderance of the evidence. See Water’s Edge Extended Care v. Ag. For Health Care Admin., DOAH 12-2188, 2013 WL 4080436, at *3 (Aug. 2, 2013) (“Here, the Agency issued a document known as a statement of deficiencies. It imposed no penalty on the Petitioner. Nor did it alter Petitioner’s licensure status in any way. Thus, it did not meet the definition of an administrative complaint found in Rule 28-106.2015(1), Florida Administrative Code. Therefore, Petitioner should have born the burden of proof by a preponderance of the evidence.”).  In contrast, if AHCA files an Administrative Complaint, then AHCA has the burden to prove the violation by clear and convincing evidence.30

Because the burden on AHCA to prove the violation is much greater when it brings an Administrative Complaint (as compared to when a facility challenges a Statement of Deficiencies), ALFs/SNFs need to seriously consider the pros and cons of challenging a Statement of Deficiencies.  In most instances, the best course of action is to challenge the Administrative Complaint, rather than challenging the Statement of Deficiencies.  However, the following are circumstances where it may be prudent for a facility to challenge the Statement of Deficiencies:

  • When AHCA is requiring some immediate corrective action that the provider believes is unwarranted under the circumstances and that would be unduly burdensome on the provider;
  • When the facility reasonably believes that the Statement of Deficiencies will result in a negative stigma affecting its business operations if it fails to challenge the alleged deficiency;
  • When the facility reasonably believes that certain payors may take adverse action based on the Statement of Deficiencies being filed and unchallenged.

It should be noted that although administrative case law in certain Final Orders has indicated that the burden on the provider is much greater when it challenges a Statement of Deficiencies, there have been no appellate decisions on this issue to date.

Case Law Examples: Recent Reported Final Orders

ALF Final Order Examples

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION v. ANGEL AIDES CENTER, INC. d/b/a BOYNTON BEACH ASSISTED LIVING FACILITY, 2014 WL 7385342 (December 17, 2014), DOAH NO. 13-1258

Action to revoke the ALF’s license and impose $5,000 fine and $500 survey fee.  Agency cited the facility for two Class II deficiencies as a result of complaint investigation surveys.  Based on the surveys it was determined that the facility failed to ensure that residents met the residency requirements (several residents required medical and psychological supervision exceeding the residency criteria) and failed to provide supervision to the residents.  Specifically, during the investigation it was revealed that one of the residents who did not meet the residency requirement (as he required medical supervision due to antisocial behavior) had sexually assaulted another resident several months prior. Pursuant to section 429.14 (1) (e), Florida Statutes, the Agency sought to revoke the license since it had previously cited the facility for four Class II deficiencies.

Holding/Fine: ALF license was revoked, and respondent was required to pay the Agency $5,500.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. DAYSPRING VILLAGE, INC., 2014 WL 2624256 (June 3, 2014); DOAH CASE NO. 13-1451

Administrative Complaint sought to impose an administrative fine of $2,000 based on two Class II deficiencies discovered during a complaint inspection of Dayspring Village’s assisted living facility (“ALF”), as well as a $185.00 survey fee. Specifically, the complaint alleged that the facility failed to provide adequate and appropriate health care consistent with established and recognized standards within the community by allowing diabetic residents to use the same glucometer without disinfecting or cleaning the glucometer device in between resident usage, and failed to properly supervise residents taking their medication.

Holding: The Final Order concluded that AHCA proved its violations by clear and convincing evidence and imposed an administrative fine of $2,000 and a survey fee of $185.50 on Dayspring Village, Inc.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. PINE TREE MANOR, INC. d/b/a PINE TREE MANOR, Respondent, 2014 WL 554674 (February 5, 2014) DOAH CASE NOS. 13-2011, 13-2397

AHCA charged Pine Tree Manor with two Class I violations and sought to revoke its license for two separate deficiencies.  The first alleged Class I violation concerned the facility’s failure to remain generally aware of one of its residents whereabouts.  Specifically, a resident wandered off from the facility and the facility did not seek to locate him until the next morning.  They were unable to locate him, and he was found, deceased, several days later.  The Final Order held that AHCA had not proved by clear and convincing evidence that the facility was on notice the resident was in “imminent danger of death or serious physical harm” to substantiate a Class I, and held that it was a Class II violation, and imposed a $5,500 fine.  The second alleged violation concerned the facility’s failure to properly respond to an emergency situation where a resident stopped breathing and ultimately died.  The employee failed to immediately call 911 and provide CPR.  The Final Order held this was a Class I violation, revoked respondent’s license, and imposed an $8,000 fine.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. STEPHENS MEMORIAL HOME, INC. d/b/a STEPHENS MEMORIAL HOME, 2013 WL 3490616 (July 8, 2013), DOAH CASE NO. 13-0368

AHCA conducted an unannounced biennial licensure and complaint survey that gave rise to the Administrative Complaint.  The Administrative Complaint alleged a widespread class II deficiency and sought the imposition of an administrative fine of $1,000 against Respondent. Specifically, the Administrative Complaint alleged that Stephens Memorial failed to insure that one of four sampled residents was free of physical restraints in violation of Florida Statutes because that resident had an activity board attached to his wheelchair that appeared to prevent the resident from getting up from his wheelchair.

Holding: The Final Order held that the resident was able to remove the activity board and that it was prescribed for therapeutic purposes and thus did not meet the definition of a “restraint” and the Administrative Complaint was dismissed.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. DOS OF CRYSTAL RIVER ALF, LLC d/b/a CRYSTAL GEM ALF, 2013 WL 595490 (February 7, 2013);  DOAH CASE No. 12-2306

Administrative Complaint alleged a Class III violation for facility’s failure to have a properly completed Residential Health Assessment form for each resident, and Class I violation for failure to provide appropriate supervision to prevent elopement.

Holding: Held that while violations did occur in that the forms were not properly completed, they did not constitute Class III violations because there was no threat to the physical or emotional health of the residents, and thus it was reduced to a Class IV violation with a fine of $100.  With regard to the alleged Class I violation regarding elopement, the Final Order held that the Agency did not prove, by clear and convincing evidence, that the facility violated Florida Statutes with respect to the provision of care and supervision of its residents.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. ALLAN V. COMRIE d/b/a PREMIER ADULT CARE; ALLAN V. COMRIE d/b/a FIRST CLASS PHASE II; and ALLAN V. COMRIE d/b/a FIRST CLASS ADULT FAMILY CARE and JAM, 2012 WL 5705633 (November 8, 2012);  DOAH CASE NO. 12-0102

AHCA alleged that Respondent had advertised and operated a facility without first obtaining licensure for that program, had misrepresented the licensure status of the home, had failed to comply with rules governing facilities, and had failed to cooperate with authorities with regard to the facility. As to all alleged violations, Respondent maintained it was not required to hold a license for the subject property as its operation was exempt as a matter of law. Additionally, Respondent averred that any incorrect advertising was merely a clerical error and not an intentional misrepresentation of the licensure status of the facility.

Holding: Although the Administrative Law Judge did not recommend revocation, AHCA entered a Final Order and imposed a $7,000 fine and revoked Respondent’s license.   The operator elected not to appeal to the District Court of Appeal.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION v. AVALON’S ASSISTED LIVING, LLC d/b/a AVALON’S ASSISTED LIVING and d/b/a AVALON’S ASSISTED LIVING AT AVALON PARK; and AVALON’S ASSISTED LIVING II, LLC, 2011 WL 860551 (March 9, 2011)

Action to revoke the facilities’ licenses due to Class II deficiencies regarding: 1) failure to provide required employee training and falsified training certifications, and 2) the failure to provide residents with appropriate pain medication and required care. The evidence established that the violations posed a direct threat to the physical and emotional health of the residents.  License revocation was an appropriate penalty pursuant to section 429.14(1)(e)(2), Florida Statutes, regarding revocation where there are three or more cited class II deficiencies.

Holding/Fine: The licenses of the facilities were revoked and an administrative fine of $3,000 was imposed.

SNF Final Order Examples

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. TALLAHASSEE FACILITY OPERATIONS. LLC d/b/a CONSULATE HEALTHCARE OF TALLAHASSEE, Respondent, 2015 WL 510385 (February 2, 2015), DOAH CASE NO. 14-0436

Administrative Complaint sought to impose an administrative fine in the amount of $1,000 and conditional licensure status based on one uncorrected Class III deficiency discovered during a revisit survey inspection conducted on August 12, 2013. AHCA conducted a survey of the facility in July 2013 and found a Class III deficiency for failure to follow physician orders that patient be bathed daily.  Respondent submitted a corrective action plan which was approved by AHCA.  AHCA re-surveyed respondent in August 2013, and found additional Class III violations regarding failure to follow physician orders concerning PICC-dressing changes in violation of rule 59A-4.107(5).  AHCA alleged the August violation constituted an uncorrected violation of the earlier failure to follow physician orders.

Respondent argued that the August violation was different than the July violation, and thus the August violation should not be construed as an “uncorrected violation.” AHCA argued that both violations concerned the failure to follow physician orders and thus the second violation was an “uncorrected violation.” AHCA further argued that its acceptance of the corrective action plan did not  absolve Respondent from its responsibility to correct every area in which it was found out of compliance.

Holding: AHCA demonstrated by clear and convincing evidence that Respondent committed an uncorrected Class III deficiency. Final Order imposed a fine of $1,000 and further imposed conditional licensure on Respondent for the period from August 13, 2013 through September 30, 2014.

WATER’S EDGE EXTENDED CARE, Petitioner v. STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Respondent, 2013 WL 4080436 (August 02, 2013), DOAH 12-2188

AHCA conducted a complaint survey and issued a statement of deficiencies for alleged violation of section 400.0255, Florida Statutes, regarding transfers or discharges initiated by nursing homes.  The statement of deficiencies was challenged by petitioner and the matter was referred to DOAH.  The ALJ found that section 400.0255, Florida Statutes, was inapplicable to the circumstances, as the physician initiated the Baker Act transfer, not the nursing home.

Holding: The Final Order found that the Agency failed to establish that respondent violated section 400.0255, Florida Statutes, by improperly discharging or transferring the resident, and they Agency withdrew its Statement of Deficiencies.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. GREENBRIAR NH, LLC d/b/a GREENBRIAR REHABILITATION AND NURSING CENTER, Respondent, 2012 WL 2191285 (June 7, 2012) DOAH CASE NO. 11-4379

Administrative Complaint alleged that Respondent failed to comply with background screenings and alleged a Class II deficiency.

Holding: the Respondent failed to comply with the relevant law regarding background screenings as well as its own policies and procedures when it hired new employee. However, the Petitioner failed to prove that these failures constituted a Class II deficiency.  The Final Order dismissed the Administrative Complaint and replaced the Conditional License with a Standard License for the time period in question.

STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, Petitioner v. SA-PG SUN CITY CENTER, LLC d/b/a PALM GARDEN OF SUN CITY, Respondent, 2011 WL 379931 (January 1, 2011), DOAH CASE NO. 10-4740

Administrative Complaint alleged that Respondent failed to follow established and recognized practice standards regarding care to its residents; and failed to comply with the rules governing skilled nursing facilities adopted by AHCA.

Holding: There is no competent and substantial evidence that Respondent failed to follow established practice standards that resulted in harm to its residents and failed to comply with rules governing skilled nursing facilities, or that otherwise warrants a fine or Conditional rating. Respondent was marginally deficient in two minor areas concerning their own policies, but neither violation is a Class II deficiency, nor warrants imposition of a sanction.

Conclusion

Preventative measures are the best way to protect against survey deficiencies.  ALF/SNF administrators should develop and implement trainings and staff education to ensure compliance with Florida Statutes and rules.  Qualified health care consulting firms and health care attorneys can assist with developing compliant materials and compliance programs.  An ounce of prevention in this respect will be well worth avoiding the costs of a bad survey or inspection by AHCA.

However, even with a good education and compliance program in place, AHCA may still seek to suspend or revoke a license, or impose a moratorium on admissions or levy substantial fines.  In order to assess penalties, AHCA is required to file an Administrative Complaint.  ALFs/SNFs have the right to demand a formal hearing to challenge the facts, and to challenge the amount or appropriateness of the fines being imposed.

ALF/SNF administrators in such situations should consult and retain experienced legal counsel to contest and defend against such actions by filing a Petition for Formal Administrative Hearing pursuant to Chapter 120.  The timeframe for responding to an Administrative Complaint is 21 days from receipt of the Complaint, and failure to timely file a petition may result in an admission of the facts alleged in the Complaint and entry of a Final Order by the agency.  ALF/SNF administrators need to be aware of their legal rights prior to receiving an Administrative Complaint and need to be sure to consult with counsel prior to inadvertently waiving any rights.  Hiring experienced legal counsel is crucial in any challenge to an Administrative Complaint.  Experienced counsel can not only help to protect your due process rights, but can also ensure that the State is required to prove its case by clear and convincing evidence.

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law for over 20 years.

View PDF Version here.

1 §408.811 (1), Fla.  Stat., §429.34 (1), Fla.  Stat., §400.19, Fla.  Stat.

2 §408.811 (1), Fla.  Stat.

3 §408.811 (3), Fla.  Stat.

4 §408.811 (4), Fla.  Stat.

5 §408.811 (5), Fla.  Stat.

6 §408.811 (6), Fla.  Stat.

7 §408.814 (1), Fla.  Stat.

8 §120.60 (7), Fla.  Stat.

9 §429.19 (2), Fla.  Stat.

10 §408.813(2), Fla.  Stat.

11 §408.813(2)(a), Fla.  Stat.; §429.19(2)(a), Fla.  Stat.

12 §408.813(2)(b), Fla.  Stat.; §429.19(2)(b), Fla.  Stat.

13 §408.813(2)(c), Fla.  Stat.; §429.19(2)(c), Fla.  Stat.

14 §408.813(2)(d), Fla.  Stat.; §429.19(2)(d), Fla.  Stat.

15 §429.19(3), Fla.  Stat.

16 §429.19(4), Fla.  Stat.

17 §429.19(5), Fla.  Stat.

18 §400.23(7), Fla.  Stat.

19 §400.23(7)(a) and (b), Fla.  Stat.

20 §400.23(7)(d), Fla.  Stat.

21 §400.23(7)(d), Fla.  Stat.

22 §400.23(8), Fla.  Stat.

23 §400.23(8), Fla.  Stat.

24 §400.23(8), Fla.  Stat.

25 §400.23(8), Fla.  Stat.

26 §400.121(2), Fla.  Stat. (emphasis added).

27 §400.121(3), Fla.  Stat.

28 §400.121(5), Fla.  Stat.

29 §400.121(7), Fla.  Stat.

30 The burden of proof on AHCA to impose an administrative fine is by clear and convincing evidence. Dep’t of Banking & Fin, v. Osborne Stern & Co., 670 So. 2d 932 (Fla. 1996). The burden of proof for the assignment of licensure status is by a preponderance of the evidence. See Florida Dep’t of Transp. v. J.W.C. Co., Inc., 396 So. 2d 778 (Fla. 1st DCA 1981); Balino v. Dep’t of HRS, 348 So. 2d 349 (Fla. 1st DCA 1977).  See also AGENCY FOR HEALTH CARE ADMINISTRATION v. TALLAHASSEE FACILITY OPERATIONS. LLC d/b/a CONSULATE HEALTHCARE OF TALLAHASSEE, 2015 WL 510385, at *12 (February 2, 2015), DOAH CASE NO. 14-0436.

 

Bid Protest Are Not Only for the Lowest Bidder

Orange County recently requested bids for its trash collection service. FCC Infrastructure responded with the lowest bid across the board. Now, two other bidders, Waste Pro and Florida Republic, are protesting the award of the contract to FCC. While the details of the case are still forthcoming, this news article contains some details of the issue and statements from each of the bidders.

According to Waste Pro and Florida Republic, FCC was able to get the lowest bid because they did not properly bid the project. According to a Waste Pro representative, FCC’s bid would require it to do with one truck what Waste Pro would need ten trucks to do. In essence, Waste Pro is arguing that, while FCC was the lowest bidder, it was not the lowest responsible bidder.

Public authorities are required to award bids to the “lowest responsible bidder.” Wester v. Belote, 103 Fla. 976, 138 So. 721 (1931). “A responsible, or qualified, bidder is one who has the capability in all respects to fully perform the contract requirements and the integrity and reliability that will assure good faith performance.” Am. Eng’g & Dev. Corp. v. Town of Highland Beach, 20 So. 3d 1000, 1000-01 (Fla. Dist. Ct. App. 2009) internal quotes omitted. Thus, simply submitting the lowest bid is not enough. A bidder must also be qualified to perform the work.

Therefore, a bidder who does not submit the lowest bid can still file a bid protest if the lowest bidder is not a responsible bidder. If you have been denied an award of a public contract due to the lowest bidder not being a responsible bidder, contact the experienced bid protest attorneys here at Smith & Associates for a free consultation. Be aware that bid protest cases have very strict, short deadlines, so you must act quickly to preserve your rights.

Update on Return of Nursing Home CON in Florida

View PDF Version here.

The “post moratorium era” continues for the Nursing Home Certificate of Need (“CON”), with twenty-eight Letters of Intent filed in response to published Fixed Need Pools for an additional 493 nursing home beds statewide. Since the lifting of the moratorium on nursing home CON by the Legislature last year, the Agency for Health Care Administration (“AHCA “) has approved a total of 3,198 needed nursing home beds. Under the legislation, AHCA cannot approve any more CONs for nursing home beds equal to or greater than 3,750 (until June 30, 2017). Assuming AHCA awards all of the published need to these applicants, the total approvals by AHCA since the legislation was passed will be 3,691 beds. This would mean that there would only be 59 beds left before the 3,750 statutory cap is reached. Other deadlines are fast approaching, as well. Any provider that wishes to file a competing Grace Period Letter of Intent has until May 6, 2015 to file for a competing proposal.

The following tables show the Fixed Need Pool in each subdistrict where AHCA has received one or more letters of intent. The tables reflect the number of beds published in the Fixed Need Pool and a summary of the Letters of Intent received in each subdistrict to date. Additional notations are made as to any observations regarding the number of beds sought in relation to the fixed need pool.

Subdistrict 1-1
(Escambia and Santa Rosa)
Need: 61

Escambia FL HUD Pensacola/Specialty Health and Rehabilitation Center Add 30 community nursing home beds
Escambia NF Bay, LLC Establish a new 90-bed community nursing home
Escambia PruittHealth – Escambia County, LLC Establish a new community nursing home of up to 120 beds

*Note: Two applicants have filed for a number greater than published need; and one less.

Subdistrict 2-1
(Gadsden, Holmes, Jackson and Washington)
Need: 41
No LOIs received despite published need.


Subdistrict 3-1
(Columbia, Hamilton and Suwannee)
Need: 113

Columbia MF Orange, LLC Establish a new 113-bed community nursing home
Columbia Palm Garden of Lake City, LLC Establish a new community nursing home of up to 113 beds
Columbia PruittHealth – Alachua County, LLC Establish a new community nursing home of up to 113 beds
Columbia Terrace Enterprises, LLC Establish a new community nursing home of up to 113 beds

Subdistrict 3-2
(Alachua, Bradford, Dixie, Gilchrist, Lafeyette, Union, and Levy)
Need: 47

Alachua Innovative Medical Management Solutions, LLC Establish a new 47-bed community nursing home
Alachua Oak Hammock at the University of Florida Add 17 community nursing home beds through the conversion of 17 sheltered nursing home beds
Alachua Palm Garden of Gainesville, LLC Add up to 47 community nursing home beds

Subdistrict 3-3
(Putnam)
Need: 34

Putnam Crestwood Nursing Center, Inc. Add up to 34 community nursing home beds
Putnam Lakewood Nursing Center, Inc. Add up to 34 community nursing home beds

Subdistrict 3-4
(Marion)
Need: 0

Marion Ocala SNF, LLC Establish a new community nursing home of up to 120 beds

*Note: No published need, but an LOI was received.

Subdistrict 3-5
(Citrus)
Need: 23
Need published but no LOIs filed.


Subdistrict 3-6
(Hernando)
Need: 5
Need published but no LOIs filed.


Subdistrict 4-1
(Nassau and North Duval)
Need: 14

Duval Edgewood Nursing Center, Inc. Add up to 14 community nursing home beds
Duval Innovative Medical Management Solutions, LLC Establish a new 14-bed community nursing home

Subdistrict 4-3
(St. Johns and Southeast Duval)
Need: 0

St. Johns Saint Johns SNF LLC Establish a new community nursing home of up to 120 beds

*Note: No published need, but an LOI was received.

Subdistrict 5-1
(Pasco)
Note: 44

Pasco Innovative Medical Management Solutions, LLC Establish a new 44-bed community nursing home
Pasco LP New Port Richey, LLC/Southern Pines Healthcare Center Add 44 community nursing home beds

Subdistrict 6-4
(Highlands)
Need: 11
Need published but no LOIs filed.



Subdistrict 7-2
(Orange)
Need: 0

Orange Orange SNF, LLC Establish a new community nursing home of up to 120 beds

*Note: No published need, but an LOI was received.

Subdistrict 7-4
(Seminole)
Need: 33

Seminole Innovative Medical Management Solutions, LLC Establish a new 33-bed community nursing home

Seminole Lifespace Communities, Inc./Village on the Green Add up to 33 community nursing home beds
Seminole Seminole SNF LLC Establish a new community nursing home of up to 120 beds

*One applicant exceeds published need.

Subdistrict 8-2
(Collier)
Need: 0

Collier Pelican Bay Retirement Services/Premier Place at the Glenview Add up to 14 community nursing home beds through the conversion of up to 14 sheltered beds

*Note: No published need, but an LOI was received.

Subdistrict 9-1
(Indian River)
Need: 9

Indian River Palm Garden of Vero Beach, LLC Add up to nine community nursing home beds

Subdistrict 9-2
(Martin)
Need: 9
Need published but no LOIs filed.


Subdistrict 9-3
(Okeechobee)
Need: 4
Need published but no LOIs filed.


Subdistrict 11-1
(Miami Dade)
45

Miami Dade CC-Aventura, Inc./VI at Aventura Add up to 40 community nursing home beds
Miami Dade Florida Medical Systems, LLC/Florida Medical Systems, LLC Add up to 45 community nursing home beds and a partial of 15 beds
Miami Dade Palm Garden of Aventura, LLC/Palm Garden of Aventura, LLC Add up to 45 community nursing home beds
Miami Dade Pediatric Specialty Care of Florida, LLC/Pediatric Specialty Care of Florida, LLC Establish a new community nusing home of up to 45 beds

Total Statewide: 493



Any provider that has been contemplating an opportunity to seek a CON for a new facility or additional beds at an existing facility should review the currently filed Letters of Intent carefully, and decide if now is the time to seek approval for a competing project. Existing providers should also carefully consider their options, and decide whether to oppose a project that may have a negative impact on existing operations. Please feel free to call me for any additional information.

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law and CON regulation for over 20 years.

View PDF Version here.

Bid Protest Law: Know Your Rights – The Clock is Ticking

Download PDF Version Here.

Bid protests and bid protest law in Florida and challenges to competitive contract procurement and awards in Florida are controlled by a myriad of unique and complex statutes, rules, policies, and law. They proceed on an extremely fast track, and important rights can be waived if not immediately asserted. For example, challenges to final bid specifications, as well as any challenge to the final award, must be filed within only 72 hours of publication of the specifications or posting of the award. For these and other reasons, it is especially important to know your rights when your company becomes involved in any public procurement. Consideration should be given to retaining experienced Florida bid protest counsel early in the process to review bid specifications, assist in the Q&A process, analyze the proposal to assure responsiveness, and generally assure you a full and fair opportunity to prevail. At a minimum, if the need to file (or defend against) a bid protest arises, an experienced Florida bid protest counsel should be retained to fully protect your rights.

This memorandum provides an overview as to the process, rights, and key issues involved with state agency competitive procurements in Florida. However, similar timing issues, rules, and case law typically apply to federal agency purchasing, and local government and other publicly funded competitive procurements.

General Purpose of Competitive Procurement Requirements

Florida’s competitive procurement process is aimed at the protection of the public against collusive contracts, fraud, bias, and favoritism. Among other things, it is designed to secure fair competition on equal terms to all bidders, to secure the best values at the lowest possible expense, to provide an opportunity for an exact comparison of bids, and to assure that the most responsive bid is accepted. Wester v. Belote, 103 Fla. 976, 138 So. 721 (1931).

Florida Statutory Thresholds and Types of Procurement

Pursuant to Section 287.017 (purchasing threshold categories) and Section 287.057 (procurement methods) when a state agency wishes to contract for commodities or contractual services that cost in excess of $25,000, the agency must use one of several types of procurement methods. The three most common methods are: Invitation to Bid (ITB), Request for Proposal (RFP), and Invitation to Negotiate (ITN).

The ITB is used when the agency is capable of specifically defining the scope of work for which a contractual service is required or is capable of establishing the precise specifications defining the commodities sought. In an ITB process, price is king, and the lowest responsive and responsible bidder must be awarded the contract. Under Section 287.057, Florida Statutes, an ITB is the preferred method for state agencies to obtain goods and services. In order to use an RFP rather than an ITB, the agency must make a finding, in writing, that use of an ITB, where price is the deciding factor, is not practicable. If a company is concerned with a situation where an agency issues an RFP, rather than using an ITB where the lowest bidder is entitled to the contract award, then arguably a protest challenge must be filed within 72 hours of the issuance of the RFP or the ability to challenge the award is waived. This is a frequent problem in competitive procurements, as a disappointed party in responding to an RFP will argue that the state agency should have awarded the contract to the lowest price proposal.

In contrast to an ITB, the RFP is used when the agency determines, in writing, an ITB is not practicable including when the agency is seeking competitive offers for proposed commodities or contractual services to evaluate who best meets certain specifications and qualifications of the solicitation. Unlike the ITB process, under an RFP the agency is not required to award the contract to the lowest bidder, but instead it may be awarded to the most responsible offeror considering price as well as other criteria. Section 287.057(2)(a), Florida Statutes, mandates that price must be one of the criteria for evaluation, but it is not the controlling criteria.

An ITN is a written solicitation that calls for responses to select one or more persons or entities with which to commence negotiations and can only be used when the agency determines, in writing, that use of an ITB or RFP will not result in the best value to the state based on factors such as price, quality, design, and workmanship. Again, a party who believes that use of an ITN will not result in a competitive award, must assert a challenge within 72 hours of issuance of the ITN, or the ability to argue that the state should have used an RFP or ITB will likely be waived.

Other less common procurement methods are also available to agencies under specified conditions as defined in Chapter 287, including a request for quote (RFQ), emergency purchases, and single source purchases. In addition, there are special provisions that apply to the procurement of certain commodities and services such as insurance, architectural and engineering services, and information technology.

Timing of and Rights to Protest Specifications and Intended Awards

Florida’s Administrative Procedure Act at Section 120.57(3), Florida Statutes, and Rules found in Chapter 28-110, Florida Administrative Code, generally govern state agency competitive bidding disputes including notice requirements, the time frames for protests, and hearing procedures.

The 72-Hour and 10-Day Protest Deadlines. Vendors (bidders, proposers) should initially be aware of the distinction between challenges to the published bid specifications versus challenges to the ultimate award of the bid itself. As to each, a separate 72-hour deadline applies. If a bidder wishes to challenge the terms, conditions, or specifications contained in the solicitation (including any provisions governing the methods for ranking bids, awarding contracts, reserving rights for further negotiation, or modifying or amending any contract) the notice of protest must be filed within 72 hours after posting of the solicitation. This is extremely important for vendors responding to a solicitation to consider. One of the most common problems in public procurement is that a vendor fails to challenge the specifications or criteria in an ITB or RFP although the vendor believes that a particular criteria or specification is unfair, unnecessary, or one that the vendor simply cannot meet. (This is often rationalized by the vendor as an effort to remain on good terms with the contracting agency – i.e., seeking to avoid an action that would irritate the contracting agency.) The use of criteria or specifications that are biased towards an incumbent contractor, or towards a vendor preferred by the state agency in question, is illegal, but nevertheless is a historic and fairly frequent problem in the public procurement arena. If a vendor believes that any part of the RFP is suspect, they must file the required notice within 72 hours or the issue is forever waived.

If a bidder or proposer wishes to challenge any agency decision (an award) or intended decision (or intended award) a notice of protest must be filed with 72 hours of posting of the notice of decision or intended decision. § 120.57(3)(b), Fla. Stat. Intervening holidays and weekends are excluded in computing each of these 72-hour period. All parties who submitted a response to an ITB or RFP are entitled to a fair notice explaining their protest rights, and failure of the state agency to provide proper notice may extend the time for filing a notice of protest.

Subsequent to the filing of any protest, a formal written protest must be filed within 10 days after the notice of protest is filed. Intervening holidays and weekends are counted in computing this 10-day period. This formal written protest must state with particularity the facts and law upon which the protest is based, and is often an extensive legal document containing supporting arguments, authorities, and evidentiary exhibits. Per the statute, failure to timely file the 72-hour notice of protest or the 10-day formal written protest, will constitute a waiver of the right to protest. See also Capeletti Bros. v. DOT, 499 So. 2d 855 (Fla. 1st DCA 1986) (72-hour period); Xerox v. DPR, 489 So. 2d 1230 (Fla. 1st DCA 1986) (10-day period). Although the deadlines are not strictly “jurisdictional,” late filing will be excused only in extraordinary situations such as where the agency fails to disclose conditions in the solicitation specifications, or where agency action or inaction substantially contributed to or caused the late filing. Jacksonville Port Auth. v. Parkhill-Goodloe Co, 362 So. 2d 1009 (Fla. 1st DCA 1978).

Bid Protest Bond. Protestors must generally file a bond payable to the agency as required by Section 287.042(2)(c), Florida Statutes, and Rule 28-110.005 Florida Administrative Code, in an amount equal to 1 percent of the estimated contract amount. Failure to timely file a required bond within the time provided will also result in a waiver of the right to protest. The bond is to cover costs, since the losing party in a bid protest is responsible for paying the prevailing party’s costs and charges (but not attorney’s fees). Attorney’s fees are sometimes separately sought and awarded in cases where a protest is found to be “frivolous” or filed for “improper purposes” as defined by statutes and controlling case law.

Protest Stays the Bid Process. Filing of a timely formal protest stops the bid process and no final award of a contract may be made before entry of a final order after resolution of the protest, unless the agency head sets forth in writing particular circumstances which require the continuance of the process in order to avoid an immediate and serious danger to the public health, safety, or welfare. Fla. Stat. § 120.57(3)(c).

Settlement Period. Prior to forwarding a protest to DOAH for hearing, Florida’s APA requires that the agency must allow seven days, excluding weekends and holidays, to provide an opportunity for the parties to resolve the protest without hearing by mutual agreement of the parties. This is a prime opportunity to resolve any dispute early on and avoid the cost of continued litigation. Whether a vendor is the winning bidder, or a challenger to the proposed award of a contract, they should monitor the settlement process closely, and should demand that the state agency keep them advised of any and all meetings, discussions, correspondence, or contacts by other parties. It is probably best legal practice for an interested vendor to file a Notice of Appearance and Motion to Intervene with the state agency during the settlement period, so that there is no ambiguity as to the party asserting its rights to be part of all Settlement discussions.

Any decision of the agency to change its proposed award or to reject all bids or proposals as a result of the discussions in the settlement period must include a new Notice of rights, and opportunity for parties to file a challenge to the new agency action. Although there does not appear to be any reported cases, it is arguable that any Settlement entered by the state agency that does not include all parties who responded to the ITB or RFP is illegal – as Section 120.57(3)(c), Florida Statute, mandates that the contract award process be stopped once a bid protest is filed, unless there is a documented emergency situation – or unless there is a settlement – which implies a resolution among all interested parties.

Standing to Protest

Section 120.57(3) provides that any person who is “adversely affected” by the agency action may file a protest. While a second ranked low bidder has standing to challenge an award to the low bidder based on non-responsiveness and other factors, a third or lower ranked bidder generally does not have standing, since even if successful in the protest of the award to the low bidder, the award would then go to the second ranked low bidder. Preston Carroll v. Florida Keys Aqueduct Auth., 400 So. 2d 524 (Fla. 3d DCA 1981). Nevertheless, the third or even fourth low bidders can sometimes have standing such as where all higher ranked bidders are also challenged, or where the procurement process was fundamentally flawed requiring a full rebidding. See, e.g., NCS Pearson, Inc. v. Dept. of Education, Case No. 04-3976, 2005 WL 310776 at ¶¶ 85-87 (DOAH Feb. 8, 2005; F.O. Feb. 22, 2005) (third-lowest bidder had standing based on challenge to fundamental fairness of procurement process). Absent special and extraordinary circumstances, non-bidders do not have standing. Fairbanks v. DOT, 635 So. 2d 59 (Fla. 1st DCA 1994) (standing found because the bid specifications effectively limited the source of materials to one specific manufacturer).

Common Grounds for Protests

The grounds for a valid bid protest tend to be fact-specific and vary broadly with the circumstances and requirements of each particular procurement. But in general, the following is a listing of some of the more common categories of grounds for protest that commonly arise in bid protest cases.

Sunshine Act Violations. Pursuant to Florida’s “sunshine law,” all meetings of any state agency at which official acts may be taken must be conducted as open, public meetings. Absent that, any action taken during such meetings is improper. The result is that the agency’s action is void and can be given no effect. See § 286.011, Fla. Stat.; Silver Express Co. v. District Board of Lower Tribunal Trustees of Miami-Dade Community College, 691 So. 2d 1099, 1100-01 (Fla. 3rd DCA 1997) (determining that a committee which helped crystallize the ultimate decision to be made by a college as to the award of a contract must be conducted openly and publicly). Among other things, to comply with the Sunshine law, all general meetings of a procurement evaluation committee should be publically noticed, and open to the public. Discussions or communications between members of the evaluation committee with respect to the procurement should not occur in private (though there are certain exceptions as to ITNs). Thus, any situation that involves private discussions among two or more evaluation committee members about the scoring or evaluations that are held outside a properly noticed public meeting are prohibited and would be a basis to challenge a contract award. (This can include communications among the members of the evaluation committee or others involved in the ultimate contract award such as email correspondence or inter-office memoranda.)

Improper Ex Parte Communications. Per Chapter 287, Florida Statutes, communications between those responding to the solicitation and the procuring agency and staff are prohibited during a “black out” period (basically from the release of the solicitation to the end of the 72-hour protest period) from communicating with anyone at the agency other then in writing to the procurement officer. Violation of this requirement may be grounds for rejecting a response.

Non-Responsive Bids: Material Variances vs. Minor Irregularities. Whether a mistake, deviation, or variance in a bid will be considered material (so as to deem the bid non-responsive) or a minor irregularity (that can be waived by the agency) is a highly technical question, and depends on the facts and circumstances of each case. To be responsive, a bid or proposal must conform in all “material” respects to the solicitation. § 287.012(25), Fla. Stat. There is a large body of case law as to what constitutes a minor irregularity versus a material variance from specifications, but generally, a material variation is one which: (1) affects the price of the bid; (2) gives the bidder an advantage or benefit not enjoyed by other bidders; or (3) adversely impacts the interests of the procuring agency. Intercontinental Properties, Inc. v. HRS, 606 So. 2d 380 (Fla. 3d DCA 1992). Material deviations or changes include those that involve fraud or misconduct, or that provide a bidder with an unacceptable or material competitive advantage. See Liberty City v. Asphalt & Concrete, 421 So. 2d 505 (Fla. 1982). In general, the test for measuring whether a deviation in a bid is sufficiently material to destroy its competitive character is whether it affects the amount of the bid by giving the bidder an advantage not enjoyed by other bidders. Harry Pepper and Associates, Inc. v. City of Cape Coral, 352 So. 2d 1190 (Fla. 2d DCA 1977). In contrast, minor irregularities have included such matters as the submission of a cashier’s check instead of a bid bond, the failure to submit written evidence that agent signing of the owner had authority, and the failure to include a form listing DBE subcontractors, at least where there is an allegation that the form was enclosed but later misplaced. See, e.g., Intercontinental Properties; Asphalt Pavers v. DOT, 602 So. 2d 558 (Fla. 1st DCA 1992). Often ITBs or RFPs will specifically list “Mandatory Criteria” or “Fatal Criteria” in the solicitation document. This listing is not exhaustive of required items. The bid or proposal may still be fatally defective if the bidder or proposer is otherwise not responsive to information and criteria specified anywhere in the RFP or ITB, and the omission meets the test of a material variance from the specification requirements as discussed above.

Improper “Conditional” Proposals. A proposal that is made conditional with respect to material matters such as price must be deemed non-responsive. See Sweeping Corporation of America, Inc. v. FDOT, Case No. 91-8203, 1992 WL 881039 (DOAH March 24, 1992; FDOT April 30, 1992) at ¶¶ 10-11 and 38-39 (holding that letters submitted that were conditional and equivocal with respect to a bond requirement required that the proposal be deemed non-responsive). This problem arises where a vendor includes a response that makes its proposal contingent upon some specification that is not expressly stated in the RFP or ITB.

Non-Responsiveness as to DBE or MBE of DBE Requirements. Many RFPs contain specified requirements as to Minority Business Enterprises (MBEs) or Disadvantaged Business Enterprises (DBEs). Failure to comply with such mandatory requirements is a material error that renders a bid non-responsive. See, e.g., City of Wildwood v. Gibbs & Register, Inc., 694 So. 2d 763 (Fla. 5th DCA 1997) (after bids were announced, mathematical errors were discovered showing that low bidder had not met the required MBE/WBE percentage); Vito’s Trucking and Excavating Co. v. Dept. of Transportation, No. 84-3436BID, 1984 WL 275479 at ¶ 6, 9, 14 (DOAH Dec. 14, 1984) (bid was non-responsive because bidder failed to meet DBE percentage requirements).

“Non-Responsible Bidder” Issues. A vendor’s bid or proposal must not only be responsive, but the vendor itself must also be a “responsible” bidder. Responsible bidder requirements are typically spelled out in the ITB or RFP or by controlling statute, rule or policy. Section 287.012(24) defines a “responsible vendor” as “a vendor who has the capability in all respects to fully perform the contract requirements and the integrity and reliability that will assure good faith performance.” Generally, a bidder can be disqualified as non-responsible for a variety of reasons including such matters as: lack of required qualifications, lack of necessary resources and experience, financial inability or insolvency, submitting false statements in bids, delinquencies on prior contracts, failure to meet applicable pre-qualification requirements, failure to possess required certifications, and the like. Typically these type requirements cannot be satisfied post-bid opening. City of Opa Locka v. Trustees of Plumbing Industry Promotion Fund, 193 So. 2d 29, 32 (Fla. 3d DCA 1966).

Pricing and Performance Issues Showing “Non-Responsible Bidders. In unusual cases, a low bid may be “too good to be true” and various factors may indicate that the bidder cannot perform. A public entity is not necessarily required to accept the lowest dollar bid, but instead may bypass the “lowest bid” if that bidder or the bid itself is not “responsible.” See, e.g., City of Pensacola v. Kirby, 47 So. 2d 533, 535 (Fla. 1950) (statute requiring award to “lowest responsible” bidder does not require agency to award contract to the “lowest dollars and cents” bidder); Couch Construction Co. v. State DOT, 361 So. 2d 184 (Fla. 1st DCA 1978); Mayes Print Co. v. Flowers, 154 So. 2d 859 (Fla. 1st DCA 1963). The “responsible bidder” requirement vests discretion in the public authority to determine whether the lowest bidder is in fact also the lowest responsible bidder by considering various performance related factors including such matters as facilities available, financial resources and ability, experience, quality of previous work, reputation for performance, judgment and skill, outstanding obligations, integrity and credit, pecuniary ability, and various other matters relating to the ability of the bidder to perform the contract. See, e.g., Duboise Const. Co. v. City of South Miami, 108 Fla. 362, 146 So. 833 (1933); Engineering Contractors Assoc. of South Florida, Inc., 789 So. 2d 445, 451 (Fla. 4th DCA 2001). Analogous federal authorities likewise illustrate that a public entity may consider performance, financial, and other factors, including whether a bid is abnormally low, unrealistic, or a “low-ball” offer, or otherwise made without adequate resources so as to create risk that the contractor will abandon or short-change performance. The federal decisions have termed this a “price realism analysis” and is used to make a “responsibility” determination, a performance risk assessment, or an analysis of whether the offeror understands the work. See, e.g., Information Sciences Corp. v. United States, 73 Fed. Cl. 70, 100-103 (U.S. Ct. Fed. Claims Sept. 19, 2006).

Non-Existing or Improperly Named Bidder as “Non-Responsible” Bidder. In general, a contract cannot be awarded to a nonexistent entity, since no entity would be bound to perform the work. Oklahoma County Newspapers, Inc., Comp. Gen. Dec. B-270849, 96-1 CPD 213, 1996 WL 225730 (May 6, 1996). Similarly, if a bidder’s corporate charter has been dissolved, it lacks legal capacity to contract, and so cannot be awarded the bid. Casper Const. Co., Inc., Comp. Gen. Dec. B-253887, 93-2 CPD 247, 1993 WL 437055 (Oct. 26, 1993). If a proposal is ambiguous on the identity of the offering entity, the offer will be unacceptable, since there is uncertainty as to exactly who is bound to perform the contract. B & L Services, Inc. v. Dept. HRS, No. 85-3294BID, 1986 WL 401534 at ¶ 9, 34, & 37 (DOAH June 4, 1986). Such ambiguous bids are nonresponsive because they do not exhibit an intent of the bidder to be bound by the terms of the contract and this directly impacts the price, quantity, quality and delivery of the solicited products. Honeywell, Inc. v. United States, 16 Cl. Ct. 173, 35 Cont. Cas. Fed. (CCH) ¶ 75,611 (U.S. Cl. Ct. 1989), rev. on other grounds, 870 F. 2d 644 (Fed. Cir. 1989); Griffin Const. Co., B-185790, 76-2 CPD ¶ 26, 1976 WL 13110 (July 9, 1976) (award of contract to an entity other than that named in the bid constitutes an improper substitution of bidders). Moreover, it is improper to substitute bidding entities after bids have been submitted. For example, in Mil-Tech Systems, Inc. v. United States, 6 Cl. Ct. 26, 28, 31-35 Cont. Cas. Fed. (CCH) 72,719 (U.S. Cl. Ct. 1984), the court held a bidder could not transfer all of its stock to another company where the only assets of the bidder’s company was the awarded bid because such transfer of stock under those circumstances was tantamount to an illegal substitution of the bidder and constitute improper “bid brokering.” Similarly, a bid is nonresponsive if the legal entity on the bid is different than the legal entity identified on the bid bond.

Bias, Improper Conduct, or Ethical Violations of Evaluation Committee. Bias, favoritism, or unethical conduct on the part of the evaluation committee is a frequent successful ground for protests. Even the potential appearance of a conflict of interest can qualify. See, e.g., Compass Environmental, Inc. v. Department of Environmental Protection, Case No. 05-0007, 2005 WL 678870 at ¶¶ 46-55, 77 (DOAH March 21, 2005) (holding evaluators properly removed due to potential appearance of conflict, and holding that it was unnecessary to show “hard fact” evidence of actual bias or favoritism) (DEP Apr. 19, 2005 reversing on other grounds); Transportation Management Servs. of Broward, Inc. v. Commission for the Transportation Disadvantaged, Case No. 05-0920, 2005 WL 1210021 (DOAH, May 20, 2005) (appearance of impropriety); Medco Behavioral Care Corporation v. State of Iowa Department of Human Services, 553 N.W. 2d 556 (Iowa 1996) (holding appearance of conflict of interest sufficient to nullify proposed contract award). There are also numerous Attorney General opinions and Ethics Commission opinions interpreting state ethics laws in procurement settings. See, e.g., Op. Att’y Gen. Fla. 74-159 (1974) (members of county aviation authority were public officers prohibited from being interested in public contracts in which they are party to the letting); Commission on Ethics Opinion (CEO) 01-4 (Mar. 20, 2001) (prohibited conflict of interest for City Commissioner to remain employee of tax-exempt community development corporation that contracts with the City).

Arbitrary Scoring and Evaluation Errors and Methodologies. So long as acting in good faith, public agencies have broad discretion in procurement matters. This is especially true when it comes to scoring and evaluation issues. Thus it is especially difficult to convince a court to re-score or re-evaluate. Nevertheless, some common examples of such challenges to consider include clear mathematical errors made by scorers, evidence that the scoring system itself is illogical or arbitrary, a clear statistical bias in a particular evaluator’s scoring when compared with other evaluators, failure of evaluator to sign conflict of interest forms, improper ex parte communications between evaluators as to scores, unqualified or inexperienced evaluators, and an evaluator’s failure to follow agency or bid document procedures. For example, if there are no weights assigned for the various criteria of an RFP, or the weights are applied inconsistently or irrationally, this can be a basis for challenge including on the basis that it prevents “an opportunity for an exact comparison of bids” as required by Wester v. Belote, 138 So. 721, 723-24 (Fla. 1938).

Consideration or Weighing of Criteria Beyond the Four Corners of the RFP. Evaluators are generally not to look outside the RFP criteria, or outside the proposals submitted, or base scoring on external information outside of the RFP and evaluation process when conducting their reviews of the submitted proposals. Aurora Pump v. Gould Pumps, Inc., 424 So. 2d 70 (Fla. 1st DCA 1982) (agency must evaluate the bids or proposals received solely on the criteria stated in the RFP); R. N. Expertise, Inc. v. Miami-Dade County School Board, et al., Case No. 01-2663, 2002 WL 185217 (DOAH: Feb. 4, 2002; F.O. Mar. 14, 2002).

Improper POST-Bid Submissions. No submissions made after the bid or proposal opening that amend or supplement are to be considered by the agency. Thus a bidder cannot change a bid after the bid has been opened, except to cure “minor” irregularities. Harry Pepper & Assoc. v. Cape Coral, 352 So. 2d 778 (Fla. 1st DCA 1981).

Post-Award Changes; Improper Bid Shopping. Solicitation documents often require that subcontractors be listed and identified at the time of proposal submission. Failure to identify all subcontractors as required by an RFP is grounds for challenging a proposal as invalid. See, e.g., E.M. Watkins & Company, Inc. v. Board of Regents, 414 So. 2d 583, 587 (Fla. 1st DCA 1982) (“dangers” of bid shopping); D. E. Wallace Construction Corp. v. Florida Board of Regents, No. 89-6844BID, 1990 WL 749710 at ¶¶ 24-29 (DOAH Feb. 26, 1990; F.O. March 30, 1990) (bidder failed to use correct list of subcontractors form and did not submit its proposed MBE participation plan until seven days after bid opening, thus bid was non-responsive). An RFP or ITB that allows a party to submit a bid or proposal for work that will be substantially conducted by subcontractors, without a requirement to identify the subcontractors, and provide proof of ability to perform at the bid price is certainly a situation making the RFP or ITB subject to a timely challenge. Again, the challenge must be brought within 72 hours of the issuance of such an RFP or ITB or the issue will likely be waived.

The Formal Hearing Process

Generally. Once the protest is filed, and assuming there are disputed issues of fact, the agency refers the matter to Florida’s Division of Administrative Hearings (DOAH) for an expedited formal hearing before an administrative law judge (ALJ) pursuant to the detailed provisions of Section 120.569 (decisions affecting substantial interests), Section 120.57 (additional procedures), and Section 120.57(3) (additional requirements as to hearings involving bid protests).

Right to a Hearing: Issues can sometimes arise as to whether a fair hearing under Section 120.57(1), Florida Statutes, is required. Examples would include solicitations by a local government that involve expenditure of state funds; solicitations by a state contractor for subcontractors that will be funded with state funds; or solicitations by other organizations or bodies that have accepted state or federal funding or grants, and have made themselves subject to the public procurement processes. Even in situations where a Section 120.57 hearing is not required, fundamental due process would demand that a hearing be made available that includes adequate notice and a right to be heard. The sufficiency of the process being offered by a local government agency is often the subject of legal challenge. An aggrieved party can always seek relief in circuit court if being denied the opportunity for a full and fair hearing.

Expedited Nature. Section 120.57 hearings are de novo and are expedited in the sense that: a final hearing must be conducted within 30 days of DOAH’s receipt of the formal protest; a recommended order is to be issued by the ALJ within 30 days after receipt of the hearing transcript; and a final order is to be issued by the agency within 30 days of the recommended order. However, these time periods can be waived by agreement of the parties and in complex cases this is often the case, although the prevailing vendor may insist on the statutory time periods.

Pre-Hearing Discovery and Other Procedures. Pre-hearing procedures and rights are similar to civil non-jury trials. The rules are found in Chapter 128-106 Fla. Admin. Code. Among other things, these rules incorporate the discovery rules and procedures from the Florida Rules of Civil Procedure. Accordingly, the broad arsenal of discovery including written discovery (interrogatories, requests for production, requests to admit) and depositions are commonly utilized.

Burden and Standard of Proof. In bid protests where an award has been made, the administrative law judge (ALJ) is required to conduct a de novo proceeding to determine whether the agency’s proposed action is clearly erroneous, contrary to competition, arbitrary or capricious, or contrary to the agency’s rules or policies, or the bid or proposal specifications. The standard of proof in these proceedings is whether the proposed agency action was clearly erroneous, contrary to competition, arbitrary, or capricious. However, a lower standard of review applies where the agency has rejected all bids – such a decision will be overturned only if the agency’s action is illegal, arbitrary, dishonest, or fraudulent. § 120.57(3)(f), Fla. Stat.

Hearing and Post-Hearing Process. The hearings are full evidentiary hearings that will typically take 1-3 days. In highly complex procurements the hearings can sometimes last for a week or more. Following the hearing, proposed recommended orders are submitted generally within 30 days. These PROs are lengthy detailed documents that outline proposed findings of fact based upon the evidence presented in the hearing, as well as proposed conclusions of law, and a recommendation. The ALJ then considers the PRO submitted by each party and issues a recommended order to the agency. The recommended order will include the ALJ’s findings of fact and conclusions of law and an ultimate recommendation on whether to award the contract to a particular vendor, to return all bids and proposals to the agency to be re-evaluated, or to reject all bids and proposals.

The parties then have 15 days to file exceptions to the recommended order with the agency. The agency is bound by the findings of fact, unless there is no competent substantial evidence in the record to support the ALJ’s findings. The agency can only change a conclusion of law if it is on a matter that is within the agency’s specialized knowledge or expertise, and the agency’s conclusion is as reasonable or more reasonable that the conclusions of the ALJ. The agency issues its final order either accepting in whole or part the ALJ’s recommended order. The agency’s FO is subject to judicial review via appeal to the District Court of Appeal.

Download PDF Version Here.

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of bid protest and public procurement for over 20 years.

Update on Return of Nursing Home CON in Florida

View PDF Version Here.

AHCA announced the preliminary winners and losers in the first nursing home CON batching cycle since the Legislature lifted the moratorium in 2014. The State Agency Action Reports (“SAARs”) released on February 20 had a few surprises, but perhaps the biggest surprise is not contained within the decisions on the 102 completed CON Applications, but instead in the significant number of areas that are still left with unmet need.

While most of the talk surround nursing home CON Applications filed in this batching cycle has been about the large number of CON Applications filed, perhaps the more interesting story is that in 9 sub-districts, where there was a combined published fixed need of 365 beds, no one applied. In 13 other sub-districts, AHCA’s preliminary decisions awarded less beds than the fixed need determination calculated despite having CON Applications that would have met the need, for a combined deficit of 443 beds. For example, in Lee County, sub-district 8-5, there was fixed need for 40 beds, yet AHCA denied the only CON Application filed in that sub-district, leaving the 40 bed fixed need determination unmet.

This article focuses on the fixed need determinations by sub-district and the net surplus or deficit that would be created if AHCA’s preliminary determinations stand. Note, however, that AHCA’s preliminary determinations may be overturned by legal challenges filed before March 16, 2015, so these numbers are subject to and will almost definitely change significantly before all of the legal challenges are completed. For a more detailed discussion on the legal challenge process and timeline, see our newsletter dated February 11, 2015.

SUB-DISTRICTS WITH FIXED NEED WITHOUT A CON APPLICANT

No one applied for a nursing home CON in 9 sub-districts where there was published fixed need in the Second Batching Cycle for Other Beds and Programs 2014. The chart below shows the sub-district, counties, and fixed need that was not applied for by any nursing home provider.

Sub-district Counties Unmet Need
2-1 Gadsden, Holmes, Jackson, and Washington 56
2-3 Calhoun, Franklin, Gulf, Liberty, and Wakulla 14
3-1 Columbia, Hamilton, and Suwannee 99
3-3 Putnam 43
5-1 Pasco 67
6-4 Highlands 25
9-1 Indian River 18
9-2 Martin 37
9-3 Okeechobee 6

While it is too late for anyone to apply for a CON in these sub-districts in this batching cycle, it is extremely likely that similar fixed need will be published for these sub-districts in the next batching cycle on April 3, 2015.

SUB-DISTRICTS WHERE NEED IS GREATER THAN AHCA AWARDS

In 13 sub-districts, AHCA preliminarily awarded CONs for less beds than the current projected need. The chart below provides the sub-district, counties, and deficit between the fixed need calculations and preliminary awards.

Sub-district Counties Unmet Need
1-1 Escambia and Santa Rosa 40
3-2 Alachua, Bradford, Dixie, Gilchrist, Lafayette, Levy and Union 60
3-5 Citrus 43
3-6 Hernando 16
3-7 Lake and Sumter 25
4-3 St. Johns and south-eastern Duval 47
5-2 Pinellas 56
7-2 Orange 18
7-3 Osceola 10
7-4 Seminole 78
8-1 Charlotte 3
8-2 Collier 7
8-5 Lee 40

Any Applicant that filed a CON in the current batching cycle has the right to challenge their denial or the approval of another CON in the same sub-district prior to March 16, 2015.

SUB-DISTRICTS WHERE AHCA AWARDS EXCEEDED FIXED NEED

There were 4 sub-districts where AHCA awarded more beds than the fixed need publications showed were needed. The chart below shows the sub-district, counties, and surplus of beds over the published fixed need.

Sub-district Counties Surplus Beds
2-2 Bay 14
3-4 Marion 12
4-2 Baker, Clay, and southwestern Duval 47
6-5 Polk 51

Any Applicant that filed a CON in the current batching cycle has the right to challenge their denial or the approval of another CON Application filed in the same sub-district prior to March 16, 2015.

RIGHTS OF EXISTING PROVIDERS

Existing providers in the same district that will be substantially affected by the approval of a competing proposed facility or program can initiate or intervene in a challenge pursuant to Fla. Stat. §408.039(5)(c) (2014). Thus, by way of example, an existing provider in sub-district 6-3 can challenge a preliminary approval of a proposed provider in sub-district 6-5 because they are both in district 6. This is different from competing Applicants that must be filing in the same sub-district to prove standing. Existing providers may also intervene in legal proceedings challenging preliminary approvals after March 16, 2015, however, they do so subject to the standing of the other parties to the proceeding, as discussed in our prior newsletter on February 11, 2015. Thus, existing providers that wait until after March 16, 2015, do so at the risk that no one else challenges the preliminary approval.

AREAS RIPE FOR CHALLENGES

At this point, any area where there is a pending CON approval is an opportunity for a legal challenge. Basis for challenges are unlimited and can include any combination of factors, such as a better fit for the market, technical flaws in an application, under or over filling the gap in need demonstrated by the fixed need publication, etc. There are literally countless basis for challenging a preliminary CON approval. Notably, final hearings are de novo proceedings, meaning AHCA’s preliminary decision is not given any weight or presumption of correctness.

Without a full detailed review of all of the competing Applications within a sub-district, it’s difficult to make any specific conclusions about where successful opportunities for challenges could be found. That said, there are some sub-districts that seem to stand out in a macro-analysis shown in the chart below.

Sub-district Deficit/Surplus Reason
1-1 40 Bed Surplus Other Applicant met the published need
3-2 60 Bed Surplus Other Applicants met the published need
4-4 47 Bed Surplus Other Applicants met the published need
5-2 56 Bed Surplus Denied 56 bed Applicant
7-4 78 Bed Surplus Other Applicants met the published need
8-5 40 Bed Surplus Denied 31 bed Applicant

If these preliminary approvals are not challenged, they become final approvals and CONs will be awarded in these sub-districts.

Thus, if you are uncertain about whether you want to challenge a denial or someone else’s approval, it’s best to go ahead and file a challenge. A challenge can always be dismissed if you decide not to proceed, but if you miss the opportunity to challenge, then you may have missed the window of opportunity. That said, we have conservatively used March 16, 2015, as the deadline to file challenges throughout this article. However, there are certain facts and subsequent notice that have occurred in this batching cycle that might extend the period of time to file such challenges. Thus, if you have not decided to file a challenge until after March 16, 2015, and are just now reading this article and thinking you are too late, please contact us to discuss whether there may be additional ways to challenge a preliminary denial or approval.

CONCLUSION

February 20, 2015, held a few surprises for the bountiful field of CON Applicants, particularly that there is still a significant amount of unmet need where either no one applied for a CON or where AHCA did not award the beds to the full amount projected by the need formula. It will be interesting to see on April 3, 2015, whether AHCA again publishes similar need for these unclaimed areas, and if so, whether any CON Applicants will jump into the arena to compete for these unclaimed areas. There are also many areas of the State that are potentially subject to legal challenges to AHCA’s preliminary approvals. It will be interesting to see how many of AHCA’s preliminary decisions ultimately remain after these legal challenges are completed.

Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law and CON regulation for over 20 years.

View PDF Version Here.

HIPAA Enforcement and Compliance: What You Need to Know

View PDF Version Here.

HIPAA 101

The Health Insurance and Accountability Act of 1996 (HIPAA) is a federal law that sets forth certain requirements to be followed by healthcare providers and related entities with respect to safeguarding a patient’s privacy and security.1 HIPAA helps to ensure that all medical records, medical billing, and patient account information meet certain standards with regard to documentation, handling, and privacy. Most simply, it requires “covered entities” to protect the privacy of patient information, secure patient health information (physically and electronically), adhere to the “minimum necessary” standard for use and disclosure of patient health information, and specifies patients’ rights for access, use and disclosure of their health information.

Following the passage of HIPAA, the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act and the 2013 HHS HIPAA Final Omnibus Rule strengthened and updated the federal HIPAA privacy and security standards. Major revisions included: breach notification requirements, fine and penalty increases for privacy violations, mandating that business associates are directly liable for HIPAA compliance, patients’ right to request electronic copies of their health care records, and patients’ right to restrict disclosure to health plans for services self‐paid in full (“self‐pay restriction”).

HIPAA’s Privacy and Security Rule, along with the relatively recent revisions resulting from the 2009 HITECH Act and 2013 Final Omnibus Rule, are discussed briefly below. 2

HIPAA Privacy Rule

The HIPAA Privacy Rule, 45 CFR Parts 160-164, regulates the use and disclosure of Protected Health Information (“PHI”). Under HIPAA, a covered entity is not required to obtain consent or authorization to use or disclose PHI for treatment, payment, or health care operations.3 While the HIPAA Privacy Rule does not require an individual’s consent or authorization for the use or disclosure of PHI for treatment, payment, or health care operations, Florida Statutes imposes a more stringent standard for the use or disclosure of patient information, and requires a written authorization for disclosures other than for treatment purposes, except under certain enumerated circumstances.4
When the use or disclosure of PHI is not related to treatment, payment, or health care operations, HIPAA requires a written valid authorization, except under certain enumerated exceptions.5 In order for the authorization to be valid, certain requirements outlined in HIPAA must be met.6 The HIPAA Privacy Rule contains several key definitions, listed below:
Business Associate: A person, other than a member of the covered entity’s workforce, that, with respect to a covered entity, performs or assists in the performance of a function or activity involving the use or disclosure of individually identifiable health information.7

Covered Entity: A health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with a transaction subject to the privacy rule.8

Protected Health Information (PHI): Individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium.9 PHI is information related to a patient’s past, present, or future physical and/or mental health condition. It includes, but is not limited to, the following information when it is maintained by a healthcare covered entity in order to conduct healthcare treatment, payment, or operations: name, address, birthdate, telephone number, email address, social security number, medical record number, account number, certificate/license number, and several other types of information collected and used by healthcare providers. PHI includes health information about individuals who have been deceased less than 50 years.

Minimum Necessary: When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. The minimum necessary requirement does not apply to disclosures to a health care provider for treatment.10

HIPAA Security Rule

The HIPAA’s Security Rule established a national set of security standards for protecting certain health information that is held or transferred in electronic form.11 The Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities to use to assure the confidentiality, integrity, and availability of electronic protected health information. While the Privacy Rule concerns those who can have access to PHI, the Security Rule’s focus is on ensuring that only those who are entitled to access electronic protected health information (ePHI) gain access to ePHI.

The HIPAA Security Rule applies to covered entities and business associates, as defined above. While the Privacy Rule protects the privacy of PHI, the Security Rule protects PHI that a covered entity creates, receives, maintains or transmits in electronic format. The Security Rule does not apply to PHI transmitted orally or in writing, only electronic PHI.12

The Security Rule requires covered entities and business associates to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI. The Rule does not dictate which security measures a covered entity or business associate must use, but requires that they take into account: their size, complexity, and capabilities; their technical, hardware and software infrastructure; the costs of security measures; and the likelihood and possible impact of potential risks to e-PHI.13 Covered entities must adopt reasonable and appropriate policies and procedures to comply with the provisions of the Security Rule, and must periodically review and update its documentation.

Breach Notification Requirements

The HIPAA Security Rule requires covered entities to notify individuals, the Secretary of HHS under certain circumstances, and in some cases, the media, regarding breaches of unsecured protected health information.14  Once a covered entity discovers a breach of unsecured PHI, both Florida law and HIPAA require notification to the individual “without unreasonable delay.”

Under HIPAA’s Security Rule, the outside time limit for individual notification is 60 calendar days, while under the Florida Information Protection Act (FIPA), the outer time limit for notification is 30 days.15 As Florida’s law is more stringent, covered entities should be sure to comply with the shorter timeframe specified in Florida statutes. Additionally, business associates are required to notify covered entities of a breach of unsecured PHI.16
Enforcement Overview

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) is responsible for enforcing HIPAA’s Privacy and Security Rules. OCR enforces the Privacy and Security Rules by investigating complaints and conducting compliance reviews to determine if covered entities are in compliance.

If OCR accepts a complaint for investigation, OCR will notify the person who filed the complaint and the covered entity named in it. Then the complainant and the covered entity will present information about the incident(s) described in the complaint. Covered entities are required by law to cooperate with complaint investigations.

If a complaint describes an action that could be a violation of the criminal provision of HIPAA (42 U.S.C. 1320d-6), OCR may refer the complaint to the Department of Justice for investigation.

OCR reviews the information, or evidence, that it gathers in each case. In some cases, it may determine that the covered entity did not violate the requirements of the Privacy or Security Rule. If the evidence indicates that the covered entity was not in compliance, OCR will attempt to resolve the case with the covered entity by obtaining: voluntary compliance; corrective action; and/or a resolution agreement.

If the covered entity does not take action to resolve the matter in a way that is satisfactory, OCR may decide to impose civil money penalties (CMPs) on the covered entity. If CMPs are imposed, the covered entity may request a hearing in which an HHS administrative law judge decides if the penalties are supported by the evidence in the case.17

Potential Fines

Failure to comply with HIPAA can result in civil and criminal penalties.

Civil Penalties18
The HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA) that was signed into law on February 17, 2009, established a tiered civil penalty structure for HIPAA violations (see chart below).19  The Secretary of the Department of Health and Human Services (HHS) has discretion in determining the amount of the penalty based on the nature and extent of the violation and the nature and extent of the harm resulting from the violation.20 If the covered entity or business associate does not act with willful neglect and corrects the violation within 30 days, the OCR may not impose any penalty. Timely correction is an affirmative defense.21

HIPAA Violation Minimum Penalty Maximum Penalty
Individual did not know (and by exercising reasonable diligence would not have known) that he/she violated HIPAA $100 per violation, with an annual maximum of $25,000 for repeat violations $50,000 per violation, with an annual maximum of $1.5 million per identical violation per year
HIPAA violation due to reasonable cause and not due to willful neglect $1,000 per violation, with an annual maximum of $100,000 for repeat violations $50,000 per violation, with an annual maximum of $1.5 million per identical violation per year
HIPAA violation due to willful neglect but violation is corrected within the 30 day required timeframe $10,000 per violation, with an annual maximum of $250,000 for repeat violations $50,000 per violation, with an annual maximum of $1.5 million per identical violation per year
HIPAA violation is due to willful neglect and is not corrected within the 30 day required timeframe $50,000 per violation, with an annual maximum of $1.5 million $50,000 per violation, with an annual maximum of $1.5 million per identical violation per year

Criminal Penalties22
Covered entities and specified individuals, as explained below, whom “knowingly” obtain or disclose individually identifiable health information in violation of HIPAA may be fined up to $50,000, as well as face imprisonment up to one year. Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine, with up to five years in prison. Offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to ten years.23

Covered Entity and Specified Individuals

The DOJ concluded that the criminal penalties for a violation of HIPAA are directly applicable to covered entities—including health plans, health care clearinghouses, health care providers who transmit claims in electronic form, and Medicare prescription drug card sponsors. Individuals such as directors, employees, or officers of the covered entity, where the covered entity is not an individual, may also be directly criminally liable under HIPAA in accordance with principles of “corporate criminal liability.” Where an individual of a covered entity is not directly liable under HIPAA, they can still be charged with conspiracy or aiding and abetting.24

Recent HIPAA Violations

Anthem Health Insurance Breached Again

In February 2015, Anthem Health Insurance, the nation’s second largest health insurance company, reported what is likely the largest health care related breach of HIPAA data to date. The breach involved an estimated 80 million Anthem customers, and Anthem is potentially liable for up to $1.5 million for the breach under HHS rules.25 The two largest health care breaches to date have been Tricare in 2011, which affected 4.9 million individuals, and Community Hospital Systems in 2014, which involved data from 4.8 million individuals.26

According to an Anthem official statement, while there was no evidence that medical information was compromised, the attackers gained access to Anthem’s IT system and have obtained information from members such as names, medical IDs/SSN, mailing and email addresses.27 For this to be considered a HIPAA breach, Protected Health Information (PHI) as defined by HIPAA and HITECH Security Rules would have to be involved. A person’s name, address and SSN (identifiers confirmed as part of the Anthem breach) are included within the types of data that comprise PHI, as articulated above.

This is not the first time that Anthem’s security was breached resulting in HIPAA violations. Anthem recently agreed to pay HHS $1.7 million to settle an investigation into a separate computer breach that occurred in 2010 and resulted in the disclosure of personal information of approximately 612,000 people.28 (At the time of the breach, Anthem was known as WellPoint). The HHS found that in 2009 and 2010, WellPoint did not adequately implement policies and procedures to protect unsecured “electronic protected health information” covered by HIPAA, and as a result, names, dates of birth, addresses, Social Security numbers and health information of over 600,000 WellPoint customers was disclosed.29 According to HHS, the personally identifiable information that HIPAA-covered health plans maintain on enrollees and members, including names and Social Security numbers, is protected under HIPAA, even if no specific diagnostic or treatment information is disclosed.30
Other Recent HIPAA Enforcement Actions and Resolutions

The Office for Civil Rights, the HHS division responsible for enforcing HIPAA, has levied more than $25.1 million in fines against healthcare organizations responsible for violating the privacy and security rules.31  To date, HHS has resolved 21 cases that resulted from breach reports of electronic protected health information. A few of these are highlighted below. For a more comprehensive accounting, please see: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.

$150,000 HIPAA Settlement Involving Anchorage Community Mental Health Services (ACMHS) (December 2014): Under the settlement agreement, ACMHS will pay $150,000 and adopt a corrective action plan to correct deficiencies in its HIPAA compliance program. OCR opened its investigation after receiving notification from ACMHS regarding a breach of unsecured electronic protected health information (ePHI) affecting 2,743 individuals due to malware compromising the security of its information technology resources. OCR’s investigation revealed that ACMHS had adopted sample Security Rule policies and procedures in 2005, but these were not followed. Moreover, the security incident was the direct result of ACMHS failing to identify and address basic risks, such as not regularly updating their IT resources with available patches and running outdated, unsupported software. http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/acmhs/acmhsbulletin.pdf.

$800,000 HIPAA Settlement Involving Parkview Health System, Inc. (June 23, 2014): Under the settlement, Parkview agreed to pay $800,000 and adopt a corrective action plan to address deficiencies in its HIPAA compliance program.  OCR opened an investigation after receiving a complaint from a retiring physician alleging that Parkview had violated the HIPAA Privacy Rule.  Parkview employees left 71 cardboard boxes of medical records unattended and accessible to unauthorized persons on the driveway of the physician’s home. In addition to the $800,000 resolution amount, the settlement includes a corrective action plan requiring Parkview to revise their policies and procedures, train staff, and provide an implementation report to OCR. http://www.hhs.gov/news/press/2014pres/06/20140623a.html.

$4.8 million HIPAA Settlement Involving New York Presbyterian Hospital and Columbia University (May 2014): Two health care organizations settled charges that they potentially violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules by failing to secure thousands of patients’ electronic protected health information (ePHI) held on their network.  The monetary payments of $4,800,000 include the largest HIPAA settlement to date. OCR initiated its investigation of New York and Presbyterian Hospital (NYP) and Columbia University (CU) following their submission of a joint breach report, dated September 27, 2010, regarding the disclosure of the ePHI of 6,800 individuals, including patient status, vital signs, medications, and laboratory results. In addition to the impermissible disclosure of ePHI on the internet, OCR’s investigation found that neither NYP nor CU made efforts prior to the breach to assure that the server was secure and that it contained appropriate software protections.  http://www.hhs.gov/news/press/2014pres/05/20140507b.html.

$1.7 Million HIPAA Settlement Involving Concentra Health Services (April 2014): OCR opened a compliance review of Concentra Health Services (Concentra) upon receiving a breach report that an unencrypted laptop was stolen from one of its facilities, the Springfield Missouri Physical Therapy Center.  OCR’s investigation revealed that Concentra had previously recognized in multiple risk analyses that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing ePHI was a critical risk.  While steps were taken to begin encryption, Concentra’s efforts were incomplete and inconsistent over time leaving patient PHI vulnerable throughout the organization. OCR’s investigation further found Concentra had insufficient security management processes in place to safeguard patient information. Concentra has agreed to pay OCR $1,725,220 to settle potential violations and to adopt a corrective action plan.  
http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/stolenlaptops-agreements.html.

What To Do If You Become Aware of a HIPAA Breach?

Covered entities must provide a process for individuals to make complaints and document all such complaints.32 Additionally, covered entities may not take any retaliatory actions against anyone making a complaint.

If a breach of unsecured protected health information poses a risk of significant financial, reputational or other harm to the patient, business associates must promptly report the breach to covered entities, and covered entities must notify the patient without unreasonable delay, and no later than within 60 days under HIPAA33, or 30 days under FIPA. If the breach involves fewer than 500 persons, the covered entity must notify HHS by filing an electronic report no later than 60 days after the end of the calendar year.34 If the breach involves 500 or more persons, the covered entity must file the electronic report when it notifies the patient.35 The written notice to the patient must satisfy regulatory requirements.36 Documenting proper actions will help you defend against HIPAA claims. Covered entities and business associates are required to maintain documentation required by HIPAA for six years.37

Understanding the HIPAA Complaint Process and Compliance Reviews

It is important that covered entities have a working knowledge of the complaint, investigation, and enforcement process in order to ensure HIPAA compliance.38

The Complaint

Any person who believes that a covered entity or business associate is not complying with HIPAA has the right to file a complaint with HHS.39  The complaint must name the provider who allegedly violated HIPAA and describe the acts or omissions that are believed to have violated HIPAA.  The statute of limitations time period for filing complaints is 180 days after the date when the complainant knew or should have known that the act or omission occurred, but this time limit can be waived for good cause.40

Investigating Complaints

If HHS accepts a complaint for investigation, it will notify the person who filed the complaint and the covered entity named in it. Then the complainant and the covered entity will have the opportunity to present information about the incident described in the complaint. HHS has the authority to subpoena witnesses and documents as part of its investigation. The investigation may include a review of the covered entity’s policies, procedures, or practices.41

Once HHS has completed its investigation, one of three things may occur. The first thing that may occur is that HHS may close the case in favor of the covered entity because it determines that the covered entity did not violate HIPAA. HHS will inform the covered entity and the complainant of its determination.42

Assuming HHS finds that a covered entity has violated HIPAA, HHS will attempt to resolve the matter informally, which could include such things as demonstrated compliance, a completed corrective action plan, or other resolution agreement.43

If the complaint is not resolved by informal means, the HHS will inform the covered entity and will allow the covered entity to submit written evidence of any mitigating factors or affirmative defenses.44  Mitigating factors are things such as the nature of the violation; the circumstances surrounding the violation; the degree of culpability of the covered entity; a history of compliance; and, the financial condition of the covered entity. Affirmative defenses would include circumstances that made it unreasonable for the covered entity, despite exercising ordinary care and prudence, to comply with HIPPA.45 After considering any mitigating factors and/or affirmative defenses, if HHS finds that a civil money penalty should be imposed, it will inform the covered entity or business associate of such finding in a notice of proposed determination.46

Compliance Reviews

In addition, HHS may conduct compliance reviews to determine whether a covered entity or business associate is complying with HIPAA.47 HHS may initiate these reviews when it becomes aware of possible violations of HIPAA by a covered entity.

How to Protect Yourself and Avoid Penalties

Cyber attacks on health care organizations increased 100 percent between 2009 and 2013, and about 40 percent of health care organizations reported facing criminal cyberattacks in 2013.48 The FBI released a warning to the health care sector in April 2014, advising health care providers that their cybersecurity systems lagged behind protections in the retail and financial sectors, leaving them vulnerable to attacks by hackers.49

Healthcare organizations should perform a HIPAA risk assessment to look at where patient information is stored and accessed, and how the organization protects that information. Such an assessment will examine the risks of a breach and provide recommendations on how to minimize risks. Every health care organization should protect its sensitive data by doing the following:

  • Perform a security risk analysis yearly to discover security vulnerabilities
  • Keep hardware and software updated with current security patches
  • Determine whether the use of encryption technology is reasonable and appropriate, and if so, deploy encryption technology
  • Perform routine audits of access to information

Additionally, it is important that every organization engage in a full compliance review of policies, forms, and procedures on an annual basis with health care regulatory counsel to ensure HIPAA compliance. All “covered entities” and “business associates” were required to update their HIPAA policies, procedures, forms, and Notices of Privacy Practices by September 23, 2013. All covered entities must have documented policies and procedures regarding HIPAA compliance. Additionally, HIPAA compliance requires staff privacy and security training on a regular basis.

As discussed above, HIPAA compliance is mandatory and fines for breach are hefty. HIPAA regulatory counsel can help to ensure HIPAA compliance by reviewing, revising, and updating internal HIPAA policies and procedures, and tailoring such policies and procedures to the specific health care entity.

At a minimum, to avoid HIPAA penalties, health care providers and business associates should:

  • Designate HIPAA Privacy and Security Officers. Covered entities must designate privacy and security officers responsible for ensuring HIPAA compliance. These individuals, among other things, will be responsible for the development and implementation of policies and procedures and for receiving HIPAA complaints. The designations must be documented in writing.50 
  • Provide Appropriate Training to Employees and Agents.  Covered entities and business associates must train their employees to comply with HIPAA policies and procedures, and all trainings should be documented in order to avoid/minimize HIPAA penalties.51
  • Ensure Compliance with Authorization, Use, and Disclosure Rules. As discussed above, covered entities and business associates may not use, access, or disclose protected health information without the patient’s valid, HIPAA-compliant authorization unless the use or disclosure fits within an exception.52  Authorization is not required under HIPAA to carry out treatment, payment, or health care operations, however Florida Statutes requires a more stringent standard in some circumstances, and a covered entity would be required to adhere to both.
  • Know Patients’ Rights. Covered entities and business associates must understand and adhere to HIPAA’s patients’ rights.53
  • Maintain HIPAA Compliant Written Policies and Forms.  Covered entities and business associates must develop and maintain written policies that implement the privacy and security rule requirements, including those dealing with confidentiality and patients’ rights.54
  • Execute Compliant Business Associate Agreements. HIPAA requires covered entities to execute “business associate agreements” with their business associates before disclosing protected health information to the business associate. To avoid liability for the business associate’s actions, covered entities must ensure that their agreements specify that the business associate is an independent contractor and not an agent of the covered entity.
  • Implement Appropriate Safeguards for PHI and ePHI. A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI.55 The security rule contains detailed regulations concerning safeguards that must be implemented to protect electronic health information.56 
  • Respond Immediately to Any Breach. HIPAA requires covered entities and business associates to investigate any privacy complaints, mitigate any breach, and impose appropriate sanctions against any agent who violates HIPAA.57 A covered entity or business associate can avoid HIPAA penalties altogether if it does not act with willful neglect and corrects the violation within 30 days.

      • Geoffrey D. Smith is a shareholder in the law firm of Smith & Associates, and has practiced in the area of health care law for over 20 years.

      View PDF Version Here.

      1 See Pub.L. No. 104-191, 110 Stat.1936 (1996) (codified at 42 U.S.C. § 1320d-d8), commonly referred to as the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
      2 For additional information on HIPAA Privacy and Security Rules, see http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html and http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html
      3 45 C.F.R. §164.502.
      4 § 456.057(7)(a), Florida Statutes. While beyond the scope of this article, it is imperative that covered entities familiarize themselves and comply with the more stringent Florida statutes governing patient privacy and security, and the recently enacted Florida Information Protection Act of 2014 (FIPA), which took effect July 1, 2014.
      5 45 C.F.R. §164.508.
      6 45 C.F.R. §§164.508, .512.
      7 45 C.F.R. §160.103.
      8 45 C.F.R. §160.103.
      9 45 C.F.R. §160.103.
      10 45 C.F.R. §164.502(b).
      11 http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html.
      12 http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html.
      13 45 C.F.R. §164.306(b)(2).
      14 45 C.F.R. §§164.404, 164.406, 164.408.
      15 Florida Information Protection Act (FIPA); Fla. Stat. §501.171.
      16 45 C.F.R. §§164.410.
      17 http://www.hhs.gov/ocr/privacy/hipaa/enforcement/process/howocrenforces.html.
      18 45 C.F.R. §160.404.
      19 See http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.page.
      20 Id.
      21 45 C.F.R. §160.410.
      22 42. U.S.C. §1320d-6.
      23 Id.
      24 See http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.page.
      25 http://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach-fine-17-million/22931345/.
      26 http://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach-fine-17-million/22931345/.
      27 Id.
      28 http://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach-fine-17-million/22931345/
      29 Id.
      30 http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/wellpoint-agreement.html
      31 http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/wellpoint-agreement.html
      32 45 C.F.R. §164.530.
      33 45 C.F.R. §164.404.
      34 45 C.F.R. §164.408(c).
      35 45 C.F.R. §164.408(b).
      36 45 C.F.R. §164.404.
      37 45 C.F.R. §164.530(j).
      38 http://www.hhs.gov/ocr/privacy/hipaa/enforcement/process/howocrenforces.html
      39 45 C.F.R. §160.306(a).
      40 45 C.F.R. §160.306(b)(3).
      41 45 C.F.R. §160.306.
      42 45 C.F.R. §160.312(b)
      43 45 C.F.R. §160.312(a).
      44 45 C.F.R. §160.312(a).
      45 45 C.F.R. §160.410.
      46 45 C.F.R. §160.312.
      47 45 C.F.R. §160.308.
      48 http://www.washingtonpost.com/blogs/the-switch/wp/2015/02/05/why-hackers-are-targeting-the-medical-sector/?hpid=z1.
      49 Id.
      50 45 C.F.R. §164.530(a).
      51 45 C.F.R. §164.530(b).
      52 45 C.F.R. §164.502.
      53 45 C.F.R. §§164.524, .526, .528.
      54 45 C.F.R. §164.316.
      55 45 C.F.R. §164.530(c).
      56 45 C.F.R. §164.308.
      57 45 C.F.R. §164.530.