Associate General Counsel, Office of the General Counsel, AHCCCS Job Location: 801 E. Jefferson Street, Phoenix, AZ 85034 Salary: $70,000-$82,500 This position is eligible for part-time/full-time remote work (including virtual…
By: Miranda A. Preston and Desalina Williams, Milligan Lawless
The Centers for Medicare & Medicaid Services (CMS) has broad authority to revoke a health care provider’s and supplier’s Medicare enrollment, and in recent years, CMS’s revocation authority has increased.[1] Currently, CMS has the discretion to revoke the Medicare enrollment of any health care provider or supplier who fails to report various events to CMS, whether in the initial enrollment application, or after enrollment, following the occurrence of certain events.[2]
Physicians, non-physician practitioners, and their respective organizations (collectively, the “Physicians” in this article[3]), who are enrolling in Medicare, or who are currently enrolled are required[4] to report all of the following to their designated Medicare contractor within the following time periods:
(1) Within 30 days –
(i) A change of ownership[[5]];
(ii) Any adverse legal action; or
(iii) A change in practice location.
(2) All other changes in enrollment must be reported within 90 days.
The Medicare regulations do not define what constitutes an “adverse legal action.” The Medicare regulations do however define a “final adverse action,” to include one or more of the following:
(1) a Medicare-imposed revocation of any Medicare billing privileges; (2) suspension or revocation of a license to provide health care by any State licensing authority [e.g., Arizona’s allopathic or osteopathic Medical Boards]; (3) revocation or suspension by an accreditation organization; (4) a conviction of a Federal or State felony offense (as defined in § 424.535(a)(3)(i))[[6]] within the last 10 years preceding enrollment, revalidation, or re-enrollment; or (5) an exclusion or debarment from participation in a Federal or State health care program.[[7]]
From the definition of a “final adverse action,” one can reasonably conclude (and CMS appears to have taken the position) that “any adverse legal action” includes all of the above circumstances, and any other event which could possibly be construed as an adverse legal action, even if it has no bearing on a Physician’s practice of medicine. Accordingly, Physicians should consult with legal counsel to ensure timely and complete disclosures to their Medicare contractor of events that could possibly constitute adverse legal actions.
If a Physician fails to report any of the above within the required time frames, CMS may revoke the Physician’s participation in the Medicare program, effectively terminating the Physician’s Medicare participation agreement.[8] Medicare revocations for failure to report in compliance with the above requirements are often coupled with other bases for revocation, such as when a Physician fails to report a felony conviction.[9]
When a Physician’s Medicare participation is revoked (in addition to the host of other potentially devastating consequences listed below), CMS bars the Physician from participating in the Medicare program from the date of the revocation until the end of the re-enrollment bar imposed by CMS, which can range from 1-10 years.[10] Medicare revocation can have other far reaching negative consequences for Physicians, including but not limited to: (i) placement on the CMS Preclusion List, rendering the Physician unable to contract with Medicare Advantage plans, or prescribe Part D prescription drugs; (ii) termination of commercial payor agreements; (iii) loss of medical staff privileges; (iv) termination of employment; (v) and general reputational damage.
To avoid revocation of Medicare enrollment as a result of a Physician’s failure to report, Physicians enrolled in Medicare must carefully monitor operational changes that are a part of the Medicare enrollment file and timely report such changes.
For more information, or if you have questions about Medicare reporting requirements, please contact Miranda Preston, Desalina Williams, or another health care attorney at Milligan Lawless.
[1] See Medicare, Medicaid, and Children’s Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process, 84 Fed. Reg. 47794 (Sept. 10, 2019); CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIP, CMS.gov Newsroom (Sept. 5, 2019), https://www.cms.gov/newsroom/press-releases/cms-announces-new-enforcement-authorities-reduce-criminal-behavior-medicare-medicaid-and-chip.
[2] See 42 C.F.R. § 424.535(a)(9).
[3] The more commonly used term, health care “Provider” is a specifically defined term in the Medicare regulations. Accordingly, this article uses the term “Physicians” throughout, even though non-physician providers are included in this definition. Under Medicare regulations, a “supplier” furnishes services under Medicare and includes physicians or other practitioners and facilities that are not included within the definition of the phrase “provider of services.” 42 U.S.C. § 1395x(d). A “provider of services,” commonly shortened to “provider,” includes hospitals, critical access hospitals, skilled nursing facilities, comprehensive outpatient rehabilitation facilities, home health agencies, hospice programs, and a fund as described in sections 1395f(g) and 1395n(e). 42 U.S.C. § 1395x(u). The distinction between providers and suppliers is important because they are treated differently under Medicare regulations for some purposes.
[4] 42 C.F.R. § 424.516(d).
[5] For most Physicians (excluding Medicare suppliers that require approval through certification survey by the state surveying agency or through accreditation (e.g., portable X-ray suppliers, ambulatory surgery centers, and hospitals with departments that bill for Medicare Part B services)), any change in the ownership or control of the Physician must be reported on the Physician’s Medicare enrollment application within 30 days of the change. Generally, a change of ownership that also changes the Physician’s tax identification number requires the completion and submission of a new enrollment application from the new owner. See 42 C.F.R. § 424.550(c). A “change of ownership,” the CMS term of art often abbreviated as a CHOW, is a distinct process. The regulations for CHOWs are codified at 42 C.F.R. § 489.18.
[6] Section 424.535(a)(3)(i) defines “Felonies” as:
(A) Felony crimes against persons, such as murder, rape, assault, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.
(B) Financial crimes, such as extortion, embezzlement, income tax evasion, insurance fraud and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.
(C) Any felony that placed the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that results in a conviction of criminal neglect or misconduct.
(D) Any felonies that would result in mandatory exclusion under section 1128(a) of the Act.
[7] 42 C.F.R. § 424.502.
[8] 42 C.F.R. § 424.535(a)(9).
[9] Physicians who have been convicted of a felony offense within the preceding 10 years, which felony CMS determines is “detrimental to the best interests of the Medicare program,” can be revoked from Medicare participation under a separate regulatory basis. See 42 C.F.R. § 424.535(a)(3). CMS has virtually unbridled discretion to determine that felony offenses are detrimental to the best interests of the Medicare program, even if the conviction has no apparent connection to the Physician’s treatment of Medicare beneficiaries (e.g., felony convictions for driving under the influence).
[10] 42 C.F.R. § 424.535(c).
Here for everyone. At Banner Health, we value and celebrate equity, diversity and inclusion. We care about you, your career and your future. If you’re looking to leverage your abilities…
Find your path in health care. We want to change the lives of those in our care – and the people who choose to take on this challenge. If you’re…
Position Summary: The Assistant General Counsel will report to the Phoenix Children’s Hospital Executive Vice President and General Counsel and provide a broad range of in-house legal support to the …
By: Chelsea Gulinson, Milligan Lawless, P.C.
Though overshadowed by the COVID-19 Pandemic, the Opioid Epidemic has quietly charged forward, with over 100,000 Americans dying from drug overdoses in 2021. State, local, and tribal governments have filed thousands of lawsuits against companies and individuals responsible for producing, manufacturing, distributing, or prescribing opioids seeking to hold them accountable for their role in the Epidemic. Novel legal theories, such as public nuisance violations, have been successful in some jurisdictions, but have failed in others. Some verdicts have been upheld; others reversed or remanded.
Despite this uncertain legal landscape, several Big Pharma companies have recently settled with state governments for billions of dollars and injunctive relief. Whether such an influx of cash will truly mitigate the effects of the Opioid Epidemic on the victims—those suffering from substance use disorder and families grieving their lost loved ones—is yet to be determined. This blog post briefly describes the current state of the Opioid Epidemic and recent developments in related litigation.
From 1999 to 2019, almost 500,000 Americans died from a drug overdose involving an opioid. The first wave of the Opioid Epidemic began in 1999 with increased prescriptions of opioids. In 2010, the second wave saw rapid increases in overdose deaths involving heroin. The third wave commenced in 2013, with drug overdose deaths overwhelmingly characterized by synthetic opioids, particularly fentanyl.[i]
In 2019, 70,630 drug overdose deaths occurred in the United States, a 4.3% increase from 2018. Nearly 50,000 deaths were attributable to opioids, over 36,000 involving synthetic opioids.[ii] In 2020, drug overdose deaths increased to nearly 100,000 Americans, a 30% increase from 2019. The COVID-19 Pandemic, which claimed the lives of over 1 million Americans, exacerbated the Opioid Epidemic by disrupting access to prevention, treatment, and harm reduction services. It also highlighted ongoing disparities in access to health care among minority groups. For example, drug overdose deaths disproportionately increased among Black and American Indian/Alaskan Native persons from 2019 to 2020 due to stigmatization, criminalization, and lack of access to evidence-based treatments.[iii] “Provisional” data from the CDC indicate that over 100,000 Americans died from a drug overdose in 2021.[iv]
In 2020, almost 4,000 non-fatal opioid overdoses occurred in Arizona, with 1,886 opioid-related overdose deaths. In 2021, Arizonans suffered 3,555 non-fatal opioid overdose events, and over 2,000 Arizona residents died from opioid-related overdoses. As of September 8, 2022, nearly 2,000 non-fatal opioid overdoses have occurred, and 372 Arizona residents have died from an opioid-related overdose.[v]
Data about opioid prescribing rates help illuminate how the Opioid Epidemic began, why it persists, and why many hold Big Pharma responsible for the Epidemic. Of individuals who began abusing opioids in the 1960s, more than 80% started with heroin. In contrast, of those who began abusing opioids in the 2000s, 75% started with a prescription drug, and nearly 80% of heroin users reported using prescription opioids before using heroin.[vi]
The opioid prescribing rate began to increase steadily in 2006, peaking in 2012 at more than 255 million opioid prescriptions, with a dispensing rate of 81.3 prescriptions per 100 persons. The national opioid dispensing rate declined between 2012 to 2020, with 43.3 opioid prescriptions per 100 persons in 2020 (still, more than 142 million opioid prescriptions). Although 2020 saw the lowest opioid dispensing rate to date, for which we have data, dispensing rates remained high in specific hotspots across the country. In 2020, Southern states, including Kentucky, Tennessee, Alabama, Louisiana, Mississippi, and Arkansas, saw an opioid dispensing rate between 64.1 and 82.9 opioid prescriptions per 100 persons. And some counties saw opioid dispensing rates of over 112.5 opioid prescriptions per 100 persons.[vii]
One of the first Opioid Epidemic lawsuits commenced in 2017, when the State of Oklahoma sued Johnson & Johnson, Purdue Pharma, and Teva Pharmaceuticals, alleging that the companies deceptively marketed opioids in Oklahoma. After settling with Purdue Pharma and Teva Pharmaceuticals, the State dismissed all claims against Johnson & Johnson except a novel public nuisance argument. After a 33-day bench trial, the Court held that Johnson & Johnson, “acting in concert with others, embarked on a major campaign in which they used branded and unbranded marketing to disseminate the messages that pain was being undertreated and ‘there was a low risk of abuse and a low danger’ . . . designed to reach Oklahoma doctors through multiple means and at multiple times over the course of the doctor’s professional education and career.”[viii] The Court awarded a $572 million judgment against Johnson & Johnson. On November 9, 2021, however, the Oklahoma Supreme Court overturned the verdict against Johnson & Johnson, holding that Oklahoma’s public nuisance law did not extend to the manufacturing, marketing, and selling of prescription opioids.[ix] Oklahoma later settled with Johnson & Johnson, McKesson, Cardinal, and AmerisourceBergen for $26 billion.[x]
New Hampshire filed suit against Johnson & Johnson’s subsidiaries in 2018, alleging that the company misrepresented that their opioids were safer than alternatives in aggressive marketing to prescribers and patients. New Hampshire also alleged that the company “disseminated misleading statements about opioids, that they promoted the false concept of pseudoaddiction and that they misrepresented that their opioids were rarely addictive when used for chronic pain.” On September 1, 2022, Johnson & Johnson entered into a $40.5 million settlement with New Hampshire, with $21.5 million of the settlement to be used for opioid abatement purposes. Along with the settlement payment, Johnson & Johnson agreed to a ban on selling and manufacturing opioids, promoting opioids and opioid products, and prescription savings programs, as well as lobbying restrictions and stringent enforcement provisions.[xi]
The Ohio Multi-District Litigation – a consolidation of over 3,000 cases brought by state, local, and tribal governments – has recently held pharmacies responsible for their role in the Opioid Epidemic. On August 17, 2022, a court ordered CVS, Walgreens, and Walmart to pay $650.5 million to two Ohio counties after a jury returned a verdict against them last November. The jury found the defendants liable for causing a public nuisance by intentional and illegal conduct, such as oversupplying legal prescription opioids that were diverted into illicit markets.[xii] A spokesperson for CVS indicated the company would appeal, claiming that CVS’s pharmacists “fill legal prescriptions written by D.E.A.-licensed doctors who prescribe legal, F.D.A.-approved substances to treat actual patients in need.” A Walmart spokesperson blamed the “real causes of the opioid crisis, like pill mill doctors, illegal drugs and regulators asleep at the switch.”[xiii]
Pharmacies have attempted to shift blame to physicians, but the Supreme Court recently sided with two physicians convicted of unlawfully dispensing and distributing drugs and sentenced to more than 20 years in prison. The Supreme Court vacated the physicians’ convictions and rejected the government’s mens rea standard of an “objectively reasonable good-faith effort.” Instead, the Supreme Court held that the government “must prove beyond a reasonable doubt that the defendant knowingly or intentionally acted in an unauthorized manner.”[xiv]
States, municipalities, and tribal nations have filed suits against various parties, including pharmaceutical companies, manufacturers, distributors, and doctors. Big Pharma has been accused of, and found liable for, oversupplying Americans with billions of pain medications. As settlements occur, many question whether the government should also be held responsible for its failures in preventing and combating the Epidemic. For example, some point to the FDA’s approval of OxyContin’s revised 2001 label for “around-the-clock” pain relief. Others find fault with the DEA due to the agency’s slow response to the significant increase in the use and diversion of opioids, failure to use available resources, and inadequate policies that did not hold registrants accountable or prevent diversion of pharmaceutical opioids.[xv] And although defendants have agreed to pay billions of dollars to help compensate victims, others are not confident that governments receiving the settlement funds will spend these funds effectively. Perhaps jaded by states’ misspending of their annual proceeds from the $246 billion tobacco Master Settlement Agreement, the likelihood of fights between state and local governments, and politicians on both sides of the political spectrum, critics are rightly concerned about whether the victims of the Opioid Epidemic will see any meaningful relief.[xvi]
[i] Understanding the Epidemic, CDC, https://www.cdc.gov/drugoverdose/epidemic/index.html (last accessed Sept. 8, 2022).
[ii] Christine L. Mattson, Ph.D. et al., Trends and Geographic Patterns in Drug and Synthetic Opioid Overdose Deaths – United States, 2013 – 2019, Morbidity and Mortality Weekly Report, CDC, Feb. 12, 2021, available at https://www.cdc.gov/mmwr/volumes/70/wr/mm7006a4.htm?s_cid=mm7006a4_w.
[iii] Mbabazi Kariisa, PhD et al., Vital Signs: Drug Overdose Deaths, by Selected Sociodemographic and Social Determinants of Health Characteristics – 25 States and the District of Columbia, 2019-2020, Morbidity and Mortality Weekly Report, CDC, July 22, 2022, available at https://www.cdc.gov/mmwr/volumes/71/wr/mm7129e2.htm?s_cid=mm7129e2_w#suggestedcitation.
[iv] Provisional Drug Overdose Death Counts, National Center for Health Statistics, CDC, https://www.cdc.gov/nchs/nvss/vsrr/drug-overdose-data.htm#notes (last accessed Sept. 8, 2022).
[v] Weekly Opioid Data, Opioid Prevention, Arizona Department of Health Services, https://www.azdhs.gov/opioid/ (last accessed Sept. 8, 2022).
[vi] Prescription Opioids and Heroin Research Report, National Institute on Drug Abuse, Rev. Jan. 2018, available at https://nida.nih.gov/download/19774/prescription-opioids-heroin-research-report.pdf?v=fc86d9fdda38d0f275b23cd969da1a1f.
[vii] U.S. Opioid Dispensing Rate Map, CDC, available at https://www.cdc.gov/drugoverdose/rxrate-maps/index.html (last accessed Sept. 8, 2022).
[viii] Judgment After Non-Jury Trial, State of Oklahoma ex rel. Hunter v. Purdue Pharma, L.P. et al., District Court of Cleveland County State of Oklahoma, case no. CJ-2017-816 (Aug. 26, 2019), available at https://int.nyt.com/data/documenthelper/1660-oklahoma-opioid-trial-johnson-and-johnson/79f3fe55f5fa1a75bd48/optimized/full.pdf#page=1.
[ix] District Court’s Judgment Reversed, State of Oklahoma ex rel. Hunter v. Johnson & Johnson et al., Supreme Court of the State of Oklahoma, case no. 118,474 (Nov. 9, 2021), available at https://www.washingtonpost.com/context/oklahoma-court-overturns-465m-opioid-ruling-against-j-j/159ce2c6-f6ba-4e6a-bfaa-539702c744be/?itid=lk_inline_manual_4.
[x] Christine Minhee, States and Localities Have $38 Billion (Ish) on the Table, available at https://www.opioidsettlementtracker.com/globalsettlementtracker (last access Sept. 9, 2022).
[xi] Attorney General Reaches $40.5 Million Settlement with Johnson & Johnson to Settle Opioid Claims, New Hampshire Department of Justice, Sept. 1, 2022, https://www.doj.nh.gov/news/2022/2022901-opioid-settlement.htm.
[xii] Abatement Order, In re National Prescription Opiate Litigation, United States District Court Northern District of Ohio, case no. 1:17-md-2804 (Aug. 17, 2022), available at https://www.ohnd.uscourts.gov/sites/ohnd/files/4611.pdf.
[xiii] Jan Hoffman, CVS, Walgreens and Walmart Must Pay $650.5 Million in Ohio Opioids Case, N.Y. Times (Aug. 18, 2022), available at https://www.nytimes.com/2022/08/17/health/opioids-cvs-walmart-walgreens.html.
[xiv] See Siulu Ruan v. United States, Supreme Court of the United States, case no. 20-1410 (June 27, 2022), available at https://www.supremecourt.gov/opinions/21pdf/20-1410_1an2.pdf.
[xv] Review of the Drug Enforcement Administration’s Regulatory and Enforcement Efforts to Control the Diversion of Opioids, Office of the Inspector General, U.S. Department of Justice (Sept. 2019), available at https://oig.justice.gov/reports/2019/e1905.pdf.
[xvi] See Christine Minhee, supra note x, at https://www.opioidsettlementtracker.com/faq/#bigtobacco.
Arizona Health Care Cost Containment System (AHCCCS) Accountability, Community, Innovation, Leadership, Passion, Quality, Respect, Courage, TeamworkThe Arizona Health Care Cost Containment System (AHCCCS), Arizona’s Medicaid agency, is driven by its…
Warren Recruiting seeks a talented Regulatory and Compliance Lawyer for an In-House Legal role with a tier-one medical institution based in Houston, Texas. The position will focus specifically on research…
By: Chase Millea, Snell & Wilmer[1]
We’ve all had heard it from one of our more active friends:
“Have you tried that latest health app? It tracks your fitness – from what you eat to how you sleep to counting every step you take. You can put in your chronic conditions, medications and the last time you took a sip of water so you can make sure everything is in one place. And since it’s a health app its HIPAA certified so your information is totally secure.”
This example may make some readers of the AzSHA blog chuckle, but the growing number of health apps – from wearable watches to mobile medication management tools – present an interesting challenge for consumers to determine exactly which laws apply to which apps, and, importantly, how their health information is collected, used and disclosed.
In the nearly thirty years since its promulgation, HIPAA – the Health Insurance Portability and Accountability Act – has gained significant traction as a pop-culture norm: when we hear health, we often think HIPAA, and the constraints it places on the sharing of health information.
This normalization may constitute a great achievement for public understanding around rights in “protected health information” or “PHI,” the limited type of health information actually regulated under HIPAA; however, odds are (as supported by impromptu polls of friends, family, and even developers of mobile health apps), the general perception of HIPAA applicability may be much wider than the law provides.
In other words, people hear health in a variety of contexts (whether at a hospital or in a free fitness app) and may think the processing of their health data is always subject to the robust privacy and security protections required under HIPAA.
Of course, HIPAA does not apply in many health app contexts (as described further below). And with the growing number of such products in the marketplace, now may seem like a good time to review the current legal landscape around these products and to think through how a federal data privacy framework may be needed to resolve consumer confusion by setting national standards on the use of personal information (including identifiable health information).
Before we get into proposing amendments to federal law though, let’s start with the status quo. First recall that HIPAA applies to covered entities (i.e., healthcare providers, health plans and healthcare clearinghouses) and their business associates (i.e., organizations providing services to covered entities).[2] If an entity is subject to HIPAA, federal law requires that organization to (i) implement administrative, technical and physical safeguards to prevent the unauthorized access, use or disclosure of PHI, and (ii) not disclose a patient’s PHI without the patient’s authorization, or unless an exception applies.[3]
So, if a primary care physician offers her patients access to an online portal to view their records, as a healthcare provider, that physician is likely required to comply with HIPAA, and it should generally be safe to assume those administrative, technical and physical safeguards (including use and disclosure restrictions) are in place.
Conversely though, the health app from the large software provider that enables consumers to personally track diet, nutrition, medication management and other notes about the individual’s healthcare – HIPAA? Not this time. Since in this case the app provider is not a covered entity nor business associate, the app provider is not subject to HIPAA and so individuals’ information is not guaranteed those same robust federal safeguards. And without a national consumer privacy law governing the use and disclosure of personal information generally, health information that is not PHI (i.e., regulated under HIPAA) does not receive any substantial protections under federal law.
Some states, including California, Colorado and Virginia are addressing this issue through state consumer privacy laws (e.g., the California Consumer Privacy Act or “CCPA”). Many other states are considering similar (and yet non-standard) approaches.[4]
Under the CCPA, certain entities (i.e., for-profit organizations processing data about large quantities of California residents) are required to adhere to rules around the processing of “personal information” (which does include healthinformation not covered under HIPAA).[5] CCPA requires regulated entities to notify consumers of that entity’s uses and disclosures of consumer data (see the “privacy policy” linked at the bottom of nearly every website you visit), and to adhere to consumer requests to review, amend and delete their personal information. Further, the California Privacy Rights Act creates a category of “sensitive personal information” that aims to protect sensitive categories of information (including genetic data, but not health information generally).[6]
So at least some states are thinking about how to protect some health data that may fall outside of HIPAA, but this is the AzSHA blog, so what do other state laws have to do with us? Well, to the extent an app provider processing your health data is not subject to these laws, the answer is nothing – and that’s kind of the issue.
Currently, Arizona law only requires organizations processing personal information in Arizona to provide breach notification in the event of an unauthorized disclosure of that data.[7] However, Arizona does not have a consumer privacy law like CCPA, so does not require organizations to provide Arizona residents with various rights – including to review, amend, and delete personal information processed about them – as required in states like California.
To avoid a hodge-podge of state consumer privacy laws with good intentions and poor practicality, the obvious solution seems to be a federal standard. There’s been talk about a federal law similar to the EU General Data Protection Rule[8]for years, however none have gotten across the legislative finish line. And consumer confusion seems to be a persistent consequence.
Much like HIPAA did with PHI, a comprehensive federal framework may bring standardization to the growing variety in the marketplace, and provide an opportunity to build public understanding of uniform requirements around the use of consumer personal information (including health information not covered under HIPAA).
The proposed American Data Privacy and Protection Act (“ADPPA”), which includes a category of “sensitive covered data” that captures information relating to the “healthcare condition or treatment of an individual” may be the closest shot yet to laying this federal foundation.[9] This process has been a long one, though, so we won’t hold our breath for the ADPPA to cross the president’s desk just yet.
While we await a federal sea change, maybe it’s best to end with what initiated this blog in the first place: a general perception that consumers are not aware of the laws applicable to the processing of their personal information, including, and maybe especially, their health information. In my practice, I find many consumers (and frankly business teams developing health apps), are confused about when HIPAA applies and which laws protect the processing of what health information.
So be aware of the confusion and maybe conduct an informal poll or two yourself. And the next time your friend asks, “have you tried that new health app” take a deep breath and just think about how much easier this may be with a federal standard.
[1] This blog represents current, general opinions of the author, and not those of his law firm or colleagues. The content should not be considered legal advice or opinion.
[2] See 45 C.F.R. § 160.103.
[3] See 45 C.F.R. § 164.304.
[4] National Conference of State Legislatures, 2022 Consumer Privacy Legislation, available at https://www.ncsl.org/research/telecommunications-and-information-technology/2022-consumer-privacy-legislation.aspx#:~:text=Creates%20the%20Consumer%20Privacy%20Act,or%20before%20the%20point%20of
[5] California Consumer Privacy Act, Cal. Civ. Code § 1798.140.
[6] Id.
[7] ARS § 18-552.
[8] Regulation (EU) 2016/679 (General Data Protection Regulation).
[9] American Data Privacy and Protection Act, HR 8152, 117th Congress (2022), available at https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-P000034-Amdt-1.pdf
Email: azhealthcareattorneys@gmail.com
©2025 Arizona Society of Healthcare Attorneys. All Rights Reserved
