After Mulready: States May Need to Pass the Baton on Pharmacy Benefit Manager Reform

Loretta Amankwah Kyei, J.D. Candidate – ASU Sandra Day O’Connor College of Law

In 2020, the U.S Supreme Court’s decision in Rutledge v. Pharmaceutical Care Management Association (PCMA) narrowed the scope of preemption under the Employee Retirement Income Security Act of 1974 (ERISA), opening the  door for states to regulate pharmacy benefit managers (PBMs) contracting with employer health plans.[[1]]

In Rutledge, Arkansas’ Act 900 required PBMs to cover pharmacies’ actual costs for prescription drugs.[[2]] The Court ruled that state regulations affecting only the cost of benefits do not improperly interfere with ERISA plans, and are thus not preempted.[[3]] However, it cautioned that state laws dictating how benefit plans must be structured or managed—such as setting required benefits or coverage rules—are preempted by ERISA.[[4]]

Many saw Rutledge as a sign that states could take stronger action on PBMs.[[5]] When U.S. insurers began integrating prescription drug coverage into their plans in the 1960s, PBMs emerged to help set reimbursement rates, process claims, and pay pharmacies.[[6]] Initially created to lower costs, PBMs have since become dominant market players whose pricing and rebate practices often drive up drug costs and limit patient access to affordable medications.[[7]] These dynamics fuel state efforts to increase oversight of PBM operations and protect consumers.[[8]]

However, the Tenth Circuit’s Pharmaceutical Care Management Association v. Mulready decision on August 15, 2023, which struck down several provisions of Oklahoma’s PBM reform law as preempted by ERISA, reaffirmed that ERISA continues to limit how far states can go in regulating PBMs tied to employer-sponsored health plans.[[9]]

This setback comes at a time when PBM practices are facing increased scrutiny. In January 2025, the Federal Trade Commission (FTC) released its second interim staff report, Specialty Generic Drugs: A Growing Profit Center for Vertically Integrated PBMs, exposing the extent of PBM-driven market manipulation.[[10]] FTC’s report documented long-standing practices affecting millions of Americans, revealing that the three largest PBMs imposed markups of more than 100% on specialty generic drugs, including treatment for cancer, heart disease, and HIV.[[11]]

The Mulready Decision and its Consequences

While Rutledge appeared to allow broader state oversight of PBMs, the Tenth Circuit Court of Appeal’s decision in Mulready effectively closed the door.  Oklahoma’s 2019 Patient’s Right to Pharmacy Choice Act aimed to monitor how PBMs contract with pharmacies and ensure patients could access their pharmacies of choice.[[12]] The Tenth Circuit obliterated several key provisions of Oklahoma’s Act under ERISA preemption. These included provisions:

  1. prohibiting PBMs from denying, limiting, or terminating a pharmacy’s contract based on the probation status of a licensed pharmacist employed by that provider;
  2. banning restrictions on person’s choice of in-network providers and use of financial incentives to encourage beneficiaries to use preferred pharmacies;
  3. requiring PBMs to maintain preferred pharmacies within a specified distance of a percentage of beneficiaries; and
  4. requiring PBMs to allow any qualified pharmacy to participate in a preferred network.

The court found that the provisions improperly affected how ERISA plans are managed by controlling the structure of their pharmacy networks.[[13]]

By contrast, the U.S. Court of Appeals for the Eighth Circuit reached an opposite conclusion in Pharmaceutical Care Management Association v. Wehbi.[[14]] Decided on November 17, 2021, the court held that North Dakota’s PBM regulations were not preempted by ERISA (while also finding that multiple provisions were preempted by federal Medicare laws).[[15]] North Dakota’s law sought to protect independent pharmacies from restrictive PBM practices by prohibiting fees on claims processing, allowing pharmacies to mail prescriptions to patients, and preventing PBMs from imposing accreditation standards that exceed state licensing requirements.[[16]]

Applying the Rutledge standard, the Eighth Circuit held that none of the challenged provisions had an impermissible “connection with” or “reference to” ERISA plans.[[17]] The court emphasized that the North Dakota laws regulated PBMs, third-party administrators, rather than ERISA plans directly, thus avoiding interference with plan administration or structure.[[18]] This interpretation, in line with Rutledge’s reasoning, clarifies that state PBM regulations addressing pricing and contracting practices generally fall outside ERISA’s preemptive scope.

Despite the Eighth Circuit’s divergent view in Wehbi, the Tenth Circuit’s Mulready decision had far-reaching effects. More than 30 states already enacted PBM reform statutes with provisions similar to those invalidated in Mulready.[[19]]

In June 2025, Iowa passed Senate File 383, a move likely shaped by Wehbi. Iowa’s law required that PBMs let patients choose any in-network pharmacies they prefer.[[20]] It also prohibited PBMs from paying independent pharmacies less than their own affiliated pharmacies for the same drug and required payments to match national averages.[[21]] PBMs must pay pharmacists a set fee for dispensing prescriptions, allow all pharmacies in a region to join their networks, and pass along all manufacturer rebates to health plan clients.[[22]]

Shortly after passage, the Iowa Association of Business and Industry sued to block its enforcement, arguing that several provisions were preempted by ERISA.[[23]] On July 21, 2025—one day before the law was set to take effect—a federal judge agreed, holding that the provisions banning payment discrimination and requiring fixed dispensing fees were preempted.[[24]] The United States District Court for the Southern District of Iowa Central Division issued an injunction, which has been appealed to the Eighth Circuit.[[25]]

The scope of the Iowa court’s ruling, however, was limited. The injunction applies only to the plaintiffs in the case and their members or contractors, leaving open the question of broader applicability. In October 2025, Wellmark Blue Cross Blue Shield, Iowa’s largest health insurer, filed a separate lawsuit against the Iowa Insurance Commissioner, arguing that the injunction should be extended to parties not involved in the original action.[[26]]

PBM Reform Efforts Beyond ERISA Plans

In 2025, states are advancing four major PBM reform strategies designed to sidestep ERISA challenges by: (1) delinking PBM compensation from drug prices, (2) requiring PBMs to pass drug rebates on to consumers, (3) imposing fiduciary duties to health carriers, and (4) prohibiting PBM ownership of pharmacies.

Delinking is the most comprehensive of these reforms. It mandates flat-fee compensation models rather than rebate-based payments. Colorado’s HB-1094, the first law of its kind, implements delinking measures and is set to take effect in 2027.[[27]]

Rebate pass-through laws, like Utah’s H.B. 257, require health insurers to ensure that PBMs either pass manufacturer rebates directly to consumers at the point of sale or use them to reduce premiums.[[28]] Utah H.B. 257 applied only to insured plans contracting with a PBM, not to self-insured plans, which would entail complexities.

Fiduciary duty provisions are also emerging as a new regulatory tool. These laws ensure PBMs act as fiduciaries to the health carriers they serve, aligning their financial interests with plan sponsors and patients. In 2024, Maine and Vermont enacted fiduciary duty requirements,[[29]–[30]] followed by North Carolina in 2025.[[31]]

Lastly, states are focusing on ownership restrictions to address PBM consolidation. Arkansas is the first state to prohibit PBMs from owning pharmacies, a provision removed from similar bills in Indiana and Louisiana.[[32]] However, Arkansas’s Act 624 faces challenges from four PBMs and PCMA, which alleged it violated the federal dormant Commerce Clause because it appears to overtly discriminate against the plaintiffs as out-of-state companies.[[33]]

Federal PBM Reform

On July 10, 2025, Representative Earl. L . “Buddy” Carter (R-GA) and 11 bipartisan cosponsors introduced the PBM Reform Act in Congress, a comprehensive legislative proposal aimed at curbing PBM practices that inflate drug prices and limit transparency to consumers.[[34]] Key provisions of the PBM Reform Act include:

  • Ban on Spread Pricing in Medicaid: Prohibits PBMs from retaining the difference between what they charge Medicaid health plans and reimburse pharmacies.
  • Medicare Part D Reforms: Delinks PBM compensation from drug costs and imposes new transparency requirements for PBM operations within Medicare Part D.
  • Disclosure and Reporting: Requires PBMs to provide semi-annual reports to employers and patients detailing drug spending, rebates, and formulary decisions, in support of more informed decision-making.
  • Enhanced Federal Oversight: Directs the Centers for Medicare and Medicaid Services (CMS) to define and enforce “reasonable and relevant” contract terms in Medicare Part D pharmacy contracts and strengthen enforcement against violations.[[35]]

If enacted, the PBM Reform Act would significantly shift regulatory authority from states to the federal government. While states have made significant strides in PBM reform, Congress seems poised to impose new PBM accountability requirements within ERISA’s framework (instead of around it).

PBM Reforms in 2025  

Although Congress has failed to advance bipartisan PBM reform legislation to date, momentum has not stalled.[[36]] The PBM Reform Act reflects sustained bipartisan interest in increasing transparency and accountability. In light of continued ERISA preemption of state reform efforts, federal action may be the only path forward towards meaningful, uniform oversight of PBMs.

Given the opportunity the Supreme Court may be compelled to address the circuit split and resolve uncertainty it created in denying certiorari in Mulready in June 2025.[[37]] A definitive ruling could clarify the scope of state authority under ERISA in furtherance of state led PBM reforms. For now, judicial and federal developments must be closely monitored. Despite ongoing ambiguities, PBMs have begun to self-regulate in response to mounting scrutiny. On October 27, 2025, Cigna Group announced it will eliminate prescription drug rebates in its commercial health plans beginning in 2027, replacing them with upfront discounts at the pharmacy counter.[[38]] With bipartisan agreement on the need for greater scrutiny, PBM reforms appear poised to enter a new era of accountability. 

Acknowledgement: Reviewed and edited in part by Joel L. Michaels, Adjunct Professor of Law, ASU Sandra Day O’Connor College of Law.

[1] Rutledge v. Pharm. Care Mgmt. Ass’n, 592 U.S. 80 (2020)

[2] 2015 Ark. Acts 900

[3] Rutledge v. Pharm. Care Mgmt. Ass’n, 592 U.S. 80 (2020)

[4] Id.

[5] In Major Victory for States, Supreme Court Clears the Way for State Health Reform, National Academy For State Health Policy (Dec. 15, 2020), https://nashp.org/ [https://perma.cc/7U23-QZN6].

[6] What are PBMs and what do they do?, American Medical Association (Aug. 7, 2025), https://www.ama-assn.org/ [https://perma.cc/H38T-JS77].

[7] Id.

[8] Id.

[9] Pharm. Care Mgmt. Ass’n v. Mulready, 78 F.4th 1183 (10th Cir. 2023)

[10] Fed. Trade Comm’n, Specialty Generic Drugs: A Growing Profit Center for Vertically Integrated Pharmacy Benefit Managers (2025), https://www.ftc.gov/system/files/ftc_gov/pdf/PBM-6b-Second-Interim-Staff-Report.pdf

[11] Id.

[12] Okla. Stat. tit. 36, § 6958

[13] Pharm. Care Mgmt. Ass’n v. Mulready, 78 F.4th 1183 (10th Cir. 2023)

[14] Pharm. Care Mgmt. Ass’n v. Wehbi, 18 F.4th 956 (8th Cir. 2021)

[15] Id.

[16] N.D. Cent. Code § 19-02.1-16.2

[17] Pharm. Care Mgmt. Ass’n v. Wehbi, 18 F.4th 956 (8th Cir. 2021)

[18] Id.

[19] 2025 State Legislation to Lower Prescription Drug Costs, National Academy For State Health Policy (Aug. 8, 2025), https://nashp.org/ [https://perma.cc/LN8Q-CFP9].

[20] 2025 Ia. SF 647

[21] Id.

[22] Id.

[23] Iowa Ass’n of Bus. & Indus. v. Ommen, No. 4:25cv211-SMR-WPK, 2025 LX 484328 (S.D. Iowa July 21, 2025)

[24] Id.

[25] Clark Kauffman, Wellmark sues to block enforcement of new law on pharmacy benefit managers, Iowa Capital Dispatch (Oct. 16, 2025), https://iowacapitaldispatch.com/2025/10/16/wellmark-sues-to-block-enforcement-of-new-law-on-pharmacy-benefit-managers/

[26] Id.

[27] 2025 Bill Text CO H.B. 1094

[28] 2025 Bill Text UT H.B. 257

[29] Me. Rev. Stat. tit. 24-A, § 4350

[30] Vt. Stat. Ann. tit. 18, § 9472

[31] 2025 Bill Text NC S.B. 479

[32] 2025 Bill Text AR H.B. 1150

[33] Express Scripts, Inc. v. Richmond, No. 4:25-CV-00520-BSM, 2025 LX 229886 (E.D. Ark. July 28, 2025)

[34]  2025 H.R. 4317; 119 H.R. 4317

[35] Id.

[36] Sophie Gardner & Kelly Hooper, Can Congress revive PBM reform?, Politico (Sep. 8, 2025) https://www.politico.com/newsletters/politico-pulse/2025/09/08/can-congress-revive-pbm-reform-00549936

[37] Lauren Clason, PBM State Fights Will Live On After High Court’s Petition Denial, Bloomberg Law (July 17, 2025) https://news.bloomberglaw.com/daily-labor-report/pbm-state-fights-will-live-on-after-high-courts-petition-denial

[38] Noah Tong, What Express Scripts’ drug rebate phase-out means for PBMs, Modern Healthcare (Oct. 29, 2025) https://www.modernhealthcare.com/insurance/mh-express-scripts-commercial-rebate-phase-out-pbms/?utm_id=gfta-ur-251029&share-code=EWRTS6MKTBCH7PTTQHTJFEPUIE&user_id=5641123&customer_secondary_source=aac_articleGifting

Employing Arbitration in the Healthcare Space

By: Patrick Welsh, HonorHealth

Binding arbitration is a valuable tool for health law attorneys. In the world of complicated and expensive healthcare disputes, arbitration is a faster, cheaper alternative. That’s hardly news. Every lawyer knows the benefits of arbitration. The proceedings are confidential; the turnaround time on decisions is faster; the discovery is truncated; and the arbitrator, if the parties so wish, has significant experience in health law. Yet, I’m often struck by how reluctant my fellow attorneys are to introduce arbitration agreements to their transactional work.

“I’ve done a few arbitrations,” a friend told me last month. “It’s one thing to argue the arbitration agreement, and another to write it. I’ve seen good-looking agreements fall apart. It covered contracts, not torts. The arbitrator didn’t have the right to decide her own jurisdiction. It violated public policy.” Then he added, “I don’t want to be the lawyer who wrote a bad agreement.” Unfortunately, his hesitancy is shared by many. There are a lot of benefits to arbitrating a healthcare dispute,[1] especially the difficult and sensitive ones, but this post is not about that. Articles on that topic could fill a small library, and I have no desire to add to the pile. The purpose of this post is simple: a brief, high-impact primer about employing arbitration agreements in healthcare transactions in Arizona. Let’s dive in.

There are many arbitration venues out there, but in the healthcare space, I find the most commonly relied-upon are the American Health Law Association (“AHLA”), the American Arbitration Association (the “AAA”), and the Judicial Arbitration Association and Mediation Services (“JAMS”). Some benefits of using AHLA are its focus on healthcare disputes and its roster of arbitrators and mediators have resumes which reflect significant industry experience. Each arbitration body has its own set of rules, and as you’ll see further down in this post, those rules matter. A lot.[2] Familiarize yourself with the rules to best select the tribunal.

Arizona has three arbitration laws that may apply to a dispute: the Federal Arbitration Act (the “FAA”);[3] the Arizona Uniform Arbitration Act (the “UAA”);[4] which applies only to a limited subset of disputes;[5] and the Arizona Revised Uniform Arbitration Act (the “RUAA”).[6] In the absence of a choice of law provision in the arbitration agreement, the FAA is likely to preempt the RUAA and apply to the dispute.[7] Review the sources of law, both the statutes and their case law, to decide whether the FAA, the UAA, or the RUAA is best.

You may want to include a statement of purpose and a declaration of the intentions of the parties at the start of your arbitration agreement, informing the reader why the parties agreed to arbitrate a future dispute. The statement of purpose helps guide arbitrators in their decision-making, helping them to render an award that best reflects the reason the parties entered into the contract.[8]

Many arbitration bodies have contract clause generators on their website, but be aware that a boilerplate definition of “dispute” may not be personalized to your client’s needs. A bad definition or infelicitous wording can create questions about whether a controversy is arbitrable or not. Determining whether to include claims arising from statute, tort, contract, or other sources is essential to drafting a clear and effective definition of a “dispute.”[9] Specificity in the definition of “dispute” will help avoid unnecessary legal battles down the road.

I want to take a moment to discuss appraisals, a great way to quickly and fairly decide fair market value in negotiations. For example, when an old medical campus lease is expiring and the tenant and landlord want to enter into a new lease, the parties may have their own opinion about what dollar amount per square foot constitutes fair market value. The parties are amicable (they want the deal to move forward, after all), but they just can’t see eye-to-eye. A friendly agreement to arbitrate through appraisal (such as each party hiring an appraiser, each of whom then selects a third appraiser to act as arbitrator) can bring the deal over the finish line while complying with the requirements of 42 U.S.C. § 1395nn (the “Stark Law”) and 42 U.S.C. § 1320a-7b (the “Anti-Kickback Statute”). Even better, in situations where you are dealing with a party who is unfamiliar with the relevant healthcare exceptions and safe harbors, the appraisal mechanism can be crafted to explicitly state what factors the appraiser may or may not consider in his or her determination, eliminating the risk of the appraiser inappropriately considering the value or volume of referrals or other business generated.

You may select the number of arbitrators who will serve. Broadly speaking, many arbitration groups utilize three arbitrators to decide a dispute.[10] How many arbitrators you want is up to you, but being silent on the issue could be a costly mistake. As a 2012 study of large complex cases by the AAA found, “when a panel of three arbitrators was used, the cost of the case was five times as high as the cost where a sole arbitrator decided the matter.”[11] More arbitrators mean more money spent by your client, resulting in overkill for simple cases.

A court, not an arbitrator, will generally decide whether an issue is arbitrable and whether the arbitrator has jurisdiction unless the parties have agreed otherwise.[12] Additionally, whether the arbitrator is permitted to decide questions of arbitrability or jurisdiction hinges on the arbitration law chosen for the agreement.[13] If the arbitration agreement adopts the FAA, the UAA, or the RUAA, the parties must consult the applicable law to determine whether they may delegate the authority to the arbitrator and, if so, how to do so clearly and unmistakably.

Arbitration typically has limited discovery and an abbreviated timeline. The scope and schedule of discovery, as well as the arbitrator’s enforcement powers, come down to the applicable arbitration law and procedural rules. The RUAA is attractive for complex transactions between two or more large healthcare companies because it allows the parties to conduct discovery “as the arbitrator decides is appropriate in the circumstances”[14] and authorizes the arbitrator to issue subpoenas and protective orders.[15] Similarly, the AAA’s Commercial Rules are attractive where the drafter anticipates large and complex claims[16] as the procedural rules allow for expanded discovery.[17]

Where a contract contains an agreement to arbitrate, the agreement will probably loop in that contract’s attachments (exhibits, schedules, riders, etc.) unless a provision limits the agreement’s breadth to exclude those documents. Avoid surprises down the line. For example, a contract which incorporates a work agreement for improvements to a building might force the parties to arbitrate, and not litigate, a construction dispute. Did your client intend to arbitrate construction matters when they signed?

As we near the end of this post, I want to discuss the role of mediation. I frequently encounter contracts which require the parties to attempt to mediate their dispute, or to otherwise engage in good-faith discussions, prior to arbitration or litigation. Consider carefully whether mandatory mediation is truly in your client’s best interest. It’s nice to think that everyone is a benevolent actor, unlikely to operate in bad faith, but experience teaches us otherwise. Defendants can abuse mediation to draw out costs and buy time. There are many ways to mollify the harshness of abusive stall tactics. For example, you can limit mediation to a certain number of days or give the parties recourse if an opponent fails to respond within an amount of time (such as a right to skip to arbitration). Think carefully about whether to agree to mandatory mediation and consider adding a safety net in case the opposing party later attempts to abuse mediation.

Fans of arbitration often tout that groups like the AAA and AHLA have mechanisms to install provisional remedies to preserve the status quo during a proceeding.[18] That may be true, but the downside is the difficulty of making that remedy meaningful during an emergency. To illustrate, imagine a party files with the AAA an application for an interim remedy on an emergency basis. Even if he or she successfully obtains an emergency award from the emergency arbitrator, the party must file an application with the superior court to confirm the award and reduce it to a judgment. In the meantime, the adversary will oppose the application, will move to vacate the award, and will request oral argument. Perhaps the process is cheaper than an application for a temporary restraining order, but is it faster? Is it better? All questions for you to answer when you decide how your arbitration agreement handles emergencies.

One of the most interesting facets of arbitration is the freedom to construct alternative arbitration arrangements to suit a client’s needs. The most popular alternative is probably “baseball” arbitration, more formally known as final-offer arbitration, a process where each party proposes a monetary award to the arbitrator and the arbitrator selects one award at the end of the hearing. Importantly, the arbitrator is not permitted to alter the award. Baseball arbitration is a great way to reach a client’s desired outcome while keeping expectations reasonable but, realistically speaking, is suitable only where the dispute concerns monetary damages. Other common arbitration alternatives include last-offer arbitration, “night baseball,” high-low arbitration, and incentive arbitration, any of which might maximize value for your healthcare client given the circumstances.

Healthcare disputes tend to be large and complicated, and where you anticipate a high-complexity dispute, there exist a few final techniques to consider. A mandatory early neutral case conference, where the parties present their case for a non-binding assessment by a subject-matter expert, can help friendly opponents evaluate their position. A mini-trial is a non-binding hearing where both sides present a truncated version of their case; the mini-trial is useful in disputes likely to get bogged down in complex factual patterns, such as reimbursement and underpayment disputes, because the parties get a sneak peek at the likelihood of success without paying for a full-blown hearing.

A lot of ink has been spilled over the years on arbitrations in the healthcare space. Hopefully this post gives you some food for thought and encourages a few of you to introduce arbitration to your contracts.

[1] See, e.g., Katherine Benesch, Why ADR and Not Litigation for Healthcare Disputes?, 66 (3) Disp. Resol. J. 1 (Aug.-Oct. 2011); Diana Kruze and Christopher C. Sabis, “Effectively Deploying Alternative Dispute Resolution Processes in Health Care”, lecture at the Am. Health L. Ass’n Annual Meeting (June 28, 2025); Elizabeth Rolph, et al., Arbitration Agreements in Health Care: Myths and Reality, 60 L. & Contemp. Probs. 153, 155–56 (1997).

[2] For example, the Arizona Supreme Court held in Bolo Corp. v. Homes & Son Const. Co., that where a plaintiff elects to litigate a dispute “in lieu of the arbitration tribunal, and ask[s] the court for exactly the same type of relief (i.e. damages), which an arbitrator is empowered to grant,” the plaintiff has waived the right to arbitration. 105 Ariz. 343, 347 (1970). The rules of the AAA conflict: “No judicial proceeding by a party relating to the subject matter of the arbitration shall be deemed a waiver of the party’s right to arbitrate.” AAA, Commercial Arbitration Rules and Mediation Procedures, R-54(a) (Sept. 1, 2022),  https://www.adr.org/media/lwanubnp/2025_commercialrules_web.pdf. While subsequent case law has distinguished the role Bolo Corp. plays, this underscores the importance of reviewing both laws and rules prior to execution of the arbitration agreement.

[3] 9 U.S.C. § 1, et seq.

[4] A.R.S. § 12-1501, et seq.

[5] See id. § 12-3003(B)–(C).

[6] Id. § 12-3001, et seq.

[7] See Brennan v. Opus Bank, 796 F.3d 1125, 1129 (9th Cir. 2015); Doctor’s Assoc., Inc. v. Casarotto, 517 U.S. 681, 687 (1996); see also 4 Am. Jur. 2d Alternative Dispute Resolution § 27 (1995).

[8] For example, where a statement of purpose says that a dispute may reveal sensitive or embarrassing information and that the parties intend that arbitration be confidential, an arbitrator’s award may be rendered in such a way as to better protect the privacy of the parties. See Kruze and Sabis, “Effectively Deploying Alternative Dispute Resolution Processes in Health Care”, supra, at n. 1.

[9] For further discussion on how the definition of “dispute” is essential to any arbitration clause, see Mark E. Lassiter, What Every Business Transaction Lawyer Should Know About Drafting Arbitration Clauses in Contracts, Ariz. State Bar (March 25, 2025).

[10] Not always the case. For instance, in the AAA’s rules for domestic commercial disputes, if the parties fail to agree upon the number of arbitrators, the dispute “shall be heard and determined by one arbitrator, unless the AAA, in its discretion, directs that three arbitrators be appointed.” AAA, Commercial Arbitration Rules, R-17, supra, at n. 2.

[11] Katherine Benesche, How to Save Time and Cost in Health Care Arbitration: Can it Really be Less Expensive Than Litigation?, 69 (3) Disp. Resol. J. 1, 2 (2014).

[12] See, e.g., A.R.S. § 12-3006(B) (“The court shall decide whether . . . a controversy is subject to an agreement to arbitrate.”); First Options of Chicago, Inc. v. Kaplan, 514 U.S. 938 (1995) (applying the FAA) (holding a court holds “the primary power” to decide arbitrability of the arbitrator, and petitioner failed to show the parties clearly agreed otherwise); AAA, Commercial Arbitration Rules, R-7(a), supra, at n. 2 (“The arbitrator shall have the power to rule on his or her own jurisdiction . . . .”); AHLA, Rules of Procedure for Commercial Arbitration, 3.1 (Feb. 6, 2025) (“[T]he arbitrator, once appointed, shall have the power to determine his or her jurisdiction and any issues of arbitrability.”).

[13] For example, the UAA provides that where an opposing party denies the existence of an arbitration agreement, “the court shall proceed summarily to the determination of the issue so raised.” A.R.S. § 12-1502(A).

[14] Id. § 12-3017(C).

[15] Id. § 12-3017(D)-(E).

[16] A claim of $1,000,000 or more. AAA, Commercial Arbitration Rules, R-1(c), supra, at n. 2.

[17] See id. at p. 9 (summarizing).

[18] See id. at R-38–39; AHLA, Rules of Procedure, 5.2(b), supra, at n. 11.The RUAA provides that an arbitrator may issue orders for interim remedies to preserve the “effectiveness” of the proceeding. A.R.S. § 12-3008(B)(1).

Federal Judge Vacates HIPAA Reproductive Health Privacy Rule: What Regulated Entities Should Know

Amita Sanghvi, Coppersmith Brockelman, PLC

On June 18, 2025, a federal judge in Texas vacated the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy,” (the 2024 Rule)[1] leaving in place only the provisions updating Notices of Privacy Practices (NPPs) for 42 USC 290dd-2 and 42 CFR Part 2 (collectively, “Part 2”) substance use disorder (SUD) treatment records. This decision in Purl v. HHS,[2] applies nationwide, and lifts the additional compliance requirements for handling reproductive health-related protected health information (PHI) under the 2024 Rule.

Background and Ruling

The 2024 Rule established new categorical prohibitions on the use or disclosure of PHI related to reproductive health care. These prohibitions specifically prevented regulated entities from disclosing PHI to impose criminal, civil, or administrative liability on individuals for seeking, obtaining, providing, or facilitating lawful reproductive health care. .  The court found that:

  • The rule unlawfully preempted state public health laws;
  • HHS exceeded its statutory authority by redefining “person” and “public health;” and
  • It was adopted without authority expressly delegated by Congress to issues such a significant privacy expansion.

The court vacated the rule, with nationwide effect, under the Administrative Procedure Act (APA).  HHS did not appeal the decision, but a group of proposed intervenors, appealing the court’s denial of their motion to intervene, has filed a protective notice of appeal.  HHS faces similar lawsuits challenging the 2024 Rule, including a lawsuit from the state of Texas, which is also filed in the Northern District of Texas, one from the state of Missouri and a suit by 14 states, led by the state of Tennessee. In the Missouri case, the parties have requested a stay until the appellate proceedings in Purl are resolved.  This stay has been granted in the Texas case.   While HHS has not formally withdrawn the rule, since it did not appeal it is bound by the national vacatur decision and as a result the 2024 changes are unenforceable.

Status of National Vacatur

In a separate, and unrelated case, on June 27, 2025, the Supreme Court of the United States (SCOTUS) limited the ability of federal judges to issue nationwide injunctions in Trump v. CASA.[3]  The 6-3 majority held that federal courts lack statutory authority under the Judiciary Act of 1789 to issue injunctions against executive branch policies that apply to individuals who are not parties to the case.[4] However, SCOTUS clarified that they did not resolve “the distinct question [as to] whether the APA authorizes federal courts to vacate agency action.”[5] Because the holding in Purl was based on this APA authority with respect to agency action, the CASA limitation on nationwide injunctions does not apply to this case. Nevertheless, SCOTUS has cast doubt on a court’s reliance on the APA to vacate a rule nationwide. Thus, while the question remains open, it is an issue that likely will be litigated.[6]

What this Means for Regulated Entities

In the wake of the decision, regulated entities are relieved of significant compliance burdens and should proceed with the following compliance processes:

  • Review Internal Procedures:Entities that updated their HIPAA policies to ensure compliance with the 2024 Rule’s restrictions on disclosure of PHI related to lawful reproductive health care can revert to their pre-2024 policies now.  While these new prohibitions are vacated, regulated entities must continue to comply with the requirements that existed for disclosures of PHI under the pre-2024 Rule.  Similarly, the definition of “person” should revert to the pre-2024 definition, and there is no longer a HIPAA regulatory definition for “public health” as used in the terms “public health surveillance,” “public health investigation,” and “public health intervention.”  
  • No more HIPAA attestations: Regulated entities are no longer required to receive an attestation from requestors for PHI potentially related to reproductive health care.
  • Staff Training: Offer targeted training to staff, explaining the updated processes.
  • Update HIPAA NPPs: Only implement the Part 2 SUD updates for NPPs by Feb. 16, 2026.
  • Monitor Developments: Continue monitoring litigation and a possible appeal by the federal government.

While the compliance burdens have lifted, entities may still be concerned about the privacy of sensitive information. HIPAA’s baseline privacy protections still apply, but navigating patient privacy and responding to law enforcement requests will now require careful review of both federal and state laws. Importantly, the HIPAA Privacy Rule never required disclosure of PHI to law enforcement; rather, the law allowed for the disclosure under specific conditions.  If these conditions are not met, regulated entities would not be permitted under HIPAA to disclose PHI. Refusing to disclose PHI also does not violate the federal Information Blocking Rule (42 USC 300jj-52 and 45 CFR Part 172) when exceptions apply, such as the recently finalized Protecting Care Access exception for reproductive health care.[7]

Even where federal law may not require a disclosure, regulated entities will also need to account for state law requirements.  For instance,  Arizona requires health care providers to disclose medical records without the patient’s written authorization as otherwise required by law or when ordered by a court or tribunal of competent jurisdiction.[8]  While state law may require certain disclosures, HIPAA preemption provisions and regulatory frameworks ensure that such disclosures comply with federal privacy standards. Thus, disclosures mandated by ARS 12-2294(A) fit within HIPAA’s scope insofar as they are legally required and compatible with HIPAA Privacy Rule’s requirements and safeguards.  At the same time, Arizona has a shield law that prohibits state agencies from assisting in out-of-state investigations relating to reproductive health care and gender-affirming health care that would not be punishable under Arizona law.[9] Without the 2024 Rule, decisions about reproductive health related PHI disclosures will require case-by-case review, considering HIPAA, state law, and information blocking rules.  Covered entities should evaluate any requests for PHI related to reproductive health care carefully, balancing patient privacy interests with legal obligations and potential risks in this evolving regulatory landscape.

[1] 89 Fed. Reg. 32976-01 (Apr. 26, 2024).

[2] N.D. Tex., 2:24-CV-228-Z, Jun. 18, 2025 (the “Decision”).

[3] 606 U.S. ___ (2025).

[4] Id.

[5] Id., note 10.

[6] In United States v. Texas, Justice Neil Gorsuch (joined by Justices Clarence Thomas and Barrett) suggested that universal vacatur under the APA may be incompatible with traditional equitable principles and Article III. See United States v. Texas, 599 U.S. 670 (Gorsuch, N.  concurrence).

[7] 45 CFR § 171.206.

[8] ARS § 12-2294(A).

[9] Ariz. Exec. Order 2023-11, Protecting Reproductive Freedom and Healthcare in Arizona (June 22, 2023), available at: https:// azgovernor.gov/sites/default/files/executive_order_2023_11.pdf; Ariz. Exec. Order 2023-12, Ensuring Access to Medically Necessary Gender-Affirming Healthcare (June 27, 2023), available at https://azgovernor.gov/sites/default/files/executive_order_2023-12.pdf.

HHS’s Proposed Revisions to Strengthen the HIPAA Security Rule

Ian M. Stanford, Esq. and Miranda A. Preston, Esq.

Milligan Lawless, P.C.

            For the first time in over a decade, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has proposed an update to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule (the “Security Rule”).  OCR stated that its goal of the proposed rule[1] (the “Proposed Rule”) is to strengthen cybersecurity protections for electronic protected health information (ePHI) considering changes in the healthcare environment, a significant increase in breaches and cyberattacks, common deficiencies observed by OCR, and cybersecurity best practices.[2] OCR is concerned about the “rampant escalation” in the number of cyber security breaches that continues to climb each year.[3]  For example, in 2024, a ransomware attack against Change Healthcare is estimated to have affected approximately 190 million people.  If the Proposed Rule becomes effective, OCR estimates it will cost regulated entities $9 billion in the first year to implement, and $6 billion per year for years two through five for ongoing compliance activities.  The public comment period closed on March 7, 2025, and OCR received around 4,745 comments.

Brief Background on the Security Rule

HIPAA is a federal statute enacted in 1996, amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009.  To implement HIPAA and HITECH, HHS issued a set of federal regulations comprised of three separate rules: the Privacy Rule, the Security Rule, and the Breach Notification Rule.  This article focuses on the Security Rule. The Security Rule was first published in 2003 and revised in 2013.  It establishes a national set of security standards to protect ePHI and is meant to serve as a floor to the security measures that regulated entities (i.e., “covered entities” and “business associates”) must implement.  The Security Rule does so by specifying administrative, physical, and technical security requirements. Administrative safeguards are the policies and procedures that regulated entities must implement to prevent, detect, contain, and correct security violations.  Technical safeguards relate to access controls, audit controls, software and other technology measures to protect ePHI. Physical safeguards relate to the physical measures, policies, and procedures to protect the physical premises where ePHI is stored.

Broad Changes in the Proposed Rule

            The Proposed Rule maintains the previous framework of administrative, physical, and technical safeguards.  However, it makes sweeping changes to the requirements imposed upon regulated entities. HHS published a fact sheet[4] that breaks down some of the sizeable changes proposed in the update to the Security Rule. Below are a few of the key changes in the Proposed Rule:

  1. Remove the distinction between “required” and “addressable” implementation specifications and all implementation specifications would be required, with limited exceptions.
  • Require the development of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis. The inventory and map must be reviewed and updated at least annually and in response to a change in the regulated entity’s environment or operations that affects ePHI.
  1. Require greater specificity for conducting a risk analysis. New express requirements would include a written assessment that contains, among other things:
  1. A review of the technology asset inventory and network map (See Section 1);
  2. Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI;
  3. Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant IT systems;
  4. An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified threats or vulnerabilities; and
  5. An assessment of the risks to ePHI posed by current and prospective business associate relationships.
  • Require regulated entities to establish and implement written policies and procedures for patch management[5] and updating the configuration of policies and procedures of relevant information systems.  These processes would require regulated entities to patch critical risks within 15 calendar days, patch high risks within 30 calendar days, and review such policies and procedures at least once every 12 months.
  • Require regulated entities to establish and implement written policies and procedures ensuring that: (1) workforce members’ access to ePHI is terminated as soon as possible, but no later than one hour after the workforce member’s employment or other arrangement ends; and (2) other covered entities or business associates are notified after a change in or termination of a workforce member’s access to ePHI.  This notice would be required to be provided as soon as possible, but no later than 24 hours after the workforce member’s authorization to access ePHI or relevant electronic information systems is changed or terminated.
  • Regarding business associates: (1) require business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plan without unreasonable delay but no later than 24 hours after its activation; and (2) require covered entities to obtain from business associates (and business associates from their subcontractors) an annual written analysis and certification of compliance with the Security Rule’s technical safeguards.  To the extent this requirement is finalized, all business associate agreements would need to be updated.
  • Require regulated entities to conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements.
  • Expand the Security Rule’s technical safeguards, including requiring regulated entities to : (1) encrypt ePHI at rest and in transit, with limited exceptions; (2) use multi-factor authentication for all technology assets, with limited exceptions; (3) create and maintain backups of relevant IT systems and review and test the effectiveness of such controls once every six months; and (4) conduct vulnerability scanning at least every six months and penetration testing at least once every 12 months.

Looking Forward

            The future of the Proposed Rule is unclear, and the Trump administration will likely decide whether the Proposed Rule moves forward. The Trump administration has already begun to act on its initiative to reduce federal regulations[6], which may mean the Proposed Rule will not be enacted into law.  In the meantime, regulated entities should make themselves aware of the key components of the Proposed Rule and monitor any developments concerning the Proposed Rule.  

[1] 90 Fed. Reg. 898 (Jan. 6, 2025).

[2] Id.

[3] Id. at 900.

[4] Health and Human Services, Office for Civil Rights, “HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information,” (2024) available at https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html.

[5] Patch management involves identifying, testing, applying, and verifying patches (or software updates) to improve security and performance.

[6] See Presidential Memorandum, Regulatory Freeze Pending Review¸ 90 Fed. Reg 8249 (Jan. 28, 2025);  Exec. Order 14192 “Unleashing Prosperity Through Deregulation,”90 Fed. Reg. 9065 (Feb. 6, 2025); and Exec. Order 14215, Ensuring Lawful Governance and Implementing the President’s “Department of Government Efficiency” Deregulatory Initiative, 90 Fed. Reg. 10583 (Feb. 25, 2025).

Arizona Reproductive Rights: An Update

By: Marki Stewart and Karen Owens, Coppersmith Brockelman PLC

  1. Proposition 139: Abortion Rights Now Are Part of the Arizona Constitution

On November 5, 2024, Arizona’s voters passed Proposition 139, an initiative that enshrines the right to abortion in the Arizona Constitution.  The initiative largely parallels the abortion right as set forth in Roe v. Wade, the 1973 U.S. Supreme Court case which the Court overruled in Dobbs v. Jackson Women’s Health Organization, 597 U.S. 215 (2022).   Arizona voters approved the initiative by large numbers, with “yes” votes constituting 61.61% of the vote, compared to a 38.39% “no” vote.  https://ballotpedia.org/Arizona_Proposition_139,_Right_to_Abortion_Initiative_(2024)

The text of Proposition 139, now Article 2, Section 8.1 of the Arizona Constitution, is quite short.  The entirety of the provision is as follows:

  1. Every individual has a fundamental right to abortion, and the state shall not enact, adopt or enforce any law, regulation, policy or practice that does any of the following:
  2. Denies, restricts or interferes with that right before fetal viability unless justified by a compelling state interest that is achieved by the least restrictive means.
  3. Denies, restricts or interferes with an abortion after fetal viability that, in the good faith judgment of a treating health care professional, is necessary to protect the life or physical or mental health of the pregnant individual.
  4. Penalizes any individual or entity for aiding or assisting a pregnant individual in exercising the individual’s right to abortion as provided in this section.
  5. For the purposes of this section:
  6. “Compelling state interest” means a law, regulation, policy or practice that meets both of the following:
  7. Is enacted or adopted for the limited purpose of improving or maintaining the health of an individual seeking abortion care, consistent with accepted clinical standards of practice and evidence-based medicine.
  8. Does not infringe on that individual’s autonomous decision making.
  9. “Fetal viability” means the point in pregnancy when, in the good faith judgment of a treating health care professional and based on the particular facts of the case, there is a significant likelihood of the fetus’s sustained survival outside the uterus without the application of extraordinary medical measures.
  10. “State” means this state, any agency of this state or any political subdivision of this state.
  11. Reuss v. State of Arizona

Proposition 139 became effective on Nov. 25, 2024, and the Arizona Constitution has now been amended to include its terms.  But the proposition itself did not automatically delete prior laws limiting abortion rights.  With that in mind, on December 3, 2024, health care providers filed a lawsuit challenging A.R.S. §§ 36-2321 through -2326, provisions that contain the ban on abortion after 15 weeks of pregnancy, on grounds that the 15-week limitation violated the new Constitutional amendment.  Reuss v. State of Arizona, No. CV2024-000565 (Maricopa County Superior Court, March 2025).

Plaintiffs filed a Motion for Judgment on the Pleadings.  The State agreed that the trial court could resolve the case on the pleadings and asked the court to enter the declaratory and injunctive relief that Plaintiffs sought.  On March 5, 2025, the Maricopa County Superior Court entered an Order granting Plaintiffs’ Motion for Judgment on the Pleadings.   A stipulation for dismissal of the case was filed soon thereafter.  Because the parties agreed to enter judgment on the pleadings, there will be no appeal.  The Reuss trial court decision is therefore the final word on the enforceability of A.R.S. Sections 36-2321 through 2326.

  • What did Reuss remove from law?

The Reuss case effectively deleted several specific provisions from Arizona law. These are:

  • A.R.S. § 36-2321: Definitions for abortion; medical emergency; gestational age; major bodily function.  (But note that some of these terms are defined elsewhere in Title 36.)
  • A.R.S. § 36-2322:
    • Except in a medical emergency, a physician may not intentionally or knowingly perform, induce or attempt to perform or induce an abortion if the probable gestational age of the unborn human being has been determined to be greater than fifteen weeks.
    • Requires reporting to the Arizona Department of Health Services (“ADHS”)  for every abortion performed after 15 weeks.
  • A.R.S. § 36-2323: Required ADHS to create the reporting forms.
  • A.R.S. § 36-2324:
    • Any physician who intentionally or knowingly violates the prohibition in section 36-2322, subsection B is guilty of a class 6 felony.
    • A pregnant woman on whom an abortion is performed may not be prosecuted for conspiracy to commit any violation of this article.
  • A.R.S. § 36-2325:
    • A physician who intentionally or knowingly violates the prohibition in section 36-2322, subsection B commits an act of unprofessional conduct and the physician’s license to practice medicine in this state shall be suspended or revoked.
    • Imposed civil penalties for failure to comply with ADHS reporting requirements or for providing false information on a report to ADHS.
    • A.R.S. § 36-2326: Authorized the Arizona Attorney General to bring an action to enforce this article.
  • What abortion laws were unaffected by Reuss?

The Reuss litigation did not affect all of Arizona’s abortion laws, however.  Important statutes regulating the provision of abortion remain in place, although the constitutionality of at least some of these provisions is in doubt under Proposition 139.  The following statutory provisions remain in law:

  • A.R.S. § 36-2159: Prohibits abortion after 20 weeks gestation except in a medical emergency; violation is a class 1 misdemeanor and an act of unprofessional conduct; creates civil cause of action for the pregnant person, father, and maternal grandparents.
  • A.R.S. § 36-2152: Requires parental informed consent or judicial bypass for minors seeking abortion services.
  • A.R.S. § 36-2323: Requires ADHS to create reporting forms.
  • A.R.S. § 36-2324:
    • Any physician who intentionally or knowingly violates the prohibition in section 36-2322, subsection B is guilty of a class 6 felony. 
    • A pregnant woman on whom an abortion is performed may not be prosecuted for conspiracy to commit any violation of this article.
    • Note that Reuss specifically addressed and deleted A.R.S. § 36-2322.
  • A.R.S. § 36-2325:
    • A physician who intentionally or knowingly violates the prohibition in section 36-2322, subsection B commits an act of unprofessional conduct and the physician’s license to practice medicine in this state shall be suspended or revoked. 
      • Imposes civil penalties for failure to comply with ADHS reporting requirements or for providing false information on a report to ADHS. 
    • Note that Reuss specifically addressed and deleted A.R.S. § 36-2322.
  • A.R.S. § 36-2326: Authorizes the Arizona Attorney General to bring an action to enforce this article.
  • A.R.S. § 36-2156: Requires a fetal ultrasound 24 hours before the abortion services; creating a civil cause of action for the pregnant person, the father of the fetus, and maternal grandparents for violation of this section. 
  • A.R.S. § 36-2153: Establishes informed consent requirements at least 24 hours before the abortion services; only physicians (MDs and DOs) may provide abortions.
  • A.R.S. § 36-2160: Abortion-inducing drugs may only be provided by a physician; prohibits providing abortion-inducing drugs via courier, delivery, or mail service. Notably, the Trump Administration has now asked a federal trial court to dismiss a case challenging Biden Administration rules that broadened federal abortion medication access.  https://www.nytimes.com/2025/05/05/health/trump-abortion-pill-case.html This federal position, however, does not by itself render Arizona’s state restrictions ineffective.
  • A.R.S. § 36-3604: Prohibits the use of telehealth to provide an abortion. 
  • Various statutes related to ADHS abortion reporting requirements (including reporting requirements for informed consent, fetus born alive, complications, etc.).
  • ARS § 13-3603.02: Makes it a felony to perform an abortion for race or sex selection or because of a genetic abnormality except in an emergency.
  • Possible Future Challenges

Although we do not yet know what additional abortion-related statutes may be challenged successfully under the new Constitutional amendment, further challenges to the remaining Arizona abortion laws appear likely.  Generally, it is reasonable to expect arguments that various statutes interfere with the fundamental right to an abortion and are not justified by a compelling state interest.

For example, the restriction on providing abortion after 20 weeks unless there is a medical emergency (in A.R.S. § 36-2159) appears to directly contradict the new Article 2, Section 8.1(A)(2) of the Arizona Constitution.  That language prohibits the state from taking any action which: “[d]enies, restricts or interferes with an abortion after fetal viability that, in the good faith judgment of a treating health care professional, is necessary to protect the life or physical or mental health of the pregnant individual.”  We may see arguments that 20 weeks gestation is not the same as “fetal viability” as defined in the new Constitutional provision.  In addition, it may be argued that the 20-week ban’s exception for “medical emergency” is not the same as the Arizona Constitution’s standard stating that an abortion after fetal viability must be necessary to protect the life or physical or mental health of the pregnant individual.

Similarly, arguments may be made that the ultrasound requirement (A.R.S. § 36-2156) and 24-hour waiting period (A.R.S. § 36-2153) interfere with the fundamental right to abortion now in the Arizona Constitution and lack the justification of a compelling state interest.   Waiting periods may be characterized as a significant burden particularly for patients who live in rural areas and need to travel for these appointments.

We also may see constitutional challenges leveled at, among other provisions, the prohibition on the use of telehealth for abortion services (A.R.S. § 36-3604), the state limitations on the delivery of abortion medications (A.R.S. § 36-2160), the prohibition of abortions performed by mid-level providers (A.R.S. § 36-2153), and informed consent provisions (A.R.S. § 36-2153).

Suffice to say that further challenges to Arizona abortion laws in light of Arizona’s new Constitutional amendment may take place. It is difficult to predict how the courts will come down on each of these provisions and others.  At a minimum, we should expect that abortion law in Arizona will be in flux for the foreseeable future.

How the CARES Act Final Rule is Changing 42 CFR Part 2 Compliance

By: Melissa Soliz and Katherine Hyde, Coppersmith Brockelman PLC

Last year, the Department of Health and Human Services (HHS) made some significant changes to 42 CFR Part 2 (Part 2)’s privacy protections for substance use disorder (SUD) records. Part 2 programs and other lawful holders of SUD records have less than one year left to get ready for the upcoming compliance deadline on February 16, 2026.

In February 2024, HHS published the final rule modifying Part 2 to implement Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (the “CARES Act Final Rule”).[1] The CARES Act Final Rule was effective April 16, 2024, but the compliance deadline is delayed until February 16, 2026. Early voluntary compliance is permitted. Below, we summarize some of the most important rule changes for health care providers, health plans, and health information networks/exchanges (HIN/HIEs).

Enforcement Structure

One of the most significant changes is the addition of a robust complaint, breach reporting, and penalty enforcement structure that leverages HIPAA’s civil/criminal penalties and the HIPAA Enforcement Rule (see 164 CFR Part 160, Subparts C, D, and E). This change significantly raises the risks associated with Part 2 noncompliance by giving HHS and state attorneys general new enforcement authority. HHS has actively conducted compliance reviews and investigations through OCR and regularly exercises its civil enforcement authority.

Breach Reporting

The requirements of the HIPAA Breach Notification Rule are now applicable to Part 2 programs. Specifically, HHS finalized changes to the Part 2 regulations to require that the Breach Notification Rule “shall apply to part 2 programs with respect to breaches of unsecured records in the same manner as those provisions apply to a covered entity with respect to breaches of unsecured protected health information.”[2] HHS also finalized the HIPAA definition of “breach” in Section 2.11. However, in the commentary to the CARES Act Final Rule, HHS explains that Part 2 programs are required to report not only HIPAA breaches, but the unauthorized use or disclosure of Part 2 records in violation of Part 2.[3] Notably, this expanded breach reporting requirement does not apply to other lawful holders of Part 2 records (including Qualified Service Organizations) that are not Part 2 programs.

Applicability and Scope

Neither the CARES Act nor the CARES Act Final Rule make changes to the applicability of Part 2 to Part 2 programs. However, the CARES Act Final Rule does:

  • Change the scope of applicability of Part 2’s use and disclosure restrictions to health plans by excluding health plans (as defined by HIPAA) from the definition of “third-party payer”;[4]
  • Clarifies the applicability of Part 2 provisions to other lawful holders of Part 2 records as well as the types of individuals and entities who may qualify as a qualified service organization (QSO);[5]
  • Adopts the HIPAA de-identification standard;[6] and
  • Creates a new subset of Part 2 records, called SUD counseling notes, that have heightened protection akin to HIPAA’s protection for psychotherapy notes.[7]

Part 2 Notice

Since its inception, Part 2 has required Part 2 programs to give patients notice of Part 2’s confidentiality requirement upon their admission to the Part 2 program. This is sometimes referred to as a “Part 2 summary” or “Part 2 notice.” In the CARES Act Final Rule, HHS finalized requirements to align the Part 2 notice requirements with HIPAA as well as changes to Part 2’s enforcement structure.[8] The changes are tantamount to a complete rewrite of the Part 2 notice requirements. Consequently, Part 2 programs will need to rewrite their Part 2 notices on or before the February 16, 2026 compliance deadline.  For HIPAA-regulated entities, the Part 2 notice may be combined with the HIPAA Notice of Privacy Practices (NPP).

A Future TPO Consent

A patient may now execute a single Part 2-compliant consent that covers all future uses and disclosures of Part 2 records for treatment, payment, or health care operations (TPO) purposes, unless revoked (a “future TPO consent”).[9] When such a future TPO consent is executed, a Part 2 program or HIPAA-regulated entity may use and disclose those Part 2 records as permitted by HIPAA for TPO purposes, unless revoked.[10] Additionally, HIPAA-regulated entity recipients of the Part 2 records pursuant to such a TPO consent may further disclose those Part 2 records in accordance with HIPAA (that is, for other HIPAA-permitted purposes beyond TPO), except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.[11] Disclosures by non-HIPAA regulated entities recipients, however, are limited to the purposes provided for in the consent.[12]

Part 2 Consent Elements

HHS has finalized the Part 2 consent elements to partially (but not fully) align with HIPAA authorization elements.[13] A Part 2 consent continues to remain materially different from a HIPAA authorization and may be combined with a HIPAA authorization to form a combined Part 2 consent/HIPAA authorization. Importantly, in the CARES Act Final Rule, HHS revised the definition of “intermediary” to exclude HIPAA-regulated entities.[14] As a result, the special consent requirements and limitations applicable to intermediaries and redisclosures through intermediaries do not apply if the intermediary is a HIPAA-regulated entity.[15] Special consent element rules (or options) also apply:

  • To future TPO consents;[16]
  • For the use and disclosure of SUD counseling notes;[17]
  • To use and disclose Part 2 records in proceedings against the patient;[18]
  • For uses and disclosures to prevent multiple enrollments in a withdrawal management or maintenance treatment program;[19]
  • To elements in the criminal justice system which have referred patients;[20] and
  • For disclosures to prescription drug monitoring programs.[21]  

Notice to Accompany Disclosure and Copy/Explanation of Consent

HHS continues to require that certain procedural requirements be followed with respect to consent-based disclosures of Part 2 records. Specifically, HHS continues to require that a “prohibition on redisclosure notice” accompany consent-based disclosures of Part 2 records, but has rebranded this as a “notice to accompany disclosure.” [22] HHS also added a new requirement to transmit a copy of the patient’s consent or clear explanation of the scope of consent with “each disclosure” of the patient’s Part 2 records.[23] HHS added this procedural requirement to enable Part 2 record recipients that are HIPAA-regulated entities to identify whether the Part 2 records were disclosed pursuant to a TPO consent (and thus qualify for redisclosure for HIPAA-permitted purposes, except in proceedings against the patient) or something less or different than a TPO consent.

Conclusion

The CARES Act Final Rule will allow patients to more broadly consent to the use and redisclosure of their Part 2 records, which potentially could enable patients to take better advantage of the benefits of whole person care and advancements in interoperability. Whether these benefits are realized will depend on whether health care providers, health plans, HIN/HIEs and their technology vendors are able to build the technology systems that are capable of identifying, segmenting, and segregating Part 2 records and deploying consent management functionality that meets the requirements of the Part 2 data sharing rules. 

[1] 89 FR 12472 (Feb. 16, 2024).

[2] 42 CFR 2.16(b).

[3] 89 FR at 12496.

[4] 42 CFR 2.11 and 2.12(d)(2)(i).

[5] See 42 CFR 2.11 (definitions of QSO and lawful holder).

[6] 42 CFR 2.16(a)(1)(i)(E).

[7] 42 CFR 2.11 and 2.31(b).

[8] 42 CFR 2.22.

[9] 42 CFR 2.33(a).

[10] 42 CFR 2.33(a)(2).

[11] 42 CFR 2.33(b)(1).

[12] 42 CFR 2.33(b)(2).

[13] 42 CFR 2.31.

[14] 42 CFR 2.11.

[15] See 42 CFR 2.31(a)(4)(ii) and 2.24.

[16] See generally 42 CFR 2.31(a).

[17] 42 CFR 2.31(b).

[18] 42 CFR 2.31(d).

[19] 42 CFR 2.34

[20] 42 CFR 2.35.

[21] 42 CFR 2.36.

[22] 42 CFR 2.32(a).

[23] 42 CFR 2.32(b).

Arizona Court of Appeals Provides Guidance on Who May Be an “Acquaintance Witness” in Petition for Court-Ordered Treatment

By Paul Giancola, Claudia Stedman, and Savannah Wix, Snell & Wilmer, LLP

            On October 31, 2024, the Arizona Court of Appeals addressed the conditions that must be met to support a petition for involuntary treatment, under A.R.S. § 36‑539(B). Relying on the statute, the Court explained that a petition requires the testimony of (1) two acquaintance witnesses,[1] and (2) “two physicians or other health professionals who participated in the evaluation of the patient.” However, the Court noted that the relationship between a behavioral health provider and client is confidential, and the provider may not testify regarding that relationship or about the care rendered, unless the client waives that privilege. See A.R.S.§ 32‑3283(A). This confidential relationship extends to social workers who assist individuals with restoring “the ability to function physically, socially, emotionally, mentally and economically,” A.R.S.§ 32‑3251(12)(b), or who apply “social work theories, principles, methods, and techniques to [t]reat mental, behavioral, and emotional disorders.” Id. § 32‑3251(12)(a).

            In In Re: MH2023-004502, hospital staff asked social worker M.G. to perform a level of care (“LOC”) assessment for patient A.R. During the evaluation, M.G. told A.R. their consultation would not necessarily remain confidential. M.G. then applied for an involuntary evaluation of A.R., which became the basis of the petition for court-ordered treatment. A.R. moved to preclude M.G. as an acquaintance witness in the proceedings, arguing that M.G. was subject to the confidentiality requirements of A.R.S. § 32‑3283 because she was licensed pursuant to A.R.S. § 32‑3521. The lower court denied A.G.’s motion, finding that M.G.’s verbal disclaimer prevented the formation of a confidential relationship. During the proceedings for involuntary treatment, M.G. testified that she met A.R. only once and that she had neither a therapeutic nor a confidential relationship with A.R. The lower court ordered A.R. to undergo involuntary treatment, and A.R. appealed.[2]

            Citing the Arizona Supreme Court’s decision in Matter of Commitment of Allegedly Mentally Disordered Person, the Court of Appeals reiterated that “the legislature’s choice in A.R.S. § 36‑539(B) to require two professional evaluators, but separately, two acquaintance witnesses, demonstrated that an acquaintance witness was not simply a third or fourth professional evaluator.” 181 Ariz. 290, 292 (1995) (emphasis added). As such, “no person whose primary contact with the patient was to examine the patient during his or her commitment evaluation process may testify” as an acquaintance witness, especially when the purpose of an acquaintance witness is to “give the trial court an opportunity to determine how the patient behaves in situations other than commitment evaluation interviews.” Id.

            Applied to the facts in In Re: MH2023-004502, the Court of Appeals found that M.G.’s role was solely to evaluate A.R. for commitment. M.G. had only one clinical interaction with A.R., and M.G. had never witnessed how A.R. behaved on a day-to-day basis outside of the LOC assessment. Accordingly, the Court determined that M.G. could not testify as an acquaintance witness and that the superior court erred in ordering treatment.

            Moreover, the Court ruled that M.G.’s assessment was privileged under A.R.S. § 32‑3283(A), despite M.G.’s disclaimer. The Court concluded that the behavioral health professional privilege applied to M.G.’s testimony under the definitions of the “practice of social work” set forth in A.R.S. § 32-3251(12).  The record demonstrated that M.G. assisted A.R. to “restore [his] ability to function . . . socially, emotionally, [or] mentally . . .” and she “[t]reat[ed his] mental, behavioral, and emotional disorders” by providing a diagnostic evaluation. A.R.S. § 32‑3251(12)(a). Because the behavioral health privilege applied to M.G.’s LOC assessment, and a confidential relationship existed between M.G. and A.G., only A.G. could waive the privilege.

            Petitioners, defendants, and mental health providers participating in court-ordered evaluations should be aware of these confidentiality obligations and evaluate whether they have witnesses who will satisfy the acquaintance witness requirement set forth in A.R.S. § 36-539(B) to support court-ordered treatment.

[1] An acquaintance witness is a witness “acquainted with the patient at the time of the alleged mental disorder.” A.R.S. § 36‑539(B).

[2] The issue became moot during the appellate process because the superior court’s commitment order expired. However, the appellate court decided the merits of the appeal, determining that it involved issues of public importance capable of repetition yet evading review and that the liberty interests at stake would likely arise in other cases.

CAN THE FTC COMPETE WITH CONGRESS TO BAN NON-COMPETES? IT MIGHT BE A “MAJOR QUESTION.”

By: Cober Plucker, Milligan Lawless, P.C.

The verdict is in.  After a year-and-a-half of testimony, research, and deliberations, the Federal Trade Commission declared last month that employment non-compete agreements are an “unfair method of competition.”   Slated to take effect September 4th, the Commission’s Final Non-Compete Clause Rule will prohibit new non-competes for every single employee in the country.[1]

But it doesn’t stop there.  In addition to prohibiting future non-competes, the Rule also retroactively invalidates over 99% of existing non-compete agreements—almost 30 million of them.  Only existing non-competes for “senior executives” earning more than $151,164 annually and who are in a “policy-making position” will remain enforceable.[2]  It’s a bold policy initiative for any government bureaucracy.

Maybe too bold. 

Some unhappy employers—including the U.S. Chamber of Commerce—have asked a U.S. District Court in Texas to stop the Rule before it takes effect, claiming that the Commission lacks authority to make such a sweeping policy change.[3]  Apparently, the Commission can’t compete with Congress to ban non-competes.

The controversy arises from the interpretation of two sections of the Federal Trade Commission Act.  Section 5 of the Act declares that “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce” are unlawful.[4]  The Commission is “empowered and directed to prevent persons, partnerships, or corporations” from engaging in them,[5] and it does this by targeting suspected violators through case-specific, individual enforcement actions.[6] 

In addition to its Section 5 enforcement authority, Congress granted the Commission various investigative and reporting powers in Section 6 of the Act.[7]  In the middle of these provisions is the center of controversy—a one-line subsection that says the Commission has power “from time to time [to] classify corporations and…to make rules and regulations for the purpose of carrying out the provisions of this subchapter.”[8]

In the Commission’s view, when the “plain text” of Section 5 and Section 6(g) are taken together, it has the authority to define conduct it deems to be an unfair method of competition.[9]  In fact, the Commission claims it’s done this sort of thing dozens of times between 1963 and 1978, for instance when it adopted rules related to the disclosure of extension ladder lengths and gas pump octane ratings.[10]  And it believes prior court rulings are on its side, including a 50-year-old decision that says that Section 6(g) authorizes the Commission to adopt “rules defining the meaning of the statutory standards of the illegality the Commission is empowered to prevent.”[11]

Of course, business interests think the ‘70s-era jurisprudence aged like disco.  They say that Congress intended Section 6(g)’s perfunctory rule-making provision to allow only “procedural rules,” not sweeping trade regulations with the force of substantive law.  It sounds like a rehash of a decades-old argument, but business interests have something new up their sleeve—a sympathetic Supreme Court. 

Weary of the “discovery” of unheralded powers in benign statutes, the Supreme Court has struck down multiple agency actions over the past 25 years, including:

  • The FDA’s claim that the Food, Drug, and Cosmetic Act gave it authority to ban tobacco products;[12]
  • The Attorney General’s attempt to use the Controlled Substances Act to prohibit physicians from prescribing controlled substances for assisted suicide;[13]
  • The EPA’s interpretation of the Clean Air Act to justify expansion of permit requirements;[14]
  • The CDC’s reliance on the Public Health Service Act to extend a nationwide eviction moratorium during the COVID-19 pandemic;[15]
  • The Secretary of Labor’s reliance on the Occupational Safety and Health Act to mandate weekly COVID-19 testing for the unvaccinated;[16] and
  • The EPA’s promulgation of the Affordable Clean Energy Rule to accelerate emissions reductions.[17]

While all of these regulatory assertions of power had a “colorable textual basis,” the Supreme Court said that “common sense” suggested it was unlikely that Congress had granted such extraordinary regulatory authority through “modest words,” “vague terms,” or “subtle device[s].”  After all, Congress is presumed to leave major policy decisions to itself.[18]  Crystalizing a quarter-century of rulings, the Supreme Court emphasized that federal agencies must identify “clear congressional authorization” when seeking to make a decision that has “vast economic and political significance.”[19]  And it gave this principle a name: the Major Questions Doctrine.

So, the big question for the new non-compete Rule is whether it involves a Major Question.  It’s certainly up for debate whether or not the Commission had “clear congressional authorization” and whether the blanket elimination of almost every present and future non-compete agreement is of “vast economic and political significance.”  We’ll get a sense of the District Court’s preliminary inclination on this in early July when it decides whether the Rule should be stayed during the lawsuit. 

One thing is clear now, though.  This case has all the markings of a dispute bound for the Supreme Court.  Stay tuned….

[1] The complete text of the Commission’s Non-Compete Clause Rule can be found at https://www.federalregister.gov/documents/2024/05/07/2024-09171/non-compete-clause-rule.

[2] FTC Rule Summary at https://www.ftc.gov/legal-library/browse/rules/noncompete-rule.

[3] Ryan LLC v. FTC, 3:24-cv-00986 (N.D. Tex.). 

[4] 15 U.S.C. § 45(a)(1).

[5] Id. at § 45(a)(2).

[6] Id. at § 45(b).

[7] Id. at § 46. 

[8] Id. at § 46(g) (emphasis added).

[9] Final Rule at pg. 38349

[10] Final Rule at pgs. 38349-50.

[11] Final Rule at pg. 38350; National Petroleum Refiners Assn. v. F.T.C., 482 F.2d 672, 698 (D.C. Cir. 1973).

[12] FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120 (2000).

[13] Gonzales v. Oregon, 546 U.S. 243 (2006).

[14] Utility Air Regulatory Group v. EPA, 573 U.S. 302 (2014).

[15] Alabama Assn. of Realtors v. DHHS, 594 U.S. 758 (2021).

[16] Natl. Federation of Indep. Bus. v. OSHA, 595 U.S. 109 (2022).

[17] W. Virginia v. EPA, 597 U.S. 697 (2022).

[18] Id. at 722-723.

[19] Id. at 716-724.

OCR Issues HIPAA Privacy Rule to Support Reproductive Health Care Privacy

By: Claudia Stedman, Snell & Wilmer, LLP

On April 17, 2023, the Department of Health and Human Services’ Office for Civil Rights (“OCR”) proposed modifications to HIPAA’s Privacy Rule to further protect the privacy of reproductive health care information. The proposed rule, arriving in the wake of Dobbs v. Jackson Women’s Health Organization, is the result of growing concern regarding the confidentiality of reproductive health information and how that information could be used to initiate civil, criminal, or administrative proceedings.

On April 26, 2024, OCR issued its Final Rule: the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”). The Final Rule establishes a “purpose-based prohibition” on certain uses and disclosures of protected health information (“PHI”) related to reproductive health care. Specifically, the Final Rule prohibits covered entities and business associates (also referred to as “regulated entities”) from disclosing PHI when:

  • That information is sought to investigate or impose liability on patients, healthcare providers, or others who seek, obtain, provide, or facilitate lawful reproductive health care; or
  • That information is sought to identify any person for any of the above purposes.

In the Final Rule, OCR also clarified that this prohibition only applies when the relevant activity involves a “person seeking, obtaining, providing, or facilitating reproductive health care,” and the regulated entity receiving the PHI request has reasonably determined that at least one of three conditions exists:

  • The reproductive care is lawful in the state where the care is provided and under the circumstances in which it is provided;
  • The care is protected, required, or authorized under federal law, including the U.S. Constitution, “under the circumstances in which such health care is provided,” regardless of the state in which the care is provided;[1] or
  • The care being provided is presumed lawful, as explained further below.

The Final Rule includes a presumption that reproductive health care performed by another person (e.g., not the covered entity or business associate receiving the PHI request) is lawful unless either (1) the entity receiving the request for the PHI has actual knowledge that the care was not lawful, or (2) factual information from the requester demonstrates a “substantial factual basis” that the care provided was unlawful.

The Final Rule also provides that regulated entities may not use or disclose PHI related to reproductive care for health oversight activities, judicial administrative proceedings, law enforcement purposes, or to coroners and medical examiners without first obtaining a valid attestation from the requestor. The attestation must:

  • Include specific identification of the information sought, including the applicable individual or class of individuals implicated by the request;
  • Include the name of the individual or entity from whom information is sought;
  • Include the name and signature of the requester and the date;
  • Include a clear statement that the use or disclosure of the PHI is not for a prohibited purpose;
  • Include a statement that a person may be subject to criminal penalties for knowingly obtaining or disclosing PHI in violation of HIPAA;
  • Be written in plain language; and
  • Not be combined with any other documents.

OCR intends to publish a model attestation form prior to the Final Rule’s effective date on June 25, 2024. An attestation that meets the Privacy Rule’s requirements is compliant even if it does not match the exact form promulgated by OCR.

The Final Rule also modifies provisions of the Privacy Rule regarding Notices of Privacy Practices. These changes require covered entities to address the above reproductive care changes as well as recently finalized changes to 42 CFR Part 2 (addressing substance use health information confidentiality). While regulated entities must comply with the majority of the Final Rule’s provisions by December 23, 2024, compliance with the Final Rule’s changes to Notices of Privacy Practices is not required until February 16, 2026.

Regulated entities should be aware that new requests for information may implicate these new reproductive health care privacy requirements and may now trigger the above prohibitions or mandates under the Final Rule. Regulated entities should review their policies and procedures to ensure that PHI disclosed to health oversight agencies, to law enforcement, coroners, and medical examiners, or for judicial or administrative proceedings complies with the Final Rule’s requirements. Regulated entities should also review and update their Notices of Privacy Practices.

[1] This provision would apply, for example, to those seeking emergency miscarriage and abortion care in hospital emergency rooms pursuant to EMTALA, though this is subject to ongoing litigation at the U.S. Supreme Court. Additionally, contraception provided in any state is lawful under federal law and information regarding the care provided in connection with that contraception would be protected from compelled disclosure under HIPAA.

Distress in Health Care – Risk and Remedy

By: Carolyn J. Johnsen, Senior Partner, Dickinson Wright, PLLC

Financial distress in the health care sector has reached a new high as demonstrated by the number of bankruptcies filed by health care-related companies in the past year. Many analysts have attributed the cause of this massive increase to the Pandemic era when various government protection and stimulus programs provided entities with much-needed cash that in many cases was depleted without the recipient addressing and solving its internal problems. The pre-Pandemic problems unfortunately still have persisted in many instances and health care administrators and professionals are now challenged with developing solutions.  A bankruptcy may provide the best strategic option.

WHAT CAN A BANKRUPTCY ACCOMPLISH?

A common misconception is that an entity or individual must be insolvent in order to file bankruptcy.  That is not the case and in fact, a solvent entity may file for any number of reasons simply to take advantage of bankruptcy code provisions designed to assist it with a reorganization plan.  Clearly, the negative stigma of filing a bankruptcy no longer exists as it has now been recognized as a valuable business tool. Bankruptcy offers a means to an end whether the goal is to stabilize and continue operations or sell or merge the business. The bankruptcy provides the time necessary to structure a realistic solution that benefits all stakeholders. Another misconception is that upon filing, a bankruptcy trustee will take over the business and immediately liquidate the assets.  This is also untrue.  A Chapter 11 bankruptcy is designed to allow current management to remain in place as a “debtor-in-possession” to either reorganize the business or sell it in an orderly fashion to maximize proceeds for the benefit of all constituents.  Overall, a bankruptcy can provide the path to attain a company’s short term or long term goals, particularly in this distressed environment – all with less or controlled risk.

STEP ONE – ESTABLISHING THE GOAL

The most common feature of a financially distressed business is likely a shortage of liquidity. But, what is the cause?  In general the across-the-board external factors have included a rise in labor costs, increase in interest rates and overall inflation, and, of course, the persistent and fluid regulatory overlay that affects reimbursement rates. All affect cash flow.  While these problems are not within immediate control, a health care company needs to be prepared to react to this pervasive stress. On an internal basis, problems may vary but consistently involve management’s juggling of compliance and patient needs with the plain and simple challenges of paying lenders, landlords and vendors. Solutions for these issues are within reach.

First and foremost, the entity’s or group’s mission must be determined or repurposed.  Some hospitals want to grow; others are happy to merge.  Some physicians what to become employees; others do not.  Some entities are saddled with an outdated legacy operating model; others have solvable cost containment issues.  In all cases, just like any business outside of the health care space, there needs to be a business plan.  The focus should be that if today, the business is at point A, what is point B. Is it trying to grow, is it trying to shrink, is it trying to reduce debt and stay in business, is it in need of a management succession plan, is it time to sell?  Once these basic goals are established, then the granular problems can be analyzed to develop a solution. 

STEP TWO – PINPOINTING THE PROBLEM

          By statute, (the federal Bankruptcy Code), a debtor in bankruptcy has at its disposal certain valuable powers. These include an instantaneous stay of all payments to creditors and all lawsuits that may have been levied against the debtor.  The so called “automatic stay”[1] gives the entity a respite from its current cash drain and the chance to negotiate with its creditors and perhaps its shareholders.  In addition, the debtor has the ability to reject, thereby cancelling burdensome contracts and leases[2], may be able to modify its secured debt, and may be able to reduce past vendor liabilities.  Thus, initially it is critical to analyze cash in and cash out:  can the revenue stream be increased by rejecting a poor provider agreement or by better collections; is the entity suffering under a lease which is above market rent; are there staffing issues?  Once these issues are identified, the entity can weigh its options of whether to restructure its debt and equity structure and continue operations or effectuate a sale or merger.  Again, bankruptcy may be the appropriate strategy.

STEP THREE – IMPLEMENTING A SOLUTION

Out-of-Court

The terms “restructuring” or “work-out” are part of the financial distress lexicon. These concepts refer to out-of-court efforts to negotiate better terms with problematic lenders, landlords or vendors.  To be sure, this alternative is less expensive and should be considered and attempted prior to resorting to bankruptcy protection which necessarily involves multiple parties—secured creditors, unsecured creditors, equipment lessors, investors, employees, landlords—not to mention a judge who referees everything.    However, often the various issues cannot be resolved out of court because a counter party demands unreasonable concessions that would not have to be given up in a bankruptcy or because the problems are easier resolved in a single forum.  

Classic Reorganization

Commencement of a Chapter 11 bankruptcy case[3] is procedurally the same whether the debtor desires to continue operations or sell or merge its business.  In the case of a debtor that is going forward or merging with another entity, the ultimate strategy is embodied in a plan of reorganization.  That plan will set forth how the business will be financed, how creditors will be paid, and how equity will be structured. It may be a lengthy process, certainly no shorter than a year, and will undoubtedly involve negotiations with the various factions involved.  At the end, however, the entity has the opportunity to emerge revitalized with a new balance sheet.   

Case in point:  An example of a successful plan of reorganization that incorporated multiple bankruptcy tools and strategies is the case of a 32-bed surgical hospital in Phoenix owned by a group of 15 physicians.  The entity was in financial distress because of flailing management, poor performing provider contracts, and shareholders who were not engaged.  At the time of filing, the unsecured debt to vendors had grown exponentially and there was little hope that creditors could be repaid any significant amount of their claims.   A Chapter 11 was filed, bad contracts were rejected, management was replaced, and a merger partner was located.  The ultimate plan provided for payment to creditors in full and a 13 percent return to equity. 

Sub-Chapter V for Small Debtors

A Chapter 11 bankruptcy can alleviate pressures a company is experiencing with its creditors and provide a chance to continue its operations.  But, it can be a complicated, lengthy, and expensive process that makes it difficult for a small business to actually reorganize. However, one benefit emanating from the Pandemic crises was an amendment to the Bankruptcy Code that provides for a streamlined version of a Chapter 11 reorganization known as a Sub-Chapter V. Sub-Chapter V is designed to increase access and the ease of reorganization for small business debtors by relaxing the requirements of an ordinary Chapter 11 and allowing business owners to retain more control over their companies. It may offer the ideal solution for a small physician practice, a small hospital or nursing facility.[4] 

          A Sub-Chapter V Debtor can be an individual or a company so long as it is engaged in commercial or business activity and at least 50 percent (50%) of the debt arose from such activity. The debtor can only have a maximum aggregate liquidated non-contingent secured and unsecured debt totaling $7,500,000.[5]   Although a Chapter V Trustee is appointed, the debtor remains a debtor-in-possession of its assets and the plan process is extremely pared down.  The Trustee’s principle obligation is to facilitate a consensual plan of reorganization.  Simplistically, the debtor can confirm a plan if it pays its unsecured creditors its projected “disposable income” (defined as funds not reasonably necessary to ensure the continued operation of the business) over a period of three to five years. The debtor can still implement other aspects of the Bankruptcy Code to modify secured claims and reject contracts.

The Bankruptcy Sale

In the past decade, sales in bankruptcy have become predominant.  The term “363 sale” refers to the section 363 of the Bankruptcy Code which permits a debtor to sell its assets free and clear of liens and interests.  For buyers, a bankruptcy sale provides the opportunity to grow or enhance business, find synergies, or acquire assets at a reduced price. For sellers, a bankruptcy sale provides the opportunity to regain financial stability in a period of decreased revenues and lack of cash, divest some or all assets, and pay debt. Most important is that the sale is blessed with a court order approving the sale that likely will include findings that there is no successor liability for the buyer and that the sale process was completed in good faith and for adequate consideration. Many buyers insist on a sale occurring in a bankruptcy because of the protections it offers and may be willing to finance it.

For the most part, bankruptcy sales are always subject to higher and bidder bids and therefore the debtor will establish bid procedures and an auction date.  The debtor will have to demonstrate that its assets were marketed sufficiently.  It may have a stalking horse bidder whose bid establishes a floor price. The stalking horse bidder may seek bid protections such as a break-up fee and expense reimbursement. The entire process is typically an expedited procedure requested by the debtor often under pressure and at the insistence of a secured creditor. 

In the sale context, the debtor works with the proposed buyer to assign to it the contracts and leases it desires for the continued operation of the business.  The funds required to cure the monetary defaults for those assigned contracts are typically part of the purchase price[6].  The remainder are rejected by the debtor. 

For buyers, the benefits of a bankruptcy sale include speed (although due diligence is on a shortened time frame), price, and the reduced risk of successor liability or claw-back.  It obtains the assets without the liabilities which stay with the debtor. The detriments include the risk of overbid by another buyer that drives the price up or wins the deal, difficulty in dealing with all the competing interests in the case, and competition and public disclosure.

For the seller debtor entity, the benefits include speed and the re-payment of a greater amount of debt from the proceeds of the sale. The detriments include whether the debtor can survive in a bankruptcy case long enough to complete the sale and whether stakeholders are willing to consent and/or negotiate through the process

Case in point:  In August, a 33-bed community hospital filed Chapter 11 in Dallas, Texas and immediately sought to have a sale of all of its assets.  The hospital was built in 2019 but its business plan did not anticipate the high costs to “ramp up” before revenues could increase and stabilize and it was suffering large losses.  In order to have the time necessary to hold an auction and complete a sale, the debtor had to obtain financing so the hospital could continue operations prior to sale. After extensive marketing, the debtor held a robust auction at which time a large hospital chain that was anxious to expand its footprint in the Dallas market purchased the hospital at a higher price than was originally projected.  The debtor subsequently filed a plan to distribute the proceeds of the sale.

OVERALL CONSIDERATIONS FOR HEALTH CARE ENTITIES

In health care bankruptcies, judges are exceptionally cognizant of the need to protect patients. In fact, in almost every case involving patients, the judge will appoint a patient ombudsman who is tasked to regularly inspect and report on the operations of the debtor and its standard of care. While this may seem an intrusion to the debtor’s operations, the debtor’s relationship with and assistance to the ombudsman can be beneficial to the debtor’s goals in the case.

Although Bankruptcy Courts are courts of equity, judges typically disdain fraud. Consequently, problems that have occurred with improper billings or reimbursements will likely not be remedied in a bankruptcy case. Nonetheless, for the honest debtor, the court  is likely to be empathetic with the debtor’s need to keep operations alive, whether through its own actions or a sale, the need to pay physicians and staff, and the need to protect the community interest for which the debtor may serve.

CONCLUSION

No one can predict what lies ahead for the health care industry as a whole, and although external factors cannot be solved, from distress may come opportunity. Bankruptcy alternatives may provide the right business strategy and legal tools for solving financial issues.

[1] Section 362 of the Bankruptcy Code.

[2] Section 365 of the Bankruptcy Code.

[3] For purposes of this article, the author is assuming that the entity or group is seeking to either reorganize its operations or is seeking a sale or merger and hence, a Chapter 11 is appropriate. Pure liquidations under Chapter 7 of the Bankruptcy Code in which a trustee is appointed to seek full control of the debtor’s business and sell its assets is not discussed here.

[4] For example, in mid-March 2024, a group of four skilled nursing facilities filed a Sub-Chapter V in Eastern Texas to address severe cash problems. 

[5] When the bill was passed, the original debt ceiling was $2,725,625 but was increased by amendment during the Pandemic.  The current $7.5 Million ceiling is set to revert to the original ceiling in June 2024; however, bankruptcy analysts and experts predict that Congress will act to preserve the current amount.

[6] Bankruptcy Courts are not entirely consistent in how Medicare provider contracts overseen by the Health and Human Services Department are treated in sale situations.  It is important to be aware of how HHS may treat the contract in a particular jurisdiction and also to be prepared to negotiate its particular issues.