05-13-2020 Council Packet - Laserfiche WebLink

Home Browse Search

32 Medicaid. A portion of the revenues of affiliates of the Borrower and the Limited Guarantor are dependent on reimbursement under the Medicaid programs administered by the State of Minnesota. For Fiscal Years ended September 30, 2019 and 2018, approximately ______% and ____% of the revenues of affiliates of the Limited Guarantor (on a consolidated basis) were derived from Medicaid payments. Each state currently funds a substantial portion of Medicaid payments and exercises considerable discretion in determining payments allowed to care providers. Regulations promulgated by CMS provide that states are not required to pay for long-term care services on a cost-related basis, but may do so according to payment rate systems established by the state and identified in a state Medicaid plan. See “APPENDIX A - THE BORROWER, LANGSTON SHORES, AND THE LIMITED GUARANTOR” in this Official Statement. Privacy and Security Regulations. The confidentiality of patient medical records and other health information is subject to considerable regulation by state and federal governments. Legislation and regulations governing the dissemination and use of medical record information are being proposed continually at both the state and federal levels. HIPAA. The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) mandates the adoption of federal privacy and security standards to protect the confidentiality of protected health information. Regulations designed to protect health information impose very complex procedures and operational requirements. Failure to protect the privacy and security of protected health information could result in damages or civil or criminal penalties. In particular, HIPAA imposes civil monetary penalties for violations and criminal penalties for knowingly obtaining or using individually identifiable health information. Penalties for HIPAA non-compliance range from $50,000 for any violation not to exceed $1.5 million in any calendar year for wrongful disclosure of individually identifiable health information. Any such violations may increase operating expenses as necessary to notify affected individuals of privacy or security breaches, correct problems, comply with federal and state regulations, defend against potential claims and implement and maintain any additional requirements imposed by government action. HITECH. Certain amendments to HIPAA known as the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) alter HIPAA rules regarding the use and disclosure of protected health information. The HITECH Act (i) extends the reach of HIPAA beyond “covered entities,” (ii) imposes a breach notification requirement on HIPAA covered entities, (iii) limits certain uses and disclosures of individually identifiable health information, (iv) increases individuals’ rights with respect to individually identifiable health information, (v) restricts marketing communications, and (vi) increases enforcement of, and penalties for, violations of privacy and security of individually identifiable health information. Any violation of the HITECH Act is subject to HIPAA civil and criminal penalties. The HITECH Act broadened the applicability of the criminal penalty provisions under HIPAA to employees of covered entities and required penalties for violations resulting from willful neglect. The HITECH Act breach notification requirement creates a federal breach notification law that mirrors protections that many states have passed in recent years. This requirement requires the Borrower to notify its clients of any unauthorized access, acquisition, or disclosure of their unsecured protected health information that poses significant risk of financial, reputational or other harm to a client. In addition, the breach notification requirement requires reporting all breaches to the Secretary of the U.S. Department of Health and Human Services (“DHHS”) and, in some cases, local media outlets, of certain unauthorized access, acquisition, or disclosure of unsecured protected health information that poses significant risk of financial, reputational or other harm to a patient.