HCA Holdings 2012 Annual Report Download - page 29

conduct additional audits. In addition, ARRA authorizes state attorneys general to bring civil actions seeking
either injunction or damages in response to violations of HIPAA privacy and security regulations that threaten
the privacy of state residents. ARRA also significantly increases the amount of the civil penalties, with penalties
of up to $50,000 per violation for a maximum civil penalty of $1,500,000 in a calendar year for violations of the
same requirement. The 2013 final rule implements many of the ARRA enforcement requirements. In the rule,
HHS removed the requirement that HHS attempt to resolve HIPAA violations through informal means, such as
allowing a covered entity to implement a corrective action plan, prior to imposing penalties. Instead, HHS has the
discretion to resolve violations by moving directly to impose monetary penalties. We enforce a HIPAA
compliance plan, which we believe complies with the HIPAA privacy and security regulations and under which a
HIPAA compliance group monitors our compliance. The HIPAA privacy regulations and security regulations
have and will continue to impose significant costs on our facilities in order to comply with these standards.
There are numerous other laws and legislative and regulatory initiatives at the federal and state levels
addressing privacy and security concerns. Our facilities remain subject to any federal or state privacy-related
laws that are more restrictive than the privacy regulations issued under HIPAA. These laws vary and could
impose additional penalties.
EMTALA
All of our hospitals in the United States are subject to EMTALA. This federal law requires any hospital
participating in the Medicare program to conduct an appropriate medical screening examination of every
individual who presents to the hospital’s emergency room for treatment and, if the individual is suffering from an
emergency medical condition, to either stabilize the condition or make an appropriate transfer of the individual to
a facility able to handle the condition. The obligation to screen and stabilize emergency medical conditions exists
regardless of an individual’s ability to pay for treatment. There are severe penalties under EMTALA if a hospital
fails to screen or appropriately stabilize or transfer an individual or if the hospital delays appropriate treatment in
order to first inquire about the individual’s ability to pay. Penalties for violations of EMTALA include civil
monetary penalties and exclusion from participation in the Medicare program. In addition, an injured individual,
the individual’s family or a medical facility that suffers a financial loss as a direct result of a hospital’s violation
of the law can bring a civil suit against the hospital.
The government broadly interprets EMTALA to cover situations in which individuals do not actually
present to a hospital’s emergency room, but present for emergency examination or treatment to the hospital’s
campus, generally, or to a hospital-based clinic that treats emergency medical conditions or are transported in a
hospital-owned ambulance, subject to certain exceptions. At least one court has interpreted the law also to apply
to a hospital that has been notified of a patient’s pending arrival in a non-hospital owned ambulance. EMTALA
does not generally apply to individuals admitted for inpatient services. The government has expressed its intent
to investigate and enforce EMTALA violations actively in the future. We believe our hospitals operate in
substantial compliance with EMTALA.
Corporate Practice of Medicine/Fee Splitting
Some of the states in which we operate have laws prohibiting corporations and other entities from
employing physicians, practicing medicine for a profit and making certain direct and indirect payments or fee-
splitting arrangements between health care providers designed to induce or encourage the referral of patients to,
or the recommendation of, particular providers for medical products and services. Possible sanctions for violation
of these restrictions include loss of license and civil and criminal penalties. In addition, agreements between the
corporation and the physician may be considered void and unenforceable. These statutes vary from state to state,
are often vague and have seldom been interpreted by the courts or regulatory agencies.
25