Author Archives: Jeffrey Lynne

About Jeffrey Lynne

Jeffrey C. Lynne is a South Florida native, representing individuals and business entities relating to licensing, accreditation, regulatory compliance, business structure, marketing, real estate, zoning and litigation pertaining to substance abuse treatment facilities and sober living residences. Mr. Lynne has been recognized across the region as a leader in progressive public dialogue about the role that substance abuse treatment has within our communities and the fundamental need and right to provide safe and affordable housing for those who are both in treatment for addiction and alcoholism as well as those who are established in their recovery.

South Florida Treatment Providers Sentenced to Federal Prison for Their Roles in $21 Million Fraud Scheme

The U.S. Department of Justice in coordination with the Health and Human Services Office of the Inspector General (HHS-OIG) just issued the following press release:

MIAMI, FL – Three former co-owners and clinical directors of a group of purported substance abuse treatment centers and sober homes were sentenced to prison today for their roles in a conspiracy to commit health care fraud and wire fraud that resulted in an actual loss of more than $3.8 million, and through which the conspirators sought to obtain more than $21 million.

U.S. Attorney Ariana Fajardo Orshan for the Southern District of Florida, Special Agent in Charge George L. Piro of the FBI’s Miami Field Office, and Special Agent in Charge Omar Pérez Aybar of the U.S. Department of Health and Human Services Office of the Inspector General (HHS-OIG) made the announcement.

Ali Ahmed, 38, Hector Efrain Alvarez, 49, and Mauren Morel, 45, all of Broward and Palm Beach Counties, previously pled guilty to one count of conspiracy to commit health care fraud and wire fraud (Case No. 19cr60200).  U.S. District Judge Federico A. Moreno of the Southern District of Florida sentenced Ahmed to 120 months in prison, Alvarez to 32 months in prison and Morel to 32 months in prison.  In addition, the defendants were ordered to forfeit certain property and pay forfeiture money judgments, as well as to pay restitution.  Specifically, Ahmed owes $4,204,336 in restitution; Alvarez owes $3,884,035; and Maurel owes $320,301 in restitution.

In recent years, South Florida has become the locus for drug and alcohol addicts seeking assistance in an effort to become and remain sober.  Substance abuse treatment centers that assist such persons undergoing detoxification from an intoxicating or addictive substance are regulated under state and federal law.  These substance abuse treatment centers, or detox centers, offer a continuum of care including, from most intensive to least intensive, as follows: inpatient detox, Partial Hospitalization Programs (PHP’s), Intensive Outpatient Programs (IOP’s), and Outpatient Programs (OP’s).  Persons undergoing treatment on an out-patient basis, whether in PHP, IOP, or OP, typically elect to live in a “recovery residence,” also known as a “sober home” or “halfway house,” with other persons who are also in treatment and committed to a drug and alcohol-free lifestyle.

Jacob’s Well, Inc. (Jacob’s Well) was a Florida corporation, located at 7950 SW 30th Street, Suite 202, Davie, Florida.  Jacob’s Well was a substance abuse treatment center licensed with the Florida Department of Children and Families that purportedly provided private insurance beneficiaries with substance abuse treatments and services.

Medi MD, LLC. (Medi MD) was a Florida corporation, located at 7950 SW 30th Street, Suite 200, Davie, Florida.  Medi MD was a substance abuse treatment center licensed with the Florida Department of Children and Families that purportedly provided private insurance beneficiaries with substance abuse treatments and services.

Arnica Health was a Florida corporation, located at 7950 SW 30th Street, Suite 202, Davie, Florida.  Arnica Health was a purported medical treatment center co-located with the purported substance abuse treatment centers.  Together with Medi MD and Jacob’s Well, Arnica Health operated as a part of Serenity Living and was affiliated with sober homes known as Serenity Ranch.

Ali Ahmed was Treasurer of Jacob’s Well, Director of Operations for Medi MD, and co-owner of Jacob’s Well, Medi MD, and Arnica Health.

Sebastian Ahmed was the CEO and co-owner of Jacob’s Well, Medi MD, and Arnica Health.

Hector Efrain Alvarez was Clinical Director of Medi MD.

Mauren Morel was Clinical Director and co-owner of Jacob’s Well.

Medi MD, Jacob’s Well, and Arnica Health together operated as Serenity Ranch/Serenity Living.

According to court documents, from June 2016 through April 2019, Ali Ahmed, Sebastian Ahmed, and Mauren Morel, submitted and caused others to submit, via interstate wire communications, approximately $1,693,276 in claims which falsely and fraudulently represented that various health care benefits, primarily substance abuse PHP, IOP, and OP services, were medically necessary, prescribed by a doctor, and provided by Jacob’s Well to insurance beneficiaries of Aetna, BCBS, Cigna and UHC.  As a result of such false and fraudulent claims, Aetna, BCBS, Cigna, and UHC made payments to the corporate bank accounts of Jacob’s Well in the approximate amount of $320,301.

Furthermore, during the same approximate time period, Ali Ahmed, Sebastian Ahmed, and Hector Efrain Alvarez submitted and caused others to submit, via interstate wire communications, approximately $21,899,439 in claims which falsely and fraudulently represented that various health care benefits, primarily substance abuse PHP, IOP, and OP services, were medically necessary, prescribed by a doctor, and provided by Medi MD to insurance beneficiaries of Aetna, BCBS, Cigna, Humana and UHC.  As a result of such false and fraudulent claims, Aetna, BCBS, Cigna, Humana and UHC made payments to the corporate bank accounts of Medi MD in the approximate amount of $3,884,035.

Ali Ahmed, Sebastian Ahmed, Hector Efrain Alvarez, and Mauren Morel used the proceeds of the health care fraud for their personal use and benefit, the use and benefit of others and to further the fraud scheme.

As set forth in Court documents, the scheme involved not only financial exploitation but also sexual exploitation of vulnerable, drug-addicted patients, whom were attracted and induced to attend Serenity Ranch facilities with free flights, free housing, vapes, clothing, spa days, benzodiazepine medications, and even drugs.  Indeed, the evidence showed that patients were permitted to keep using drugs, and even provided drugs – including heroin and cocaine – by conspirators such as Ali Ahmed.  Ali Ahmed also engaged in sexual relationships with patients and, as a result of the destabilizing environment at the facilities, many patients did not get the treatment that they so desperately needed.

Co-defendant Sebastian Ahmed, the former CEO of Jacob’s Well, Medi MD, and Arnica, who was charged in the same indictment, has pleaded not guilty and is set for trial on February 18, 2020, before Senior U.S. District Judge James I. Cohn.  He is presumed innocent of the charges.

The FBI and HHS-OIG investigated the case, with assistance from the Davie Police Department, Broward County Sheriff’s Office and U.S. Drug Enforcement Administration (DEA).  Assistant U.S. Attorneys Christopher J. Clark and Lisa H. Miller are prosecuting the case, and Assistant U.S. Attorneys Nicole Grosnoff and Peter A. Laserna are handling the asset forfeiture issues related to this matter.

Related court documents and information may be found on the website of the District Court for the Southern District of Florida at or at

New Arrests of More “Sophisticated” Players in Drug Treatment Industry Forthcoming

Hot off of the (local) presses is an article written by South Florida Sun Sentinel reporter Marc Freeman, in his piece “More arrests to come in crackdown on drug-recovery industry, prosecutor vows,” who asks the question: “In light of the resounding success from the Task Force’s law enforcement/investigative component, is it time for Palm Beach County State Attorney Dave Aronberg and his sober-homes cleanup crew to declare victory and disband?”

The response from the State Attorney Aronberg – “Hardly.”

When created over 3 years ago, the Task Force was a “first of its kind,” and still is an unusual group of law enforcement agencies, legitimate drug treatment providers, prosecutors, city and state agency representatives. According to the State, the Task Force’s work to date has resulted in 100 cases involving 87 people; the two most recent cases were filed last month. All were charged with multiple counts of patient brokering, with some cases aided by tips from a hotline.

Among the 87 people the state has charged with patient brokering, 38 have so far pleaded guilty, one had charges dropped due to a problem with witnesses, and one man was convicted at a trial last February.  “At its heart, the evil of patient brokering is that it corrupts the health care system because your decisions as to whom your provider should be are not made by who gets you well but rather who’s paying you,” Aronberg said. “You’re being shuttled in and out of these corrupted drug-treatment centers, these flophouses, for money, until you leave in an ambulance or a body bag.”

According to Aronberg, the focus has now shifted, moving beyond what was called “low hanging fruit” (reckless treatment-center operators and corrupt sober-home landlords that have taken advantage of recovering addicts in the quest for lucrative payouts) and into more complicated arrangements found amongst labs, pharmacies, and even physicians.  “We are starting to see it morph into some of the more sophisticated actors, the labs for example … the doctors, people who have corporate veils and attorneys to protect them. And so that’s different from originally, when it was a fly-by-night individual creating mayhem.”

The article states that Aronberg’s office has indicated there will be a new round of arrests within the next 30-45 days, and on an even larger scale than has been seen since the crackdown began in 2016. One of the potential defendants has been characterized in the article as a “real surprise” and another one being “kind of shocking.”

To read the full article, click here”.

Medication Assisted Treatment Deemed Appropriate for Sober Living

Alison Knopf, the award-winning journalist and editor of Alcoholism & Drug Abuse Weekly (ADAW), recently published an article highlighting SAMHSA’s new guidelines for recovery housing, which includes MAT/Medication Assisted Treatment. In her story entitled “SAMHSA guidelines for recovery housing emphasize MAT,” she writes:

If there’s any question about the appropriateness of medication‐assisted treatment (MAT) using methadone and buprenorphine for recovery housing residents, it has been settled by the most recent report from the federal government: Don’t ban it, and, furthermore, do it.
Best practices for operating recovery housing are a key part of the Substance Use‐Disorder Prevention that Promotes Opioid Recovery and Treatment (SUPPORT) Act, under Subtitle D, “Ensuring Access to Quality Sober Living (SEC. 7031).” The law mandates the Department of Health and Human Services to identify or facilitate the development of best practices, and the Substance Abuse and Mental Health Services Administration (SAMHSA) issued this report last week.
The document is focused on MAT for opioid use disorders, because the SUPPORT Act is only for opioid use disorders.
“This document is intended to serve as a guidance tool for states, governing bodies, treatment providers, recovery house operators, and other interested stakeholders to improve the health of their citizens related to substance use issues,” according to the executive summary.
The document constitutes guidelines. There are no provisions for the federal government to enforce or monitor these—except for SAMHSA funding, which can be based on state evaluations and adherence to these guidelines.
This report identifies 10 principles to help define safe, effective and legal recovery housing.
What is recovery housing? It’s not just housing; it’s an intervention that is meant to help a recovering person access a safe and healthy living space “while supplying the requisite recovery and peer supports,” the report states. Under the SUPPORT legislation, it also has to be “free from alcohol and illicit drug use and centered upon peer supports and connection to services that promote sustained recovery from substance use disorders,” according to SAMHSA.

The SAMHSA report, “Recovery Housing: Best Practices and Suggested Guidelines” specifically adopts NARR’s (National Alliance of Recovery Residences) levels of housing and appears to incorporate NARR’s MAT guide, “Helping Recovery Residences Adapt to Support People with Medication-Assisted Recovery”.

It is our hope that one day soon, eventually, the inevitable obvious conclusion will be reached – the recovery “journey” may start with treatment, but sustained recovery and the ability to be free of dependency upon substances takes long-term community support, in a community of fellow peers. For some, this includes both short term and long term use of MAT, depending upon each individual’s chemistry and needs.

But is also begs the question – cities that are effectively banning sober living by creating mandatory spacing requirements are doing so under the guise of preventing a “de facto social service district.”  What is a “de facto social service district?” Who has determined with evidence and study that a concentration of NARR level approved/certified housing is BAD for people in recovery? What if it actually helps, and these spacing requirements (ex. 1,000 feet between each home) actually hinder recovery???

Using the same assumptive reasoning in treatment, the abstinence-only approach has worked in the past, and continues to work for many (though mostly people with Alcohol Use Disorders primarily). Using MAT has a stigma attached to it (rightfully and understandably so) because the thought is that we are merely substituting one drug for another, not forcing the patient to fully confront their inner demons and move to the next level of emotional independence.  But the science says otherwise.

While we also understand that Big Pharma clearly has played a role in having MAT become synonymous with “treatment,” causing many to be suspicious and cynical of these supposed positive outcome studies, the larger picture is the need for recovery residences to learn how to incorporate MAT into their housing policies and procedures because MAT is here to stay.

While some housing providers continue to insist they have the right to deny residency to a patient/client on MAT, legal observers in this niche space have suggested that denying a patient residency because they are on MAT may actually violate the Fair Housing Act (FHA) and the Americans with Disabilities Act (ADA) based upon discrimination of a protected class based upon their medical condition alone.

We have written on this topic for years, and the antagonism between the two sides (for and against) remains strong.  However, there is now more than sufficient evidence and science of the efficacy of using MAT as useful tool to jumpstart many people’s recovery, and to sustain in long into sober living.

Travel Assistance, Patient Financial Responsibility, and Good Intentions

Last week was the annual Moments of Change conference at The Breakers Hotel in Palm Beach. A beautiful venue for a long-running gathering of providers, clinicians, and industry representatives.

The question which I heard most repeatedly asked on the exhibit floor or in breakout sessions pertained to how to assist patients (I don’t call them “clients”) and their families with the exorbitant out of pocket costs of obtaining quality treatment, such as the cost of travel. In many providers’ minds, financial barriers like this should not prevent a patient from obtaining what is essentially life-saving treatment in a community known for its robust treatment community.

As a result of these financial hardships, providers have tried to find a way to facilitate travel from the patient’s location to their programs. This concept of “travel assistance” is quite controversial in the addiction treatment space because, no matter the intention of the provider, if that offer of “travel assistance” was the reason (inducement) for the patient to choose “x” treatment center, then it is very likely that law enforcement will view such assistance as a violation of the Patient Brokering Act.

In our 10 years working specifically with treatment providers, we have been repeatedly presented with this scenario and asked what is lawful. On our end, we have spent countless hours grappling with the need to develop policies and procedures to clarify, identify, and address compliance concerns regarding financial assistance for patients who have a bona fide financial hardship. Our conclusion to date has remained the same: while the law does not explicitly state that payment of airfare is a de facto inducement or violative of the plain language of the laws against patient brokering, and while we have heard and understand the reasoning provided and the procedure used by providers has been limited to very narrow and strict circumstances, the risk to the provider of arrest is simply too great. In other words, you will have to explain it to the jury, while in the meantime, your business reputation has been soiled in the press. If a provider is not going to 100% scholarship a patient, then any other extension of good-faith credit to a patient may be viewed as illegal by regulators and law enforcement.

Fair? Maybe not. Reality? Absolutely yes.

Stated otherwise, even if at no time was it ever a provider’s intention to sway (induce) the decision-making process of any patient to receive treatment services using travel assistance, and even if such travel arrangements were facilitated solely to provide those specific patients identified as having a bona fide financial hardship with reasonable access to critical addiction treatment services, in today’s environment, law enforcement is going to assume a criminal intent is at play based upon the dozens and dozens of arrests (and reviews of business records) that have been made.  It’s simply the “zero tolerance policy” world that we live in today, based upon the atrocities we have seen by the few who care less about patients and only care about profit.

In summary, while extending credit to a patient or their family who has been legitimately verified as not having the ability to pay may not violate the plain language of Florida’s Patient Brokering Act or the federal Eliminating Kickbacks in Recovery Act, the practice remains highly suspect based upon frequent past abuses uncovered by law enforcement. Therefore, a program that engages in such practices continues to expose itself to great liability of criminal penalties, fines, and damage to reputation.

We understand that many providers have as their overwhelmingly singular goal to provide access to those seeking help, recognizing that some are facing dire financial circumstances and may not at that time have the additional financial resources to travel to their chosen treatment provider. Notwithstanding these good intentions, extending credit to patients to facilitate travel costs, even with legitimate and good faith efforts to determine bona fide financial hardship and robust efforts to collect, is considered suspect and potentially violative of the law.  Accordingly, we continue to be unable to support any practice of providing travel assistance to patients in need.  Sad, but true.

We will continue to advocate for any best practice that connects patients with addiction health care providers, recognizing that the overarching policies behind the state and federal health care laws are often in conflict with present-day realities. Even the Centers for Medicare and Medicaid Services (CMS) has recognized this reality and has been vigorously exploring ways to revamp and rewrite these laws to meet 21st century health care delivery. See

But until then, the conservative course must be the one to follow, if addiction medicine is going to ever receive the due recognition it deserves as an integral part of our national health care model.


Harm Reduction – Supervised Injection Sites

A federal judge ruled on Tuesday, October 2, 2019, that a Philadelphia nonprofit group’s plan to open the first site in the U.S. where people can use illegal opioids under medical supervision does not violate federal drug laws, delivering a major setback to Justice Department lawyers who launched a legal challenge to block the facility.

We had previously discussion this issue on on February 8, 2019 (“US Attorney Sues To Stop Supervised Injection Sites in Philadelphia”) as Florida and other states were approving “needle exchange programs” but “safe injection sites” remained objectionable to the US Attorney for the Eastern District of Pennsylvania.

According to NPR:

U.S. District Judge Gerald McHugh ruled Wednesday that Safehouse’s plan to allow people to bring in their own drugs and use them in a medical facility to help combat fatal overdoses does not violate the Controlled Substances Act.

“The ultimate goal of Safehouse’s proposed operation is to reduce drug use, not facilitate it,” McHugh wrote in his opinion, which represents the first legal decision about whether supervised injection sites can be legally permissible under U.S. law.

The decision means that the country’s first supervised injection site, or what advocates call an “overdose prevention site,” can go forward.

Justice Department prosecutors had sued to block the site, calling the proposal “in-your-face illegal activity.”

While local officials from New York to San Francisco praised the decision, the federal government is expected to appeal.

“The Department of Justice remains committed to preventing illegal drug injection sites from opening,” said Bill McSwain, U.S. Attorney for the eastern district of Pennsylvania. “Today’s opinion is merely the first step in a much longer legal process that will play out. This case is obviously far from over.”

Most studies show that the supervised injection sites can drive down fatal overdoses. These sites are credited with restricting the spread of infectious diseases. And advocates say the facilities help move more people into treatment. The American Medical Association has endorsed launching supervised injection site pilot programs.

Ronda Goldfein, who is Safehouse’s vice president and secretary, said winning judicial approval is a major feat for advocates of the proposed site, which also has the backing of top city officials and former Pennsylvania governor Ed Rendell.

“Philadelphia is being devastated. We’ve lost about three people a day” to opioid overdoses, Goldfein said. “And we say we had to do something better and we couldn’t sit back and let that death toll rise. And the court agreed with us.”

Although federal data show that overdose deaths in 2018 dipped for the first time in years, more than 68,000 people died of overdoses in the U.S. last year, and most of the deaths involved opioids. Public health leaders in localities hardest cit by the opioid crisis have been searching for interventions to save more lives, including sites similar to what Safehouse is planning.

Supervised injection sites exist in Canada and Europe, but no such site has gotten legal permission to open in the U.S. Cities like New York, Denver and Seattle have been publicly debating similar proposals, but many were waiting for the outcome of the court battle in Philadelphia.

Attorneys general from Washington, D.C., and seven states including Michigan, New Mexico and Oregon, in addition to city leaders in five cities, urged the court before the decision to rule in favor of Safehouse.

Legal hurdles are not Safehouse’s only obstacles. The facility is planning to launch in the Philadelphia neighborhood of Kensington, which has been ravaged by the opioid crisis, but some neighbors have resisted welcoming an injection site into their community.

Community activist Amanda Fury said the court decision will not change the hardened battle lines over this issue there.

“I’ve never been in the business of trying to change people’s minds on this,” said Fury, who supports the measure but admits that residents are divided.

“I don’t think that’s where we are in this process anymore. I feel like most people have made up their minds, and it’s going to take a lot more to make people see things in a different way,” she said.

In court, meanwhile, prosecutors have contended that the plan violated a provision of the Controlled Substances Act that makes it illegal to own a property where drugs are being used — known as “the crack house statute.” But backers of Safehouse argued the law was outdated and not written to prevent the opening of a medical facility aimed at saving lives in the midst of the opioid crisis.

“We have consistently said we did not have an illegal purpose. We have a lawful purpose. Our purpose is to save lives,” Goldfein said.

On Wednesday, in a move that surprised observers, McHugh agreed. He wrote that there “is no support for the view that Congress meant to criminalize projects such as that proposed by Safehouse.”

McHugh rejected federal prosecutor’s view that this was an open-and-shut case of a proposal clearly violating federal drug statutes. Instead, he noted that the purpose of Safehouse is not to provide a place for people to engage in unlawful activity.

“Viewed objectively, what Safehouse proposes is far closer to the harm reduction strategies expressly endorsed by Congress,” McHugh wrote.

The case is United States of America v. Safehouse, a Pennsylvania nonprofit, and Jeanette Bowles, as Executive Director, Case No. 2:19-cv-00519-GAM, filed in the Eastern District of Pennsylvania.

** Please make sure to “like” our Facebook page to get more recent and up-to-date daily news relating to SUD, treatment, and recovery housing.

DCF Updates Rules Regulating SUD Treatment Providers

Today (technically on 8/9), DCF released its Final Version of the rewrite of the rules regulating treatment providers, found within Chapter 65D-30 of the Florida Administrative Code.

A copy of the Final Rules is attached and is expected to be considered “final” as of 8/29/2019.

We want to give a shout out to attorney Benjamin Hefflinger, Esq., who also represents providers in this space, for running the attached redline comparison so you can see what has changed (and a lot has changed).

My prior commentary and highlights of the rule changes can be found in prior blog posts.

Since this change impacts how a treatment provider conducts its operations going forward, it is strongly suggested that providers work with their in-house licensing consultants/compliance officers to review the changes to make sure you are adequately informed.

This email and all blog posts are not intended to replace legal advice from a Florida licensed attorney and is being offered for informational purposes only.

Click here for “Chapter 65D-30” Click here for “65D-30 (Compared result)”

EMRs and the Sale of Patient Data, Part 1

Amongst all aspects of regulatory compliance as an addiction treatment provider, the privacy and security of Patient Health Information (“PHI”) as well as protecting Patient Identifying Information (“PII”) appears largely misunderstood. The requirement of privacy and security of patient information stem in part from both HIPAA (the “Health Insurance Portability and Accountability Act” of 1996) and the HITECH Act of 2009 (the “Health Information Technology for Economic and Clinical Health Act”), the latter of which was created to motivate the implementation of electronic health records (“EHR”) and supporting technologies to start to be able to data crunch and see a patient’s “whole health” picture before any given physician. [Note: EHRs are the aggregation of health data from a patient; EMR or Electronic Medical Records, are the electronic equivalent to charting within a health care provider’s office.]

A patient’s PHI is more and more regularly kept as an electronic medical record – a single practice’s digital version of a patient’s chart. An EMR contains the patient’s medical history, diagnoses and treatments by a particular physician, nurse practitioner, specialist, dentist, surgeon or clinic.

In contrast, electronic health records are larger data sets, which are aggregations of data from EMRs, designed and intended to be shared with other providers, so authorized users may instantly access a patient’s EHR from across different healthcare providers and platforms.

Within this space of Health Information Management, the governing laws have essentially two main parts: the Privacy Rule, and the Security Rule.

The Privacy Rule addresses what PHI and PII must be protected from unauthorized disclosure The Security Rule essentially discusses the steps that a provider of holder of PHI and PII must take to secure such data, including in its transmission to another authorized party (often what is referred to as a “Business Associate.”). “Patient Identifying Information” includes “the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information.”  Both PHI and PII must be secured and protected.

The Privacy Rule describes the ways in which covered entities can use or disclose PHI, including for research purposes. In general, the Rule allows covered entities to use and disclose PHI for research if authorized to do so by the subject in accordance with the Privacy Rule. In addition, in certain circumstances, the Rule permits covered entities to use and disclose PHI without authorization for certain types of research activities. For example, PHI can be used or disclosed for research if a covered entity obtains documentation that an Institutional Review Board (IRB) or Privacy Board has waived the requirement for authorization or allowed an alteration. The Rule also allows a covered entity to enter into a data use agreement for sharing a limited data set. There are also separate provisions for how PHI can be used or disclosed for activities preparatory to research and for research on decedents’ information.

However, if the data is de-identified, then the data itself is not PHI as a matter of law, and therefore is not protect by HIPAA’s Privacy Rule. PHI excludes health information that is de-identified according to specific standards. Health information that is de-identified can be used and disclosed by a covered entity without authorization or any other permission specified in the Privacy Rule.

De-identified patient data is health information from a medical record that has been stripped of all “direct identifiers”—that is, all information that can be used to identify the patient from whose medical record the health information was derived. According to the Health Insurance Portability and Accountability Act (HIPAA), there are 18 direct identifiers that are typically present in patient medical records. These include: Names; Geographic subdivisions smaller than a state (e.g. street address, city and ZIP code); All dates that are related to an individual (e.g., date of birth, admission); Telephone numbers; Fax numbers; Email addresses; Social Security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; Certificate/license numbers; Vehicle identifiers and serial numbers, including license plate numbers;  Device identifiers and serial numbers; Web universal locators (URLs); IP address numbers; Biometric identifiers such as fingerprints and voice prints; Full-face photographic images; and Other unique identifying numbers, characteristics or codes.

According to HIPAA, there are 3 acceptable ways to de-identify patient data. The first is the “safe harbor” option, in which all 18 identifiers are removed. The second is the “statistical” option, in which a retained statistician determines which of the 18 identifiers can be maintained without creating greater than a “very small” risk that the data could be re-identified. The third is the “limited data set” technique, in which the organization removes 16 identifiers and protects what remains with special security precautions.

As a result, both PHI and de-identified health data has been lawfully used for years to help find medical breakthroughs, improve care, estimate the costs of care, and support public health initiatives.

More recently, “big data” companies like Google, Amazon and Apple have been getting into the health care data space. Back in 2016, Google partnered with England’s NHS using Google’s “Deep Mind” subsidiary which was granted access to medical records on 1.6 million patients who had been treated at some time by three major hospitals. The purpose of this data mining was a joint effort between Google and the Royal Free NHS Trust to develop a diagnostic app for detecting acute kidney injury. (see,

However, if one can de-identify the information, meaning, remove those aspects of a chart or file or data set that contains PII, then the rules governing privacy and security effectively go away.

So why does this matter?

This begins the brief discussion of this post – the massive unground economy which has evolved around the brokering of de-identified PII and PHI to third-parties.

“Why would anyone pay for that,” you ask?

The offspring of that evolution in medical data brokering and big number crunching is a not-so-new economy that is using your health care data, and that of your patients, for profit.

One of the most prolific writers and outspoken critics of this underground economy of medical data brokering is Adam Tanner, a fellow at Harvard University’s Institute for Quantitative Social Science and author of “What Stays in Vegas: The World of Personal Data — Lifeblood of Big Business — and the End of Privacy as We Know It” and “Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records.”  According to an interview Tanner gave to Time Magazine in 2017, “prescription records, blood tests, doctors’ notes, hospital visits and insurance records are all sold to commercial companies, which gather years of health information on hundreds of millions of people,” which de-identified data is then sold to various entities including insurance companies, researchers, and you guessed it, Big Pharma.

In a comprehensive article published in Scientific American written by Adam Tanner, he summarizes it best:

“Health researchers are not the only ones, however, who collect and analyze medical data over long periods. A growing number of companies specialize in gathering longitudinal information from hundreds of millions of hospitals’ and doctors’ records, as well as from prescription and insurance claims and laboratory tests. Pooling all these data turns them into a valuable commodity. Other businesses are willing to pay for the insights that they can glean from such collections to guide their investments in the pharmaceutical industry, for example, or more precisely tailor an advertising campaign promoting a new drug.”

How much are they willing to spend? reported back on May 8, 2019, that the EMR market alone is growing at 6% annually, now topping $31 billion dollars annually.  Within the EMR economy is the recognition that Big Pharma has been willing to pay big bucks for EMR vendor data, such as prescriber habits, outcomes-related data, or connecting the e-prescribing function with copay and formulary data.  Pfizer is on record as stating that, as of 2016, it was spending $12 million dollars annually to acquire anonymized health data.

In addiction medicine, this sharing of information is very important amongst researchers to begin to find long-term cures to heal the addicted brain. For insurance carriers, it may become a source to help identify effective “evidence based outcomes” and modalties.  For Big Pharma, they want to follow who is prescribing MAT (and who is not) to get everyone on their latest and greatest magic pills.

So the takeaway question is this – if you are a health care provider/addiction treatment center, do you know what’s going on with your patient health data you are uploading to your EMR?  And equally important, is your EMR legally selling your acquired data, and then cutting you out?  What about the patients? Who are the “brokers” in this space?

On this point (and a topic of future blog posts on this subject), most states including Florida had adopted laws which provide that such patient data is owned by the health care provider, not the patient (and thus, not the EMR either).

So is your EMR provider controlling or even selling your patients’ data, without your knowledge or consent? And if so, to who, and why?

Thanks again for reading, and please “Like” our Facebook page where we share daily news articles of interest.

Prosecutors bring rare criminal charges against Ohio opioid distributor

Federal prosecutors in Cincinnati filed criminal charges Wednesday against an opioid distributor and two of its top former officers, including its Compliance Officer, accusing them of conspiring with doctors and pharmacies to pour millions of addictive pain pills into Ohio, West Virginia and Kentucky.

The indictment of Miami-Luken, its former president and its former compliance officer was the second time in three months that federal prosecutors have used criminal laws against a drug distributor in their efforts to stem the prescription opioid epidemic. That is a more aggressive posture than the Justice Department has used since 2007, when it began using civil and administrative actions to enforce laws against drug distributors.

“There’s a need, in my opinion, to devote sufficient charges right here and now to stop the dying,” U.S. Attorney Benjamin C. Glassman said about why the agency used criminal statutes. “We have to devote the resources to cut off the supply of the drugs, whether it’s synthetics or it’s prescription opioids or both.”

In April, we also reported that the U.S. attorney in New York brought criminal charges against Rochester Drug Cooperative, another opioid distributor, in the first use of that tactic against a middleman in the drug supply chain.

Many will recall that a 2017 “60 Minutes” report uncovered that DEA investigators wanted criminal charges filed against executives of the largest drug distributor in the United States, McKesson Corp., after they built a case against the firm alleging violations in nine parts of the country. But they were rebuffed by federal prosecutors and the Justice Department, which settled with the company and fined it $150 million.

Read more here.

DCF Releases Further Changes to Treatment Regulations in 65D-30

On June 25, 2019, the Florida Department of Children and Families (DCF) released its latest “Notice of Change” relating to further proposed and revised revisions Chapter 65D-30 of the Florida Administrative Code. These rules govern the licensure, management, regulation, as well as service delivery of care relating to Substance Use Disorders.

DCF first issued its “Notice of Proposed Rules” in December 2017 and held live and video-conferenced public hearings across the state to take public input. This rule re-write was based upon a mandate by the Florida Legislature in 2017.

Since that time, there have been two (2) proposed changes or revisions; one published in October 2018, and now the one published just last week.

Understanding the changes are difficult at best as the 2018 and 2019 revisions to the 2017 proposal are not drafted as a redline of the currently enacted rules (pre-2017 version). There is a lot of back-and-forth cross-referencing required to try to piecemeal the entire thing together. It is a very time-consuming and laborious task that may cause even the most astute reader (or lawyer) to simply throw up their hands (or, simply just throw up).

We are currently unaware of when a hearing on the proposed changes may take place.  For clients who are interested in knowing more, please contact us so that we can work with you on this very important matter.

Below are a few comments on items that we gleaned from the current 2019 proposed revisions. This information is intended simply to make the reader aware of the proposed changes and is not intended to be an analysis of the proposed changes or to be a substitute for clinical, compliance and/or legal counsel to determine the impact any of these proposed changes may have upon ownership, management, operations and service delivery.

Please also note that further revisions to the proposed rule changes beyond the June 25, 2019 version may occur as a result of the recent adoption of HB 369 (2019), signed by the Governor on June 28, 2019, and codified as Chapter 2019-159, Laws of Florida, particularly with regard to expanded Level 2 background screenings as well as the new, revised exemption from disqualification application process and categories, and mandatory timeframes that DCF must now follow.

  • Definition of “Best Practices” –Proposed Rule 65D-30.004(1) continues to mandate all administrative and clinical services now must align with “current best practices,” defined to mean: “the combination of specific treatments, related services, organizational and administrative principles, core competencies, or social values designed to most effectively benefit the individuals served.  Best Practices also include evidence-based practice, which is subject to scientific evaluation for effectiveness and efficacy.  Best Practice standards may be established by entities such as the Substance Abuse and Mental Health Services Administration, national trade associations, accrediting organizations recognized by the Department, or comparable authorities in substance use treatment.”
  • Change of Ownership/Transfer of Licensure –  Proposed Rule 65D-30.0034 is dedicated to the topic of “Change in Status of License.” The 2019 revision offers a further change to what was proposed in 2018 to align with the statute and clarifies that a “change of ownership” occurs when greater than 50% of ownership, shares, membership, or controlling interest of a licensee is in any manner transferred or otherwise assigned.  The 2018 version had stated “51%.”  A change in ownership of less than a majority of the ownership interest in a licensed entity is proposed to only require submittal of a local and Level 2 background check.
  • Clinical Supervisor – The proposed definition seeks to track recent amendments to Florida Statutes and states: “Clinical Supervisor” means a person that manages personnel who provide direct clinical services, or a person who maintains lead responsibility for the overall coordination and provision of clinical services. A “Clinical Supervisor” shall meet the qualifications of a “Qualified Professional” as defined in s. 397.311(34), F.S. For the purposes of this Rule Chapter a Clinical Director is considered a Clinical Supervisor.”
  • License Applications and Renewals –Proposed Rule 65D-30.0036 (“License Application and Renewals”) made some new additions, updated further in the recent 2019 version. Some key takeaways are:
    • Applications require proof of compliance for all licensed facilities, including community housing, with local health, fire, and safety inspections. This seems to be an attempt to eliminate the use of private fire inspectors.
    • In addition to the CEO, now CFOs and Clinical Supervisors must also provide information on their competency and ability to fulfill their roles and compliance with the rules, “including education, previous employment history, and list of references.”
  • Self-Administrative of Medication in Community Housing – within Rule 65D-30.004(7) under “Medical Services” is new language requiring specific standards and criteria for supervision of the self-administration of medicine within a Community Residence setting under a PHP license.  The rule mirrors the same requirements as in clinical settings.
  • Violations and Penalties – Proposed Rule 65D-30.0038 entitled “Violations; Imposition of Administrative Fines; Grounds” adopts statutory penalties enacted in 2017; this 2019 proposed revision to the rule emphasizes that it shall be deemed unlawful to: (i) operate a service without a license; and (ii) fail to inform DCF of a change of ownership within the specified timeframe [5 business days]. These omissions will now incur additionally penalties and fines.
  • Medical Directors & Number of Facilities – DCF has endeavored to try to create a methodology for determining the maximum number of individuals a Medical Director may serve (noting that a “medical director” is only still required for addiction receiving facilities; detoxifications; intensive inpatient treatment; residential treatment; and methadone medication-assisted treatment). This methodology, found within revised Rule 65D-30.004 (“Common Licensing Standards”), subsection (6), breaks down the maximum number of patients that can be under a single Medical Director’s supervision in a chart format, based upon license type.  However, a Medical Director is still not required for outpatient services.
  • Critical Incident Reporting –DCF has attempted to incorporate into rule the IRAS critical incident reporting tool, CFOP 215-6, for ease of reference. Mandatory reporting must now occur within 24 hours of the incident occurring, different than the existing language of “one (1) business day” and continues to include: “Events regarding individuals receiving services or providers that have led to or may lead to media reports.”
  • Delivery of Clinical Services – Proposed Rule 65D-30.0046 entitled “Staff Training, Qualifications, and Scope of Practice” appears to continue to require that all clinical services now be provided by either the Qualified Professional or by persons with specific degrees or recognized certifications.  It remains UNCLEAR however, whether non-clinical staff may still continue to provide therapy and counseling, as well as the new “recovery support services”; “crisis intervention” and “counseling with families, couples, and significant others” even when working “directly under the supervision of a qualified professional.”  It seems that only certain persons may now provide such “counseling services” and includes, but is not limited to: (i) persons with a bachelor’s or master’s degree with a major in a relevant field; (ii) certified addiction professionals, certified by the Florida Certification Board; and (ii) certified addiction counselors, also certified by FCB.
  • Day or Night Treatment with Community Housing (PHP) Licenses – Proposed revisions to Rule 65D-30.0081 states: “The housing must be provided and managed by the licensed service provider, including room and board and any ancillary services needed, such as supervision, transportation and meals.”  This is in response to inquiries as to whether third-parties may provide such Community Housing. What remains unclear is how this is to be implemented. At a minimum, it would seem the treatment center must be the primary tenant on any lease, even if ownership is the same.
  • Residential Treatment – Rule 65D-30.007 is proposed for significant overhaul going back to the original 2017 version of the rules and carrying over into the 2018 revisions (the recent 2019 amendments left the 2018 changes in place). DCF seeks to restructure Residential Level 1 into “Adult Level 1” and “Adolescent Level 1” and does the same with Level 2 programs. DCF continues to seek to eliminate Residential Level 5 programs (we were hoping they would reverse course in the 2019 version based upon overwhelming opposition from providers). It remains to be seen how this will be resolved, such as whether these licenses will be “grandfathered in” particularly in instances where DCF was directly involved in assisting with obtaining the Res. 5 approval to meet nuanced (i.e. discriminatory) local zoning requirements that did not otherwise allow inpatient treatment in their cities.

Again, this information is intended simply to make the reader aware of the proposed changes and is not intended to be an analysis of the proposed changes or to be a substitute for clinical, compliance and/or legal counsel to determine the impact any of these proposed changes may have upon ownership, management, operations and service delivery.

The proposed rule changes are not final and still must go through a process for final adoption.

If you have received this post from someone else and are not a subscriber to our newsletter, please make sure to sign up at, where you can also find other articles, editorials, and commentary of interest.

Click here to find out more

What the New DOJ Compliance Program Guidance Means to Health Care

By Michael W. Peregrine, McDermott Will & Emery LLP;  Katherine Lauer, Latham & Watkins LLP; and Tony Maida, McDermott Will & Emery LLP

Original written for, and published by, the American Health Lawyers Association, May 10, 2019

[Editor’s Note: With the adoption of the SUPPORT Act of 2018 and its inclusion of the “Eliminating Kickbacks in Recovery Act” which now expands federal jurisdiction in the SUD treatment regulatory space to private-pay providers as well, it is far past time for licensed service providers to begin to take very seriously the development of an effective compliance program, consistent with US Department of Justice Guidelines, in order to both mitigate risk, as well as to be able to identify new risk quickly and effectively when it arises.]

The health care compliance industry recently received a new addition to the compliance program guidance library that continues the discussion of the government’s viewpoint on measuring compliance program effectiveness.

The guidance document, entitled “The Evaluation of Corporate Compliance Programs,” was issued by the Department of Justice (DOJ) Criminal Division on April 30, 2019, updating a prior version issued by the Criminal Division’s Fraud Section in February 2017. Ten pages longer than the 2017 version—many of the revisions provide additional context to how DOJ expects prosecutors to analyze a company’s compliance program, while also harmonizing the guidance with other Department guidance and standards.

The 2019 version stresses the adequacy—rather than the simple existence—of a corporation’s compliance program. Whether the organization had any compliance program at the time the misconduct occurred, and the quality of the program, affects the resulting (a) form of any resolution or prosecution; (b) monetary penalty, if any; and (c) compliance obligations contained in any corporate criminal resolution. Prosecutors are instructed to consider whether the compliance program has been tested and proven to prevent or detect misconduct, and whether simple changes and improvements could correct the misconduct that gave rise to the legal issue.

The new guidance document discusses in detail the three main thematic questions that prosecutors should use in evaluating corporate compliance programs: (1) whether the program is well-designed; (2) whether the program has been applied earnestly and in good faith (in other words, effectively implemented); and (3) whether the program actually works in practice. DOJ dispensed with the 2017 document’s structure, moving from a series of questions about the characteristics of a compliance program into a discussion of how these three main thematic questions can be used to draw out information to show that the compliance program is adequate and effective.

Part I: Design

DOJ first examines the compliance program’s design as the starting point for an effectiveness review. One hallmark of a well-designed compliance program is whether the program’s risk assessment program is designed to detect the particular types of misconduct most likely to occur in the company’s line of business and whether that risk assessment is updated periodically. This approach acknowledges that compliance programs need to prioritize risks to properly focus time and resources to the risks that pose greater importance to the business than other, possible, but less likely risks. Much of DOJ’s further discussion of risk assessment and program design keys off of this concept:

  • Policies and procedures—DOJ looks at company policies and procedures for content addressing risks and showing a commitment to a culture of compliance and ethics.
  • Training and communications—Here, DOJ examines whether the program is being disseminated to, and understood by, employees in practice in order to decide whether the compliance program is truly effective, including providing appropriate resources for guidance.
  • Confidential reporting structure and investigation process—DOJ’s review will examine whether the program provides an efficient and trusted mechanism by which employees can anonymously and confidentially report allegations of a breach of the code of conduct, a company policy, or suspected/actual misconduct, as well as an efficient and effective investigation response.
  • Third party management—DOJ will ask whether the program applies risk-based due diligence to vet its third-party relationships, with a focus ranging from specificity of contract terms to the third-party’s reputation.

M&A—Finally, DOJ reviews whether the program ensures comprehensive due diligence of any acquisition targets.

The main lesson from this discussion is DOJ’s focus on the effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment. DOJ expects that an effective compliance program evolves over time as new risks emerge and as the company develops new strategies to address them. The new focus on M&A diligence reflects a pattern that DOJ has seen time and again—those situations where a new owner finds itself saddled with ongoing compliance issues, and the attending liability, when its diligence activities have been insufficient to identify historical non-compliance.

Part II: Implementation

DOJ next moves to discussing the features of effective implementation of a compliance program, including commitment by senior and middle management, autonomy and resources, and incentives and disciplinary measures. Helpfully, DOJ continues to acknowledge that there is no “one size fits all” for compliance program structure and consequent implementation, but that these decisions depend on the size, structure, and risk profile of the particular company. The implementation discussion includes:

Commitment by senior and middle management—Consistent with all of DOJ’s statements on individual accountability (e.g., Yates Memo), DOJ unsurprisingly scrutinizes whether the company’s leadership fosters a culture of ethics and compliance with the law and demonstrates a personal, shared commitment to compliance.

Autonomy and resources—A longstanding issue for the government’s examination of program effectiveness is whether the program gives adequate authority and stature to those charged with day-to-day oversight.
Incentives and disciplinary measures—Another longstanding government concern is whether the program establishes incentives for compliance and disincentives for non-compliance, including clear disciplinary procedures, with a focus on consistency.

A key takeaway from the implementation discussion is a focus on “tone at the top” and other indications of support for the compliance program from gatekeepers, executive leadership, and the board. DOJ will look not only at what senior management says, but at how senior management treats compliance professionals. A company that gives lip service to compliance, but denies its compliance professionals the title, authority, and resources necessary to effectively implement the program will not be viewed favorably.

Part III: Actual Operation

Finally, DOJ ends its thematic analysis with metrics for asking whether the compliance program is in fact operating effectively. Importantly, DOJ acknowledges the fact that some misconduct occurred does not necessarily mean that the compliance program is ineffective. However, consistent with long-held views of the Department of Health and Human Services Office of Inspector General, detection, remediation, and resolution of misconduct is described as an important sign that the compliance program is effective.

Continuous improvement, periodic testing, and review—DOJ’s review concerns whether the program has the capacity to improve and evolve with changes in company business and the environment within which it operates, including whether the company makes meaningful efforts to review its compliance program and ensure it does not lose strength.

Investigation of misconduct—DOJ articulates a strong focus on whether the program has a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents that includes meaningful documentation.

Analysis and remediation of any underlying conduct—Another traditional area for government examination is whether the company is able to conduct a root cause analysis of misconduct and timely and appropriately remediate to address the root causes.

DOJ’s main message with this factor is a strong focus on how the company both detects misconduct and responds to situations in which misconduct is detected. Once again, DOJ focuses on the need for a compliance program to adapt to new risks and develop new controls as the business environment changes. And once again there is a strong message from DOJ that a compliance program must be sufficiently resourced so that the company can effectively and rigorously investigate alleged misconduct.


Given all the risks health care companies face in operating in a highly regulated environment, a well-functioning and effective compliance program is a critical component of a company’s risk management strategy. DOJ’s revised guidance shows DOJ has a consistent view of the importance of an effective and highly functioning compliance program. Health system boards, executive teams, and the compliance and other departments would be well served to review and implement the key takeaways and messages from the revised guidance.

Mr. Peregrine and Mr. Maida are partners in the law firm of McDermott Will & Emery, and Ms. Lauer is a partner in the law firm of Latham & Watkins.