OCR Issues Guidance on Visitation Discrimination
in Hospitals and Long Term Care Facilities

By: Angie C. Smith, Burr & Forman LLP

Visitation in long-term care facilities and hospitals received a lot of attention during COVID
because of facility closures that led to limited visitation, and it is now a topic of interest for the
Office of Civil Rights (OCR) due to discrimination concerns. On January 25, 2024, OCR issued
guidance to hospitals and long-term care facilities to clarify obligations of those providers to
ensure religious non-discrimination for patient visitation.

Under federal law, hospitals, long-term care facilities, and critical access hospitals are prohibited
from restricting, denying or in any way limiting visitation to patients on the basis of race, color,
national origin, religion, sex, gender identity, sexual orientation, or disability. Additionally,
provisions of the Affordable Care Act and Section 504 of the Rehabilitation Act prohibit any
type of discrimination in certain federally funded programs and activities. In order to be in
compliance, providers are required to have policies and procedures to prohibit discrimination. In
fact, when becoming a Medicare provider, healthcare providers certify to the federal
government that they are in compliance with these non-discrimination laws.
Although the Centers for Medicare and Medicaid Services (CMS) is the agency that oversees
compliance with the regulations cited above, CMS has delegated its authority to enforce the
regulations pertaining to discrimination in visitation to OCR. Following this delegation, OCR
issued a set of frequently asked questions (FAQs) to serve as guidance for hospitals and long-term care facilities. Additionally, OCR held a call with stakeholders on February 6, 2023, to
further discuss its guidance. Below are the key topics covered by OCR.

1. What constitutes visitation?
   The FAQ states that patients and residents have the right to receive visitors of
   their choosing, but it also noted that patients and residents can withdraw or deny
   consent to any visitor. A visitor includes, but is not limited to, a spouse or
   domestic partner, same-sex spouse or domestic partner, another family member or
   friend, and clergy minister or other faith leader.
   The guidance also reminds providers of their obligations to allow individuals with
   disabilities access to support persons, which is separate and apart from an
   individual’s right to visitors.
2. Which facilities are covered by the visitation requirements?
   The guidance specifically references the regulations pertaining to hospitals,
   including critical access hospitals, and long-term care facilities, but it also
   referenced federal non-discrimination laws that apply to all entities receiving
   federal funding. Those laws prohibit entities receiving federal assistance from
   excluding an individual from participating in, denying an individual the benefits
   of, or otherwise discriminating against an individual in the entity’s programs and
   activities. Therefore, even those providers who may not be covered by the
   visitation requirements should review the guidance.
3. Which patients are covered by these rights?
   Patients and residents protected by the visitation rights are not limited to Medicare
   and Medicaid beneficiaries. All patients or residents receiving services from
   Medicare and Medicaid-certified facilities are covered by this guidance, and the
   right to visitation and non-discrimination applies to all patients and residents,
   regardless of whether their hospitalization or residency is being paid for by
   Medicare or Medicaid.
4. What are the notification obligations of the facilities?
   Hospitals and long-term care facilities are required to inform patients and
   residents of their visitation rights, which should include any information related to
   clinical limitations or restrictions on such visitation. These providers must also
   have written policies and procedures related to visitation that include any
   clinically necessary or reasonable restriction or limitation that the provider may
   need to place on the visitation rights of a patient and the reasons that would
   support clinical restrictions or limitations.
   As mentioned above, OCR recognizes that there may be clinical reasons that
   visitation with a patient must be restricted or limited, and OCR’s FAQs make it
   clear that any such restriction or limitation must be “clinically necessary” or
   “otherwise reasonable.” Examples provided were limiting visitation hours or the
   number of visitors at a time. However, it is important that any type of limitation
   or restriction be objective and not based on any stereotype or assumption. It
   should also be clearly outlined in the facility’s policies related to visitation.
   OCR states in the FAQs that a provider has a responsibility to provide auxiliary
   aids and services to individuals with a disability in order to provide equal
   opportunity to participate or benefit from the services provided, which would
   include the ability to have visitation. According to the FAQs, a policy that only
   allows for video remote interpretation instead of in-person interpreter “may
   violate” certain non-discrimination laws, if an in-person interpreter or reader is
   necessary for effective communication.
5. What might constitute a discriminatory denial of visitation?
   If a policy or procedure subjects certain classes of visitors to additional screening
   or if it prohibits certain classes of visitors and not others on the basis of race,
   color, national origin, religion, sex, gender identity, sexual orientation, or
   disability. Examples given were as follows:
   1. Facility prevented family member from bringing patients kosher food or
      halal food to meet the patient’s religious dietary restrictions while
      allowing other visitors to bring non-religious food items to patients.
   2. Members of certain religious groups subjected to more rigorous screening
      or denied visitation.
   3. Policies that would prohibit clergy or religious leaders from meeting with the patient.

6. Does a facility’s chaplain program affect the right to visitation by other faith
   leaders? Even if the facility has a chaplaincy program, it must still allow other types of religious or faith leaders to visit patients, if the patient requests such visitation. Likewise, a facility must abide by a patient’s choice to deny visitation to clergy or religious leaders.

Conclusion/Takeway
Typically, when OCR issues guidance on a particular topic, we see corresponding scrutiny from
regulators and government enforcement agencies. Therefore, providers should take this
opportunity to review its visitation policies for compliance with the guidance and ensure staff are
educated on those policies.

OCR’s FAQs can be found here.
https://www.hhs.gov/civil-rights/for-individuals/special-topics/emergency-preparedness/faqs- patient-visitation/index.html?cm_ven=ExactTarget&cm_cat=HHS+Office+for+Civil+Rights+Releases+ Visitation+Guidance+Resources&cm_pla=Mark%27s+Memos+2024+Marketing+List&cm_ite= FAQ+on+Patient+Visitation+at+Certain+Federally+Funded+Entities+and+Facilities%e2%80%8 b&cm_lm=1612414245&cm_ainfo=&&&&&

Angie Smith is a Partner at Burr & Forman LLP practicing exclusively in the Healthcare
Practice Group. Kelli may be reached at (205) 458-5209 or acsmith@burr.com.

Cyber-attacks on the Rise (Once Again…)

By: Kelli C. Fleming, Esq., Burr & Forman

Cyber-attacks within the healthcare industry are continuing to rise, despite increased awareness, security measures, and training. The attacks are not only becoming more far-reaching, with each attack impacting more and more patient data, but are also more prevalent as well. Threat actors do not discriminate against victims, as we are seeing reports of security breaches against physician practices, rural hospitals, large hospital chains, as well as their business associate vendors and contractors.

At the time of drafting this article, we are only ten days into 2024, and in 2024 thus far, five breach reports have been published by the Office for Civil Rights (“OCR”) for incidents involving more than 500 individuals. The total number of individuals impacted as a result of those five instances is over 585,000. Of those five reports, four of them deal with hacking/IT incidents on a network server. Of the entities reporting, one is a health plan, two are healthcare providers (hospital and long-term care provider), and two are business associates. 

Partly as a result of this rise in cyberattacks against the healthcare industry, the Department of Health and Human Services (“HHS”) recently announced plans to increase federal funding to assist providers with training and implementing cyber-security protections. The plans also include increased fines for facilities that do not have adequate cyber-security measures in place. While the plans are in the early stages, and require additional funding and coordination among government entities, it is encouraging to see the government recognize that additional assistance is needed by the healthcare industry to thwart attacks. Providers are encouraged to monitor any guidance and assistance issued by HHS in this regard. 

In addition, OCR publishes cyber-security guidance as well as a cyber-security quarterly newsletter to help HIPAA-covered entities, including providers, to remain in compliance. The guidance and the quarterly newsletters contain helpful tips on ways to reduce the risk of a security breach. The guidance and newsletters are available at https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html. Providers are encouraged to review this guidance for helpful information on measures they can implement to reduce the risk of a cyber-attack. 

Kelli Fleming is a Partner at Burr & Forman LLP practicing exclusively in the Healthcare Practice Group. Kelli may be reached at (205) 458-5429 or kfleming@burr.com.

Updated: Remote Patient Monitoring

This article is an update to “Remote Patient Monitoring” published in the Fall 2023 edition
of the Alabama Medicine Magazine. The U.S. Department of Health and Human Services Office
of the Inspector General (“OIG”) issued a Consumer Fraud Alert related to Remote Patient
Monitoring (“RPM”) on November 21, 2023. This alert provided insight into RPM practices
subject to scrutiny by OIG.

OIG indicated that legitimate RPM includes the use of medical devices like scales, glucose
monitors, blood pressure cuffs, cardiac rhythm devices, and other like equipment to continuously
monitor patients with chronic conditions for medical anomalies within the comfort of the patient’s
home. However, there must be a medical necessity for such services for bills submitted
for RPM services to withstand enforcement scrutiny from OIG. Accordingly, to minimize the risk
of enforcement actions, providers should ensure that the need for such services is present before
setting up a patient with an RPM device.

Additionally, OIG indicated that fraudulent use of RPM occurs where billing is submitted
for set-up, patient teaching, and monthly monitoring of data and the RPM equipment does not meet
the statutory standards. For example, fraudulent RPM billing occurs when bills are submitted for
RPM services, but RPM equipment either (i) is not sent to the patient or (ii) is sent, but is not FDA-approved. Providers should be sure that all equipment provided to their patients meets the requisite
requirements for FDA approval before submitting bills for RPM services. Additionally, providers
should ensure that patients have RPM equipment and appropriately use the equipment to meet
coding requirements before billing for any RPM services provided.

When setting up RPM services, OIG has addressed some suspect characteristics of RPM
that providers should consider. These characteristics include (i) signing patients up for RPM
services through call centers; and (ii) failing to include necessary patient consents for RPM
services in patient files. With these characteristics in mind, there are steps that providers can take
to lessen the risk of scrutiny from OIG. First, providers should be sure to maintain policies and
procedures to ensure that the proper documentation of patient consents is kept in appropriate files.
Additionally, as a best practice, providers should only set up RPM services after establishing a
patient-provider relationship, and avoid, to the extent possible, using call centers to set up RPM
services for patients.