Patient Notification Requirements When Medical Practices Merge or are Acquired

When physicians merge their practices or one practice acquires another practice, the doctors need to remember that the patient comes first – not their profits. Agreements to buy, sell, or transfer medical practices require that the patients be informed when the merger or sale will take place so the patients can make informed decisions about which physician (doctors from their old practice, the new practice, or another practice altogether) they will select for their medical care. The patients need to be notified with plenty of time to make an informed decision.

Patients also need to be notified about the purchase, sale, or merger of a medical practice so the patients (and not the medical practice) can decide how their medical records should be handled. Specifically, both participants in the merger or acquisition of a medical practice need to understand the requirements for compliance with the Health Insurance Portability and Accountability Act (HIPAA) with regard to the transfer of files and patient consent and other patient information privacy laws.

We’ve written about the notification and consent requirements before – in the context of closing, selling, or leaving a medical practice. Leaving a practice can include one physician retiring. Leaving can also include allowing a managed service organization (MSO) or a telemedicine company to continue marketing the practice.

This article focuses on the notification requirements for mergers and acquisitions – although many of the concerns are the same as the concerns about closing, selling, or leaving a practice.

The notification requirement – the right of patients to choose a doctor.

Federal and state laws require that patients be informed of the merger or sale of a medical practice so the patients can decide whether to stay with the merged practice, the new practice, or choose another healthcare provider. There are many factors that may determine which doctor a patient wants to provide medical care for the patient. Some of these factors are:

• Will the doctor who has been treating the patient have the right to see the same patient?
• Will the patient’s insurance pay for the patient’s medical care after the business transaction (the merger or acquisition) is completed?
• Where will the offices of the medical providers be located? A change in location is a common reason for selecting a new doctor.
• What specialists will work for the merged or acquired practice?
• What hospital affiliations will the merged or acquired practice have?

Patients are likely to have many other questions based on their current and past medical conditions, their family history, and other factors.

The notification requirement – the right of patients to determine how their medical records are handled

Patients must be informed and have the ability to decide what should be done with their medical records. HIPAA requires that patients be informed and consent to any transfer of the patient’s electronic health information. Other consumer laws generally require that patients have the right to control who can see any part of the medical record file. The medical practices that are merging, buying, or selling should never assume that the practice can just keep the medical records or transfer the records to the new practice. The patient must consent to the continued use or to the transfer.

While these notification requirements may delay the transaction, medical practices need to know that violations of federal and state laws may result in severe penalties and ethical complaints.

Legal and practical considerations when determining when and how to notify patients of a sale or an acquisition

The parties to the business transaction need to consider:

• How will the medical records be stored while the responses from the patients to the notification are pending?
• How should the notification issues be negotiated and be made part of the merger or acquisition contract?
  • Sometimes, the medical practices may “mutually designate a custodian for the practice’s medical records, and then that custodian will sign a business associate agreement under which the custodian agrees to comply with HIPAA.”
  • HIPAA does have specific policies and procedures for the retention of patient medical records and authorizations. Other states, such as California, have their own retention requirements.
  • We also advise medical practices who decide to use an MSO to hold on to the medical records while patients are deciding how the records should be handled and after the transaction is completed. Our advice includes addressing HIPAA compliance requirements and the requirements of the California Medical Board or other state medical boards.
• Identify who will be responsible for integrating the medical records of the two medical practices
• Have safety and backup plans to ensure the security of the medical records
• Consider using a HIPAA-business associate agreement to handle protected patient information during the consolidation or transfer of the medical practice.

Other agreements and terms may be required depending on the complexities of the merger or acquisition.

Physicians and medical practitioners who fail to notify a client/patient may be found to have abandoned that client.

Generally, the medical practices involved in the merger or acquisition should:

• Notify the patient well enough in advance of the merger or acquisition by certified mail, return receipt requested, about the transaction and the effective date of the merger or acquisition.
• Notify patients where their records will be stored and how the patient can access their records.
• Provide authorization/consent to transfer the medical records.

Experienced healthcare lawyers can help explain when patients are considered “active” and when patients are “inactive.” The duty to give notice and the terms of the notice may vary depending on whether the patient is active or inactive. Active vs. inactive generally refers to the last time the patient met with the doctor.

Federal and state medical associations such as the American Medical Association may provide guidance on notification requirements and medical record ownership and access when medical practices merge or one medical practice acquires another medical practice.

HIPAA and the disclosure or transfer of patient records

As we wrote previously:

If HIPAA applies, then, we start with 45 CFR 164.508(a)(1), which states that except as otherwise permitted or required, a covered entity (i.e., an MD) “may not use or disclose protected health information [(“PHI”)] without an authorization that is valid under this section.” The authorization must contain the core elements and requirement statements specified in 45 CFR 165.508(c) and must be in plain language, and a copy must be provided to the patient.

There are some exceptions to the use or disclosure of patient information under HIPAA. The exceptions cover such issues as payment for services, the type of treatment, the relationship between the patient’s doctor and another covered entity who may see or use the medical information, issues of fraud, and other exceptions. For example, a doctor generally can provide medical information about a patient to a specialist that the doctor works with and that the patient agrees to see for treatment.

Generally, California’s laws regarding the privacy of patient information are stricter than HIPAA. We’ll explain the differences between California law and HIPAA and how the differences apply to the merger or acquisition.

Other notification compliance laws

Other laws that may regulate patient notification requirements when medical practices merge or there is an acquisition include:

• The California Consumer Privacy Act
• The Confidentiality of Medical Information Act – a California law
• The Health Information Technology for Economic and Clinical Health Act (HITECH)

Medical practices that merge with another practice or acquire another practice need to protect the rights and records of their patients. Patients should be informed before the transaction is complete that the patients have the right to decide which doctor will care for them – whether it’s their current doctor, a new doctor in the merged or acquired practice, or a doctor outside of the practices involved in the transaction. Patients also have the right to decide how their medical records and electronic patient information will be used and disclosed. The medical practices involved in a merger or acquisition must comply with federal and state regulations to ensure that the notices are timely, legally compliant, and inform and protect their patients.

Physicians and medical practices should contact Cohen Healthcare Law Group to discuss their duty to notify patients about mergers and acquisitions of medical practices. Our experienced healthcare attorneys advise doctors, medical practices, and MSOs about healthcare compliance laws and regulations.