Spouse-Owned PT Clinic, a Subpoena Without Authorization, and a Stolen Laptop
Dr. Patel is a 50% owner of a six-physician orthopedic group. His wife owns 60% of a standalone physical therapy clinic three miles away; the clinic is a separate entity, not owned by the group, and not located in the group's office. Dr. Patel refers about 15 patients per month for post-operative PT, and the clinic bills Medicare and commercial plans. The only paperwork between the group and the clinic is an internal note describing a "referral relationship." In the same month, two other events occur: a front-desk employee faxes a patient's full operative report to an attorney who sent a subpoena, without checking whether an authorization or protective order accompanied it; and a laptop containing unencrypted data on 4,200 patients is stolen from an employee's car. The compliance officer asks for a written assessment.
1. Analyze the PT referral arrangement under the Stark law and the Anti-Kickback Statute.
Read the worked answer
Stark (physician self-referral).
- Is PT a designated health service? Yes - outpatient physical therapy is a DHS.
- Is there a financial relationship? Yes. Dr. Patel's wife owns 60% of the entity, and an ownership interest held by an immediate family member is attributed to the physician.
- Does an exception apply? The in-office ancillary services exception fails on its face: the clinic is a separate entity, not part of the group practice, and not in the group's space. There is no written, signed, fair-market-value services or lease agreement, no personal-service arrangement, and no physician-recruitment fit. With no exception, each referral is a prohibited referral and each related claim is an improper claim.
Anti-Kickback Statute.
- Profits flowing to the physician through his wife's ownership of an entity he refers to can be remuneration for referrals. The investment-interest safe harbor requires specific, documented criteria (e.g., no requirement to refer, FMV purchase, no disproportionate returns) that this informal arrangement plainly does not satisfy.
Penalties and fix. Stark carries civil monetary penalties per claim plus exclusion; AKS is criminal, and resulting claims raise False Claims Act exposure. Remediation: stop the referrals immediately, obtain health care counsel, consider restructuring (divestiture, FMV acquisition, or an employment model with a compliant agreement), and evaluate self-disclosure and refund of affected claims.
2. Walk through the HIPAA response to the stolen laptop and the faxed operative report.
Read the worked answer
Stolen laptop (4,200 patients, unencrypted).
- Unencrypted PHI on a stolen device is presumed to be a breach unless a documented four-factor risk assessment shows low probability of compromise. Encryption, remote wipe, and whether the data was actually accessible all matter; a police report does not substitute for the assessment.
- Notification: the count exceeds 500, so notify affected individuals without unreasonable delay and no later than 60 days from discovery, notify HHS at the same time via the breach portal, and notify media in any state where more than 500 residents are affected. Document the risk assessment, the notification list, and the dates.
- Mitigate: device inventory, full-disk encryption, ban on PHI on portable devices, sanctions as appropriate.
Faxed operative report.
- A subpoena alone does not authorize disclosure. HIPAA requires either a valid patient authorization or satisfactory assurances that the requesting party has notified the patient or obtained a qualified protective order, plus the minimum necessary standard.
- The employee sent the full operative report with no verification - an impermissible disclosure. Investigate scope, attempt to retrieve or obtain written destruction assurances, and run a risk assessment to decide whether notification is required. Then retrain front-desk staff on the log-and-verify workflow for legal requests.
3. What governance and documentation changes should the compliance officer recommend?
Read the worked answer
Move from informal practice to documented program controls.
- Written policies with teeth: a legal-request protocol (no records released without authorization, qualified protective order, or counsel review), a sanction policy for staff who bypass it, and a device/PHI policy.
- Tracking: a log of every record request - date, requester, legal basis, scope released, reviewer. This is the single cheapest defense in an OCR inquiry.
- Periodic risk analysis: HIPAA requires an ongoing security risk analysis, not a one-time document. The laptop and the fax both point to gaps that a current analysis would have surfaced.
- Conflict-of-interest and arrangement review: annual attestations from physicians about ownership interests in referral targets, routed to counsel before any new arrangement goes live. The PT situation should never have reached 15 referrals a month without a written analysis.
- Training cadence: role-specific training - front desk on disclosures, clinicians on documentation, billing on modifiers and medical necessity - with completion records.
- Reporting culture: a confidential reporting channel and a documented response process, because the compliance officer needs to hear about the next stolen laptop before the patient does.