You have been hired as the first chief compliance officer (CCO) for Mystic Health Systems, a tax-exempt charitable organization located in the Midwest, which operates a 250-bed hospital with $400 million in annual revenue (Mystic Hospital), a 200-member multispecialty physician group (Mystic Medical Group), and a 100-bed skilled nursing facility (Mystic Nursing Home), each of which is separately incorporated. Mystic Hospital is located in an urban (city) setting approximately 5 minutes from the state's capital; Mystic Nursing Home is located in a developing, previously rural area approximately 45 minutes from the state's capital; and Mystic Medical Group has multiple offices throughout the five counties that surround and include the state's capital (mostly in suburban areas).

DAY 1: There is a letter on your desk from the state Department of Public Health (DPH), dated April 22, 2020. In the letter, which was sent to all health plans and hospitals doing business in the state, the Commissioner of Public Health has requested a spreadsheet of all patients who have tested positive for COVID-19 or who, since January 1, 2020, have presented with idiopathic respiratory conditions (pneumonia, bronchitis) and flu-like symptoms but who tested negative for the flu. The letter specifically states that it does not want the names or social security numbers of those patients, but only their dates of birth, dates of treatment, and home ZIP code. The DPH explains in the letter that, by using these identifiers, it can determine with an acceptable degree of statistical certainty if the same individual is being reported by multiple entities (e.g., the same person could be treated by a hospital and also be a member of a health plan, both of which would include the individual in the list). The DPH intends to use this data to generate a fairly accurate count of the number of potential COVID-19 cases in the state so that it can assess whether the state has reached its infection peak and more accurately determine the prevalence rates of COVID-19 in the state. DPH asserts that it will only use the data for this purpose and that the data sent by the plans and hospitals will be destroyed once the statistical report is complete.

After reading this case study answer the following questions below:

1. What are the legal and/or compliance issues raised by the hypothetical?

2. What law, regulation, or governance requirement/policy MAY have been violated? Consider among the following and explain why a potential violation may have occurred.

• Federal False Claims Act
• Physician Self-Referral "Stark" Law
• Federal Anti-Kickback Statute
• Federal Tax-Exempt Law
• Emergency Medical Treatment and Labor Act (EMTALA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Antitrust Law
• Organizational bylaws
• Scope of practice laws, licensure, certification
• Employment law, corporate liability

3. Which issues merit highest priority? Why?

4. Which issues would you recommend for further investigation? Why?

5. What, if any, further steps would you suggest (e.g., referral to inside/outside counsel, involvement of additional departments or individuals, revision of policies/procedures, termination of employment or contractual relationships, self-reporting to the government, internal audit, etc.)?

6. To the extent you believe there to be a legal or compliance-related issue, please recommend alternatives to the problematic program, policy, programmatic element/component, departmental or corporate structure, and/or relationship that you believe would not violate any laws. These alternative proposals do not require detail; however, and particularly where the offending program/policy is designed to increase access, improve quality, or reduce costs, the CEO and board will want to know that these ultimate goals can still be achieved if you are recommending elimination or modification of existing activities.