If you’re considering buying a medical practice, compliance needs to be a top priority. Being lax about HIPAA rules, as well as state, federal and local laws, could open you up to liability on multiple fronts. While the onus is mostly on the seller to make sure that everything is in order, the buyer needs to do their due diligence before taking over.
First Steps
Experts recommend that anyone selling their practice consult with an attorney that handles these types of transactions regularly.1 However, buyers should also meet with an attorney to make sure all the necessary protocols are being followed. Attorneys should be knowledgeable on the aspects of healthcare that could make the process a bit more challenging than other business acquisitions, particularly HIPAA compliance.2
In addition to an attorney, the seller will also likely enlist appraisers and accountants to help to provide an accurate valuation of the practice.3 Be patient; this process may take some time – sometimes over a year, particularly if the seller faces poor market conditions.
Managing Patient Records
Perhaps the biggest compliance consideration when a practice changes hands is patient records. Where do they go? State and federal regulations mandate that the seller provides patients with the option to have their medical records sent to another provider of their choosing.
It probably goes without saying that medical records won’t be automatically transferred over to the buyer; protected health information (PHI) cannot be turned over to another provider without the patient’s consent. The seller must ensure that patients are informed of the proposed sale so that they have ample time to find a new provider and transfer their PHI to them if they so choose.
There are certainly things that can prolong the sale, but the process can run a bit smoother if the buyer keeps staff in place or ensures that a holdover from the previous practice stays on board as an employee or independent contractor. This allows the seller to share PHI with the buyer, in accordance with a HIPAA-compliant business associate agreement (BAA). Having a BAA in place allows the new owner to access PHI for healthcare operations, which is permitted under HIPAA.
The seller can also sign over their legal obligations for patient records to the buyer.4 By drafting a standalone medical records custody agreement or adding a custodianship provision to the asset purchasing agreement, the buyer can assume obligations for storing and maintaining records. The agreement should also provide the seller with access to the records once the sale is complete if they are needed in limited circumstances, for example, an investigation or audit.
Furthermore, many patients will opt to stay with a medical practice after it changes hands.5 It is therefore in the new owner’s best interest to have immediate access to patient records. By becoming the custodian of patient records, the purchasing physician can ensure that they have such access.
As always, buyers should verify every step in this records management process with their attorneys. Regulations can change over time, and good legal representation can help physicians keep up with any changes.
Lastly, the buyer should carefully review all of the seller’s policies, particularly if there are staff members that are going to stay on board after the transition. Buyers should ensure that the seller has kept up with annual HIPAA risk assessments. If they haven’t done one recently, it’s a good idea for the buyer to encourage completion as it will uncover any compliance vulnerabilities the practice may have that buyer could inherit. In addition to the assessment, the buyer should ensure that the practice has been maintaining proper documentation and regularly training employees on HIPAA, PCI, and OSHA compliance.
Start Early
If you are contemplating purchasing a medical practice, it’s not too soon to begin your due diligence. Even if you don’t have a particular practice in mind, it’s a good idea to familiarize yourself with all relevant HIPAA rules, federal laws, and any state and local laws for the area that you’re considering. Remember, it’s better to be over-prepared than to face legal jeopardy.
References
- https://simasgovlaw.com/hipaa-compliance-selling-health-care-practice/
- https://www.ironmountain.com/resources/best-practice-guides/c/compliance-lessons-for-retiring-physicians-sponsored-by-how-to-avoid-risk-when-closing-a-practice
- https://practicesuite.com/blog/selling-your-medical-practice-do-these-things/
- https://www.stevenslee.com/health-law-observer-blog/q-a-youre-selling-your-practice-what-about-the-medical-records/
- https://medprodental.com/practice-more-safely/transferring-patient-health-records
