A new generation of AI-powered billing and coding tools are infiltrating revenue cycle management departments across the country. These tools crawl electronic medical records, read clinical notes, and generate billing code suggestions in seconds. They promise to speed up billing/coding, accurately document, eliminate undercoding, capture missed diagnoses, and boost reimbursement.

Vendors call it “revenue optimization.”

The post AI Is Billing Your Patients. Who Holds the Bag? – The Rise of Ambient Billing and Coding Tools (and the Legal Minefield Your Practice Is Walking Into) appeared first on Health Law Attorney Blog.

The technology works. Physicians love it. Patients often do too. But here’s the problem: the law hasn’t caught up, and providers are deploying these tools faster than they’re building the compliance infrastructure to support them.

The result? Class action lawsuits, regulatory scrutiny, and the very real possibility that the technology meant to reduce burnout could become a new vector for institutional liability.

The post Your AI Scribe Is Listening. Is Your Compliance Program? appeared first on Health Law Attorney Blog.

“What are the penalties for an Anti-Kickback violation?”

“Can they subpoena my pharmacy records?”

The post Your AI Chatbot Is Not Your Lawyer — And a Federal Court Just Made That Official appeared first on Health Law Attorney Blog.

This is a meaningful shift for the regulated community because it operationalizes a core feature of the February 2024 Part 2 Final Rule (implementing CARES Act ? 3221): Part 2 confidentiality is no longer “compliance-by-policy.” It is now a HIPAA-style civil enforcement regime with OCR’s familiar tools—investigations, corrective action commitments, resolution agreements, monetary settlements, and civil money penalties.

Why This Announcement Matters: Part 2 Now Looks (and Feels) Like HIPAA Enforcement

The post OCR Launches Civil Enforcement for 42 CFR Part 2 (SUD Records): What Covered Entities and “Part 2 Adjacent” Organizations Should Do Now appeared first on Health Law Attorney Blog.

Background on Part 2 and HHS’ 2024 Final Rule

Part 2 regulations safeguard the privacy of individuals receiving SUD treatment by imposing strict limits on the disclosure and use of patient records. In February 2024, HHS issued a Final Rule implementing Section 3221 of the CARES Act, with dual goals of:

The post HHS DELEGATES ENFORCEMENT OF SUBSTANCE USE DISORDER CONFIDENTIALITY RULES TO OCR appeared first on Health Law Attorney Blog.

The complete slate of elected Officers and Council Members for fiscal year 2026 elected at the Section Business Meeting on August 8, 2025 is available here.

The post Jessica Gustafson Elected Secretary of the ABA Health Law Section appeared first on Health Law Attorney Blog.

Section 18-C includes several notable updates to patient consent forms. First, Section 18-C prohibits healthcare providers from using a single form to obtain a patient’s consent for treatment and payment of medical services. Instead, healthcare providers must have two separate forms – one form for consent of treatment and one form for consent to pay for medical services. This is an important update as many healthcare providers may have been utilizing a single form to obtain patient consent for treatment and payment of services.

Second, and most importantly, Section 18-C prohibits healthcare providers from obtaining a patient’s consent to pay for healthcare services prior to the patient receiving such services and discussing the treatment costs. As written, this new requirement would conflict with the federal No Surprises Act – a federal law which requires advance notice of treatment costs and patient approval of costs in certain circumstances. Moreover, from a practical standpoint, healthcare providers were understandably wary of the requirement to provide healthcare services prior to obtaining any agreement from patients to pay for such services.

The post New York State Dept. of Health Issues Guidance on Recently Amended Consumer Protection Laws and Postpones New Requirements for Patient Consent Forms appeared first on Health Law Attorney Blog.

A Shift in Focus and Structure

The 2024 ICPG introduces a more structured and focused framework to support nursing facilities in developing effective compliance programs. Unlike the 2000 guidance, which largely centered on fraud prevention, the new ICPG places quality of care and resident safety at the forefront. This shift reflects OIG’s recognition of the direct relationship between care quality and compliance. Leadership accountability is another critical focus, with the guidance emphasizing the active role of governing bodies, owners, and investors in ensuring compliance programs are operationalized and continuously monitored. This approach highlights the importance of integrating compliance into an organization’s culture and leadership practices.

The post OIG Releases New Industry-Specific Compliance Program Guidance for Nursing Facilities appeared first on Health Law Attorney Blog.

Background of the Case

The core issue in this case revolves around the interpretation and application of the Health Insurance Portability and Accountability Act (HIPAA) and its provisions regarding “Individually Identifiable Health Information” (IIHI). In December 2022, HHS issued a guidance document (the Original Bulletin) that expanded the definition of IIHI to include the combination of an individual’s IP address with their visits to healthcare providers’ unauthenticated public webpages (UPWs). This combination, referred to as the “Proscribed Combination,” was considered by HHS to be protected under HIPAA. HHS later revised its rule, in response to the lawsuit, but still retained the “Proscribed Combination” concept in the “Revised Bulletin”.

The post Court Strikes Down HHS “Guidance” Regarding Online Tracking Technologies and HIPAA: Implications for Healthcare Providers appeared first on Health Law Attorney Blog.

The Need for the Health Breach Notification Rule

In the evolving landscape of healthcare technology, many entities manage personal health records (PHRs) without being subject to HIPAA. HIPAA primarily governs healthcare providers, health plans, and their business associates who conduct standardized electronic transactions. However, the rise of direct-to-consumer health apps, wearable devices, and other digital health technologies necessitated additional regulatory measures to ensure these entities also adhere to stringent privacy and security protocols. This is where the FTC’s newly released HBN Rule comes into play.

The post Newly Released FTC Health Breach Notification Rule: A Guide for Non-HIPAA Health Apps and Technologies appeared first on Health Law Attorney Blog.