Compliance

The Physician Payments Sunshine Act, commonly called the Sunshine Act, is intended to make the relationships between the healthcare industry and healthcare professionals more transparent. The Sunshine Act requires applicable manufacturers of drugs, devices, biologicals, and medical supplies to report certain payments or transfers of value provided to physicians or teaching hospitals and other research entities to the Centers for Medicare & Medicaid Services (CMS) on an annual basis.

“Payments” are fees for services rendered such as for royalties, speaker programs or consulting engagements, and for associated approved out-of-pocket reimbursements (e.g., mileage and parking).  Payments can also be in the form of an educational grant for a third party meeting, fellowship grant, product donations or a clinical research study.

“Transfers of value” are in-kind items such as meals, airfare, and/or educational materials (journal reprints, textbooks, etc) that Orthofix pays for or provides in connection with medically relevant interactions with healthcare professionals and healthcare organizations.

Orthofix interacts with physicians and teaching hospitals in many important ways. We consult doctors to get their insights and advice on developing treatments that meet the needs of patients. We facilitate programs where physicians who are experts in their fields meet with their peers to help educate them about the appropriate use of FDA-approved treatments; this helps them make informed prescribing decisions with their patients. We also engage physicians as clinical trial investigators and work with hospitals to conduct clinical research studies, which are fundamental to the development of innovative treatments for patients.

A physician (excluding medical residents) with an active license in the US who possesses any of the following degrees: Medical Doctor (M.D.), Doctor of Osteopathy (D.O.), Doctor of Dental Surgery (D.D.S.), Doctor of Dental Medicine (D.M.D.), Doctor of Optometry (O.D.), Doctor of Podiatry (D.P.M.) or Doctor of Chiropractic Medicine (D.C.).

The Covered Recipient list was expanded in January 2021 to include five new provider types: physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists & anesthesiologist assistants, and certified nurse-midwives. Health care providers who practice either in collaboration with or under the supervision of a physician, including physician assistants, nurse practitioners, and clinical nurse specialists, are referred to as non-physician practitioners (NPPs).I.

Every year, CMS publishes a list of teaching hospitals identified as reportable “Covered Recipients.” The teaching hospital list contains all hospitals that CMS has recorded as receiving a payment(s) under a Medicare direct GME, IPPS IME, or psychiatric hospital IME programs during the latest full fiscal year for which such information is available to CMS.

Examples of payment or transfers of value include:

• Meals provided to physicians during medically relevant discussions and presentations;
• Meals and/or travel accommodations provided for a product training and education event;
• Travel and lodging associated with a product training and education event;
• Consulting fees and related expenses paid to physicians;
• Educational Grants and other payments to teaching hospitals;
• Educational materials, such as journal reprints and textbooks; and
• Royalties and licenses fees.

If you have any questions about the Sunshine Act, Open Payments or published data, please email transparency@orthofix.com  or call +1.800.527.0404 and request to speak with a member of our Compliance team.

HIPAA stands for the Health Insurance Portability and Accountability Act. This law was passed in 1996 in order to protect individual’s Protected Health Information (PHI) from impermissible uses and disclosures by Covered Entities and their Business Associates.

PHI (Protected Health Information) means any information, whether oral or recorded, in any form or medium that is created by a health plan, a health care provider, or a health care clearinghouse that relates to the past, present or future physical or mental health of an individual, including the provision of and payment for health care, that either identifies the individual or provides a reasonable basis for such identification.

Yes. HIPAA applies to all Covered Entities and their Business Associates. Covered Entities include healthcare providers, healthcare plans and billing clearinghouses. Since Orthofix is defined as a healthcare provider, it is considered a Covered Entity under HIPAA and must comply with all HIPAA requirements.

A Business Associate is a person or entity that performs certain functions or activities on behalf of a Covered Entity. Business Associate services include, but are not limited to: legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, and financial.

The HIPAA Privacy Rule explicitly excludes from the Business Associate requirements disclosures by a Covered Entity to a healthcare provider for treatment purposes. Therefore, Orthofix may share PHI with other healthcare providers for treatment purposes without a Business Associate Agreement (BAA). Other healthcare providers such as hospitals and physician offices frequently request Orthofix to sign their BAAs. In most instances, Orthofix does not sign these BAAs due to the reasons explained above. Please forward all such requests to the Privacy Officer so that the requestor can be contacted to explain Orthofix’s position.

Covered Entities are not permitted to simply abandon PHI or dispose of it in containers that are accessible by the public or other unauthorized persons. Examples of proper disposal methods may include, but are not limited to:

• For PHI in paper records, shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.
• For PHI on electronic media, clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding).

1. Impermissible Uses and Disclosures – e.g., using patient data to commit fraud
2. Lack of Safeguards – e.g., allowing visitors entry into workplace without sign-in
3. Failure to Provide Access – e.g., denying patients the ability to access their records
4. More than Minimum Necessary – e.g., ability to access PHI without work-related reason
5. Lack of Administrative Safeguards of PHI – e.g., coworkers sharing login information

If you have any questions about HIPAA, please email Privacy@orthofix.com or call +1.800.527.0404 and request to speak with a member of our Compliance team.