Healthcare Insights

Analysis and practical guides on healthcare.

23 articles, checklists, and guides on healthcare law, written by the attorneys at MC Law. Every piece is general information, not legal advice — for a specific matter, contact the firm.

HealthcarePrivacy and Data Security

HIPAA Privacy and Security Compliance for Covered Entities and Business Associates

HIPAA is misunderstood in both directions. Providers refuse to share information the rules plainly permit them to share, and organizations that hold enormous quantities of health data assume the rules do not reach them. This article sets out what HIPAA actually requires: who is covered, what counts as protected health information, the uses and disclosures the Privacy Rule permits without authorization, the risk analysis that anchors the Security Rule, and the four-factor assessment that determines whether an incident is a reportable breach. It also covers the business associate relationship, which is where most enforcement now originates, the Office for Civil Rights penalty structure and what actually triggers a large settlement, the right of access initiative that has produced more enforcement actions than any other theory, and the interaction of HIPAA with state law, Part 2 substance use records, and the reproductive health privacy rules.

Casey Scott McKayJuly 4, 202625 min read

HealthcareInsurance

Health Insurance Denials and Appeals: ERISA Plans, ACA Coverage, and External Review

A health insurance denial is not a medical decision and it is not final. This article explains why the single most important question is whether the plan is a self funded ERISA plan or state regulated insurance, because that determines what law applies, what appeal rights exist, what a court will review, and what remedies are available. It covers the categories of denial and what each actually means, the internal appeal deadlines and content requirements, the external review by an independent organization that overturns a substantial share of denials, why Firestone deference makes the administrative record decisive in ERISA litigation, what Metropolitan Life v Glenn held about structural conflicts of interest, why there is no treating physician rule in ERISA, and the specific protections for emergency care, surprise billing, and mental health parity.

Casey Scott McKayJune 29, 202629 min read

HealthcareRegulatory Compliance

Healthcare Regulatory Compliance Toolkit

Healthcare is regulated by more overlapping regimes than any other industry, and the organizations that fail are rarely the ones that intended to. They are the ones whose arrangements expired without anyone noticing, whose risk analysis covered the electronic health record and nothing else, and whose response to a hotline report took four months. This toolkit maps the whole compliance surface in the order a provider actually encounters it: entity structure and licensure, the fraud and abuse framework governing every financial relationship with a referral source, privacy and security, billing and documentation, the compliance program itself, and the response sequence when something is found. Each stage points to the article, checklist, or guide that covers it in depth.

Casey Scott McKayNovember 30, 202514 min read

HealthcareRegulatory Compliance

Healthcare Fraud and Abuse: The Anti-Kickback Statute, the Stark Law, and the False Claims Act

Three federal statutes govern nearly every financial arrangement in American healthcare, and they operate on assumptions that are alien to the rest of commercial law. The Anti-Kickback Statute makes it a felony to pay for a referral, with no requirement that the payment be unreasonable or that anyone be harmed. The Stark Law is a strict liability prohibition that forbids a physician from referring designated health services to an entity with which the physician has a financial relationship, unless an exception fits exactly. The False Claims Act converts violations of either into treble damages plus per-claim penalties, enforced largely by private whistleblowers who share in the recovery. This article explains how the three statutes interact, what the safe harbors and exceptions actually require, how the Supreme Court's decisions in Escobar and Schutte reshaped materiality and scienter, and what a healthcare organization should do when it discovers a problem.

Casey Scott McKayJune 4, 202526 min read

HealthcareProduct Regulation

Life Sciences Regulatory Toolkit: FDA Pathways, Labeling, and Promotion

Almost every question in life sciences regulation reduces to two prior questions: what is this product, and what does the company say it does. Classification determines the pathway, the manufacturing standard, the reporting obligations, and whether a state tort claim is preempted, and classification turns substantially on the company's own claims. This toolkit runs the product lifecycle: intended use and classification, pathway selection and the clinical work each requires, quality systems, labeling and promotion including the constitutional limits on off-label enforcement, postmarket reporting and recalls, the enforcement ladder from inspection through consent decree, and the preemption doctrines that determine whether an approved product can still be sued over. It ends with enforcement, recalls, and the promotional review process that keeps a compliant product from becoming a misbranded one.

Casey Scott McKayFebruary 25, 202513 min read

HealthcarePrivacy and Data Security

HIPAA Security Rule Risk Analysis Checklist: A Practical Checklist

The risk analysis is the foundational requirement of the HIPAA Security Rule and the single most frequently cited failure in Office for Civil Rights enforcement, and the reason is almost always scope rather than effort. Organizations analyze the electronic health record and omit the imaging system, the research database, the billing vendor, the shared drives, and the laptops. This checklist runs an enterprise-wide analysis in the sequence the regulation contemplates: build a complete inventory of every system and location where electronic protected health information lives, identify the threats and vulnerabilities to each, assess the safeguards actually in place, determine likelihood and impact, and document the result. Later phases cover risk management, the addressable specifications that must be either implemented or justified in writing, and the review cycle that keeps the analysis current.

Casey Scott McKayOctober 17, 20249 min read

HealthcarePrivacy and Data Security

HIPAA Business Associates and Cloud Computing

Almost every cloud service that touches electronic protected health information is a HIPAA business associate, and the 2016 HHS cloud guidance closed the door on the comfortable myth that a vendor who only stores encrypted data—or never looks at it—escapes the rules. This guide explains who counts as a covered entity, a business associate, and a subcontractor; why the "conduit exception" almost never saves a cloud provider; and exactly what a compliant business associate agreement must contain under 45 C.F.R. 164.504(e). It walks through the Privacy, Security, and Breach Notification Rules as they apply to the cloud, the encryption-based breach safe harbor, and the shared-responsibility model that determines who is on the hook when something goes wrong. It covers OCR enforcement and the steep tiered penalties, the sweeping 2024–2025 Security Rule overhaul proposal that would make encryption and multifactor authentication mandatory, and the special problems of pushing PHI into AI and analytics pipelines. The aim is a single, readable map a hospital administrator, a SaaS founder, a privacy lawyer, and a curious patient can all follow.

Casey Scott McKayJuly 30, 202441 min read

HealthcareHealthcare Transactions

Structuring a Management Services Organization for a Medical Practice

Building a management services organization means constructing a two-entity structure that lets non-physician capital own the economics of a medical practice without owning the practice itself. The design problem is that the same features making the structure investable — long-term contracts, control over the professional entity's ownership, and a fee capturing most of the margin — are the ones that make it vulnerable to a corporate practice or fee-splitting challenge. Getting it right means researching the specific profession in the specific state, drafting the management agreement to leave clinical authority where it belongs, supporting the fee with a valuation, and then operating consistently with the documents rather than as a single business. This guide walks the structuring decisions in sequence, the documents and what each must contain, the regulatory filings and approvals required, and the operating discipline that keeps the structure defensible.

Casey Scott McKayApril 13, 202426 min read

HealthcareProduct Regulation

FDA Regulation of Drugs, Devices, and Diagnostics: Pathways, Labeling, and Enforcement

Almost every question about FDA regulation reduces to two prior questions: what is this product, and what does the company say it does. Product classification determines the approval pathway, the manufacturing requirements, the reporting obligations, and whether a state tort claim is preempted, and classification turns substantially on the manufacturer's own claims. This article works through the classification framework for drugs, biologics, devices, diagnostics, and the categories that straddle them, explains each premarket pathway and what it actually requires, covers labeling and promotion including the constitutional limits on off-label enforcement, and addresses postmarket obligations from adverse event reporting to recalls. It closes with the enforcement escalation ladder and the preemption doctrines that determine whether an approved product can still be sued over.

Casey Scott McKayMarch 10, 202425 min read

HealthcareHealthcare Transactions

Corporate Practice of Medicine and Healthcare Transactions: MSOs, Private Equity, and Fee-Splitting

Most states prohibit a corporation from employing physicians or otherwise controlling the practice of medicine, which means a non-physician investor cannot simply buy a medical practice. The workaround the industry settled on is a two-entity structure: a physician-owned professional corporation that holds the clinical business and the licenses, and a management services organization that provides everything else under a long-term contract paying a management fee. Whether that structure is respected depends on how the documents allocate control and how the fee is calculated, and both are constrained by fee-splitting rules, the federal fraud and abuse statutes, and an increasingly active set of state transaction review laws. This article explains the doctrine, the structure and its pressure points, the regulatory overlay, and the diligence and closing mechanics that healthcare deals require.

Casey Scott McKayOctober 27, 202325 min read

HealthcareRegulatory Compliance

Anti-Kickback and Stark Law Compliance Checklist: A Practical Checklist

Nearly every arrangement that gets a healthcare organization in trouble was reviewed by someone who concluded it was fine, and failed on a detail: an expired agreement under which payments continued, a missing signature, per-click rent, compensation stacked across four separate agreements, or services nobody documented. This checklist works arrangement by arrangement rather than by legal theory. It starts by building a complete inventory of every financial relationship with a referral source, then applies the Stark exception analysis and the Anti-Kickback safe harbor analysis to each, tests fair market value and commercial reasonableness, and checks the operational controls that keep a compliant arrangement compliant. Later phases cover the monitoring calendar, exclusion screening, and what to do when a problem is found, including the choice between disclosure paths.

Casey Scott McKayOctober 16, 20239 min read