Healthcare Insights
Analysis and practical guides on healthcare.
31 articles, checklists, and guides on healthcare law, written by the attorneys at MC Law. Every piece is general information, not legal advice—for a specific matter, contact the firm.
Life Sciences Regulatory Toolkit: FDA Pathways, Labeling, and Promotion
Almost every question in life sciences regulation reduces to two prior questions: what is this product, and what does the company say it does. Classification determines the pathway, the manufacturing standard, the reporting obligations, and whether a state tort claim is preempted, and classification turns substantially on the company's own claims. This toolkit runs the product lifecycle: intended use and classification, pathway selection and the clinical work each requires, quality systems, labeling and promotion including the constitutional limits on off-label enforcement, postmarket reporting and recalls, the enforcement ladder from inspection through consent decree, and the preemption doctrines that determine whether an approved product can still be sued over. It ends with enforcement, recalls, and the promotional review process that keeps a compliant product from becoming a misbranded one.
HIPAA Security Rule Risk Analysis Checklist: A Practical Checklist
The risk analysis is the foundational requirement of the HIPAA Security Rule and the single most frequently cited failure in Office for Civil Rights enforcement, and the reason is almost always scope rather than effort. Organizations analyze the electronic health record and omit the imaging system, the research database, the billing vendor, the shared drives, and the laptops. This checklist runs an enterprise-wide analysis in the sequence the regulation contemplates: build a complete inventory of every system and location where electronic protected health information lives, identify the threats and vulnerabilities to each, assess the safeguards actually in place, determine likelihood and impact, and document the result. Later phases cover risk management, the addressable specifications that must be either implemented or justified in writing, and the review cycle that keeps the analysis current.
HIPAA Business Associates and Cloud Computing
Almost every cloud service that touches electronic protected health information is a HIPAA business associate, and the 2016 HHS cloud guidance closed the door on the comfortable myth that a vendor who only stores encrypted data—or never looks at it—escapes the rules. This guide explains who counts as a covered entity, a business associate, and a subcontractor; why the "conduit exception" almost never saves a cloud provider; and exactly what a compliant business associate agreement must contain under 45 C.F.R. 164.504(e). It walks through the Privacy, Security, and Breach Notification Rules as they apply to the cloud, the encryption-based breach safe harbor, and the shared-responsibility model that determines who is on the hook when something goes wrong. It covers OCR enforcement and the steep tiered penalties, the sweeping 2024–2025 Security Rule overhaul proposal that would make encryption and multifactor authentication mandatory, and the special problems of pushing PHI into AI and analytics pipelines. The aim is a single, readable map a hospital administrator, a SaaS founder, a privacy lawyer, and a curious patient can all follow.
Structuring a Management Services Organization for a Medical Practice
Building a management services organization means constructing a two-entity structure that lets non-physician capital own the economics of a medical practice without owning the practice itself. The design problem is that the same features making the structure investable—long-term contracts, control over the professional entity's ownership, and a fee capturing most of the margin—are the ones that make it vulnerable to a corporate practice or fee-splitting challenge. Getting it right means researching the specific profession in the specific state, drafting the management agreement to leave clinical authority where it belongs, supporting the fee with a valuation, and then operating consistently with the documents rather than as a single business. This guide walks the structuring decisions in sequence, the documents and what each must contain, the regulatory filings and approvals required, and the operating discipline that keeps the structure defensible.
FDA Regulation of Drugs, Devices, and Diagnostics: Pathways, Labeling, and Enforcement
Almost every question about FDA regulation reduces to two prior questions: what is this product, and what does the company say it does. Product classification determines the approval pathway, the manufacturing requirements, the reporting obligations, and whether a state tort claim is preempted, and classification turns substantially on the manufacturer's own claims. This article works through the classification framework for drugs, biologics, devices, diagnostics, and the categories that straddle them, explains each premarket pathway and what it actually requires, covers labeling and promotion including the constitutional limits on off-label enforcement, and addresses postmarket obligations from adverse event reporting to recalls. It closes with the enforcement escalation ladder and the preemption doctrines that determine whether an approved product can still be sued over.
Corporate Practice of Medicine and Healthcare Transactions: MSOs, Private Equity, and Fee-Splitting
Most states prohibit a corporation from employing physicians or otherwise controlling the practice of medicine, which means a non-physician investor cannot simply buy a medical practice. The workaround the industry settled on is a two-entity structure: a physician-owned professional corporation that holds the clinical business and the licenses, and a management services organization that provides everything else under a long-term contract paying a management fee. Whether that structure is respected depends on how the documents allocate control and how the fee is calculated, and both are constrained by fee-splitting rules, the federal fraud and abuse statutes, and an increasingly active set of state transaction review laws. This article explains the doctrine, the structure and its pressure points, the regulatory overlay, and the diligence and closing mechanics that healthcare deals require.
Anti-Kickback and Stark Law Compliance Checklist: A Practical Checklist
Nearly every arrangement that gets a healthcare organization in trouble was reviewed by someone who concluded it was fine, and failed on a detail: an expired agreement under which payments continued, a missing signature, per-click rent, compensation stacked across four separate agreements, or services nobody documented. This checklist works arrangement by arrangement rather than by legal theory. It starts by building a complete inventory of every financial relationship with a referral source, then applies the Stark exception analysis and the Anti-Kickback safe harbor analysis to each, tests fair market value and commercial reasonableness, and checks the operational controls that keep a compliant arrangement compliant. Later phases cover the monitoring calendar, exclusion screening, and what to do when a problem is found, including the choice between disclosure paths.