Legal Updates from WMK Law Group: 2025 Quarter 2 Updates

The Newsletter

As we wrap up another productive quarter, we want to take a moment to thank you—our clients and partners—for your continued trust and collaboration. At Werfel, Moore & Kelly Law Group, we remain committed to supporting our community with the focused legal expertise you rely on. Keep scrolling to take a look at what’s new this quarter.

Top 5 Medicare Reasons to Deny Ambulance Claims (Part 2)

A Medicare Administrative Contractor (MAC) has recently released a new summary of their Target Probe and Educate (TPE) audits for emergency ambulance transports. Of the ambulance services reviewed, 46% failed the first round of review, meaning they had an error rate of more than 20%.

The top 5 errors identified were:

No documentation received
No Beneficiary Signature
Transport Not Medically Necessary
Documentation for Wrong Patient or Date of Service
Provider Signature Does Not Include Credentials

In last quarter’s newsletter, we addressed the top two and the fourth most prevalent reasons to deny claims according to this report. This quarter we will tackle the remaining two.

3.Transport Not Medically Necessary

Often identified as the top error in TPE audits, medical necessity is probably the toughest “error” to correct. This is due to the very subjective nature of what is considered medically necessary; it is a determination upon which reasonable minds often have different opinions. So what can you do to correct a subjective “error” that may not be an error at all? The best solution is to document the patient encounter completely and thoroughly. This is not to be confused with documenting so that it is clear that medical necessity was met, because that will not always be the case. What it means is to document so well that someone who was not in the ambulance with the patient can determine if what the crew did was clinically indicated by the patient’s condition, or, on the other hand, was done because they are required to do it under state law or protocols but was not really needed by the patient. Medical necessity applies to an individual intervention, such as an I.V. start or putting the patient on oxygen, or it can apply to the entire trip. Medical necessity applies to both what was done, and why the patient went to a specific destination. All of the elements of the transport must be explained so that a proper code can be billed for the level of care that was actually required by the patient’s condition. In our experience, claims denied for not meeting medical necessity are more often a result of the clinical elements of the transport not being clear or not being explained, than they are for the patient truly not needing the care provided. When an EMT or Paramedic explains why they provided the specific interventions that they did, it is rare that an auditor challenges the clinical decision-making. It is usually when no explanation or context is given that the auditors conclude that claims do not meet medical necessity.

5.Provider Signature Does Not Contain Credentials

In the age of electronic patient care reporting, it is odd that a lack of credentials should make the top 5 list, but this is not the first report that has made this finding. Make sure that new employees names and credentials are added to your e-pcr system so that they appear under the signature line when they login. If you know that your agency is being reviewed in a TPE audit, check that crew signature line before you send in the documents. If there is an illegible signature with no name and credentials printed below it, you will need to do an “attestation” statement to go with the trip report, which is simply a separate document, stating that the signature on the PCR is that of your crew member who signed it, and then that same crew member signs the statement and prints their name and credentials below that signature. It is also a good idea to send in the crew member’s current license as well, just to make sure that the auditor has all of the proof that they need to find a valid crew signature.

Conclusion

TPE audits are frequent in EMS. If you get notice that you are the subject of one of these audits, please feel free to reach out to us to help you navigate the process. Failing multiple rounds of TPE can result in having your billing privileges with Medicare revoked, so successfully getting through TPE review is critical to your service.

New & Newsworthy

HHS Office of Civil Rights Enters Resolution Agreement with Healthcare Provider for HIPAA Cybersecurity Breach

On April 17, 2025, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Guam Memorial Hospital Authority (GMHA) concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. OCR initiated an investigation following the receipt of a complaint in January 2019 alleging that GMHA experienced a ransomware attack affecting the ePHI of approximately 5,000 individuals. Additionally, during the investigation, OCR received another complaint in March 2023 alleging that hacker(s) had accessed patient records.

OCR’s investigation determined that GMHA had failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI held by GMHA. In April, the American Ambulance Association (AAA) hosted a webinar on What EMS Providers Need To Know About The Proposed HIPAA Security Rule where the AAA’s legal consultants highlighted the proposed changes to the HIPAA Security Rule. In the proposed rule, OCR stated that through its numerous investigations, it believes that many covered entities are not meaningfully and comprehensively complying with the requirements under the HIPAA Security Rule. The proposed rule seeks to more clearly address the issues that resulted in the breach and subsequent resolution agreement in the GHMA case.

Under the terms of the resolution agreement, GMHA agreed to implement a corrective action plan that will be monitored by OCR for three years, and paid OCR $25,000. Under the corrective action plan, GMHA has agreed to take a number of steps to ensure compliance with the HIPAA Security Rule and protect the security of ePHI, including:

Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
Develop a written process to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
Develop, maintain, and revise, as necessary, written policies and procedures to comply with the HIPAA Privacy, Security and Breach Notification Rules;
Augment its existing HIPAA and security training program so all workforce members with access to PHI understand the HIPAA requirements and GMHA’s HIPAA policies and procedures;
Enhance workforce security and information access management by reviewing all access credentials that have been granted access to ePHI; and
Conduct breach risk assessments and provide evidence to OCR that all breach notification obligations have been conducted.

As we discussed during the AAA webinar, and as noted in the resolution agreement, OCR recommends that health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyber-threats:

Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems. (Technology Asset Inventory & Network Map)
Integrate risk analysis and risk management into the organization’s business processes.
Ensure that audit controls are in place to record and examine information system activity.
Implement regular reviews of information system activity.
Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
Incorporate lessons learned from incidents into the organization’s overall security management process.
Provide workforce members with regular HIPAA training that is specific to the organization and to the workforce members’ respective job duties.

The AAA has submitted comment on behalf of its members to HHS regarding the proposed Cybersecurity Rule essentially asking to limit legal liability and damages for any covered entity that can demonstrate compliance with the proposed regulations. We will keep clients posted as to the rule’s progression through the regulatory process. If clients have questions regarding their obligations under the HIPAA rules, please contact us.

Client Advisories

EMS & Public Safety Agencies Must Reevaluate Marijuana Use Policies In Light of Florida Court Ruling in Firefighter Medical Marijuana Employment Case

The EMS and public safety community has struggled with its workplace policies and practices as the legalization of both medical and recreational marijuana has spread across the U.S. For years, many employers have relied on their workplaces being subject to the Drug Free Workplace Act or because their employees are performing safety-sensitive work. Several states have laws that specifically protect an employee’s off duty use of cannabis.

In December 2024, in a pivotal decision likely to influence workplace drug policies across Florida and the U.S., a Florida state court has ruled in favor of a firefighter who was placed on unpaid leave after testing positive for marijuana—despite having a valid medical marijuana card. The case, Angelo Giambrone v. Hillsborough County, signals a shift in how Florida employers must handle off-duty use of legally prescribed medical cannabis by employees with disabilities. Giambrone v. Hillsborough County, No. 20-CA-4719 (Fla. 13th Cir. Ct. Dec. 10, 2024).

Background

Angelo Giambrone, a firefighter/EMT with Hillsborough County since 2009, was subjected to a random drug screening in early 2019. After testing positive for marijuana, Giambrone disclosed that he was a registered medical marijuana patient, legally using cannabis to treat anxiety, PTSD, and insomnia.

Despite no evidence of impairment or use while on duty, Hillsborough County placed Giambrone on unpaid leave, citing its Drug-Free Workplace Policy and collective bargaining agreement (CBA). The County reported Giambrone’s positive drug test to the county EMS oversight agency who investigated and closed the case due to no finding or restriction to his certification. Giambrone subsequently filed suit under the Florida Civil Rights Act (FCRA) and for breach of contract, arguing that the County discriminated against him and failed to accommodate his lawful medical use of marijuana.

During the legal proceedings, both Giambrone and the County acknowledged that there were no performance issues or suspicions of on-duty cannabis use or possession while on duty. The County acknowledged that Giambrone had been promoted during his tenure with the Fire Department and that the sole reason he was drug tested was due to their random drug testing policy.

Court’s Findings

The judge in Florida’s Thirteenth Judicial Circuit granted summary judgment in Giambrone’s favor on all four counts:

Disability Discrimination (FCRA): The court found that Giambrone qualified as a person with a disability under the FCRA and that Hillsborough County failed to reasonably accommodate his lawful, off-duty medical marijuana use.
Wrongful Discharge: The County’s decision to place Giambrone on unpaid leave violated his rights under Florida law and did not align with its own personnel policies because their drug testing policies broadly included drugs and medications authorized under federal or Florida law.
Policy Violations: The County had not updated its Drug-Free Workplace Policy to account for lawful medical marijuana use, even though it accommodated other prescribed medications that could affect alertness.
Breach of Contract: Hillsborough County breached the CBA and its own policies by penalizing Giambrone solely on the basis of a positive test, without evidence of impairment or improper use on duty and regardless of drug or medication type.

Key Legal Takeaways for Employers from this Ruling

Medical marijuana must be treated like any other legally prescribed medication in Florida workplaces, so long as its use does not affect performance or safety on the job.
Employers must engage in an interactive process to assess whether reasonable accommodation is possible when employees present a valid medical marijuana prescription.
Drug-free workplace policies must be updated to reflect the protections offered under Florida’s medical marijuana laws and disability rights statutes.

The court awarded Giambrone back pay, emotional distress damages, attorney’s fees, and costs. It also issued an injunction requiring the County to accommodate qualified medical marijuana users under its workplace policies, unless on-duty use or impairment is evident.

Implications for Employers

This ruling is among the first in Florida to affirm that employers cannot take adverse action against employees simply for testing positive for THC if they are registered medical marijuana users and are not impaired at work. It also suggests that traditional zero-tolerance policies may be legally vulnerable when applied to medical marijuana patients.

While many states have not yet legalized cannabis, this ruling demonstrates that there are significant shifts in opinion regarding the use of cannabis. Employers in states that have legalized either recreational or medicinal marijuana should consult with an attorney prior to taking employment action based upon any positive marijuana drug test that is not due to on-duty reasonable suspicion.

Conclusion

We have been advising clients for many years that they should consider how the shift towards legalized marijuana will be addressed in their workplaces. Our recommendations have been to focus drug testing efforts to an on-duty reasonable suspicion policy. Additionally, we recommend that you educate your leadership on reasonable suspicion and utilize a consistent Reasonable Suspicion Checklist to ensure consistency.

Three Rivers Product Network (TRPN) BAAs

It has come to our attention that a company doing business as “Three Rivers Product Network” or “TRPN Direct Pay” is sending out documents purporting to be Business Associate Agreements (“BAAs”) to ambulance services across the country. This company is claiming that the BAA is required to be signed by ambulance service providers in order to “review” claims submitted to “members” of TRPN’s payer network. These BAA agreements contain dangerous provisions; do NOT sign them.

In this case, the document sent by TRPN is NOT a standard BAA. In most respects, it does look like a standard BAA. However, included in paragraph 18 of the version of the BAA we have seen, they have the following provisions:

That reimbursement of claims shall be limited to the lesser of several options at their discretion, including 35% less than billed charges, 80% of “usual and customary” charges, and other amounts which would be less than what the ambulance service would otherwise be entitled to.
Language stating “All claims shall be processed through this Agreement on an exclusive basis”; and
“All discounts granted by Provider shall be fully assigned to TRPN Direct Pay”.

While it is unclear exactly what their intent is, from this language, it appears that they are trying to get ambulance service providers to agree to discounts, then they would seek to keep the difference in the discounted amount and what insurance would have otherwise paid. All of paragraph 18 is extremely concerning, and this is not the first time that TRPN Direct Pay has had its intentions and business practices questioned. Several years ago, the California Medical Association issued this statement: CMA demands TRPN immediately cease illegal $15 check scheme, and the State of Georgia required them to cease and desist similar improper business practices: Commissioner King Takes Action Against Nevada-Based Company | Office of the Commissioner of Insurance and Safety Fire. Now it seems like TRPN has come up with a new scheme to slip payment limitations and assignment language into a “BAA” and then use that Agreement to reduce payments, and possibly insert themselves as the exclusive administrator of your claims.

As a general matter, any company working as a claim processing or re-pricing agent for an insurance payer would not be performing a business function for the ambulance services and therefore would not need a BAA directly with the ambulance service provider. Instead, they should be entering a BAA with any payer with whom they work as a vendor. Also, as a general rule, if there is ever a need for a BAA, then it is not up to the business associate to dictate the terms of the BAA; the covered entity should require the business associate to sign the covered entity’s standard BAA. Any time you receive a BAA from a third party, you should carefully read the terms or have us review it for you; these are enforceable contracts and come with potential consequences for your company.

Our advice is NOT to sign any BAA agreement sent to your company by TRPN Direct Pay. If you receive one, please let us know and give us the opportunity to review on your behalf. If you have already signed and returned one of these agreements, please contact us so that we can take steps to terminate that agreement for you.

Massachusetts Pay Transparency Posting Requirements Effective October 2025

On April 15, 2025, Governor Maura Healey signed into law new pay transparency requirements aimed at increasing wage equity and access to salary information for job applicants and employees. These requirements will take effect on October 1, 2025.

Summary of New Requirements

Beginning October 1, 2025, Massachusetts employers who employ 25 or more employees must:

Include the salary or wage range for any advertised job, promotion, or transfer opportunity in all public and internal job postings.
Disclose a “good faith” wage range that reflects the employer’s actual expectations at the time of posting.
Maintain records of wage ranges and job descriptions for each position, consistent with existing recordkeeping obligations under the state’s Equal Pay Act.

Additionally, employers with 100 or more employees will be required to submit annual pay data reports to the state beginning in 2026, although implementation details for this requirement are pending further regulatory guidance. The Massachusetts Office of the Attorney General has published Guidance on Employers’ Obligations Under the Wage Transparency Act to provide employers with the necessary compliance information.

Action Steps for Employers

Review and update job posting templates to ensure inclusion of salary ranges for all applicable postings.
Develop or formalize internal wage ranges for all roles to ensure consistency and compliance.
Train HR and recruiting teams on the new posting and disclosure requirements.
Monitor for forthcoming regulations that may clarify data reporting requirements for larger employers.

We recommend reviewing your current compensation policies and practices now to ensure compliance ahead of the October 1 deadline.

President Trump Signs Executive Order Drastically Changing the Regulatory Enforcement of Disparate Impact Discrimination

On April 23, 2025, President Donald Trump signed Executive Order 14173, titled “Restoring Equality of Opportunity and Meritocracy,” marking a significant shift in federal civil rights enforcement by targeting the legal doctrine of disparate impact liability.

Disparate Impact Theory

Disparate impact refers to policies or practices that, while neutral on their face, disproportionately affect members of protected classes such as race, sex, or age. Established in the 1971 Supreme Court case Griggs v. Duke Power Co., this legal theory has been a cornerstone in addressing systemic discrimination in areas like employment and education. An example of disparate impact theory is a police agency requiring that all police officers be a minimum of six feet tall. While it is possible for any individual to be six feet tall, it is highly likely that this facially neutral policy will impact certain groups of people, such as women. Often, policies such as this, which do not meaningfully equal a bona fide occupational qualification, were used intentionally or unintentionally to restrict who qualified for certain positions.

Key Provisions of the Executive Order

The Executive Order asserts that disparate impact liability is inconsistent with the Constitution's guarantee of equal treatment, arguing that it mandates race-oriented or gender-based policies to achieve predetermined outcomes. The order directs federal agencies to:

Deprioritize enforcement of statutes and regulations that include disparate impact liability, including Title VI and Title VII of the Civil Rights Act.
Revoke prior presidential approvals of regulations supporting disparate impact liability.
Assess and potentially amend or repeal existing regulations, guidance, and enforcement actions based on disparate impact theories.
Evaluate state laws imposing disparate impact liability for potential federal preemption or constitutional issues.
Review by EEOC Chair or Attorney General of current matters or lawsuits and take appropriate action consistent with the Executive Order.