Photo of Conor Duffy

Conor Duffy is a member of Robinson+Cole's Health Law Group and the firm's Data Privacy + Security Team. Mr. Duffy advises hospitals, physician groups, accountable care organizations, community providers, post-acute care providers, and other health care entities on general corporate matters and health care issues. He provides legal counsel on a full range of transactional and regulatory health law issues, including contracting, licensure, mergers and acquisitions, the False Claims Act, the Stark Law, Medicare and Medicaid fraud and abuse laws and regulations, HIPAA compliance, state breach notification requirements, and other health care regulatory matters. Read his full rc.com bio here.

Below is an excerpt of an article co-authored with Robinson+Cole Construction Law Group lawyer Virginia K. Trunkes and published in Healthcare Facilities Today on March 31, 2021. 

The need to update and implement new processes for delivering healthcare in response to the COVID-19 pandemic has resulted in the adoption of more automation, remote access and

On March 14, 2021, Connecticut Governor Lamont issued Executive Order 10C (EO 10C), which extends provisions of Public Act 20-2 (PA 20-2), a law passed by the Connecticut legislature in July 2020 that “provided additional flexibility for the delivery of telehealth services and insurance coverage of these services” but was scheduled to expire March 15, 2021. As a result of EO 10C, the provisions of PA 20-2 that were scheduled to expire on March 15 will remain in effect through April 20, 2021, in part to give the state legislature more time to “address the ongoing need for” expanded access to telehealth services.
Continue Reading Connecticut Extends Expansion of Access to Telehealth Services

On January 28, 2021, the Department of Health and Human Services (HHS) issued a Fifth Amendment to HHS’s Declaration under the Public Health Readiness and Emergency Preparedness Act (PREP Act) that provides liability immunity to certain individuals and entities arising from the manufacturing, distribution, administration or use of medical countermeasures (e.g., therapeutics and vaccines) against COVID-19.
Continue Reading COVID-19 Vaccine Update: HHS Expands Pool of Eligible Vaccinators under PREP Act

On January 14, 2021, the U.S. Court of Appeals for the Fifth Circuit overturned a $4.348 million penalty for alleged HIPAA violations assessed by the U.S. Department of Health & Human Services (HHS) against the University of Texas M.D. Anderson Cancer Center (Hospital). The case arises from an enforcement action undertaken by HHS following the Hospital’s self-disclosure of three separate instances of lost or stolen portable devices containing electronic protected health information (ePHI). The government’s investigation determined that the devices were not encrypted, and that the Hospital’s failure to encrypt the devices to protect the ePHI contained therein constituted a violation of HIPAA’s Privacy and Security Rules. After HHS imposed the penalty in 2017, the Hospital appealed the penalty first to an Administrative Law Judge, and then to HHS’s Departmental Appeals Board before petitioning the Fifth Circuit for review in 2019 (see our prior analyses of this case here).
Continue Reading Fifth Circuit Overturns “Arbitrary and Capricious” $4.3 Million HIPAA Penalty Against Hospital

On December 10, 2020, the U.S. Department of Health and Human Services (HHS) announced proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which is one of several rules that protect the privacy and security of individuals’ medical records and other protected health information (PHI). According to HHS, the proposed changes are intended to support individuals’ engagement in their health care, remove barriers to coordinated care and case management, and reduce regulatory burdens on the health care industry, while continuing to protect the privacy and security of individuals’ PHI.
Continue Reading HHS Proposes Modifications to the HIPAA Privacy Rule to Enhance Care Coordination and Management and Remove Barriers to Accessing Information

On December 7, 2020, Connecticut Governor Ned Lamont signed Executive Order No. 9Q (the “Order”) in anticipation of the approval of COVID-19 vaccines. The Order addresses and expands COVID-19 vaccine administration, establishes flu vaccine reporting requirements for pharmacists, and limits out-of-network charges for administration of authorized COVID-19 vaccines. Specifically, the Order:
Continue Reading In Anticipation of COVID-19 Vaccine Approval, Connecticut Governor Ned Lamont Issues Executive Order To Facilitate Vaccine Administration and Reporting

On November 3, 2020, a Massachusetts Federal District Court issued a notable decision on the applicability of the state’s medical peer review privilege in a federal proceeding, determining that the privilege does not apply to documents requested in discovery as part of a qui tam False Claims Act (FCA) case. In United States ex rel. Wollman v. Massachusetts General Hospital, Inc. et al., Case Number 1:15-cv-11890-ADB, the court reviewed the purpose of the peer review privilege and precedent addressing the applicability of state privileges under the Federal Rules of Evidence, and concluded that the privilege should not apply because the “goal of the peer review privilege would not be thwarted if it was not applied” in a case predicated on alleged billing fraud. The court’s decision is instructive for health care providers and whistleblowers in connection with discovery and the applicability of medical peer review privileges to FCA cases.
Continue Reading Massachusetts Federal Court Declines to Apply State Medical Peer Review Privilege in Federal Whistleblower Case

On November 20, 2020, the Department of Health & Human Services (HHS) released heavily anticipated final rules revising the regulatory exceptions to the Physician Self-Referral Law (also known as the Stark Law), the Anti-Kickback Statute (AKS) safe harbors, and the Beneficiary Inducements Civil Monetary Penalties (CMP) regulations.  The changes to the regulations go into effect on January 19, 2021 (except for one change to the Physician Self-Referral Law that becomes effective January 1, 2022). In a separate rule also released November 20th, HHS removed safe harbor protection for rebates involving prescription pharmaceuticals and created a new safe harbor for certain point-of-sale reductions in price on prescription pharmaceuticals and pharmacy benefit manager service fees.

The full text of each rule is available below.


Continue Reading Physician Self-Referral Law (Stark), Anti-Kickback Statute, and Beneficiary Inducement CMPs – HHS Releases Final Rules

Excerpt of a contributed article published in Medical Economics on November 18, 2020.

Past Special Fraud Alerts have portended heightened enforcement activity.

On November 16, 2020, the Office of Inspector General of the Department of Health & Human Services (OIG) issued a Special Fraud Alert (Alert) highlighting the fraud and abuse risks posed by speaker

Health care providers interested in applying for additional CARES Act Provider Relief funding from the Phase 3 General Distribution have until November 6, 2020 to submit an application to the Department of Health & Human Services (HHS).
Continue Reading REMINDER: November 6 Deadline for New CARES Act Funding Approaches