|
Welcome
Welcome to our fifth issue of 2025 of The Health Record -- our healthcare law insights e-newsletter.
In this edition, we look at the effect tariffs could have on pharmaceuticals, the rise in healthcare facilities as the target of major cyber attacks, Virginia's rural healthcare options, potential home healthcare legislation for Florida, CMS ending federal matches for Medicaid, a California data breach that involved LinkedIn, and how hospices can optimize telehealth services. Spilman attorney Josh Jarrell also addresses the specialized nuances of bonds with healthcare systems.
ANNOUNCEMENT
Congratulations to 18 Spilman attorneys located in West Virginia and two of our Virginia attorneys for being recognized by Super Lawyers for 2025. The objective of the Super Lawyers selection process is to create a credible, comprehensive and diverse listing of outstanding attorneys from more than 70 practice areas. The annual selections are made using a patented multiphase process that includes a statewide survey of lawyers, an independent research evaluation of candidates, and peer reviews by practice area. Many of these attorneys practice in our Health Care Practice Group and ancillary departments.
MEETINGS AND CONFERENCES
As always, we want to keep you informed about upcoming events that Spilman is sponsoring and/or in which our lawyers are participating.
DRI 2025 Employment and Labor Law Seminar, May 7–9, Nashville, Tennessee
Spilman is sponsoring this premier event, which is the ultimate gathering for top-tier management-side employment and labor attorneys, in-house counsel, human resources professionals, and employment practices liability insurance representatives from across the U.S. and Canada. In addition to Spilman’s sponsorship, our own Kevin Carr will be presenting: Glorious Laborious – The Definitive Update on The Year’s Labor Law Developments. Click here to learn more.
SuperVision Labor & Employment Symposium, May 30, Charleston, West Virginia
You are cordially invited to our 2025 SuperVision Labor & Employment Symposium - Working Hard or Hardly Compliant: Strategies, Solutions and Surprises in the New World of Labor and Employment Law. Join Spilman attorneys for our full-day SuperVision Symposium, designed to inspire your confidence in navigating complex employment decisions. This complimentary symposium is tailored for business owners, C-suite executives, HR professionals, and anyone who manages employees. Dive into a day of valuable insights on employment topics such as HR impacts from the new administration; employee relations; changes at the NLRB; free speech in the workplace and much more. Spend the day with us and leave armed with strategies and solutions to tackle the ever-changing world of labor and employment law. Click here to learn more and register.
We hope you enjoy this issue and will let us know if you have any questions or suggestions.
Brienne T. Marco
Member, Chair of the Corporate Department, Co-Chair of the Health Care Practice Group, and Editor of The Health Record
| | |
“The analysis, conducted by Ernst & Young, found the United States imported $203 billion in pharmaceutical products in 2023, with 73% coming from Europe -- primarily Ireland, Germany and Switzerland.”
Why this is important: Proposed tariffs and their effects on the cost of living for the average American are top of mind right now. According to a report recently commissioned by the pharmaceutical industry’s leading trade group, Pharmaceutical Research and Manufacturers of America, a 25 percent U.S. tariff on pharmaceutical imports, if passed, would likely increase U.S. pharmaceutical prices by up to 12.9 percent. The article notes that pharmaceutical products “have long been spared from trade wars due to the potential harms,” but that President Trump has threatened a tariff on pharmaceutical imports and has announced probes into pharmaceutical imports. --- Brienne T. Marco
| | |
“Ransomware attacks across all industries rose by 37% and are now present in 44% of breaches, despite a noticeable decrease in the median ransom amount paid, the report found.”
Why this is important: The upward trend of cyberattacks on the healthcare industry continues in 2025. A recent report from Verizon showed that ransomware attacks are up 37 percent. Despite this significant increase, the good news is that median ransomware payments are down significantly from $150,000 to $115,000. This decrease in ransom payouts is attributed to the 50 percent increase in victims following the federal government’s recommendation to refuse to pay the ransom. This significant increase in victims not paying the ransoms is also likely attributable to the fact that more healthcare facilities are prepared in advance of a ransomware attack, and have their systems regularly backed-up so that they do not need to pay the ransom to get access to their data.
With the increase in attacks, the targets for attacks in the healthcare sector are changing. Cybercriminals are now attacking vendors on the periphery of the healthcare industry as a way to get patient information. Radiology service providers, pharmaceutical firms, IT providers, medical transport companies, and pharmacies are prime targets for these new attacks. Not only are the tactics for attack evolving, but the motivations behind the attacks are evolving as well. There is an increase in espionage-motivated attacks in the healthcare industry, with those types of attacks increasing from 1 percent in 2023 to 16 percent in 2024.
Even if you are a small healthcare provider or a healthcare-related vendor, there are simple and inexpensive ways to protect your network. The most important one is to install all software patches to protect against known vulnerabilities. Another important way to protect your network is regular employee training to teach your employees to recognize evolving threats and avoid becoming a victim. Planning before you are a victim of a cyberattack is also a key way to protect your data. With the increase in cyberattacks and the increased sophistication of those attacks, having a data breach response plan in place before you are a target of a cyberattack is a necessity. This includes knowing what to do if one of your vendors is a victim of a cyberattack that compromises your patients’ data. If you need assistance with preparing to thwart a cyberattack or to review your contracts with vendors to ensure that you are protected in the event that they become the victim of a cyberattack, please contact a member of Spilman’s Health Care Practice Group for assistance. --- Alexander L. Turner
| | |
“Virginia is one of 18 states that allows such mergers, and a bipartisan effort that sailed through the 2025 session could see those mergers become more frequent.”
Why this is important: Virginia has a law that allows competing health systems to merge into a single health system with the approval of its Legislature. Critics of such legislation argue that with the elimination of competitors, the cost of healthcare to consumers will rise and quality-of-care will suffer. Proponents of the law argue that Virginia has a responsibility to rural and low-income communities to maintain access to hospitals and healthcare, which, in some instances, will not survive without full control of the market. The only example of such a system, known as a certificate of public advantage (COPA), is Ballad Health in rural southwest Virginia, a network of 20 hospitals created from the merger of the Mountain States Health Alliance and Wellmont health systems in 2018. The Ballad Health merger was approved by both Virginia and Tennessee officials, in part, due to the threat of hospital closures. Ballad Health has reportedly failed to meet several quality and performance benchmarks set by state and federal officials, but more recent reports show improvement.
Earlier this year, Lynchburg Delegate Wendell Walker introduced legislation to make it easier for Virginia communities that meet certain criteria through a certificate of public need (COPN) to establish new or expand health care facilities in underserved areas, referred to as “medical deserts”, by offering an expedited application and review process. This legislation was signed into law on March 24, 2025, and becomes effective July 1, 2025. --- Jennifer A. Baker
| | |
"This bill is designed to support the long-term viability of Florida’s home health system by ensuring residents have access to quality care, offering employees better career opportunities and enabling agencies to operate efficiently in a rapidly changing industry.”
Why this is important: The Florida House of Representatives has passed a transformative piece of legislation aimed at strengthening the state’s home healthcare system—a move that could have sweeping implications for patients, caregivers, and healthcare agencies across the state. The bill, hailed as a landmark step forward, is designed to expand access to home-based care, improve quality standards, and create a more sustainable infrastructure for one of Florida’s most critical and fastest-growing healthcare sectors.
Florida is home to one of the largest elderly populations in the United States, and the demand for home healthcare continues to rise. For many aging or chronically ill residents, receiving care in the comfort of their homes is not just a preference—it is a necessity. This bill addresses long-standing challenges such as limited access in rural and underserved communities, overworked care providers, and inconsistent quality across agencies. By providing a framework for better oversight and support, the legislation helps ensure that residents can rely on consistent, compassionate, and competent care.
A central goal of the bill is to enhance career opportunities and improve conditions for the dedicated professionals who deliver home health services. The legislation includes measures to promote workforce development, address labor shortages, and support continuing education and training. In doing so, it not only uplifts caregivers but also ensures a higher standard of care for patients. A stable, well-trained workforce is the cornerstone of a reliable home health system, and this bill reflects a critical investment in those on the front lines.
Home healthcare agencies operate in an increasingly complex regulatory and financial environment. With rising costs, shifting reimbursement models, and growing administrative demands, many agencies struggle to remain viable. This legislation seeks to streamline operations and remove bureaucratic barriers, enabling agencies to focus more on care delivery and innovation. By fostering efficiency and adaptability, the bill empowers providers to meet the evolving needs of Florida’s diverse communities.
“This bill is designed to support the long-term viability of Florida’s home health system by ensuring residents have access to quality care, offering employees better career opportunities, and enabling agencies to operate efficiently in a rapidly changing industry,” lawmakers stated in a joint release.
The legislation represents a proactive and balanced approach to a sector that touches countless lives. It recognizes that the future of health care is increasingly home-based and that Florida must lead with policies that reflect both compassion and pragmatism.
As the bill moves forward to the Senate and implementation stages, stakeholders across the healthcare spectrum—patients, families, providers, and policymakers—are watching closely. If successful, this effort could become a model for other states grappling with similar challenges, proving that smart legislation can meaningfully improve care outcomes and system resilience. --- Kevin L. Carr
| | |
“The Centers for Medicare and Medicaid Services will restrict federal funds for state-based programs that go toward certain priorities like rural broadband and student loan repayments.”
Why this is important: The Centers for Medicare and Medicaid Services (CMS) will begin rejecting, or not extending, federal matching fund requests for designated state health programs (DSHPs) and designated state investment programs (DSIPs) under section 1115 waiver authority, also known as Medicaid Demonstration waiver. Some of these programs are for such things as rural broadband and student loan repayments. In support of this initiative, CMS cited concerns over the states not meeting their own financial obligations and that these funds do not always go to Medicaid members. DSHPs and DSIPs reportedly saw an increase in federal funds from $886 million in 2019 to $2.7 billion in 2025. Under the Trump administration, CMS is now looking to reduce federal financial investments for what counts as Medicaid-reimbursable, which includes such things as certain in-home services, rural high-speed internet, and student loan repayments. CMS will also be eliminating expenditure approvals associated with the provision of non-emergency care to individuals who fail to meet citizenship or immigration status requirements to be eligible for Medicaid. --- Jennifer A. Baker
| | |
“The state’s health insurance exchange transmitted pregnancy and domestic abuse data during a marketing campaign.”
Why this is important: Do you know where your protected health information (PHI) is going? Recently, residents of California who participated in the state’s health insurance exchange had their PHI shared with LinkedIn via trackers installed on the exchange’s website. Information submitted by the residents of the state to the exchange’s website was sent to LinkedIn via LinkedIn’s Insight Tag. These trackers transmitted data regarding whether individuals were blind, pregnant, used a large amount of prescription drugs, were transgender, or were the victims of domestic violence. The trackers have now been removed, and the error was attributed to the state’s transition to a new ad agency that was marketing the exchange on LinkedIn. The intent was to use the trackers to remind people that there was an upcoming deadline for open health insurance enrollment. The trackers were allegedly in place for a year before they were discovered, and millions of participants’ data were impermissibly shared.
Even though the breach was only discovered in late April, LinkedIn has already been sued in a putative class-action. The lawsuit, filed in the Northern District of California, alleges that LinkedIn and Google received health data from web trackers on Covered California without the knowledge or consent of users. The putative class representative alleges that the trackers violate federal and California law, including the California Invasion of Privacy Act. In addition to the filing of the lawsuit, this breach has drawn the attention of lawmakers who want to further investigate this matter and determine how this happened, how many people were impacted, and how to prevent similar breaches in the future. --- Alexander L. Turner
| | |
“The most recent extension came last month with the Full-Year Continuing Appropriations and Extensions Act 2025.”
Why this is important: Telehealth providers, including hospice providers who utilize telehealth, want to make pandemic-related telehealth waivers instituted by the U.S. Centers for Medicare & Medicaid Services permanent. Currently, the Full-Year Continuing Appropriations and Extensions Act of 2025 extends the waivers that currently allow hospices the flexibility to perform face-to-face recertification through telehealth. Those waivers are currently set to expire on September 30, 2025. If the waivers were made permanent, then hospice providers would be incentivized to invest in using telehealth to increase their services. In order to do that, hospice providers need a regulatory framework that addresses patient eligibility and sets care guidelines and quality standards. Hospice providers want to use telehealth because they are experiencing staffing shortages, and so that they can improve health disparities among underserved patient populations. Telehealth will provide hospice providers with the flexibility to address these issues by increasing cost-effectiveness, clinical capacity, timely access, and improving care coordination. --- Alexander L. Turner
| |
Healthcare Bills that Passed in the West Virginia Legislative Session This Year | | |
S.B. 458 has been approved by Governor Morrisey and is focused on making the state more competitive by easing licensure qualifications for people who move to this state. Specifically, it establishes universal professional and occupational licensing reciprocity in West Virginia and standards used by boards of examination and registration for accepting the professional and occupational licenses issued by other states.
H.B. 2402 provides access to the health records of a minor child to parents, guardians, and foster parents unless otherwise ordered by a court if the minor child has graduated high school or equivalent, is emancipated, or is married.
S.B. 565 expands the scope of practice for optometrists to offer certain ophthalmic laser procedures, provided that they have met certain minimum educational and training requirements. This bill became law without the Governor’s signature, perhaps signaling a concern over the wisdom of this policy.
H.B. 3444 also became law without the Governor’s signature. The purpose of this bill is to repeal the sections of code requiring the administration of certain medications to the eyes of newborns to prevent inflammation or other communicable diseases. The principal effect of this repeal is that it removes the potential misdemeanor penalties that could have been levied on those who failed to administer the medications. Practically, however, the standard of care for newborns would mean that such medications will continue to be administered. --- Alexander Macia
| |
Featured Attorney Question & Answer | | This is our Featured Attorney Q&A to introduce you to our large healthcare law team. To help you get to know our team a little better, we are highlighting attorneys in each issue by asking them a healthcare-related question. We hope their responses will be insightful for you. | | |
Joshua L. Jarrell
Member; Chair, Public & Project Finance Practice Group; Co-Chair, Banking and Finance Practice Group
Morgantown, WV
304.291.7949
jjarrell@spilmanlaw.com
Q: Bonds issued for healthcare projects (like building hospitals, clinics and medical research facilities, and securing investments for equipment) often involve complex legal issues. As the Chair of Spilman’s Public & Project Finance Practice Group and Co-Chair of our Banking and Finance Practice Group, what are your baseline recommendations when it comes to bond deals and public financing scenarios?
A: Hospital bonds are typically issued as a subset of municipal bonds called private activity bonds. In these cases, a public entity issues bonds on behalf of a nonprofit hospital or healthcare organization to raise capital for projects such as construction, renovation, or equipment purchases. Although the proceeds benefit a private, nonprofit entity, these bonds can still qualify for tax-exempt status under federal law if certain requirements are met. This is commonly accomplished under the rules for “qualified 501(c)(3) bonds”.
These tax-exempt private activity bonds allow nonprofit hospitals to access lower borrowing costs, as the interest paid to investors is typically exempt from federal (and often state and local) income tax. However, strict IRS and regulatory requirements must be satisfied to maintain this tax-exempt status, including limits on private business use and compliance with ongoing reporting and operational rules
When it comes to bond deals, for healthcare projects or otherwise, here are a few baseline considerations:
- Confirm Your Legal Authority. First and foremost, ensure that your organization has the clear legal authority to issue bonds for the intended healthcare project. This involves a careful review of enabling statutes, municipal charters, and other governing documents to confirm that the proposed financing is permitted under state and local law as well as the healthcare entity’s corporate governance requirements. In many cases, this step requires obtaining formal approvals from your governing board, or local or state government agencies. In some cases, the “applicable elected representative” (typically, the Governor) must provide final approval after a TEFRA hearing, which is a public hearing required by section 147(f) of the internal revenue code for private activity bonds. After the public hearing is held and community input is received, the governor’s approval serves as the official public endorsement needed for the issuance of tax-exempt private activity bonds. Overlooking any of these requirements can delay or jeopardize your project.
- Structure Repayment Thoughtfully. You’ll need a clear plan for how the bonds will be repaid. Where is the revenue coming from? What covenants will apply to protect investors? When structuring repayment for municipal bonds, it’s essential to clearly define how the bonds will be paid. For hospital revenue bonds, repayment typically comes exclusively from the revenue generated by the hospital’s operations after covering operating expenses. This makes it crucial to realistically project future revenues and consider risks like changes in healthcare regulations, reimbursement rates, or patient volume. The debt service should be tailored to match expected cash flows, and strong covenants may be put in place to protect investors. Because these bonds are not backed by taxing power, careful planning and conservative assumptions are important to ensure ongoing repayment and to maintain investor confidence. This is where creative thinking and experience really matter.
- Due Diligence and Disclosure Obligations. Due diligence and disclosure are critical legal requirements in municipal bond financings, particularly for healthcare projects. Issuers must conduct a thorough review of financial statements, operational history, regulatory compliance, and potential risks associated with the project. All material information must be accurately disclosed to investors, including project details, financial data, risk factors, legal matters, and tax considerations. Ongoing disclosure obligations may also apply, such as annual financial updates and timely notice of significant events like payment defaults or rating changes. Failure to meet these requirements can result in legal liability, so it is essential to work closely with experienced bond and disclosure counsel throughout the process.
- Don’t Overlook Tax and Regulatory Compliance. Don’t forget about the tax side of things. Tax compliance is fundamental to municipal bond financings, particularly for healthcare projects seeking tax-exempt status. To qualify for federal tax exemption, issuers must meet strict requirements under the Internal Revenue Code, including limitations on private use, arbitrage rules, and ongoing reporting obligations. Failure to comply with federal and state tax laws can result in loss of tax-exempt status and significant financial penalties. The right professionals will help you stay compliant on all fronts.
In short, healthcare bond financing is just one piece of the much larger public finance picture. The process can be complex, but the right team of legal, financial, and tax professionals can help navigate it and keep your project on track. If you have questions about municipal bonds or public financing, don’t hesitate to reach out to any of our Spilman attorneys. We’re here to help guide you every step of the way.
| | |
This is an attorney advertisement. Your receipt and/or use of this material does not constitute or create an attorney-client relationship between you and Spilman Thomas & Battle, PLLC or any attorney associated with the firm. This e-mail publication is distributed with the understanding that the author, publisher and distributor are not rendering legal or other professional advice on specific facts or matters and, accordingly, assume no liability whatsoever in connection with its use.
Responsible Attorney: Michael J. Basile, 800-967-8251
| | | | |
