The Law Offices of Alejandro Mora, PLLC The Law Offices of Alejandro Mora, PLLC 2026-06-18T17:07:30Z https://www.morahealthcarelaw.com/feed/atom/ WordPress /wp-content/uploads/sites/1604262/2023/05/cropped-ID-image-32x32.jpg On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[The cost of non-compliance: Ignoring data security and privacy regulations could hurt your medical enterprise]]> https://www.morahealthcarelaw.com/?p=48348 2026-04-16T00:14:53Z 2026-04-16T00:14:53Z For large and growing health care enterprises in Texas, data security and privacy compliance is no longer just a regulatory obligation—it is a core business need. Ignoring or otherwise failing to honor compliance requirements under HIPAA, the HITECH Act and evolving data privacy frameworks can trigger serious consequences. The financial exposure alone can be staggering. Under current enforcement standards, HIPAA violations can carry penalties ranging from hundreds of dollars per violation to over $2 million annually for the most serious, uncorrected failures. Criminal exposure is also possible in cases involving intentional misuse of patient data, with fines reaching $250,000 and potential imprisonment. 

Compliance must be treated as a serious concern 

Penalties for data security and privacy compliance violations are often assessed per violation, not per incident. A single data breach affecting thousands of patient records can multiply liability quickly. Beyond regulatory fines, organizations must also absorb the costs of breach notification, forensic investigations, credit monitoring for affected patients, litigation and operational disruption. These secondary costs frequently exceed the value of initial penalties themselves. Recent enforcement trends illustrate a particular focus on risk analysis failures and inadequate security safeguards. Many settlements stem not from sophisticated cyberattacks alone, but from basic compliance breakdowns—such as failing to conduct proper risk assessments, implement access controls or timely report breaches. Regulators expect proactive compliance, not reactive responses after an incident occurs. Operational consequences can be just as damaging as financial penalties. Investigations often result in corrective action plans that require extensive policy overhauls, employee retraining and ongoing federal oversight. These mandates can strain internal resources and disrupt daily operations, particularly for large healthcare enterprises managing multiple facilities and complex data systems simultaneously. The reputational harm from a data breach or enforcement action can also be significant. Patients trust healthcare providers with highly sensitive information, and a failure to protect that data can erode confidence quickly.  In this environment, a robust, proactive and legally sound compliance approach is necessary. This includes comprehensive risk assessments, strong cybersecurity protocols, clear internal policies, employee training and well-defined incident response plans. It also requires ongoing evaluation as data privacy laws continue to evolve at both the federal and state levels. For healthcare enterprises, the cost of non-compliance is not limited to fines—it is a cascading set of financial, operational and reputational risks. Proactive legal guidance can help organizations identify vulnerabilities, strengthen compliance programs and respond effectively to emerging threats before they escalate into costly enforcement concerns accordingly. ]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[Beyond the red flag: Proactive strategies for large healthcare systems to survive and thrive during a Medicare audit]]> https://www.morahealthcarelaw.com/?p=48331 2026-03-31T13:02:35Z 2026-03-31T13:02:35Z Understanding what you are actually up against RAC, MAC and ZPIC auditors operate under the Medicare Integrity Program, authorized by 42 U.S.C. § 1395ddd, which gives the federal government broad authority to identify and recover improper payments. These are not random reviews. Auditors use data analytics to target billing patterns that deviate from peer benchmarks, and large health systems with high claim volumes present a wide surface area for scrutiny. The financial exposure is real. A single audit can trigger demand letters in the millions. More damaging, a pattern of noncompliance can result in exclusion from Medicare and Medicaid participation, a consequence that can threaten the viability of an entire system.

Building the internal controls that reduce your exposure

Waiting for an audit to test your documentation practices is the wrong order of operations. Strong internal controls do not just improve your audit outcomes. They also reduce the likelihood that an audit will find anything worth pursuing in the first place. Focus your infrastructure on these areas:
  • Conduct regular internal claim audits across your highest-volume service lines, comparing your documentation against Medicare's Local Coverage Determinations and National Coverage Determinations.
  • Train clinical and coding staff together, not separately, so that documentation and billing code selection stay aligned at the source.
  • Establish a clear document retention and retrieval protocol so you can respond to a records request quickly and completely.
  • Monitor your denial rates by payer and by provider. A spike in denials often signals a billing or documentation pattern that auditors will notice before you do.
Getting these fundamentals in place before an audit request arrives puts you in a far stronger position to respond.

Handling an active audit without losing ground

If you receive an audit request, your response window is short and your documentation standards will face scrutiny under the Medicare appeals process, which protects your right to challenge adverse determinations. Use that right. The Medicare appeals process has five levels, and health systems that pursue appeals through the Administrative Law Judge level or beyond often recover a meaningful portion of initially denied claims. When you respond to an audit, keep these priorities in order:
  • Submit only the records requested. Producing documents beyond the audit's scope invites additional scrutiny.
  • Respond within the stated deadline. Late submissions can forfeit your appeal rights at that level.
  • Document every communication with the auditing contractor, including dates, names and the substance of each exchange.
A disciplined, well-documented response is often the difference between a contained review and an expanded one.

Turning audit pressure into long-term resilience

The healthcare systems that come out of a Medicare audit in a stronger position treat the process as a diagnostic, not a penalty. Every finding points to a gap in your documentation, coding or compliance workflow. Your job is to close that gap before the next review cycle begins. RAC and ZPIC audits grow more complex when your system manages multiple facilities and service lines, and a weak response strategy compounds that complexity fast. An attorney who understands Medicare regulatory structure can help you assess your exposure, build your appeal arguments and surface the systemic issues that claims data alone may not reveal.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[The ethical and legal implications of AI use in medicine]]> https://www.morahealthcarelaw.com/?p=48325 2026-01-07T03:10:42Z 2026-01-07T03:10:42Z AI is not infallible People tend to assume that machines are more efficient or accurate than humans. However, AI software is only as effective as the human who programmed the software and the person using the program. Individual medical professionals and the health care facilities that employ them could have liability for errors and oversights made by AI software. If a radiologist relies on software to evaluate imaging tests for signs of cancer and doesn't perform a manual check, that professional or the hospital where they work may be liable if they fail to diagnose a patient because AI didn't spot irregularities when assessing medical imaging test results.

Privacy issues

Medical records are subject to very strict federal privacy standards. Medical professionals typically need written releases to provide information about patients to one another or even to the family members of patients going through major emergencies. AI software developers often rely on the routine sharing of data, and there may be reason to worry about outside parties gaining access to private health care records and other personal information about individual patients. Facilities and practitioners may ultimately be liable for privacy issues triggered by the software they elect to use in their practice of medicine.

Algorithmic bias

Bias among medical practitioners is a common issue that can compromise the standard of care at a facility. Bias can also potentially affect how software operates. Algorithmic bias is a known issue with many AI programs. The bias of the person developing the software, limitations in the data already gathered and the views of the medical professionals using the software could result in diagnostic errors and medical oversights that have negative implications for individual patients. While AI may seem less biased, the reality is that algorithms can reinforce inherent biases and can negatively impact the quality of care that patients receive in some cases. Medical professionals and business leaders should evaluate the risks thoroughly before establishing internal policies regarding the use of AI for medical care purposes. Recognizing the potential pitfalls of reliance on AI software can limit the likelihood of a lawsuit and unfavorable outcomes for patients who trust the care providers using AI software.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[Medicare and Medicaid reimbursement issues]]> https://www.morahealthcarelaw.com/?p=47625 2023-04-07T17:11:11Z 2023-04-07T17:11:11Z rely on Medicaid and Medicare to pay for healthcare services. Although medical professionals want to provide medical care to those who need it, they may run into a few reimbursement challenges.

Compensation amount

One of the most significant issues medical providers face when they work with Medicaid and Medicare is the cost of care versus the amount of reimbursement. In fact, in 2020, the federal and state government underpaid medical providers by $75.6 billion. Unfortunately, many providers do not receive enough to cover their service costs because these insurance providers only pay 84 cents on every dollar, and they do not adjust enough for inflation, increasing the shortages.

Telehealth services

Today’s medical customers increasingly seek telehealth services. These services are especially valuable for those who live in rural areas and those who find it difficult to get to their appointments. However, Medicare and Medicaid site overuse, fraud, care quality and overpayment potential as reasons to avoid or reduce payments. Fortunately, the Consolidated Appropriations Act of 2023 extended telehealth payments for an additional two years.

Increasing denials

Although technology revolutionized healthcare services, payment software was not as beneficial. In fact, payers use software that results in increasingly more denials, and healthcare providers do not have the time to rework and resubmit these bills. In addition, health insurance companies, including Medicare and Medicaid, are for-profit organizations, so they receive incentives if they reduce their payouts. Medical professionals should investigate all the relevant issues and develop strategies to address them to gain the best Medicare and Medicaid reimbursement results.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[2 root causes of compliance issues in healthcare]]> https://www.morahealthcarelaw.com/?p=47624 2023-06-02T17:00:17Z 2023-03-03T20:20:16Z 1. Lack of training Human error represents a leading cause of compliance issues. Changing technology paired with updates in policies and procedures means healthcare workers may easily find their knowledge outdated. If you manage a healthcare facility, providing training allows you a way of refreshing your staff's knowledge. No matter what your role at work is, stay aware of changes that might alter what best practices you should use. Keep up on current Texas laws and regulations so you remain in the know even when things change.

2. Not considering compliance as a step in every process

While healthcare workers rightfully consider patient care as their first priority, regulatory compliance also requires consideration in everyday tasks. Often, employees think of compliance as someone else's job and fail in considering it until an issue arises. Having a plan in place for handling any potential breaches in compliance and fostering communication across departments creates a mindset focused on preventing issues throughout the facility. The consequences of a compliance issue in healthcare range from fines to legal action against health professionals. While regulatory compliance involves careful attention to detail, revisiting the basics of staff training and communication helps reduce the likelihood of serious problems arising.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[Understanding the Anti-Kickback Statute]]> https://www.morahealthcarelaw.com/?p=47623 2023-01-27T20:03:30Z 2023-02-01T20:02:37Z Explaining the Anti-Kickback Statute The AKS prohibits healthcare providers from giving or receiving rewards, also called remuneration or kickbacks, in exchange for promoting goods and services payable by Medicare or Medicaid, such as drugs and healthcare services. For example, a doctor might prescribe a medication to a Medicare patient and receive money from the pharmaceutical company for doing so. This provider is acting in violation of the AKS and committing Medicare fraud. The AKS applies to patients as well. For example, a provider may not give free services or waive copays to encourage patients to use his or her practice. Providers can still waive fees for patients who can not afford to pay.

Understanding the impact of kickbacks

Physicians and other healthcare providers wield a significant amount of influence. Patients trust them to recommend the most effective treatments, services and drugs. When providers accept kickbacks, it can affect their ability to make sound decisions about patient care. Accepting remuneration for referrals also creates an unfair competitive advantage for the company that is paying for business and can drive up Medicare and Medicaid costs. Potential consequences of violating the AKS can include fines, criminal penalties or the termination of the practice's Medicare contract. For healthcare professionals, accepting or offering kickbacks is never a wise decision.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[Tips for preventing fraud in your medical practice]]> https://www.morahealthcarelaw.com/?p=47622 2022-12-28T19:51:32Z 2022-12-30T19:50:31Z Separate roles and responsibilities No single staff member should be responsible for inputting patient record information, generating insurance company invoices and crediting payments. Divide these tasks between several employees to ensure a reasonable system of checks and balances. This prevents the lack of oversight that encourages fraudulent activity.

Require physician signatures on all check deposits and payments

Managing partner signatures must appear on any deposit records or payments made on behalf of the practice. This offers a management-level assessment of transactions as they happen so that you can audit and verify random samples.

Mandate background checks for all employees

Background checks can help raise red flags of concern with potential new hires. Conduct thorough background checks on everyone that you hire within the practice. This can help with malpractice and liability insurance as well because background checks help insurance carriers assess risk factors and determine premiums. With the additional inspection of those background checks, you have a sound defense with the board if issues arise. Proactive steps to establish procedures, checks and balances within your practice can reduce the risk of insurance fraud and can minimize even the appearance of impropriety. Protect your practice from medical board review with strict safety measures.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[How nursing homes can help keep their licenses]]> https://www.morahealthcarelaw.com/?p=47620 2022-12-06T15:45:29Z 2022-12-06T15:45:29Z Investigate possible abuse right away If an employee suspects abuse directed at a nursing home patient by another employee, it is in everyone's best interest to investigate the situation immediately. Not only can abuse cases jeopardize a long-term care facility's license, but physical, emotional, sexual and financial abuse can cause lasting trauma to victims and their families. Employees can take the initiative to report and ensure a speedy investigation into anything they see that does not look right.

Comply with all safety standards

Maintaining a clean, safe environment for everyone is essential for ensuring healthy residents and the continued operation of the facility. One notable safety standard is having enough staff members present to provide each resident with the proper care and medical attention. Keeping a sanitary environment is another standard help to all medical facilities. When staff do things that jeopardize a senior care facility's license, it is bad for everyone who comes into contact with the facility. Fortunately, adhering to some basic guidelines helps nursing facilities keep their licenses and keep their residents safe.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[Dallas-area doctor convicted in $54 million Medicare fraud scheme]]> https://www.morahealthcarelaw.com/?p=47618 2022-11-01T20:10:05Z 2022-11-01T20:10:05Z pleaded guilty on Oct. 25 to a federal wire fraud charge for his involvement in a $54 million Medicare fraud scheme. Daniel R. Canchola of Flower Mound pocketed nearly $470,000 in kickbacks and bribes for prescribing unneeded and unprescribed medical equipment and cancer genetic tests to Medicare beneficiaries.

Telemarketing firms, health care vendors targeted beneficiaries

The crimes occurred during a nine-month period from August 2018 to April 2019 in which Canchola worked in tandem with telemarketing companies and health fair vendors. Telemarketers targeted unsuspecting Medicare beneficiaries who also became targets while attending health fairs. These predators encouraged Medicare beneficiaries to agree to cancer genetic testing and receive medical equipment even though neither was necessary. Canchola then prescribed genetic cancer testing and durable medical equipment to patients he did not personally meet with, speak to or even treat. Examples of durable medical equipment include hospital beds, canes, crutches, blood sugar testing strips, oxygen equipment and CPAP devices. Sentencing is scheduled for March 15 at the U.S. Attorney’s Office for the Northern District of Texas in Dallas. Canchola faces up to 20 years in prison. In October 2019, the Texas Medical Board suspended Canchola’s license to practice medicine in the state.

Careers at risk

Medicare fraud remains a serious crime. Annually, many health care professionals put their careers at risk.]]> On Behalf of The Law Offices of Alejandro Mora, PLLC <![CDATA[The impact of telehealth on medical licensing]]> https://www.morahealthcarelaw.com/?p=47545 2022-10-15T15:32:49Z 2022-10-15T15:32:49Z The PREP Act The Public Readiness and Emergency Preparedness Act allows the Department of Health and Human Services to issue specific declarations during emergency situations that provide immunity from liability in areas of healthcare. One of the provisions of this act is the interstate practice of telemedicine in order to assist with a public health crisis or emergency. There are similar protections in place in certain states across the nation, but there are also specific requirements as to who can practice telemedicine. The telemedicine statute in Texas is the Texas Occupations Code, Chapter 111. This sets the standard of care for the health care provider and guidance on the advisability of telemedicine services in a particular situation.

State-level guidance

In Texas, there are strict guidelines in place for patient privacy and informed consent, much like one would find at an in-person visit. There are also requirements for a protocol related to abuse or fraud. While the physician needs to establish continual communication with the patient, the physician must have the appropriate medical license or authorization from the medical board in the state where the patient lives. In Texas, a healthcare provider licensed to practice medicine in Texas may engage in telehealth services within Texas. However, Texas participates in the Interstate Medical Licensure Compact which allows one application for licensing in several states.]]>