Medicaid & HIPAA: Implications for Proprietary Correctional Health Care Vendors and Their Handling of PHI

Highlighted Stories

Editor's Note

Destruction of evidence, publishing personal health information (PHI) on a website, or illegally withholding public records might seem to be unusual activities for a medical provider but these actions seem to be run of the mill for correctional health care vendors. In the first four highlighted stories from four states (Oregon, New Mexico, Alaska, and Arizona), Wellpath, NaphCare and Centurion have been accused and found guilty of such mismanagement.

Over the years, our subscribers have been no strangers to stories about correctional health care vendors engaged in what in the non-carceral world be considered highly unusual. But since these stories have been continuing over a long period of time, what exactly can change? As our subscribers are also well aware, since COCHS has been banging this drum for quiet awhile, what can change is bringing Medicaid behind the walls of correction through the multiple 1115 waivers that have been approved in many states and sections 5121 and 5122 of the Consolidated Appropriations Act of 2023.

Of the four states mentioned above, Oregon and New Mexico have had their 1115 waivers approved, Arizona’s waiver is pending (though the justice-involved section may be in question), and Alaska has not applied. Now, let’s be honest—who is actually going to serve as the Medicaid provider in these states and their local jurisdictions? Likely the current correctional healthcare vendors. It will be very interesting to see the repercussions for these companies, given their track records. Furthermore, since some of the highlighted articles address issues with medical records (such as NaphCare publishing PHI on a website!), these vendors may not only face scrutiny over their potential role as Medicaid providers but also over their ability to comply with HIPAA regulations.

These HIPAA issues are particularly germane given the fifth and last highlighted story. CorrectCare Integrated Health, a claims processing services for correctional institutions and correctional healthcare vendors, has settled a class action suit for $6.4 million, brought by incarcerated people. The class action suit was in response to a data breach that exposed PHI due to what CorrectCare described as a misconfigured server.

PHI

A federal judge ruled Monday against the correctional health care giant Wellpath after company leaders “intentionally destroyed email evidence in order to prevent its use at trial.” The ruling stems from the case of a woman who died in 2018 at the Josephine County Jail in Oregon. Wellpath destroyed emails surrounding her death through its implementation of a company-wide policy known as the “purge.” After the company deleted emails, it then spent years making misleading statements that intentionally omitted why it was unable to turn over emails, according to three separate rulings from federal judges in two states. The policy was “conceived and approved” by some Wellpath executives. “Its architects referred to the policy internally as the ‘purge.’”

A state judge has ordered a former New Mexico prison medical care provider to pay $100 per day for illegally withholding public records from the Human Rights Defense Center for about four years. First Judicial District Judge Kathleen McGarry Ellenwood ordered Centurion Correctional Healthcare to pay the penalties — the maximum allowed under the state’s Inspection of Public Records Act — after determining the company had withheld the records “intentionally and in bad faith.”

The private, legally protected medical information of 74 incarcerated people in Alaska was displayed on a publicly accessible website by a state Department of Corrections contractor. An ACLU of Alaska staff member doing research stumbled across what appeared to be a training website for NaphCare, the Alabama-based for-profit prison health care giant the state contracts with for correctional health records management and found training examples that divulged what seemed to be highly sensitive medical information. The website showed full names of dozens of Alaska inmates along with prescription medications, dosages, and physical and mental health diagnoses, as well as whether and when a person was in substance use treatment.

Medical information for some Arizona inmates that should be private was recently found online. The ACLU reported the problem after saying they observed private medical information for inmates in Arizona listed on a manual through the website for contracted healthcare provider, NaphCare.

A misconfigured web server and the exposure of sensitive information for nearly 600,000 prison inmates in 2022 will cost medical claims processing company CorrectCare $6.49 million to settle a consolidated proposed class action lawsuit, according to court records. "CorrectCare is a third-party administrator for correctional facilities and a HIPAA business associate. How diligent are correctional institutions in selecting vendors to perform HIPAA-regulated services?" said regulatory attorney Paul Hales of Hales Law Group. "HIPAA security rule safeguards should detect an IT misconfiguration."

Medicaid

In a major step for health equity in California, the Department of Health Care Services (DHCS) announced that three California counties—Inyo, Santa Clara, and Yuba—were approved as of October 1 to begin delivering a targeted set of Medi-Cal services to people returning to communities after incarceration. All California counties are required to implement this initiative before October 1, 2026. California is the first state in the nation to receive federal approval and implement this historic initiative.

Louisiana submitted a request for a new five-year Medicaid section 1115(a) demonstration entitled "Louisiana Reentry Demonstration." This demonstration aims to provide Medicaid coverage to qualified individuals prior to their release from prison or jail. The state seeks to cover Medicaid services, including case management, medication-assisted treatment (MAT), and a 30-day supply of prescription drugs, among other services, for 90 days before a Medicaid-eligible individual's release from prison or jail.

In January 2023, California became the first state to receive approval from CMS for a 1115 waiver demonstration request to amend Medicaid’s inmate exclusion. A key to addressing these reentry risks is building continuity of care from jail to community when they are released.

This paper explores the process and impact of convening a cross-sector peer learning network to foster coordination and collaboration between criminal justice, health care, behavioral health and community partners in support of this new Medicaid and criminal justice initiative.

Opioid Epidemic

Two Democratic lawmakers are pushing the Drug Enforcement Administration to take a more lax approach to regulating buprenorphine, a medication used to treat opioid addiction. A new legislative proposal introduced this week by Sen. Martin Heinrich (D-N.M.) and Rep. Paul Tonko (D-N.Y.) would force the federal government’s drug police to back off from monitoring buprenorphine the same way it monitors more potent prescription painkillers.

Given the intersection of public health and criminal justice systems in the context of unlawful drug use, it is essential that drug prevalence data are accurate. This is particularly crucial given the soaring rates of opioid-related overdoses, fueled in large part by the introduction of highly potent fentanyl and related analogs. Law enforcement and policymakers need timely, evidence-based intelligence of drug prevalence in criminal justice populations, including patterns of fentanyl and fentanyl-related compounds.

To prevent substances from entering the jail, some jails are offering individuals immunity for possession prior to booking. A person can willingly turn over any illegal substances prior to intake without additional charges. But a person struggling with addiction may attempt to conceal the drugs anyway if it means an opportunity to use during incarceration. Drug testing on arrest (DToA) has been in place in the United Kingdom since 2003 and has been shown to reduce drug use. Implementing drug testing at intake would allow for immediate intervention and targeted support based on the amount and type of substances found in a test.

A Wisconsin program that sends suspects in minor drug-related crimes to treatment instead of jail is paying off, a new study shows. Researchers who evaluated the Madison Area Recovery Initiative (MARI) found that non-violent offenders who were given a clinical assessment and six months of substance use treatment were less likely to be arrested, jailed or die of an overdose in the year after their initial arrest.

A team from the Community Practice Innovation Center at South Dakota State University has been awarded a $3 million grant to expand and facilitate services for individuals transitioning out of South Dakota prison systems. The grant, which comes from the Health Resources and Services Administration, will continue the START-SD (Stigma, Treatment, Avoidance and Recovery in Time) work on prevention, treatment and recovery for substance use disorder in South Dakota.

Somerset County (PA) Jail’s medical treatment provider will start dispensing medication – and treatment – to some inmates suffering with opioid use disorder. It’s part of a contract addendum between Somerset County and PrimeCare Medical approved this week. PrimeCare would provide the daily medication – aligned with counseling services – to inmates who were already prescribed medications before they were jailed, commissioners said.

Incarcerated Women

A report published by a federal watchdog agency highlights key concerns of pregnant people behind bars, including stress and anxiety that can threaten maternal health, inconsistent access to doctors and other services, and challenges getting to pregnancy-related appointments. The report, by the Government Accountability Office (GAO), a nonpartisan arm of Congress, also calls attention to the lack of data collection by the U.S. Department of Justice on incarcerated pregnant people in state prisons and local jails.

Incarceration rates in the United States are the highest in the world. Cancer risk is higher among incarcerated persons in the United States than nonincarcerated. Incarcerated women experience high cancer rates relative to incarcerated males. Health literacy is associated with increased screening, yet there is minimal published information on cancer screening literacy among women who are incarcerated in United States prisons.

Juveniles

While over half of justice-involved youth are covered by Medicaid or CHIP, federal law has historically prohibited states from receiving federal financial participation for services provided while youth are in correctional settings due to the “inmate payment exclusion.” By implementing policies to meet recent federal requirements and opportunities, states can reduce Medicaid coverage disruptions and improve continuity of care for justice-involved youth.

Many people who say they were raped or molested while confined at California juvenile facilities are out of time to sue the county governments that oversaw their care. Gov. Gavin Newsom vetoed a bill that would have changed the statute of limitations to give people sexually abused in juvenile facilities more time to sue. His decision infuriated victim advocates, who accused him of bowing to pressure from local officials concerned about how to pay for an onslaught of litigation.

BOP

A federal review has concluded that a prison facility in Lewisburg, Pennsylvania, is not adequately addressing the risks of suicide among its inmates. This violates Federal Bureau of Prisons (BOP) policies and raises urgent concerns about the questionable treatment of prisoners within the facility. The Justice Department's Office of the Inspector General (OIG) has also expressed ongoing concerns about Lewisburg Federal Prison.

Co-Pays

Early intervention is essential for improving health outcomes, but medical fees often prevent individuals from seeking timely treatment, leading to more severe health emergencies. This issue is especially problematic for people entering prisons and jails, as they frequently lacked access to healthcare before incarceration and may already suffer from chronic illnesses or disabilities.

Data & Statistics

BJS has released the 2023 Annual Survey of Jails in Indian Country dataset through the National Archive of Criminal Justice Data. This survey collects data on all known adult and juvenile facilities (such as jails, confinement facilities, detention centers, and other correctional facilities) operated by tribal authorities or the Bureau of Indian Affairs.

State Roundup

Alabama

Two Alabama jailers have admitted to letting an inmate freeze to death while housed naked in a filthy jail cell without running water, a bed or a toilet for two weeks. According to court documents filed on Monday, Heather Lasha Craig and Bailey Clark Ganey have agreed to admit to their roles in the death of Anthony Mitchell, 33. Craig pleaded guilty to deprivation of rights under color of law.

California

California, Riverside County

Colorado

While the next legislative session is still three months away, Colorado lawmakers are already working on legislation to help people living with severe mental illness. The Treatment of Persons with Behavioral Health Disorders in the Criminal and Juvenile Justice Systems Interim Committee advanced a slate of bills this week aimed at helping people with mental illness stay out of the criminal justice system.

Florida

Inmates are staying in jail longer than before the Covid-19 pandemic, according to a report presented to the Leon County Commission. The report found that the jail’s current configuration, where each housing unit has two beds instead of the designed one, presents a “potentially dangerous” situation. The report also found no expansion of the jail is required, easing the minds of local lawmakers who feared an expansion would be necessary. However, mental health continues to be a top problem in the system, the report found. Of people incarcerated for “violent” offenses, the report said more than half have mental health issues.

Georgia

A Justice Department investigation into Georgia’s state prison system found conditions that violate the Constitution, including rampant violence, sexual assault, drug smuggling and gang activity. The investigation by the department’s Civil Rights Division comes as the system, which houses around 50,000 inmates at any given time, is in crisis — with 142 homicides reported at facilities run by the Georgia Department of Corrections from 2018 to 2023.

Hawai'i

There has been at least seven suicides in Hawai'i's correctional system since 2022. The suicides are a symptom of what officials, staff and experts described as a mental health system in trouble again, nearly two decades after the U.S. Department of Justice sued the state for alleged “deliberate indifference” to mental health needs at the largest jail on Oahu.

Idaho

Unlike most states, Idaho lacks regulatory oversight of local jails. Sheriffs and jail commanders set their own standards. Annual inspections are voluntary, scheduled months ahead of time, and the sheriff’s association conducting the inspections is exempt from the state’s public disclosure law. If jails fail the inspections, there’s nobody who can force them to comply.

The Idaho Department of Correction has agreed to increase staffing and dramatically increase medical care oversight as part of a long-running lawsuit over conditions at a prison south of Boise. The agreement filed with the U.S. District Court in Idaho Tuesday afternoon guarantees that the court will continue to review conditions at the Idaho State Correctional Institution for at least two more years.

New Jersey

The amount of time people are confined to their cells is just one problem for those incarcerated in New Jersey, according to a new report released by the state’s corrections ombudsperson. The ombudsperson, an independent office that investigates prison conditions, examined operations in one disciplinary housing unit at Northern State Prison in Newark where two inmates committed suicide in March.

Oregon

Governor Kate Brown announced that she will commute the sentences of 57 medically vulnerable adults in custody, due to their risk for significant health challenges should they contract COVID-19. The decision comes following the Governor’s direction to the Oregon Department of Corrections (DOC) to perform a case-by-case analysis of adults in custody vulnerable to COVID-19.

Texas

he Texas Department of Criminal Justice is at a critical point, according to the latest state review of the agency. The Sunset Advisory Commission’s staff review of TDCJ reportedly took place during a systemwide prison lockdown due to unprecedented levels of contraband and violence and inmate population projections that exceed the agency’s operational capacity. According to a Sunset staff analysis, TDCJ facilities are more dangerous now than they were a decade ago.

So far this year, 10 people have died while in custody at the Bexar County jail. Most of those people, officials have said, suffered from a medical episode. The Bexar County Sheriff’s Office (BCSO) said in a statement that it was booking a growing number of jail inmates with major health conditions and withdrawal symptoms.

Bexar County officials broke ground on an expansion project that aims to help even more jail inmates who struggle with mental health issues. At the same time, the goal is to also address the ongoing problem of overcrowding at the Bexar County Adult Detention Center. The $25 million expansion project for the Applewhite Recovery Center is made possible through federal funds from the American Rescue Plan Act.

Washington State

The Seattle Times spent six months reporting on two arrests and one death in Yakima County last year. What emerged was a story about the challenges of responding to mental health crises, the dangers of incarceration for ill people and the importance of comprehensive death investigations.Two men experiencing mental health crises were arrested under similar circumstances last year, with different results. Both Jim Curtice and Hien Trung Hua were placed into handcuffs, but Curtice was hospitalized and recovered, whereas Hua went to jail and died during a struggle with guards.

Wisconsin

One of eight guards charged in the deaths of two inmates at a troubled maximum security prison in Wisconsin has pleaded no contest to a reduced charge, becoming the first defendant to resolve their case. Former Waupun Correctional Institution guard Sarah Ransbottom pleaded no contest last week to a charge of violating a law governing conduct by prison staff and paid a $250 fine.

As rising temperatures continue to change Wisconsin's landscape, one group is particularly vulnerable: the nearly 23,000 men, women and youths currently housed in state Department of Corrections' facilities. In at least 44 states, including Wisconsin, Departments of Corrections don't provide universal access to air conditioning. And as climate change ramps up, with its onslaught of unprecedented heat waves, conditions in prisons will only worsen.

Rikers Island

Detainees with mental health issues are sometimes locked inside cells for weeks or months at a time without access to their needed medication and left to deteriorate, a former social worker on Rikers Island told the jails’ watchdog board. The alleged practice, which the DOC did not confirm or deny, would appear to be a violation of the BOC’s rules that govern the rights of detainees on Rikers Island, a jail complex where half of the incarcerated population has been diagnosed with a mental illness.

Los Angeles County

One person died and seven others were hospitalized after a cluster of suspected overdoses at a downtown Los Angeles jail. The official cause of death is still under investigation, but sheriff’s officials said that it was a suspected drug overdose, although they did not specify what drug might have been involved. In an emailed statement, the department said it “continually strives” to keep drugs from entering its jails by using drug dogs and mail scanners to detect illicit substances.

Researchers and L.A. County officials are calling for more funding for a program that diverts people with behavioral health conditions away from the criminal justice system. Out of the 669 people who graduated from the county’s Rapid Diversion Program since it began five years ago, 91% have avoided having a new criminal case filed, according to a study released last week by the RAND corporation.

San Diego County

Keith Galen Bach died from diabetic ketoacidosis after being denied his insulin while in custody at the San Diego County Jail. The county’s medical examiner ruled his death a homicide based on this denial. The American Diabetes Association updated its guidance on the treatment of diabetes in detention settings. The principle is simple: People with diabetes should receive care that meets national standards. Being incarcerated does not change these standards.

Proprietary Correctional Healthcare Vendors

Wellpath

When it comes to unpaid accounts, $6 million is a lot of money. The $6 million was supposed to have been paid to Michigan EMS agencies by Wellpath, “which was the contract health insurance provider for inmates and prisoners within the Michigan Department of Corrections facilities,” said Angela Madden who is the Executive Director of the Michigan Association of Ambulance Services (MAAS). MAAS has asked Michigan’s Department of State Attorney to take legal action against Wellpath to get the outstanding $6 million (see Editor's Note 09-24-2024).

Worcester County (MD) officials unanimously voted to renew the service contract for the medical provider at the county jail, even as that provider is a defendant named in a pending $5 million wrongful death lawsuit. Jennifer Albero of Delmar is the plaintiff in a federal lawsuit filed earlier this year. Her son Kyle Arthur, 36, took his own life in the jail on Sept. 10, 2021, after suffering the effects of opiate withdrawal.

The Peoria County Board approved a new contract to provide healthcare to inmates in the Peoria County Jail as part of their content agenda. A three-year $8,7 million contract was made with Wellpath will provide detainees with medical services. This will cover inmates after their current coverage ends.

Naphcare

In 2022, Judge Roslyn Silver ruled that Arizona was violating prisoner’s rights by not providing proper care and that healthcare faults were causing preventable deaths in Arizona prisons. In 2023, the Arizona district court issued another injunction to speed up the process. NaphCare claims to be making improvements on providing proper care and staffing to its facilities. Independent court monitor reports many objectives had not been met. Noncompliant areas include hiring enough psychiatric staff and additional physicians and having proper medical facilities to house patients.

Sheriff Kelly Martinez faced a tough crowd. More than a dozen relatives of people who have died in San Diego County jails filled the seats. During public comment at the start of the meeting, they described how jail staff had failed their loved ones, and expressed their frustration with what they see as a lack of attention to reforms. Efforts to improve medical and mental health services hit a snag last year when NaphCare, the Alabama-based correctional medical giant brought in to manage jail health care, was found to be out of compliance with its contract. In the interview, Martinez and Lopez defended the decision to continue with NaphCare.

Turn Key Clinics

The deadline looms to find another medical provider for the Oklahoma County Jail. The partnership with Turn Key Health Clinics ended on October 9th. Turn Key Health Clinics announced last month it is ending it partnership with the detention center due to insufficient security staff for providers. Groups like the People’s Council for Justice Reform have called for this change after more than four detainees have died this year. Jail officials say they hope to get a request for proposal out as soon as possible to start getting in bids for a new provider (see Editor's Note 09-17-2024).

Cleveland County (OK) officials have hired a consultant to investigate detainee deaths at the county jail that will also examine the policies of health care provider Turn Key Health. The Board of County Commissioners approved a contract with a Missouri-based consulting firm on Aug. 9 to examine the causes of detainee deaths and develop a plan to improve health and safety procedures at the jail.

Wexford

Wexford Health Sources, the company Illinois has paid for prison health care services for decades, has long faced accusations of neglect and abuse, including enforcing a “one good eye” policy and providing such poor treatment to older people with dementia that court monitors compared it to elder abuse. Nonetheless, earlier this year, Illinois inked a 5-year, $4 billion contract with Wexford, raising fresh questions about the state’s commitment to improving quality of care for incarcerated people.