News and Insights

Visit regularly for up-to-date information on relevant news, firm announcements and additions to our AZ Health Law Blog.

Written by: John A. Conley, Aaron E. Kacer and Lauren A. Crawford

On Friday, December 17, 2021, a federal circuit court of appeals lifted a stay banning implementation and enforcement of the Occupational Safety and Health Administration’s (“OSHA”) Emergency Temporary Standard on COVID-19 vaccination and testing for employees of employers with at least 100 employees (“OSHA Rule”).[1]  The OSHA Rule, also known as the vaccine-or-testing mandate, covers approximately 80 million workers in the United States. 

What does the OSHA Rule require?

Generally, for employers with at least 100 employees (“Large Employers”), the OSHA Rule requires face covering requirements, a written policy, collection of proof of vaccination, creation of a vaccination status records, removal of COVID-19 positive or untested employees from the workplace, maintenance of employee medical records, and certain employee communications about the employer’s policies and vaccine information from the Centers for Disease Control and Prevention.  

More specifically, the OSHA Rule requires all employees of Large Employers to be fully vaccinated or submit weekly COVID-19 testing and wear a face mask while in the workplace.  Additionally, the employer must:

  • Establish, implement, and enforce a written policy that either (1) requires mandatory vaccinations, or (2) allows employees to choose either to be fully vaccinated against COVID-19 or provide proof of regular testing for COVID-19 and wear a face covering. 
  • Determine the vaccination status of each employee.  In instances where an employee is unable to produce acceptable proof of vaccination, a signed and dated statement by the employee is acceptable proof of vaccination.
  • Keep records of employee vaccination status in a file separate from the employee’s personnel file.
  • Provide a reasonable amount of time to each employee for each (or only) vaccine dose, including (1) up to 4 hours paid time off, including travel time, at the employee’s regular rate, and (2) reasonable paid sick leave to recover from vaccine-related side effects.
  • Inform each employee about the OSHA Rule and the employer’s policy.
  • Report to OSHA each work-related COVID-19 fatality within 8 hours of the employer learning about the fatality, and inpatient hospitalization within 24 hours of the employer learning about the inpatient patient hospitalization.
  • Require employee notification of a positive COVID-19 test or diagnosis.
  • Ensure that, for employees who are not fully vaccinated, employees submit to and report COVID-19 testing at least once every 7 days and provide documentation of the most recent COVID-19 test result to the employer no later than the seventh day following the date on which the employee last provided a test result.  Unvaccinated employees must wear a face covering indoors and when occupying a work vehicle with another employee.

Are there any exemptions or exceptions to the OSHA Rule?

Yes.  The OSHA Rule has specific exemptions for certain types of employers and employees.  Specifically, the following are exempt from the OSHA Rule:

  • Workplaces covered under the Safer Workforce Task Force COVID-19 Workplace Safety: Guidance for Federal Contractors and Subcontractors;
  • Workplaces covered under the Safer Workforce Task Force COVID-19 Workplace Safety: Guidance for Federal Contractors and Subcontractors;
  • Settings where any employee provides healthcare services or healthcare support services when subject to the requirements of the Healthcare ETS;
  • Employees who telework;
  • Employees who do not report to a workplace where other people are present; and
  • Employees who work exclusively outside.

Exemptions are also available for employees for whom a vaccine is medically contraindicated, who require a delay in vaccination, or for those sincerely held religious beliefs or disabilities. 

Which employers are “covered employers” under the OSHA Rule?

The OSHA Rule applies to employers with a total of 100 or more employees at any time the OSHA Rule is in effect.  Further, the OSHA Rule applies to healthcare workers in healthcare settings who are not covered by OSHA’s Healthcare Emergency Temporary Standard (“Healthcare ETS”).[2]  If the Healthcare ETS no longer applies, workers previously covered by the Healthcare ETS who remain unvaccinated would be subject to the OSHA Rule.

Private Medical Practices:

The OSHA Rule does not apply to private medical practices with fewer than 100 employees.  However, private medical practices with fewer than 100 employees may still be subject to the Healthcare ETS.[3]

What should I do if I am a “Covered Employer”?

Businesses with 100 or more employees should determine the COVID-19 vaccination status of their employees and develop a “vaccine-or-test” policy.  OSHA announced, however, that it will not issue citations for noncompliance until January 10, 2022.  OSHA stated it will exercise its discretion and not issue citations for noncompliance with testing requirements before February 9, 2022, if an employer is exercising reasonable, good faith efforts to comply.

Will there be any more legal challenges to the OSHA Rule that would affect its implementation?

Yes.  Multiple parties, including nearly 30 states, have filed emergency motions with the United States Supreme Court to block the OSHA Rule.  In its opinion lifting the stay on the OSHA Rule, the Sixth Circuit Court of Appeals noted that OSHA “must be able to respond to dangers as they evolve.”[4] 

Emergency appeals, including the request to stay a federal circuit court of appeals’ decision, go directly to the Justice assigned to the particular circuit.  Justice Brett Kavanaugh is assigned to the Sixth Circuit.  Justice Kavanaugh may decide the motions on his own, or he may elect to distribute to the full court for consideration.

Stay tuned for additional developments and updates on federal vaccine mandates.  If you have any questions about COVID-19 employment-related issues, please contact John Conley. 


[1]  In re: MCP No. 165, Occupational Safety & Health Admin. Rule on COVID-19 Vaccination and Testing, 86 Fed. Reg. 61402, Nos. 21-7000, et al. (6th Cir. Dec. 17, 2021).

[2]  See OSHA’S COVID-19 Emergency Temporary Standard: What Employers Need to Know, available here, released September 2021.

[3]  Id.

[4]  See supra, fn.1.

What mandates presently apply?

Written by: John A. Conley, Aaron E. Kacer and Lauren A. Crawford

Three federal COVID-19 vaccine mandates have proven to be a frequently-moving target for employers nationwide as to both implementation and compliance.  As of the date of this article, all three vaccine mandates are blocked in full or in part.

On September 9, 2021, President Biden announced federal COVID-19 vaccination mandates as part of his COVID-19 Action Plan, Path Out of the Pandemic.  The same day, the President issued Executive Orders on COVID-19 vaccination for Federal employees and safety protocols for Federal contractors (the “Federal Contractor Mandate”).[1]  On November 5, 2021, the Centers for Medicare and Medicaid Services (“CMS”) and the Occupational Safety and Health Administration (“OSHA”) released interim final rules directed towards employers to require (per CMS) or strongly suggest (per OSHA) employees receive the COVID-19 vaccination.  According to the current Administration, approximately two thirds of all private sector employees in the United States would be covered by COVID-19 vaccination rules.[2] 

Many states, including Arizona, have challenged the new rules through state legislation and litigation.  On November 12, 2021, a federal court in Louisiana stayed enforcement and implementation of the OSHA Rule.[3]  All petitions for review of the OSHA Rule, including the Fifth Circuit’s ruling, were consolidated and are now before the U.S. Court of Appeals for the Sixth Circuit.  

Shortly thereafter, on November 29, 2021, a federal court in Missouri granted a preliminary injunction blocking the CMS Rule against any and all Medicare- and Medicaid-certified providers and suppliers within Alaska, Arkansas, Iowa, Kansas, Missouri, Nebraska, New Hampshire, North Dakota, South Dakota, and Wyoming pending a trial on the merits.  The following day, the court issued a preliminary injunction to cover all 50 states. 

On November 30, 2021, a federal court in Kentucky issued an order granting a preliminary injunction to block the enforcement of the Federal Contractor Mandate in all covered contracts in Kentucky, Ohio, and Tennessee.  Presently, this means that any covered contractors not affected by the injunction must be fully vaccinated (unless they qualify for a legal exemption) on or before January 18, 2022.  Challenges to the Federal Contractor Mandate are presently pending in other jurisdictions, which may result in an extension of the preliminary injunction to additional states.             

Stay tuned for additional developments and updates on the federal vaccine mandates and contact Aaron Kacer or Lauren Crawford with any questions.  In the meantime, if you have questions about any COVID-19 employment-related issues, please contact John Conley.


[1]  See Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors, available here, signed September 9, 2021; Executive Order on Requiring Coronavirus Disease 2019 Vaccination for Federal Employees, available here, signed September 9, 2021.

[2]  See Fact Sheet: Biden Administration Announces Details of Two Major Vaccination Policies, available here, released on November 4, 2021. 

[3]  See BST Holdings, L.L.C., et al. v. Occupational Safety & Health Admin., et al., No. 21-60845, 2021 WL 5166656, at *1 (5th Cir. Nov. 6, 2021), adhered to sub nom. BST Holdings, L.L.C. v. Occupational Safety & Health Admin., United States Dep’t of Labor, 17 F.4th 604 (5th Cir. 2021), available here; see Petition for Review, available here

Written by: Desalina Williams

On August 11, 2021, the U.S. Department of Justice (DOJ) issued a press release announcing a $350,000 settlement between the federal government, Cornell Scott Hill Health Corporation (“Cornell”), a Federally Qualified Health Center (“FQHC”), and the State of Connecticut to settle Medicaid fraud claims asserted against Cornell.

As a FQHC, Medicaid pays Cornell for certain services on an “encounter-based” reimbursement structure. Per federal law, claims for dental services, paid on an encounter-basis, are limited to one all-inclusive encounter per day, which should include all dental services rendered to a patient during his or her visit. The government alleged that Cornell improperly billed Connecticut’s Medicaid program for prophylactic cleaning and dental exams by requiring Medicaid patients to receive prophylactic cleanings and dental exams on different days so that Cornell would receive payment for two encounters instead of one. To resolve the allegations against it, Cornell paid $350,000 to the federal and Connecticut state governments. It also agreed to change its policy by offering Medicaid patients the option of scheduling their prophylactic cleaning and dental examination for the same day.

Earlier this year, in a January 2021 press release, the DOJ announced that it obtained more than $2.2 billion in settlements and judgments from civil fraud cases in the fiscal year that ended in September 30, 2020. $1.8 billion of that amount represented federal losses that were recovered from the health care industry. Many cases also included the recovery of millions of dollars for state Medicaid programs. This recent settlement with Cornell should prompt healthcare providers who are serving Medicaid beneficiaries to proactively assess their billing practices and policies to ensure that their policies are compliant with federal and their state’s Medicaid laws.

To review the August 11, 2021 Press Release from the U.S. Department of Justice, visit https://www.justice.gov/usao-ct/pr/health-center-pays-350k-settle-improper-billing-allegations-related-medicaid-dental.

Miranda Preston
Written by: Miranda Preston

On June 11, 2021, the U.S. Department of Health and Human Services (HHS) issued new guidance on the use and reporting of Provider Relief Fund (PRF) payments, and announced that PRF reporting will begin on July 1, 2021.  

Many health care providers have been anxiously awaiting additional HHS guidance on their obligations regarding reporting of their use of PRF funds.  Since January 15th, providers have been able to register their reporting accounts in the PRF Reporting Portal, but the portal has not yet been open for reporting.  In its recent guidance, HHS adopted a multiphase reporting system, pursuant to which the deadlines for the provider’s use and reporting of PRF funds are based on the specific dates on which the provider received the PRF payments..

Summary of PRF Use and Reporting Deadlines

PeriodPayment Received PeriodDeadline to Use FundsReporting Time Period
Period 1April 10 – June 30, 2020June 30, 2021July 1 – September 30, 2021
Period 2July 1 – December 31, 2020December 31, 2021January 1 – March 31, 2022
Period 3January 1 – June 30, 2021June 30, 2022July 1 – September 30, 2022
Period 4July 1 – December 31, 2021December 31, 2022January 1 – March 31, 2023

.The reporting deadlines apply to all recipients who received one or more payments exceeding $10,000 in the aggregate during a Payment Received Period.  Recipients who received PRF payments during multiple Payment Received Periods will be required to submit multiple reports.  

Key Considerations

  • The reporting requirements are also now applicable to recipients of the Skilled Nursing Facility (SNF) and Nursing Home Infection Control Distribution, which were not included in prior Post-Payment Notices. 
    .
  • As set forth in the table above, there are four new deadlines by which providers must use PRF funds, and four new deadlines by which providers must submit their reports to HHS as to how they used the PRF funds.
    .
  • The guidance replaces all prior versions of HHS’s Post-Payment Notice of Reporting Requirements documents.
    .
  • The reporting requirements set out in the guidance apply to past and future PRF General and Targeted Distributions.
    .
  • The reporting requirements set out in the guidance do not apply to recipients of funds from the Rural Health Clinic (RHC) COVID-19 Testing Program, the HRSA COVID-19 Uninsured Program, or the HRSA COVID-19 Coverage Assistance Fund.
    .
  • The updated guidance extends the time in which providers are required to complete their report from 30 days to 90 days after the end of the Payment Received Period.
    .
  • HHS issued updated PRF FAQs, clarifying PRF funding and reporting. HHS added some new FAQs, and removed some previously issued FAQs.
    .
  • HHS issued an updated Reporting Portal FAQ. In this FAQ, HHS announced that the PRF Reporting Portal will open July 1, 2021.
    .
  • Failing to report within the applicable time period(s) is a breach of the Terms and Conditions applicable to the recipient of the PRF distribution, and may result in recoupment of PRF funds received.[1]

If you have questions or would like additional information about this topic, please contact Miranda Preston at miranda@milliganlawless.com, or your primary Milligan Lawless attorney.


[1] The Terms and Conditions applicable to the recipients of each type of PRF distribution require the recipient to submit reports as specified by HHS in future program instructions. The Terms and Conditions also provide that non-compliance with the Terms and Conditions is grounds for HHS to recoup PRF funds.  To view the Terms and Conditions applicable to the various PRF distributions, click here.

By Chelsea L Gulinson, Esq. and James R. Taylor, Esq. Milligan Lawless, P.C

Since HIPAA’s creation almost 25 years ago, many have long suspected that, eventually, a provider’s failure to comply with HIPAA might result in a patient’s recovery of economic damages as a result.  Although HIPAA violations can lead to economic penalties imposed by the U.S. Department of Health and Human Services Office for Civil Rights, HIPAA does not include a mechanism for patients to seek economic damages from non-compliant providers.  However, the Arizona Supreme Court recently determined that HIPAA standards can be used in the context of a patient’s claim against a provider for negligently disclosing protected information.  

Understanding when and how a provider may disclose a patient’s information is tricky.  Typically, a provider discloses an individual’s protected health information to the individual, the individual’s family or specifically-authorized representatives, or pursuant to a subpoena.  However, in each instance, a provider can only disclose such information pursuant to Arizona’s medical records statute[1] and HIPAA.  

In a case decided earlier this month, the Arizona Supreme Court clarified that Arizona’s medical records statute “affords healthcare providers immunity from liability for damages if they acted in good faith when disclosing medical information pursuant to applicable law.”[2]  However, although HIPAA does not include a private right of action, the Court concluded that HIPAA is applicable to defining the standard of care in a state law negligence claim.[3]  Thus, although Arizona law may protect against liability for good faith disclosures of a patient’s protected information, understanding when and how disclosures are allowed under HIPAA and Arizona’s medical records statute is essential.

For any questions on the above, please contact Jim Taylor or Chelsea Gulinson at 602-792-3500.


[1] A.R.S. § 12-2296.

[2] Shepherd v. Costco Wholesale Corp., CV-19-0144-PR, 2021 WL 941432, at *1 (Ariz. Mar. 8, 2021).

[3] Id.


Next Page »