Management and Structural Analysis of Health Care Organizations: Objectives:

17Journal of Health Care Compliance — July–August 2019 17

In the Weeds: Are U.S. Health Care Companies Ready for a

Legal Cannabis Market?

Three Potential Compliance Issues that Health Care Industry Participants Should Anticipate

Joanne Caceres / Michael Montgomery

T he trend of legalizing the distribution and use of medical cannabis in the United States has main- tained momentum, positioning the industry for

continued rapid growth that will have increasingly wide- spread regulatory and compliance implications across the health care sector. As of May 2019, 33 states and four territories, including the District of Columbia, have to some extent legalized cannabis for medical uses, and 13 other states permit access to oils high in cannabidiol (CBD) and low in tetrahydrocannabinol (THC), the main psychoactive component of cannabis. While the scope and exact requirements of such laws vary state to state, the accompanying regulatory schemes have called for significant and ongoing adaptation by most major health care players, including physicians, hospitals, and phar- maceutical companies.1

Despite the liberalization at the state level, federal law vis-à-vis the Controlled Substances Act (CSA) cur- rently classifies cannabis, including its component parts, as an illegal “Schedule I” substance deemed to have no acceptable medical use.2 This categorization, coupled with other federal statutes and regulations, has created an uncertain, disadvantageous, and even hostile environment for the integration of medical can- nabis into the health care space. Due to these inherent compliance risks, most health care industry players, who already operate in a highly regulated environ- ment, have either shied away or severely limited their interaction and involvement with medical cannabis.

Pending federal bills, including the Secure And Fair Enforcement (SAFE) Banking Act3 and the Strengthening the Tenth Amendment Through Entrusting States (STATES) Act,4 signal that the United States may now be at a tipping point for reforms that would align federal law more closely with the states and aim to disentangle

Joanne Caceres is a Managing Associate in Dentons’ Cannabis Group,

Illinois. She advises large publicly traded companies, investors, vapor- izer manufacturers, and companies operating dispensaries on cannabis

and hemp related regulatory and com- pliance matters. She can be reached at 312/876-2862 or joanne.caceres@

dentons.com.

Michael Montgomery is a member of Dentons’ Health Care practice group, resident in the San Francisco office. Michael’s practice focuses on trans- actional matters in the health care

industry and includes advising hospital and health system clients on mergers and acquisitions, joint ventures, and

corporate governance matters as well as related regulatory and compliance

matters. He can be reached at 415/882- 0375 or michael.montgomery@

dentons.com.

Journal of Health Care Compliance — July–August 201918

Are U.S. Health Care Companies Ready for a Legal Cannabis Market?

cannabis from federal criminal statutes alto- gether. With these pending pieces of legis- lation in mind, this article previews three potential compliance issues that health care industry participants should anticipate and prepare for: (1) the need to re-think policies for the use of medical cannabis onsite at hos- pital facilities; (2) the opening of pathways toward U.S. Food and Drug Administration (FDA) approval for new drugs and prod- ucts; and (3) the increased attention that will be called for under federal health care privacy laws, such as the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collec- tively, “HIPAA”).

BACkgRound—the MediCAl CAnnABis RegulAtoRy enfoRCeMent enviRonMent Over the last several years, the federal gov- ernment has not enforced the CSA against persons or entities complying with state cannabis laws. A 2013 U.S. Department of Justice (DOJ) memorandum issued by Deputy Attorney General James M. Cole (the “Cole Memo”) identified eight enforce- ment priorities in reference to cannabis- related activities “that are particularly important to the federal government,”5 and led the federal government not to enforce against state law compliant entities. On January 4, 2018, however, then Attorney General Jeff Sessions rescinded the Cole Memo, directing prosecutors instead to prosecute “marijuana activities” by follow- ing “the well-established principles that govern all federal prosecutors.”6 Attorney General William Barr has since testified in his confirmation hearing that he will not upset “settled expectations,” “invest- ments,” or other “reliance interest[s]” aris- ing as a result of the Cole Memo and that he does not intend to use federal resources to enforce federal cannabis laws in states that have legalized cannabis “to the extent people are complying with the state laws.”7

While the DOJ has sent somewhat mixed messages, entities strictly com- plying with state medical cannabis laws

have benefitted from additional pro- tection at the federal level. Since 2014, federal spending bills have contained a provision8 which has been interpreted to prohibit the DOJ and the U.S. Drug Enforcement Administration (DEA) from prosecuting anyone who strictly complies with a state medical cannabis law.9 The provision was most recently extended through short-term appropria- tions legislation until September 30, 2019.10 Notwithstanding the efforts to clarify and focus cannabis enforcement priorities, conflict remains both within sources of federal law and guidance as well as with state laws.

Pending fedeRAl legislAtion—the sAfe BAnking ACt, stAtes ACt, And MoRe

Federal cannabis legislation may be approaching an inflection point. Industry observers believe that the SAFE Banking Act of 2019 has the best chance of passing this or next year. The SAFE Banking Act would “create protections for depository institu- tions that provide financial services to can- nabis-related legitimate businesses and service providers for such businesses…”11 Effectively, upon passage, no one in the can- nabis industry conducting business consis- tent with state law would face uncertainty around federal anti-money laundering crimes. While the legislation would not fully harmonize federal and state laws (e.g., the bill does not absolve cannabis companies from CSA violations or providers from incho- ate liability under the CSA), it comes close to doing so. Increased legal certainty around federal law is likely to lead established play- ers, including banks and public companies, to become more involved in the space.

Although less likely to pass in 2019, the STATES Act would go even further to align federal and state law.12 The bill pro- vides in relevant part that the provisions of the CSA, as applied to cannabis, “shall not apply to any person acting in compliance

Journal of Health Care Compliance — July–August 2019 19

Are U.S. Health Care Companies Ready for a Legal Cannabis Market?

with State law relating to the manufacture, production, possession, distribution, dis- pensation, administration, or delivery of marihuana.” Even though cannabis would remain a Schedule I controlled substance, the STATES Act makes state legal cannabis activities federally permissible by creating a carve-out to the CSA (nullifying concerns about violations of the CSA, including inchoate offense liability for service pro- viders). By allowing continued prohibition to be a choice by the individual states, the STATES Act does not fully legalize cannabis on a national level. Nonetheless, for fully compliant state regulated businesses, there would be no federal criminal risk.

These are also several other laws pro- posed at the federal level with the goal of eliminating the conflict between state and federal law. In early May, top congressional democrats announced they would be rein- troducing legislation that would go even further than the STATES Act.13 The pro- posed legislation, “Marijuana Freedom And Opportunity Act,”14 would remove cannabis from the CSA altogether, a process known as descheduling. States would then have the ability to regulate cannabis as they see fit.

thRee CoMPliAnCe ConCeRns foR heAlth CARe entities to ConsideR These bills represent significant strides toward reconciling the divergence between deeply engrained federal law and the many constantly evolving bodies of state law. Although the precise fate of these laws remains uncertain, it is becoming increas- ingly more likely that at some point, fed- eral law will become more permissive. When that happens, the barriers that have held the health care industry back will for the most part disappear or change signifi- cantly. Below, we briefly discuss three top- ics that the health care industry will have to face. Health care industry participants would be well served to consider and pre- pare for these issues sooner rather than later.

Hospital Onsite Use of Medical Cannabis

Should a hospital permit the presence and consumption of medical cannabis by inpa- tients? If so, where in the hospital would use and/or storage be authorized and in what forms of delivery? What role should physicians, nurse practitioners, and other facility staff play in oversight and admin- istration? And, considering cannabis cur- rently remains a Schedule I controlled substance under the CSA, what level of risk could the onsite use of medical can- nabis pose to a hospital’s federal fund- ing, licenses, and programs, including its Medicare enrollment? These are just a few of the baseline questions hospitals and other providers are grappling with as state legalization and regulation of medi- cal cannabis continues to mature. Not sur- prisingly, legal uncertainty has led many providers to mitigate risk by defaulting to outright prohibition, or in some cases, adopting an informal “don’t ask, don’t tell” approach.

The Centers for Medicare & Medicaid Services (CMS), despite being the single largest payer and one of the most impor- tant regulatory bodies in the U.S. health care system, has to-date been mostly silent and not issued specific guidance on medical cannabis matters. CMS does, how- ever, require that providers contracting with and billing Medicare and Medicaid agree to “Conditions of Participation,” pursuant to which such providers must certify their general compliance with all state and federal laws and regulations.15 This, of course, includes compliance with the CSA. Accordingly, beyond Medicare and Medicaid not covering medical canna- bis treatments, the use or even presence of cannabis in health care facilities runs the risk of financial penalties, lost federal funding, and the potential revocation of a provider’s Medicare enrollment and other various categories of federal licenses and accreditations.

Journal of Health Care Compliance — July–August 201920

Are U.S. Health Care Companies Ready for a Legal Cannabis Market?

With the political climate and pend- ing federal legislation trending toward greater if not total deference to state law, however, hospitals should consider establishing medical cannabis policies and procedures carefully tailored to satisfy the regulatory regimes in their respective state jurisdictions. Health care organizations in a few states have offered model policies that may serve as useful starting points. For example, the Minnesota Hospital Association has published several templates designed to align with state law, including poli- cies that outline how certain “qualified” patients might be verified for eligibility to receive the assistance of a nurse in administering or otherwise self-adminis- ter their own supply of medical canna- bis.16 Similarly, the Washington Health Care Association has published a model policy directed toward long-term care facilities,17 while select Mayo Clinic facilities in Minnesota have established a process for certifying and dispensing to Minnesota residents with certain quali- fying conditions in the Minnesota medi- cal cannabis program.18

The varying approaches to handling the risk of uncertainty where CMS regula- tions potentially stand at odds with state law are indicative of legal quagmires that are likely to be addressed and resolved through the STATES Act or similar leg- islation. Clear guidelines as to when a health care facility would be jeopardiz- ing its accreditation status and access to federal funding will allow hospitals and other providers the opportunity to build on existing model policies to construct or rebalance their own approach to inpa- tient-use of medical cannabis. In doing so, providers may soon have more free- dom to shift away from technical compli- ance with competing bodies of law and focus on the health, rights, and inter- ests of patients, as well as the providers’ own financial and operational goals and circumstances.

FDA Regulatory Pathways for Cannabis Products

The FDA has not attempted to regulate, or enforce rules against, state medical canna- bis programs, despite a clear authority to do so under federal law.19 It has and continues to address, however, the budding market for CBD derived from hemp.20 By under- standing how the FDA has approached CBD in hemp, we can make predictions about how the FDA may react to certain cannabis derived extracts, once and if they become available outside of a state-regulated mar- ket. Cannabis dispensing organizations will need to “catch up” to these regulations to the extent they do not anticipate them.

The FDA has issued statements remind- ing the public of the FDA’s continued authority “to regulate products contain- ing cannabis or cannabis-derived com- pounds under the United States Federal Food, Drug, and Cosmetic Act (FDCA) and section 351 of the Public Health Service Act.”21 Under the FDCA, it is unlawful “to introduce food containing added CBD or THC into interstate commerce, or to mar- ket CBD or THC products, as, or in, dietary supplements, regardless of [the source of the substance].”22 This is because, regard- less of whether health claims are made, CBD (and THC) are active ingredients in FDA-approved drugs and have been the subject of public substantial clinical inves- tigations. Therefore, the FDA’s position has been that, prior to introduction into interstate commerce, any cannabis prod- uct, whether derived from hemp or other- wise, marketed with a disease claim (e.g., therapeutic benefit, disease prevention) must first be approved by the FDA for its intended use through one of the drug approval pathways.

It seems that current political pressure caused a shift in the FDA’s prohibitive position. As a result, the FDA has formed a working group to evaluate how best to regulate CBD products but has added that the working group will likely take a

Journal of Health Care Compliance — July–August 2019 21

Are U.S. Health Care Companies Ready for a Legal Cannabis Market?

number of years to develop and implement a new regulatory strategy, unless Congress passes CBD-specific legislation that forces it to act within a specified timeframe.23 The agency has taken several steps in its continued evaluation of possible regula- tory pathways for cannabis- containing and cannabis-derived products: (1) it has noticed a public hearing date, May 31, 2019, to discuss the safety, manufactur- ing, product quality, marketing, labeling, and sale of products containing cannabis or cannabis-derived compounds; (2) it has formed a high-level internal agency work- ing group tasked with exploring potential pathways for the legal marketing of foods and/or dietary supplements containing CBD; (3) it updated FAQs on the FDA Web site related to this topic; and (4) it issued warning letters to three companies mar- keting CBD products using claims viewed as egregious and targeted at particularly vulnerable populations.24

The health care industry, especially drug manufacturers, has a vested inter- est in the outcome of this FDA action for several reasons. First, drug manufacturers already do and increasingly will have to compete with medical cannabis products, which may, due to an unusual regulatory history, have less restrictive barriers to approval under the FDCA, further disad- vantaging competing therapies. Second, the FDA may set a precedent for certain products to be approved with less effort and expense than other products, an out- come that may or may not be welcome by industry participants. Therefore, regard- less of whether or not any particular drug manufacturer has an interest or desire to participate in the cannabis industry post- legalization, decisions that will affect the regulatory landscape in the future are happening now.

Medical Cannabis and HIPAA The medical cannabis state programs raise questions about compliance with HIPAA’s privacy protections.25 There appears to

be a misconception in the industry that because HIPAA is a federal law, and can- nabis remains federally illegal, medical cannabis dispensaries are not subject to HIPAA. While this correlation is without merit (consider that these companies are still beholden to federal tax laws, for exam- ple), it is likely the case that the vast major- ity of medical cannabis dispensaries are not presently subject to HIPAA. In order for a dispensary (or any other entity) to be subject to HIPAA, the entity must meet the definition of a “covered entity” or a “busi- ness associate” as defined by the law.

A HIPAA-covered entity is defined as a health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with particular transactions subject to HIPAA.26 While a dispensary might meet the definition of a health care provider,27 it most likely fails the second required component of the definition to be a covered entity; namely that the health care provider transmit health infor- mation in electronic form in connection with particular transactions subject to HIPAA.28 Similarly, a dispensary is unlikely to meet the definition of a HIPAA business asso- ciate, which is generally any entity that performs a covered function or activity on behalf of a covered entity that involves the use or disclosure of protected health infor- mation (PHI).29

Nonetheless, from a policy perspective, medical cannabis should theoretically be subject to HIPAA. Doing so would serve to further protect the privacy, security, and confidentiality of dispensary customers. It also would place restrictions on how cus- tomers’ information could be used and dis- closed and would afford such customers additional rights regarding their identifi- able information maintained by the dis- pensary. As noted by the U.S. Department of Health and Human Services (HHS), health care providers have a strong tradi- tion of safeguarding private health infor- mation, and the consequences of not

Journal of Health Care Compliance — July–August 201922

Are U.S. Health Care Companies Ready for a Legal Cannabis Market?

doing so could cause significant negative outcomes for the patient.30

Once medical cannabis programs become federally legal, this question is likely to come to a head. Again, partici- pants in the health care industry should have a vested interest in ensuring that medical cannabis facilities are subject to HIPAA and safeguard PHI, especially as those organizations become more con- nected to other health care institutions. Furthermore, health care industry law- yers are uniquely suited to help dispens- ing organizations come into compliance.

While many medical cannabis busi- nesses have not focused on HIPAA requirements, they would be well served to reassess their operations so as to ensure compliance with HIPAA and state health privacy laws. The passage of something similar to the STATES Act would elimi- nate the veil of illegality, bringing in more institutional actors, including health care providers such as hospitals and nursing homes, who will already be HIPAA com- pliant and require any entities they asso- ciate with to do the same.

ConClusion Some level of cannabis legalization or at least decriminalization, which used to seem impossible, now seems likely if not inevitable in the United States. The pend- ing federal bills at the very least signal a directional change in federal politics, as more and more legislators appear ready to consider making changes to federal law. Furthermore, many different indus- tries, including food, tobacco, and alcohol may enter the fray (and certain forward- thinking companies have already begun experimenting in Canada). The health care industry will inevitably more frequently and deeply be impacted directly and indi- rectly by the cannabis industry and the increased use of cannabis for health and wellness. Indeed, health care providers are uniquely positioned to and should provide leadership on the issue.

Endnotes 1. For example, in all states that have legalized medi-

cal cannabis, doctors need to identify and certify or recommend patients to relevant programs (see, e.g., Florida (Fla. Stat. Ann. § 381.986(4)), describing physician certification); some states additionally require employment of a physician to supervise the activities of a medical cannabis dispensing organi- zation (e.g., Florida (Fla. Stat. Ann. § 381.986(8)(b) (9))); and some states require that the cannabis be dispensed by a pharmacist (e.g., Connecticut, (CT ADC §21a-408h(b)(B)), Minnesota (Minn. Stat. Ann. § 152.29, subd. 3) and New York (10 NYCRR § 1004.12)).

2. 21 U.S.C 801 et seq. Until recently, hemp (defined by the U.S. Government as Cannabis sativa L. with a THC concentration of not more than 0.3 percent on a dry weight basis) and hemp’s extracts were illegal Schedule I controlled substances, along with canna- bis generally, under the CSA (except mature stalks, fiber produced from the stalks, oil or cake made from the seeds, and any other compound, manu- facture, salt derivative, mixture, or preparation of such parts). In December 2018, the U.S. government changed the legal status of hemp. The Agriculture Improvement Act of 2018, Pub.L. 115-334 (the “Farm Bill”), removed hemp and extracts of hemp, including CBD, from the CSA schedules. Accordingly, the production, sale, and possession of hemp or extracts of hemp, including CBD, no longer violate the CSA.

3. SAFE Banking Act of 2019. H.R. 1595, 116th Cong. § 1 (2019), www.congress.gov/bill/116th-congress/ house-bill/1595.

4. Strengthening the Tenth Amendment Through Entrusting States Act, H.R. 2093, 116th Cong. § 1 (2019), available at www.congress.gov/bill/ 116th-congress/house-bill/2093/text.

5. See Memorandum from James M. Cole, Deputy Att’y Gen., to U.S. Atty’s, 1 (Aug. 29, 2013), www.justice. gov/iso/opa/resources/3052013829132756857467.pdf.

6. Jefferson B. Sessions, III, U.S. Dep’t of Justice, Memorandum for All U.S. Att’ys re: Marijuana Enforcement (Jan. 4, 2018), available at www.justice. gov/opa/press-release/file/1022196/download.

7. See Attorney General William Barr Confirmation Hearing, available at www.c-span.org/video/ ?456626-1/attorney-general-nominee-william-barr- confirmation-hearing (“My approach to this would be not to upset settled expectations and the reliance interest that have arisen as a result of the Cole Memorandum and investments have been made and so there has been reliance on it, so I don’t think it’s appropriate to upset those interests.”).

8. The provision, now called the Joyce Amendment (previously the Rohrabacher Amendment), states: “None of the funds made available under this Act to the Department of Justice may be used, with respect to any of the [states with medical cannabis

Continued on page 48

Journal of Health Care Compliance — July–August 201946

Access to Services

immediate threat of injury” from the hos- pital’s actions. The couple contended that the fiancé’s medical condition will likely require hospital services, but as pleaded, that claim was not sufficient to demon- strate future harm. The court explained that the allegations did not establish that the fiancé will require hospitalization or otherwise return to Memorial for services, and accordingly, the couple was granted leave to replead the claim.

intentionAl disCRiMinAtion Under the Rehabilitation Act and the ACA, intentional discrimination is a necessary

element to prove in addition to deliber- ate indifference. The couple’s allegation that the hospital repeatedly failed to pro- vide interpreters after being repeatedly informed that they were necessary for communication with the couple was suffi- cient under governing appellate case law. Thus, Memorial’s motion to dismiss was denied on this issue.

Endnotes 1. Ayling v. Memorial Health System, May 23, 2019,

Schanzle-Haskins, T. 2. 42 U.S.C. ¶ 12131. 3. 29 U.S.C. § 704. 4. 42 U.S.C. § 18116.

Copyright of Journal of Health Care Compliance is the property of Aspen Publishers Inc. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.