Hospitals
New HIPAA Waivers for Health Care Providers During the COVID-19 Emergency
This post provides an update on a number of HIPAA waivers that have just been made available to health care providers: (1) Waivers for hospitals in the initial 72 hours of enacting a disaster protocol; and (2) Waivers for all health care providers to allow them to use “everyday communications technologies, such as FaceTime or Skype, during the COVID-19 nationwide public health emergency” for the provision of patient care services. Each waiver is addressed more fully, below: Waivers for Hospitals in the Initial 72 Hours of Enacting a Disaster Protocol First, the Secretary of the Department of Health and Human Services (HHS) has issued limited HIPAA waivers to hospitals. The waivers are retroactive to March 15, 2020. See the HHS HIPAA waiver document here. We addressed the possibility of these waivers in our earlier post, available here, along with a summary of some of the main HIPAA laws already in place which may be helpful to covered entities and business associates during this time of national and public health emergency. The HIPAA waiver document starts by reminding covered entities and their business associates that, in general, the HIPAA rules are not suspended during this time of a national and public health emergency. In particular, addressing a topic of much discussion among providers, the guidance includes a reminder that the HIPAA security safeguards rules (mandating reasonable administrative, technical and physical safeguards) apply to uses and disclosures of electronic protected health information as always. This statement is a reminder to health care providers of their obligations to use appropriate safeguards when using or disclosing protected health information (but, see Part 2 of this blog post, below, which describes a new waiver allowing providers to use everyday communications technologies for patient care.) The HIPAA waiver will only apply to hospitals: (1) in the emergency area identified in the public health emergency declaration (the declaration applies nationwide, see the declaration here); (2) that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol. After the 72 hours elapses, the hospital is required to return to full HIPAA compliance, even for patients who are still under care at the time. Also, if the national emergency or the public health emergency is terminated, the hospital is required to return to full HIPAA compliance, even if the 72 hours has not elapsed. The waivers permit U.S. hospitals that have instituted their disaster protocol to have the following HIPAA requirements waived during the initial 72 hours of the disaster protocol: • the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient's care. See 45 CFR 164.510(b). • the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a). • the requirement to distribute a notice of privacy practices. See 45 CFR 164.520. • the patient's right to request privacy restrictions. See 45 CFR 164.522(a). • the patient's right to request confidential communications. See 45 CFR 164.522(b). Waivers for All Health Care Providers to Allow the use of Everyday Communications Technologies for Patient Care Second, the HHS Office for Civil Rights (OCR) announced that it will “exercise enforcement discretion and waive penalties for HIPAA violations against health care providers that serve patients in good faith through everyday communications technologies, such as FaceTime or Skype, during the COVID-19 nationwide public health emergency”. See the announcement from OCR here. A few days later, OCR issued FAQs regarding telehealth and OCRs waiver of penalties for the use of everyday communications technologies, available here. This second announcement is particularly refreshing for health care providers who have been anxiously seeking easier methods, such as the use of personal devices and specific technologies, to interact via audio and/or video technologies with their patients and colleagues. Specifically, OCR states: “A covered health care provider that wants to use audio or video communication technology to provide telehealth to patients during the COVID-19 nationwide public health emergency can use any non-public facing remote communication product that is available to communicate with patients….This exercise of discretion applies to telehealth provided for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19.” OCR provides the following examples of technology that will be allowed: “…a video chat application connecting the provider’s or patient’s phone or desktop computer in order to assess a greater number of patients while limiting the risk of infection of other persons who would be exposed from an in-person consultation.” “…popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype…” The OCR makes clear that this technology is also allowed to assess or treat any other medical condition, even if not related to COVID-19. Further, the OCR also states in the notice that it will not impose penalties against health care providers that do not have a business associate agreement in place with such technology vendors. The OCR provides the following examples of technology that will not be allowed because they are public facing: Facebook Live Twitch TikTok similar video communication applications are public facing Finally, the OCR acknowledges that some health care providers may still wish to use technology vendors that are “HIPAA compliant” and with whom the health care provider has entered into a business associate agreement related to the vendor’s video communications products. The OCR provides a list of some technology vendors that represent that they provide HIPAA-compliant video communication products and will enter into a business associate agreement (although the OCR states that it does not endorse any particular technology and it has not reviewed the business associate agreements of these vendors): Skype for Business Updox VSee Zoom for Healthcare Doxy.me Google G Suite Hangouts Meet However, a few words of caution: The OCR encourages providers to notify their patients that these third-party applications potentially introduce privacy risks. Providers should also take as many security precautions as possible to protect patient information such as enabling “all available encryption and privacy modes when using such applications,” and having these conversations in private spaces to avoid others who are not involved in the patient’s care overhearing the communication. Further, even if a provider is using “everyday communications technologies”, providers should take care to record the interactions in the patient’s medical record to ensure that patients’ records are complete and accurate. We are continuing to monitor this ever evolving area of the law and will continue to post updates. Please call the authors of this post or your regular Dorsey attorney if you have any questions.
March 17, 2020
by Alissa Smith and Charis Zimmick
Hospitals
New Proposal to Remove Disincentives to Living Organ Donation
On December 20, 2019, the Department of Health and Human Services (“DHHS”) issued a notice of proposed rulemaking (the “Proposal”) that removes financial barriers to organ donation by expanding the scope of reimbursable expenses paid through the Health Resources and Services Administration’s Reimbursement of Travel and Subsistence Expenses Incurred toward Living Organ Donation program (the “Program”). Specifically, the Proposal would allow living organ donors to be reimbursed for donation-related lost wages, child-care expenses, and elder-care expenses through the Program. With the Proposal, DHHS is hoping to increase the number of living organ transplants and improve the overall quality and outcome of organ donations. Generally, federal law prohibits any person from knowingly acquiring, receiving, or otherwise transferring any human organ for valuable consideration for use in human transplantation. 42 U.S.C. § 274e. However, valuable consideration does not include “the reasonable payments associated with the removal, transportation, implantation, processing, preservation, quality control, and storage of a human organ or the expenses of travel, housing, and lost wages incurred by the donor of a human organ in connection with the donation of the organ.” Id. (emphasis added). Therefore, organ donors can be reimbursed for their donation-related expenses under certain circumstances. Primarily to aid low-income organ donors in such reimbursement, 42 U.S.C. § 274f describes the Program, which funds the National Living Donor Assistance Center (the “NLDAC”), to reimburse an eligible organ donor’s qualified expenses. Nevertheless, the Program’s current guidelines specifically limit NLDAC qualifying expenses to only those incurred by the donor and/or his/her accompanying person(s) as part of: (1) donor evaluation and/or (2) hospitalization for the living donor surgical procedure, and/or (3) medical or surgical follow-up, clinic visits, or hospitalization within two calendar years following the living donation procedure. As such, the Program (through the NLDAC), does not currently reimburse organ donation-related expenses such as lost wages, child-care, or elder-care. Rather, reimbursement for such expenses can only be received from sources such as state compensation programs, insurance policies, or the recipient of the organ. This reduces the reimbursement options available, which may be especially significant to the low-income organ donors utilizing the Program. To address this, the Proposal sets out to amend the Organ Procurement and Transplantation Network Final Rule by adding Section 121.14(a), stating: The following incidental nonmedical expenses incurred by donating individuals toward making living donations of their organs may be reimbursed: (1) Lost wages; (2) Child-care expenses; and (3) Elder-care expenses. The Proposal fulfills the President’s mandate under Executive Order 13879: Advancing American Kidney Health that DHHS propose a regulation to allow living organ donors to be reimbursed for donation-related lost wages, child-care expenses, and elder-care expenses through the Program. Therefore, some form of the Proposal is likely to become final, and DHHS is accepting comments on the Proposal until February 18, 2020. If you would like to submit comments or have any questions, one of the authors or your regular Dorsey attorney would be happy to assist you.
January 6, 2020
by Randall Hanson and Neal N. Peterson
Hospitals
Hospital Price Transparency Rule Finalized; Health Plan Transparency Rule Proposed
The Centers for Medicare and Medicaid Services (CMS) has issued a final rule to require every hospital licensed in the United State to make public a robust set of standard charges for every item or service that the hospital bills. In addition, CMS and other agencies have issued a proposed rule to require group health plans and health insurance issuers to: (1) disclose in-network negotiated rates and out-of-network allowed amounts for every health care item or service; and (2) offer a real-time tool to provide a plan enrollee with an estimate of cost-sharing and out-of-pocket expenses associated with plan covered items and services. The hospital price disclosure rule is effective January 1, 2021. Hospitals and hospital trade associations have stated that they will bring a legal challenge against the final rule as exceeding CMS’ legal authority. The rule will require every licensed hospital to provide two separate sets of standard charge lists: (1) a list of standard charges for at least 300 “shoppable” hospitals services that a consumer can schedule in advance; and (2) a comprehensive list of standard charges for all items and services for which the hospital establishes a charge. Both lists must be updated at least annually and placed on a publicly-accessible website. Only hospitals are regulated under the final rule; ambulatory surgery centers or other clinics or facilities that may provide items and services that are also performed in hospitals are not required to report pricing. For the comprehensive charge list the hospital must report seven data elements for each item or service: (1) description; (2) code used to bill the item or service; (3) hospital’s gross charge; (4) negotiated rate with every third party payer (linked by name to the third party payer and plan); (5) highest charge the hospital has negotiated with any third party payer; (6) lowest charge the hospital has negotiated with any third party payer; and (7) charge applicable to an individual who pays cash. The “shoppable” charge list must include similar data elements, with the addition of the hospital location(s) at which the “shoppable” service is provided. The resulting report will be an exceedingly dense data set of hundreds of thousands of line items for a typical hospital. The biggest change the final rule would effect is that payment rates that a hospital negotiates with third party payers would no longer be confidential or proprietary, and would in fact be public information under the final rule. CMS made clear that a hospital must report data on all items or services the hospital provides and charges, including the professional services of its employed physicians or other clinicians. This appears to apply only to the hospital itself (presumably identified by NPIs associated with the hospital) and not to separate corporate entities, formed for the purpose of operating physician group, that do not operate the hospital but may be owned by the same entity (or corporate affiliate) that operates the hospital. The health plan proposed rule would require every group health plan or health insurance issuers to make available on a website a negotiated rate file that lists: (1) the name and Employer Identification Number (EIN) or Health Insurance Oversight System (HIOS) identifier for each plan option or coverage offered; (2) codes and plan language description for each item or service; and (3) negotiated rate for each item or service furnished by every in-network provider (linked by National Provider Identifier (NPI) to each in-network provider) along with the last date of contract term for that rate. A separate file that lists out-of-network allowed amounts for each items or service furnished by out-of-network providers must also be posted. These lists must be updated monthly under the proposed rule. In addition, health plans must offer a tool to allow plan enrollees to obtain real-time information about cost-sharing information with regard to specific items or services. Unless halted by courts, hospitals will need to begin the considerable work of compiling and formatting the data files required under the final rule. And, although it is unclear how the hospital pricing data will be analyzed and used (and by whom), hospitals should analyze their own pricing data and begin anticipating and preparing for the questions and critiques that will arise.
November 20, 2019
by Ross C. D'Emanuele