A recent Internal Revenue Service (IRS) memorandum addresses the tax status of certain fixed-indemnity health plans that promise employers major payroll tax savings. In this American Staffing Association article, Alden J. Bianchi summarizes the memorandum and outlines what employers need to know.
What are the opportunities and challenges of digital health wellness programs? In a recent discussion, McDermott Partners Scott A. Weinstein and Sarah G. Raaii discussed a wide range of issues, including accessibility to employees, navigating the health plan regulatory landscape, budgetary constraints and the reality of rising healthcare costs.
On May 17, 2023, the Texas Senate approved Senate Bill No. 14, prohibiting physicians from providing gender-affirming medical care to minors experiencing gender dysphoria (distress that results from having one’s gender identity not match one’s sex assigned at birth). The bill is expected to be signed into law by Texas Governor Greg Abbott and take effect on September 1, 2023.
The “family glitch” was a regulatory oddity of the Affordable Care Act (ACA). It required the affordability of an employer-sponsored health plan to be determined based solely on the cost of the plan to an individual employee, disregarding the costs to add family members to a plan. This resulted in many families being ineligible for marketplace premium subsidies when purchasing their own health insurance on exchanges. In October 2022, the US Department of the Treasury and Internal Revenue Service (IRS) issued a final rule designed to fix the “family glitch.”
In this Bloomberg Law article, Alden Bianchi and Teal Trujillo examine the rationale advanced by the IRS in support of its changed position in the matter of the “family glitch” and consider how the new position of the IRS might fare if challenged in the wake of West Virginia v. EPA.
On May 19, 2023, Novitas Solutions and First Coast Options sent an email to certain interested parties, with whom they had engaged following the multijurisdictional contractor advisory committee (CAC) meeting, explaining that they have decided to not pursue at this time a local coverage determination for remote physiological monitoring (RPM) and remote therapeutic monitoring (RTM).
What does this communication mean for RPM/RTM service providers?
The US Department of Health and Human Services Office for Civil Rights (OCR) recently announced a settlement with a community hospital resolving an investigation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules. While the settlement involved a medical provider, it offers some important lessons for other HIPAA-covered entities, including employer-sponsored group health plans.
The settlement involved impermissible data breaches by non-medical staff who, allegedly, used their login credentials to access patient medical records maintained in the hospital’s electronic medical record system without a job-related purpose. The lesson here is straightforward: all HIPAA-covered entities must “protect the privacy and security of health information.”
The HIPAA privacy and security rules are complex, and full compliance requires substantial resources that are, as a practical matter, beyond the reach of many organizations. While OCR routinely refers to these rules as “scalable,” that claim is difficult to square with our experience. Full compliance with the particulars of the rule is costly and time-consuming, and it requires no shortage of expertise. Thankfully, in practice, OCR tends to focus its investigative resources on certain features of these rules. These features include the following items which covered entities must perform to comply:
Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic protected health information;
Develop and implement a risk management plan to address and mitigate identified security risks and vulnerabilities identified in the risk analysis;
Develop, maintain and revise, as necessary, written HIPAA policies and procedures;
Enhance HIPAA and security training programs to provide workforce training on the updated HIPAA policies and procedures; and
Review relationships with vendors and third-party service providers to identify business associates and obtain business associate agreements with business associates if not already in place.
Where group health plans are concerned, fully insured plans routinely rely on their carriers for HIPAA compliance, which requires that plan sponsors get only “summary” health information at renewal. This option is not available to self-funded plans, however, even those that contract with a carrier for administrative services. Employers in this latter category should be reasonably confident of surviving an OCR audit or investigation only, at a minimum, by taking the actions listed above.
The US Drug Enforcement Administration (DEA) and the Substance Abuse and Mental Health Services Administration (SAMHSA) are extending telehealth flexibilities that allow providers to prescribe controlled substances. While the extension is in place, the DEA indicated that it will be further evaluating its recently proposed rules for post-COVID-19 public health emergency telemedicine prescription of controlled substances.
US lawmakers recently advanced a broad healthcare bill during a US House Energy & Commerce Health Subcommittee markup. In this Health Policy Breakroom podcast episode, McDermott+Consulting’s Debra Curtis and Rodney Whitlock break down the markup and address extenders, PBMs, site-neutral policies and the timing of this bill.
At a recent open Commission meeting, the Federal Trade Commission (FTC) voted unanimously to issue a Notice of Proposed Rulemaking to amend the Health Breach Notification Rule (HBNR). The FTC’s proposed amendment aims to codify the HBNR’s application to digital health and mobile technologies. However, several aspects of the proposed amendment lack clarity and are likely to cause confusion unless further clarified through the ongoing rulemaking process.
The US Department of Health and Human Services Office of the Inspector General (HHS OIG) recently unveiled a new toolkit that seeks to help analyze telehealth claims for federal healthcare program integrity risks. It is based on methodologies highlighted in OIG’s September 2022 data brief; the data brief identified billing practices by Medicare providers that OIG was concerned posed a high risk to program integrity. OIG intends for the toolkit to be used by public and private parties—including Medicare Advantage plan sponsors, private health plans, State Medicaid Fraud Control Units and other federal healthcare agencies—to assess program integrity risks and identify providers whose billing may warrant further scrutiny.