The My Health My Data Act in Washington State (the Act) is expected to be signed into law by Governor Jay Inslee this year, after being passed by both the Washington Senate and House in different versions. Unlike recent state privacy laws, the Act specifically targets consumer health data that is not covered by the Health Insurance Portability and Accountability Act (HIPAA). It includes provisions that apply to processors and third parties who may handle a broadly defined set of consumer health data, beyond healthcare-adjacent businesses. The Act could have a significant impact on various entities, including advertisers, mobile app providers, wearable device manufacturers, healthcare companies and their data processors who handle non-HIPAA-regulated health information.
We expect to see continued focus on privacy and security at the federal and state level. For example, California, Virginia, Colorado, Utah and Connecticut have new privacy laws coming into effect in 2023. As part of our State Law Privacy Video Series, McDermott described how these laws will affect health data and healthcare entities—in particular, those entities that are regulated by HIPAA.
In addition, at the end of 2022, the US Department of Health and Human Services (HHS) proposed long-awaited changes to the regulations protecting the confidentiality of substance-use disorder patient records under Part 2 of Title 42 of the Code of Federal Regulations (42 CFR Part 2, or Part 2). Specifically, the proposed rule would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which required HHS to align Part 2 with certain provisions of HIPAA and to make certain changes to the HIPAA Notice of Privacy Practices, the form given to patients and plan members that describes patient privacy rights, covered entity duties, and the covered entity’s uses and disclosures of protected health information.
The Biden administration has announced its intention to end the COVID-19 National Emergency (NE) and the COVID-19 Public Health Emergency (PHE) on May 11, 2023 (read our series introduction for more information).
On March 29, 2023, the US Departments of Labor, Health and Human Services, and Treasury (the Departments) issued a set of Frequently Asked Questions (available here), which answered questions from stakeholders relating to the various laws, regulations and other guidance enacted or adopted in connection with the NE and PHE. The FAQs include eight questions related to the anticipated end of the “Outbreak Period” on July 10, 2023, which is 60 days after the end of the NE and PHE on May 11 (rules regarding the Outbreak Period are set forth in our earlier articles here and here). Below are the highlights:
Following the end of the PHE, plans and issuers can impose cost-sharing, prior authorization or other medical management requirements for COVID-19 diagnostic tests, although the Departments encourage plans not to do so.
Plans and issuers are encouraged to notify plan participants of changes regarding COVID-19 diagnosis, testing and treatment. Special rules apply under which Summaries of Benefits and Coverage (SBCs) need not be amended mid-year.
While plans and issuers will no longer be required to post prices for diagnostic tests furnished after May 11, they are nevertheless encouraged to do so.
Plans must continue to cover vaccines that qualify as preventive services, without cost-sharing, when provided in-network.
The FAQs provide examples relating to the application and termination of extended time periods for elections under the Consolidated Omnibus Budget Reconciliation Act (COBRA) and the Health Insurance Portability and Accountability Act (HIPAA).
In what is a welcome surprise, the FAQs confirm that individuals covered by a High-Deductible Health Plan (HDHP) will remain Health Savings Account (HSA)-eligible until further notice even if the HDHP in which they are enrolled provides medical care services and items purchased related to testing for and treatment of COVID-19 prior to the satisfaction of the HDHP’s applicable minimum deductible.
To keep employers apprised of the rules and to assist with providing notice to plan participants of the changes that will accompany the end of the NE and PHE, the Department of Labor has issued two blog posts, which are available here and here.
Action Items: We urge plan sponsors to pay particular attention to notifying employees of the upcoming changes that will accompany the end of the PHE and NE and to ensure that participants covered under an HDHP understand that they may continue to contribute to their HSAs. Employers should consider communicating these changes to their employees.
For any questions regarding the end of the PHE and/or NE, please contact your regular McDermott lawyer or one of the authors.
The Biden administration has announced its intention to end the COVID-19 National Emergency (NE) and the COVID-19 Public Health Emergency (PHE) on May 11, 2023 (read our series introduction for more information). Among other things:
The NE and the PHE modified the rules governing financial requirements and quantitative treatment limitations under the Mental Health Parity and Addiction Equity Act (MHPAEA). The end of the NE and the PHE will require modifications to group health plans’ and health insurance issuers’ MHPAEA testing as it relates to financial requirements and quantitative treatment limits. The NE and the PHE also affect the design and operation of some employee assistance plans (EAPs).
The NE and the PHE allowed plan sponsors to expand coverage under excepted benefit EAPs in certain respects without risking their status as the Health Insurance Portability and Accountability Act (HIPAA)-excepted benefits.
MHPAEA
MHPAEA requires that the financial requirements (such as coinsurance and copays) and quantitative treatment limits (such as visit limits) imposed on mental health or substance use disorder (MH/SUD) benefits cannot be more restrictive than the predominant financial requirements and treatment limitations that apply to substantially all medical/surgical benefits in a particular benefit classification. During the public health emergency period, group health plans and health insurance issuers were permitted to disregard certain items and services related to testing for the detection of SARS-CoV-2, the virus that causes COVID-19, when performing the “substantially all” and “predominant” tests. Absent this relief, the costs of covering COVID-19 testing items and services without cost-sharing would be the amounts allocated to medical/surgical benefits, thereby putting group health plans and health insurance issuers at risk of running afoul of MHPAEA quantitative treatment limits.
From and after the end of the PHE, group health plans and health insurance issuers must include the cost of covering COVID-19 tests, either diagnostic or over-the-counter, or testing-related services, when calculating MHPAEA quantitative treatment limits.
Action Items: Employers should revisit their MHPAEA compliance testing to ensure that the coverage of COVID-19 tests is properly accounted for in applying the relevant quantitative treatment limits. There is, however, no longer a requirement that a group health plan or health insurance issuer cover these services without charge.
EMPLOYEE ASSISTANCE PLANS
The end of the NE and the PHE could have various impacts on EAPs depending on the specific plan design. Employers may, for example, see a spike in the need for mental health support that could be met through EAP services. While the pandemic may be winding down, the mental health impacts of the past three years may continue for by many employees. Employers may need to continue to offer mental health services and resources through their EAPs, and potentially explore expanding mental health services through an EAP or otherwise, to support employees who are struggling with anxiety, depression or other mental health issues related to the pandemic.
Particular attention is required in the case of excepted benefit EAPs. Excepted benefit EAPs do not provide minimum essential coverage for Affordable Care [...]
A key feature of the COVID-19 National Emergency (NE) and the COVID-19 Public Health Emergency (PHE) was the government’s ability to provide access and coverage of COVID-19 tests. This resulted in overlapping legislation targeted at providing tests to benefit plan participants for free.
With the end of the NE and PHE set for May 11, 2023, there is confusion about what will happen to COVID-19 testing.
Starting on March 18, 2020, the Families First Coronavirus Response Act (FFCRA) required all public and private insurance coverage, including self-funded plans, to cover COVID-19 tests and costs associated with diagnostic testing with no cost-sharing for the duration of the PHE. The Coronavirus Aid, Relief, and Economic Security (CARES) Act enacted shortly after expanded this requirement to cover out-of-network tests during the PHE. The Consolidated Appropriations Act of 2021 (CAA) then took a new approach and applied the requirement to over-the-counter (OTC) COVID-19 tests and added additional obligations. Under guidance issued by the US Departments of Labor, Health and Human Services, and Treasury, effective January 15, 2022, health plans were required to cover up to eight free OTC at-home tests per covered individual per month. Health plans could limit the reimbursement of these tests to the lesser of the actual or negotiated price or $12 per test. Health plans could also provide tests through participating network providers, such as pharmacies or retailers.
When the PHE ends, health plans will no longer be required to cover COVID-19 tests, either diagnostic or OTC, or testing-related services with no cost-sharing.
Employers should consider whether they want to continue to cover COVID-19 tests as required by a doctor or OTC without cost sharing. There is no requirement to stop doing this after the PHE but doing so may have some implications on group health plans. Importantly, if an employer decides to continue covering testing at no cost, they should consider how this affects any employer-sponsored high-deductible health plan (HDHP). IRS Notice 2020-15 permitted HDHP coverage of COVID-19 testing with no cost-sharing without conflicting with HSA eligibility (see our article here). This relief continues until further guidance is issued. Though COVID-19 testing could be considered preventative care under Section 223 of the Internal Revenue Code, the US Department of Treasury will need to provide further clarification. Employers should also consider whether they want to continue to apply a $12 reimbursement cap on COVID-19 or some other limitation.
After the PHE, employers who choose to continue to cover COVID-19 tests at no cost or apply a reimbursement cap may need to amend their plans or summary plan descriptions for these practices. They will also need to coordinate with any insurer or third-party administrator of the employer’s group health plan to ensure proper administration. Depending on the timing of these amendments, they may also need to provide a summary of material modifications to participants. Employers who decide not to continue coverage of COVID-19 tests or apply a reimbursement cap may need to amend their plans, depending on whether [...]
On January 30, 2023, the Biden administration announced its intention to make final extensions of both the COVID-19 National Emergency (NE) and the COVID-19 Public Health Emergency (PHE) through May 11, 2023, at which point both will end. These emergency declarations have been in place for nearly three years and have enabled the government to modify certain coverage requirements by Medicare, Medicaid and private insurance plans, as well as benefits administration rules. The end of the PHE and NE may mean added costs for benefits plans and new questions regarding compliance. This series will explore the implications of the PHE and NE and what their impending end may mean for benefit plan sponsors with articles released periodically before May 11.
There are several important benefit coverage and administration requirements connected to the PHE and/or NE that may remain the same, remain for a temporary period or may need to be discontinued upon the end of these federal emergencies. Over the course of the upcoming weeks, we will cover the key topics that may be triggered by the end of the PHE and/or NE, including:
High Deductible Health Plans, Health Savings Accounts and Employee Assistance Plans (Part 6 of 10)
Deadline Tolling Applied to Each of:
COBRA (Part 7 of 10)
Claims and Appeals + External Review (Part 8 of 10)
HIPAA Special Enrollment (Part 9 of 10)
Other Plan-Related Notices (Part 10 of 10)
Note that the items covered above are not an exhaustive list of all legislative and regulatory changes that could affect employee benefit plans. This series is meant to keep employers informed about some of the most important upcoming changes and the impending decisions and disclosures that need to be made.
For any questions regarding the end of the PHE and/or NE, please contact your regular McDermott lawyer or one of the authors.
In a Notice of Proposed Rulemaking published December 2, 2022 (the Proposed Rule), the United States Department of Health and Human Services (HHS) proposed long-awaited changes to the regulations protecting the confidentiality of substance use disorder patient records under Part 2 of Title 42 of the Code of Federal Regulations (42 CFR Part 2, or Part 2). Specifically, the Proposed Rule would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which required HHS to align Part 2 with certain provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and to make certain changes to the HIPAA Notice of Privacy Practices, the form given to patients and plan members that describes patient privacy rights, covered entity duties, and the covered entity’s uses and disclosures of protected health information (PHI).
On December 1, 2022, the Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS) issued a Bulletin on the obligations of covered entities and business associates (regulated entities) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules) when using online tracking technologies, such as cookies, web beacons and pixels. The Bulletin aims to provide further clarity on when identifiable information collected by such tracking technologies may also constitute protected health information (PHI) as defined and interpreted under the HIPAA Rules. In such instances, the Bulletin instructs that the technology vendor may be seen as providing a service to the regulated entity that would, in light of the use and disclosure of PHI, create a direct or downstream business associate relationship. Accordingly, the Bulletin states that the regulated entities would need to enter into a business associate agreement (BAA) with the vendor of the technology (and the vendor would, in turn, become a regulated entity) and meet other requirements under the HIPAA Rules. The Bulletin provides long-awaited guidance to help regulated entities review their positions and procedures concerning tracking technologies to ensure that the trackers they implement either do not collect PHI or meet the prerequisites outlined in the Bulletin.
Doctors across the country are encountering a minefield of legal risks as they navigate a post-Roe reality. In this Axios article, McDermott Partner Scott Weinstein offers perspective on the Health Insurance Portability and Accountability Act (HIPAA) and health information disclosure.
The US Supreme Court’s recent decision to overturn Roe v. Wade in Dobbs v. Jackson Women’s Health Organization has raised many questions about potential efforts by law enforcement agencies to obtain data from healthcare and other service providers to detect the performance of a possibly unlawful abortion. For example, data collected by period-tracking apps, patients’ self-reported symptoms, or diagnostic-testing results might be used to establish the timeframe in which an individual became pregnant, and then demonstrate that a pregnancy was terminated, as part of investigative or enforcement efforts against individuals or organizations allegedly involved in such termination.
On June 29, 2022, the office within the US Department of Health and Human Services (HHS) that is responsible for enforcing the Health Insurance Portability and Accountability Act (HIPAA), the Office for Civil Rights (OCR), issued guidance addressing how HIPAA limits disclosures by covered entities and business associates to law enforcement agencies in the absence of a court order or other legal mandate. The guidance provides helpful insight on how OCR may use HIPAA enforcement to discourage unauthorized disclosures of protected health information (PHI) to law enforcement officials in the wake of new state laws outlawing abortion. The guidance also implicitly confirms, however, that HIPAA does not provide a complete shield against law enforcement and litigation-driven requests for abortion-related information.
Subscribe
