HIPAA News

21st Century Cures Bill Sails Through Senate

Last week, the House of Representatives unanimously voted in favor of the 21st Century Cures Act. Yesterday, the bill sailed through the Senate with a vote of 94-5. All that remains is for President Obama to add his signature to the bill, which is expected to happen in the next few days. President Obama has already said he is happy to sign the new bill.

The bill will provide funding for a number of initiatives that are intended to hasten the development of new cures and medical devices to treat cancer and other diseases. The bill makes more funds available for mental health treatment as well as for programs to tackle the growing problem of opioid abuse in the United States. $500 million per year will be made available for the latter to prevent new cases of opioid abuse and to fund treatment programs for addicts.

The bill had originally called for changes to be made to the Health Insurance Portability and Accountability Act to improve data sharing for research purposes. By classifying research under healthcare operations, it would have been possible for the identifiable protected health information of patients to be shared with hundreds of thousands of covered entities – and potentially millions of business associates – without patient consent being required.

Many privacy groups believed the HIPAA changes would lead to patients’ privacy being violated and the bill was vehemently opposed. Eventually, the HIPAA changes were dropped from the bill. Instead, the version of the bill that was passed by the Senate calls for the creation of a new working group that will report to the Department of Health and Human Services. The group will investigate potential uses and disclosures of patient health information for research purposes and will conduct “studies to obtain generalizable knowledge, while protecting individuals’ privacy rights.” In the short to medium term it is unlikely that any changes will be made to current legislation to improve health data sharing for research purposes.

The 21st Century Cures Act does include some provisions aimed at improving data sharing, in particular to improve the sharing of mental health information. The bill has been praised by mental healthcare organizations and has been called the most significant piece of mental health legislation since the Mental Health Parity and Addiction Equity Act (MHPAEA), which was passed in 2008 to ensure equal coverage of treatment for mental illness and addiction as physical illnesses. The 21st Century Cures Act also strengthens current laws which ensure parity between mental and physical health.

The bill will make grants available to increase the number of psychiatrists and psychologists across the country and funding will be increased for early intervention and assertive community treatment programs.

The 21st Century Cures Act calls for the HHS’ Office for Civil Rights to issue new guidance for covered entities on allowable disclosures of mental health and substance abuse information HIPAA to clear up current confusion about how HIPAA applies to the sharing of mental health data.

OCR must also ensure that healthcare organizations and individuals involved in the provision of mental health treatment have “adequate, accessible, and easily comprehensible resources relating to appropriate uses and disclosures of protected health information under HIPAA.”

The bill also introduces penalties for organizations that either engage in information blocking or make it difficult for electronic health information to be shared with other entities. Civil monetary penalties of up to $1 million per violation will be possible when the bill is signed into law.

The post 21st Century Cures Bill Sails Through Senate appeared first on HIPAA Journal.

21st Century Cures Act Unanimously Passed by House

The 21st Century Cures Act has been passed by the House of Representatives with a vote of 392-26. One Democrat and twenty Republicans voted against the bill. The legislation will now go to the Senate for the vote, which will take place early next week.

The legislation was passed by the House last year, although the bill failed in the Senate in July 2015. Numerous revisions have been made since last summer and this time around the 21st Century Cures Act is expected to be passed by the Senate. However, not unanimously. Some senators are certain to vote against the legislation, including Senators Bernie Sanders (I-Vt.) and Elizabeth Warren (D-Mass.). Both strongly oppose the changes that have been made to the legislation to appease the pharmaceutical industry.

The main purpose of the $6.3 billion bill is to advance medical innovation. A sizable chunk of cash will be given to a number of programs introduced by the Obama administration. NIH will receive $4.8 billion in funding over the next 10 years which will go towards programs such as the cancer moonshot research project, the Precision Medicine Initiative, and the BRAIN Initiative.

The legislation will change the way pharmaceutical products and medical devices are approved by updating the Food and Drug Administration’s (FDA) current approval process. Many view the current FDA approval process as out-of-date and long winded, which is preventing new and effective treatments from being provided to patients.

The legislation will speed up the process of bringing new drugs and medical devices to market; however, there are fears that by doing so patient safety may be compromised. Critics of the legislation believe the Act favors pharmaceutical companies and that the FDA’s powers will be eroded. As a result, it is possible that ineffective cures and medical devices may come to market.

The legislation requires the FDA to develop a program to evaluate new drugs based on “real world evidence” rather than solely relying on clinical trial data to evaluate new indications or uses for drugs. Pharmaceutical companies will be able to submit observational studies, safety monitoring data, or summary-level reviews as proof that a drug is suitable for a new use.

In the three years since the bill was first introduced it has been subjected to numerous additions and changes, including provisions to change the allowable uses and disclosures of protected health information under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule.

The change would have seen medical research come under healthcare operations, which would have allowed patients’ PHI to be shared or disclosed for medical research without patient consent first being obtained. However, those changes were dropped from the current version of the bill.

Instead, the new legislation calls for the creation of a new working group to evaluate the issues surrounding the disclosure of patients’ PHI for research purposes. The working group will report to the HHS on “recommendations on whether the uses and disclosures of protected health information for research purposes should be modified to allow protected health information to be available, as appropriate, for research purposes, including studies to obtain generalizable knowledge, while protecting individuals’ privacy rights.”

The legislation also calls for the Office for Civil Rights to issue new HIPAA Privacy Rule guidance to covered entities on the “existing permitted uses and disclosures of health information by health care professionals to communicate with caregivers of adults with a serious mental illness to facilitate treatment.” This includes clarification on the sharing of mental health and substance abuse information with close relatives.

The post 21st Century Cures Act Unanimously Passed by House appeared first on HIPAA Journal.

After 2.5 years, HHS finally finalizes modifications to HIPAA rules

Excellent and detailed write-up of the new HIPAA rules that take effect on September 23, 2013:

On January 17, 2013, the U.S. Department of Health and Human Services (“HHS”) issued the highly anticipated omnibus final rule (the “Final Rule”) to modify the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) pursuant to the Health Information Technology for Economic and Clinical Health Act (“HITECH”). Following the enactment of HITECH, HHS issued interim final rules to implement the breach notification requirements and certain of the enforcement provisions of HITECH (collectively, the “Interim Rules”), and in July of 2010 HHS issued a proposed rule to implement modifications to the privacy and security provisions of HIPAA. Since that time, Covered Entities and their Business Associates and subcontractors have been awaiting the Final Rule to confirm the extent to which these modifications, which are aimed primarily at strengthening the privacy and security protections for protected health information (“PHI”) and tightening the HIPAA enforcement provisions, will impact their operations, contractual relationships and potential exposure for HIPAA liability.

Read all the gory details here: http://www.lexology.com/library/detail.aspx?g=40defc09-2337-435e-be56-2bef662a67e7

10 Affordable Health Care Act changes to be aware of for 2013

2013 HIPAA ChecklistWith 2013 right around the corner, you should be aware of the following 10 items for your checklist to make sure you’re ready for the Affordable Health Care Act.

Effective in 2013:

The following list itemizes the changes that generally will become effective in 2013.  The effective date depends upon a number of factors, including whether the health plan is grandfathered, the first day of the plan year, and the number of employees.

  • Women’s Preventive Health Care Mandates               
    Applicable To: Non-grandfathered plans only
    Effective:        Plan years beginning on or after August 1, 2012 (January 1, 2013 for calendar year plan years)
    Details:           Plans are required to provide in-network coverage with no cost sharing for preventive care such as coverage for contraceptives, contraceptive counseling, breastfeeding support, supplies and counseling, and screening for domestic violence.
  • Reduction in the Maximum Employee Contributions to a Health Flexible Spending Accounts
    Applicable To: Only health flexible spending accounts (generally offered under a cafeteria plan)
    Effective:        January 1, 2013 for calendar year plan years
    Details:           The maximum amount that an employee can contribute to a health flexible spending account on a pre-tax basis cannot exceed $2,500 per taxable year.  While the reduced limit is effective January 1, 2013 (or the first day of the plan year beginning after January 1, 2013 for plans with fiscal years), employers have until December 31, 2014, to adopt amendments to reflect this reduced limit.
  • Annual Benefit Limits
    Applicable To: Health plans other than health flexible spending accounts, health reimbursement accounts, and medical savings accounts
    Effective:        Generally only for the 2013 plan year (see below for changes in 2014)
    Details:           The annual limit on the dollar value of essential health benefits cannot be less than $2 million.
  • Reporting the Cost of Group Health Insurance Coverage on Forms W-2
    Applicable To: Employers that issued at least 250 Forms W-2 for 2012 (transition relief applies to exclude employers that issued fewer than 250 Forms W-2 for 2012, and certain types of plans)
    Effective:        For the 2012 W-2s to be issued by January 31, 2013
    Details:           The Forms W-2 issued by employers in early 2013 must report the value of any health coverage provided to each employee in 2012, regardless of who pays the premium for that coverage.  Employers should take steps to ensure that payroll departments or payroll providers are prepared for the new reporting requirement.
  • Summary of Benefits and Coverage and Notices of Material Modification
    Effective:          For open enrollment periods beginning on or after September 23, 2012 and for plan years beginning after that date
    Details:             Employer health plans must provide a Summary of Benefits and Coverage (SBC) to all plan participants, as well as to all employees who are eligible to participate.  If the employer makes a mid-year change in the plan provisions that would change the terms of the SBC, the plan also must provide a Notice of Material Modifications at least 60 days before the change takes effect.
  • Additional Medicare Tax Withholding
    Effective:          January 1, 2013
    Details:             An employer is required to withhold an additional 0.9% Medicare tax on an employee’s compensation in excess of $200,000.  The additional tax does not have an employer matching requirement.
  • Notice of Exchange Availability
    Applicable To: Employers subject to the Fair Labor Standards Act
    Effective:        Required by March 1, 2013
    Details:           Employers must provide a notice to employees concerning the availability of health coverage through the state-wide exchanges.  The notices will explain some of the benefits and consequences to employees if they choose to purchase a qualified health plan through the state exchange instead of electing coverage under an employer-sponsored health plan.  Employers are still waiting for additional guidance regarding these requirements, and some are predicting that this requirement may be postponed.
  • Taxation of the Retiree Drug Subsidy
    Effective:          January 1, 2013
    Details:             Employers who were providing retirees with prescription drug coverage that was generous enough to qualify for a federal tax subsidy will no longer be allowed to deduct all of those expenses.
  • Patient-Centered Outcomes Research Comparative Effectiveness Fee
    Applicable To: Plan sponsors maintaining a self-insured plan (insurers will pay this for fully-insured plans)
    Effective:        First payment is due by July 31, 2013
    Details:           Plan sponsors must begin to pay a fee (the “PCORI Fee”) to the Internal Revenue Service per average covered life ($1 for the first year, $2 for the second year, and increased as permitted in future years) per plan using Form 720.  These fees will be used to fund the new nonprofit corporation, the Patient-Centered Outcomes Research Institute, to support clinical effective ness research.  Some rules permit the limited aggregation of  plans.
  • Certification of Compliance to Health and Human Services (HHS)
    Effective:          By December 31, 2013
    Details:             Group health plans must file a certification statement with HHS certifying that their data and information systems for the plan are in compliance with the HIPAA standards and operating rules for health plan eligibility, electronic funds transfer, health claim status, health care payments, and remittance advice transactions.

 

Read more here, including 2014 preparedness items:
http://www.jdsupra.com/legalnews/2013-and-2014-under-the-affordable-care-00701/

5 Interesting HIPAA & HITECH Rule YouTube Videos

Need a refresher of some of the differences that HITECH brought to the HIPAA landscape? Check out the videos below.

Privacy & Security: The New HIPAA Rule

HIPAA Privacy, Security, and the HITECH Act

HITECH ACT – 2010 Changes in HIPAA Law

HITECH Act and Encryption in 5 Minutes

Information Security Program and HIPAA Compliance

HIPPA Violations Scarier than Surgical Fires?

Wonder just how worried hospital administrators are about potential HIPAA breeches due to IT failure and mistakes? According to a poll taken and published by Healthcare IT News worried enough to put IT failures at number five on their Top Ten list of general technology hazards an institution might face.

According to that report the prospect of a data disaster that leads to a costly HIPPA breech is scarier than luer mis connections, over sedation, needle sticks, surgical fires and defibrillator failures.

Is this a bit of an over reaction? Surgical fires and needle sticks sound a lot more serious than data loss. However given the increasing number of HIPPA violations reported around the country in 2010 and in many cases the costly fines and horrendous publicity that came with them make this kind of concern understandable.

Some of these violations would never have been prevented by even the most sophisticated of IT security systems though. Take the recent reports about a physician who transmitted a great deal of personal patient information via email to his home in a completely insecure and unencrypted manner.

There was no malice involved, the man was merely trying to have the information at hand to review properly at the end of his long day. The story though highlighted the continuing need for the education of everyone who handles PI in what is and is not allowable under the HIPPA rules and regulations.

How Safe Is the Data in my EHR and Practice Management System?

Dr. Sharham Famorzadeh, Nuesoft’s Chief Technology Officer, explains the security benefits of medical practice management systems that run in the cloud, and addresses common concerns related to cloud computing. Do you agree? would you consider a cloud based practice management system?