Weekend update

HIPAA Privacy and Security Rules

Weekend update

David Ermer–Congress, COVID-19, COVID-19 vaccine, HIPAA Privacy and Security Rules, U.S. Healthcare, Uncategorized–
green pine trees during snow season
Snow trees on trail by Ian Schneider on Unsplash.com

The Wall Street Journal reports that

Lawmakers raced to put finishing touches on a roughly $900 billion coronavirus aid package, pushing up against a midnight deadline to complete the agreement and pass it through Congress. 

With a disagreement on the Federal Reserve’s emergency lending powers settled earlier in the weekend, negotiators on Sunday were finalizing details for the rest of the bill. Senate Majority Leader Mitch McConnell (R., Ky.) said Sunday afternoon that negotiators were hours away from completing the deal. * * *

The emerging agreement is expected to provide $300 a week in enhanced federal unemployment benefits, a $600 direct check to many Americans, as well as aid for schools, vaccine distribution and small businesses. Final votes in the House and Senate could occur as early as Sunday.

Lawmakers raced to put finishing touches on a roughly $900 billion coronavirus aid package, pushing up against a midnight deadline to complete the agreement and pass it through Congress. 

With a disagreement on the Federal Reserve’s emergency lending powers settled earlier in the weekend, negotiators on Sunday were finalizing details for the rest of the bill. Senate Majority Leader Mitch McConnell (R., Ky.) said Sunday afternoon that negotiators were hours away from completing the deal. * * *

The emerging agreement is expected to provide $300 a week in enhanced federal unemployment benefits, a $600 direct check to many Americans, as well as aid for schools, vaccine distribution and small businesses. Final votes in the House and Senate could occur as early as Sunday.

The House is expected to vote on a 24-hour extension of government funding Sunday evening, setting up votes on the relief agreement and broader spending bill for Monday. The aid package is tied to a roughly $1.4 trillion annual spending package and Congress has passed a series of temporary spending bills in recent days to keep the government funded while it finished the negotiations.

Significantly, Politico reports that “Congress is set to include a long-elusive ban on “surprise” medical bills as part of a major spending deal lawmakers were working to finalize Sunday evening.”

(P.S. Govexec.com confirms that Congress passed a one day extension of the continuing resolution Sunday night.)

On the COVID-19 front —

The Centers for Disease Control now has a COVID-19 vaccines website which indicates that as of 1 pm today 2,838,225 doses of vaccine have been distributed and 556,208 doses have been administered in the first week.

In accordance with CDC Advisory Committee on Immunization Practices recommendations, the current phase 1A of distribution is directed at healthcare personal and nursing home residents, The Wall Street Journal reports that ACIP today approved phases 1B and 1C as follows:

The next group would include people ages 75 and older, whose hospitalization and death rates are the highest of all age groups. It would also include teachers, factory workers, police and firefighters, grocery store workers and others who are considered essential to the functioning of the economy and at high risk of exposure to Covid-19.

Another group would follow them, comprised of people between the ages of 65 and 74, anyone age 16 or over with a medical condition that puts them at high risk of complications from Covid-19, and other essential workers. They include people who work in transportation and logistics, food service, water and wastewater, and energy sectors.

The ACIP vote was 13-1. State governors are the ultimate decision makers in their states but the FEHBlog understands the governors generally defer to ACIP. As the FEHBlog has noted the vaccines are being directly distributed to federal agencies too.

On the COVID-19 treatment front, the Wall Street Journal reports that

Doctors are treating a new flood of critically ill coronavirus patients with treatments from before the pandemic, to keep more patients alive and send them home sooner.

Last spring, with less known about the disease, doctors often pre-emptively put patients on ventilators or gave powerful sedatives largely abandoned in recent years. The aim was to save the seriously ill and protect hospital staff from Covid-19.

Now hospital treatment for the most critically looks more like it did before the pandemic. Doctors hold off longer before placing patients on ventilators. Patients get less powerful sedatives, with doctors checking more frequently to see if they can halt the drugs entirely and dialing back how much air ventilators push into patients’ lungs with each breath.

“Let us go back to basics,” said Dr. Eduardo Oliveira, executive medical director for critical-care services for AdventHealth Central Florida, which recommends its doctors stick with pre-pandemic guidelines for ventilator use. “The less you deviate from it, the better.”

Advances also include new drugs, most notably steroids, for severely ill patients.

In other healthcare news, Health Payer Intelligence informs us that

Payers may consider promoting ambulatory surgery centers as the ideal site of care for joint replacement surgeries, UnitedHealth Group’s recent research findings suggested.

“Findings from new UnitedHealth Group research underscore the importance of optimizing sites of care to improve patient safety and reduce costs,” the report summarized.

The study analyzed data 2018 and 2019 procedures conducted at Optum’s ambulatory surgery centers. The researchers used low- and medium-severity surgeries to from the baseline and gauge shifts in costs and savings. They used the Ambulatory Surgery Centers Quality Collaboration’s recommended outcome measures to assess quality of care.

On the SolarWinds backdoor hack front, check out this ArsTechnica article:

Of the 18,000 organizations that downloaded a backdoored version of software from SolarWinds, the tiniest of slivers—possibly as small as 0.2 percent—received a follow-on hack that used the backdoor to install a second-stage payload. The largest populations receiving stage two were, in order, tech companies, government agencies, and think tanks/NGOs. The vast majority—80 percent—of these 40 chosen ones were located in the US.

These figures were provided in an update from Microsoft President Brad Smith. Smith also shared some insightful and sobering commentary on the significance of this almost unprecedented attack. His numbers are incomplete, since Microsoft sees only what its Windows Defender app detects. Still, Microsoft sees a lot, so any difference with actual numbers is likely a rounding error.

The FEHBlog had been wondering why not all of the victims of the backdoor hack were breached. It was a conscious decision by the hackers.

COVID-19 Vaccine update and more

David Ermer–Congress, COVID-19, COVID-19 testing, HIPAA Privacy and Security Rules–

Last night, the FDA granted Moderna emergency use authorization for administering its mRNA based COVID-19 vaccine to Americans aged 18 and older. About an hour ago, the CDC’s Advisory Committee seconded this decision which means that health plans, including FEHB plans, must begin to provide in-network and out-of-network coverage for administration of the Moderna vaccine on January 3, 2021. That is certainly good news.

Last night, as CBS News reports, the Senate joined the House of Representatives in approving a two day extension of the continuing resolution funding the federal government, and the President signed the resolution into law. The Hill adds this afternoon that

Speaker Nancy Pelosi (D-Calif.) told Democratic House members during a conference call Saturday that a deal is within reach as soon as negotiators hammer out an agreement on language being pushed by Sen. Pat Toomey(R-Pa.) to wind down the Federal Reserve credit lending facilities. Pelosi told colleagues that the “good news” is “we’re right within reach” of resolving that disagreement.

In other news —

  • The American Medical Association offers advice on which masks work best in warding off COVID-19.
  • The federal government’s Cybersecurity and Infrastructure Security Agency (“CISA”) offered updated guidance today on the SolarWinds backdoor hack.
  • Bloomberg provided this interesting observation on the scope of this hack:

At least 200 organizations, including government agencies and companies around the world, have been hacked as part of a suspected Russian cyber-attack that implanted malicious code in a widely used software program, said a cybersecurity firm and three people familiar with ongoing investigations.

The number of actual hacking victims has been one of many unanswered questions surrounding the cyber-attack, which used a backdoor in SolarWinds Corp.’s Orion network management software as a staging ground for further attacks.

As many as 18,000 SolarWinds’ customers received a malicious update that included the backdoor, but the number that was actually hacked — meaning the attackers used the backdoor to infiltrate computer networks — is likely to be far fewer.

Monday Roundup

David Ermer–Congress, COVID-19 vaccine, HIPAA Privacy and Security Rules–
Photo by Sven Read on Unsplash

STAT News offers a portrait of the COVID-19 virus at one year — what scientists know about how it spreads, infects, and sickens. Meanwhile, the AP provides its perspective on today’s first COVID-19 vaccinations, which should be view as a miracle as vaccines normally take at least four years to develop.

Healthcare Dive and Revcycle Intelligence discuss industry reaction to the bipartisan, bicameral surprise billing legislation introduced in Congress last week. The articles make it clear that neither providers nor payers are entirely happy with the legislation and that the legislators’ goal is to attach the bill to this week’s must pass omnibus spending bill (“the omnibus”). It could go.

A friend of the FEHBlog pointed out today another bill that could get attached to the omnibus. Last week the House passed H.R. 7898 which would permit HHS’s Office for Civil Rights to mitigate HIPAA fines and other remedies when the covered entity or business associate has adequately demonstrated that it “had, for not less than the previous 12 months, recognized security practices in place.” “The term ‘recognized security practices’ means the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title).” That’s quite reasonable and equitable.

Bloomberg reports today that legislative work on the omnibus itself remains on track. Also the FEHBlog appreciated Bloomberg’s insights into the COVID-19 relief bill which would be the key measure to be attached to the omnibus. What better time than now for Christmas tree legislation” In any event, according to Bloomberg,

[U.S Senator John] Cornyn [R TX] said the $908 billion bipartisan proposal unveiled Monday isn’t likely to go forward by itself but will be used as jumping-off point for the leaders from both parties in both chambers. ”It’s having a positive influence on what will ultimately included,” Cornyn said of the bipartisan proposal. 

Forbes provides more background on the status of the COVID-19 relief legislation for those who are interested (as the FEHBlog is).

While the FEHBlog is a subscriber to the WSJ, Bloomberg and STAT News, among others, he does not subscribe to Modern Healthcare. That’s difficult at this time of year because he does get a kick out of their list of the 100 people who have most influence on U.S. healthcare. Fortunately, AHIP provided a list of their members’ executives who made the list. Congratulations to them.

Happy Hannukah

David Ermer–COVID-19, COVID-19 vaccine, Federal employment benefits, HIPAA Privacy and Security Rules, U.S. Healthcare–
Hanukkah greeting template. Nine candles and wishing. Hand drawn sketch illustration. White, yellow and blue colors

The eight day long Jewish holiday of Hannukah begins tonight. Best wishes to those who are celebrating this holiday.

This evening. STAT News reports

A panel of outside experts on Thursday recommended the Food and Drug Administration issue an emergency use authorization to the Covid-19 vaccine being developed by Pfizer and BioNTech, a vaccine that appeared to be highly efficacious in a Phase 3 clinical trial.

The 17-4 vote came after a long day in which members of the Vaccines and Related Biological Products Advisory Committee, or VRBPAC, discussed a wide range of issues related to the vaccine, including concerns about vaccinating people with severe allergies and 16- and 17-year-olds, as well as issues regarding vaccination during pregnancy or lactation.

Although the FDA does not have to follow the panel’s recommendation, it is widely expected to do so. The rollout of Covid-19 vaccine could then begin in the United States in a matter of days.

The FEHBlog watched on You Tube a good chunk of the discussion preceding the vote. The FEHBlog was surprised that the motion presented to the Committee would extend the emergency use authorization to 16 and 17 year olds. He thought that the the minimum age would be 18 years old, and the committee members who voted against the bill were pediatricians concerned about the 16 to 17 year olds. Another member who was not a physician argued that the emergency use authorization use authorization should be limited to health care workers and nursing home residents, the initial phases approved by the CDC’s Advisory Committee on Immunization Practices. In any event, the FEHBlog was pleased by the decisive vote. At the close of the virtual committee meeting the Chairman reminded the members that they would be meeting next Thursday December 17 to consider an emergency use authorization for the Modern vaccine.

Speaking of voting, the Senate did not take up today the one week long extension of continuing resolution funding the federal government or the FY 2021 national defense authorization act which the House approved yesterday. The Senate needs to act on the continuing resolution tomorrow. The Wall Street Journal reports that negotiations over another COVID-19 relief bill continue.

A friend of the FEHBlog called to his attention the Department of Health and Human Services website on combatting the COVID-19 virus. It’s quite comprehensive.

In other news today, the HHS Office for Civil Rights, which enforces the HIPAA Privacy and Security Rules, proposed changes to the Privacy Rule.

The proposed changes to the HIPAA Privacy Rule include strengthening individuals’ rights to access their own health information, including electronic information; improving information sharing for care coordination and case management for individuals; facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhancing flexibilities for disclosures in emergency or threatening circumstances, such as the Opioid and COVID-19 public health emergencies; and reducing administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.

A friend of the FEHBlog shared this HHS fact sheet on this proposed rule. The proposal has a 60 day comment deadline which will end during the Biden Administration.

HHS’s Centers for Medicare and Medicaid Services proposed new rules to crack down on prior authorization practice by Medicaid, CHIP, and QHP marketplace plans. (Medicare does not permit prior authorization.)

The rule would require payers in Medicaid, CHIP and QHP programs to build application programming interfaces (APIs) to support data exchange and prior authorization. APIs allow two systems, or a payer’s system and a third-party app, to communicate and share data electronically  Payers would be required to implement and maintain these APIs using the Health Level 7 (HL7) Fast Healthcare Interoperability Resources (FHIR) standard. 

Building on that foundational policy, this rule would require impacted payers to implement and maintain a FHIR-based API to exchange patient data as patients move from one payer to another. In this way, patients who would otherwise not have access to their historic health information would be able to bring their information with them when they move from one payer to another, and would not lose that information simply because they changed payers.  

These proposed changes would also allow payers, providers and patients to have access to more information including pending and active prior authorization decisions, potentially allowing for fewer repeat prior authorizations, reducing burden and cost, and ensuring patients have better continuity of care.

The proposals are expected to take effect in January 2023. Good ideas. The pubic comment period ends on January 4, 2021, but the final rule no doubt will be in the hands of the Biden administration. The American Medical Association must be happy though.

In Govexec, benefits consultant Tammy Flanagan discusses FEHBP options for annuitants with primary Medicare A and B coverage. The FEHBlog is always impressed by the creative benefit designs that FEHB plan carriers offer members.

Thursday Miscellany

David Ermer–ACA, CDC, COVID-19, HIPAA Privacy and Security Rules, Medicare, U.S. Healthcare–
Photo by Juliane Liebermann on Unsplash

Today’s big news is that the ACA regulators (the Departments of Health and Human Services (“HHS”), Labor, and Treasury) finalized a lengthy pricing transparency rule for payers, including ERISA and FEHBP group health plans (see footnote 233). The related fact sheet explains

This final rule includes two approaches to make health care price information accessible to consumers and other stakeholders, allowing for easy comparison-shopping.

First, most non-grandfathered group health plans and health insurance issuers offering non-grandfathered health insurance coverage in the individual and group markets will be required to make available to participants, beneficiaries and enrollees (or their authorized representative) personalized out-of-pocket cost information, and the underlying negotiated rates, for all covered health care items and services, including prescription drugs, through an internet-based self-service tool and in paper form upon request. For the first time, most consumers will be able to get real-time and accurate estimates of their cost-sharing liability for health care items and services from different providers in real time, allowing them to both understand how costs for covered health care items and services are determined by their plan, and also shop and compare health care costs before receiving care. An initial list of 500 shoppable services as determined by the Departments will be required to be available via the internet based self-service tool for plan years that begin on or after January 1, 2023. The remainder of all items and services will be required for these self-service tools for plan years that begin on or after January 1, 2024.

Second, most non-grandfathered group health plans or health insurance issuers offering non-grandfathered health insurance coverage in the individual and group markets will be required to make available to the public, including stakeholders such as consumers, researchers, employers, and third-party developers, three separate machine-readable files that include detailed pricing information.
The first file will show negotiated rates for all covered items and services between the plan or issuer and in-network providers.
The second file will show both the historical payments to, and billed charges from, out-of-network providers. Historical payments must have a minimum of twenty entries in order to protect consumer privacy.
And finally, the third file will detail the in-network negotiated rates and historical net prices for all covered prescription drugs by plan or issuer at the pharmacy location level.
Plans and issuers will display these data files in a standardized format and will provide monthly updates. This data will provide opportunities for detailed research studies, data analysis, and offer third party developers and innovators the ability to create private sector solutions to help drive additional price comparison and consumerism in the health care market. These files are required to be made public for plan years that begin on or after January 1, 2022.

The final rule also provides some medical loss ratio relief to compliant health insurance issuers as explained in the fact sheet. Here is AHIP’s reaction to the final rule.

Also today HHS issued an interim final rule with a comment period that “extends the compliance dates and timeframes necessary to meet certain requirements related to information blocking and Conditions and Maintenance of Certification (CoC/MoC) requirements. Released to the public on March 9, 2020, ONC’s Cures Act Final Rule established exceptions to the 21st Century Cures Act’s information blocking provision and adopted new health information technology (health IT) certification requirements to enhance patients’ smartphone access to their health information at no cost through the use of application programming interfaces (APIs).” The rule had been scheduled to take effect beginning next week.

Fierce Healthcare reports that “Regeneron’s anti-SARS-CoV-2 antibody cocktail has significantly reduced medical visits in ambulatory COVID-19 patients. The phase 2/3 clinical trial linked REGN-COV2 to a 57% decline in medical visits associated with COVID-19 in the 29 days after treatment.”

HealthPartners, a Minneapolis health insurer that participates in the FEHBP, offers a helpful, complete explanation of the benefits of wearing masks to prevent COVID-19. “At its core, wearing a mask is an act of kindness and neighborliness. It’s one of the simplest good deeds you can do these days, and a great way to be a force of positivity for the people in your life.”

Fierce Healthcare reports

The financial crisis for hospitals and physician practices caused by the COVID pandemic is a “clarion call” for the healthcare industry to move from a fee-for-service payment model to value, said Kevin Mahoney, chief executive officer of the University of Pennsylvania Health System (Penn Medicine).

“The hospital sector has taken a giant hit. We keep hearing about ‘the new normal.’ The lesson that we learned is that there is nothing new or normal about a pandemic, there’s just been an acceleration of trends,” Mahoney said during a recent virtual event hosted by the University of Pennsylvania. “It has laid bare how dependent hospitals are on commercially-insured, elective procedures, and without them, we don’t make money.”

The FEHBlog’s youngest son is a research coordinator for Penn Medicine. The FEHBlog seconds his boss’s sentiments.

The Surgeon General issued a timely

Call to Action to Control Hypertension (Call to Action) seeks to avert the negative health effects of hypertension by identifying evidence-based interventions that can be implemented, adapted, and expanded in diverse settings across the United States.

The Call to Action outlines three goals to improve hypertension control across the United States, and each goal is supported by strategies to achieve success:

Goal 1. Make hypertension control a national priority.
Goal 2. Ensure that the places where people live, learn, work, and play support hypertension control.
Goal 3. Optimize patient care for hypertension.

Following up on yesterday’s post about mandatory of coverage of COVID-19 vaccines with no member cost sharing once available, the FEHBlog wants to add that the same rule applies to Medicare. CMS “estimates the overall cost of providing the vaccine to every senior on Medicare would be around $2.6 billion, which would be covered by the federal government. CMS will also cover the vaccine for any uninsured individuals by using money from a $175 billion provider relief fund passed as part of the CARES Act.” It appears however that the vaccine would be administered through the Part D program. That would not be much help to FEHB plans as most FEHB members with primary Medicare coverage does not carry Medicare Part D.

Nextgov reports that

The Health and Human Services Department, the Cybersecurity and Infrastructure Security Agency and the FBI warn hospitals face an imminent threat from cybercriminals that encrypt and hold their data hostage—and some health care facilities are already dealing with the fallout.

The agencies collectively issued an advisory Wednesday detailing the tactics, techniques and procedures reportedly used against at least five hospitals already this week. The advisory includes recommendations for mitigating what observers are referring to as the most serious cyber threat the U.S. has seen to date, being perpetrated by an especially ruthless group of criminals.  

“CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers,” reads the advisory.

Monday Roundup

David Ermer–COVID-19, HIPAA Privacy and Security Rules, U.S. Healthcare–

The Wall Street Journal reports today that

Photo by Sven Read on Unsplash

“Public-health experts increasingly agree—including critics of the Great Barrington Declaration—that the broad, months long lockdowns imposed in March may be too unpopular to sustain [again]. Experts who backed lockdowns in the spring now worry another round of the same type could backfire if the public ceases to comply.

Even proponents of more lockdowns are generally pushing for briefer, more targeted closures, dubbed circuit-breakers, in which governments would shut specific businesses for two or three weeks, such as bars, restaurants and possibly universities. Other institutions that appear to be lower risk—including day cares, elementary schools and outdoor facilities—could remain open.

“The opinion of public health experts is changing very rapidly,” said Jayanta Bhattacharya, a professor of medicine at Stanford University, who is one of the co-authors of the Great Barrington Declaration. “In March, I felt alone. [Now] I think there are a very large number of public health experts, epidemiologists, and doctors who oppose further lockdowns.”

That’s a consensus that the FEHBlog can support.

Fierce Healthcare reports from the HLTH Conference on Humana CEO Bruce Broussard’s talk on how he adjusted his leadership style to the COVID-19 public health emergency. “He said that a virtual work environment has forced him to be much more “intentional” in his leadership approach, which meant adopting new strategies to reach workers and being more thoughtful about how he approaches communicating with Humana’s employees. * * * In addition,Broussard said he believes COVID-19 is putting a spotlight on the value of taking a whole-person approach to care. Having flexible access to a number of different services at home was crucial for the insurer’s largely-Medicare Advantage member base, who were at high risk from complications if they caught the virus. Broussard said he doesn’t foresee the momentum toward those options going away once COVID-19 is under control.

Today, the FEHBlog ran across another interesting conference which is being held later this week — American Healthcare Information Management Association (“AHIMA”) 20. The FEHBlog, who is an AHIMA member, purchased access to this virtual conference. The conference runs from October 14 to October 17.

A related organization, the Workgroup for Electronic Data Interchange (WEDI) holds its virtual annual conference from October 20 to 22. WEDI focuses on the HIPAA standard transactions while AHIMA focuses on the HIPAA-coded data included in those transactions. It is the umbrella law that piques this lawyers interest among other things.

Friday Stats and More

David Ermer–CDC, COVID-19, HIPAA Privacy and Security Rules, SCOTUS–

Based on the Centers for Disease Control (CDC) Cases in the U.S. website, here is the FEHBlog’s chart of new weekly COVID-19 cases and deaths over the 20th through 40th weeks of this year (beginning May 14 and ending October 7; using Thursday as the first day of the week in order to facilitate this weekly update):

and here is the CDC’s latest overall weekly hospitalization rate chart for COVID-19:

Because the FEHBlog does look at his charts which are intended to show trends, he realized that new deaths chart is flat because new cases greatly exceed new deaths. Accordingly here is a chart of new COVID-19 deaths over the same period (May 14 through October 7 (nearly five months).

Chris Conover recently wrote about your risk of dying from COVID-19 in the Forbes Apothecary. Three takeaways from the article:

  • Covid-19 has increased the risk of death for the average American by about 10 percent, but this increase in risk is much higher for seniors than children.
  • For seniors age 70 and older, getting Covid-19 is riskier than climbing Mt. Everest; in contrast, for those under age 20, the infection fatality risk is equivalent to driving a car for 7,500 miles.
  • Those under age 50 who get infected with the coronavirus lose less than one day of discounted quality-adjusted life expectancy; seniors age 70 or older lose nearly 90 days.

Today the CDC released the first weekly influenza update for this flu season in our country. The key update is brief: “Seasonal influenza activity in the United States remains low.” In contrast, the key update from this week’s COVID-19 update from the CDC is more nuanced:

Nationally, indicators that track COVID-19 activity continued to decline or remain stable (change of ≤0.1%). However, one region reported a slight increase in the percentage of specimens testing positive for SARS-CoV-2 and four regions reported slight increases in the percentage of visits for influenza-like illness (ILI). Mortality attributed to COVID-19 declined but remains above the epidemic threshold.

Today, the CDC also issued its National Action Plan for Combating Antibiotic Resistance 2020-2025, a worthy goal. “The U.S. Government will report annually on progress toward the objectives set in the Plan.”

In his Libertarian podcast this week, law professor Richard Epstein discussed why the Supreme Court will uphold the constitutionality of the Affordable Care Act in the California v. Texas case, which will be argued on November 10. The FEHBlog is buying what the good professor is selling. The discussion is in the first 10 minutes of the podcast which is less than 30 minutes overall.

The HHS Office for Civil Rights took its second scalp this week from a healthcare provider that allegedly failed to give patients HIPAA required access to their medical records, a big OCR priority. “NY Spine Medicine (NY Spine) has agreed to take corrective actions and pay $100,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access provision. NY Spine is a private medical practice specializing in neurology and pain management with offices in New York, NY, and Miami Beach, FL.”

Have a good weekend.

Midweek Update

David Ermer–CDC, COVID-19, HIPAA Privacy and Security Rules, Telehealth, U.S. Healthcare–
Photo by Maria Teneva on Unsplash

The Blue Cross Blue Shield Association has a new president and CEO effective January 4, 2021 — Kim A. Keck. Ms. Keck, who will be the first woman to hold this position, is currently president and CEO of Blue Cross of Rhode Island. She worked for Aetna for 28 years. Of course, she succeeds Scott Serota. Congratulations, Ms. Keck.

Congratulations as well to the 2020 winners of the Nobel Prize in Chemistry, Emmanuelle Charpentier of the Max Planck Institute in Berlin and Jennifer Doudna of the University of California, Berkley, for their work in developing “genetic scissors” known as CRISPR-Cas9 “that can cut DNA at a precise location, allowing scientists to make specific changes to specific genes.” NPR explains that

“Once in a long time, an advance comes along that utterly transforms an entire field and does so very rapidly,” says Francis Collins, director of the National Institutes of Health, which has long supported Doudna’s research. “You cannot walk into a molecular biology laboratory today, working on virtually any organism, where CRISPR-Cas9 is not playing a role in the ability to understand how life works and how disease happens. It’s just that powerful.”

In other good news Precision Vaccinations reports that

The CDC researchers noted in the Morbidity and Mortality Weekly Report published on October 2, 2020, that during the 2019-20 flu season, 61.2 percent of surveyed pregnant women received the flu vaccine, which was 7.5 percentage points higher than the previous flu season. In addition, 56.6 percent of the women received the Tdap vaccine during pregnancy, and 40.3 percent received both vaccines. The percentage of women receiving both vaccines significantly increased from 35 percent just one year ago.

These increases were driven by increased vaccination coverage among Black and Hispanic women and those of other races reported the CDC. The CDC authors stated: “Racial disparities in vaccination coverage could decrease further with consistent provider offers or referrals for vaccination, in combination with culturally competent conversations with patients.” Specifically, this data found approximately 20 percent of pregnant women reported not receiving a provider recommendation for these vaccinations.

On the COVID-19 front, STAT News informs us that Eli Lilly reports good results with its synthetic antibody treatments for COVID-19. Lilly is seek emergency authorization use approval from the Food and Drug Administration as it continues to clinical trials on the treatments.

In other news —

The Department of Health and Human Services (“HHS”) announced today that

Surgeon General VADM Jerome M. Adams, M.D., M.P.H., issued a Call to Action urging Americans to recognize and address hypertension control as a national, public health priority. The Surgeon General’s Call to Action to Control Hypertension provides strategies for those on the frontlines of health care and public health to address this costly, dangerous and far too common chronic health condition.

According to Fierce Healthcare, Express Scripts has added new tools to its digital formulary that address “women’s health needs, tobacco cessation, muscle and joint pain, caregiver care and COVID-19 workplace support. The formulary’s goal is to assist employers and other plan sponsors in finding the digital health solutions that best fit their worker’s needs, and which have been vetted by experts at Express Scripts for key concerns like effectiveness, value, user experience and security.”

Healthcare Dive lets us know that

Doctors and consumers expect to use virtual care more often after COVID-19 than they did before, according to a new survey from telehealth vendor Amwell, hinting at the long-term potential of the virtual care model in healthcare. Prior to the pandemic, the majority of virtual visits were for on-demand urgent care. But this year, the volume of virtual specialty and scheduled visits outpaced urgent care, suggesting telehealth is becoming normalized across more fields and use cases. Only about 21% of consumers had a virtual visit for on-demand urgent care visit this year. By comparison, 54% had a scheduled visits with their primary care physician.

HHS’s Office for Civil Rights announced another HIPAA scalping of a healthcare provider that failed to provide individual access to their medical record, a top OCR priority at this time. “Dignity Health, doing business as St. Joseph’s Hospital and Medical Center (“SJHMC”), has agreed to take corrective actions and pay $160,000 to settle a potential violation of the HIPAA Privacy Rule’s right of access provision. SJHMC, based in Phoenix, Arizona, is a large, acute care hospital with several hospital-based clinics that provide a wide range of health, social, and support services.”

Happy New Fiscal Year

David Ermer–COVID-19, COVID-19 testing, COVID-19 vaccine, Federal employment benefits, HIPAA Privacy and Security Rules, OPM–

Today, October 1, 2020, is the beginning of the new 2021 federal fiscal year and the fourth calendar quarter of 2020. Federal News Network reports that the President signed the compromise continuing resolution into law at 1 am this morning. The federal government is now funded through December 11, 2020.

The Washington Post reminds us that

Most federal employees [became] eligible Thursday [October 1] for paid parental leave, a benefit valued at about $1 billion a year and one of the most significant expansions of their benefits since the creation of unpaid parental leave more than 25 years ago. The new entitlement will allow employees to take paid time off for part or all of 12 weeks over a 12-month period, effective with births, adoptions or foster placements that occur Thursday and after. Previously, employees could take 12 weeks of unpaid time available under the Family and Medical Leave Act.

On the COVID-19 front —

  • The Wall Street Journal provides operational background on the current Phase III COVID-19 vaccine trials.
  • The Department of Health and Human Services announced an agreement with the Rockefeller Foundation “to identify and share effective approaches for using rapid point-of-care (POC) antigen tests to screen for COVID-19 in communities, with a focus on safely reopening K-12 schools. The partnership establishes a pilot program with select cities and states in The Rockefeller Foundation’s Testing Solutions Group (TSG), a network of public officials devoted to rapidly scaling COVID-19 testing, tracing, and tracking in their communities.”
  • STAT News discusses the somber connection between diabetes and COVID-19.

Data from the U.S. Centers for Disease Control and Prevention show more than three-quarters of people who died from Covid-19 had at least one preexisting condition. Overall, diabetes was noted as an underlying condition for approximately 4 in 10 patients. Among people younger than 65 who died from the infection, about half had diabetes.

[Moreover,] Juliana Chan, director of the Hong Kong Institute of Diabetes and Obesity, said the pandemic has intertwined with and exposed two other widespread problems: diabetes and disparities triggered by social determinants of health.

“What we are seeing is nothing new, but it is really just on a massive and global scale,” she said in an interview. “I hope that there is something positive out of this, that people understand that we are hit by three epidemics.”

  • The U.S. Department of Labor issued additional FAQs “regarding the need to report employees’ in-patient hospitalizations and fatalities resulting from work-related cases of the coronavirus.”

Because October is National Cybersecurity Awareness Month, the FEHBlog wishes to point out this Health IT Security report that

From October 2019 to July 2020, Microsoft data shows hackers have rapidly improved the sophistication and increased the frequency of cyberattacks. And when it comes to incident response engagements, ransomware attacks were the most common cause. The report follows reports that the Universal Health Services health system is currently recovering from what appears to be one of the biggest ransomware attacks in recent history. Further, nearly a dozen healthcare entities in the past month have either faced similar incidents or saw their data leaked online by ransomware threat actors.

Midweek Update

David Ermer–Congress, COVID-19, HIPAA Privacy and Security Rules, Medicare, OPM, U.S. Healthcare–
Photo by Manasvita S on Unsplash

Late this afternoon, the Senate approved the compromise FY 2021 continuing resolution (H.R. 8337) by a vote of 84-10. The President is expect to sign the bill into law tonight. The bill provides continued funding for the federal government through December 11. Congress will hold a lame duck session following the national election on November 3 to consider next steps on FY 2021 appropriations.

This bill includes two provisions relevant to the FEHBP:

  • Section 2401 caps any increase to the Medicare Part B premium at 25% of what it otherwise would be for 2021. Presumably this cap only applies to the basic Part B premium and not to the increased premiums paid by high earners. In any event it should help encourage annuitants to join or stay enrolled in Part B. CMS should be announcing Medicare Part B and other traditional Medicare cost sharing amounts later in October.
  • Section 138 allows OPM, “which is still grappling with its own funding shortfall after the governmentwide security clearance business transferred to the Defense Department last year, to tap into the trust funds it oversees to keep its own operations going.” How would this impact the FEHBP? Section 8909 of the FEHB Act imposes a 4% surcharge on net to carrier premiums. 75% of that surcharge is deposited in a contingency reserve for the carrier which acts like a premium stabilization fund. The remaining 25% of that surcharge is available to cover OPM costs of FEHB administration to the extent appropriated by Congress. Congress typically appropriates only 1/4 of the administration fund to OPM and the balance per Section 8909 is deposited into the FEHB plan contingency reserves based on enrollment. It appears to the FEHBlog that this new law has given OPM the authority to tap into that surplus that otherwise would have been available to the FEHBP carriers. This is not the only such trust fund available to OPM.

The Wall Street Journal and the Hill report that the House Speaker Nancy Pelosi and the Secretary of the Treasury Steven Mnuchin will continue to discuss a compromise fourth COVID-19 relief bill tomorrow. The two leaders met today for 90 minutes and they hope for more progress tomorrow.

On the COVID-19 front —

  • The U.S. National Science Foundation discusses how it has been funding small businesses in the fight to control COVID-19. “Startups nationwide responded with creativity and a diversity of experiences to create innovative technology solutions in the COVID-19 crisis,” said Andrea Belz, director for the Division of Industrial Innovation and Partnerships. “NSF-funded solutions have the potential to make a significant impact in the fight against COVID and future pandemic threats.” That’s encouraging.
  • Forbes reports on a deal between startup tech company doc.ai and major health and Blue Cross licensee Anthem. “One of the products that Anthem is offering its members through doc.ai is called Passport, which helps employees safely return to in-person work during the Covid-19 pandemic. An employer decides on the parameters and each morning the employee answers a self-assessment that determines whether or not the app generates a unique barcode to enter the office building. But the key here is that the protected health information is never sent to the employer—it stays on the employee’s phone—and all the employer sees is whether the QR code was issued. De Brouwer likens it to “soft contact tracing,” where privacy comes first. The data is never uploaded to a server, but stays on the mobile device.” Also encouraging
  • In not so encouraging but understandable news, MedPage Today reports that “Overall frequency of alcohol consumption among adults ages 30-80 increased 14% versus 2019, with increases of 17% for women, reported Michael Pollard, PhD, of RAND Corporation in Santa Monica, California, which administers the survey, and colleagues. * * * ‘Health systems may need to educate consumers through print or online media about increased alcohol use during the pandemic and identify factors associated with susceptibility and resilience to the impacts of COVID-19,’ Pollard and co-authors wrote.”

On the healthcare fraud front, the HHS Inspector General announced today

The Department of Health and Human Services (“HHS”) Office of Inspector General, along with our state and federal law enforcement partners, participated in a health care fraud takedown in September 2020. More than 345 defendants in 51 judicial districts were charged with participating in health care fraud schemes involving more than $6 billion in alleged losses to federal health care programs. Since 2016, HHS-OIG has seen a significant increase in “telefraud”: scams that leverage aggressive marketing and so-called telehealth services. The conspirators include telemedicine company executives, medical practitioners, marketers, and business owners who scammed hundreds of thousands of unsuspecting patients in their homes.

Wow.

In miscellaneous news —

  • HHS created a Hospital Price Transparency website today three months before the final rule takes effect on January 1, 2021.
  • HHS also announced today “five cooperative agreements to health information exchange organizations (HIEs) to help support state and local public health agencies in their efforts to respond to public health emergencies, including disasters and pandemics such as COVID-19.” These HIEs provide a vital framework for sharing health information.
  • “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) have released a joint Ransomware Guide that details practices that organizations should continuously engage in to help manage the risk posed by ransomware and other cyber threats. The in-depth guide provides actionable best practices for ransomware prevention as well as a ransomware response checklist that can serve as a ransomware-specific addendum to organization cyber incident response plans.” Check it out.
  • Health Payer Intelligence helpfully reports on a surprise billing study published in the American Journal of Managed Care which finds that

More than 10% of health plan spending is attributable to ancillary and emergency services that commonly surprise-bill. Reducing payment for these services by 15% would reduce premiums by 1.6% ($67 per member per year), and reducing average payment to 150% of traditional Medicare rates—the high end of payments to other specialists—would reduce premiums by 5.1% ($212 per member per year). These savings would reduce aggregate premiums for the nation’s commercially insured population by approximately $12 billion and $38 billion, respectively.

The study is based on claims data from major health insurers housed in the Healthcare Cost Institute.