Monday, January 26, 2009

Legislative Bulletin: Health Provisions of H.R. 1, American Recovery and Reinvestment Act

Order of Business: During the week of January 26, 2009, the House is expected to consider H.R. 1 under a likely structured rule. The legislation was introduced by Rep. Dave Obey (D-WI) on January 26, 2009. The bill was referred to the House Committees on Appropriations and Budget, but was never considered; however, the House Energy and Commerce Committee and other relevant committees marked up provisions within their jurisdiction the week of January 19, 2009.

Summary of Health Provisions: The legislation contains several sections of major health care provisions, including expansions of health care subsidies for the unemployed, a bailout of state Medicaid programs, and new spending on health information technology. Provisions of these titles include:

Health Provisions Affecting Unemployed Workers

Temporary COBRA Premium Subsidy: Provisions of the Consolidated Omnibus Reconciliation Act of 1985 (COBRA) provide for separated employees and their dependents to remain on their previous employer’s group policy for 18 months, or up to 36 months in some cases. Employers are permitted to charge former workers electing COBRA coverage the full cost of their group insurance premiums, plus a 2% fee to cover administrative costs.

The bill would provide a 65% premium subsidy to employers to cover the costs of individuals electing COBRA coverage, provided such election comes as a result of the individual’s involuntarily termination from employment during the period from September 1, 2008 to December 31, 2009. The subsidy would continue for a maximum of 12 months, but would terminate once the individual becomes eligible for other employer-based coverage or Medicare.

The bill re-opens the COBRA election period for certain individuals, who had previously declined COBRA coverage, to allow them to accept continuation coverage in light of the new federal subsidy. Any pre-existing condition exclusions as a result of the temporary lapse in coverage would be waived if the former employee chooses to accept the COBRA coverage with the new federal subsidy. The bill imposes various notification requirements on employers to inform their separated workers about the COBRA subsidy program.

The bill includes a 110% penalty for individuals who lose eligibility for the COBRA premium subsidy (due to eligibility for other group coverage), but fail to report their changed status. However, because the reporting mechanism for individuals to report their changed status lacks transparency (i.e. employers may not know their former employees have obtained another job, or whether that job includes an offer of group health insurance), some Members may be concerned that the premium subsidy program could be ripe for abuse by individuals who could obtain a “better deal” by remaining on the COBRA subsidy.

According to the Joint Committee on Taxation (JCT), this provision would cost the federal government $28.7 billion in reduced revenue over five and ten years, as the subsidy would be paid to employers in the form of a reduction or rebate of taxes (both income and payroll) withheld. JCT estimates that 7 million individuals would receive COBRA subsidies at some point during calendar year 2009.

Permanent COBRA Expansion: The bill also includes a permanent expansion of COBRA in the case of “older or long-term employees.” Specifically, the bill would permit former employees over age 55, or those with at least 10 years of service with the employer, to remain on COBRA until becoming eligible for Medicare. These provisions are similar to language inserted by the House Rules Committee into H.R. 3920, the Trade Adjustment Assistance (TAA) Reauthorization Act, which passed the House by a by a 264-157 vote on October 31, 2007, but was never considered by the Senate.

Particularly as a 2006 study found that employers’ costs for administering the COBRA plan are already double the 2% maximum administrative fee permitted under the statute, some Members may be concerned that permitting former employees to remain on COBRA for decades could result in even higher administrative costs for firms due to the expanded requirements of the unfunded federal mandate.

Because the COBRA statute requires former employees to pay the full cost of their group health insurance, the individuals most likely to elect continuation coverage would be those for whom the coverage has value despite its high cost—i.e. those with significant expected medical expenses. Consistent with this premise, the 2006 employer study also found that workers electing COBRA coverage had overall health costs 45% greater than the active workers employed by the reporting firms. Some Members may be concerned that allowing workers to retain COBRA coverage would further exacerbate these adverse selection concerns, raising costs for all the participants in the group plan and potentially encouraging some employers to drop coverage altogether rather than absorbing these higher costs.

Medicaid Coverage for Unemployed: The bill provides a state option to cover unemployed workers through their Medicaid programs—with the federal government paying 100% of the cost of such coverage. Eligible individuals would include:

  • Individuals currently receiving unemployment compensation;
  • Individuals formerly receiving unemployment compensation whose benefits were exhausted after July 1, 2008;
  • Individuals who were involuntarily separated from employment between September 2008 and January 2011, whose gross family income remains below 200% of the federal poverty level (FPL, $42,400 for a family of four in 2008);
  • Individuals are eligible for food stamp assistance; and
  • Spouses and dependent children under age 19 of the individuals listed above.

The bill states that (except for the income-based criteria for the third group listed above) “no income or resources test shall be applied with respect to” any of the eligible groups. Some Members may be concerned that this provision would therefore allow fired CEOs formerly making millions of dollars in compensation to obtain free health care benefits from the federal government.

The bill makes eligible for Medicaid assistance all individuals in the groups listed above who are “not otherwise covered under creditable coverage.” Some Members may be concerned that because the bill language prohibits participation in the program only for individuals actually covered by another policy—as opposed to all those eligible for other coverage, as with the COBRA premium subsidy listed above—the bill provides eligible individuals with a perverse incentive to remain on federal health insurance rolls and obtain free health insurance, rather than switch to a group plan where higher premiums and co-pays likely would apply.

According to the Congressional Budget Office (CBO), the temporary Medicaid coverage provision would cost $10.8 billion over five and ten years. CBO estimates that in 2009, 1.2 million individuals (including spouses and children) would obtain health care coverage through this provision.

As noted above, the bill provides a 100% subsidy to states for Medicaid coverage of eligible individuals through January 1, 2011. Some Members may be concerned that having the federal government pay for the entire cost of covering unemployed individuals through Medicaid provides no incentive for states to police fraud and abuse of the program by these populations. Moreover, because the bill does not sunset the program to cover unemployed workers, only the 100% federal match, some Members may be concerned about the implications of a significant expansion of government’s role in providing health care under the guise of a “temporary” stimulus provision.

Health Care Aid to the States

Increase in Federal Medicaid Match: The federal share of spending on states’ Medicaid programs is determined through the Federal Medical Assistance Percentage (FMAP). Based on a formula that compares a state’s per capita income to per capita income nationwide—a mechanism designed to gauge a state’s relative wealth—the FMAP can range from a low of 50% to a maximum of 83%.

The bill would provide an across-the-board FMAP increase of 4.9% for a total of nine calendar quarters—from October 1, 2008 through December 31, 2010. The bill also includes language providing that no state’s FMAP percentage (exclusive of the 4.9% increase) shall decline during the nine calendar quarter period. Both the scope and the length of the FMAP increase exceed the 2.95% increase in the federal match rate for five fiscal quarters passed to help states during the last economic downturn as part of tax and budget reconciliation legislation (P.L. 108-27).

The bill includes further increases in the FMAP percentage for “high unemployment states,” which are defined by using a 3-month average unemployment rate. If, when compared to any prior 3-month period after January 1, 2006, unemployment in a state has increased 1.5%, the FMAP will be increased by 6%; if unemployment has increased 2.5%, the FMAP will be increased by 12%; and if unemployment has increased 3.5%, the FMAP will be increased by 14%. Once qualifying as having high unemployment, a state’s FMAP increases outlined above will remain until at least July 1, 2010, even if unemployment in that state falls prior to that date.

The bill includes “maintenance of effort” provisions such that states wishing to receive the FMAP increases may not impose more restrictive eligibility standards than those in effect on July 1, 2008 (unless the states retroactively remove such restrictions) and may not deposit any amounts “directly or indirectly” into a state’s rainy day fund or reserve account.

CBO scores the entire FMAP increase package as costing $87.7 billion over five and ten years.

Some Members may have concerns about this increase in FMAP funding, included but not limited to:

  • An increase in the federal Medicaid match by definition provides no “stimulus,” instead substituting federal expenditures for state spending.
  • The provisions as drafted could result in a FMAP rate for some states approaching 100%, meaning that the federal government would be paying nearly the full share of a state’s Medicaid expenses—a significant alteration of the traditional state-federal Medicaid partnership, and one which would give states a strong incentive to shift additional costs (whether directly health related or not) on to the federal government’s books.
  • An increase in the federal Medicaid match provides no incentive for states to reform their Medicaid programs to improve the quality of beneficiary care while reducing the growth in health costs—and by providing additional federal dollars, may provide states with a perverse incentive not to accelerate reform.
  • An FMAP increase will not halt states from expanding their Medicaid programs at an unsustainable rate, as evidenced by one study’s findings that state Medicaid expenditures during the economic “boom years” of 1994-2000 outpaced both state GDP growth and states’ revenue growth.
  • Increasing the federal Medicaid match does nothing to reform the flawed FMAP formula itself. The Congressional Budget Office in its December 2008 Budget Options report noted that the 50% minimum FMAP level results in nearly a dozen wealthy states receiving match rates significantly higher than they otherwise would have received; in one case, a state’s FMAP level would be 12% absent the statutory minimum percentage. Members may therefore be concerned that increasing the federal Medicaid match would not reform a system where studies have indicated that wealthier states spend more on Medicaid than poorer ones—exactly the opposite of FMAP’s intended goal.

Moratoria on Anti-Fraud Regulations: The bill would extend by three months—from April 1, 2009 to July 1, 2009—moratoria on the Centers for Medicare and Medicaid Services (CMS) from issuing six Medicaid regulations designed to bolster the fiscal integrity of the program. The regulations cover intergovernmental transfers, graduate medical education, school-based administrative and transportation services, rehabilitation services, targeted case management, and provider taxes. In addition, the bill extends the moratoria to cover a seventh regulation, relating to the definition of outpatient hospital services. Under a previous agreement between President Bush and Congressional Democrats negotiated in relation to the 2008 wartime supplemental appropriations act (P.L. 110-252), six of the proposed regulations were to be placed under the moratoria, while the outpatient hospital services regulation was to be implemented in full; this provision attempts to undo that agreement. CBO scores these moratoria as costing $200 million over five and ten years.

Some Members may be concerned by attempts to repeal regulations that respond to various state abuses within the Medicaid program that have been documented by the Government Accountability Office (GAO) in reports dating back well over a decade. Some Members may also note that even the liberal Center for Budget and Policy Priorities has published a report noting that several of the abuses—specifically, intergovernmental transfers and provider taxes, which constitute the majority of the projected $42 billion in 10-year taxpayer savings associated with the regulations—are often “designed primarily to provide a windfall for state governments.” Therefore, some Members may agree with the need to restore the Medicaid program’s fiscal integrity, and be concerned by Democrats’ frequent attempts—including the third extension of these “temporary” moratoria—to undermine regulations that would affect less than 1% of the total Medicaid spending of nearly $5 trillion over the next decade.

Transitional Medical Assistance: The bill extends for 18 months—through December 31, 2010—the Transitional Medical Assistance (TMA) program that provides Medicaid benefits for low-income families transitioning from welfare to work. Traditionally, the TMA provisions have been coupled with an extension of Title V abstinence education funding during the passage of health care bills. However, the Title V funds were excluded from the bill language, and will expire on July 1, 2009 absent further action. CBO scores the TMA extension as costing $1.3 billion over five and ten years.

Particularly given the Obama Administration’s desire for bipartisan agreement on economic stimulus provisions, some Members may be concerned at the removal of the Title V abstinence education funding and the potential end of this worthwhile program. Some Members may also question whether an extension of TMA funding—which has been included in Medicare and related health bills for several years—constitutes economic “stimulus,” or instead represents additional domestic spending that Democrats simply do not wish to pay for under regular order.

Family Planning Services: The bill includes several provisions related to family planning services. Specifically, the bill would amend the definition of a “benchmark state Medicaid plan” to require family planning services for individuals with incomes up to the highest Medicaid income threshold in each state. The bill also permits states to establish “presumptive eligibility” programs for family planning services, which would allow Medicaid-eligible entities—including Planned Parenthood clinics—to enroll individuals in family planning services and “medical diagnosis and treatment services” connected with a family planning service, subject to a later determination of eligibility. CBO scores this provision as costing $200 million over five years, and $700 million over ten.

Some Members may be concerned that these changes would, by altering the definition of a benchmark plan, undermine the flexibility that Republicans established in the Deficit Reduction Act to allow states to determine the design of their Medicaid plans, and would expand the federal government’s role in financing family planning services. Some Members may also be concerned that the presumptive eligibility provisions would enable wealthy individuals to obtain free family planning services—and potentially other health care benefits—financed by the federal government, based on a certification by Planned Parenthood or other clinics. Lastly, some Members may question the “stimulus” behind this family planning expansion, the effects of which on economic growth and recovery would be minimal at best.

Other Provisions: The bill also includes provisions prohibiting Medicaid cost-sharing for Indians receiving care through the Indian Health Service, and related provisions regarding Indians’ eligibility for Medicaid. Some Members may question whether and how these provisions constitute necessary economic stimulus.

The bill includes a 2.5% increase in Medicaid Disproportionate Share Hospital (DSH) payments for those hospitals treating a large percentage of low-income individuals. The increase covers Fiscal Years 2009 and 2010, and sunsets thereafter.

Health Information Technology

The bill contains language amending the Public Health Service Act and the Social Security Act designed to accelerate the adoption of health information technology, including the following:

Federal Office and Standards: The bill codifies the Office of the National Coordinator for Health Information Technology (ONCHIT) within the Department of Health and Human Services (HHS), which had previously been established by Executive Order. The Coordinator will be charged with updating the federal government’s health IT strategic plan and developing a program for voluntary certification of health information technology, among other duties.

The bill establishes a Policy Committee and a Standards Committee to make recommendations to the Coordinator on national strategy and health IT standards. The Policy Committee will determine which areas require federal standards and certification criteria, and the Standards Committee will recommend to the Coordinator specific standards and criteria in the areas highlighted by the Policy Committee. The National Institute for Standards and Technology (NIST) will assist the standards committee in testing implementation specifications to ensure their appropriate use, and develop a program of grants to institutions of higher education to establish multidisciplinary centers for health care information integration.

The bill provides the Department with a 90-day window to adopt or reject the standards proposed by the Standards Committee, and requires the Department to establish an initial set of standards and certification criteria by December 31, 2009. The bill also requires federal agencies and federal contractors to utilize information technology systems and standards consistent with those promulgated by the Department. The bill authorizes $250 million in appropriations for ONCHIT for Fiscal Year 2009.

The bill requires the Coordinator to “support the development, routine updating, and provision” of electronic health record technology, “unless the Secretary determines that the needs and demands of providers are being substantially and adequately met through the marketplace,” and permits the Coordinator to “impose a nominal fee” for providers choosing to use systems so developed. Some Members may be concerned that this provision may permit undue intervention by the federal government in the marketplace for health information technology.

Grant and Loan Funding: The bill would establish new programs designed to fund the implementation of health information technology, and authorizes such sums as may be necessary to carry out the programs for Fiscal Years 2009 through 2013. The bill would require the Department to “invest in the infrastructure necessary” to promote health IT nationwide, including IT architecture, electronic health records, training on best practices, and interoperability, including $300 million for regional efforts to support health information exchange.

The bill creates a Health Information Technology Research Center to provide technical assistance and develop best practices on IT adoption and utilization, as well as additional regional centers affiliated with non-profit organizations that would receive financial assistance from the federal government for up to four years to supplement the national efforts. The bill provides that federal financial support may not exceed 50% of any applying organization’s annual budget, except under certain circumstances.

The bill establishes a grant program for states and other state-designated non-profit entities to “facilitate and expand the electronic movement” of health records, subject to state matching contributions of no more than $1 for every $3 in federal funding. The bill creates another grant program for states or Indian tribes to loan money to providers for adoption of, or training for the use of, electronic health records, and requires that entities receiving grants under this program contribute at least $1 for every $5 in federal funding. Finally, the bill creates two grant programs—one for schools of medicine, the other for institutions of higher education—to develop curricula that integrate electronic health records into clinical training and education, subject to a match by the schools of at least 50%.

Some Members may be concerned that the spending authorized by these various grant and loan programs, coupled with the matching requirements that will result in the federal government shouldering half (and in several cases more than half) the financial cost of projects, will increase the federal deficit to support projects that may hold marginal value. Given the speed with which the private sector has adopted information technology in other industries, some Members may question the need for an intrusive and costly federal role in health IT over and above the establishment of nationwide standards.

Medicare Payments: The bill establishes a system of incentives and penalties related to Medicare reimbursement for providers to encourage the adoption of electronic health records. For physicians not working in a hospital setting, the bill provides for a bonus payment of 75% of Medicare billed claims, subject to total limitations of $41,000, paid out over five years. Incentives will begin in 2011, will be reduced for providers adopting health IT beginning after 2013, and will be eliminated entirely after 2015. The bill makes eligible for bonus payments all physicians receiving Medicare reimbursement, including physicians participating in Medicare Advantage Health Maintenance Organizations.

The bill requires that providers receiving incentives be “meaningful users” of electronic health records, based on a self-attestation by the provider and reporting any various clinical quality measures the Secretary may require, but includes no requirement that such meaningful users bill claims to Medicare on a regular basis. Payment incentives will not be taken into account when calculating the sustainable growth rate (SGR) for Medicare physician payment reimbursement, and limits judicial review of the Secretary’s decisions regarding the enhanced payments.

The bill provides for reductions for non-adopters of health information technology, beginning with a 1% fee reduction in 2016, and continuing with a 2% reduction in 2017, a 3% reduction in 2018, and reductions of up to 5% 2019 and subsequent years. The Secretary may grant limited exceptions from the Medicare penalties for up to five years.

For hospitals (including those affiliated with Medicare Advantage Health Maintenance Organizations), the bill provides a base incentive payment of $2 million for health IT adoption, coupled with a per-discharge payment of $200. Incentive payments (base and per-patient discharge) may total up to $6.37 million per hospital for the first year. (Note that this is an increase of nearly 50% in the maximum per-hospital payment from the originally introduced package.) Payments will be adjusted based on the percentage of Medicare patients treated by the hospital, and phased out entirely over four years, such that the maximum payment a hospital could receive would total more than $15.9 million. Payments would begin in Fiscal Year 2011, but that hospitals who fail to convert to electronic health records by 2016 shall not be eligible for the bonus payments.

The bill further provides for adjustments to the annual “market-basket” hospital update, beginning in 2016. Hospitals who do not adopt electronic health records will see their payments reduced by 0.5% in 2016, 1% in 2017, and 1.5% in 2018 and subsequent years, unless the Secretary grants a limited five-year exception.

The bill provides that the bonus payments outlined above shall not be taken into account when calculating beneficiaries’ premiums under Medicare Parts A and B.

The bill amends the Medicare Improvement Fund to shift funds from Fiscal Years 2016-2018 into Fiscal Years 2014 and 2015. While the Congressional Budget Office has written that this provision is budget-neutral, some Members may consider this timing shift a budgetary gimmick designed primarily to make future legislation compliant with five year PAYGO requirements under House rules. Some Members may therefore question this provision’s relevance in a measure designed to spur economic growth and recovery.

The bill authorizes and appropriates a total of $540 million—$60 million for each of Fiscal Years 2009 through 2015, and $30 million per year from 2016 through 2019—to allow the Centers for Medicare and Medicaid Services (CMS) to implement the IT incentive provisions. Some Members may be concerned that the nearly $1 billion in direct spending given to CMS to implement the Medicare and Medicaid provisions of the health IT title may “stimulate” nothing more than the growth of federal bureaucracy.

Some Members may believe that the size and scope of spending contemplated—up to $41,000 for every eligible physician, including practitioners who bill Medicare infrequently, such as chiropractors, and as much as $10.9 million per hospital—represent an inefficient use of government spending, particularly given widespread IT adoption in other industries without such heavy government subsidies. The Congressional Budget Office projects that passage of the bill’s provisions will increase implementation of health IT by only 25%—from the 65% rate of physician adoption in 2019 under current law to 90%, and has stated that it “anticipates near-universal adoption of health IT within the next quarter-century even without legislative action.” Some Members may therefore find the expenditure of $30 billion to achieve this marginal improvement in health IT adoption inefficient, particularly as it would not target subsidies to those providers who otherwise would not have adopted electronic health records.

Some Members may also be concerned that the bill provisions, by including various “carrots and sticks” related to health IT adoption by providers, would further increase the federal government’s role in patient-provider relations, and could encourage providers nearing retirement age to abandon their practices entirely rather than comply with the bill’s requirements. Lastly, some Members may believe that tying the physician payment bonus to the level of billed claims, coupled with the current fee-for-service model of reimbursement, may encourage providers only to increase the amount and intensity of services billed in order to raise their reimbursement levels, resulting in high and inefficient levels of government spending.

Medicaid Funding: The bill includes provides for a 100% federal FMAP match for certain Medicaid providers related to electronic health records technology, and a 90% match for administrative expenses associated with. In order to qualify for the enhanced federal match, providers’ Medicaid patients must exceed 30% of their overall patient load; children’s hospitals, acute care hospitals with at least a 10% Medicaid patient load, and federally qualified health centers with a 30% or greater Medicaid patient load will also qualify for the Medicaid payments. Payments under these provisions may not exceed a total of $75,000—$25,000 for the purchase of electronic health record technology, and up to $10,000 per year for five years for operation and maintenance. Providers receiving Medicaid funds would have to pay 15% of the cost of any electronic health records technology they acquire.

The bill provides that incentives under the Medicaid formula shall not exceed those provided under the Medicare formula established above, except that a provider’s Medicaid patient load may be substituted for its Medicare patient load in determining a higher payment level. However, in order to receive Medicaid funding, providers must decline to accept the Medicare health IT bonus payments discussed above.

The bill authorizes and appropriates a total of $360 million—$40 million for each of Fiscal Years 2009 through 2015, and $20 million per year from 2016 through 2019—to allow CMS to implement the Medicaid incentive provisions. Some Members may be concerned that the nearly $1 billion in direct spending given to CMS to implement the Medicare and Medicaid provisions of the health IT title may “stimulate” nothing more than the growth of federal bureaucracy.

CBO estimates that both the Medicare and Medicaid bonus payments will total $30 billion over ten years—$17.7 billion for Medicare and $12.4 billion for Medicaid—along with $900 million in mandatory administrative funding for CMS. However, CBO estimates that increased IT adoption will yield baseline savings in Medicare, Medicaid, and the Federal Employee Health Benefits Program (FEHBP) totaling $12.3 billion over ten years. CBO also estimates that revenues will increase under the health IT provisions, as slightly lower health costs will result in individuals excluding slightly less of their salaries from payroll and income taxes through the exclusion for employer-provided health insurance. Thus CBO scores the net cost of the Medicare and Medicaid bonus payment provisions as $17.1 billion over ten years.

Privacy: The bill extends the privacy and security provisions included in the Health Insurance Portability and Accountability Act (HIPAA, P.L. 104-191), as well as the civil and criminal penalties established in such legislation, from “covered entities”—health plans and other providers who transmit electronic health information—to the “business associates” of those entities. In general, the Privacy Rule requires covered entities to obtain consent for the disclosure of protected health information—defined as health information that identifies the individual, or can reasonably be expected to identify the individual—except when related to “treatment, payment, or health care operations.”[1] The regulations include several exceptions to the pre-disclosure consent requirement, including public health surveillance, activities related to law enforcement, scientific research, and serious threats to health and safety.[2] The HIPAA Security Rule requires covered entities and their business associates to safeguard protected health information held electronically, including administrative, physical, and technical safeguards that covered entities must follow.[3] Some Members may be concerned about the expansion of the full HIPAA privacy and security requirements to business associates, particularly given the additional unfunded mandates placed on businesses elsewhere in the bill.

In general, the bill includes four general categories of privacy provisions:

  1. Breach Notification: The bill requires covered entities holding unsecured personal health information to “notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been” disclosed as a result of an information breach within 60 days, and requires business associates of covered entities to notify those entities as a result of a breach of unsecured information. Notification is not linked to a security threat assessment—in other words, the same notification must occur in all instances, regardless of whether the potential for harm is significant or minimal. In cases where more than 500 individuals are believe to have been affected, notice must be provided to appropriate media outlets—a requirement which, coupled with the blanket notification provisions outlined above, some Members may consider unreasonable, costly to businesses, and likely to cause undue public alarm or confusion.

The bill places the burden of proof on the covered entity or business associate to demonstrate that required notifications were made; some Members may be concerned by such a burden of proof lying with the business entity. The bill also creates an education initiative within HHS to advise businesses and the public on their health privacy rights and responsibilities.

The bill establishes a temporary breach notification process for vendors of personal health records and other firms not classified as HIPAA covered entities. Entities must notify “each individual,” as well as the Federal Trade Commission (FTC), when information that does not meet security standards approved by the Secretary is breached; third party vendors must notify the entity to whom they provide their services. Failure to notify will be classified as a “unfair and deceptive act or practice” under the Federal Trade Commission Act for purposes of enforcement. The provision will expire when either HHS or the FTC publish standards for entities that are not covered entities to report data breaches. Some Members may be concerned that the bill would impose onerous penalties on entities, particularly as the bill language contains no link between a threat of harm and required notification.

  1. Disclosure: The bill places new restrictions on disclosures of health information related to insurance payment if an individual so requests that the covered entity (in this case, an insurance carrier) not disclose information and instead pays for the service out-of-pocket and in full. The bill requires that entities disclose the minimum amount of personally identifiable information necessary “to accomplish the intended purpose of such disclosure,” and requires entities to compile—and make available to individuals—an accounting of disclosures made with respect to protected information in an electronic health record. Some Members may be concerned that the ongoing compilation of disclosures (as opposed to providing them solely upon an individual’s request) constitutes a burdensome requirement on business, and also note that, because the disclosure requirements apply solely to those entities using electronic health records, this provision could actually discourage entities from adopting health IT.
  2. Operations and Marketing: The bill prohibits the sale of protected health information by entities and business associates without individuals’ express consent to allow entities to sell such information. Certain exceptions to this general prohibition would remain, including treatment of the individual or public health research where the price charged reflects the costs of transmitting the relevant data and ongoing business relationships between a covered entity and business associates. The bill also prohibits the use of personal health information for fundraising, or for paid marketing purposes without an individual’s express written consent, and instructs HHS to compile a list of health care activities “that can reasonably and efficiently be conducted through the use of information that is de-identified,” and remove these activities from the list of health care operations exempt from the HIPAA privacy rule. Some Members may be concerned that these provisions would hinder the ability of covered entities to provide information to individuals about products and services—for instance, cheaper generic drugs or affinity discounts at health clubs—that may be of value to them.
  3. Enforcement and Penalties: The bill includes privacy enforcement provisions, including a clarification that individuals who obtain personal health information from a covered entity, and then discloses said information, will be subject to current law civil and criminal penalties under the HIPAA statute. The bill also creates penalties for non-compliance due to willful neglect, “for which the Secretary is required to impose a penalty.” Penalties obtained due to a general failure to comply with requirements and standards will be transferred to HHS’ Office of Civil Rights for the purposes of enhanced enforcement, except that a certain percentage of penalties may be paid to individuals harmed by the offenses in question—a provision which some Members may view as providing monetary incentives for individuals to join class action lawsuits related to HIPAA non-compliance.

The bill establishes new higher, tiered penalties for failure to comply with HIPAA requirements, up to a maximum of $50,000 per violation, and $1,500,000 per year, due to willful neglect that is not corrected. Current law provides for penalties of up to $100 per violation and $25,000 per year. Some Members may be concerned that this 6000% increase in maximum fines for business could have a chilling effect on applicable entities, potentially lessening health IT adoption.

The bill would permit state attorneys general to bring action against companies “in any case in which the attorney general…has reason to believe that an interest of one or more residents of that state has been or is threatened or adversely affected by any person.” Attorneys general may file actions “in a district court of the United States of appropriate jurisdiction” seeking either an injunction or civil penalties for a general failure to comply with standards. State attorneys general must first notify the Secretary of intent to file such action, and may not bring actions against relevant persons if and when the Secretary has a separate action pending. Some Members may be concerned that these provisions, particularly when coupled with the provisions permitting affected individuals to receive a portion of penalties awarded, could lead to a proliferation of lawsuits against applicable individuals and entities for real or perceived security violations, which could discourage the adoption of health information technology that the bill is intended to promote.

The bill maintains current law pre-emption provisions with respect to the HIPAA statute, and includes various study and reporting requirements, including an FTC study on the implications of extending HIPAA’s privacy and security requirements to entities that are not covered entities or business associates under current law. The bill also provides a general exemption for pharmacists to communicate with their patients to improve patient safety and reduce medical errors, provided the pharmacists accepts no additional remuneration (over and above the amount paid for relevant prescriptions).

Other Medicare Provisions: The bill places a one-year moratorium on CMS’ introduction of a wage adjustment related to hospice reimbursement, and halts for one year a phase-out of capital costs paid to certain teaching hospitals in the form of a capital indirect medical education (IME) payment. Some Members may believe that these provisions have little to do with promoting economic recovery and therefore do not belong in a “stimulus” measure.

Lastly, the bill makes certain “technical corrections” regarding long-term care hospitals, specifically as it relates to implementation of a rule for referrals from non co-located facilities. According to CMS, at least one of these “corrections” will affect only three hospitals—two located in North Dakota, and one located in Connecticut. Some Members may believe this provision constitutes an authorizing earmark, and therefore believe its inclusion is inconsistent with President Obama’s pledge that economic recovery legislation should not include any “pork-barrel” spending.

 

[1] Definitions of protected health information and individually identifiable health information can be found at 45 C.F.R. 160.103; permitted use for “treatment, payment, or health care operations” can be found at 45 C.F.R. 164.506.

[2] The full list can be found at 45 C.F.R. 164.512.

[3] The safeguards are found at 45 C.F.R. 164.308, 164.310, and 164.312, respectively.