For more information about this blog post, please contact Khaled J. Klele, Ryan M. Magee, Labinot Alexander Berlajolli, or Daniel J. Parziale.

HHS Proposes Changes to HIPAA/HITECH Privacy Rule

The United States Department of Health and Human Services (“HHS”) issued its Notice of Proposed Rule Making (“Proposed Rule”) to modify the Standards for the Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”). The modifications proposed by HHS address standards that it believes may impede the transition to value-based healthcare by limiting or discouraging care coordination and case management communications among individuals and covered entities (including hospitals, physicians, and other healthcare providers, payors, and insurers) or posing other unnecessary burdens.

The proposed rule would achieve this by first clarifying that individuals’ right to inspect their Protected Heath Information (“PHI”) includes the right to view, take notes or photographs, and use other personal resources to capture their PHI free of charge, except that covered entities need not allow individuals to connect personal devices to electronic information systems and may impose safeguards to ensure that individuals see only their own PHI. Second, the Proposed Rule provides that although covered entities may require individuals to submit written access requests electronically or on paper, they may not impose measures that unreasonably impede access.  Third, the Proposed Rule provides that an individual’s right to direct transmission of PHI to a third party would apply only to electronic health records (“EHRs”) maintained by covered healthcare providers; it would not apply to other types of PHI or to health plans.  Health plan participants could, however, instruct their health plan to request EHRs from covered healthcare providers, which would then be required to disclose the requested EHRs directly to the plan.  Finally, the Proposed Rule requires that a covered entity, which charges for copies of PHI, has to post a fee schedule on its website and make the schedule available at the point of service and upon request. The schedule would need to specify (i) types of access available free of charge and (ii) standard fees in other situations.  Individualized fee estimates would have to be provided upon request, as would an itemized list of billed charges.

Comments on the proposed rule are open until March 22, 2021.

OCR Announces Relaxation of the Imposition of Penalties Related to Privacy Issues Involving Web‑Based Scheduling Applications

The Office for Civil Rights (“OCR”) at HHS recently announced that it will exercise its enforcement discretion and will not impose penalties for violations of the HIPAA Rules on covered healthcare providers or their business associates in connection with the good faith use of online or web‑based scheduling applications (collectively, “WBSAs”) for the scheduling of individual appointments for COVID‑19 vaccinations during the COVID‑19 nationwide public health emergency. The announcement has a retroactive effect back to December 11, 2020.

HHS Releases New Guidance to Improve Access to Medication‑Assisted Treatment of Opioid Use Disorder

HHS has released new practice guidelines that eliminate the requirement that physicians obtain a federal waiver to prescribe buprenorphine, commonly known as suboxone, a medication traditionally used to treat opioid use disorders.  In the past, HHS required physicians to complete an eight‑hour course before receiving a license, called an “X‑waiver,” to prescribe.

However, under these new guidelines, doctors who possess a Drug Enforcement Administration registration and exercise this exemption will be limited to treating no more than 30 in‑state patients with buprenorphine for addiction treatment at any one time. Nurse practitioners or physician assistants will still need to apply for separate waivers to prescribe buprenorphine.

The new practice guidelines can be found here.

CMS Issues Final Rule on Transparency for Out-of-Pocket Costs for Prescription Drugs

CMS issued a final rule, 86 FR 5864, which revises the regulations for the Medicare Advantage (Part C) program, Medicare Prescription Drug Benefit (Part D) program, Medicaid program, Medicare Cost Plan program, and Programs of All‑Inclusive Care for the Elderly (“PACE”) to improve transparency with regard to out‑of‑pocket costs for prescription drugs for seniors.

Among other things, effective January 1, 2023, the final rule requires Part D plans to offer a real‑time benefit comparison tool to allow enrollees to know the out‑of‑pocket costs for prescription drugs in advance and compare those prescription drugs with potential lower cost alternatives. The rule also allows Part D plans to have a second “preferred” specialty tier with a lower cost sharing level than their other specialty tier. This change gives Part D plans more tools to negotiate better deals with manufacturers on the highest‑cost drugs and lower out‑of‑pocket costs for enrollees in exchange for placing these products on the “preferred” specialty tier.