Tuesday Tidbits

HIPAA Privacy and Security Rules

Tuesday Tidbits

David Ermer–Congress, COVID-19, COVID-19 vaccine, Federal employment benefits, HIPAA Privacy and Security Rules, Medicare, U.S. Healthcare, Uncategorized–

Following up on last Friday’s and Sunday’s posts on the President’s executive orders on drug pricing, here for greater perspective is a link to a Fierce Healthcare article offering the positions of the health insurance and PBM industry trade associations’ positions on the orders. Essential Hospitals lets us know that the text of the fourth international pricing index executive order has not yet been made public.

The Wall Street Journal reports that “Eastman Kodak Co. has won a $765 million government loan under the Defense Production Act, the first of its kind. The purpose: to help expedite domestic production of drugs that can treat a variety of medical conditions and loosen the U.S. reliance on foreign sources. * * * Kodak’s loan has terms similar to a commercial loan and must be repaid over 25 years, [Kodak CEO Jim] Continenza said. He said Kodak will produce “starter materials” and “active pharmaceutical ingredients” used to produce generic medicines. “We have a long, long history in chemical and advanced materials—well over 100 years,” Mr. Continenza said. He added that Kodak’s existing infrastructure allows the company “to get up and running quickly.”

On the COVID-19 front —

  • Federal News Network informs us that

About 4,000 federal employees have filed workers’ compensation claims with the Labor Department due to COVID-19. 60 people have filed death claims. Labor projects COVID-19 claims among federal employees may reach 6,000 in the coming weeks. The department’s inspector general says the division that handles federal employee claims is anticipating a strain in resources due to demand and social distancing mandates. It has alternative staffing plans if COVID-19 compensation claims continue to surge. Labor says it’s accepted over 1,600 federal employees claims so far. Over 2,300 are unadjudicated.

  • The Society for Human Resource Management brings us up to date on the Senate majority’s new $1 trillion COVID-19 relief bill, the HEALS Act.
  • The Center for Medicare and Medicaid Services released “an early snapshot of the impact of the coronavirus disease 2019 (COVID-19) pandemic on the Medicare population. The data shows that older Americans and those with chronic health conditions are at the highest risk for COVID-19 and confirms long-understood disparities in health outcomes for racial and ethnic minority groups and among low-income populations.” A large cadre of the Medicare population of course is also enrolled in the FEHBP so this data is worth a gander.
  • The National Institutes of Health announced the successful results of a double blind study of the Moderna / NIAID COVID-19 vaccine on non-human primates / rhesus macaques. As noted yesterday that vaccine entered phase 3 human trials this week.

In other news —

  • Becker’s Hospital Review identifies the highest ranking hospital in each State as found in U.S. News and World Report.
  • NPR discusses two new studies suggesting that the risk of Alzheimer’s disease can be reduced by taking flu and pneumonia vaccines.
  • HHS’s Office for Civil Rights (“OCR”) which enforces the HIPAA Privacy and Security Rules announced that “Lifespan Health System Affiliated Covered Entity, a non-profit health system based in Rhode Island, has agreed to pay $1,040,000 to the OCR and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to the theft of an unencrypted laptop [thereby evidently allowing access to protected health information on over 20,000 patients in 2017].

Thursday Miscellany

David Ermer–COVID-19, HIPAA Privacy and Security Rules, U.S. Healthcare–

Modern Healthcare reports this evening that Health and Human Services (“HHS”) Secretary Alex Azar has signed a 90 day extension of the COVID-19 national health emergency. The current emergency period was otherwise set to expire on Saturday July 25. Modern Healthcare explains that

The renewal gives the healthcare industry certainty through the fall on several key policies to assist with the COVID-19 response. Some notable policies tied to the public health emergency are the 20% Medicare inpatient add-on payment for COVID-19 patients, increased federal Medicaid matching funds for states, a mandate that insurers cover medically necessary COVID-19 tests without cost-sharing, relaxed telehealth restrictions, and Section 1135 waivers that give providers additional flexibility to respond to COVID-19.

In other news,

  • Aetna is rolling out two new benefit design offerings for employer sponsored health plans per Fierce Healthcare.

The new designs, called Upfront Advantage and Flexible Five, offer members coverage for some preventive services before they meet their deductibles. In Upfront Advantage, members will have access to services worth up to $500 for an individual and $1,000 for a family for free before their deductible is met. In Flexible Five, members will instead be offered five coupons per person for these services; a family of four, for example, would receive 20 coupons that can be applied to services such as primary care visits, behavioral health visits, urgent care, lab tests or x-rays conducted during those visits and generic drugs.

  • Health Payer Intelligence informs us that Humana “has committed to mail out over a million preventive care packages that members can use in their homes. The in-home preventive care packages are designed to support chronic disease prevention for members with diabetes or colon cancer. Members can take the test in their homes to detect diabetes or colon cancer developments as early as possible.” That’s quite an investment.
  • HHS’s Office for Civil Rights announced a HIPAA Privacy Rule breach settlement with a North Carolina based healthcare provider today. It’s noteworthy that the settlement resolved issues that were touched off by a data breach in 2011.

Monday roundup

David Ermer–Congress, COVID-19, HIPAA Privacy and Security Rules, OPM, Rx coverage–

The Wall Street Journal seeks to answer a question that the FEHBlog has been pondering — “Scientists Hoped Summer Temperatures Would Tamp Down Covid-19 Cases. What Happened?” “There are three likely reasons, public-health and infectious-disease experts said. They have to do with the current [relatively low] levels of immunity in the population, how the virus is transmitted [by respiratory droplets] and how people behave [/fail to follow public health guidance].” Oh well.

The Hill reports that “The two main health insurance lobbying groups, America’s Health Insurance Plans (AHIP) and the Blue Cross Blue Shield Association, wrote a letter to congressional leaders on Friday making a [wide] range of requests for the next coronavirus response package, expected later this month.” Check it out.

HHS’s Substance Abuse and Mental Health Services Administration today finalized a revised 42 CFR Part 2 rule intended to better facilitate coordination of patient care. Part 2, which dates back to 1975, applies to substance use disorder patient records held by certain federally assisted health care providers. Here is a link to the FAQs on the final rule. The next time that SAMHSA revises this rule it will do so to align the rule with the generally applicable HIPAA Privacy Rule in accordance with the CARES Act. The statutory deadline for this action is March 27, 2021.

Fedsmith offers an article discussing whether federal annuitants with FEHB coverage also should elect to purchase Medicare Part prescription drug coverage. Here is OPM’s guidance:

Part D: There is a monthly premium for Part D coverage. Most Federal employees do not need to enroll in the Medicare drug program, since all Federal Employees Health Benefits Program plans will have prescription drug benefits that are at least equal to the standard Medicare prescription drug coverage. Still, you may want to be aware of the benefits Medicare is offering, so you can help others make informed decisions. If you have limited savings and a low income, you may be eligible for Medicare’s Low-Income Benefits. For people with limited income and resources, extra help in paying for a Medicare prescription drug plan is available. Information regarding this program is available through the Social Security Administration (SSA). For more information about this extra help, visit SSA online at www.ssa.gov, or call them at 1-800-772-1213 (TTY 1-800-325-0778).

Tuesday Tidbits

David Ermer–CDC, Congress, COVID-19 testing, HIPAA Privacy and Security Rules, OPM–

The Senate Health Education Labor and Pensions Committee held a hearing this morning on progress made in reopening schools and businesses from the great hunkering down. Fierce Healthcare reports on the hearing here.

The Department of Health and Human Services announced today the extension of “its partnership with national pharmacy and grocery retail chains CVS, Rite-Aid, Walgreens, Quest (through services at Walmart) and eTrueNorth (through services at Kroger, Health Mart, and Walmart) so they may continue to seamlessly provide Americans convenient access to COVID-19 testing. The partnership, which is part of the Community-Based Testing Program, has scaled up to more than 600 COVID-19 testing sites in 48 states and the District of Columbia. Approximately 70% of these testing sites are located in communities with moderate-to-high social vulnerability, as evidenced by their racial, and ethnic composition, and their housing, economic, language barrier, and similar considerations.” “The [partnership] contract utilizes a federal bundled payment program paid directly to retailers that receive a flat fee for each test administered, with participating retailers responsible for coordinating the full end-to-end testing.” So far the collaborative program has tested 750,000 Americans. That makes sense.

The Office of Management and Budget’s Office of Information and Regulatory Affairs issued its anxiously awaited Spring 2020 regulatory agenda. The regulatory agenda tells you what’s baking in each agency’s regulatory oven but you can rely on the oven timers’ shown in the reports. Here’s a link to OPM’s “rule list.” Nothing earth shaking to report.

The FEHBlog’s favorite healthcare quality consulting firm, Discern Health, notes the release of the National Health Quality Roadmap by the Department of Health and Human Services. “The National Health Quality Roadmap highlights not only many of the challenges that have been faced by health care stakeholders across the quality environment, but also a plan for addressing them,” Discern Health Vice President Donna Dugan said. “It will be important for stakeholders across the continuum to participate where possible in order to facilitate this transformation and aid in the realization of quality goals.”

Becker’s Hospital Review reports on a class action settlement of a phishing attack related lawsuit against UnityPoint Health which is based in Iowa. ‘The class action lawsuit alleges the health system didn’t notify [over 16,000] patients of the breach in a timely manner and told patients Social Security numbers weren’t compromised, but they were.’ The settlement is valued at $2.8 million.

For what it’s worth, Forbes reports an IRS announcement that that “the 2019 tax filing deadline remains July 15, 2020.” Forbes considers and the FEHBlog agrees that this will be the IRS’s final work on the topic. Also the Labor Department yesterday added q&a 93 to its list of frequently asked questions on the Families First Coronavirus Response Act’s paid leave program

Monday Roundup

David Ermer–COVID-19, HIPAA Privacy and Security Rules–

On the COVID-19 front

  • Researchers continue to make progress in developing a convalescent plasma treatment for COVID-19. Specifically, “Mayo Clinic researchers and collaborators have found investigational convalescent plasma to be safe following transfusion in a diverse group of 20,000 hospitalized patients transfused with investigational convalescent plasma as part of the U.S. Food and Drug Administration’s national Expanded Access Program (EAP) for COVID-19.” Testing continues on the efficacy of the treatment.
  • In view of the FEHBlog’s concern about super spreader events, he also calls attention to this Society for Human Resource Management article on thermal scanners. The scanners are an early warning device for use at “airports, sporting events, concerts or food-processing plants.” The particular article discusses the use of these devices by large and medium sized business.

For a change of pace, the FEHBlog takes note of these Wall Street Journal reports from the cybersecurity front

The health-care sector reported far less [cybersecurity] vulnerability than other areas. Health care is sometimes seen as one of the most targeted sectors. Yet, while 63% of construction and infrastructure companies admitted cybersecurity breaches on one or more occasions in the past 12 months, only 17% of health-care organizations said they had been compromised.

“We think the reduction is due to a combination of factors, including improvements in the cybersecurity posture of health-care organizations,” says Dave Wong, vice president with cyber-incident response provider Mandiant, a division of FireEye Inc., “but the behavior of attackers had also changed.”

In 2017, health care was the third-most-targeted sector, according to Mandiant’s annual threat report. By 2019, security improvements and evolution of the attackers’ tactics led to the sector dropping to eighth place. Cybercriminals follow the money, Mr. Wong says, and when fewer ransoms were being paid, they shifted their focus elsewhere. “Ransomware operators previously targeted hospitals knowing that the operational disruption could potentially cost patients’ lives,” he says. “Now, the same ransomware operators target larger companies with deeper pockets.”

  • and a list of five books “recommended by cybersecurity experts” that are accessible to all readers, just in time for the summer reading season. The FEHBlog plans to put at least one on his Kindle.

Thursday Miscellany

David Ermer–CDC, COVID-19, HIPAA Privacy and Security Rules, Medicare–

Earlier this month, the National Center for Health Statistics released a report on 2019 births in our country. Here are some notable snippets from that report:

  • The provisional number of births for the United States in 2019 was 3,745,540, down 1% from the number in 2018 (3,791,712). This is the fifth year that the number of births has declined after the increase in 2014, down an average of 1% per year, and the lowest number of births since 1985.
  • The birth rate for teenagers in 2019 was 16.6 births per 1,000 females aged 15–19, down 5% from 2018 (17.4), reaching another record low for this age group. The rate has declined by 60% since 2007 (41.5), the most recent period of continued decline, and 73% since 1991, the most recent peak.
  • The low-risk cesarean delivery rate, or cesarean delivery among nulliparous (first birth), term (37 or more completed weeks based on the obstetric estimate), singleton (one fetus), vertex (head-first) births, also decreased to 25.6% of births in 2019 from 25.9% in 2018.
  • The percentage of infants born preterm (births at less than 37 completed weeks of gestation) fell 8% from 2007 (the most recent year for which national data are available based on the obstetric estimate of gestation) to 2014, but has risen 7% from 2014 (9.57%) to 2019.

Healthcare Dive reports that

The number of Medicare beneficiaries using telehealth skyrocketed in the early weeks of the pandemic as the Trump administration relaxed regulations to virtual care.

The looser regulations are only in place for the extent of the national public health emergency, but myriad groups have called on HHS to permanently relax the barriers. Top administration health officials have said they’re exploring the possibility.

Here’s hoping.

Health IT Security informs us about Verizon’s latest data breach investigations report.

For healthcare, there were 798 security incidents and 521 confirmed data breaches in 2019, compared to 304 incidents in the previous year. While miscellaneous insider errors, privilege misuse, and web applications were the leading causes 2018 healthcare data breaches, external threats outpaced insiders in this year’s report.

In fact, 51 percent of healthcare data breaches were caused by external actors, and insider-related breaches fell to 48 percent. Despite the slight increase in external-related breaches, healthcare does remain the leading industry for internal bad actors.

It’s not always a good thing to be in first place.

Let’s wrap it up with a story about responsible corporate citizenship. Becker’s Hospital CFO Report informs us that

CMS automatically sent out the first slice of federal funding under the Coronavirus Aid, Relief and Economic Security Act based on historical Medicare fee-for-service reimbursement. Now, several companies are returning the relief aid.

[Healthcare companies] Cigna, CVS Health, DaVita, Encompass and Walmart are among the companies sending back federal grants they received under the CARES Act, which are meant to reimburse healthcare providers for expenses or lost revenues tied to the COVID-19 pandemic, according to Business Insider. The companies are returning a total of nearly $574 million.

The common reason for returning these large amounts of money was aptly stated by CVS Health:

“We have made the decision to return the funds and forgo participation in subsequent disbursements,” CVS Health President and CEO Larry Merlo wrote in a May 19 letter to HHS Secretary Alex Azar. “In doing so, we hope to help HHS provide additional support to other providers who are facing significant financial challenges as a result of the pandemic.”

Bravo.

Monday Roundup

David Ermer–COVID-19, COVID-19 testing, COVID-19 vaccine, HIPAA Privacy and Security Rules–

Fierce Biotech reports on today’s positive but not definitive results from Moderna’s early COVID-19 vaccine testing. “With eyes on a phase 3 study this summer, Moderna posted promising early data for its COVID-19 vaccine. The jab prompted an immune response similar to those seen in patients who have recovered from the disease.” Fingers crossed.

CVS Health, Walgreen’s and Rite Aid / Verily continue to expand their drive up COVID-19 testing capabilities. Healthcare Dive reports that the Food and Drug Administration (“FDA”) last Friday “authorized multiple laboratories to test for coronavirus in nasal samples collected by consumers using an at-home kit” produced by Everlywell. This is the second FDA approved at home kit.

What’s more, Fierce Biotech reports that Verily’s Project Baseline “has launched a new clinical research effort focused on COVID-19 antibody testing and exploring the body’s immune response to the novel coronavirus.” Fierce Healthcare adds that the American Medical Association is offering guidance on COVID-19 antibody testing for physicians. “Although many are using these tests to determine whether an individual had COVID-19, we encourage physicians to only use antibody tests authorized by the FDA and only for the purposes of population-level studies [like the Project Baseline study], evaluating recovered individuals for convalescent plasma donations, or along with other clinical information as part of a well-defined testing plan for groups or individuals.”

A friend of the FEHBlog called his attention to this federal government list of top ten routinely exploited cybersecurity vulnerabilities and mitigations over the period 2016 through 2019 and this year.

Weekend update

David Ermer–Congress, COVID-19, HIPAA Privacy and Security Rules, Rx coverage–

Happy Mother’s Day.

Just like last week, the Senate will be in session this week while the House continues to fully hunker down. The Hill discusses five factors influencing when the House will return to Capitol Hill. It’s funny that the article does not list the Presidential election as a sixth factor. (Even the FEHBlog is entitled to have an occasional “DJT” moment. Lo siento.)

The FEHBlog forgot last Thursday to provide a link to the Senate Health Education Labor and Pension Committees “shark tank” on new tests for COVID-19. Here you go. This Committee will be holding a hearing on how to pull out of the great hunkering down on Tuesday.

For the past two months, the FEHBlog has been tracking a simplified infection fatality rate (IFR) for COVID-19 based on the CDC’s statistics. The FEHBlog is not an epidimeologist but he figured things would be looking up if the rate plateaued. The FEHBlog’s statistics do show the IFR increase slowing down over the past month. In any event, here’s a new Health Affairs article on the COVID-19 IFR for your information.

CIGNA’s PBM Express Scripts has created a program called ParachuteRX which offers reasonably priced prescription drugs to the uninsured. Cool.

The FEHBlog has been a fan of genetics-based personalized medicine. It therefore was sobering for the FEHBlog to read in the Wall Street Journal that the popular focus on personalized medicine has detracted from public health efforts. The article explains that

the first national initiative launched to try to treat today’s severely ill patients is the National Covid-19 Convalescent Plasma Project. The project originated with a small nucleus of people who, it turns out, have been prominent critics of personalized medicine over the years, including Arturo Casadevall of Johns Hopkins University, Michael Joyner of the Mayo Clinic and Nigel Paneth of Michigan State University.

The idea of using antibody-rich plasma from recovered patients to try to neutralize a virus in those who are ill was first used more than 100 years ago. The project is designed to buy time and save lives until a vaccine can be developed and deployed or more targeted therapies can be identified and tested. It also offers a real-world test case for ideas that had largely been confined to academic journals and debates between scientists.

Indeed the FEHBlog learned in the Great Influenza book that small scale efforts to use this antibody approach found success in the 1918-19 pandemic. It’s encouraging to read that a large scale effort is underway now. In the aftermath of the great hunkering down, a Goldilocks compromise must be reached between personalized medicine and public health efforts.

Finally, Health IT Security does a good job putting the government’s COVID-19 related flexibilities with regard to enforcing the HIPAA Privacy Rule into focus.

Person using a laptop

Thursday Miscellany

David Ermer–COVID-19, HIPAA Privacy and Security Rules, Medicare–

The Centers for Medicare and Medicaid Services today announced wide ranging Medicare changes to make healthcare more accessible during the COVID-19 emergency. For example,

For the duration of the COVID-19 emergency, CMS is waiving limitations on the types of clinical practitioners that can furnish Medicare telehealth services. Prior to this change, only doctors, nurse practitioners, physician assistants, and certain others could deliver telehealth services. Now, other practitioners are able to provide telehealth services, including physical therapists, occupational therapists, and speech language pathologists.

CMS previously announced that Medicare would pay for certain services conducted by audio-only telephone between beneficiaries and their doctors and other clinicians. Now, CMS is broadening that list to include many behavioral health and patient education services. CMS is also increasing payments for these telephone visits to match payments for similar office and outpatient visits. This would increase payments for these services from a range of about $14-$41 to about $46-$110. The payments are retroactive to March 1, 2020.

It will be interesting to see whether commercial plans adopt these changes (perhaps they already have). Check out the lengthy list. Hopefully many of these changes will be made permanent following the COVID-19 emergency.

As the FEHBlog has listed major COVID-19 testing locations. It occurred that he should also link to the COVID-19 sites for the major actuarial consulting firms, all of which provide useful information for health plans:

These sites are a valuable public service in the FEHBlog’s view.

HHS’s Office for Civil Rights today provided a helpful COVID-19 cyber threat resources. While the FEHBlog could not find a link to the list, he was able to upload the email to Dropbox.

Person using a laptop

Thursday Miscellany

David Ermer–CDC, COVID-19, HIPAA Privacy and Security Rules, Rx coverage–

As the FEHBlog discussed COVID-19 death rates yesterday, it’s only meet and right to post STAT’s story which seeks to put COVID-19 death projections into perspective.

On the flip side, STAT reports on Pfizer’s decision to accelerate by three months human testing on a potential treatment for COVID-19 and local WTOP news reports on COVID-19 vaccine development efforts by a company in the Maryland suburbs of D.C., Novovax. Best of luck.

Healthleaders Media discusses a Guidehouse study finding

A major factor hampering the financial situation for rural providers is the migration of patients to care options outside of the community, with over 75% of patients bypassing local hospitals to receive care elsewhere. These levels are much higher compared to the outmigration patterns of suburban and urban patients.

More than 350 rural hospitals [one in four], accounting for $8.3 billion in total patient revenue, are at the greatest financial risk of closure, according to Guidehouse. The five states most likely to be impacted by hospital closures include Tennessee, Oklahoma, Mississippi, Alabama, and Kansas, according to the analysis.

Guidehouse adds that “Of these hospitals, 81%, or 287 hospitals, are considered highly essential to the health and economic well-being of their communities.” What is really troubling about this study is that it was conducted before the COVID-19 emergency which must be exacerbating these financial problems.

The Centers for Medicare and Medicaid Services today issued additional guidance loosening the regulatory reins on healthcare providers so that “so that hospitals, clinics, and other healthcare facilities can boost their frontline medical staffs” necessary to treat COVID-19 patients and others. Among other steps,

Doctors can now directly care for patients at rural hospitals, across state lines if necessary, via phone, radio, or online communication, without having to be physically present. Remotely located physicians, coordinating with nurse practitioners at rural facilities, will provide staffs at such facilities additional flexibility to meet the needs of their patients.

Similarly, the HHS Office for Civil Rights which enforces the HIPAA Privacy and Security Rules promised not to impose HIPAA penalties on good faith rule violations that occur at COVID-19 testing sites.

Drug Channels offers an interesting take on the CMS actuary’s recent healthcare spending projections for the U.S. Adam Fein observes that ” The coronavirus is upending our healthcare system and putting enormous pressure on hospitals. Despite increased costs of treatment, I expect that spending [that CMS estimated before the COVID-19 emergency] will be lower than the CMS projections.”

On the technology front, the federal government’s cybersecurity authorities released a detailed alert on a variety of cyberscams that have arisen during the COVID-19 emergency.