The Future of the Patient Protection and Affordable Care Act May be Uncertain… But HIPAA is Here to Stay

While the future of the Patient Protection and Affordable Care Act and any potential replacement legislation is still in question, the Office for Civil Rights (“OCR”) within the U.S. Department of Health and Human Services (“HHS”) has clarified through its recent actions that the HIPAA privacy, security, and breach notification rules contained at 45 C.F.R. Parts 160 and 164 (the “Administrative Simplification Rules”) are here to stay. Audits initiated by OCR and investigations resulting from reported violations reveal that HIPAA compliance continues to be a governmental priority under the new administration. Indeed, nine representative resolution agreements have been released by HHS thus far in 2017 (the latest being released earlier this week) assessing a range of penalties from $31,000 to $5.5 million for a covered entity’s failure to comply with various aspects of HIPAA (including but not limited to failure to conduct a thorough and accurate risk analysis, failure to have a business associate agreement in place, failure to have comprehensive policies and procedures in place and implemented, and failure to protect protected health information (“PHI”) from improper use and disclosure). Thus, it is as important as ever for employer-sponsored group health plans to ensure that they are complying with HIPAA’s encompassing and technical requirements. As the various resolution agreements detail, failure to do so can have dire financial consequences on the group health plan (and correspondingly on the sponsoring employer).

HIPAA’s Administrative Simplification Rules require covered entities and their business associates to protect the confidentiality, integrity, and availability of PHI from improper use and disclosure. A group health plan falls within the definition of “covered entity.” Third parties who create, receive, maintain and/or transmit PHI for or on behalf of a covered entity are generally considered “business associates.” See 45 C.F.R. 160.103. Complying with HIPAA’s Administrative Simplification Rules can be a daunting task for group health plans and the employers sponsoring them. For example, administratively, group health plans are required to create, maintain, implement, and periodically review and update several written documents. The following provides a “checklist” approach of some important documents that group health plans need to have in place in order to comply with the Administrative Simplification Rules. Please keep in mind, however, that merely having the documents in place is insufficient from a HIPAA compliance standpoint; group health plans (and plan sponsors) also need to ensure that they are actually implementing, adhering to, and periodically reviewing the substance of the documents. Thus, it is imperative for employer-sponsored group health plans to continually evaluate their HIPAA compliance position with experienced HIPAA legal counsel. Even minor deficiencies can result in substantial penalties.

1. Business Associate Agreements

A covered entity may permit a business associate to create, receive, maintain or transmit PHI on its behalf only after it obtains satisfactory assurances in the form of a written business associate contract that the business associate will appropriately safeguard the information. See 45 C.F.R. sections 164.502, 164.504, and 164.314. A business associate agreement is a cornerstone HIPAA requirement that is commanding more and more scrutiny by the government.

For example, a resolution agreement released on April 20, 2017, demonstrated that a covered entity’s failure to have a business associate agreement in place with a third party vendor that had access to the covered entity’s PHI was a $31,000 mistake.  Interestingly, the compliance review of the covered entity was initiated by OCR following OCR’s investigation of the business associate. The two-year corrective action plan associated with the $31,000 fine required, among other things, that the covered entity revise its HIPAA policies and procedures to require: (1) the designation of one or more individual(s) who are responsible for ensuring that the covered entity enters into a business associate agreement with each of its business associates prior to disclosing PHI to the applicable business associate; (2) the creation of a standard template business associate agreement; (3) a process for assessing current and future business relationships to determine whether each relationship is with a “business associate;” (4) a process for negotiating and entering into business associate agreements with business associates prior to disclosing PHI to the business associate; (5) a process for maintaining documentation of business associate agreements for at least six years beyond the date of when the business associate relationship is terminated; and (6) a process to limit disclosures of PHI to business associates to the minimum necessary amount of PHI that is reasonably necessary for business associates to perform their duties.

The government’s demand for the creation of a standard template business associate agreement is of particular note for employers sponsoring group health plans for some important reasons. First, HIPAA’s Administrative Simplification Rules contain detailed provisions that must be included in a business associate agreement; variations from these strict regulatory requirements can make the agreement noncompliant. If a group health plan has a template business associate agreement in place prepared by experienced HIPAA legal counsel, it can be assured that the agreement is HIPAA compliant. When the document has been prepared by another party (such as the business associate), the group health plan should have the agreement carefully reviewed to ensure each of the regulatory provisions are correctly stated. Second, like any contract, business associate agreements can be drafted in a one-sided manner. A group health plan will want to have its standard business associate agreement prepared to adequately address, among other items, reporting time limits and indemnification requirements in the group health plan’s favor. While the HIPAA Administrative Simplification Rules set forth minimum requirements, keep in mind that additional information can be included within the agreement. Thus, each contract should be reviewed to ensure that the additional provisions are in fact desirable to be included from the group health plan’s perspective.

2. Security Policies and Procedures

A covered entity is required to implement reasonable and appropriate written policies and procedures to comply with the standards, implementation specifications, and other requirements of the security rules. See 45 C.F.R. 164.316. This requires the covered entity to implement administrative, physical, and technical safeguards to protect the confidentiality and integrity of electronic PHI (“EPHI”). Various resolution agreements highlight the need: (1) for comprehensive security policies and procedures; (2) to train workforce members on the policies and procedures; and (3) periodically evaluate the scope of the policies and procedures.

One of the cornerstones of a covered entity’s security policies and procedures is its security management process. This requires the covered entity to: (1) periodically conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI held by the covered entity; (2) implement security measures sufficient to reduce the detected risks and vulnerabilities to a reasonable and appropriate level; (3) apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures; and (4) implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

Indeed, two April 2017 resolution agreements demonstrate the need to conduct a thorough and accurate risk analysis to assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI and to implement security measures sufficient to reduce those risks and vulnerabilities. In an April 24, 2017 resolution agreement, the covered entity’s HIPAA deficiencies resulted in a $2.5 million settlement. A resolution agreement released April 12, 2017 resulted in a $400,000 settlement. Among other things, the corrective action plan in both cases requires the covered entity to conduct and provide the results of a comprehensive risk analysis to HHS. Thereafter, the covered entity is required to review the risk analysis annually (or more frequently, if appropriate) and promptly update the risk analysis in response to environmental or operational changes affecting the security of EPHI. Thus, through its resolution agreements, HHS is emphasizing the fluid need to ensure that electronic systems adequately safeguard EPHI and that covered entities are appropriately minimizing risk.

3. Privacy Policies and Procedures

Pursuant to 45 CFR 164.530, a covered entity is required to implement written policies and procedures with respect to PHI that are designed to comply with the HIPAA privacy rules and breach notification rules. A limited exception to this requirement is available under 45 CFR 164.530(k) for certain fully-insured group health plans that maintain a “hands off” status (i.e., the group health plan does not create or receive PHI except for certain summary health information and/or enrollment/disenrollment information). Among other items, the privacy policies and procedures must address how a covered entity may use and disclose PHI. They also must address an individual’s rights with respect to his or her PHI and which employees will be granted access to PHI. One May 2017 resolution agreement resulted from a covered entity’s improper disclosure of PHI to the media and various public officials without proper authorization. Another May 2017 resolution agreement resulted from a covered entity’s improper disclosure of PHI to his workplace. The corrective action plans associated with the resolution agreements required the covered entity to develop/review, maintain, and revise as necessary written policies and procedures (which relevantly would set forth the permissible uses and disclosure of PHI), to distribute such policies and procedures to the workforce, and to assess, update, and revise, as necessary, the policies and procedures at least annually. Thus, implementation of comprehensive privacy policies and procedures is deemed a necessity by HHS.

4. Notice of Privacy Practices

Pursuant to 45 CFR 164.520, an individual has a right to adequate notice of the uses and disclosures of PHI that may be made by the covered entity and of the individual’s rights and the covered entity’s legal duties with respect to PHI. The notice of privacy practices is essentially a summary of the covered entity’s privacy policies and procedures. The plan sponsor is obligated under the privacy rules to ensure that the notice is prepared and timely and appropriately distributed to plan participants, except in the case of certain fully-insured group health plans that maintain a hands off status, in which case the insurer has the duty. The content and distribution requirements for notices of privacy practices are strict. Thus, it is imperative for plan sponsors to ensure legal compliance.

5. Plan Sponsor Certifications

A group health plan may disclose PHI to the plan sponsor for plan administration functions only after: (1) the plan document has been amended to incorporate various regulatory requirements related to the plan’s use and disclosure of PHI, and (2) the plan sponsor has certified to the plan, in writing, that the plan has been amended and that the plan sponsor agrees to the restrictions contained in the amendment. See 45 C.F.R. 164.504 and 164.314. Plan sponsors must ensure that their plans have been appropriately amended and that proper written certification is in place.

6. Workforce Training

A covered entity is required to provide training to all members of its workforce on its HIPAA policies and procedures, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity. Various resolution agreements stress the necessity of conducting and documenting comprehensive training. For example, two May 2017 resolution agreements indicate that training must be reviewed at least annually, and, where appropriate, updated to reflect changes in the law, issues discovered during internal or external audits, and other relevant developments. Thus, plan sponsors must continually evaluate the need for workforce training and tailor such training to their internal structure.

These are just some of the written documentation requirements that group health plans must adhere to under HIPAA’s Administrative Simplification Rules. Regulatory provisions must be reviewed in conjunction with the group health plan’s administrative practices when drafting these documents. The resolution agreements released this year reaffirm the notion that employer-sponsored group health plans must evaluate their HIPAA compliance position with experienced HIPAA legal counsel. Deficiencies can result in substantial penalties. Please feel free to contact us with any questions you may have with respect to your HIPAA compliance endeavors.

Copies of the resolution agreements are available by clicking HERE.

This email serves solely as a general summary of complex proposed legislation and government initiatives.  It does not constitute legal guidance.  Please contact us with any questions related to the Proposed Legislation and what impact finalization might have on your employer-sponsored plans.

Questions? Contact us to learn more.

ACTION REQUIRED BEFORE YEAR-END: Disability Plans Claims and Appeals Procedures

Employers who sponsor disability plans have work to do with respect to their claims and appeals procedures prior to year-end. Final regulations were recently released by the Department of Labor (“DOL”) revising the existing claims and appeals procedures regulations under ERISA for employee benefit plans providing disability benefits. According to the DOL, the intent of the final regulations is to strengthen the current procedures by adopting some of the additional procedural safeguards and protections for disability plan claims that are already in place for group health plan benefits pursuant to the Patient Protection and Affordable Care Act.

The newly issued final regulations took effect on January 18, 2017 and will apply to all disability benefits claims filed on or after January 1, 2018. Accordingly, it is imperative for employers to work with their disability plan insurance carriers, third party administrators, and attorneys to ensure that all underlying disability plans and associated documentation (including any ERISA wrap plans, Code section 125 cafeteria plans, and claims denial forms) are reviewed and updated to ensure legal compliance with the requirements for claims filings beginning January 1, 2018.

The final regulations are lengthy, comprehensive, and require detailed review and analysis. Some highlights of the final regulations for employers, plan sponsors, carriers, and administrators to consider, include the following:

  1. Independent and Impartiality to Avoid Conflicts of Interest. Claims and appeals must be adjudicated in a manner designed to ensure independence and impartiality of the persons involved in making the benefit determination. Decisions regarding hiring, compensation, termination, promotion, or similar matters with respect to any individual (such as a claims adjudicator, medical expert, or vocational expert) cannot be made based upon the likelihood that the individual will support the denial of benefits. For example, the preamble to the final regulations notes that a plan cannot provide bonuses based on the number of denials made by a claims adjudicator.
  2. Improvements to Disclosure Requirements.  Benefit denial notices must contain specified information, including but not limited to:
    1. A complete discussion of why the plan denied the claim and the standards applied in reaching such decision. Such discussion must include the basis for disagreeing with or not following: (i) the views of health care professionals and vocational professionals who treated/evaluated the claimant; (ii) the views of medical or vocational experts whose advise was obtained on behalf of the plan in connection with a denial (without regard to whether the advice was relied upon in making the determination); or (iii) a disability benefit determination made by the Social Security Administration. Thus, under this standard, merely stating that the plan or a reviewing physician disagrees with the treating physician is insufficient.
    2. If the denial is based on a medical necessity or experimental treatment or similar exclusion or limit, either an explanation of the scientific or clinical judgment for the determination (applying the terms of the plan to the claimant’s medical circumstances), or a statement that such explanation will be provided free of charge upon request;
    3. Either the specific internal rules, guidelines, protocols, standards or other similar criteria of the plan relied upon in denying the claim, or a statement that such rules, guidelines, protocols, standards or other similar criteria of the plan do not exist; and
    4. A statement that the claimant is entitled to receive, upon request and free of charge, reasonable access to, and copies of, all documents, records, and other information relevant to the claimant’s claim for benefits.
  3. Right to Review and Respond to Additional Information Prior to Final Determination. A claimant must be given timely notice of his or her right to access his or her entire claim file and other relevant documentation. A claimant must also be guaranteed the right to present evidence and testimony in support of his or her claim during the review process. Further, a claimant must be given notice and a fair opportunity to respond before denials on review are based on new or additional evidence or rationales. More specifically, the claims procedures must require that: (a) plans provide claimants, free of charge, with any new or additional evidence considered, relied upon, or generated by the plan, insurer, or other person making the benefit determination (or at the direction of the plan, insurer or such other person) during the pendency of the appeal in connection with the claim; and (b) before the plan can issue a denial on review based on a new or additional rationale, that the plan provides claimant, free of charge, with the rationale. Any rationale/evidence must be provided as soon as possible and sufficiently in advance of the date on which the notice of denial upon review is required in order to give the claimant a reasonable opportunity to respond prior to that date.
  4. Deemed Exhaustion of Claims and Appeals Processes. Plans cannot prohibit a claimant from seeking court review under ERISA section 502(a) of a denial based upon a failure to exhaust administrative remedies under the plan if the plan failed to comply with the claims procedures requirements, unless the violation was (a) the result of a minor error; (b) non-prejudicial; (c) attributable to good cause or matters beyond the plan’s control; (d) in the context of a good-faith exchange of information; and (e) not reflective of a pattern or practice of non-compliance. Additionally, denial notices on review, among other information, must describe any applicable contractual limitations period that applies to the claimant’s right to bring an action under ERISA section 502(a), including the calendar date on which the contractual limitations period expires for the claim.
  5. Coverage Rescissions. The final regulations clarify that certain rescissions of coverage must be treated as adverse benefit determinations triggering the plan’s appeals procedures.
  6. Culturally and Linguistically Appropriate Notices. Required notices and disclosures issued under the final regulations must be written in a culturally and linguistically appropriate manner. If a claimant’s address is in a county where 10% or more of the county population are literate only in the same non-English language, notices of denials to the claimant must include a statement prominently displayed in the applicable non-English language clearly indicating how to access language services provided by the plan. Additionally, the plan must provide a customer assistance process with oral language services in the non-English language and provide written notices in the non-English language upon request.

This alert serves as a general summary of the lengthy and and comprehensive final regulations, which can be found by clicking HERE. Please feel free to contact us with any questions you may have regarding getting your plans into compliance with the newly issued regulations prior to January 1, 2018.

This email serves solely as a general summary of complex proposed legislation and government initiatives.  It does not constitute legal guidance.  Please contact us with any questions related to the Proposed Legislation and what impact finalization might have on your employer-sponsored plans.

Questions? Contact us to learn more.

Detroit Updates Its Jock Tax

In March of this year, the City of Detroit officially codified its jock tax and released new income tax guidelines which clarify how professional athletes should apportion their income to Detroit for purposes of its city income tax, as well as guidance for teams on how to allocate income. Continue reading Detroit Updates Its Jock Tax

If It Doesn’t Say So, it Aint So: Michigan Supreme Court Holds For-Profit Schools Entitled to Property Tax Exemption

A unanimous Michigan Supreme Court decision this week will have big implications for for-profit schools and colleges – and even for-profit laboratories, research and development facilities, and test centers. Continue reading If It Doesn’t Say So, it Aint So: Michigan Supreme Court Holds For-Profit Schools Entitled to Property Tax Exemption