All players in the health and wellness ecosystem should be following developments around the American Data Privacy and Protection Act (ADPPA).  If enacted, the ADPPA would be a watershed in the regulation of the privacy and security of personal information, including health information.  The ADPPA would have a particularly large impact on entities that currently collect, process, and transmit health information but are not subject to HIPAA.

The Office of Inspector General for the Department of Health and Human Services (OIG) recently published an Advisory Opinion in which it concluded that the provision of free genetic testing and counseling services by a pharmaceutical manufacturer would not result in the imposition of sanctions under the federal Anti-Kickback Statute (AKS) and the beneficiary inducements civil monetary penalty provision (Beneficiary Inducements CMP).  This Advisory Opinion is the first to address this type of arrangement and thus provides useful insight for the health care and life sciences industries.

The Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) released a Request for Information (RFI) to obtain industry feedback and inform potential future rulemaking regarding information security practices and civil money penalties (CMPs) under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the HIPAA Security Rule. OCR is seeking input on how HIPAA covered entities and business associates are operationalizing “recognized security practices” as defined by Public Law 116-321. It is also requesting commentary on the methodologies used to disperse CMPs to individuals harmed by violations of certain privacy or security provisions of the HITECH Act or the Social Security Act, which we will cover in a separate post.

The United States Department of Health and Human Services (HHS) and Centers for Medicare and Medicaid Services (CMS) leadership announced during last week’s HIMSS 2022 Conference that the agencies will be focusing on information blocking enforcement for the remainder of 2022. This blog post discusses the importance of closing the enforcement gap and the development of disincentives for health care providers. 

Health care providers, health information networks, health information exchanges, and health IT developers of certified health IT will want to take note of the information blocking claim submission trends recently published by the Office of the National Coordinator for Health Information Technology (ONC).

In this episode of the Health Law Diagnosed podcast, members of the Mintz Health Law team discuss their health law–focused 2022 New Year’s resolutions and how they’re helping clients and colleagues navigate the continued challenges and opportunities of the current era.

While the Office of the National Coordinator for Health Information Technology (ONC) issued the 21st Century Cures Act; Interoperability, Information Blocking, and the ONC Health IT Certification Program (Information Blocking Final Rule) back in May 2020, many entities are still parsing out compliance strategies and seeking additional regulatory guidance to understand how the rule will be enforced. Broadly-speaking, information blocking is a practice that is likely to interfere with, prevent, or discourage access, exchange, or use of electronic health information (EHI). For example, a health system might require patient written consent before sharing the patient’s EHI with unaffiliated providers. Another example of information blocking is that a health IT developer might charge a fee to a health care provider to perform an export of EHI so that the provider can switch to a different health IT platform.