Telehealth companies and other industry stakeholders have had a watchful eye towards the end of 2024 and the impending “telehealth cliff” as COVID-era Drug Enforcement Agency (DEA) flexibilities and Medicare expanded telehealth coverage are set to expire. Although a recent temporary joint rule from the DEA and the Department of Health and Human Services (HHS) along with the 2025 Medicare Physician Fee Schedule final rule has provided some hope, questions regarding telehealth access in 2025 and under a new Administration remain unclear. Further, calls continue for increased oversight of telehealth services. 

Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule), generally prohibits disclosure or use of PHI by a covered entity or their business associate for purposes of criminal, civil, or administrative investigations into persons for seeking, obtaining, providing, or facilitating reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it vacated.

A recent court split about whether awards granted through arbitration under the No Surprises Act (NSA) are enforceable through litigation has created uncertainty around an already complicated process.  A Texas judge recently held that the NSA does not grant parties a right to bring suit to enforce arbitration awards, while last year a New Jersey court granted enforcement of a similar award.  The resulting split raises questions about the enforceability and utility of the NSA and its Independent Dispute Resolution (IDR) process. 

Earlier this week, the Biden-Harris Administration, through the Office for Civil Rights (OCR) announced a Final Rule aimed at protecting protected health information (PHI) related to lawfully provided reproductive health care services.  As we discussed last year, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy was proposed in response to concerns about the confidentiality of PHI related to reproductive health care following the decision in Dobbs v. Jackson Women’s Health Organization.  In the executive summary of the Final Rule, OCR emphasized that the changing post-Dobbs legal landscape “increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system.”  The Final Rule defines “reproductive health care” as “health care…that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” 

Lawyers for Good Government, in partnership with the American College of Obstetricians and Gynecologists, initiated a vital project known as The Policy Resource Hub in 2022.

On October 10, 2023, the Drug Enforcement Administration (DEA) published another temporary rule extending the COVID-era telemedicine flexibilities that allow physicians and other prescribers to prescribe controlled substances without an in-person evaluation.  With just over a month to go before the expiration of the first set of flexibilities, the DEA announced that the telemedicine flexibilities, which have been in place since March 2020, will be extended through the end of 2024 in order to give the agency more time to consider feedback received in response to the proposed rule, which was announced in March of this year.  As a reminder, under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, providers may not prescribe controlled substances without an in-person visit, unless an exception applies.  The COVID public health emergency triggered one such exception, which lead to the telehealth flexibilities. 

A new Florida law will require certain Florida-licensed providers to ensure that patient information is physically maintained only in the continental United States and its territories or in Canada. Florida SB 264, which goes into effect July 1, 2023, amends the Florida Electronic Health Records Exchange Act, adding a ban on offshoring health information that goes beyond the requirements under HIPAA and most other generally applicable health privacy and security laws. Florida licensees to which the new requirements apply will need to attest upon initial licensure and any renewals that they are in compliance with the new requirements. Applicable licensees will also be required to ensure that no individual or entity with a controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries.