Commencing October 2024, CMS will start off-cycle revalidations of all Skilled Nursing Facilities (SNFs).  As part of the revalidation process, SNFs must disclose the additional information required under CMS’ final rule, “Disclosures of Ownership and Additional Disclosable Parties Information for Skilled Nursing Facilities and Nursing Facilities,” which was  released November 17, 2023 (“Final SNF Disclosure Rule”).  

Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule), generally prohibits disclosure or use of PHI by a covered entity or their business associate for purposes of criminal, civil, or administrative investigations into persons for seeking, obtaining, providing, or facilitating reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it vacated.

A recent court split about whether awards granted through arbitration under the No Surprises Act (NSA) are enforceable through litigation has created uncertainty around an already complicated process.  A Texas judge recently held that the NSA does not grant parties a right to bring suit to enforce arbitration awards, while last year a New Jersey court granted enforcement of a similar award.  The resulting split raises questions about the enforceability and utility of the NSA and its Independent Dispute Resolution (IDR) process. 

Earlier this week, the Biden-Harris Administration, through the Office for Civil Rights (OCR) announced a Final Rule aimed at protecting protected health information (PHI) related to lawfully provided reproductive health care services.  As we discussed last year, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy was proposed in response to concerns about the confidentiality of PHI related to reproductive health care following the decision in Dobbs v. Jackson Women’s Health Organization.  In the executive summary of the Final Rule, OCR emphasized that the changing post-Dobbs legal landscape “increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system.”  The Final Rule defines “reproductive health care” as “health care…that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” 

As the Mintz Health Law team welcomes the beginning of 2024, many of its members take a moment to reflect on the exciting growth of the Health Law Practice, opportunities to partner with clients on complex legal issues, and the celebration of numerous milestones.

As we reflect on the flurry of activity in the health care data privacy and security space in 2023 and look ahead to what will continue to be a busy 2024, we are seeing the early stages of federal agency movement to align the regulatory environment with modern health care delivery, cutting-edge technologies, and innovative data-sharing techniques. Some of this work has been done in the form of federal agency guidance in which health care organizations will be looking for additional updates and there are also a handful of pending U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) proposals that call for substantial changes to the HIPAA Privacy Rule.

On October 10, 2023, the Drug Enforcement Administration (DEA) published another temporary rule extending the COVID-era telemedicine flexibilities that allow physicians and other prescribers to prescribe controlled substances without an in-person evaluation.  With just over a month to go before the expiration of the first set of flexibilities, the DEA announced that the telemedicine flexibilities, which have been in place since March 2020, will be extended through the end of 2024 in order to give the agency more time to consider feedback received in response to the proposed rule, which was announced in March of this year.  As a reminder, under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, providers may not prescribe controlled substances without an in-person visit, unless an exception applies.  The COVID public health emergency triggered one such exception, which lead to the telehealth flexibilities. 

A new Florida law will require certain Florida-licensed providers to ensure that patient information is physically maintained only in the continental United States and its territories or in Canada. Florida SB 264, which goes into effect July 1, 2023, amends the Florida Electronic Health Records Exchange Act, adding a ban on offshoring health information that goes beyond the requirements under HIPAA and most other generally applicable health privacy and security laws. Florida licensees to which the new requirements apply will need to attest upon initial licensure and any renewals that they are in compliance with the new requirements. Applicable licensees will also be required to ensure that no individual or entity with a controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries.

As we previously covered, in March 2023, the Drug Enforcement Agency (DEA) announced a proposed rule on prescribing controlled substances via telehealth, aimed at addressing the “telehealth cliff” that was expected to occur once the COVID-19 Public Health Emergency (PHE) ends on May 11, 2023. The proposed rule provided some flexibility, but required a much more restrictive framework for prescribing controlled substances via telehealth compared to the flexibilities available during the PHE. During the 30-day comment period following the announcement of the proposed rule, the DEA received over 38,000 comments, which the agency says it is closely reviewing. Many commentators across the health care industry criticized the proposed rule because the in-person examination requirement would limit access to care. The DEA, working with the Department of Health and Human Services, is also considering revisions to the proposed rule.