Issue 19, Winter 2023
General OrthoForum Policy Issues
Final Rule on Physician Fee Schedule; Related Actions by Congress
Conversion Factor: Other Payment Issues: CMS published the PFS final rule on November 18, 2022. It set the 2023 conversion factor at $33.0607, which is a cut of 4.47 percent from the 2022 conversion factor of $34.6062.
Congress, however, took action to reduce the cut. The Consolidated Appropriations Act, 2023 (Public Law 117-328), which was enacted December 29, 2022, included a provision that increased the conversion factor by 2.5 percent. That results in a 2023 final conversion factor of $33.8872, which is a 2.08 percent cut from the 2022 conversion factor.
That same law waived the 4 percent cut in Medicare physician payments that would have occurred under the Statutory Pay-As-You-Go Act of 2010. Congress, however, did not take any action to end the 2 percent sequestration cut that, under the Budget Control Act of 2011, took effect again on July 1, 2022 (having been suspended and then reduced earlier in 2022).
Telehealth Flexibilities: The 2023 PFS final rule extends through the end of 2023 many of the telehealth flexibilities that have been authorized during the Covid-19 public health emergency (PHE). Congress, however, took action on these flexibilities in the Consolidated Appropriations Act that was enacted in December. Congress extended the telehealth flexibilities through the end of 2024, including eliminating geographic restrictions on which sites can be “originating sites.” Such sites can be anywhere in the United States where the patient is located at the time a service is furnished, including the home of the patient. More details are provided in the newsletter section on therapy services.
Split/Shared Evaluation and Management (E/M) Services: The final rule delayed until January 1, 2024, the requirement for the facility setting (not the office setting) that the person who provides the “substantive portion” of the services bill for the visit and that reimbursement be based on the rate applicable to that person (physician or non-physician practitioner, as the case may be). The rule is that time, and not medical decision making (MDM) or other factors, is the determinative factor; therefore, whoever provides more than 50 percent of the total time for the visit is providing the “substantive portion”.
For 2023 (as for 2022), CMS is providing options on how to determine the “substantive portion” (except that the options are not applicable to critical care visits). Specifically, the substantive portion can be determined (1) by time (more than 50 percent of the visit), or (2) by performing the history, or (3) by performing the examination, or (4) by performing the medical decision making (MDM).
Global Surgical Packages: CMS had, in the proposed rule, requested public comments on “strategies to improve the accuracy of payment” on the packages, but the final rule did not make any changes, even though it noted that many commenters urged the agency to “continue to rely on RUC valuations of global packages (including the number of embedded E/M visits included in the RUC surveys.)”
Duration of Public Health Emergency; Effects From Its End
Effective January 11, 2023, the Secretary of Health and Human Services, Xavier Becerra, extended the Covid-19 public health emergency (PHE) for an additional 90-day period, using authority under section 319 of the Public Health Service Act. That additional period will be in effect until mid-April 2023. The Biden Administration has stated that it will provide a 60-day notice that the PHE will end. Therefore, if no such notice is provided by mid-February, the assumption will be that the PHE will be renewed on or before it expires in April. The PHE, however, may not be extended beyond April, as the Biden Administration appears to be moving toward a decision to end the PHE.
Ending the PHE involves complicated issues, as noted in the previous newsletter. Millions of people may lose access to emergency health insurance coverage when the PHE ends. Covid-19 vaccines and tests may no longer be provided without charge. Note also that the authority for emergency use authorizations (EUAs) for drugs and devices issued by the Food and Drug Administration is not provided under section 319 of the Public Health Service Act, but rather under section 564 of the Federal Food, Drug, and Cosmetic Act. Separate action by Secretary Becerra under section 564 will be necessary to terminate EUAs.
Update: Late on January 30, the Biden Administration announced that, on May 11, 2023, it will end the declaration of a public health emergency under section 319 of the Public Health Service Act.
Medicare Prior Authorization Issues
Legislation: Congress did not address prior authorization issues in it end-of-session legislation package (the Consolidated Appropriations Act, 2023). Many advocates hoped the bill that passed the House in September 2022 by a voice vote (H.R. 3173) would be included in the package, but the costs of the legislation apparently prevented that from happening. The Congressional Budget Office scored the bill as increasing federal spending by approximately $16 billion. That bill would have required Medicare Advantage (MA) plans to electronically issue real-time prior-authorization decisions, effective with the second plan year beginning after the bill’s enactment.
Proposed Rules: In December 2022, CMS issued two proposed rules concerning prior authorization. The proposed rule published on December 13 focused on interoperability issues and some substantive requirements for MA plans; Medicaid and CHIP fee-for-service (FFS) programs and managed care plans; and ACA plans. (It also withdrew a related proposed rule published in December 2020.)
Effective January 1, 2026, a particular “application programming interface” (API) would be required to support and streamline the prior authorization process, and the following substantive requirements would apply (but would not apply to drugs):
· Respond to prior authorization requests within certain timeframes.
· Provide a clear reason for prior authorization denials.
· Publicly report on prior authorization approvals, denials, and appeals.
MA plans would be required to “provide notice of prior authorization decisions as expeditiously as a patient’s health condition requires, but no later than 7 calendar days for standard requests.”
These requirements would apply to any formal decision-making process through which impacted payers render an approval or denial determination in response to prior authorization requests based on the payer’s coverage guidelines and policies before services are rendered or items provided.
Although this proposed rule does not apply to the Medicare FFS program, CMS stated that, if the proposed rule is finalized, Medicare FFS “would align its efforts for implementation of the requirements as feasible.”
The proposed rule published on December 27 provides as follows regarding MA plans:
· Prior authorization policies for coordinated care plans may only be used to confirm the presence of diagnoses or other medical criteria and/or ensure that an item or service is medically necessary based on standards specified in this rule.
· An approval granted through prior authorization processes must be valid for the duration of the approved course of treatment.
· MA plans must provide a minimum 90-day transition period when an enrollee who is currently undergoing treatment switches to a new MA plan.
· MA plans must comply with national coverage determinations (NCD), local coverage determinations (LCD), and general coverage and benefit conditions included in Traditional Medicare statutes and regulations as interpreted by CMS.
· MA plans cannot deny coverage of a Medicare covered item or service based on internal, proprietary, or external clinical criteria not found in Traditional Medicare coverage policies.
· When there is no applicable coverage criteria in Medicare statute, regulation, NCD, or LCD, MA organizations may create internal coverage criteria that are based on current evidence in widely used treatment guidelines or clinical literature that is made publicly available to CMS, enrollees, and providers.
· To ensure prior authorization is being used appropriately, MA plans must establish a Utilization Management Committee to review all utilization management, including prior authorization, policies annually and ensure they are consistent with current, traditional Medicare’s national and local coverage decisions and guidelines.
No Surprises Act
A lawsuit was filed in September 2022 challenging the latest federal final rule on the arbitration process (issued in August 2022), but there apparently is no news on the progress of the lawsuit. That final rule continues to give priority to the median in-network contracted rate in the geographic area involved notwithstanding that the No Surprises Act specifies that other arbitration factors must also be considered.
On November 18, 2022, the Democratic and Republican leaders of the House Ways & Means Committee sent a letter to federal agencies that administer the No Surprises Act. The letter notes “serious concerns” about the implementation of the Act and states that “we are severely disappointed to find that the August 2022 final rule violates the No Surprises Act in the same ways as before.”
Another issue of interest under the Act is the requirement to furnish a “good faith estimate” (GFE) of the costs of particular health procedures in certain circumstances. Under the guidance provided by the Department of Health and Human Services (HHS) for 2022, providers were not required to furnish GFEs to patients for whom insurance coverage will be used, but “convening” providers and facilities were required to furnish GFEs to uninsured or “self-pay” patients. The agency did not, however, require “co-providers” and “co-facilities” to furnish GFEs for such patients to the convening providers and facilities. On December 2, 2022, HHS issued guidance stating that this exemption for co-providers and co-facilities will continue in 2023, although the exemption could end if the agency issues a new final rule. The guidance included the following statement: “HHS believes that to achieve industry-wide interoperability for the transmission of GFE data between convening providers and facilities and co-providers and co-facilities, the next step is for providers and facilities market-wide to adopt a standards-based application programming interface (API) for this purpose.”
MedPAC Recommendation on Physician Pay for 2024
The Medicare Payment Advisory Commission (MedPAC) held a meeting on January 12, 2023, and reportedly voted to recommend that Congress increase physician pay by 50 percent of the Medicare economic index (MEI). Presumably, this means that the 2024 conversion factor under the physician fee schedule would be updated by a percentage equal to half of the MEI percentage. It appears that the Medicare statute has not updated the conversion factor on the basis of the MEI percentage since 2007. MedPAC also reportedly recommended an additional increase for services provided to low-income Medicare patients.
Additional Information
For more information on any of the topics discussed in this section, please contact the chair of the OrthoForum Advocacy Committee, Dr. Richard Bruch, at rich.bruch@gmail.com.
Telehealth Flexibilities
Final Rule on Physician Fee Schedule: The 2023 PFS final rule (published on November 18, 2022) continues through the end of 2023 many of the Medicare telehealth flexibilities allowed during the Covid-19 public health emergency (PHE) for physical therapists (PTs) and occupational therapists (OTs), including CPT codes 97161-97164 for PTs, codes 97165-97168 for OTs, and therapy codes 97110, 97112, 97116, 97150, 97530, and 97542.
Further Extension by Congress: Congress, however, has recently taken action on these issues. The Consolidated Appropriations Act, 2023 (enacted December 29, 2022) included a provision that extends the telehealth flexibilities through December 31, 2024, including for the CPT codes noted above. Importantly, these policies regarding PTs and OTs are now written into the telehealth provisions of the Medicare statute, which increases the likelihood that they may become permanent policies.
Interaction of PFS Final Rule, Duration of Public Health Emergency, and Recent Congressional Action: Before the Consolidated Appropriations Act was enacted in December 2022, PTs and OTs would have ceased to be authorized as telehealth providers approximately five months after the end of the PHE. Now, however, they will continue to be telehealth providers through the end of 2024, even if the PHE ends well before then. As noted in the general policy issues section of the newsletter, HHS took action on January 11, 2023, to extend the PHE through mid-April 2023. It is unclear whether there will be any further extensions.
Other Provisions of the PFS Final Rule
Conversion Factor: As noted in the general policy issues section of the newsletter, the final rule set the 2023 PFS conversion factor at $33.0607, but Congress increased it by 2.5 percent. This results in a final conversion factor of $33.8872, which is a 2.08 percent cut from the 2022 conversion factor. In addition to this cut, the 2 percent sequestration cut under the Budget Control Act of 2011 remains in effect.
Direct Supervision Requirement: The Medicare “direct supervision” requirement is that, although the supervision need not be provided in the same room as the PT or OT, the supervising physician or practitioner must be “immediately available,” which normally does not allow virtual supervision. CMS, however, has during the PHE allowed virtual supervision through real-time audio/video technology. The final rule extends this virtual-supervision authority through the end of 2023. If the PHE ends sometime in 2023 (as expected), it is unclear whether CMS will extend the virtual-supervision authority into 2024.
Additional Legislation Regarding PTs and OTs
All bills introduced in 2021 or 2022—the 117th Congress—that were not enacted as of December 31, 2022, “died”. In order to be considered in the new Congress (the 118th), bills will have to reintroduced. As of mid-January, none of the bills supported by the Advocacy Committee in 2022 have been reintroduced. That does not indicate any lack of interest by Congress, however, as the Members were focused in January on issues such as deciding who serves on which committees and who will be the committee leaders.
Therapy Services Subcommittee
For more information on therapy services issues, or to join the Therapy Services Subcommittee of the OrthoForum Advocacy Committee, please contact Renee Duncan at: renee.duncan@orthotennessee.com.
CMS/CMMI Update
Action by Congress on Bonus Payments for Advanced Alternative Payment Models
The Medicare 5 percent bonus payment for advanced APMs will continue to be in effect for 2023 and 2024, but would no longer have applied for 2025 or later years. The Consolidated Appropriations Act, 2023 (enacted on December 29, 2022) amended the Medicare statute to provide a 3.5 percent bonus payment for 2025. Congress did not make any changes concerning payments under the Medicare Merit-based Incentive Payment System (MIPS).
CMMI Issues Updates on “Strategic Refresh” and Announces Strategy on Value-Based Specialty Care
On November 7, the CMS Innovation Center (CMMI) issued its latest report providing updates on implementation of its renewed strategic vision. The report builds on the Center’s “strategic refresh” released in October 2021, detailing CMMI’s progress and next steps on the new strategy’s five strategic objectives: drive accountable care; advance health equity; support innovation; address affordability; and partner to achieve system transformation. One of the key new strategies CMMI sets out focuses on creating greater care coordination between primary care doctors and specialists.
CMMI leadership, including Director Liz Fowler, Chief Strategy Officer Purva Rawal and others, published an accompanying blog post on November 7, announcing that the Center will focus on testing models and tools to improve access to high-quality, value-based specialty care as it enters the second year of its strategic refresh. The 2021 strategic refresh set a goal of getting all Medicare beneficiaries and a majority of Medicaid beneficiaries into accountable care organization (ACO) relationships by 2030. In pursuing this goal, CMMI seeks to examine and enhance payments for specialty care provided to beneficiaries.
CMMI outlines several challenges presented by specialty practice in value-based care models, including fragmented and costly care resulting from frequent diagnostics, imaging and other treatments delivered by specialists across varying sites. The authors also cite access barriers and challenges in scheduling specialist visits, reporting that beneficiaries most commonly cited long travel distance and out-of-pocket costs as barriers to specialty access. The authors also highlight ongoing trends of market consolidation, citing rapid vertical integration among specialty practices and the increasing shift to hospital employment as relevant factors impacting access to specialty care.
Based on key learnings from testing various payment models and discussions with industry experts, CMMI sets out a four-element strategy to test models and innovations that support access to high-quality, integrated specialty care across the patient journey:
Element 1: Enhance Specialty Care Performance Data Transparency.
CMMI found that the need for enhanced data and profiling tools to provide data on specialist performance emerged as a key theme in the development of the strategy. In the short term, CMS will refine and enhance specialist performance data and dashboards to support greater coordination and integration across primary and specialty care. In the long-term, CMS plans to develop and distribute industry standard definitions of condition-based episodes for ACOs to improve management of specialty care and to support subcontracting efforts with specialists.
Element 2: Maintain Momentum on Acute Episode Payment Models and Condition-Based Models.
CMS reports that stakeholders and experts have requested it design episode-based payment models to align incentives between specialists and ACOs. In the short term, CMMI announced it will extend the BCPI Advanced model through 2025, with technical revisions aimed at sustaining and growing participation. During the period that BPCI Advanced is extended, CMMI plans to test a new mandatory acute episode payment model that focuses on improving the beneficiary’s transition of care, while limiting overlap and facilitating a smooth transition back to their population-based, longitudinal providers.
Element 3: Create Financial Incentives within Primary Care for Specialist Engagement.
CMMI cites evidence of inefficiencies, poor quality of care and waste due to limited communication between primary care providers and specialists. In the short term, the Center intends to test strategies that incentivize integration and coordination between primary- and specialty care providers both before and after the point of initial referral. This could include increasing transparency on specialist performance to aid primary care physicians in making informed referrals and exploring the use of e-consults to support comprehensive care and potentially prevent unnecessary specialty referrals. In the long term, CMMI will examine capitated payments to specialists for defined conditions within the context of longitudinal, population-based models.
Element 4: Create Financial Incentives for Specialists to Affiliate with Population-based Models and Move to Value-Based Care.
Lastly, CMS sets out to create targeted financial incentives for ACOs to actively manage specialty care, including through possible beneficiary alignment changes. CMMI will also work with stakeholders to develop episode cost and quality measures specific to specialist-managed conditions:
· For hospital-affiliated ACOs, explore sub-population condition and procedure-based spending targets, layered underneath the ACO’s benchmark, to promote active longitudinal management of high-volume and costly conditions.
· For physician-affiliated ACOs, encourage specialists to meet sub-population condition and procedure-based spending targets with same risk and reward as hospital-affiliated ACOs.
In addition, CMMI released a supplemental document describing the rationale, methods, and limitations for data referenced throughout the report.
Additional Information
For more information on any of the topics discussed in this section, or to join the CMMI Subcommittee of the OrthoForum Advocacy Committee, please contact Wilford Gibson, MD at gibsonw@atlanticortho.com.
Ambulatory Surgery Center Update
OPPS-ASCs Final Rule
Conversion Factor: CMS published the OPPS-ASCs final rule on November 23, 2022. It set the 2023 ASC conversion factor at $51.854 for ASCs meeting the quality reporting requirements (higher than the proposed conversion factor of $51.315). This is an increase of $1.938 above the 2022 conversion factor of $49.916 (an increase of approximately 3.8 percent). For ASCs not meeting the quality reporting requirements, the conversion factor is $50.855. These 2023 conversion factors for ASCs are about 60.59 percent of the parallel conversion factors for hospital outpatient departments ($85.585 if meeting the quality reporting requirements and $83.934 if not).
Methodology for Annual Update to the Conversion Factor: Under current CMS regulations, 2023 is the last year for which CMS will update the ASC conversion factor on the basis of the productivity-adjusted hospital market basket (the same update methodology used for the HOPD conversion factor). For 2024, the update methodology will (as for years before 2019) be the Consumer Price Index for All Urban Consumers (CPI-U), which will likely have a significant negative effect on ASCs. The OrthoForum comment letter on the proposed rule urged CMS to continue using the productivity-adjusted hospital market basket on a permanent basis.
In the final rule, CMS stated:
[S]everal commenters requested that we amend our regulations to permanently increase ASC payment rates by the hospital market basket update. Comments from hospital associations recommended that we end our policy of providing the hospital market basket update after CY 2023 and that CMS should work to collect ASC cost data to determine a more appropriate update factor for ASC payment rates.
CMS explained that the purpose of using the hospital market basket for ASCs during the 5-ycar period 2019-2023 has been to “assess whether there is a migration of the performance of procedures from the hospital setting to the ASC setting as a result of the use of a hospital market basket update, as well as whether there are any unintended consequences, such as less than expected migration of the performance of procedures from the hospital setting to the ASC setting.”
In conclusion, the agency stated, “We intend to update the public on our assessment of service migration and other factors in the CY 2024 OPPS/ASC proposed rule.”
Therefore, it seems possible that, for 2024, CMS may continue using the hospital market basket for ASCs rather than returning to the use of the CPI-U.
ASC “Weight Scalar”: This mechanism (also sometimes referred to as the “secondary” scaler) is used by CMS to achieve budget neutrality in the ASC payment system. The system is based on the payment system for hospitals (OPPS). For hospitals, the agency scales the relative payment weights to achieve budget neutrality for the OPPS. Then, for the ASC system, CMS starts with the hospital scaled relative payment weights and then scales them again to achieve budget neutrality for the ASC system. This approach ensures that the only increases in the two payments systems are the result of updates to the conversion factor.
In the final rule, CMS stated, “Many commenters reiterated their past recommendation that we discontinue applying the ASC weight scalar to achieve budget neutrality.” The agency, however, did not accept this recommendation.
Inpatient-Only List; ASC Covered Procedures List: The final rule removed 11 procedures from the IPO list, including a spinal fusion code, CPT code 22632. It added eight procedures (new CPT codes).
With respect to the ASC CPL, the final rule added four procedures, which relate to mastectomy (CPT 19307); removal of intravascular vena cava filter (CPT 37193); biopsy or excision of lymph node(s) / open, inguinofemoral node(s) (CPT 38531); and laparoscopy (CPT 43774).
Advisory Panel on Hospital Outpatient Payment: The OrthoForum comment letter on the proposed rule urged CMS to include at least one representative from the ASC community in the membership of the advisory panel because the clinical integrity of the application of the relevant statutory factors also governs ASC payments and therefore are of critical importance to ASCs. The final rule noted that one commenter made this ASC “critical importance” point and responded to it:
[T]he Panel may also include a representative of a provider with ASC expertise, who advises CMS only on OPPS APC rates, as appropriate, impacting ASC covered procedures within the context and purview of the Panel’s scope. Interested individuals, including those with relevant ASC expertise, are encouraged to apply to serve on the Panel. Nominations for the Panel are currently being accepted in the new electronic application system, Medicare Electronic Application Request Information SystemTM (MEARIS). Interested individuals may submit nominations for themselves or others on https://mearis.cms.gov.
Narrow Hospital-Related Exception to Stark Law: The proposed rule would have created a new type of exception to the Stark Law for an ownership or investment interest in a “rural emergency hospital” (REH), a new type of Medicare provider created by Congress in December 2020. CMS proposed the exception because it was concerned that, without it, the Stark Law “could inhibit access to medically necessary designated health services furnished by REHs that are owned or invested in by physicians (or their immediate family members) and thwart the underlying goal of [Congress in creating REHs]”.
The final rule noted that many commenters objected to the creation of this new Stark exception. CMS decided not to finalize the proposal, stating that “we are persuaded that financial relationships permitted under the REH exception, as it was proposed, may present a risk of patient or program abuse [and] we agree with the commenters that the potential for cherry-picking and lemon-dropping, as well as other harms the physician self-referral law aims to deter, may persist in the REH context”.
ASC Subcommittee
For more information on ASC issues, or to join the ASC Subcommittee of the OrthoForum Advocacy Committee, please contact Teresa Copeland at: teresa.copeland@orthotennessee.com.
Cybersecurity “Recognized Security Practices” Regarding Mitigation of HIPAA Civil Money Penalties
Posting of RFI Comment Letters: As noted in previous newsletters, the HHS Office for Civil Rights (OCR) published a request for information (RFI) on April 6, 2022, concerning the implementation by OCR of a law enacted in January 2021 (Public Law 116-321) that included provisions authorizing OCR to “mitigate” HIPAA civil money penalties imposed on covered entities if they have implemented “recognized security practices”. This law is fully in effect even without any implementing guidance or regulations from OCR.
On October 24, 2022, OCR posted on the regulations.gov site all the comment letters it received in response to the RFI (approximately 71). See here.
The OrthoForum submitted a letter responding to this RFI on June 6, 2022. The letter emphasized that OCR should consider recognized security practices (RSPs) to include the encryption and destruction standards identified in 2009 by OCR guidance relating to the section under the HITECH Act that requires covered entities to send notifications to patients and HHS if there has been a breach of “unsecured” “protected health information” (PHI). With respect to the mitigation of civil money penalties under the January 2021 law, the letter continued that HIPAA covered entities that are following these HITECH standards created by OCR should not be subject to such penalties for PHI breaches resulting from cyberattacks.
The OrthoForum comment letter was among the letters posted on October 24. See here.
OCR Preliminary Response to RFI Comment Letters: As of mid-January 2023, OCR had not issued any guidance or regulations to implement the January 2021 law. It did, however, release a video in late October 2022 that provided some information relating to its views on that law. See here:
The law expressly provided that RSPs include approaches under section 2(c)(15) of the National Institute of Standards and Technology (NIST) Act or section 405(d) of the Cybersecurity Act of 2015. OCR discussed these two RSP categories in its video.
There is also a third statutory RSP category: “other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities.”. The OrthoForum comment letter stated that OCR should consider this “other” category to include the HIPAA guidance issued in 2009 concerning technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized persons. Those technologies and methodologies render PHI “secured”. Under the HITECH Act, if there is a breach of “unsecured” PHI, covered entities must provide certain breach notifications (as noted above).
With respect to this “other” RSP category, the OCR October video did not address the issue of whether it includes the 2009 HITECH guidance on “secured” PHI. The video states that, if a covered entity claims it has implemented RSPs in the “other” category, it must provide OCR with a citation to the particular law or regulation that creates the RSPs.
There are in fact citations to the HITECH Act and to the Federal Register that expressly concern the 2009 HITECH guidance referred to above; therefore, that guidance should be considered to be in the “other” category.
The video also emphasizes that a covered entity must provide details on how it has implemented RSPs and also evidence that the RSPs have been fully implemented for at least 12 months throughout the organization. OCR notes that merely having an RSP binder on a shelf is not evidence of having implemented RSPs. The types of implementation evidence include (but are not limited to) RSP policies and procedures; project plans and meeting minutes; diagrams and narrative details; training materials; application screenshots and reports; and vendor contracts and statements of work.
OCR emphasized that RSPs are not a “safe harbor”. Even though they have been implemented for at least 12 months, a civil money penalty could still be imposed. In contrast, the OrthoForum comment letter took the position that, if an entity is in full compliance with the 2009 HIPAA guidance on “secured” PHI, no penalty should be imposed.
If OCR initiates an investigation or audit of a covered entity, it will send the covered entity a “data request” stating that the entity has the option to provide evidence that RSPs have been implemented for at least 12 months.
OCR emphasized that not providing any evidence of RSP implementation will in no way count against a covered entity. Implementing RSPs is a totally voluntary matter.
Importantly, OCR seemed to take the position in the video that the RSPs can only mitigate penalties for violations of the HIPAA Security Rule regulations, not the HIPAA Privacy Rule regulations. That interpretation appears to be narrower than the text of the January 2021 law. If OCR finalizes this interpretation, it may have the effect that the RSP mitigation law would not apply to HIPAA civil money penalties imposed for breaches of PHI.
OrthoForum Cybersecurity Draft Legislation
As noted in previous newsletters, the OrthoForum Advocacy Committee has written a draft bill that would protect physician group practices (PGPs) from breach-related HIPAA civil money penalties when the PGPs have undergone a third-party audit to confirm their compliance with the HITECH cybersecurity encryption and destruction standards identified in the OCR 2009 guidance discussed above.
The draft bill also states that HIPAA covered entities would be required to report cyberattacks and ransom payments to HHS, not to the Cybersecurity and Infrastructure Security Agency (CISA), which is part of the Department of Homeland Security. HHS would have an agreement with CISA about sharing information from these reports. This portion of the draft bill is a response to a law enacted in March 2022 that (once CISA issues a final rule) will require critical-infrastructure entities to submit a cyber-incident report to CISA within 72 hours after the entity reasonably believes that a “substantial cyber incident” has occurred. In addition, ransom payments made due to a ransomware attack must be reported to CISA within 24 hours after making the ransom payment.
During the virtual meeting of the Advocacy Committee on January 5, 2023, there was a discussion about whether to modify the current strategy for seeking support for the draft bill in Congress. Further discussions on this matter will take place at the in-person meeting of the Committee on February 23, 2023, at the OrthoForum Annual Conference (which well be held in Phoenix).
Additional Cybersecurity Updates
• Senator Mark Warner (D-VA) reportedly plans to introduce healthcare-focused cybersecurity legislation within the next few months, in part because he believes that increased protections are important for the safety of patients and that HHS should have a stronger role in federal cybersecurity matters.
• In November 2022, Senator Warner issued a related report, which presumably will be the basis for his planned bill. See here.
• Thus far in the new Congress (118th), it appears that only one healthcare-focused cybersecurity bill has been introduced (H.R. 286). Although it mentions cybersecurity, it also concerns security issues generally. It would authorize HHS to make grants to providers “to pay for security services and otherwise enhance the physical and cyber security of their facilities, personnel, and patients to ensure safe access.”
Additional Information
For more information on any of the topics discussed in this section, please contact the chair of the Cybersecurity Subcommittee of the OrthoForum Advocacy Committee, Scott Paneitz, at spaneitz@SignatureHealth.net.
Political Update
As we finalize this update, the House and Senate are still working out new committee assignments in the new Congress (the 118th). Therefore, rather than writing about recent news in Congress, we are focusing on the results of the 2022 elections and the outlook for the 2024 cycle, already the subject of much conversation and speculation in political circles.
Senate
At the beginning of the 118th Congress, the Senate, as you may have noticed, has been the more low-key of the two chambers of Congress. For the first time since 1914, every incumbent who ran for re-election won.
In the 2022 elections, just one seat changed parties—Pennsylvania—which went from Republican to Democratic, giving Democrats a 51-49 majority. Only one Democratic senator retired—82-year-old Patrick Leahy—who is being succeeded by 75-year-old Rep. Peter Welch.
But everyone on Capitol Hill is aware that the 2024 election cycle, which is already underway, could be much more favorable for Republicans. The third of the Senate that is up for re-election this cycle provides Republicans with an excellent chance to take the majority.
The first piece of good news for Republicans is that, of the 33 senators up for re-election, 23 are Democrats (including two Independents who caucus with Democrats), and just 10 are Republicans. It’s always easier to defend fewer seats.
The second piece of good news for the GOP is that all 10 Republicans in the 2024 class are running in states that Trump won—twice. State preferences for the Senate tend to align with presidential preferences. (Ninety-five senators belong to the party that their state supported for president in the last election.)
More favorable news for Republicans—the three Senate Democrats who represent states that Trump won are up for re-election. Defending seats in Ohio, Montana and West Virginia will be a tremendous challenge.
Democrats will also have to defend seats in states Biden barely won: Wisconsin, Pennsylvania, Nevada, Arizona, and Michigan.
Democrats’ resources are likely to be diverted by a rare open seat race in California. Although Senator Dianne Feinstein hasn’t announced her retirement yet, a Democratic congresswoman declared her candidacy in January, with more to follow. If Feinstein serves out her term and doesn’t run again, then this is likely to be the most expensive Senate primary in history. The general election may be very costly as well, because California’s top-two primary system may result in a Democrat v. Democrat general election, as was the case when Feinstein last ran in 2018.
All of that is good news for Republicans. They have very little chance of winning a California Senate race, but money spent by Democratic donors on California races is money diverted from other states.
Further improving conditions for Republicans, Arizona senator Kyrsten Sinema has changed her party affiliation from Democrat to Independent. As a third-party candidate, she could throw the race to a Republican.
Finally, at least for now, Michigan Democrat Debbie Stabenow has announced that she will not run for re-election, creating an open seat in a swing state.
We believe that the election forecast means that we’ll see a relatively cooperative atmosphere in the Senate, as the members of each party know that their positions are likely to be reversed in two years.
It may also help that the most prominent potential presidential candidates on the Republican side, starting with Donald Trump and Florida governor Ron DeSantis, are not senators.
House of Representatives
The outlook for the 2024 House cycle looks very different. Republicans now have a 222-213 majority—a nine-seat margin—when the one House seat currently vacant is filled.
That’s the same margin Democrats had two years ago, but the House caucus was unified behind Speaker Nancy Pelosi, and was able to legislate with virtually no defections. That’s in part because a Democrat in the White House meant that many of the bills the House passed were bound to become law.
House Speaker Kevin McCarthy can’t afford to lose more than five of his members on any vote, which means that individual Republican congressmen will have an inordinate amount of power.
A nine-seat Republican majority is likely to produce a different dynamic, as the election for Speaker illustrated. The Republican caucus is more contentious, and with a Democrat in the White House, Republicans know that most of their priorities will not become law. Republicans have announced that their focus in the House will be on investigations and oversight, activities that they can conduct without Democratic cooperation.
The most important fact to know with respect to the 2024 House cycle is that Republicans now hold 18 seats in congressional districts that Joe Biden won in 2020, and Democrats hold 5 seats in districts that Donald Trump won. That seems to favor Democrats. However, if you look at the congressional districts that were most competitive in the last presidential election (where Biden got between 47 percent and 55 percent of the vote), there are 75, of which Democrats hold 41—meaning that they have more to lose.
Conclusion
Ultimately, the outcome of the 2024 congressional election cycle will depend to a large degree on the presidential race. Unless something changes radically, Joe Biden will again be the Democratic nominee. The Republican race is the wild card, and we’re definitely not going to speculate on how that will play out.
