backNinth Circuit’s Unanimous Decision in Favor of Empire Health Foundation Vacating Medicare’s 2005 Disproportionate Share Regulation Regarding Unpaid Part A Days is Now Effective – On October 28, 2020, after previously denying the Secretary of Health and Human Services’ (HHS) request for en banc review, the Ninth Circuit issued a mandate rendering effective its unanimous panel decision on behalf of Empire Health Foundation. In that decision, the Ninth Circuit vacated CMS’s 2005 amendment to its disproportionate share (DSH) regulation in which CMS sought to treat days for which Medicare Part A made no payment, such as exhausted benefit days, as nonetheless being “days entitled to benefits under Part A.” Because the Ninth Circuit vacated HHS’s 2005 amendment to the DSH regulation, and vacatur is not limited to a specific plaintiff or to a specific geography, this decision could directly benefit DSH hospitals throughout the country. Empire Health was represented by the author of this article, King & Spalding healthcare partner Dan Hettich.
CMS’s vacated policy of treating days for which Medicare Part A made no payment as nonetheless being “entitled to benefits under Part A” tended to systematically decrease payments to hospitals that treat a disproportionate share of indigent patients for several reasons. One primary reason is that many patients that have exhausted their Medicare benefits are eligible for Medicaid, but patients who are considered “entitled to benefits under Part A” are categorically excluded from the DSH Medicaid fraction. The Ninth Circuit, however, held that CMS’s policy violated the plain language of the DSH statute because the statute clearly defined “entitled” to mean the right to payment,and not merely potential eligibility for benefits, under Part A. Because the Ninth Circuit held that CMS’s DSH policy violated the plain language of the statute, the decision is not time-limited and CMS cannot attempt to “correct” the issue through further rulemaking, whether retroactive or otherwise.
In vacating the policy, the Ninth Circuit cited University of California v. DHS, 908 F.3d 476, 511 (9th Cir. 2018), in which the Ninth Circuit specifically upheld a district court’s nationwide injunction of the Department of Homeland Security’s rescission of the DACA Program based on an arbitrary-and-capricious finding under the APA.
Given the potential scope of the Ninth Circuit’s decision, all hospitals that receive DSH payments should carefully consider the potential implications of the decision on their specific circumstances and the concrete steps they need to take in order to take advantage of this favorable development.
Reporter, Daniel (Dan) J. Hettich,Washington, D.C., +1 202 626 9128, dhettich@kslaw.com.
Hospitals Facing New Ransomware Challenges – Ransomware has risen to “worst nightmare” status for many organizations, particularly in the healthcare industry. While it has been lurking for many years, recently ransomware has emerged as one of the most virulent cybersecurity risks, affecting public and private sectors alike. Ransomware attacks have become more focused, sophisticated, costly, and numerous. Threat actors have shifted their tactics and techniques to include the destabilizing combination of encryption (sometimes including backups), data exfiltration, and company-shaming to attempt to, and sometimes successfully, extract sizable payments from their victims.
A recent New York Times article, “How Ransomware Puts Your Hospital at Risk,” notes that: “Even before the pandemic, hospitals were an increasingly popular target for ransomware and other types of cyberattacks, because they need to be able to operate constantly, providing patient care 24 hours a day. Any interruption to their networks must be resolved as quickly as possible, making them ideal targets for ransomware, in which attackers promise to restore their systems immediately in exchange for cryptocurrency payments.”
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and HHS recently coauthored a joint cybersecurity advisory, “Ransomware Activity Targeting the Healthcare and Public Health Sector,” which describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health Sector (HPH) to infect systems with ransomware for financial gain. CISA, FBI, and HHS announced that they have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers.
Facing a ransomware event can be very disruptive and pose significant risks, so organizations must be prepared. That means considering hard questions in advance of any attack, such as whether to endorse a “no pay” policy or to be prepared to pay if necessary. There are no easy answers to the difficult question of whether to pay. Our recent Client Alert, “Ransomware: To Pay or Not to Pay” discusses how organizations must balance the potential near-term benefit of decrypting data, which is not always guaranteed, against the risk of legal exposure for making a payment to a prohibited person or entity – not to mention the risk of increased targeting by threat actors once a payment has been made. Waiting until “right-of-boom” to assess these issues only will complicate the situation. Organizations should have a plan in place before an attack occurs.
In addition to planning whether and how to pay, organizations should update their incident response plans (IRPs) to address other unique decision points implicated by a ransomware attack. Often such IRP updates take the form of a ransomware addendum. And to truly understand how that ransomware plan works, organizations should tabletop realistic ransomware scenarios. As this Cybersecurity Law Report article on “Tips and New Benchmarks for Creating Effective Tabletop Exercises” points out, these exercises ensure company leaders can communicate safely and securely and are able to interact in an organized way to make critical decisions. Companies have been introducing realistic cybercrime scenarios, such as ransomware and ransomed denial of service (RDOS) attacks, in their exercises both to test the ability to respond, and to raise awareness within the organization about how to deal with them.
Although there is no fool-proof solution yet, preparedness is the key. Hospitals should plan and discuss how these attacks will be handled, and what measures the hospitals can take to ensure continued operations in the meantime. For more information, contact the authors of this article, King and Spalding partners Robert Cooper and Phyllis Sumner.
Reporters, Robert (Bob) M. Cooper, Washington, D.C., +1 202 626 8991, rcooper@kslaw.com and Phyllis B. Sumner, Atlanta, +1 404 572 4799, psumner@kslaw.com.
CMS Implements Requirements that Medicare and Most Private Health Plans Cover COVID-19 Vaccines Without Cost-Sharing Requirements – On October 28, 2020, CMS released an interim final rule with comment period (IFC) that implements several CARES Act requirements to prepare for the availability of a COVID-19 vaccine. Among other changes, the IFC establishes that COVID-19 vaccines that are authorized or approved by the FDA will be covered by Medicare Part B without co-pays or deductible. The IFC also implements CARES Act provisions that require most private health plans to cover a COVID-19 vaccine without cost-sharing requirements. The IFC also establishes that Medicare will provide enhanced payment to hospitals for new products authorized or approved to treat COVID-19 in the inpatient and outpatient settings.
Medicare beneficiaries will not pay cost-sharing amounts for COVID-19 vaccines. The CARES Act provides for coverage of a COVID-19 vaccine and its administration under Medicare Part B without any beneficiary cost sharing, beginning on the date that such vaccine is licensed pursuant to a Biologics License Application (BLA) under section 351 of the Public Health Service (PHS) Act (42 U.S.C. § 262). As explained in the IFC, CMS is considering any vaccine for which the FDA has issued an Emergency Use Authorization (EUA) during the Public Health Emergency (PHE), when furnished consistent with the terms of the EUA, to be eligible for Medicare coverage and payment. In other words, any vaccine that receives FDA authorization or approval, either through an EUA or a BLA, will be covered under Medicare Part B as a preventive vaccine with no beneficiary cost sharing.
As permitted by the CARES Act, CMS intends to announce coding and payment for FDA authorized or approved vaccines and administration by issuing program instructions to providers and suppliers.
Members of most private health plans will not pay cost-sharing amounts for COVID-19 vaccines. The CARES Act requires non-grandfathered group health plans and health insurance issuers offering non-grandfathered group or individual health insurance to cover, without cost sharing, qualifying coronavirus preventive services, including COVID-19 immunizations. The IFC amends existing regulations to implement requirements intended to ensure rapid coverage of qualifying coronavirus preventive services. Specifically, these plans and issuers are required to cover:
- Qualifying coronavirus preventive services, without cost-sharing, regardless of whether an in-network or out-of-network provider delivers such services;
- COVID-19 immunizations that have in effect a recommendation of the CDC’s Advisory Committee on Immunization Practices (ACIP) with respect to the individual involved; and
- Items and services that are integral to the furnishing of recommended preventive services, without cost-sharing, including the administration of COVID-19 immunizations.
Covered plans and issuers must provide this coverage within 15 business days after the date on which the United States Preventive Services Task Force or the ACIP makes an applicable recommendation.
IFC establishes enhanced Medicare payment for hospital services involving new products used to treat COVID-19. The IFC establishes a new technology add-on payment under the Inpatient Prospective Payment System (IPPS) for eligible COVID-19 cases that involve the use of new products authorized or approved to treat COVID-19. The add-on payment (which will be excluded from the calculation of the operating outlier payments) will be equal to the lesser of the following amounts:
- 65 percent of the operating outlier threshold for the claim; or
- 65 percent of the amount by which the costs of the case exceed the standard DRG payment (including the 20 percent add-on payment under the CARES Act) for eligible cases.
CMS will issue operational instructions on how eligible cases of COVID-19 will be identified. CMS also warns hospitals not to seek additional payment on claims for drugs or biologicals procured or provided by the government to a provider at no cost to the provider to diagnose or treat patients with known or suspected cases of COVID-19.
Under the Outpatient Prospective Payment System (OPPS), CMS is excluding drugs and biologicals (including blood products) that have been approved or authorized by the FDA to treat or prevent COVID-19 from being included in the Comprehensive Ambulatory Payment Classification (C-APC) payment when billed on the same claim as a primary C-APC service. Medicare will pay for these drugs and biologicals separately throughout the remainder of the PHE. This separate payment will result in an additional copay of 20 percent of the cost of the new COVID-19 treatment.
The interim final rule is available here, and the CMS fact sheet is available here.
Reporter, Kyle Gotchy, Sacramento, +1 916 321 4809, kgotchy@kslaw.com.
HHS Releases New Frequently Asked Questions Regarding CARES Act Provider Relief Funds – Last week, HHS released over sixty new Frequently Asked Questions (FAQs) regarding payments distributed to providers via the CARES Act Provider Relief Fund. The FAQs cover a wide range of topics, including sharing funds between subsidiaries, using funds for COVID-19 vaccines, the Phase 3 General Distribution application, and more.
The new FAQs broadly discuss the following general categories: (1) attestation; (2) rejecting payments; (3) terms and conditions; (4) ownership structure and financial relationships; (5) auditing and reporting requirements; and (6) Phase 3 General Distribution. Particularly significant is that the FAQs explain that a subsidiary entity that applied and attested to accepting payment under its own tax identification number (TIN) can now transfer its General Distribution payment to its parent TIN. The parent entity can then allocate general distribution funds at its discretion to its subsidiaries, though it will be required to substantiate that these funds were used for increased healthcare-related expenses or lost revenue attributable to COVID-19. Furthermore, regardless of which entity (the parent or subsidiary) attested to the receipt of the General Distribution payments, the parent entity can report on the use of the General Distribution payment as part of the HHS reporting process.
The FAQs also explain that relief fund payments may be used to support distribution of a COVID-19 vaccine licensed or approved by the FDA. Funds may also be used ahead of an FDA-licensed or approved vaccine becoming available–this may include using funds to purchase additional refrigerators, personnel costs to provide vaccinations, and acquiring doses of a vaccine (including transportation costs not otherwise reimbursed).
The deadline to submit an application under the Phase 3 General Distribution is November 6, 2020 at 11:59 PM EST for those that have had their TIN validated in Phase 2 or received funds as part of Phase 1. Providers that have not yet received any General Distribution payments must submit their TIN for validation by November 6, 2020 at 11:59 PM EST, and they will have until November 27, 2020 at 11:59 PM EST to submit an application once their TIN has been validated.
The complete FAQ document is available here.
Reporter, Ahsin Azim, Washington, D.C., +1 202 626 9262, aazim@kslaw.com.
Transparency in Coverage Final Rule Requires Insurance Disclosure to Consumers – On October 29, 2020, HHS, the Department of Labor, and the Department of Treasury (the Departments) jointly issued a final rule requiring health plans to disclose price and cost-sharing information to participants, beneficiaries, enrollees and the general public. This rule builds upon prior price transparency rules requiring hospitals to disclose their standard charges, including negotiated rates with third-party payers.
This final price transparency rule applicable to health plans includes two approaches to make more healthcare price information accessible to consumers:
- Most non-grandfathered group health plans and health insurance issuers will be required to disclose to participants, beneficiaries, and enrollees, their personalized out-of-pocket cost information, and the underlying negotiated rates, for all covered healthcare items and services, including prescription drugs, through an internet-based self-service tool and in paper form upon request. Beginning January 1, 2023, health plans will be required to publish an initial pricing list of 500 shoppable services, as determined by the Departments, that must be disclosed on the health plan’s website using a self-service tool. Beginning January 1, 2024, health plans will be required to disclose pricing information for all remaining items and services using the same online self-service tool.
- Beginning January 1, 2022, most non-grandfathered group health plans and health insurance issuers must disclose on their websites three separate machine-readable files that include detailed pricing information for all covered items and services offered to enrollees. The first file must show negotiated rates for all covered items and services between the plan or issuer and in-network providers. The second file must show both the historical payments to, and billed charges from, out-of-network providers. The third file must detail the in-network negotiated rates and historical net prices for all covered prescription drugs by plan or issuer at the pharmacy location level.
This final rule is the latest effort by the Trump administration to increase what is known as price transparency in health care. A copy of the executive order on “Improving Price and Quality Transparency in American Healthcare to Put Patients First” can be found here. Additional information regarding the final rule on hospital price transparency can be found in the Health Headlines November 18, 2019 article entitled “CMS Finalizes Rule on Hospital Price Transparency and HHS Proposes New Rule on Health Plan Price Transparency.”
A copy of the October 29, 2020 final rule can be found here, and the CMS fact sheet can be found here.
Reporter, Kathryn T. Han, Los Angeles, +1 213 443 4336, khan@kslaw.com.
ONC Interim Final Rule Delays Information Blocking Requirements – On October 30, 2020, the Office of the National Coordinator for Health Information Technology (ONC) issued an interim final rule (IFR) with comment period delaying the compliance dates for certain regulatory requirements set forth in the May 1, 2020 final rule implementing the information blocking, interoperability, and Health IT Certification Program (the Cures Act Rule). The new compliance date for the information blocking prohibition is April 5, 2021. The IFR also extends compliance dates in the ONC Health IT Certification Program, updates standards and clarifies regulatory text for certain certification criteria and makes technical corrections.
Under the IFR, the new compliance dates are as follows:
April 5, 2021:
- Information blocking provisions, applicable to all actors, including healthcare providers (45 CFR Part 171)
- Information Blocking Conditions and Maintenance of Certification (CoC/MoC) requirements (§ 170.401)
- Assurances CoC/MoC requirements (§ 170.402, except for § 170.402(b)(2) as it relates to § 170.315(b)(10))
- API CoC/MoC requirement (§ 170.404(b)(4)) - compliance for current API criteria
- Communications CoC/MoC requirements (§ 170.403) (except for § 170.403(b)(1))
December 31, 2022:
- 2015 Edition health IT certification criteria updates (except for § 170.315(b)(10) – electronic health information (EHI) export, which is extended until December 31, 2023)
- New standardized API functionality (§ 170.315(g)(10))
One Calendar Year Extension
- Submission of initial attestations (§ 170.406)
- Submission of initial plans and results of real-world testing (§ 170.405(b)(1) and (2))
The new compliance dates are codified into the regulations, removing the need for ONC’s enforcement discretion announced in April 2020.
The press release accompanying the IFR includes a quote from the National Coordinator for Health IT, stating, “[t]o be clear, ONC is not removing the requirements advancing patient access to their health information that are outlined in the Cures Act Final Rule. Rather, we are providing additional time to allow everyone in the health care ecosystem to focus on COVID-19 response.” Thus, providers are expected to continue working toward compliance with the requirements of the Cures Act Rule.
The IFR does not provide any new information on the timing of enforcement by OIG, which is expected to begin at some point after OIG finalizes its proposed rule.
ONC’s press release is available here, and the IFR is available here.
Reporter, Igor Gorlach, Houston, + 1 713 276 7326, igorlach@kslaw.com.
Federal Government Approves Georgia’s State Relief and Empowerment Waiver – On November 1, 2020, CMS and the Department of the Treasury approved Georgia’s request for a 1332 State Relief and Empowerment waiver (1332 waiver), permitting the state to implement a new healthcare plan to address growing healthcare access and affordability challenges facing Georgia residents. Section 1332 waivers permit states to implement new ways to provide access to healthcare that are currently not possible under the Affordable Care Act (ACA), as long as the new plan: (1) is as comprehensive and affordable as would be provided absent the waiver; (2) provides coverage to a comparable number of residents as would be provided absent the waiver; and (3) does not increase the federal deficit.
Currently, Georgia has one of the highest uninsured rates in the country at 13.7 percent, resulting in approximately 1.38 million uninsured people. The high uninsured rate has been attributed to numerous factors, including high premiums and out-of-pocket expenses, in addition to low carrier participation in the individual market in certain areas of the state. From 2016 to 2019, total individual market enrollment on the Federal Exchange in Georgia declined over 22 percent.
Georgia’s new healthcare program consists of two phases. Beginning in plan year 2022, Georgia will implement a reinsurance program that is expected to reduce annual premiums in the individual market by an average of 10 percent. During the second phase, Georgia’s individual market will be transitioned from the Federal Exchange to a private sector platform, the Georgia Access Model, beginning in Payment Year 2023. Through the Georgia Access model, health insurance consumers will shop for and buy coverage directly from insurers or through web brokers. Certain eligible consumers will be able to enroll in the subsidy-eligible qualified health plans and be assessed for Medicaid and the Children’s Health Insurance Program (CHIP) eligibility, simultaneously.
CMS’s news release regarding approval of Georgia’s 1332 waiver is available here, and the recent approval builds on its earlier approval of Georgia’s Section 1115 demonstration project to partially expand Medicaid coverage for adults who participate in certain qualifying activities like work and education.
Reporter, Jennifer Siegel, Washington D.C., + 1 202 626 5595, jsiegel@kslaw.com.
HHS to Distribute $333 Million in Performance Incentive Payments to Nursing Homes for Curbing COVID-19 Infections and Deaths – On October 28, 2020, HHS announced that it would distribute $333 million to nursing homes that demonstrated significant reductions in COVID-19-related infections and deaths in September. “These $333 million in performance payments are going to nursing homes that have maintained safer environments for residents between August and September,” said HHS Secretary Alex Azar. This is the first of four rounds of performance incentive payments that HHS plans to make to nursing homes by the end of 2020 for curbing COVID-19 infections and deaths.
Funding for these payments comes from the $175 billion Provider Relief Fund created by the Coronavirus Aid, Relief, and Economic Security (CARES) Act and the Paycheck Protection Program and Health Care Enhancement (PPPCHE) Act. HHS announced in early September that it was allocating $2 billion from the Provider Relief Fund to make targeted performance incentive payments to nursing homes in the final quarter of 2020.
The performance incentive payments will be distributed over four monthly performance periods, spanning from September to December 2020. Whether a nursing home qualifies for payment in a given period, and the amount of payment it will receive, depends on its COVID-19 infection and mortality rates, as measured by data from the National Healthcare Safety Network (NHSN) Long Term Care Facility (LTCF) COVID-19 module. To qualify for payment in a given period, a nursing home must have a rate of COVID-19 infections that fall below the rate of infection in the county in which it is located, and a rate of COVID-19 deaths below a nationally established performance threshold.
In September 2020, 10,501 out of 13,795 nursing homes (76 percent) met the infection and mortality criteria to qualify for payment. These facilities will receive payments in the first week of November. A state-by-state breakdown of the first round of performance incentive payment distributions is available here.
Reporter, Alek Pivec, Washington D.C., +1 202 626 2914, apivec@kslaw.com.