HIPAA Privacy Rule to Support Reproductive Health Care Privacy
In April, the Health Insurance Portability and Accountability Act (HIPAA) added requirements for the better protection of reproductive healthcare data. The ruling of the Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR), addresses the concerns of protecting patient confidentiality and preventing medical records from being used against individuals providing or obtaining lawful reproductive health care.
The final rule prohibits covered entities, such as healthcare providers, health plans, healthcare clearinghouses, and business associates from using or disclosing protected health information (PHI) for certain purposes related to penalizing a person for accessing, seeking access to, or facilitating reproductive health care.
Attestation
Covered entities and business associates that receive a request for PHI potentially related to reproductive health care must obtain a signed attestation that the use or disclosure is not for a prohibited purpose. The attestation will include a statement that a person may be subject to criminal penalties for obtaining individually identifiable information in violation of HIPAA. The OCR will publish model attestation language before the compliance effective date, and at that time, WebTPA will update its policies and procedures for responding to requests for PHI.
Notices of Privacy Practices (NPPs)
Clients will be required to update NPPs, so that the notices contain examples of prohibited uses and disclosures of PHI in terms of reproductive health care and the purpose of the attestation requirement. The final rule also requires NPP revisions to include proposed requirements in the Notice of Proposed Rulemaking for the Confidentiality of Substance Use Disorder Patient Records, also referred to as “Part 2 NPRM.”
Compliance Dates with Final Rule
The final rule was effective on June 25, 2024, and covered entities and business associates will have 180 days beyond the effective date, or until December 23, 2024, to comply with provisions. Separately, the effective date for including the reproductive and substance use disorder provisions within the NPPs is February 16, 2026, to align with the compliance date for the updated Part 2 NPRM regulations. The Departments decided on the separate effective date for the NPP additions, so they could be added in tandem and not rolled out as two NPP updates within 12 months of each other.
The HHS Fact Sheet can be accessed here for your additional review of the topic.
ACA Preventive Care Mandate Remains in Place After Latest Court Ruling
On June 21, a federal appeals court ruled on the validity of the Affordable Care Act’s (ACA) preventive services mandate. As background, the ACA requires group health plans to provide preventive services without cost sharing, defining “preventive services” as evidence-based items and services recommended by the Unites States Preventive Services Task Force (USPSTF), the Health Resources and Services Administration (HRSA), and the Advisory Committee on Immunization Practices (ACIP).
In 2022, a U.S. District Court in Texas held that members of the USPSTF were not constitutionally appointed and therefore did not have the authority to determine what preventive services are required by the ACA. The case in question involved a Christian-owned business, Braidwood Management, Inc. that claimed the requirement to cover HIV preventive drugs was a violation of its religious freedom. The court sided with Braidwood and vacated all actions that HHS has taken since March 23, 2010, to implement or enforce the USPSTF recommended requirements and blocked HHS from further enforcement. HHS appealed the decision, and a stay was issued, putting the court’s ruling on hold.
The U.S. 5th Circuit Court of Appeals has now affirmed the Texas court’s ruling that the USPSTF’s members are not validly appointed and that HHS cannot enforce preventive service coverage requirements, however, its decision is only applicable to the challengers in this case, and not nationwide.
The appeals court also did not rule on whether the members of the ACIP or HRSA were also unconstitutionally appointed and instead sent the case back to the U.S. District Court in Texas.
Because this decision is specific to Braidwood Management, Inc. the ACAs requirement for health plans to cover without cost-sharing the preventive services recommended by the USPSTF remains intact. WebTPA will be watching this litigation closely, as it is expected that the case will ultimately be sent to the Supreme Court.
High Deductible Health Plan Updates for 2025 plans
The federal government released HDHP limits recently for 2025 plan years as follows:
The maximum HSA contribution for individuals with self-only HDHP coverage is $4,300, and the maximum HSA contribution for individuals with family HDHP coverage is $8,550. Please make sure to review these limits when making updates to your HDHP plans for the 2025 renewal.
COVID-19 Coverages Under HDHPs in 2025
For plan years beginning January 1, 2025, HSA qualified HDHPs will no longer be permitted to cover COVID-19 testing and treatment prior to the minimum deductible being met, without jeopardizing a participant’s HSA eligibility. WebTPA’s 2025 Compliance Checklist includes this information, and the checklist will be provided to health plans by your Account Management team when preparing for your upcoming 2025 renewal.
PCORI Fees
One final reminder that the annual PCORI fees are due July 31, 2024. For a plan year ending between January 1, 2023, and September 30, 2023, the fee is $3.00 per covered life and for a plan year ending between October 1, 2023, and December 31, 2023, the fee is $3.22 per covered life.
If you have any questions on the above information, please reach out to your Account Team.