The HIPAA Omnibus Final Rule changes go into effect on September 23. Covered entities have been required to provide Notice of Privacy Practices for several years. Those notices need to be revamped. The Final Rule clarifies and expands the obligation to report breach of protected health information (PHI) to patients. Covered entities must specifically notify patients of a right to be informed of breach. More importantly, there will now be a rebuttable presumption of breach unless the covered entity can show through a four-factor test that there is a low probability of PHI compromise.
There are also requirements for the notice of disclosures to health plans, marketing and sale of PHI, and the right to opt out of communications.
These are considered material changes, thus it is important to revise the notice to reflect the changes and make it available.
There has been more political jockeying this week related to the ACA. A week after the White House announced that it would delay implementation of the play-or-pay rule for large employers to provide health insurance coverage by one year, House Republicans have called for a similar delay in the individual mandate. The mandate is expected to play a significant role in getting uninsured people signed up for health coverage. Outside of a few limited categories of people, the mandate applies to most everyone in the United States.
There is no indication that such a delay will occur. Jay Carney, spokesman for the Obama administration, responded, “A piece of legislation like [the ACA], to be responsibly implemented, needs to be implemented in a flexible way.”
In a surprising announcement this week, the Obama administration delayed implementation until 2015 of the requirement that large employers provide coverage for workers. The Affordable Care Act establishes penalties for companies with more than 50 employees that fail to offer affordable health insurance. Those penalties were set to commence in 2014 but are now delayed.
On the White House blog, Valerie Jarrett wrote yesterday about simplified reporting procedures, “[W]e believe we need to give employers more time to comply with the new rules. Since employer responsibility payments can only be assessed based on this new reporting, payments won’t be collected for 2014. This allows employers the time to test the new reporting systems and make any necessary adaptations to their health benefits while staying the course toward making health coverage more affordable and accessible for their workers.”
Rising health insurance premiums have plagued employers for several years. There is significant fear over future costs. Upcoming requirements under the Affordable Care Act will place employers in a position of balancing those costs with potential federal penalties.
Beginning in 2014, large employers may be penalized if they do not offer full-time employees and their dependents minimum essential coverage or offer coverage that is deemed unaffordable. A “large employer” is defined as one that has 50 or more full-time equivalent employees during the preceding calendar year. A full-time employee averages 30 or more weekly hours of work. Hours worked by part-time employees are included in the calculation. These penalties amount to $2,000 per year per full-time employee (starting with employee number 31).
Coverage is “unaffordable” when:
- the employee’s share of the premium for self-coverage is more than 9.5 percent of the employee’s modified adjusted gross household income, and
- an employee receives a subsidy for coverage through a state exchange.
If coverage is not affordable, employers may be penalized $3,000 per year per employee who receives a federal individual insurance subsidy.
The United States Treasury Department has issued new regulations applying to large employers. For those with more than 50 employees, the employer faces penalties for every employee who elects federally subsidized coverage, up to $3,000 annually but prorated per month. Large employers will face decisions about how much employees will be contributing to their health insurance coverage. The difference is that according to the Department, the 9.5% threshold under the Affordable Care Act applies to the individual’s coverage, not family coverage. Under the ACA, an employee may opt for the federal subsidy if unable to get affordable insurance through the employer, and affordable is defined at this 9.5% threshold. This ruling has the potential to save the federal government money if fewer people opt for coverage through insurance exchanges. The effect on business, of course, would be the opposite.
These exchanges are insurance markets created under the Affordable Care Act in which consumers can buy individual policies and obtain subsidies to assist with premiums.
Governor Bill Haslam has sent a letter to the Secretary of Health and Human Services citing his concerns about “aggressive federal timelines, a lack of true flexibility for states, and misguided federal policies.”
Because Tennessee rejected the creation of a state-based exchange at the end of 2012, Tennesseans will participate in an exchange run solely by the federal government. The State estimates that 300,000 people may participate in the exchange, but some estimates set participation closer to 600,000.
The HIPAA-HITECH Omnibus Final Rule has been released and was officially published January 25, 2013. Businesses need to take steps to be compliant with many requirements by September 23, 2013. And there will be much work to do. Among other issues:
- There will be a need for changes in Notices of Privacy Practices.
- There will be greater enforcement efforts, which is already being seen in many places, and more emphasis on penalties.
- There are changes to breach notification requirements with more events being reportable.
- There is direct liability for Business Associates and Covered Entities will need to monitor Business Associates more closely.
- The Rule contemplates electronic copies of electronically stored information.