What the Heck is Happening with HIPAA?

Speaker A: Hi everybody and thank you for ah, joining us for another episode of Compliant with Alliant. I'm Christine Blanco, I'm the director of employee Benefits compliance here at Alliant and I have Laura joining us.

Speaker B: Hello. Great to be back.

Speaker A: Laura's a compliance consultant on our team as well. And um, I just have to say we recorded a really great podcast um, just now. Except for that it wasn't recording. So we're going to go again. Um, we're here to talk to you today about what the heck is happening with hipaa. And so we kind of want to run through. There's been a bit of a whipsaw happening with hipaa and if you're, it's kind of difficult to track even if you're following it closely. And so for those of you who don't spend your time following what's happening with hipaa, we're going to kind of run you through what's happened and then what do you need to do now? Like what's the upshot here? So I'm going to start you know, with First Service Fire. From a HIPAA perspective we are focusing not on the portability special enrollment rights component. We're focusing on privacy and you know, the changes that have happened to the privacy requirements. So let's just level set here. Um, HIPAA applies to covered entities. Self, self funded plan sponsors are covered entities under hipaa. So if you are a group that sponsors a self funded medical plan, you are a covered entity subject to the HIPAA privacy and security requirements. We could go on an entire day about what specifically those are. Hopefully you're uh, at least fairly familiar with them. Other, you know, quick update just in terms of requirements to have policies and procedures around the security of protected health information Phi when you are a covered entity and again focusing largely on self funded plans. If you have a fully insured medical plan, generally the HIPAA compliance is with the insurance carrier. There may be a circumstance where you have a number of other self funded lines of coverage or maybe HIPAA would, you know, it would, maybe m would make sense to treat yourself as a covered entity. But that's something to speak to your advisors about. So with HIPAA privacy compliance and privacy and security compliance comes with a requirement to have policies and procedures in place and for the plan to execute business associate agreements that run down how they'll protect um, Phi and then put all the HIPAA requirements contractually um, onto that business associate even though business associates are directly subject to HIPAA as well. But the have to be in place as well. And so the HIPAA rules have been, you know, in place for I think since the 90s. They've been taking various permutations over the years. And so what we're going to focus on is the most recent rulemaking in 2024. And that rulemaking happened in the wake of the Dobbs decision. So with the Dobbs decision overruling, overruling Roe v. Wade, the there was a heightened concern about protecting phi related to reproductive healthcare and accessing lawful reproductive healthcare. And so I won't go into the details of the final rule, but the final rule basically added some protections for those individuals, um, seeking lawful reproductive healthcare from having that information disclosed for purposes of certain legal proceedings, whether criminal or civil. Um, the final rule issued under the Biden administration in February of 2020 also happen to include some additional alignment, um, with HIPAA of another set of health information that has been protected historically even before hipaa, substance use disorder related health information. So that's generally referred to as quote part two. And those protections have been in place much longer than HIPAA and they're much more stringent. And what has, what had developed over the years is just a misalignment of um, use and disclosure rules that made it difficult for insurance carriers, covered entities, to manage disclosure disclosure under those different set of rules. And so, you know, Congress and the UM and the agencies have been trying to align that part to disclosure rules with HIPAA for some time. And so that final rule not only just created added protections for reproductive rights, but also required that the notice of privacy practices that you guys are all familiar with, it's been around forever under HIPAA contain some information about the protection protections for substance use disorder benefits. And so as a result of that final rule issued In February of 2024, many of you very diligent covered entity self funded plans updated your policies and procedures and your business associate agreements to comply with those uh, expanded reproductive rights protections that was required by the end of 2024. Note that the substance use disorder updates to the notice of Privacy weren't required until February of 2026. I think it was February 16th, which is we're looking at right now sidebar. We don't have a model notice out with any of these updates. Um, but that was, you know, the plans always had that period of time until next month to update their notice of privacy practices, but they did not have that time to update. They had to have that implemented the uh, reproductive rights implemented by the end of 2024. So many of you made updates so now then I'm going to turn it over to Laura because now we're going to move to the state of te in the federal district court and a lawsuit that is impacting all has impacted all of this. So Laura, you want to pick it up from here?

Speaker B: Yeah, absolutely. So we move along from, you know, again, as Christine mentioned, all of you diligent, uh, self funded plans, making those updates by the end of 2024 with your privacy policies and your business associate agreements to the summer of 2025 when a federal court in Texas struck down Most of the 2024 HIPAA final rule and specifically the aspect of the rule that was really designated to strengthen, uh, the privacy protections for that reproductive health care information. And at the center of um, the argument here, um, was plaintiffs claiming that HHS Health and Human Services, um, when they promulgated the final rule, really exceeded their authority under hipaa, um, and unlawfully then interfered with some of those state laws that Christine mentioned that might be, um, wanting to use that reproductive health care information to enforce state laws, uh, around that type of treatment that otherwise that final rule was trying to protect. The court agreed with the plaintiff's arguments, finding that Congress did not clearly authorize HHS to create this special reproductive health specific privacy protection under hipaa, uh, and so as a result of that we had the final rule vacated, um, nationwide, so no longer enforceable, no longer, uh, applicable. And I want to take a moment to go back to something, Christine, that you had mentioned earlier, um, and highlighting the fact that even though this, uh, vacator of the 2024 HIPAA Final Rule occurred, it didn't impact the substance use disorder treatment records that were otherwise pulled into hipa, um, that part too. And the reason being is because Congress actually did authorize HHS to make those changes to the Part 2 protections for substance use disorder benefits and bring that into sort of our HIPAA privacy infrastructure, um, because of the issues that we've historically had with this type of information and really trying to coordinate care for individuals that are receiving, uh, substance use disorder treat. And so because through the CARES Act, Congress had actually instructed HHS to promulgate those rules around, uh, substance use disorder treatment information. Um, that is why those rules still continue today. And so when we think about, okay, you know, where does this land us now? Where do we go from here after that Texas court ruling to really vacate the protections around reproductive health care information, we now have to pull out all of those changes that you did back in 2024, um, from our privacy policies our baas, but we still have the notice of Privacy Practices that needs to be updated by February 16th. Um, so that is something that if uh, you're a self funded plan, employer plan sponsor of a self funded plan, you want to make sure, um, that you go ahead and make those updates, incorporate and pull in the substance use disorder treatment information into um, your notice of privacy practices and into that HIPAA infrastructure.

Speaker A: Right, right. So a couple things just like color commentary, um, if we look at the, because it's rare that a district court will issue an order and then that's the end of it. Right. And so there can be some questions about, well, what's going on there. And um, if you were, if this litigation were to happen in the middle of an administration and the administration issued a rule and a court vacated it, the administration would uh, more often than not they appeal that all the way up to however high it needs to go. Um, here we had the unique situation where this decision, um, the rule was challenged, the decision was issued, and then there was an administration change which then just did not appeal the decision. You know, we have reason to, no reason to believe that would, that would shift. And so what we look at, like Laura said, is just reverting back to the pre, final rule as it relates to reproductive rights and moving forward with the substance use disorder, uh, language into the notice of privacy practices and distributing that. Do we want to talk a little bit about how. I mean.

Speaker B: Yeah, let's talk about that.

Speaker A: Yeah, it can be disruptive to all of a sudden have a new notice that just needs, needs to go out. Um, as we mentioned, the model notice that HHS has on the hipaa, the Notice of Privacy Practices that has not been updated. We don't know whether it will. I know that we have done some updates to the um, the materials that ah, we use with our clients. Um, and so what is the recommendation on, on distributing that, Laura?

Speaker B: Yeah, so plans can post the updated Notice of Privacy Practices on a public website and in which case distributing the updated notice to participants can wait until really the next annual mailing that the employer does. Right. So thinking about um, open enrollment really was when we typically include that notice of Privacy practices within, um, those renewal materials, um, plan documents. So employers can wait until that time to then go ahead and start incorporating and distributing the updated notice to participants. But if the notice isn't posted on a publicly available website, which I know for a lot of employers out there, the, the employer organization might have a, uh, public website, but the plan itself often doesn't yeah, um, so, so in that case, where I think a lot of um, employers will find themselves is, is needing to provide the, the updated Notice of Privacy Practices directly to participants. That needs to happen within 60 days of the update. Even though the updates need to happen by February 16th, you technically have until April 17th to go ahead and get that updated Notice of Privacy Practices distributed. Um, it can be done electronically provided that, you know, participants can access the notice in accordance with HIPAA's electronic delivery standards. So making sure that it's accessible, notifying participants of where and how they can then access that document. Or of course there's always paper that we can fall back onto as well.

Speaker A: Right. So they have a little time. And then, you know, when we think about um, the Notice of Privacy practices was required to be updated with the substance use disorder information and then arguably it's probably a best practice is to have that same informational language in any business associate agreements as well. So to the extent that um, those might need updating, you'd want to think about that. I think, um, what we find is that these updates can be disruptive. Both the notice distribution, but also the business associate agreements and policies and procedures, um, can be disruptive. We get a lot of questions about do I have to do them now? What's my risk if I don't do them now? And we would just say, you know, um, from a, you know, a very, a very hard line compliance perspective, you want to be in compliance with the existing regulations, but if you are waiting for sort of a cadence that makes more sense, whether it's, you know, at your annual contract renewal or something to that effect, just talk to your lawyers about whether that makes sense for your organization. Everyone has different risk tolerances, um, as it relates to these kinds of things. So um, we would decide to just confirm with your legal advisors if you're going to kind of take a wait and see approach. Absolutely, yeah. So I think hopefully that answers the question of what the heck is happening with hipaa. And uh, we are grateful to you for joining us. Thanks so.

Speaker B: Much.