Clarity Emerges for Employer Sponsored Health Insurance Auto-Enrollment Requirement

In early November, 2015, the President officially signed the federal budget that included a repeal of the auto-enrollment mandate contained with the Patient Protection and Affordable Care Act (PPACA) for employers with over 200 employees.

Originally under the PPACA, an employer with 200 or more employees would be required to automatically enroll new employees into the employer-sponsored health coverage. This mandate had never been implemented and was indefinitely suspended due to problems at the Department of Labor in issuing regulations. It was unclear whether it would eventually be implemented, but the official legislative repeal ends this potential issue for employers.

Many aspects of the PPACA continue to change and evolve. As more of the law continues to be implemented, be sure to monitor the evolving requirements for both individuals and health insurance providers.

© 2015 Houghton Vandenack Williams

For more information, Contact Us

Ensuring Compliance with the Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) requires physicians, healthcare providers, and all others that qualify as “covered entities”  or “business associates” to comply with regimented patient privacy and security standards. Failure to fully comply with the law can result in an investigation by the Office for Civil Rights, leading to fines, penalties, and potential damages. This means the best solution for a covered healthcare entity is proactively auditing HIPAA compliance. The following are some key topics that are important for HIPAA compliance.

Risk Assessments.  All covered entities and business associates must conduct periodic risk assessments to identify potential risks to protected health information from a variety of threats, including threats from the environment, such as long-term power loss, chemicals, or pollution. Other threats that must be included in the assessment are intentional and unintentional human data breaches, human error, and natural disasters, such as floods, tornadoes, and earthquakes. The risk assessment must include a variety of information and clearly delineate the risk and potential impact from specific threats. In conjunction with the identification of threats, the risk assessment must demonstrate and outline safeguards implemented to mitigate the potential risk from the identified threats.

Privacy and Security Standards.  An easily overlooked issue pertains to the different standards between the requirements of the HIPAA Privacy Rule and the HIPAA Security Rule.  The HIPAA Privacy Rule requires a covered healthcare provider to have specific policies and procedures for health information disclosure and to distribute a Notice of Privacy Policy to patients.  These requirements are separate from the policies and procedures required by the HIPAA Security Rule.  Policies and procedures under the Security Rule relate to physical premises security, data encryption, and other electronic protection measures. The HIPAA Security Rule and the Privacy Rule require separate and distinct policies and procedures and should be evaluated individually.

On-Going Compliance. After HIPAA policies and procedures are adopted, on-going compliance requirements must not be overlooked.  For example, HIPAA compliance activities must be recorded, and records demonstrating implementation must be kept. Compliance with the Security Rule and the Privacy Rule must be periodically reviewed, with policies and procedures updated as circumstances warrant.

HIPAA has many pitfalls that a healthcare provider may fall victim to, even when that healthcare provider is attempting to comply with the law. This underscores the importance of taking proactive steps to audit HIPAA compliance and even seek outside counsel where appropriate to prevent unintentional miscues.

© 2015 Houghton Vandenack Williams
For more information, Contact Us

Federal HIPAA Audits Set to Resume in Early 2016

By Matthew J. Effken

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has announced its intent to move forward with new HIPAA compliance audits in early 2016. The so-called “Phase 2” audits were originally scheduled to commence in 2014, but have been repeatedly delayed.  The OCR reportedly sent preliminary pre-screening surveys to several hundred potential audit targets earlier this year, but there has been no apparent activity since that time.

The upcoming round of audits will include both covered entities and business associates.  There will be a combination of on-site visits and desk audits.  Before the audits can begin, however, the OCR still needs to revise its HIPAA audit protocol and update its information systems to support the audit program.

The OCR’s announcement came in the wake of a highly critical report from the HHS Office of Inspector General (OIG)  that highlighted various deficiencies in the OCR’s execution of its HIPAA oversight responsibilities.  Among the shortfalls noted in the report was the OCR’s failure to implement a permanent program of proactive HIPAA audits, as required by federal law. The OCR cited various obstacles, including limited resources, as having delayed the audit program.

The OIG report and the OCR response are available at the following link:

© 2015 Houghton Vandenack Williams
For more information, Contact Us

FDA Issues Draft Guidance on Injectable Medical Products Packaging

The Food and Drug Administration (FDA) issued draft guidance regarding the packaging of certain injectable medical products. The FDA is charged with approving packaging for medical products, including the package type terms and discard terms. This draft guidance specifically updates the packaging requirements and definitions for multiple-dose and single-dose medical products, while introducing a new term, single patient use container.

In issuing the draft guidance on October 22, 2015, the FDA noted the increased practice of unsafe injections. Specifically, the FDA has stated that problem is the improper use of needles, syringes, and medication vials, causing contamination of the medication vials. Moreover, when these single use containers are subsequently used on more than one patient, cross-contamination occurs. The failure to follow safe injection procedure for single patient and single dose containers, the FDA notes, has led to bacterial and viral infection outbreaks.

The FDA hopes that the clear product packaging will help alleviate some of the mistaken injection procedures and reduce the transmission of blood-borne pathogens. Although the guidance is not a legal requirement, it is the current FDA position based upon current trends. The draft guidance can be found at the following link: 

© 2015 Houghton Vandenack Williams
For more information, Contact Us

Amendment to the Definition of Small Employer Under the Patient Protection and Affordable Care Act.

On October 8, 2015, the President signed the Protecting Affordable Coverage for Employees (PACE) Act, amending the Patient Protection and Affordable Care Act (PPACA). The amendment modifies a portion of the small employer mandate that was set to take effect in 2016. Under the original provisions of the PPACA, the definition of a small employer would increase to 100, from 50 full time employees, on January 1, 2016.

This amendment leaves the definition at 50 full time employees, unless a state legislature acts and raises the definition to 100 full time employees. This will have a substantial impact on businesses with 51-100 full time employees because the PPACA mandates vary based upon whether an employer is a small or large employer, as defined under the act.

For the state legislatures that previously adopted laws to comply with the definition changes in 2016, the legislature will have to act in order to leave the definition of a small employer at 50 full time employees. Should the state fail to act, the definition of a small employer will change to 100 full time employees on January 1. Neither Nebraska or Iowa previously acted and the definition will remain at 50 full time employees unless the state legislature changes the definition.

© 2015 Houghton Vandenack Williams
For more information, Contact Us

Final Rules Issued by CMS on Stage 3 Electronic Health Record Incentive Program

On October 6th, 2015, the Centers for Medicare and Medicaid Services (CMS) issued two final rules regarding the incentive program for eligible professionals adopting electronic health records. One rule pertained to the requirements necessary to receive a stage 3 incentive payment and the second rule pertained to the electronic health record use requirements for stage 3 participants.

Of the many specifics in the final rules, eligible professionals should note a change to the meaningful use incentive payment reporting period. Previously, eligible professionals had to report meeting the requirements for a full year, but the new rule only requires reporting that the eligible professional met the specifications for 90 days, significantly shortening the reporting period. Another important change, CMS shifted hospitals to a calendar year from a fiscal year, meaning that the attestation period has been moved as well. For hospitals looking to attest to meeting the meaningful use requirements in 2015, the hospital will have to wait until the online attestation portal opens on January 4, 2016. For non-hospital eligible professionals, this will not change the attestation timing because CMS already required the use of a calendar year for these individuals.

The attestation requirements are important for Medicare providers because these 2016 incentive payments turn into Medicare penalties, a negative payment adjustment, in 2017. The final rules for stage 3 electronic health record incentive payments will be published on October 16, with comments open until December 15, 2015. The final rules can be found at the following links:

© 2015 Houghton Vandenack Williams
For more information, Contact Us

Circuit Split Leaves Nebraska and Iowa in Limbo on ACA Contraceptive Mandate

On September 17, 2015, the United States Court of Appeals for the Eighth Circuit (8th Circuit) ruled against the United States Department of Health and Human Services (HHS) in two cases regarding the contraceptive mandate found within the Patient Protection and Affordable Care Act (ACA). The 8th Circuit determined that nonprofit religious organizations do not have to provide contraceptive coverage or participate in the accommodation process designed to alleviate concerns for religious objectors under the ACA. For those residing in the court’s jurisdiction, which includes Nebraska and Iowa, this ruling interjects ambiguity because this is the only circuit court to rule against HHS on this issue.

The two cases, Dordt Coll. v. Burwell, No. 14-2726 (8th Cir. 2015) and Sharpe Holdings, Inc. v. HHS, No. 14-1507 (8th Cir. 2015), pertained to religious organizations that fell outside of the religious employer exemption, instead falling in another category. This category, designed by HHS, provides for the nonprofit entity by granting a religious accommodation. The religious accommodation allows nonprofit organizations to notify HHS of their objections, which also requires the nonprofit provide updates and further information about the objection. Once notified, HHS would begin a procedure that would ultimately require another party to provide contraceptive benefits to the beneficiary of the nonprofit’s health plan. The 8th Circuit determined the nonprofit organization is neither required to notify HHS or provide contraceptives to the health plan beneficiaries.

This poses a problem for those within the 8th Circuit’s jurisdiction because it is the lone circuit to rule against HHS on this issue and it is expected that the United States Supreme Court will take up this issue in the fall term. In the meantime, those in Nebraska, Iowa, and similar 8th Circuit jurisdictions are subject to an ambiguous and evolving standard. For those employers in the 8th Circuit’s jurisdiction considering applying this ruling, counsel should be contacted prior to moving forward.

© 2015 Houghton Vandenack Williams
For more information, Contact Us

CMS announces equitable plan to improve care for under-served Medicare populations.

In an effort to reduce health-care disparities among specific Medicare populations, the Centers for Medicare & Medicaid Services (CMS) has developed the Medicare Equity Plan. Announced on September 8, 2015, the plan is designed to improve upon healthcare disparities, especially for minority populations, in four years. The equity plan, to be implemented in conjunction with other CMS priorities, focuses on improving health-care quality to under-served Medicare groups, especially those with traditionally higher percentages of disease, low quality of care, and high barriers to care.


The six priorities of the Medicare Equity Plan, as outlined by CMS, are as follows:

  •  Priority 1: Expand the Collection, Reporting, and Analysis of Standardized Data
  • Priority 2: Evaluate Disparities Impacts and Integrate Equity Solutions Across CMS Programs
  • Priority 3: Develop and Disseminate Promising Approaches to Reduce Health Disparities
  • Priority 4: Increase the Ability of the Health Care Workforce to Meet the Needs of Vulnerable  Populations
  • Priority 5: Improve Communication and Language Access for Individuals with Limited English Proficiency and Persons with Disabilities
  • Priority 6: Increase Physical Accessibility of Health Care Facilities”


For those that participate in Medicare as recipients or providers, more information may be obtained from CMS at the following location:

© 2015 Houghton Vandenack Williams
For more information, Contact Us

IRS Issues Notice on PPACA “Cadillac” Tax

On July 30, 2015, the Internal Revenue Service (IRS) issued Notice 2015-52, addressing issues and seeking public comments on the implementation of the “Cadillac” tax on high-cost health insurance under the Patient Protection and Affordable Care Act (“PPACA”).  The Cadillac tax is intended to discourage expensive health care plans by imposing a non-deductible 40 percent excise tax on the portion of health plan costs that exceed a predetermined dollar amount.  The tax, which will go into effect in 2018, generally applies to healthcare benefit packages costing more than $10,200 for individuals and $27,500 for families, subject to certain proposed adjustments.  Although the law was passed in 2010, many details of how the tax will be implemented still remain to be sorted out.

For example, one of the basic issues with the Cadillac tax is determining who has the responsibility to pay it.  The law provides that the tax must be paid by the “coverage provider.” Depending on the circumstances, that may be the insurance company, the employer or “the person that administers the plan benefits.”  However, some key terminology impacting these determinations have yet to be defined.  Other unresolved complexities addressed the in IRS notice include: timing issues relating to calculation and payment of the tax, circumstances under which employers will be aggregated for purposes of the tax, and adjustments to the dollar limit based on age and gender.

The IRS has invited public comments on the issues raised in the Notice, as well as any other issues relating to the Cadillac Tax.  Public comments are due no later than October 1, 2015.  Comments received will be used in the preparation of forthcoming Treasury Regulations governing the Cadillac tax.

Notice 2015-52 is available at the following link:

© 2015 Houghton Vandenack Williams
For more information, Contact Us

CMS Reveals Star Ratings for Home Health Care Agencies

By Matthew J. Effken.

The Centers for Medicare and Medicaid Services (CMS) has added star ratings to its Home Health Compare website that provides information about Medicare-certified home health care agencies. The new feature is intended to help consumers identify differences in quality among home health care providers and also help agencies identify areas where they can improve. Ratings range from 1 star for the worst performers to 5 stars for the best performers. Agencies are awarded more stars when they follow recommended care practices for more patients and when more of their patients show improvement.

Nationally, nearly half of all agencies fall in the 3 to 3½ star range. Less than 3% of home health agencies achieve the highest 5 star rating. Quality measurements used in determining the star ratings include: managing daily activities, managing pain and treating symptoms, treating wounds and preventing pressure sores, preventing harm, and preventing unplanned hospital care.

The star ratings are determined based on patient surveys and Medicare claims data, and will be updated by CMS each quarter. Further information and the website can be found at the following link:

© 2015 Houghton Vandenack Williams
For more information, Contact Us