Upcoming Changes to Various Federal Laws Impacting the Health Care Industry

Pumpkin spice is on all the shelves and the winter holidays are fast approaching.  But as we enter into the final few months of 2023, the health care industry should also remember to make note of and prepare for a number of changes that are expected to occur in late 2023 or early 2024.  Below we recap just a few of these items. 

OIG Compliance Program Guidance Updates

 In April 2023, the HHS Office of Inspector General (“OIG”) announced its intention to modernize its compliance program guidance documents.  This includes publication of a General Compliance Program Guidance (“GCPG”), which will apply to all individuals and entities in the health care industry, and Industry-Specific Compliance Program Guidance (“ICPG”).  According to the April 2023 announcement, we should expect publication of the GCPGs by the end of 2023.  Additionally, OIG will begin publishing the ICPGs in 2024, starting with those focused on Medicare Advantage and nursing facilities.  But, don’t expect to see any future publications in the Federal Register.  The new GCPG and ICPGs, including future updates to these documents, will be published only on the OIG’s website, and OIG will notify the public through its public listserv and other communications platforms.  You can sign up for the OIG listserv here.

Medicare Overpayment Rule Amendments 

In December 2022, the Centers for Medicare & Medicaid Services (“CMS”) proposed a rule to amend the current regulations for Medicare overpayments.  This new proposed rule could be effective as early as the beginning of calendar year 2024.

The Medicare overpayment regulations require a provider to report and return a Medicare overpayment within 60 days of “identification” of the overpayment.  A provider failing to report and return an overpayment within 60 days of identification creates a separate basis for liability under the False Claims Act (“FCA”).  The current overpayment regulations define the concept of “identification” of an overpayment as when an individual “has, or should have” through “reasonable diligence” determined that they have received an overpayment and have quantified the amount of the overpayment.  To date, CMS commentary has provided clarification that “reasonable diligence” means a timely, good faith investigation of credible information of an overpayment, which, outside of instances involving extraordinary circumstances, should take no more than six months.

If the amendments are adopted as proposed, they would change the definition of “identification” for a Medicare overpayment by removing the “reasonable diligence” standard and replacing it with the FCA’s “knowing” standard.  Under the FCA, “knowledge” is defined as actual knowledge, reckless disregard, or deliberate ignorance.  Therefore, a Medicare Advantage organization, or Part D sponsor, provider, or supplier will have “identified” an overpayment if they have actual knowledge of the overpayment or act with either reckless disregard or deliberate ignorance of the overpayment.  Another notable difference between the current “reasonable diligence” standard and the new, proposed “knowing” standard is removal of the requirement that an overpayment must be quantified before it is “identified.”

Gag-Clause Attestations Due by End of Year 

On or before December 31, 2023, plans and insurers must submit their first attestation of their compliance with the prohibition against gag-clauses in accordance with the Consolidated Appropriations Act of 2021 (the “CAA”).  The CAA prohibits plans and insurers from entering into agreements with health care providers, third-party administrators, and other service providers that would directly or indirectly restrict the plan or insurer from sharing with the plan sponsor, enrollees and certain other entities, cost and quality information that is specific to providers, or from electronically accessing claims and encounter information that is specific to enrollees.

The attestations due on or before December 31, 2023, must be retroactive and cover the period of December 27, 2020, through the date of submission.  Beginning in 2024, attestations must be made annually and submitted on or before December 31st.  While there are limited exceptions, plans and insurers should confirm their compliance with this prohibition against gag-clauses and submit their attestation before year end.

340B Hospital Refunds and Reductions

In July 2023, CMS issued a proposed rule in response to the Supreme Court’s 2022 decision that found the Medicare Part B payment policy to hospitals participating in the 340 drug pricing program unlawful.  The proposed rule seeks to remedy the payment rates that the Supreme Court held were invalid.  CMS plans to issue a final rule sometime this fall and, if finalized as proposed, repay each of the approximately 1600 340B hospitals that were underpaid from 2018 to 2022 in a one-time lump sum payment.  Additionally, CMS would offset these refunds by adjusting the outpatient prospective payment system conversion factor by minus 0.5% starting in calendar year 2025.  This would act as a way to recoup funds from hospitals that received increased rates for non-drug services from 2018 to 2022.

*          *          *

The above is an overview of various new issues and requirements the health care industry should see in the coming months.  Further into the future, the health care industry should also take note of the following:

CMS Coverage of Emerging Technologies

In June 2022, in response to trends in new medical technologies coming into the market earlier in their development (and thus with limited clinical evidence), CMS proposed a new pathway to provide transitional coverage to emerging technologies (“TCET”). TCET would replace the Medicare Coverage for Innovative Technology (“MCIT”) final rule. CMS hopes that this proposed pathway will provide more timely and predictable access to new medical technologies for Medicare beneficiaries.  The proposed TCET pathway is a multi-step process.  First, CMS will conduct an in initial review prior to FDA approval/clearance and determine whether the device is likely to be coverable through a benefit category, in which case it may be accepted into the TCET pathway.  Further steps involve a focused literature review and a formal national coverage determination request.  The comment period on the proposed rule closed in August 2023, so it may be some time before we see further information on this rule.

HIPAA Privacy Rule Amendments

Finally, back in January 2021, the HHS Office for Civil Rights (“OCR”) issued a proposed rule to, as OCR summarized it, “improve health information sharing for more effective health care, empower individuals with their own health information, and lift unnecessary administrative burdens on covered health care providers and health plans.”  It had long been thought that OCR would issue the final rule by the end of 2023.  However, it’s now anticipated that OCR’s publication may not come until December 2024, more than a year later than first expected.  WE previously commented on how HIPAA Covered Entities and Business Associates can begin preparing for the final rule here.

In addition to those changes included in the 2021 proposed rule, next year’s final rule from OCR may also finalize (1) a proposed rule issued by OCR in April 2023 related to protecting patients by prohibiting disclosure of PHI for use against patients and providers involved in the provision of reproductive health care, including abortion, (2) a proposed rule issued by OCR and the Substance Abuse and Mental Health Administration in December 2022 to align 42 CFR Part 2 and HIPAA, and (3) a request for information by OCR in April 2022 seeking industry feedback on certain security rule provisions under HITECH.