Health Care

JAMA published a study earlier this week finding more than 95% wanted immediate access to test results. However, when speaking to ONC, the study’s lead researcher specifically noted that although 95.3% of patients who received abnormal test results responded that they still would like to continue to receive immediately released results, this was associated with nearly twice the likelihood of worry compared to respondents who received normal results.
Continue Reading ONC Vindicated. Patients Want Immediate Access to Test Results

The FTC issued a proposed order requiring BetterHelp to pay $7.8 million to consumers to settle charges that it shared consumers’ health data with Facebook, Pinterest, Snapchat, and Criteo after promising to keep such data private and claiming it is “certified” as “HIPAA compliant.” The real juice of this case is in the FTC compliant — and HIPAA-covered providers, facilities & organizations can learn a lot about what to watch out for with health data Apps as we continue to march towards the FHIR.
Continue Reading FTC Orders BetterHelp Health App to Pay $7.8M for Sending User Data to Facebook & Snapchat

The forecast for Arizona is thunderstorms, at least for at least one health care system. Last week, OCR announced a $1.25 settlement for HIPAA Security Rule violations brought to light by a cybersecurity hacking incident that took place over five years ago.
Continue Reading Not So Sunny News in Arizona –  Major Health Care System Agrees to Pay $1.25 Million HIPAA Settlement for Cybersecurity Hacking Incident from 2016

The chickens have come home to roost for GoodRx. The FTC has assessed a $1.5 Million penalty against the telehealth and prescription drug discount provider for failing to report unauthorized disclosures as required by the Health Breach Notification Rule.
Continue Reading Mobile Health Apps and Vendors of Health Records Beware! – the FTC has just started Enforcing the Breach Notification Rule.

On December 1, 2022, OCR released a “guidance” Bulletin re: “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.” One of the most troubling positions OCR takes in its Bulletin is that “all IIHI collected on a regulated entity’s website or mobile app generally is PHI, even if the individual does not have an existing relationship with the regulated entity . . .” If your organization maintains a website, portal, FB page, mobile application etc., it must review the tracking technologies associated with these immediately.
Continue Reading Is Your Organization Ready for an OCR HIPAA Compliance Review re: Use of Online Tracking Technology?

Early on November 4, 2021, the federal Occupational Safety and Health Administration (“OSHA”) filed its Emergency Temporary Standard (the “Standard”) requiring employers with 100 or more employees to implement mandatory COVID-19 vaccine policies no later than January 4, 2022.  These rules are added to OSHA’s existing Emergency Temporary Standard for Health Care providers and similar rules adopted by the Safer Federal Workforce Task Force with respect to contracts amended on or after October 15, 2021, or newly awarded on or after November 14, 2021.

Under the new guidance, by January 4, 2022, employers (other than healthcare providers and federal contractors
Continue Reading OSHA mandates new vaccination rules for large employers

As efforts at the federal and individual states level evolve every day at almost a breakneck pace to address challenges and needs related to the COVID-19 outbreak, here is a updated running list of some of the top actions taken at the federal level that we thought would be helpful to the healthcare industry (Caveat, this is not an exhaustive list): 
Continue Reading Summary List Update of COVID19-related Federal Actions Relevant to Healthcare

On May 1, modifications to the Medicare Conditions of Participation (“CoPs”) went into effect, requiring certain electronic event notifications for admissions, discharges and transfers (“ADTs”) to and from hospitals, critical access hospitals and psychiatric hospitals. To provide guidance to hospitals and state surveyors, CMS released several FAQs as well as interpretive guidance last week to be published in the State Operations Manual.

Hospitals are required to make a “reasonable effort” to ensure that notifications are sent to post-acute care services providers and suppliers, and other practitioners and entities, which need such notifications for treatment, care coordination or quality improvement. Under
Continue Reading CMS Releases Hospital COP Event Notification FAQs; Interpretive Guidance

Labor and Employment
BlogCOVID-19’s Implications for OSHA and the NLRAMay 7, 2021
Recent news regarding the COVID-19 pandemic brings long-awaited optimism as signs of improvement begin to show. According to recent statistics from the Center for Disease Control and Prevention (CDC), 40.7% of the Arizona population has received at least one dose of the COVID-19 vaccine, with 28.9% being fully vaccinated. The number of confirmed cases and deaths related to COVID-19 continues to decline as well. As conditions seem to improve, businesses are eager to re-open their doors and bring back their workforce in an effort to return to “normal.”
Continue Reading COVID-19’s Implications for OSHA and the NLRA

Under the Information Blocking Rule (IBR), a health information network (HIN) or health information exchange (HIE) type actor is one that “determines,” “controls,” or has the “discretion to administer” access, exchange or use of EHI between two or more unaffiliated entities. ONC has said that a separate entity is not necessary to trigger the IBR HIN/HIE definition of an Actor. Additionally, ONC has specifically pointed out that a health care system, for example, could wear two IBR actor hats: (1) as a health care provider, and (2) as a HIN/HIE.
Continue Reading When Does a Health Care Provider Wear an HIE/HIN Hat for Purposes of the Info Blocking Rule?

Well folks, the Information Blocking Rule (IBR) April 5th compliance deadline is behind us at this point.  However, I know that many of you are continuing to work through your top IBR challenges and questions one at a time.  At this point, I have worked through many thorny IBR issues with numerous health care providers and health information exchanges (HIE), so I thought it might be interesting for me to share what is the main topic that I see Actors are focused on. And the winner is …..
Continue Reading What Information Must be Made Available on Patient Portals?

The deadline for compliance with the Information Blocking Rule is just 12 days away!  I am certain that all the Actors are working feverishly and diligently to come into compliance with these new requirements by this fast-approaching date.  On the bright side, I suppose that we can all be relieved that ONC did not stick with its original deadline date of November 2, 2020.  However, even with the extra time Actors may still be scrambling to get all of their ducks in a row by April 5, 2021. So, what are the actual consequences if everything is not “buttoned-up” in time?
Continue Reading Information Blocking Compliance — So What Happens on April 5th?

On and after April 5, 2021, any actor’s agreements, arrangements, or contracts are subject to and may implicate the Information Blocking Rule. The Communications Condition of Certification (CCOC) requirements must be revised to remove or void the contractual provision that contravenes the CCOC requirements whenever the contract is next modified for any reason. A Business Associate Agreement should generally not prohibit or limit the access, exchange, or use of the EHI for treatment.
Continue Reading NEW ONC FAQ: Prior Agreements or Contracts CAN Implicate Information Blocking as of April 5th!