May 3, 2024: National Advocacy Update

On April 22, CMS finalized two major rules to strengthen access to high-quality medical care for Medicaid and Children’s Health Insurance Program (CHIP) beneficiaries and advance transparency related to quality, access and payment rates.

The "Managed Care Rule" establishes federal maximum appointment wait-time and other standards for the first time and requires public reporting of quality and payment data for key services. The "Access Rule" requires states to publish Medicaid fee-for-service payment rates and compare them to Medicare rates for key services and prove that any plans to restructure plans or reduce rates will not result in sufficiently diminished or insufficient access.

The AMA strongly supported many of the provisions when both rules were proposed and welcomed the historic changes in a statement, noting that the AMA has long sought changes to Medicaid payment and coverage policies to overcome longstanding barriers to care for low-income patients and advance health equity. In the statement, AMA President Jesse M. Ehrenfeld, MD, MPH, underscored that the AMA looks forward to working with CMS to implement these reforms to advance patient access and quality of care while emphasizing the need for common-sense protections to ensure managed care plans do not unfairly pass the burden of compliance onto safety net practices.

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published a Final Rule to modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to support reproductive health care privacy. This action is part of the Biden Administration’s efforts to protect access to and privacy of reproductive health care after the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization (PDF). The Final Rule strengthens privacy protections by prohibiting the use or disclosure of protected health information (PHI) that relates to reproductive health care, by a covered health care provider, health plan, health care clearinghouse, or their business associate to (1) conduct an investigation or impose any liability in order to seek, obtain, provide or facilitate reproductive health care, or (2) identify any person to conduct an investigation or impose a liability.

The prohibition on the use or disclosure of PHI that relates to lawfully provided reproductive health care applies when a medical provider is asked to disclose records that reflect care that they, themselves, provided. In addition, if a covered entity or business associate is asked to disclose records of care that was provided by someone else, that covered entity or business associate can rely on a presumption that the care was lawfully provided. No separate analysis is needed of whether the care that was provided elsewhere was lawful because the covered entity can presume that it was. Only records of lawfully provided reproductive health care are protected from the requirement to disclose them without an attestation. The attestation is a promise that the recipient of the PHI will not use the records for a prohibited purpose—to identify or bring legal action against the patient, their medical provider or any person who assisted them.

Moreover, covered entities or business associates can continue to use or disclose PHI for other Privacy Rule purposes where the request for PHI is not made to investigate or impose liability on someone for seeking or facilitating reproductive health care. More details on the Final Rule are available on OCR’s website.

On April 26, OCR issued its long-awaited Sec. 1557 non-discrimination rule, including a problematic provision that creates new liability for physicians who use AI-enabled technologies and other clinical algorithms potentially resulting in discriminatory harms. While the final rule is significantly more permissive than the earlier proposal, it is still concerning as it places new duties on physicians and creates the risk of penalties should they rely on algorithm-enabled tools that result in discriminatory harms.

The rule includes a general prohibition on discrimination through the use of the newly termed “patient care decision support tools.” New duties imposed by the new section include a covered entity’s ongoing duty to make reasonable efforts to identify uses of these tools that employ potentially discriminatory inputs. The final rule also requires covered entities to make reasonable efforts to mitigate risk of discrimination from any tools identified above. OCR declined to exempt FDA-approved medical devices from this section and likewise declined to institute any transparency requirement that would better help physicians and others evaluate the potential for discriminatory outputs.

The AMA urges physicians to carefully consider the new requirements in their decisions to incorporate these tools into their practices. The lack of transparency requirements for these tools requires physicians to be diligent about their selections and have proper policies in place to guide use within a practice.

The Federal Trade Commission (FTC) finalized the Health Breach Notification Rule (HBNR) to help ensure that health-related data remains protected once it is outside the scope of the HIPAA, shore up consumer confidence, and rein in unauthorized disclosures by entities entrusted with individuals’ health information. The final regulation clarified its applicability to health apps and other similar technologies and expanded the information that entities must provide to consumers when notifying them of a breach of their health data.

The rule requires vendors of personal health records (PHR) and related entities that are not covered by HIPAA to notify individuals, the FTC, and in some cases, the media of a breach of unsecured personally identifiable health data. It also requires third-party service providers to vendors of PHRs and PHR-related entities to notify such vendors and PHR-related entities following the discovery of a breach.

In public comments (PDF) in Aug. 2023, the AMA supported much of what FTC proposed, and subsequently finalized, including specifically excluding from the Rule’s scope entities that are subject to HIPAA, since there is the potential for burdensome, competing notice obligations under the health breach notification rule and the HIPAA statutory regime. The AMA also supported FTC’s work to authorize expanded use of electronic notices to inform individuals of breaches and unauthorized disclosures as well as changes to the content of the required notice to individuals, and how the content should be educational in nature. The final rule will go into effect 60 days after its publication in the Federal Register.

The FTC recently launched a new effort aimed at curbing anti-competitive behavior in the health care industry. The new reporting portal allows physicians, consumers and others to easily file reports about actions and behaviors by health care entities that may reduce competition. Submitted complaints will undergo review by FTC and Department of Justice staff, and, should they rise to a significant level of concern, may lead to a formal investigation. According to the FTC, “The launch of the new portal advances the Biden-Harris administration’s efforts to lower health care and prescription drug costs and help create more competitive health care markets that are fairer to patients, providers, payers, and workers.”

The reporting portal is available at www.healthycompetition.gov.

On April 23, the five commissioners of the FTC voted to approve a final rule banning non-competes with all workers, including physicians. Three commissioners voted in favor of the final rule and two voted against it.

A few of the rule’s highlights are as follows:

• The rule defines a “non-compete clause” as a term or condition of employment that prohibits a worker from, penalizes a worker for, or functions to prevent a worker from: 1) seeking or accepting work in the US with a different person where such work would begin after the conclusion of the employment that includes the term or condition, or 2) operating a business in the U.S. after the conclusion of the employment that includes the term or condition.
• Under the final rule, all new non-competes will be banned 120 days after the date on which the final rule is published in the federal register.
• From the effective date forward, existing non-competes will be unenforceable for all workers except “senior executives.” For purposes of the rule, a “senior executive” is a worker in a policy-making position that is compensated at or above a threshold rate specified by the rule.
• The rule does permit other types of clauses such as confidentiality agreements and non-disclosure agreements.
• The final rule preempts any state law that is less restrictive than existing state laws. Thus, the final rule would preempt some aspects of state laws dealing with physician non-competes.

Notably, Congress has limited the jurisdictional reach of the FTC so that it is difficult for the FTC to govern non-profit organizations. This jurisdictional limit raises a significant question concerning the extent to which the final rule will be able to limit the use of non-competes by 501(c)(3) organizations, including non-profit hospitals and hospital systems. Likely, the rule will not apply to many 501(c)(3) health care organizations, despite banning independent physician practices from using non-compete clauses since the latter are mostly for-profit businesses.

Dissenting commissioners argued that the FTC does not have proper authority to issue this rule under the Federal Trade Commission Act. Indeed, within 24 hours of the rule’s publication, the U.S. Chamber of Commerce and other business organizations filed suit in the Eastern District of Texas challenging the rule—one of several potential lawsuits. The Chamber will be asking courts to enjoin the FTC from enforcing the rule until legal issues, including but not limited to the FTC’s authority, are resolved. Even if courts ultimately side with the FTC, enforcement of the final rule will likely be significantly delayed as legal issues wind their way through the judicial process.

On April 29, the U.S. Food and Drug Administration (FDA) finalized its highly anticipated rule for regulation of laboratory developed tests (LDT). While the rule has some notable changes from the initial proposal, the final rule seeks to end FDA’s longstanding enforcement discretion approach to regulating LDTs and require many LDTs to go through a pre-market review process at the agency. Efforts to further regulate LDTs have been highly controversial, and numerous impacts to the diagnostic industry are expected as a result of the new system of oversight.

While many in the laboratory community have long argued that test development represents a service and does not meet the definition of a medical device, within its final rule FDA has amended its previous regulations to make explicit that all in vitro diagnostics are diagnostics under the Federal Food, Drug, and Cosmetic Act. The regulations lay out plans to phase out the current enforcement discretion approach for LDTs in five stages, with the fourth stage requiring full compliance with pre-market review requirements for high-risk LDTs and stage five requiring full compliance for moderate-risk and low-risk LDTs. Stage four begins three and a half years from the publication date of the final rule, while stage five will begin four years from publication.

The final rule does contain some notable provisions that should somewhat assist in easing burdens on laboratories going forward:

• FDA plans to continue to exercise enforcement discretion for LDTs currently marketed that were first marketed prior to issuance of this rule and that are not modified (or have limited modifications in accordance with the rule).
• FDA will continue to exercise enforcement discretion for LDTs approved by the New York State Clinical Laboratory Evaluation Program.
• FDA will continue enforcement discretion for LDTs manufactured and performed by a laboratory integrated within a health system to meet an unmet need of patients receiving care within the same system.
• FDA will continue enforcement discretion for LDTs manufactured and performed with the Veterans Health Administration.

The AMA will continue to closely monitor the diagnostics space given the significant concerns over patient access and cost that persist despite the policy changes in the final rule. Congress has taken a renewed interest in more tailored legislation to address LDT regulation and the AMA will continue to monitor any potential legal challenges to the final rule.

The Office of the National Coordinator for Health IT (ONC) published Version 2.0 of the Common Agreement (PDF) for the Trusted Exchange Framework and Common Agreement (TEFCA). TEFCA is intended to provide another means to help facilitate broad-based nationwide health data exchange. The Common Agreement establishes the technical infrastructure model and governing approach for different health information networks and their users to securely share clinical information with each other—all under commonly agreed-to rules of the road.

Version 2.0 of the Common Agreement includes the requirements each Participant and Subparticipant must agree to and comply with to participate in TEFCA. In addition, it embraces enhancements and updates to require support for Health Level Seven (HL7®) Fast Healthcare Interoperability Resources® (FHIR) based transactions.

In Dec. 2023, the RCE recognized five QHINs to begin operating to support data exchange through TEFCA. At this point, there are seven designated QHINs: Commonwell, eHealth Exchange, Epic Nexus, Health Gorilla, Kno2, KONZA and MedAllies.

On April 29, the Biden administration finalized a rule that rescinded a Trump-era policy concerning Association Health Plans (AHPs). Under longstanding rules, small employers could join together to form AHPs, which do not have to adhere to Affordable Care Act requirements, including covering 10 essential health benefits. However, employers had to meet certain criteria including being in related industries. In 2018, the Trump administration expanded the criteria to include many more companies, including those in non-related industries and employers that have no workers. The Trump-era rule was previously vacated after a group of Democratic Attorneys General sued, but yesterday’s action formally rescinds the rule.

The AMA previously expressed concern (PDF) over the Trump-era expanded criteria, arguing that while the AMA supports efforts to maximize health plan choices for individuals and small businesses seeking coverage in the individual and small group markets, the Trump-era changes undermined state and federal patient and provider protections and would result in a lack of meaningful health insurance coverage. In the 118th Congress, Republican lawmakers have introduced bills that would expand AHPs by allowing non-related industries to create them and sole proprietors to join. Last year, the House passed H.R. 3799, the CHOICE Arrangement Act, while a similar bill permitting expanded AHP options without usurping state law, specifically S. 3167, the Multiple Employer Welfare Arrangement Act, has been introduced by Senator Mike Braun (R-IN).

A new Policy Research Perspective (PDF) provides a detailed examination of the 2022 U.S. National Health Expenditures (NHE) data released by CMS. In 2022, health spending was 17.3% of GDP and increased by 4.1% to $4.4 trillion (or $13,493 per capita). This spending growth rate is comparable to pre-pandemic rates (4.3% in 2019). Although government spending to manage the pandemic led to substantial increases in NHE, these expenditures significantly declined in 2021 while utilization of medical goods and services rebounded. By 2022, top-level patterns in health spending more closely reached that of the pre-pandemic period.

The U.S. is facing a shortage of between 13,500 and 86,000 physicians by 2036—a deficiency that is almost certain to be compounded by rising rates of physician burnout and early retirement. The physician workforce, like our general population, is aging, with nearly 45% of active physicians in the U.S. aged 55 or older. Addressing the physician workforce issue is crucial to ensuring patients have access to care where and when they need it.

Register for this Advocacy Insights webinar on May 22 at 2:00 p.m. Central to learn about how increasing residency training slots, addressing visa issues for international medical graduates, ensuring access to care in rural areas and addressing factors impacting physician burnout—including Medicare physician payment instability and administrative burdens—can help bolster the physician workforce.

Moderator:

• Jesse M. Ehrenfeld, MD, MPH, president, American Medical Association

Speakers:

• John Andrews, MD, vice president of graduate medical education innovations, AMA
• Alexis Pierce, JD, senior attorney, Division of Legislative Counsel, AMA
• Christopher Sherin, assistant director, Division of Congressional Affairs, AMA

• May 3, 2024: Advocacy Update spotlight on Change Healthcare cyberattack adverse impact
• May 3, 2024: Medicare Payment Reform Advocacy Update
• May 3, 2024: State Advocacy Update