News

HHS’ Office of Civil Rights Exploring Whether Change Healthcare Cyberattack Breached HIPAA

• The Office of Civil Rights (OCR) is determining whether protected health information was impacted in the Change Healthcare cyberattack. The OCR is investigating because the cyberattack poses a significant risk to critically necessary patient care and vital healthcare industry operations. In a “Dear Colleague” letter, OCR reminds entities involved in the cyberattack that they are focused on UnitedHealth Group and Change Healthcare but that partners of these organizations also have regulatory commitments and obligations to members (Inside Health Policy, March 14).

HHS Encourages Plans and Payers to Suspend Prior Authorization, Consider Interim Payments

• As a result of the Change Healthcare cyberattack on February 21, HHS has encouraged private health plans to suspend prior authorizations and consider making interim payments to providers. However, the health insurance industry is unsupportive of the suggestions, claiming that doing so would open health plans to fraud. AHIP President Mike Tuffin expressed his opposition to a blanket exemption for prior authorizations in a statement issued on March 12. HHS has announced several strategies in addition to the prior authorizations and interim payments to help providers address challenges presented by the cyberattack incident. These strategies include instructing Medicare Administrative Contractors (MACs) to make newly created Change Healthcare/Optum Payment Disruption (CHOPD) accelerated payments to Part A providers and advance payments to Part B suppliers experiencing claims disruptions upon request (Inside Health Policy, March 14).

CMS Releases Report to Congress on Money Follows the Person Best Practices

• CMS has released a new report to Congress that outlines the best practices within the Money Follows the Person (MFP) demonstration based on input from states, providers, and MFP participants and their family members. This could help states improve their home- and community-based services for existing recipients and assist with the transition of institutionalized people back into the community. The best practices include ways states can use their funding to improve health outcomes and offer the easiest transition possible as well as outlining person-centered care, funding flexibilities, and options for housing supports. According to the HHS budget-in-brief, the Consolidations Appropriations Act of 2023 extended the MFP program through FY2027 and appropriated $450M each year for FY2024-FY2027 (Inside Health Policy, March 15).

Federal Legislation

Senate Finance Leaders Seek Prompt PBM Reforms

• On March 14, Senate Finance leaders, Ron Wyden (D-OR) and Mike Crapo (R-ID) sent a letter to Chuck Schumer (D-NY), Mitch McConnell (R-KY) and other finance members, asking that immediate bipartisan action be taken to devise PBM Medicaid and Medicare service reforms to be sent to President Biden. This month’s recent “skinny health package” release did not include PBM reforms. Wyden and Crapo’s letter also addresses the large number of pharmacy closures that were said to be due to low reimbursement, one-sided PBM contracts and restrictive coverage policies and generic drug markups by PBMs (Inside Health Policy, March 14).

Bipartisan Bill Could Coordinate Dual Eligible Plans

• On March 14, the bipartisan bill, Delivering Unified Access to Lifesaving Services Act of 2024, was proposed on Capitol Hill. If passed, the bill will require each state to develop a comprehensive and integrated health plan that manages all medical, behavioral, and long-term care for dual eligible beneficiaries. Currently there are over 12 million Americans that qualify as dual eligibles. It costs nearly twice as much as the average Medicare patient to provide services to this population and their health outcomes tend to be worse. The bipartisan supported bill could enhance the coordination of benefits and simplify health choices for dual eligible beneficiaries. However, some stakeholders are concerned that the bill might restrict the options of Medicare dual special needs plans (MSN, March 14; Health Payer Specialist, March 18).

Federal Regulation/Guidance

Change Healthcare Cybersecurity Incident: CMS Response and State Flexibilities Informational Bulletin

• On March 15, CMS released an Informational Bulletin to Medicaid and CHIP agencies on the Change Healthcare cybersecurity incident and outlined detailed temporary flexibilities that states have to address with impacted providers. CMS is allowing states to provide interim payments to impacted fee-for-service (FFS) providers through State Plan Amendments (SPAs) that are not subject to certain standard requirements through June 30, 2024. States are expected to reconcile payments once data access is restored. CMS also outlined additional flexibilities that states can take advantage of, such as modifying prior authorization requirements, reducing more stringent prompt pay timeframes, and enhancing pharmacy dispensing fees (Medicaid.gov, March 15).

CMS Releases State Medicaid Director Letter on the Health Home Core Quality Measure Sets

• On March 15, CMS released State Medicaid Director (SMD) Letter #24-002 that outlines required state reporting for Health Home benefits based on the Mandatory Medicaid and Children’s Health Insurance Program (CHIP) Core Set Reporting final rule. The letter addressed mandatory reporting and adherence to reporting guidance, applicable populations, stratification categories, and SPA updates. SMD #24-002 also provided updates to the 2025 Health Home Core Quality Measure Sets and discussed CMS’ plans to make technical specification manuals available along with technical assistance webinars to help states in implementing all required regulations. Key highlights of the letter include the following:
  • Authority for Mandatory Reporting and Adherence to Reporting Guidance:
  • Applicable Populations
  • Stratification Categories and Measures Subject to Stratification
  • State Plan Amendment Updates
• In addition, SMD #24-002 informed states of the stakeholder workgroup process, updates to the 2025 Health Home Core Sets, and the effective date of revisions to the core sets (Medicaid.gov, March 15).

CMS Releases Resources About the Permissibility of Certain Practices During Medicaid and CHIP Renewals

• On March 15, CMS released an informational bulletin and slide deck to address questions and concerns about Medicaid and CHIP renewals and provide clarification on permitted practices for Medicaid and CHIP programs. The bulletin summarizes 10 key renewal requirement reminders for states to continue to conduct Medicaid and CHIP renewals during the PHE unwinding period and beyond. CMS urges states to review their processes and ensure compliance (Medicaid.gov, March 15).

Disability Access Rule to be Finalized

• Last September, HHS issued a proposed rule that would require providers to retrofit facilities and medical equipment to meet patients with disabilities’ physical and sensory needs, ensure websites and virtual care programs are user-friendly, and remove disability status as a factor in clinical support tools. The final rule is expected to be issued in the near future, and therefore healthcare providers should start to prepare to comply with new standards for accommodating patients with disabilities. The regulation would dramatically improve access for individuals with disabilities and set clear standards for providers that engage in business with the federal government and protect patients against discrimination (Modern Healthcare, March 14).