News

President Elect Taps Jim O’Neill for HHS Deputy

• President-Elect Donald Trump has selected Jim O’Neill as his nominee for HHS Deputy Secretary. O’Neill’s experience includes work in the private sector and a previous position as an HHS official during the George W. Bush administration. Should he be confirmed to the role, O’Neill would work as a deputy to HHS Secretary nominee Robert F. Kennedy, Jr. and assist in overseeing the agency’s operations and creating improvements in transparency and accountability (Health Payer Specialist, November 27; Inside Health Policy, November 27).

Federal Regulation and Guidance

Focuses of Proposed Rule Include Medicare Advantage (MA) Prior Authorization, Provider Directories, and Marketing Guidelines

• On Tuesday, November 26, CMS unveiled its proposed rule for MA and Part D plans for 2026, which includes a requirement for MA plans to share full provider directories with CMS. The rule also proposes enhanced reporting on prior authorizations and an expanded definition of MA plan marketing to be regulated by CMS. Starting January 1, 2026, the rule would prevent MA plans from charging higher in-network cost-sharing for behavioral health services—such as mental health specialty care, psychiatric inpatient care, partial hospitalization, substance use disorder outpatient services, and opioid treatment programs—compared to traditional Medicare. To further ensure adherence to federal non-discrimination policies, the proposed rule mandates that MA plans conduct an annual health equity analysis of their prior authorization practices. This analysis would identify any disparities and require plans to take corrective actions where necessary. The proposed rule aims to further reform the prior authorization process for MA plans by requiring them to publicly disclose their internal coverage criteria for services and ensure these are easily accessible on their websites. The criteria may not delay or deny medically necessary care that is covered by traditional Medicare. MA plans would also be required to resolve any discrepancies between their criteria and Medicare’s National Coverage Determinations (NCDs) or Local Coverage Determinations (LCDs) (Inside Health Policy, November 26; Modern Healthcare, November 26).

Federal Studies and Reports

OIG Issues Report on HHS Office for Civil Rights Regarding Cybersecurity

• Given the rise of successful cyberattacks, the Office of Inspector General (OIG) conducted an audit of the Office for Civil Rights (OCR) and released its report on November 25, detailing failures of the HHS office in mitigating cybersecurity risks related to the Health Insurance Portability and Accountability Act (HIPAA). The OIG evaluated the OCR’s periodic HIPAA audits from 2016 and 2017 as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The scope of the report includes actions taken by the OCR from January 2016 through December 2020, though a HIPPA compliance audit has not been completed since 2017. The report found that while the OCR did fulfill its statutory requirement, it did not effectively assess electronic Protected Health Information (ePHI) protections or improve cybersecurity protections. The OCR’s audits only investigated eight of the 180 HIPAA Rules requirements, none of which related to physical and technical security safeguards. The OIG recommended that the OCR enhance its HIPAA audit program by expanding the scope of assessments, implement standard practices to correct identified issues in a timely manner, define and document criteria for determining if an identified compliance issue during a HIPAA audit should initiate a compliance review, and establish metrics to better monitor the effectiveness of HIPAA audits in improving ePHI protections. The OCR agreed with three of the four OIG recommendations. Additionally, the OCR highlighted budget and personnel constraints that have persisted for several years despite increasing health breaches (OIG, November 25; Fierce Healthcare, November 26).