HIPAA Enforcement Discretion During the Declared Public Health Emergency

PRACTICE MANAGEMENT

By Shawn P. Parker, JD, MPA NCAFP General Counsel & Chief of Staff

TELEHEALTH IN FOCUS

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is a federal law that, among other measures, led to the establishment of national standards for safeguarding patients’ protected health information (“PHI”) and ensuring the confidentiality, integrity, and availability of PHI created, maintained, processed, transmitted, or received electronically. Interestingly, the initial purpose of the law was to create a simpler way to transfer health insurance information as individuals moved between employers. The original long title of the Act does not even mention patient privacy or data security:

“An Act to amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.” 1

The law later evolved to support healthcare providers who needed access to patient medical records in order to provide adequate treatment by eliminating the need to have the patient serve as the primary point of contact for this information. The adoption and implementation of the Privacy Rule and Security Rule created minimum privacy, technical, and administrative requirements. The Privacy Rule went into effect in 2003 and regulates the use and disclosures of PHI (more specifically, PHI that is disclosed without the patient’s consent or knowledge) in healthcare treatment, payment, and operation activities.

The Security Rule, unlike the Privacy Rule which regulates PHI regardless of how it's maintained (i.e. on a digital server or in a filing cabinet), deals specifically with electronic medical records and specifies administrative, physical, and technical safeguards required for compliance. The Security Rule also went into effect in 2003. HHS’ Office for Civil Rights (“OCR”) is responsible for enforcing these rules., In 2006, the HIPAA Enforcement Rule was adopted with provisions relating to compliance and investigations, as well as the imposition of civil monetary penalties for violations of the HIPAA Rules.

ENFORCEMENT GUIDANCE IN RESPONSE TO COVID-19 PUBLIC HEALTH EMERGENCY.

The U.S. Department of Health and Human Services published guidance regarding the enforcement of HIPAA and its privacy and security requirements in response to the COVID-19 public health emergency (“PHE”). To date, OCR, which enforces HIPAA, has announced that it would not impose penalties during the PHE for violation of certain HIPAA rules in connection with (i) good faith provision of Telehealth services, (ii) a Business associates use and disclosure of PHI for public health and health oversight activities (without the direction of the covered entity), and (iii) specific privacy rule requirements applicable to hospitals during the first 72 hours that the hospital has instituted disaster protocols. For the purpose of this article, our summary and guidance will focus on telehealth specifically.

Telehealth

During the COVID-19 national emergency, which also constitutes a nationwide public health emergency, covered health care providers subject to the HIPAA Rules may seek to communicate with patients and provide telehealth services through remote communications technologies. Some of these technologies, and the manner in which they are used by HIPAA covered health care providers, may not fully comply with the requirements of the HIPAA Rules.2

OCR stated that it would not enforce penalties for noncompliance with HIPAA regulatory requirements against covered health care providers “in connection with the good faith provision of telehealth during the PHE,” referring specifically to the technology used to provide services via telehealth. OCR’s enforcement discretion applies to services that are related to the diagnosis and treatment of COVID-19, as well as services to assess or treat any other medical condition even if not related to COVID-19. The guidance provided a non-inclusive list of popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype, but would not commit to endorsement, certification or recommendation of these applications’ compliance outside the issued guidance and indicated there may be other technology vendors that do offer HIPAA compliant video communication products.

OCR did not elaborate on what constitutes “good faith” but did provide examples of bad faith, including using public facing remote communication products like TikTok and Facebook live. The guidance advises providers to seek additional privacy protections for telehealth while using video communication products. It advised providers to deliver such services through technology vendors that are HIPAA compliant and endorsed entering into HIPAA business associate agreements (BAAs) in connection with their provision and use. Additionally, it encouraged them to provide notice to the patient that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications.

Tips to Reduce Telehealth Non-Compliance Risk

While providers are able to take advantage of the enforcement discretion to care for patients and cooperate with public health agencies, caution is warranted. Compliance with HIPAA is still required by law; the enforcement discretion is not a broad waiver of HIPAA or its implementing rules. Further, the guidance does not affect the application of other federal or state laws, so you should continue to observe privacy and security procedures as feasible and otherwise work to reduce or contain their compliance risk.

Here are a few considerations for minimizing your risk:

• Obtain and document consent of your patients to proceed with the services via telehealth.

• Be sure to note the potential for interception and security issues and that (during enforcement discretion) the application being used may not be compliant with HIPAA regulations and standards. • Use HIPAA-compliant devices and software and private Wi-Fi networks when available.

• Telehealth services should be provided in a private location, with reasonable precautions to reduce the possibility that the information may be overheard.

• Maintain compliance with medical record requirements and continue to comply with federal and state laws that are not affected by HHS’s guidance.

References: 1. PLAW-104publ191.pdf (govinfo.gov) 2. Notification of Enforcement Discretion for Telehealth; HHS.gov

MEDICAID Tailored Plan Information for Primary Care Practices Contracting with Tailored Plans

Beginning Dec. 1, 2022, NC Medicaid will transition approximately 170,000 beneficiaries who may need services for a mental health disorder, substance use disorder, intellectual/developmental disability (I/DD) or traumatic brain injury (TBI) to Behavioral Health and I/DD Tailored Plans (Tailored Plans). Tailored Plans offer a comprehensive benefit package, including physical health, pharmacy, and behavioral health services. Beneficiaries enrolled in Tailored Plans may choose a primary care provider (PCP) and a Tailored Care Management (TCM) provider. TCM providers, including AMH+ or Care Management Agencies, will coordinate all physical and behavioral health, substance use services, home and community-based services and supports.

Primary care physicians provide a critical medical home for this complex group, and it is important that they participate in the Tailored Plan provider networks. Tailored Plans have the option to contract directly with primary care providers or to partner with a Standard Plan to contract with primary care providers. If primary care providers have not been contacted by Tailored Plans, providers should contact the Tailored Plan directly to discuss the process and requirements. You can find information about tailored plans on the NC DHHS website at: https://medicaid.ncdhhs.gov/ health-plans#behavioral-health-idd-tailored-plans. It is important to contract with multiple, if not all, networks who serve beneficiaries in your community so that existing patients and their families can remain in network.

Terms & Definitions

Advanced Medical Home Plus (AMH+): Deliver both primary care services and tailored care management services.

Behavioral Health and Intellectual/Developmental Disabilities (I/DD) Tailored Plan (Tailored Plan): An integrated health plan for individuals with significant behavioral health needs and I/DDs.

Care Management Agencies (CMAs): Deliver behavioral health, substance use, and/ or intellectual and developmental disability services and care management.

Tailored Care Management (TCM): Care management services for individuals in Tailored Plans. Tailored Care Managers must coordinate all physical, behavioral health, substance use services, home and community-based services and supports. TCM can be provided by an AMH+ or a CMA.

KEY TAILORED PLAN DATES

AUG. 15, 2022 – Beneficiary Choice Period begins. Enrollment Broker begins mailing Enrollment Packets to beneficiaries, and beneficiaries can choose a PCP and Tailored Care Management provider by contacting their Tailored Plan.

SEPT. 15, 2022 – Last day for PCPs to have fully executed contracts with Prepaid Health Plans (PHP) for inclusion in PCP Auto-Assignment.

OCT. 14, 2022 – Last day for beneficiaries to choose a PCP and Tailored Care Management provider before auto-assignment.

POST OCT. 14, 2022 – PCP and Tailored Care Management Provider Auto-Assignment for beneficiaries who have not chosen a PCP or Tailored Care Management provider.

DEC. 1, 2022 – Behavioral Health I/DD Tailored Plans launch.

Special to the NCAFP from the ARC of North Carolina

Why Should Tailored Care Management Matter to Primary Care Physicians?

ning and service coordination to promote all services working in concert for each Medicaid member. We encourage family physicians to collaborate with Tailored Care Managers across the state and in different organizations. Tailored Care Managers will have in-depth, firsthand knowledge of each person and their needs, and will be able to help integrate health-improving strategies into the lives of the people they support.

By Lisa Poteat, Deputy Director, The ARC of North Carolina Holly Richard, Director, Program Development, The ARC of North Carolina

What are Tailored Plans and how do they work?

As a family physician, you may have seen it before. Your patient, “Joe,” comes in for an office visit after being referred by the local Emergency Department. He presents with a painful UTI and signs of diabetes, complicated by weight gain. How do you untangle this? You’re not sure he reads well or really understands a treatment plan. He has an obvious intellectual disability and you’re not sure if he has any of the supports he needs. How can you help him improve his health?

Bridging the gap between medical services and community-based services and supports for Medicaid recipients with intellectual and developmental disabilities has not been a hallmark of our current or past systems. Our current system is bifurcated and fraught with disconnects, creating gaps that often lead to poor health outcomes, disparity in services, and disenfranchisement for people who need to seek care and support. Emergency Department misuse and overuse, along with poor health outcomes are products of these gaps.

The Tailored Care Management model in the future Tailored Plans is an opportunity for our state to finally integrate physical health services with support services for people with intense needs to help improve health and support people in living their best life. Building bridges between the two systems will create partnerships that improve health, improve lives, and ultimately contain the rising costs of care. Tailored Care Managers will help build these bridges, facilitating planThe current Local Management Entities/Managed Care Organizations (LME/MCOs) will become NC Medicaid Managed Care Behavioral Health and Intellectual/Developmental Disabilities Tailored Plans (TPs) on December 1st. TPs will be the health plans that manage the integrated physical health and specialty services for people with moderate to high support needs who have intellectual and developmental disabilities (IDD), traumatic brain injury (TBI), mental illness, or substance use disorders.

As Tailored Plans launch on December 1st, every person receiving services managed by a TP will become eligible for Tailored Care Management. Tailored Care Management will help guide the integration of each person’s physical health services, specialty and community-based services, pharmacy, long-term services and supports, and non-medical drivers of health, such as housing, food inadequacy, transportation, and personal safety. Tailored Care Management will be focused on the whole person, will be community-based and provider-driven, and will be focused on improving overall health and well-being for each person. Three types of entities will be certified to provide Tailored Care Management, including the TPs, Care Management Agencies (CMAs), and some Advanced Medical Homes (AMH+s).

What is a Care Management Agency (CMA)?

Care Management Agencies (CMAs) are existing community-based service providers who are going through a rigorous development and certification process and will

begin providing Tailored Care Management on December 1st. CMAs, and their Tailored Care Managers, will be available to collaborate with family physicians to help address the needs of patients like Joe. Family physicians will benefit from this extra set of hands who can expertly assist patients and their families in navigating the larger system, connecting to needed resources in the community, and accessing services, supports, education and information needed to improve health and improve lives. In Joe’s case, the CMA might help with ensuring he takes his medications accurately, gets involved in an exercise program, secures nutritional food he can afford, gets involved in cooking lessons and a diabetic support group, and has sufficient staff support to help where he needs assistance. In these and other ways, the Tailored Care Manager within a CMA can bring to life a physician’s treatment plan and “go live” with options that work for the patient.

NC DHHS has established a four-year glide path for TPs to assign 80% of the Tailored Care Management responsibilities out to CMAs and AMH+s by the end of that period. This evolution will help ensure that Tailored Care Management happens for people like Joe at the local level, connecting them to local services, supports and resources.

What is Tailored Care Management at The Arc of NC?

Tailored Care Management will be the “glue” for whole-person, integrated care. People will have a single designated Tailored Care Manager supported by a multidisciplinary care team to provide whole-person care management that addresses all of a person’s needs, including physical health, behavioral health, IDD, traumatic brain injuries (TBI), pharmacy, long-term services and supports (LTSS), and unmet health-related resource needs.

The Arc of NC is a statewide nonprofit and has been certified as a CMA. Our goal in providing care management will be to help people with IDD and TBI improve their health and overall quality of life as much as possible. At The Arc of NC, care management staff will assess the needs of each person, coordinate a full team of people and service providers around each person and lead a collective effort among that team to develop and implement plans to improve health and quality of life for each unique person. With almost seventy years of experience, we understand that connectedness works, and we will focus on building relationships and productive partnerships that benefit each person in unique and person-centered ways. The Arc of NC’s Tailored Care Managers will work to collaborate with health care professionals across the state and throughout this process.

Who is eligible for Tailored Care Management in the Tailored Plans?

People receiving services managed by the Tailored Plans and funded by Medicaid or state funds will be eligible for Tailored Care Management on December 1st. This includes people with IDD, TBI, mental illness, and substance use disorder who have moderate to high levels of need for supports and services. There are over 70,000 people in NC with IDD and TBI who will be eligible for Tailored Care Management. Around 15,000 of those people are currently receiving services under the Innovations Waiver, a Medicaid-funded group of services focused on supporting people with significant IDD to live in the community, rather than an institution. In addition, there are over 17,000 people in NC with IDD and TBI waiting on these waiver services, and the average wait time has increased to over 10 years. Only the NC General Assembly can allocate more funds to increase these waiver services. As individuals and families wait, Tailored Care Management can help support them in locating resources for other needs and help coordinate any physical health and community-based services that may be available.

Who can a physician turn to if they have questions or concerns for individuals with IDD or TBI?

The Arc of NC is available to help. We have several offices across the state and will provide Tailored Care Management statewide. Lisa Poteat, Deputy Director and Holly Richard, Director of Program Development, can assist in supporting PCPs and ensuring health care professionals are connected with the right people and resources during this transformative time.

Are there other ways for a primary care practice to become involved in Tailored Care Management?

If a primary care practice is already an Advanced Medical Home Tier 3, they can decide to become an AMH+. An AMH+ is a Tier 3 practice whose providers have experience delivering primary care services to the Tailored Plan eligible population or can otherwise demonstrate strong competency to serve that population and is willing to provide in practice care management to that population.

Connecting Family Physician Job Seekers and Employers in North Carolina.

EMPLOYERS:

Target Candidates with Ease

PLACE your job in front of our highly qualified members and job seekers.

SEARCH our resume database of qualified candidates.

MANAGE jobs and applicant activity right on our site.

LIMIT applicants only to those who are qualified.

FILL your jobs more quickly with great talent.

ADVERTISE your open positions in the exclusive Job Flash™ email sent directly to 2,000+ family physicians in North Carolina.

CONTACT Jan Kielec at Jan.Kielec@communitybrands.com or (860) 935-8437 for package and recruitment options.

Visit jobs.ncafp.com to log in or create your account today!

JOBS.NCAFP.COM

PROFESSIONALS:

Take Your Career to the Next Level

POST your resume or anonymous career profile that leads employers to you.

SEARCH and apply to thousands of family physician jobs in North Carolina on the spot by using robust filters.

SET UP efficient job alerts to deliver the latest jobs right to your inbox.

ACCESS career resources, job searching tips and tools.

GAIN insights and detailed data within the family physician profession including salary, job outlook videos, education and more.

REQUEST a free resume critique from an expert writer.

CONTACT NCAFP Career Center’s Customer Service at clientserv@communitybrands.com or (727) 497-6565 for questions and concerns.

Carolina to connect health systems, health care payers and community-based organizations (CBOs) for the Pilots and to ultimately continue beyond the Pilots. As part of the 1115 Waiver authorization of Medicaid funding, North Carolina was given the flexibility to use up to $100 million on capacity building, which goes directly to community-based organizations such as food pantries and homeless shelters, but also to Healthy Opportunity Network Leads (HONLs). HONLs are new types of entities that form and manage a network of CBOs who then deliver the Pilot services. The HONLs provide technical assistance and training to these organizations, ensure network adequacy of Pilot services, and link the CBOs to health insurers, including Medicaid Managed Care Pre-Paid Health Plans.

The Pilot Program is authorized for 5 years and will undergo consistent robust evaluation for results. The goal of the Pilots is to learn what service or combination of services work to improve health and meaningfully lower health care costs for high needs Medicaid enrollees. These learnings will inform CMS coverage policy with the goal of including effective services as part of allowable Medicaid spending nationally. The Pilot program, if continued, would stay under Medicaid, but could also be used as a blueprint for other payers to address the non-medical drivers of health in a way that prioritizes whole person health. This program can provide resources for payers, both state and federal, to expand beyond Medicaid, and implement similar programs in Medicare and commercial insurance. Other payers can leverage the infrastructure being built for the Pilot, the fee schedule developed for Pilots, and the evaluation.

The Pilot Program is in its early phases. Food services began being offered in March 2022 in the pilot regions, which includes services such as diabetes prevention programs, healthy food box pickups or deliveries, and fruit and vegetable prescriptions. Housing and transportation services were launched in May 2022. Some housing services covered under the Pilot program are a one-time payment for a security deposit or one month’s rent, essential utility set up, and home remediation services. Under the transportation services, health-related transportation, both public and private, are reimbursed. Toxic stress services were launched in June 2022, and include evidence-based parenting curriculum, violence intervention services, home visiting services, and dyadic therapy. More services for toxic stress will be added in the coming months. Interpersonal violence services do not yet have a set release date.

These Pilots are important for Family Physicians for several reasons. Family Physicians who care for patients in the three Pilot Regions can help identify eligible patients and refer them for pilot services through their care manager or the health plan’s care manager. Perhaps more importantly, medical homes are a safe place for members to share their unmet needs and your engagement in asking the right questions, and providing for unmet needs, will be rewarding for your practice and for the patient. The success of the Pilots could catalyze sustainable funding sources for services critical to the health of your patients. For Family Physicians involved in Advance Payment Models or Accountable Care, these pilot services help address the 80% of their patients’ health and health care costs that are not within the control of the four walls of a medical practice, but for which the physician is accountable and can potentially result in significant shared savings.

www.ncafp.com Raleigh, North Carolina 27607 2501 Blue Ridge Road, Suite 120,

Permit No. 592 Pontiac, Illinois

PAID

US Postage Non-Profit Org.