Our Take: HHS issues finalized data-sharing rules; payers, providers respond with concerns about patient privacy
May 03, 2020
Editor’s Note: With wall-to-wall coverage of the coronavirus, we could have led with yet another repeat of last week’s Our Take. While it’s clearly the most important story in the news, we presume that our readers are getting their information related to COVID-19 elsewhere. That said, knowing our readership (primarily Pharma and health system executives), if we find something interesting not being covered by mainstream news outlets, we’ll report on it here. -JM
Last Monday, the Department of Health and Human Services finalized two long-anticipated but controversial rules centered on interoperability and patient access to health data, prompting renewed reservations among industry stakeholders.
The Office of the National Coordinator for Health Information Technology (ONC) issued a final rule to implement interoperability requirements outlined in the 21st Century Cures Act, stating that the rule would help promote transparency and “deliver better information, more conveniently, to patients and clinicians.”
CMS issued the Interoperability and Patient Access final rule, saying it would “liberate” patient data using the agency’s authority to regulate Medicare Advantage, Medicaid, CHIP, and qualified health plan issuers on the federally facilitated exchanges.
Together, CMS said, the rules “will give patients unprecedented safe, secure access to their health data.”
The intent of the rules is to prevent “information blocking” practices that impede the exchange of medical information (such as restrictions on sharing screenshots); to allow patients to access information in their electronic health record (EHR) using smartphone apps; and to require health plans to share claims and other health information electronically with patients.
But groups like the American Hospital Association (AHA) and America’s Health Insurance Plans (AHIP) that represent payers and providers voiced concerns that the rules will put patients’ privacy at risk because third-party app companies not covered under HIPAA will have access to people’s personal health information.
Rick Pollack, CEO of the AHA, said the ONC’s final rule “fails to protect consumers’ most sensitive information about their personal health,” adding that the rule “lacks the necessary guardrails to protect consumers from actors such as third-party apps that are not required to meet the same stringent privacy and security requirements as hospitals.” He said third-party apps would be able to use personal health information “in ways in which patients are unaware.”
Echoing those sentiments, Matt Eyles, CEO of AHIP, said members of his organization “remain gravely concerned that patient privacy will still be at risk when health care information is transferred outside the protections of federal patient privacy laws.”
Dr. Donald Rucker, head of the ONC, told reporters during a call last Monday, “When you’re in the electronic world, there’s always risk. I think we’ve put in some powerful protections here.”
Our Take: A point that’s been raised many times over the years in discussions about these controversial rules is that the health care industry is the only one in which consumers don’t have access to their own information. Virtually anyone who’s tried to get a copy of their medical records will attest to how frustrating and time consuming a task that can be.<
So, we’re all in favor of making it easier for people to obtain their personal health information.
But the regulations established under the Health Insurance Portability and Accountability Act (HIPAA) were created for very valid reasons, and third-party apps are not covered under HIPAA. As the new interoperability rules are implemented, Congress eventually will need to take steps to update HIPAA. Until then, we’re inclined to agree with Pollack’s and Eyles’ criticisms.
We also share concerns others have raised about how much of an additional burden these rules will place on providers. One of the primary purposes of electronic health records is to facilitate the coordination of care, and while inroads have been made with respect to physicians, hospitals, and other providers being able to share information for a given patient, that flow of information is still far from ideal, even all these years after EHRs were first implemented.
Complying with EHR and other documentation requirements is already a main contributor to both physician burnout and increasing administrative costs. Health systems and hospitals now face additional costs to implement the new interoperability rules, as do EHR vendors — who will pass at least a portion of those costs along to the health systems and hospitals.
Collectively, the two rules take up some 1,700 pages. It’s going to take time for stakeholders to digest everything that’s in those pages. And it’s going to take even more time to carry out what’s in those pages. We can expect some speed bumps along the way, to be sure.
All in all, though, we believe that these rules will bring about positive changes for patients, for digital health and telehealth companies, and eventually possibly even for insurers and providers.
What else you need to know
Researchers and policy experts are sounding the alarm: Hospitals and health systems must plan for how they are going to meet the need for care, should there be an outbreak of the coronavirus similar to the one in Wuhan, China, where the virus started. Harvard and Johns Hopkins researchers noted in a research paper that the number of patients with COVID-19 who became seriously ill continued to increase even after the lockdown in Wuhan. Patients exceeded local hospitalization and ICU capacities for at least a month, they said, warning that exceeding health care capacity could increase community spread of the virus and result in lower quality of care. Reporting by Healthcare Dive indicated that hospital systems are discussing ways to ramp up capacity and that hospital leaders are most concerned about supply chain issues, overcrowded ERs, and a shortage of ICU beds, according to a recent survey.
Costco bought a minority stake in SSM Health’s pharmacy benefit manager (PBM), Navitus Health Solutions. Although terms of the transaction were not disclosed in the news release, SSM Health did note that Navitus’ specialty pharmacy subsidiary, Lumicera Health Services, was included in the deal. Navitus serves more than 6 million people across the country and functions as a “100% pass-through PBM,” SSM Health stated, meaning that all rebates, fees, and incentives from drugmakers, as well as network discounts, are passed on to the PBM’s clients. Costco has its own internal PBM, Costco Health Solutions, which was launched in 2013; the company did not say whether it would integrate its PBM with Navitus.
Several insurers agreed to waive cost sharing for physician-ordered coronavirus testing. Aetna/CVS Health, Anthem, Blue Cross Blue Shield Association, Cigna, Humana, Molina Healthcare, and UnitedHealth Group said they would waive copays, coinsurance, and other out-of-pocket costs for at least some of their members, although some placed certain restrictions on their coverage of the testing. America’s Health Insurance Plans, an industry lobbying organization, said in a statement that its members would also take steps to ease network, referral, and prior authorizations requirements associated with COVID-19 testing and treatment.
Ro, an online pharmacy, is offering hundreds of generic drugs for $5 per month, including shipping, CNBC reported. According to the report, Ro is testing the program with a small number of users but plans to offer it to the public soon. The program will include metformin, atorvastatin, and other commonly used medications. The startup pharmacy initially focused on men’s health and later expanded to women’s health. Of note, Ro has physicians who can prescribe drugs virtually; the cost of an online physician visit is $15, and the company does not accept insurance. Currently, Ro has three pharmacies but plans to have more than 10 by year-end.
CMS announced a pilot payment model to lower patients’ costs for insulin. Starting in 2021, the Part D Senior Savings Model will allow enhanced Part D plans to offer Medicare beneficiaries a 30-day supply of insulin — including rapid-, short-, intermediate-, and long-acting forms — for a copay of no more than $35. However, the enhanced plans will have “slightly higher premiums” to offset the reduced cost-sharing amounts. CMS said pharmaceutical manufacturers have until March 18 to apply for participation in the model, and Part D sponsors have until May 1 to submit their application for participation. Meanwhile, New Mexico Gov. Michelle Lujan Grisham signed a bill into law that caps insulin copays and out-of-pocket expenses at $25 per month, the lowest in the country.
Greenville, S.C.-based Prisma Health agreed to acquire several LifePoint Health facilities located in South Carolina. The facilities include three hospitals — Providence Health and Providence Health Northeast in Columbia, and KershawHealth in Camden — as well as a freestanding emergency room in Fairfield County. Prisma Health, a not-for-profit company formed in 2017 when Greenville Health System and Palmetto Health merged, has 18 hospitals and more than 300 physician practice sites. The acquisitions from LifePoint are subject to the usual regulatory approvals. Terms were not disclosed in the announcement.
CVS and Schnucks Markets, a grocery store chain based in St. Louis, signed a definitive agreement in which CVS Pharmacy, a subsidiary of CVS Health, will acquire, rebrand, and operate 99 Schnucks’ retail and specialty pharmacy businesses. CVS said it would also acquire the prescription files from 11 other Schnucks pharmacies and transfer them to nearby CVS Pharmacy locations. The acquisition is subject to customer closing conditions and is expected to close in the second quarter. Specific terms were not provided.
What we’re reading
Gilead’s coronavirus treatment is already being used in Washington state. Fortune, 3.10.20
Virtually Perfect? Telemedicine for Covid-19. NEJM, 3.11.20
Prices Are Not “Reimbursements.” Health Affairs, 3.13.290
