Photo of Noreen Vergara

As a Healthcare Regulatory Attorney and former executive, Noreen is a transparent communicator and innovative problem solver with a deep background in operations and risk management.

Noreen’s career in healthcare operations, healthcare compliance and executive leadership began as a behavioral health admissions representative – she understands the day-to-day regulatory hurdles facing healthcare clients. Most recently, Noreen served as Acting CEO, General Counsel and Chief Human Resources Executive for a national managed behavioral health venture with employees across 50 states. In this position, Noreen leveraged her experience in strategic planning, corporate governance, complex contracts, employment law and compliance. Noreen navigated tough decisions including guiding 500 percent growth over 6 years, moving online quickly during COVID-19 and helping secure the largest contract in company history. Earlier in her career, Noreen collaborated in-house at the National Association of Insurance Commissioners (NAIC), where oversight, peer review, best practices and standards are established by state regulators.

On January 17, 2025, the ERISA Industry Committee (ERIC) filed a lawsuit in the U.S. District Court for the District of Columbia, claiming that the 2024 Mental Health Parity and Addiction Equity Act (MHPAEA) Final Rule oversteps legal bounds, breaches the Administrative Procedure Act (APA), improperly delegates the Departments of Labor, Health and Human Services and Treasury’s (Departments) executive power to private entities, and violates the Due Process Clause. ERIC argues that under the Mental Health Parity Act of 1996, the plan was not obligated to assess any disparate impact that a term, applicable to both medical/surgical (M/S) and mental health and substance use disorder (MH/SUD) benefits, might have had on access to MH/SUD benefits. The Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) similarly maintained the disparate treatment standard of liability, rather than the disparate impact standard. Moreover, the Departments acknowledged in the 2013 regulations that “disparate results alone” did not constitute a parity violation.

On December 27, 2024, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), issued proposed changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule (the Proposed Rule) to strengthen the cybersecurity protections that HIPAA-regulated entities are required to maintain for electronic protected health information (ePHI).

On September 9, 2024, the U.S. Department of Labor (DOL), Health and Human Services (HHS), and Treasury (collectively, the Departments) issued a Final Rule clarifying and adding additional requirements on health plans to provide equitable access to health insurance coverage for treatment of mental health and substance use disorders (SUDs), as required by the Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) and implementing regulations at 45 C.F.R. Part 146 and 147 (the 2024 Final Rule).

MHPAEA is a federal law that prevents group health plans and health insurance issuers (collectively, Health Plans) that provide mental health or substance use disorder benefits from imposing less favorable benefit limitations on those benefits than it does for a medical condition or surgical procedure. This means that Health Plans cannot impose additional financial requirements or apply non-quantitative treatment limitations (NQTLs) to these benefits more stringently than those applied to medical/surgical benefits.

What Are the Changes?

On April 26, 2024, the U.S. Department of Health and Human Services (“HHS”) issued a final rule (the “Final Rule”) along with guidance updating the Health Insurance Portability and Accountability Act (“HIPAA”) regulations at 45 C.F.R. Parts 160 and 164 (the “Privacy Rule”). The Final Rule prohibits the use or disclosure of protected health information (“PHI”) for the purpose of (1) conducting criminal, civil, or administrative investigations into, or (2) imposing criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that is legal when provided. The Final Rule also prohibits the use or disclosure of PHI in order to (3) identify any person for any of those purposes (the “Prohibition”).[1]

On February 8, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) finalized long-awaited modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2, which requires individuals or entities that receive federal funding and provide SUD treatment to implement additional privacy protections and obtain specific consent before using and disclosing SUD treatment records (see 42 C.F.R. § 2.11).

In the United States, mental health (“MH”) and substance use disorder (“SUD”) (collectively “MH/SUD”) have continued to represent areas of intense concern. During the COVID-19 pandemic, the MH struggles of essential workers and health care professionals were pushed to the forefront. However, issues related to MH/SUD have continued to escalate.

The Department of Health and Human Services (HHS) through its Office of Inspector General (OIG), announced plans for significant updates and modernization of OIG compliance program guidance (CPG) to improve their accessibility and usability for healthcare entities.[1] Originally issued in 1998, the CPG provide healthcare organizations across the industry with guidance on developing, implementing, and maintaining internal compliance controls. In the 25 years since, the OIG has issued multiple and specific CPGs that apply to particular segments of the healthcare industry including Medicare Advantage organizations, hospitals, home health agencies, nursing homes, and clinical laboratories. However, over time the CPGs have not sufficiently kept up with the innovations and growth of the healthcare industry.

On October 14, 2022, President Joe Biden signed Executive Order 14036, directing the Department of Health and Human Services (“HHS”) to consider innovative actions to drive down certain single-source prescription drug costs as the Biden-Harris Administration works to implement the Inflation Reduction Act of 2022 (the “Act”).

We continue to see an increase in fiduciary litigation involving employer-sponsored group health plans, particularly litigation involving mental health.  A recent New York Federal District Court case, Collins et al. v. Anthem, Inc. & Anthem UM Services, Inc., Case No. 1:20-cv-001969, is one example that may have wide-ranging impact. This case caught our attention because of its potential impact on plan design and plan administration of its mental health and substance use disorder (collectively “behavioral health”) benefits.

On February 23, 2022, Judge Jeremy Kernodle of the Eastern District of Texas ruled that certain parts of the Interim Final Rule Part II (the Rule) implementing the No Surprises Act are invalid. Specifically, the provisions of the Rule governing the methodology for how arbitrators determine the amount of payments insurers and self-funded health plans