Data Privacy & Security/HIPAA/HITECH

Led out of the firm’s Milwaukee office, Husch Blackwell represented UpHealth in its recently closed business combination that created a publicly traded, comprehensive global digital healthcare company.

Our Kate Bechen and Robin Lehninger were thrilled to join the leadership team of UpHealth Inc. at the New York Stock Exchange to celebrate their listing as a

Since last year, the Husch Blackwell privacy attorneys have been working with various healthcare providers—from hospitals to hospices, to independent physician groups—to comply with the Information Blocking rule (the Rule) implemented by the Office of the National Coordinator for Health Information Technology (ONC) as part of the 21st Century Cures Act.  Recently, Education clients have been asking, “We’re a university – does the Information Blocking rule apply to our student health center?”  We discuss the answer to that question, along with practice tips, in this blog post.

You may recall on December 10, 2020 we wrote about the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announcement of a proposed rule  that would revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations. In the proposed rule, HHS has solicited public comments, that were originally due within 60-days  of the proposed rule publication in the Federal Register.

The pandemic of 2020 tested the mettle of our nation’s healthcare system in many unexpected and profound ways. As healthcare delivery was being rapidly restructured to accommodate COVID-19 diagnosis and treatment and socially-distanced care, bad actors simultaneously began to exploit the increased number of vulnerabilities in health information systems created by telehealth platforms, patient portals and the inattention of stressed, overworked staff. The result was an unprecedented number of cyberattacks culminating in an alert from the Cybersecurity and Infrastructure Security Agency (CISA) on October 28, 2020 addressing the plague of ransomware activity targeting the healthcare and public health sector.

On December 10, 2020, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) released a proposed rule that would revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

In its news release, OCR noted that the changes “seeks to promote value-based health care by examining federal regulations that impede efforts among healthcare providers and health plans to better coordinate care for patients.”  The proposed changes come on the heels of the recently delayed Information Blocking Rule, which seeks to prohibit interferences with access, exchange, or use of electronic health information (EHI).   The key proposed changes are discussed below.

The Centers for Medicare and Medicaid (CMS) expanded Medicare reimbursement for telehealth within the annual Physician Fee Schedule (PFS) final rule for 2021. During the pandemic Public Health Emergency (PHE), CMS has temporarily reimbursed many telehealth services. In light of the success of unprecedented telehealth utilization during the PHE, more than 60 services have been formally added to the Medicare telehealth list which will endure beyond the end of the PHE.

With all that 2020 has brought, the Information Blocking Rule that came out of the Cures Act was under the radar of many hospices. Thankfully, HHS extended the compliance date for the Rule to April 5, 2021, from November 2, 2020. With this additional time, hospices need to evaluate how they will achieve compliance; what

On October 29, 2020, HHS extended the effective date of compliance for the “Information Blocking” final rule promulgated as part of the 21st Century Cures Act (Information Blocking Rule). The Information Blocking Rule, which was set to take effect on November 2, 2020, prohibits health care providers, IT developers, and health information exchanges from unreasonably interfering with the access, exchange, or use of electronic health information (EHI). We previously discussed the practice of information blocking and the eight exceptions in our blog post Information Blocking: Ready or Not, Here it Comes!.

The combination of a significant increase in COVID-19 cases, political tensions in the final days of a national election season, and law enforcement’s focus on election security created an opportunity for cybercriminals to target the computer networks of America’s healthcare and public health (HPH) sector. That opportunity has come to fruition this week.

On October 28, 2020 the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) published Alert AA20-302A (Alert) describing ransomware activity that has targeted the HPH sector. In the Alert, CISA, FBI and HHS assess that cybercriminals are targeting the HPH sector with TrickBot and BazarLoader malware, which are frequently followed by ransomware attacks, data theft, and disruption of healthcare services.

Two new federal rules will make it easier for consumers to access, use and transmit their personal healthcare information using an app on their smartphone or tablet.  The regulations implement prior legislation and advance the current Administration’s intent to empower patients to be better consumers and transform the healthcare industry.

The two final rules were released on March 9 by the Department of Health and Human Services (DHHS):  from the Office of the National Coordinator for Health Information Technology (ONC), the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program final rule; and, from the Centers for Medicare and Medicaid Services (CMS), the final rule on Interoperability and Patient Access.