For years, law enforcement has bypassed traditional means of securing evidence by informal requests for documents from witnesses of crimes. At some point, that practice bled over into informal requests for healthcare providers’ documents, including documents reflecting protected health information (PHI). Healthcare providers, for the most part, have complied with these informal requests because, as the logic goes, law enforcement couldn’t possibly prosecute me for complying with law enforcement, right? Isn’t that entrapment?

This cooperative, well-intentioned practice by healthcare providers now appears to be drawing scrutiny from Congress. On December 12, 2023, members of Congress sent a letter to Health & Human Services Secretary Xavier Becerra announcing the results of a Congressional inquiry into the practice of pharmacies handing over patient information without legal process. In the face of that new scrutiny, which is sure to extend beyond pharmacies to all healthcare providers, what are healthcare providers to do when asked for PHI through informal means?

You may recall on December 10, 2020 we wrote about the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announcement of a proposed rule  that would revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations. In the proposed rule, HHS has solicited public comments, that were originally due within 60-days  of the proposed rule publication in the Federal Register.

On October 1, 2020 the Department of Health and Human Services (“HHS”) announced that it will distribute a total of $20 billion as part of Phase 3 of the Provider Relief Funds. The application for Phase 3 funding is now open and will be available from October 5 – November 6, 2020. However, HHS has urged providers to apply early, which may be an indication that the funds will be available on a first-come first-serve basis.

Below are some key details regarding Phase 3:

In late July 2020, the U.S. Department of Health and Human Services (HHS) issued a public notice about forthcoming reporting requirements for certain providers that accepted funding of one or more payments exceeding $10,000 from the Provider Relief Fund (PRF). The reporting notice initially advised recipients that additional details would be provided by August 17, 2020. However, the release date has been delayed.

After the U.S. Department of Health and Human Services (“HHS”) automatically distributed $30 billion to providers as Tranche #1 Relief Fund payments based on 2019 Medicare fee-for-service payment data, HHS subsequently released a new formula that was based on 2018 “program service revenue” and intended to calculate providers’ payments under Relief Fund Tranches #1 and #2 cumulatively.  For providers whose Tranche #1 payments alone exceeded their expected payment under the new “program service revenue” formula, there have been ongoing questions about whether such providers were “overpaid” and needed to reject and return their Tranche #1 payments.

The U.S. Department of Health and Human Services (HHS) will soon make targeted distributions of the next tranche of the Provider Relief Fund to hospitals and other facilities that have been particularly affected by caring for those with the coronavirus. By 11:59 p.m. ET, hospitals will need to complete the HHS information request on ICU beds, COVID-19 positive patients, etc. Specifically, to be eligible to receive a portion of the $10 billion of the next $70 billion in funding from the CARES Act, providers need to submit the information via a CMS portal. This is not a guarantee of payment—rather, CMS is using this information to decide how to allocate the remaining funds.

Representatives of the Office of Inspector General (OIG) for the U.S. Department of Health and Human Services (HHS) are reaching out to speak with hundreds of hospital officials nationwide to provide feedback to HHS and to Congress about the most difficult challenges that hospitals are currently facing in responding to COVID-19.  The OIG emphasizes that