At Last, HHS Releases the Affordable Health Insurance Exchanges Rule

On March 12, 2012, HHS finally released the long-awaited Affordable Health Insurance Exchanges final rule that was published in the Federal Register on March 27. The Affordable Care Act (ACA) mandates that all states set up a state-run insurance exchange to be ready to go live in January 2014 or else the federal government, through HHS, will step in and implement an exchange pursuant to its discretion. The states have until January 1, 2013 to prove to HHS that they have taken the steps to create an operable exchange pursuant to the standards and that they will be ready to go live in January 2014. If HHS finds that the state is unprepared or not complying with the minimum standards, HHS will step in and create the exchange under its own direction.

The exchange is designed to allow consumers and small businesses the option to choose a private health insurance policy through a web-based platform. Kathleen Sebelius, the Secretary of HHS, states in a news release that the new exchange policies will “give states the flexibility they need to design an exchange that works for them,” and the exchanges will provide a marketplace for Americans for “one-stop shopping for health insurance,” which the federal government hopes will drive down costs for consumers by increasing competition among insurers and improving access to health care. Individuals that purchase a qualified health plan through an exchange may be eligible for a tax credit according to a recently released regulation by the IRS, known as the health insurance premium tax credit.

According to HHS’s news release, the final rules provides guidance to the states on how to structure the exchanges in two keys areas: (1) setting standards for establishing Exchanges, setting up a Small Business Health Options Program (SHOP), performing the basic functions of an Exchange, and certifying health plans for participation in the Exchange; and (2) establishing a streamlined, web-based system for consumers to apply for and enroll in qualified health plans and insurance affordability programs. The final rule also provides details on the roles of agents and brokers in the exchange and provides for privacy protections for enrollee data. The private insurance industry is pleased that the final rule also allows enrollees of the exchange to purchase insurance through private entities and still have access to the subsidies. Essentially, the final rule tasks the states with setting up an acceptable exchange and provides the standards and framework for doing so. Future rules by HHS will have to address how HHS will establish exchanges in states that do not implement one since this is not dealt with in this final rule.

To date, HHS has issued nearly $670 million to thirty three states and the District of Columbia to get them started on setting up an exchange. HHS announced, as of March 2012, that the “majority of the states have taken significant steps in building Exchanges.”

HHS’s new release fails to mention the backlash among a number of states (mainly Republican-led) and in general, from opponents of the ACA, that view the Act as unconstitutional and an abuse of federal power. Most recently, the Republican governor of Wisconsin, Scott Walker, has reportedly turned down $37 million in federal funding to set up the state’s exchange. Governor Walker stated that he will not begin implementing an exchange until the Supreme Court has issued a decision on the constitutionality of the ACA. Walker, like many Republicans, opposes the ACA and the creation of an exchange on the grounds that it is an “encroachment of Obamacare in our state, which has the potential to have a devastating impact on Wisconsin’s economy.” In defense of his position, Walker refers to Wisconsin’s reputation as a health care innovator and its success in achieving a high level of health insurance coverage, without the involvement of the federal government.

For Wisconsin and the several other states that have refused federal funding, including Kansas and Oklahoma, the regulations provide that HHS will step in and set up an exchange if the states refuse to take such action. Given the continued opposition across the country surrounding the ACA’s provisions, the backlash among the states is not surprising and will certainly continue until the Supreme Court makes its ruling on the constitutionality of the individual mandate and the Medicaid expansion provision in the upcoming months. If the Supreme Court rules that the individual mandate is unconstitutional and that the provision is not severable from the remainder of the Act, then the entire Act including the state exchange provisions will be struck down.

Whether you align yourself with the Republicans or Democrats, or another political party of choice, it is important to remember — politics aside — that 17.7 percent of Americans in December 2011 were uninsured. Even if the Supreme Court strikes down the whole Act or parts of the ACA, future action and legislation will be necessary to remedy the sad state of health care coverage in America and improve the quality and delivery of health care services.

An Uncertain Future for ICD-10

On February 14, 2012, Marilyn Tavenner, the acting Administrator of CMS, told reporters that CMS will “re-examine the timeframe” of the planned conversion to the ICD-10 code standard.  Presently, covered entities under HIPAA must fully convert from the ICD-9 coding system to ICD-10 by October 1, 2013.

ICD-10, which stands for the International Classification of Diseases, 10^th Revision, is a coding system that providers use for billing purposes and medical researchers also use for statistical analysis.  ICD-10 consists of 68,000 codes that will expand upon the 13,000 codes currently being used with ICD-9. The codes, each representing a separate medical service or diagnosis, are used by providers and hospitals when they submit their bills to the insurer. The providers receive payment for their services based upon the codes and the terms of their reimbursement agreement. From these codes, medical researchers are able to evaluate kind and frequency of care; with more than five times as many descriptive codes in the new system, many researchers and evidence based medicine proponents are said to look forward to the far greater depth of analysis the new coding system will offer. The United States already lags behind many countries in ICD-10 implementation and it is said that this compliance extension will widen the gap even further.

Two days after Ms. Tavenner’s announcement, HHS issued a news release stating that “HHS will initiate a process to postpone the date by which certain health care entities have to comply with ICD-10.” Kathleen G.  Sebelius, the Secretary of HHS, states in the news release that “we have heard from many in the provider community who have concerns about the administrative burdens they face in the years ahead. We are committing to work with the provider community to reexamine the pace at which HHS and the nation implement these important improvements to our health care system.”

HHS’s news release leaves a lot of questions unanswered. There is no hint at which “certain health care entities” will be granted an extension for compliance and how far off the new deadline will be. HHS claims they will “initiate a process,” which leads many to believe a formal rule making process with public comments will occur. This process could possibly take years to complete, which undoubtedly has caused a giant sigh of relief for providers and institutions across the country that feel ill-prepared for the 2013 deadline. Analysts at Health Care IT News estimate that the deadline could be pushed off a year or two if there is a formal rule-making process.

As the news of Ms. Tavenner’s announcement spread, members of the industry sent out messages cautioning that a complete overhaul of the current plan is unlikely.  Ms. Tavenner’s announcement, which happened at the American Medical Association (AMA) Advocacy Conference in Washington, D.C., was fittingly met with applause by AMA members. The AMA has publicly and vehemently opposed the current October 1, 2013 deadline.  In a January 17, 2012 letter addressed to Speaker of the House John A. Boehner, the Executive Vice President and CEO of the AMA James L. Madara M.D. pleaded with Speaker Boehner to stop the implementation of ICD-10. In the letter, Dr. Madara argues that the conversion “will create significant burdens on the practice of medicine with no direct benefit to individual patient care, and will compete with other costly transitions associated with quality and health IT reporting programs.” Of course, Dr. Madara is referring to the task of implementing an electronic health records (EHR) system in accordance with CMS’s meaningful use criteria, which entitles a covered entity to receive incentive payments from CMS. Dr. Madara also cites to what he deems to be the competing tasks of dealing with financial penalties for non-participation in Medicare programs, including e-prescribing and the Physician Quality Reporting System.

ICD-10 opponents also cite to the industry’s recent failure to comply with the January 1, 2012 deadline to comply with the transition to Version 5010, a HIPAA electronic transactions upgrade that is necessary to support ICD-10, as evidence that the industry is not ready for the ICD-10 change. In November 2011, CMS gave in to industry pressures to extend the 5010 compliance deadline an additional ninety days. It is undeniable that providers are already subject to tremendous demands under HIPAA and the HITECH Act, on top of Medicare cuts, which are placing significant financial stress and compliance burdens on the industry. It is not surprising that ICD-10 has met a lot of resistance from providers. However, it is no secret that providers and institutions are consistently successful lobbyists for their concerns and beliefs and it remains to be seen how CMS will proceed with the scheduled ICD-10 implementation and what compromises will be made.

Proponents of the ICD-10 system argue that the new coding system will create significant positive changes in the industry because it will help collect important data that will improve the quality of patient care, decrease costs, and collect statistics for medical research.  CMS and the Center for Disease Control and Prevention believe that the new codes will create more accurate and exact descriptions of diagnoses and inpatient procedures, which will improve efforts to track care, detect emerging health issues and improve quality. A report from Deloitte, a consulting firm, reported that the increased size and scope of the ICD-10 codes is expected to provide potential benefits in cost and quality measurement, public health, research, and organizational monitoring and performance measurement.  Whether a provider supports the change or not, Deloitte echoes the sentiment of many that advance planning is essential. Providers and institutions that have already invested time and money into the ICD-10 implementation are frustrated and upset by CMS’s decision to “reexamine” the current compliance deadline.  After all, no provider wants to see its large investment in the ICD-10 system put to waste.

The fact is that no one, perhaps even CMS and HHS, is certain about the date of the future ICD-10 implementation plan so perhaps the smartest choice for providers is to proceed with steps to continue the ICD-10 implementation. Considering the prospect of the financial disincentives attached with non-compliance, it seems like a risky choice for any provider to sit around and wait and see what may happen, especially when the ICD-10 implementation cannot happen overnight.  There are providers that started the ICD-10 conversion process back in 2009 when it was first introduced and they still have not completed the task. Unfortunately for providers, the ICD-10 conversion requires time, manpower, training, testing with payers, and significant technological changes that will carry high administrative and financial costs.  The Medical Group Management Association (MGMA), which opposes the ICD-10 implementation, estimates that it will cost a ten doctor practice more than $285,000 to convert to ICD-10, with software upgrades accounting for only $15,000 of that amount. According to the MGMA, the bulk amount would be for increases in claims queries, reductions in cash flow, and increased documentation time.  What it comes down to is that if a provider wants to be paid for its services, noncompliance with ICD-10 is not an option. The risk for successful claims processing and receiving payments in a timely fashion is present, but adequate preparation and testing well before the compliance deadline is the best way to combat this significant risk.

One thing is certain - until HHS releases a new rule and schedule for ICD-10 implementation, opponents will continue to argue that the costs to adopt the new system are too high, the task too onerous, and the rewards too speculative to justify such an undertaking.  Unless the industry comes together to find a solution for an easy transition, this could be a bumpy road until the ICD-10 transition is complete.

Data Breaches: A Growing and Alarming Trend and a Potential Safe Harbor

Since the data breach notification regulations by HHS went into effect in September 2009, 385 incidents affecting 500 or more individuals have been reported to HHS, according to its website. A total of 19 million individuals have been affected by a large data breach since 2009. The regulations require a covered entity that discovers a reportable breach affecting 500 individuals or more to report the incident to the HHS Office of Civil Rights immediately. After an investigation, HHS publicly posts information about the reported incident on its website on what has become known as the “Wall of Shame.” Of the 385 reported incidents, there are six separate incidents each affecting a million individuals or more. In its 2011 annual report to Congress, HHS reported that in 2009 covered entities notified approximately 2.4 million individuals affected by a breach and 5.4 million individuals the following year. This number grew in 2011 and it will likely continue to grow in 2012. To date, the largest breach took place in October 2011 at Tricare, the health insurer of American military personnel, which affected 4,901,432 individuals after storage tapes containing protected health information (PHI) were stolen from a vehicle. These numbers are staggering, but fortunately more can be done and should be done to prevent data breaches.

Data breaches can cause great harm to the affected individuals, providers and institutions. Individuals may experience embarrassment and harassment because sensitive health information was released. Individuals are vulnerable to identity theft and financial fraud if personal information such as social security numbers were accessed. More frequently, institutions are offering credit monitoring services to affected individuals to monitor for potential fraud. Similarly, data breaches carry a very high cost for institutions that will have to spend great sums to investigate and report a breach to HHS, the media and the affected individuals. An institution or provider’s reputation can also be harmed through negative publicity and the loss of consumers. More institutions are hiring public relations teams after a breach to minimize the amount of fallout and negative publicity. The threat of litigation and class action lawsuits following a breach is also present and very real. Stanford Hospital, Tricare, and Sutter Health are all facing million and billion dollar class action lawsuits  for their 2011 data breaches.

The bad news is that data breaches are impossible to predict and it is impossible to protect against every type of possible breach. Unfortunately, even the strongest policies, precautions and security measures cannot protect an entity from a hacker, thief or an employee or business associate’s honest mistake. As more providers and institutions adopt electronic health record systems and digitize their records, data breaches will continue to occur and large breaches will be spotlighted by the media. Pursuant to the regulations, a covered entity must alert a prominent media outlet if a reported breach affects more than 500 people of that state. Based on the events of last year alone, it is clear that the media loves to report on data breaches and will continue to do so. Hopefully this public exposure will serve to increase accountability to the public rather than instill fear in the public and hurt consumer confidence in the EHR movement.

The good news is that more can be done by providers and institutions to prevent harmful and costly data breaches. Data security and patient privacy should be the focus of the industry in the upcoming years because it is just as important as meaningful use certification. The benefits flowing from the Medicare incentive payments that an institution may receive under the Affordable Care Act can be canceled out in the event of a large and debilitating data breach. It would be wise for covered entities to focus on preventing data breaches as much as achieving meaningful use.

There is no easy solution to preventing breaches, but encryption is one surefire way an entity can better protect itself from a costly breach. As entities become more familiar with EHR systems and recognize the risks involved in storing and transferring PHI data, implementing encryption technology should become a top priority for each entity.

Encryption of PHI is a major step a provider or institution can take to secure its sensitive patient data. Encryption is the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key. According to a Guidance from HHS, if an entity encrypts its data in accordance with the National Institute of Standards and Technology standards for encryption, then any breach of the encrypted data falls within a safe harbor and does not have to be reported. This is an incredibly important safe harbor that could save an entity a lot of money. It is shocking that more entities, especially those with the means and resources to install a qualifying encryption system, do not utilize encryption technology on any of their electronic devices, especially  portable devices.

Of the 385 reported breach incidents, thirty-nine percent involved a lost or stolen laptop or other portable media device containing unencrypted PHI. A report recently released by Redspin, an IT security firm, states that data breaches stemming from employees losing unencrypted devices spiked 525 percent in the last year alone.  This statistic confirms that devices, including laptops, tablets and smartphones, pose a very high risk for a data breach. Redspin reported that eighty-one percent of healthcare organizations now use smartphones, iPads, and other tablets, but forty-nine percent of respondents in a recent healthcare IT poll by the Ponemon Institute said that nothing was being done to protect the data on those devices. At the very least, these reports and the statistics on HHS’s “Wall of Shame” should encourage entities to encrypt their portable electronic devices that contain sensitive PHI.

There are of course costs associated with adopting encryption technology in an EHR system. There are costs to install the system and maintain it with the help of an IT expert. Encryption of information can also slow down the processes used in sharing information. After all, one of the main goals of an EHR system is to make it easier for providers to share health information about their patients. An entity should work with an IT expert to determine what information should be encrypted in order to maximize the efficiencies of an EHR system. Despite the costs, the money and resources spent implementing encryption technology can be well worth it and are a smart investment for any entity with an EHR system. In a study published in 2011, the Ponemon Institute found that the cost of a data breach was $214 per compromised record and the average cost of a breach is $7.2 million. In light of the large data breaches that have been reported, it is clear that the costs of a breach can be much higher than the costs to implement encryption technology.

Under the HITECH Act and HHS’s interim final rule, encryption of health information is not mandatory. It remains to be seen whether HHS will impose a mandatory encryption policy on all devices or, at the very least, all portable devices capable of storing or transferring PHI, when it releases the final version of the data breach notification regulations sometime this year. The health care industry’s lack of encryption for patient information has drawn attention on Capitol Hill. At a November 2011 hearing before the Senate Judiciary Committee’s panel on Privacy, Technology and Law, Deven McGraw of the Center for Democracy and Technology testified that “we know from the statistics on breaches that have occurred since the notification provisions went into effect in 2009 that the healthcare industry appears to be rarely encrypting data.”  At the hearing, Senator Tom Coburn, a physician himself, and Senator Al Franken, the chair of the panel, both voiced their concern over patient privacy protection and the current regulatory scheme. Senator Franken has said that he is contemplating legislation to encourage encryption by providers, although no action has been taken.

In the interim, it is reasonably clear that most, if not all, entities can benefit from implementing encryption technology when considering the costs and headaches associated with a data breach. When encryption is done properly, it has the potential of saving an entity a large sum of money, perhaps millions of dollars, in costs and fines — and that should be reason enough for entities to start taking this step in EHR technology.