The Prinz Law Office

The final update to the HIPAA Privacy Rule on reproductive health is anticipated to be issued soon by the Department of Health and Human Services (“HHS”).

HHS issued a Notice of Proposed Rulemaking on April 17, 2023 to solicit comments on its proposal to modify the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”).  The comment period on the proposed update closed as of June 16, 2023.

If adopted, the proposed update would modify existing standards permitting uses and disclosures of protected health information (“PHI”) by prohibiting uses and disclosures of PHI about reproductive health care for criminal, civil, or administrative investigations or proceedings against individuals, covered entities or their business associates or other persons for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided.

The update was originally prompted by an executive order from President Biden directing HHS to take actions to strengthen the protections under HIPAA for reproductive health information following the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.  Attached is a link to the Court’s decision: https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.  A copy of President’ Bidens’s executive order may be viewed here: https://www.govinfo.gov/content/pkg/FR-2022-07-13/pdf/2022-15138.pdf.

According to the HHS Notice, the proposed Privacy Rule will “strengthen privacy protections for individual’s PHI related to reproductive health care” in order to “avoid the circumstance where an existing provision of the Privacy Rule is used to request the use or disclosure of any individual’s PHI as a pretext for obtaining PHI related to reproductive health care for a non-health care purpose where such use or disclosure would be detrimental to any person. ”

To view the full HHS notice on the anticipated HIPAA Privacy Rule update, please click here: https://www.federalregister.gov/documents/2023/04/17/2023-07517/hipaa-privacy-rule-to-support-reproductive-health-care-privacy.   For additional HHS commentary on the proposed Privacy Rule updates, please click here: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html.

The American Telemedicine Association has just released a new toolkit intended to help with assessing the impact of telehealth on addressing disparities in healthcare among communities.  Please click here to view the ATA Press Release, which announces the release and explains the significance.

The toolkit, which was developed by an ATA advisory group, provides functionality to review digital infrastructure by zip code and county, and a tool to scope the cost of telehealth-based improvements, as well as a collection of other resources the ATA has released to date.

According to the ATA Press Release, ATA developed the tool for the purpose of empowering healthcare industry members to address gaps in care that can be mitigated using virtual care.  In other words, the tool is intended to further one of the key aspirational goals of digital health, which is to improve access to healthcare for underserved populations.

To access the toolkit, please click here.

The DEA conducted a two day listening session last week to receive practitioner comments on  regulations relating to the prescribing of controlled substances via telemedicine.   Transcripts of the public comments are available for viewing at this link:  https://www.deadiversion.usdoj.gov/Telemedicine_listening_session.html.

According to reporting by Fierce HealthCare, the listening sessions were held in response to a backlash from doctors and telehealth groups after the DEA released proposed rules in February, 2023 that would have reinstated the restrictions that existed before the COVID era on the prescribing of controlled substances via telehealth.  In particular, the proposed rule would mandate that Schedule 2 medications or narcotics be prescribed in-person and Schedule 3 medications or higher could be prescribed for 30 days via telehealth but would require an in-person visit prior to refill.  Fierce HealthCare reported that the DEA received a record 38,000 comments on its proposed telemedicine rules, which were among the highest ever received in DEA history.

The American Telemedicine Association (“ATA”) has opposed the DEA’s February, 2023 position, asserting that the DEA’s plans will “simply limit. . . . access to legitimate health care”.  See ATA’s March 28, 2023 letters to the DEA at this link, in which the ATA submitted comprehensive recommendations regarding the proposed rules: https://www.americantelemed.org/press-releases/ata-action-submits-comprehensive-recommendations-to-dea-on-proposed-rules-regarding-remote-prescribing-of-controlled-substances/.

The ATA has advocated for a special registration process for telemedicine prescribing of controlled substances without a prior in-person visit based on seven key tenets, stated in its press release attached here:

1. The Special Registration process should work in conjunction with the existing registration process.
2. Telemedicine providers should not be required to maintain local addresses in every state where they practice.
3. Special Registration should include the elements DEA needs to monitor for illegitimate practitioners and illegal prescribing practices.
4. Special Registration should not be limited to any specific specialty or treatment condition. Schedule II prescribing could involve additional oversight but should not have additional restrictions.
5. Dispensers (pharmacies and pharmacists) should be able to identify legitimate prescribers who have a current Special Registration.
6. The location of the patient should not require any registration unless otherwise required because controlled substances are dispensed or administered at that site.
7. The Special Registration process should not place any arbitrary limits on a clinician’s ability to practice within the scope of their authority.

According to Fierce HealthCare the DEA was originally mandated fifteen years ago within the Ryan Haight Act to develop a special registration process for remote prescribing, which was mandated again by Congress in 2018, but the DEA failed to act on both occasions.  The ATA and other advocates are pushing the DEA to follow through on the prior mandates to keep COVID-era telemedicine flexibilities in place.

The Silicon Valley Digital Health Blog will continue to follow this issue as it develops.  Clearly, the DEA’s next steps will have a tremendous impact on patient access to telemedicine going forward.

If your company is currently subject to, or alternatively, may be subject in the future to HIPAA security requirements, you may be interested to know that the Office for Civil Rights (“OCR”) and the Office of the National Coordinator for Health Information Technology (“ONC”) have just released an updated version of their security assessment tool, which is intended to help with the identification and assessment of risks and vulnerabilities to electronic protected health information (“ePHI”), as well as with remediation and compliance planning.

Version 3.4 of the updated tool is available for download at the following link:  https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool.

The newly released version of the tool contains updates such as a remediation report, a glossary and tool tips section, bug fixes, usability improvements, and references to the 2023 edition of the Health Industry Cybersecurity Practices (HICP) publication.

The security assessment tool is currently made available in Windows and Excel Workbook format and also comes with a convenient user guide.

The California legislature is currently considering a controversial new telehealth bill that would dramatically expand the access to veterinary care for animal patients located in California.  AB 1399 would change California’s existing law to permit a veterinarian-client-patient-relationship to be established solely via telemedicine.   Existing California law limits the practice of veterinary telemedicine to existing veterinarian-client-patient-relationships only, where the animal has previously been examined by the veterinarian, except in cases where the advice is given in an emergency.  See the attached link to view the bill in its entirety: Bill Text – AB-1399 Veterinary medicine: veterinarian-client-patient relationship: telehealth. (ca.gov)

Proponents of AB 1399 argue that passage of this bill is necessary to make permanent the COVID-era relaxation of California’s existing regulations, which permitted care virtually when local veterinary practices were inundated with new patients and human caretakers were dealing with challenging personal circumstances.  They argue that California continues to deal with a shortage of veterinarians and telemedicine improves access to care for California animals, many of whom would not otherwise receive care at all.  Attached are links to arguments and statements in support of the bill by Dr. Christie Long and the SFSPCA.

However, critics of AB 1399 warn of the unintended consequences of relaxing the existing regulations to California animals.  In particular, the American Veterinary Medical Association has opposed the bill on this ground (see the attached link).  While the California Veterinary Medical Association had also opposed AB 1399 (see the attached link), it just recently amended its position after several new amendments were made to the bill.  Attached is a copy of the letter published by the CVMA explaining the change of position:  AB-1399-Friedman-NEUTRAL-position.pdf (cvma.net).

For the digital health community, the adoption of AB 1399 and permanent relaxation of existing veterinary care restrictions in California would be a clear win for digital health providers seeking to expand access to veterinary care to more of the state’s animal residents.  The adoption of AB 1399 in this state could also have the effect of influencing other states with similar restrictions in place to also consider relaxing their regulations.

The Veterinary Virtual Care Association, a global nonprofit association dedicated to developing standards for veterinary virtual care, is actively tracking the current status of veterinary telehealth laws around the country at the following website:  The VVCA Telemedicine Regulatory Map – Veterinary Virtual Care Association.  According to the VVCA’s regulatory reporting map,  Michigan, Connecticut and the District of Columbia are currently the only states not requiring that telemedicine be tied to a veterinarian-client-patient-relationship.  If accurate, this means that California’s adoption of AB 1399 would set an important national precedent for veterinary telemedicine law.

The Silicon Valley Arbitration and Mediation Center has published for public comment a first draft of “Guidelines on the Use of Artificial Intelligence in Arbitration.”  The proposed guidelines were drafted by the Center’s AI Task Force Guidelines Drafting Subcommittee and are intended to provide a framework for how to use artificial intelligence in domestic and international arbitrations.

The guidelines contain three key chapters: a chapter that applies to all participants in international arbitrations, a chapter that applies to parties and party representatives, and a chapter that applies to arbitrators.   The topics addressed by the guidelines include safeguarding confidentiality, duty of competence or diligence in the use of AI, and non-delegation of decision-making responsibilities.

To view and comment on the guidelines, check out the following link: SVAMC AI GUIDELINES PORTAL (typeform.com)  The deadline for submitting comments is September 30, 2023.