PPI in the News Compliance Corner -June 23, 2022 Archive
You are here: Home / PPI in the News / Compliance Corner -June 23, 2022 Archive

On June 13, 2022, the Office of Civil Rights (OCR) updated its website with guidance related to audio-only telehealth and HIPAA Privacy and Security Rules. The OCR stated the guidance was in direct response to Executive Order 14058, which was issued in December 2021 and ordered the federal government agencies to design and deliver services in a more equitable and effective manner, especially for those who have been historically underserved. The guidance notes that telehealth that includes video may be difficult for certain populations to access because of various factors, including financial resources, limited English proficiency, disability, internet access, availability of sufficient broadband and cell coverage in the geographic area.

In March 2020, the OCR issued a notification and guidance related to the use of telehealth services during the COVID-19 public health emergency. Importantly, this new guidance will apply in situations where those rules do not and will remain in effect even after the public health emergency is declared to be over.

The HIPAA Privacy rules specifically provide for telehealth services, including audio-only services. Covered entities, including healthcare providers and health plans, must take steps to verify the identity of the individual. There are no prescribed methods of identification. Covered entities must apply reasonable safeguards to protect the privacy of protected health information (PHI) and avoid incidental uses or disclosures of PHI. Examples include not using speakerphones, using a lowered voice and providing the services in a private setting.

Regarding the HIPAA Security rules, a traditional landline telephone is not considered electronic communication. Thus, the rules would not apply to such communication. However, if the covered entity uses voice over internet protocol (VoIP), a cell phone, Wi-Fi, a smartphone application or technology to transcribe or record the communication, the HIPAA Security rules would apply. In that case, the covered entity must identify, assess and address the potential risks and vulnerabilities (such as the transmission being intercepted by an unauthorized third party) and whether the communication method is encrypted.

If the telecommunications service provider (TSP) is only a conduit for the communication and does not create, receive or maintain any PHI from the session, no business associate agreement is required. An example would be a cell phone or internet provider if the session is conducted with a cell phone over Wi-Fi. However, if the TSP maintains the PHI after the session, an agreement would be required. An example would be a smart phone application that records the session and stores it in the cloud.

No action is required of employer plan sponsors as a result of the new guidance. However, it is welcome news for plans with underserved populations, as those participants may be able to better access health services due to the updated rules.

OCR Audio-only Guidance »

On June 1, 2022, the US Court of Appeals for the Seventh Circuit held in Zicarrelli v. Dart et al. that an employee’s FMLA rights may be violated without an actual denial of leave — simply interfering with an employee’s attempt to exercise those rights can violate the law.

Plaintiff Salvatore Zicarrelli worked for the Cook County Sheriff’s Office for over 27 years. During that time, he periodically took FMLA leave. In September 2016, he called the Sheriff’s Office FMLA manager to discuss taking more FMLA leave. According to Mr. Zicarrelli, when he asked to take FMLA leave, the FMLA manager responded by saying “don’t take any more FMLA. If you do so, you will be disciplined.” Though the contents of this conversation are hotly disputed, Mr. Zicarrelli retired from the Sheriff’s Office soon thereafter, a decision that he claims was based on the conversation.

Mr. Zicarrelli then sued his former employer, alleging violations of FMLA and discrimination under the ADEA, the ADA, and Title VII of the Civil Rights Act. The lower district court ruled in favor of the Sheriff’s Office on all claims. Specifically, the district court denied the FMLA interference claim because there was no denial of FMLA benefits. Mr. Zicarrelli appealed to the Seventh Circuit, but only as to his FMLA claims.

The Seventh Circuit ruled that threatening to discipline an employee for seeking FMLA leave to which the employee is entitled clearly qualifies as an unlawful interference with FMLA rights. In reaching this ruling, the Court found no ambiguity in the statute or regulations nor any conflicting interpretations among its sister circuit courts. First, the Court parsed the relevant section of the statute, which makes it unlawful for a covered employer to “interfere with, restrain, or deny” an eligible employee’s attempt to exercise FMLA rights. The Court zeroed in on the disjunctive phrasing (i.e., “or” not “and”), which signified that interfere with can stand alone as unlawful without an actual denial of FMLA leave. Second, the inclusion of “attempt to exercise” within the Act’s description of protected rights suggests that actual denial is not necessary. Third, the Court found that interpreting FMLA to allow employers to actively discourage the use of FMLA rights if no unlawful denial occurs would significantly diminish the rights granted. While FMLA was designed to accommodate employer’s legitimate interests, the Court found no legitimate interest in impeding access to FMLA benefits through intimidation, deception or concealment. Finally, the Court looked to DOL regulations, which state that interfering with an employee’s exercise of FMLA rights includes discouraging an employee from using such leave.

Having found Mr. Zicarrelli’s FMLA interference claim legally viable, the Seventh Circuit sent the case back down to the lower court for a jury to decide whether to believe Mr. Zicarrelli’s or the FMLA manager’s version of the leave conversation in dispute.

The Zicarrelli case serves as a good reminder to employers to not discourage eligible employees from taking FMLA leave. Doing so is a clear violation of FMLA-protected rights. Supervisors, managers or other agents designated by employers to handle FMLA requests must be trained to not interfere with an employee’s right to seek FMLA leave. Beginning with an employee’s initial inquiry, communications regarding leave should be documented in a way that prevents any misunderstanding between employer and employee. Similarly, written leave policies must be carefully drafted to not include any terms that could be interpreted as discouragement or limitation on eligible FMLA leave.

Zicarrelli v. Dart et al.»

On June 3, 2022, the IRS, DOL and HHS (the “departments”) released a federal independent dispute resolution (IDR) process checklist of requirements for group health plans and insurers. The checklist was designed to help plans and insurers understand their obligations when processing claims for items and services covered by the No Surprises Act (NSA) balance billing protections.

The NSA provisions protect participants from surprise bills for out-of-network (OON) emergency and air ambulance services and certain OON services received at in-network (INN) facilities. Participant cost-sharing for covered items and services is limited to the INN cost-sharing amount. The plan or insurer must address the remainder of the bill with the provider. If the parties cannot agree on the OON payment amount after a 30-day negotiation period, the federal IDR process can be initiated.

According to the departments, the checklist addresses common questions and complaints received by the No Surprises Help Desk. First, the guidance emphasizes that a plan or insurer must process claims within a 30-calendar-day timeframe after receiving an OON bill for covered items and services and make an initial payment or send a notice of payment denial. The 30-calendar-day period begins on the date the plan or insurer receives the information necessary to decide the claim. The initial payment should be an amount that the plan or insurer reasonably intends to be payment in full based on the relevant facts and circumstances and as required under the terms of the plan, prior to the beginning of any open negotiation period or initiation of the federal IDR process.

Second, the checklist outlines the information that a plan or insurer must provide in writing to a provider with each initial payment or notice of payment denial. Such items include the qualifying payment amount, which is the median contracted rate for the item or service for the geographic region, if participant cost-sharing was based on this amount. The plan or insurer must also provide the phone and email address for the appropriate contact person or office, in the event the provider wishes to initiate a 30-day open negotiation period to determine the total payment amount.

Third, the guidance explains that the 30-day open negotiation period can be initiated by one party providing the standard open negotiation notice to the other party. In such an event, the open negotiation period begins on the day that the initiating party sends the notice. An extension of the negotiation period can be requested in certain extenuating circumstances.

Finally, the guidance details the information that must be included if a party initiates the federal IDR process. The process must be initiated within four business days after the close of the open negotiation period by submission of a Notice of IDR Initiation to the other party and to the departments.

Group health plan sponsors and their service providers may want to review this practical checklist to ensure compliance with the federal IDR process requirements.

Federal IDR Process Checklist »

For further information on the federal IDR process, please also see our April 28, 2022, article, February 17, 2022, article, and February 3, 2022, article.

On June 9, 2022, the IRS released Announcement 2022-13, in which the agency increased the optional standard mileage rate for computing the deductible costs of operating an automobile for business to 62.5 cents per mile. The optional standard mileage rate for medical and moving expenses is increased to 22 cents per mile. These increases are effective starting on July 1, 2022, and were increased in part due to higher fuel costs. Taxpayers may use the optional standard mileage rates to calculate the deductible costs of operating an automobile for business, medical and moving purposes in lieu of tracking actual costs. These rates are also used by many businesses as benchmarks for reimbursing employees for mileage.

Employers who use these rates as benchmarks should be aware of and account for this increase.

IRS Announcement 2022-13 »

On June 3, 2022, the IRS announced that they will begin a new pre-examination retirement plan compliance program in June of 2022. Plan sponsors who are selected for the program will receive a letter from the IRS indicating that they have 90 days to review their retirement plan’s documentation and operation to determine if they meet the IRS’ requirements. The IRS will potentially schedule a full exam for those employers who do not respond.

Upon completing the review, employers who find mistakes may be able to self-correct through the IRS Employee Plans Compliance Resolution System (EPCRS). If self-correction is not an option, employers can request a closing agreement from the IRS and pay the penalties outlined by the IRS’ Voluntary Correction Program.

The IRS intends to use this process to lessen the taxpayer burden of completing retirement plan investigations. Any employer plan sponsor who is contacted by the IRS as part of this program should work with their service providers and/or legal counsel to review their retirement plan compliance.

Employee Plans Newsletter, June 3, 2022 »

New transparency requirements include a mandate that health plans and health insurance issuers must disclose, on a public website, information regarding in-network rates and out-of-network allowed amounts and billed charges for covered items and services in two separate machine-readable files (MRFs).

The regulations define MRFs as files presented in a digital format that can be imported or read by a computer system for further processing without human intervention, while ensuring no semantic meaning is lost (such as JSON). Based on language in the final regulations, there is an expectation that researchers, legislators, regulators and application developers will compile the information into reports, studies and internet tools, so that it can more readily be used for price comparison purposes. In other words, the information provided may not be immediately understandable by the average layperson, but others may take that data and present it in ways that the average layperson can understand.

The requirement to publicly post the MRFs applies to the group health plan level. The plan sponsor must be sure that the files are on a site available to the general public, meaning not just employees, but regulators, industry groups, application developers, etc. Additionally, the files must be accessible and free of charge without having to establish a user account, password or other credentials, and without having to submit any personal identifying information such as a name, email address or telephone number. Beyond those requirements, the regulations state the sponsor has discretion as to the exact location on the public website, since they are in the best position to determine where the files will be most easily accessible by the intended users.

The regulations allow an insured plan to enter into a written agreement with the insurer to assume liability for the disclosures. Under such an agreement, the carrier would provide the required information and assume responsibility for maintaining and updating it as required under the regulations. Note that the regulations allow either a group health plan or an issuer to enter into an agreement with a third party (such as a TPA) to provide and maintain the required information; however, the responsibility remains with the group health plan or the issuer if the third party fails to perform.