HIPAA and the Cloud’s Shared Responsibility Models

Cloud-based service providers (CSPs), like Amazon Web Services and Microsoft Azure, offer online access to shared computing resources. As such, they have developed a “shared responsibility model” for how CSPs and companies that use their cloud services will share responsibilities when it comes to ensuring security in the cloud. A lot of companies believe that, if they host protected health information (PHI) with a CSP, it is the CSP that is ultimately responsible for ensuring HIPAA compliance. That is NOT the case. While the CSP will generally be responsible for ensuring that their cloud infrastructure is secure under the HIPAA rules, companies using the cloud services are responsible for ensuring the use and disclosure of their own PHI, as well as any of their platforms, applications, and operating systems that live in the cloud, comply with HIPAA. Business Associate Agreements CSPs that want to do business with a company that is subject to HIPAA (like a hospital or physician) will need to sign a Business Associate Agreement (BAA) with that company before any PHI is transmitted or uploaded. Under this BAA, the CSPs generally will agree to maintain appropriate safeguards … Continue reading

Posted in Cloud Based Services, Health Care, HIPAA

Share this Article:

The MACRA Final Rule: In Search of the “Goldilocks” Model

The Medicare Access and CHIP Reauthorization Act (“MACRA”) Final Rule published late last year implements CMS’ new payment approach for physicians and other Medicare Part B eligible clinicians under the Merit-Based Incentive Payment System (“MIPS”) and looks to steer clinicians towards more “at risk” advanced alternative payment models (“Advanced APMs”).  In light of some Congressional concerns on MIPS’ potential negative impact on small physician groups, the Final Rule softened some of the initial timeframes for MIPS implementation.  In addition, the Final Rule proposed a new “ACO Track 1+” model that would qualify as Advanced APM, which some providers hope will turn out to be that ACO in the “goldilocks zone” – not too much, not too little, but just the right balance of shared savings and risk.  Last week, CMS issued some new guidance regarding the ACO Track 1+ model and promised to provide additional details in the coming months. CMS helps (or hopes) to ease into MIPS As we noted in our prior blog post on the MACRA Proposed Rule, MIPS represents the consolidation of three CMS reporting programs: Physician Quality Reporting System, the Value-Based Modifier Program, and Meaningful … Continue reading

Posted in MACRA | Tagged ,

Share this Article:

If Obamacare’s Days are Numbered, What’s Next? Trumpcare.

The Affordable Care Act has withstood 62 repeal attempts by the House of Representatives and several challenges brought to the U.S. Supreme Court.  Now, with Donald Trump as President and a new Republican-led House and Senate, full or partial repeal of the ACA seem likely to occur sometime in 2017, perhaps with a delayed effective date.  What impact would an ACA repeal have on healthcare industry?  Is a full repeal possible?  What are the potential varieties and timing of any replacement “Trumpcare” programs?  Below are some of our initial thoughts on some of these questions. Provider uncertainty ahead. Several stock analysts have expressed concern that successful repeal of the ACA would have a negative financial impact on health care providers and that any replacement would not be as lucrative for providers.  The first immediate impact after the election of Trump was a sharp decline in stock prices for some healthcare services companies, although some medical device and pharmaceutical companies saw a rise in stock prices, presumably on theory that less regulation would be better for their businesses.  MACRA was the result of bi-partisan consensus to move into alternative payment models … Continue reading

Posted in Affordable Care Act | Tagged , ,

Share this Article:

“Pick Your Pace” for MACRA Rollout (But Don’t Be Too Slow)

CMS Acting Administrator Andy Slavitt recently announced that CMS would provide new physician reporting options for the first year of the MACRA program starting January 1, 2017. In response to concerns about the MACRA Proposed Rule, including how excessive reporting can distract from patient care, Administrator Slavitt outlined four options for first-year reporting, which are summarized below. As we noted in a recent Health Law Checkup blog post, it is perhaps not surprising that CMS chose to provide physicians with additional flexibility for the program’s first-year reporting requirements, given the condensed rollout schedule.  Ultimately, we still need to see the final details in the MACRA Final Rule, which is due out by November 1, 2016, to gauge how much flexibility CMS is actually providing and whether there are any intended or unintended consequences for physicians that pick a “slower” reporting pace.  For example, payment adjustments for those participating in the Merit-based Incentive Payment System (“MIPS”) will increase dramatically – from plus/minus 4% in 2019 to plus/minus 9% in 2022 – so physicians may not want to slow down efforts to prepare for MACRA, despite these new first-year reporting changes. First … Continue reading

Posted in MACRA | Tagged

Share this Article:

More (MACRA) Data Analysis, Please

On July 1, CMS finalized new MACRA rules that significantly expand how qualified data entities will be allowed to share or sell analyses of Medicare and private claims data to providers, insurers, employers, and others who, in turn, can use the data to support improved care.  In announcing the new rules, CMS’ Chief Data Officer, Niall Brennan, stated that “ncreasing access to analyses and data that include Medicare data will make it easier for stakeholders throughout the healthcare system to make smarter and more informed healthcare decisions.” The goal of the program is that through data analytics, organizations will be able to identify and implement improvements to clinical practice standards and population health strategies.  In fact, MACRA’s new advanced alternative payment models, which require physician groups to assume greater downside financial risk, would likely benefit from any improvements to population health strategies that are derived from this new data mining initiative. CMS also hopes that these new rules will increase the number of organizations that are interested in its qualified entity program. Currently, there are 15 certified qualified entities, although CMS noted in the final rule that only 2 qualified … Continue reading

Posted in MACRA | Tagged ,

Share this Article:

Key issues to watch in the MACRA Proposed Rule

The MACRA Proposed Rule details CMS’ new payment approach, which emphasizes and rewards the use of interoperable health information technology by physicians and other Medicare Part B clinicians and that steers clinicians toward alternative payment models.  The Proposed Rule would establish key parameters for the new Quality Payment Program, a framework that includes the Merit-based Incentive Payment System (MIPS) and Alternative Payment Models (APMs). These policies were established by the latest, permanent ‘doc fix,’ that Congress passed in 2015. MIPS and APMs The bad news: more acronyms to remember.  The good news: CMS seems to be making a concerted effort to simplify the current quality reporting requirements for physicians.  MIPS will consolidate three current CMS programs: Physician Quality Reporting System, the Value-Based Modifier Program, and Meaningful Use of EHRs.  MIPS will score physician on four performance categories: Quality, Resource Use, Clinical Practice Improvement Activities, and Advancing Care Information (f/k/a Meaningful Use). Most physicians will report through MIPS in the first year of the program, which will be 2019. The MIPS bonus or penalty is proposed to start at 4% and moves successively up to 9% by 2022. APMs will initially … Continue reading

Posted in MACRA | Tagged

Share this Article: