On Aug. 19, 2009, the Department of Health and Human Services (HHS) released an advance copy of the interim final regulations entitled “Breach Notification for Unsecured Protected Health Information.” The new regulations require HIPAA covered entities, such as ambulance service providers, to notify individuals when their unsecured health information has been breached.

The Office of Inspector General (OIG) posted Advisory Opinion 09-13, where the OIG approved a subsidy arrangement between a Hospital and an Ambulance Cooperative. Under the arrangement, the Ambulance Cooperative would assume responsibility for providing ALS services currently provided by the Hospital, and the Hospital would provide a subsidy to the Cooperative (in the form of cash, equipment, and services) to be used exclusively to subsidize the provision of the ALS services. The OIG stated that, given the unique circumstances that were present, the arrangement posed a low risk of abuse under the Anti-Kickback Statute (AKS) and it would not impose sanctions for the arrangement. However, this was a highly fact specific, unique, and confusing situation. As with all other Advisory Opinions, it is only binding on the requesting party.

ON April 30, 2009, the Office of Inspector General (OIG) issued Advisory Opinion 09-03, in which, for the first time, the OIG approved the waiver of Medicare copayments and deductibles by municipal ambulance services who provide occasional backup services to each others' residents. While prior OIG opinions have long permitted municipal ambulance services to treat taxes as resident copayments, this is the first time the OIG has approved the practice in the context of reciprocal waivers by neighboring providers that furnish occasional "backup" ambulance services to one another. Click the article title above to go to PWW's Compliance Resource Page and download Advisory Opinion 09-03.

This week, President Obama is expected to sign into law the $787 billion stimulus bill. Included in the bill are strong new privacy and security measures that will generate significant changes to the current HIPAA regulations. These changes not only affect covered entities under HIPAA, but they directly affect many organizations that perform services on their behalf. The bill makes business associates directly subject many requirements under HIPAA and contains provisions that would make patient notification mandatory in the event of an unauthorized disclosure of unsecured protected health information. It also places new restrictions on certain disclosures, increases penalties for violations of the Privacy and Security Rules, and requires more accounting of disclosures from electronic health records. Click on the link above to find out how this will affect your organization.

CMS published the “State Flexibility for Medicaid Benefit Packages” Final Rule (73 FR 73694 – 73727) implementing a provision of the Deficit Reduction Act of 2005 (“DRA”). A copy of the rule, with relevant portions bookmarked and highlighted, is available by clicking on the article title above. While many of our comments to the Proposed Rule received honorable mention, CMS decided to implement the Proposed Rule without modification, effective February 2, 2009.