Advisory Committee Meeting Materials

Regulatory Reform Home

Master list of Recommendations adopted by the Secretary’s Advisory Committee on Regulatory Reform (SACRR)

PLEASE NOTE: The list of recommendations has been edited from the prior version posted at this website. Staff worked with SACRR Members to edit the list of adopted recommendations in order to enhance clarity and readability. Notice of this editing process was posted on the Committee’s website (see above) in June 2002. As a result of its review and actions during the Telemeeting of September 9, 2002 and the final meeting on November 21, 2002, the SACRR has determined that the table below represents its list of adopted recommendations. Please click here for more information.

Number	Adopted Recommendation	Committee Action
1	Publish a final rule on the previously proposed rule on Conditions of Participation (COPs) for home health agencies (HHAs) currently in the queue.	Adopted May 2002
2	Announce removal of the Proposed Rules on HHA COPs from the docket if the proposed rule remains dormant for more than six months from the date of adopting this recommendation.	Adopted May 2002
3	Eliminate or modify the definitions of branch office and sub-unit contained within Medicare’s COPs for HHAs to reflect current technology and accepted practices.	Adopted May 2002
4	Allow Medicare+Choice Organizations (M+COs) to access State and county codes and input changes to that data element during the summer of 2002 for payment reconciliation of special status Medicare enrollees. (Direct access to proprietary information held in Federal databases would be limited in accordance with the Privacy Act.)	Adopted May 2002
5	Determine new procedures for processing working aged enrollments for M+CO payment reconciliation purposes and establish pilot. Analyze systems issues with ESRD enrollments and propose workarounds.	Adopted May 2002
6 *	Simplify the Medicare program’s data filing process requirements in Adjusted Community Rate Proposals (ACRPs) for Medicare+Choice (M+C) health plans; prepare a report due September 30, 2002, to inform that goal which examines the following options. Statutory recommendations that would allow plans to use M+C only data in doing their ACRs. Allow M+COs to make greater use of actuarially-generated information rather than information from the accounting systems in the ACR. Reduce the number of filings for the 2004 filing. Reduce the back-up documentation required for the 2004 filing. Use simpler filing forms similar to those used in State Department of Insurance filings. Reduce the number of benefit categories submitted in the ACR for the 2004 filings.	Adopted May 2002
7	Provide additional comprehensive training for auditors concerning the development of ACR proposals in order to decrease the occurrence of erroneous and incorrect findings; include industry experts in the faculty for the training sessions. Consult with industry experts in the design of the training.	Adopted May 2002
8	Convene a work group whose goal is to pursue alternative methods of determining a M+COs compliance with Medicare’s regulations, such as by data-driven and "focused review"-based, biennial monitoring visits. (Plans with good performance should not be subject to total review.) Implement work group’s recommendations no later than January 1, 2004.	Adopted May 2002
9 *	Continue to standardize and streamline the process of reviewing M+CO marketing materials, including nationwide use of "use & file" standards; establish uniform performance standards that do not exceed statutory requirements and provide training prior to their use by all CMS Regional Offices (ROs).	Adopted May 2002
10	Establish a policy wherein joint training is conducted for M+CO CMS Regional Office (RO) and Central Office (CO) staff in one setting regarding major initiatives and issuance of significant changes in existing M+C policy.	Adopted May 2002
11	Establish a policy to provide sufficient notice to M+COs to implement major CMS information systems’ changes allowing M+COs to adequately budget for said changes, many of which occur when M+COs are in the midst of implementing other statutory system upgrades, such as Year 2000 and HIPAA.	Adopted May 2002
12	Establish a Special Election Period (SEP) for current M+CO members who wish to enroll in a zero-premium plan offered by the same M+CO in 2002 consistent with the "lock-in" requirement.	Adopted May 2002
13	Establish a policy that allows M+C plans to default members to replacement plans based on the member’s primary care physician choice.	Adopted May 2002
14	Review and revise the language of its template on Medicare Health Plan Compare in situations where there is a $0 premium or $0 co-pay. The fill-in-the-blank default template language does not make sense for situations where the dollar amount is greater than $0. The result is confusing, misleading, and possibly contradictory language as to financial liability.	Adopted May 2002
15	Clarify the 36-month payment reconciliation rule to ensure that the 36-month window runs from the time an M+CO submits its information or claim rather than the time CMS acts on and enters the information or claim into the system.	Adopted May 2002
16	Publish regulations in a timely fashion. States are left in limbo or held financially responsible for unclear policies. (For example, finalize and publish the newest revision of Medicaid and School Health: A Technical Guide for States; clarify the policy related to payment for these services. [The "old" version of the Technical Guide still references Medicaid as a payer of last resort for health-related services. The transmittal of May 2000 indicates the opposite.])	Adopted May 2002
17	Modify the definition of "hospital property" to be only the emergency department and any other health facility that holds itself out to the public as being available to provide emergency or urgent care, as well as the "immediate vicinity" to the hospital property (such as the hospital lawn, parking lot, waiting room, or similar location) in situations where someone seeking emergency care is physically unable to proceed to the actual emergency department or urgent care facility.	Adopted May 2002, with dissent from Mr. Martin.
18	Issue immediate interpretive guidance that use of community-based Emergency Medical Service (EMS) protocols, including established 911 protocols, is not a violation of the Emergency Medical Treatment and Active Labor Act (EMTALA).	Adopted May 2002
19 *	Exclude from the purview of EMTALA patients who are referred to the emergency department for diagnostic or scheduled therapeutic services, unless the diagnosis is part of the EMTALA-required screening or the treatment is part of the EMTALA-required stabilization.	Adopted May 2002
20 *	Resolve the Medicare coverage issues underlying the need for advanced beneficiary notices (ABNs) to have to be provided in the emergency room. Consider waiving the requirement for ABNs and the associated denial of coverage in emergency room and other urgent care settings.	Adopted May 2002
21	Issue interpretive guidance that EMTALA does not apply: In the event of an attack involving multiple casualties and where hospitals use an established disaster plan. In the event of bioterrorism, or the threat of bioterrorism, to those hospitals directly affected and where hospitals follow a community-based, regional or Centers for Disease Control and Prevention (CDC)-directed protocol (especially for highly contagious outbreaks, like smallpox).	Adopted May 2002
22	Review, update, and clarify in regulation and interpretive guidance what is mandated by EMTALA for the physician; clearly distinguish physician medical staff responsibilities from hospital responsibilities. In particular, Centers for Medicare & Medicaid Services (CMS) guidance should provide an explanation as to whether there is a recommended threshold for the application of EMTALA as it relates to the number of specialists and type of specialists on staff who are available to be "on-call" at a particular hospital (e.g., identify safe harbors when physician specialists who are in short supply are "on-call" at more than one hospital at the same time).	Adopted May 2002
23	Require that hospitals be notified when EMTALA investigations are completed, regardless of the outcome.	Adopted May 2002
24	Make Quality Improvement Organization (QIO) review mandatory early in the process and improve training of regional offices and State Agencies to improve performance and consistency of review of complaints. (CMS’ Atlanta Regional Office procedures should be used as a model.)	Adopted May 2002
25	Develop, fund and implement a comprehensive, ongoing communications plan that will be coordinated among HHS, CMS and its contractors, as recommended by the Advisory Panel on Medicare Education, to aggressively reach specific segments of the audience, using the appropriate channels including radio, TV, 1-800-MEDICARE, web and print media, as well as other strategies supported by research results.	Adopted May 2002
26	Continuously improve efforts to educate elderly individuals and/or individuals with disabilities approaching Medicare eligibility.	Adopted May 2002
27	Add the 1-800 MEDICARE phone number and website address to the beneficiary’s Medicare card.	Adopted May 2002
28	Eliminate overly burdensome Medicare Secondary Payer requirements.	Adopted May 2002
29	Research, consumer-test, and evaluate the current Medicare Summary Notice (MSN) and incorporate those enhancements that result in improved beneficiary understanding of the content. Incorporate reasons for noncoverage or denial of service on MSNs in plain language and refer beneficiaries to relevant regulations regarding the noncoverage or denial.	Adopted May 2002
30	Improve and consistently update the Medicare Plan Finder (which includes original Medicare and Medicare+Choice).	Adopted May 2002
31	Develop/implement performance standards for CMS’program of beneficiary education and communication efforts so that the program can be implemented consistently by CMS and all its agents and partners.	Adopted May 2002
32	Develop shorter versions of the Minimum Data Set (MDS) (e.g., one of the quarterly assessments forms) for Medicare and Medicaid resident assessment, to the maximum extent possible. Define the specific uses of any data elements prior to retaining any element on the form as part of an overall streamlining process. Delete or revise all MDS data elements whose reliability is below generally accepted statistical standards.	Adopted May 2002
33	Clarify with interpretive guidance that the MDS is a source document and does not require supporting documentation to justify coded responses.	Adopted May 2002
34	Automate the Resident Assessment Protocols (RAPs) process at the facility level to free up more time to meet patient care needs.	Adopted May 2002
35	Update the Coverage Manual relevant to Medicare Part A (e.g., who can be covered, authorized benefit periods, breaking the spell of illness, and other administrative issues).	Adopted May 2002
36	Integrate updates of the MDS Manual and Resident Assessment (RAI) User Guide and documentation into one manual, distribute the updated guide as soon as possible, and keep the one manual up-to-date. Revise the current manual to incorporate all interpretive guidance and answers to frequently asked questions. Keep a downloadable, up-to-date manual available on the CMS website and publish an annual print edition each year on a set date which incorporates all life-to-date regulation and guidance. Post quarterly updates on interpretive guidance to the CMS website.	Adopted May 2002
37	Continue to develop the MDS 3.0, which will include an analysis of the clinical relevancy of its contents and the capability to capture short stay assessment data, with an expected release date of 2004.	Adopted May 2002
38	Adopt a continuous quality improvement process to keep the MDS tool and the RAI process current with medical practice and changing delivery systems. Establish a scientific and technical advisory panel to guide MDS use (measure work-ups, interpretation of data quality, and interpretation of results, quality reporting, assessment of need for new measures).	Adopted May 2002
39	Give providers joint property rights to any data submitted as part of the MDS process. (This will allow the provider to access backup copies and may reduce the need for providers to warehouse redundant manual versions of the data.)	Adopted May 2002
40	Develop facility-specific analytic reports that allow facilities to compare their own performance in relation to local, regional and national trends. Develop reports and other tools to share aggregate data with all persons.	Adopted May 2002
41	Shorten the interval from when MDS data were originally collected to when the reports of those data are made public. The older the data are, the less relevant the application and inferences to be drawn from those data.	Adopted May 2002
42	Enhance CMS’ investment in education related to the use of the Minimum Data Set (MDS), including web-based training tools, such as the Medicare Learning Network. Update the skilled nursing facility (SNF) section of the Medicare Learning Network to include a detailed tutorial on MDS.	Adopted May 2002
43	Eliminate data elements that are not used for payment, quality measurement, or survey purposes for those resident assessments performed solely for the purpose of complying with Medicare payment requirements.	Adopted May 2002
44	Consolidate the number and timing of all MDS assessments to those that are required for care planning purposes, to the maximum extent possible. Refine the time frames for MDS assessments so that payment and quality cycles coincide and such cycles require the least number of assessments during short periods of time.	Adopted May 2002
45	Add case mix/risk adjustment to quality indicators, as appropriate.	Adopted May 2002
46	Improve the legend of key terms on the Nursing Home Compare website.	Adopted May 2002
47	Further automate the Minimum Data Set (MDS) process, including the design of publicly available software with "interview wizards" and other intuitive data accumulation methods.	Adopted May 2002
48	Improve the balance of nursing home comparative data available for the public to include both quality of life and quality of care measures.	Adopted May 2002
49	Standardize the investigative protocols of HHS and State survey teams. Increase training for State survey teams. Focus training on the proper interpretation of the regulatory compliance requirements placed on nursing facilities.	Adopted May 2002
50*	Use the Health Insurance Portability and Accountability Act (HIPAA) mandate as the basis to standardize terminology and identify common data elements used by payers, programs, providers, and suppliers of care and to determine whether the Resident Assessment Protocols (RAPs) are confidential and if any access protections are needed.	Adopted May 2002
51	Develop a standard instrument for the assessment of the health and functional status of patients receiving post acute services as mandated by the Benefit Improvement and Protection Act (BIPA); integrate, to the extent feasible, communication standards adopted under the Consolidated Health Information (CHI) eGov initiative as part of the development of this tool.	Adopted May 2002
52	Seek greater partnerships and outreach to the full continuum of academic medical, nursing, and other allied health care training programs in order to expose all health care professionals (not just specialists) to the value of training in gerontology and participation in interdisciplinary teams, and to the utility of clinical patient care data sets in the process of care planning.	Adopted May 2002
53*	Establish an appeal process for default Resource Utilization Group (RUG) payments with a specified time frame for the appeal. Establish clear and reasonable rules concerning submission of the MDS instrument so that providers are not penalized with default RUG payments for legitimate, minor delays in completing an MDS assessment.	Adopted May 2002
54	Change the Outcome and Assessment Information Set (OASIS) policies to better reflect actual home health agency (HHA) operations: Expand the time for completion of the OASIS instrument, for example, from 5 days to 7 days. Change the lock-in time for the OASIS instrument, for example, from 7 days to 14 days. (For example, HHA nurses, especially in rural areas, come to the HHA central office only once a week.)	Adopted May 2002
55	Eliminate separate form for significant change in condition when it occurs in the 5-day window of the follow-up assessment.	Adopted May 2002
56	Create the option to use one OASIS form for all situations of care or change in status.	Adopted May 2002
57	Share the Outcome and Assessment Information Set (OASIS) risk-adjustment methodology with all users; make the information available on the CMS website.	Adopted May 2002
58	Provide access to the studies on the validity of OASIS data, adverse event measurements, and the University of Colorado study on OASIS quality and outcomes.	Adopted May 2002
59	Ensure that data collection efforts facilitate development of care plan. Delete elements that are duplicative or not used for payment (including risk adjustment), quality management, or survey purposes. CMS should particularly scrutinize elements listed in Miami testimony, including MO190, MO340, MO640-680, and MO780. Eliminate OASIS encounters that are not used for payment, quality management, or survey purposes.	Adopted May 2002
60	Consider the impact of HIPAA on HHAs with respect to the timing of any changes to the OASIS.	Adopted May 2002
61	Adopt a continuous quality improvement process to keep the OASIS tool current with medical practice and changing delivery systems. Establish a scientific and technical advisory panel to guide OASIS use (measure work-ups, interpretation of data quality, interpretation of results, quality reporting, assessment of need for new measures).	Adopted May 2002
62	Field test new OASIS measures before they are put into use.	Adopted May 2002
63	Clarify the definition of "significant change." Consider using re-hospitalization as a proxy for "significant change."	Adopted May 2002
64	Conduct an independent evaluation of the cost-benefit of using the OASIS form.	Adopted May 2002
65	Create modern-day electronic and on-line enrollment processes for physicians and Part B suppliers. Immediately implement a system that allows providers to submit electronic applications via e-mail. Develop a secure website for provider enrollment.	Adopted May 2002
66 *	Seek legislation that would require all insurance companies and other government payers to recognize the validity of the Medicare enrollment process and prohibit them from developing their own processes. (For provider enrollment.)	Adopted May 2002
67	Create and maintain one central repository of forms required or allowed by HHS or its principal components from all of the various HHS websites.	Adopted May 2002
68	Create a continuous review process for all forms with an eye to constantly improving and streamlining existing forms and eliminating obsolete forms.	Adopted May 2002
69	Redesign all forms and data requirements to seamlessly interface with the Information Technology (IT) architecture of HHS so as to minimize human intervention and optimize IT output. Do not publish new forms until IT issues have been addressed.	Adopted May 2002
70	Eliminate Medicare credit balance reporting.	Adopted May 2002
71	Eliminate forms HCFA 1513 and HCFA 1514.	Adopted May 2002
72	Incorporate form HCFA 2572 into CMS 855.	Adopted May 2002
73	Reduce costs and speed up administrative activities for providers, suppliers, health plans, and consumers by modernizing HHS IT, processes, and applications: Implement use of electronic signatures. Implement use of e-filing. Integrate data acquisition into IT architecture of HHS and data providers. Maximize use of web-based transactions.	Adopted May 2002
74	Modernize the current Medicare Cost Report (MCR), make it more useful, more creative, and less burdensome: Eliminate CMS 339; fold data into the MCR. Eliminate need to file redundant manual data to support the MCR. Modernize and speed up current audit process, settle MCRs within one year and first round appeals within six months. Establish a method to electronically file MCRs into a central repository similar to the U.S. Securities and Exchange Commission’s Electronic Data Gathering and Retrieval (EDGAR) system.	Adopted May 2002
75	Use Generally Accepted Accounting Principles-based cost reporting for providers who no longer receive cost reimbursement; continue to use a simplified and streamlined version of the MCR for cost-based providers.	Adopted May 2002, with dissent from Ms. Pattee
76	Issue clear directions to carriers and State Agencies that observations made on the MDS, OASIS, and other HHS-approved survey instruments do not require redundant manual documentation to support the observations.	Adopted May 2002
77	Connect data instruments and acquisition efforts so data can be transferred and applied to another use or another site of service.	Adopted May 2002
78	Provide resources to meet the January 1, 2005, deadline set by Congress for the development of standard patient assessment instruments as mandated by BIPA. Involve providers and patients in this process.	Adopted May 2002
79	Adopt protocols for joint ownership of data thus eliminating the need for manual backup copies of data.	Adopted May 2002
80	Establish a task force funded to address specific issues related to current practices, whereby a single provider or health plan may be reviewed/surveyed/audited by numerous State and Federal entities (especially those under the auspices of the Secretary of HHS), none of which are required to be coordinated. The task force should also address regulatory oversight. The task force will be established no later than December 31, 2002 and it will have a six-month time frame for recommendations to be submitted.	Adopted May 2002
81	Simplify the authorization process by adopting the Notice of Proposed Rulemaking (NPRM) proposal at 45 CFR § 164.508 that would permit a single, relatively straightforward form to cover all authorization settings.	Adopted May 2002
82	Require a covered entity that obtains direct or indirect remuneration from a third party for requesting any authorization relating to use or disclosure of an individual’s medical information to reveal that fact, as well as the third party source of the remuneration. (This may be achieved by including the following provisions within 45 CFR § 164.508(c)(2): "(_) If use or disclosure of protected health information by any entity pursuant to an authorization requested by a covered entity will result in direct or indirect remuneration to the requesting covered entity from a third party, a statement that such remuneration will result and identification of the third party or class of third parties who will furnish the remuneration.")	Adopted May 2002
83	Allow a covered entity to use and disclose the minimum necessary protected health information without individuals’ authorizations to distribute a newsletter or similar general circulation communication to a broad cross-section of patients, enrollees or other broad group of individuals. Clarify that this activity is allowed by adding the following new rule as 45 CFR § 164.508(a)(3)(i)(C): "(C) A newsletter or similar type of general communication device that the covered entity distributes to a broad cross-section of patients, enrollees, or other broad group of individuals."	Adopted June 2002; Re-adopted September 2002, with dissent from Dr. Olsen, Ms. Ryan, Mr. Toby
84	Redefine activities that are not marketing as follows. As the NPRM proposes, add "care coordination" and "case management" to activities that are not marketing, and allow medical information use and disclosure without authorization for communications regarding (a) members of a provider’s or health plan’s network, (b) products or services, or payments for such products or services, provided by a covered entity or included in health plan benefits, (c) treatment of the individual, or (d) directing or recommending alternative treatments, therapies, health care providers, or care settings. Close loopholes in the NPRM proposal by requiring covered entities to reveal the fact and source of any third-party remuneration for making "non-marketing" communications and allowing individuals to opt out of future such communications. (This may be accomplished by adding the following provisions as new 45 CFR § 164.514(e): "(e)(1) Standards: certain communications involving remuneration. Except when the communication is contained in a newsletter or similar type of general communication device that the covered entity distributes to a broad cross-section of patients, enrollees, or other broad group of individuals, a covered entity that uses or discloses an individual’s protected health information to communicate with that individual by any means, other than face-to-face with that individual, about any of the matters described in paragraphs (e)(1)(i)-(iii) of this section, and that receives or will receive direct or indirect remuneration from a third party for making the communication, must meet the requirements of paragraph (e)(2) of this section. "(i) The covered entity communicates with an individual to describe the entities participating in a health care provider network or a health plan network, or to describe if, and the extent to which, a product or service (or payment for such product or service) is provided by a covered entity or included in a plan of benefits. "(ii) The covered entity communicates with an individual for treatment of that individual. "(iii) The covered entity communicates with an individual for case management or care coordination for that individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to that individual. "(2) Implementation specifications: requirements relating to certain communications involving remuneration. Except when the communication is contained in a newsletter or similar type of general communication device that the covered entity distributes to a broad cross-section of patients, enrollees, or other broad group of individuals or is face-to-face with the individual, a covered entity that makes a communication as described in paragraphs (e)(1)(i)-(iii) of this section and that receives or will receive direct or indirect remuneration from a third party for making the communication must in the communication: "(i) Identify the covered entity as the party making the communication; "(ii) Prominently state that the covered entity has received or will receive remuneration from a third party for making the communication and disclose the name of the third party providing the remuneration; and "(iii) Provide instructions describing how the individual may opt out of receiving future such communications, and for each individual who so opts-out, avoid any future such communications with that individual.") Clarify in the rule, or at least in the preamble to the rule, that an activity that the Privacy Rule characterizes as "not marketing" may still be marketing regulated by other applicable Federal and State laws, such as FDA regulations, CMS rules addressing Medicare+Choice (M+C) materials, and the anti-kickback and anti-influencing laws (Social Security Act §§ 1128A(a)(5), 1128B(b)). HHS Office of Civil Rights (OCR) should coordinate the final "marketing" provisions of the Privacy Rule with the HHS Office of Inspector General, FDA, and other appropriate Federal agencies to ensure consistency in regulatory provisions among these agencies.	Adopted June 2002; Re-adopted September 2002, with dissent from Dr. Olsen, Mr. Toby
85	Clarify that incidental use and disclosure is permitted (45 CFR §§ 164.502(a), 164.530(c)) by adopting the NPRM provisions that specify that uses and disclosures reasonably incidental to permitted uses and disclosures of medical information are not violations of the Privacy Rule.	Adopted May 2002
86	Clarify the provisions on informal permission for persons involved in payment related to an individual’s health care, so that communications with family or others acting for an individual "not present" to resolve payment matters relating to the individual’s health care, are permitted. (This can be accomplished by rewording of the first sentence of 45 CFR § 164.510(b)(3) as follows: "(3) Limited uses and disclosures when the individual is not present. If the individual is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual’s incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s health care or payment related to the individual’s health care.")	Adopted May 2002
87	Reconcile potential conflict between confidential communications and explanations of benefits (EOB) issuance (45 CFR §§ 164.501 ("Payment"), 164.522(b)(1)) by clarifying that a health plan may require the person demanding confidential communication to explain how the health plan can perform its payment obligations of issuing EOBs to the subscriber. Require the HHS OCR to coordinate the Privacy Rule with the rules of the Department of Labor’s (DOL) Pension and Welfare Benefits Administration, which regulates Employee Retirement Income Security Act (ERISA) group health plans, in order to avoid conflicting compliance obligations for ERISA group health plans and the health insurers that administer or underwrite them. (This may be accomplished by rewording 45 CFR § 164.522(b)(2)(ii)(A) to state, "When appropriate, information as to how payment activities, including issuance of explanations of benefits to the insured under a health plan, will be handled." Another potential solution is to allow a health plan to warn in its notice of privacy practices that requests for confidential communications may not prevent the insured under a health plan from receiving other information, such as explanations of benefits for others covered by the insured’s policy or benefits plan, that may alert the insured that the individual requesting confidential communications obtained health care. Yet another is to permit a health plan to inform an individual requesting confidential communication that the individual may have to pay for the care to avoid the health plan providing information to the insured through other explanations of benefits or similar communications that may alert the insured that the individual obtained health care in confidence.)	Adopted June 2002; Re-adopted September 2002, with dissent from Dr. Olsen, Ms. Ryan
88	Delete the endangerment requirement at 45 CFR §§ 164.524(a)(3), (4), (d)(2) and leave it to the health care professional’s judgment, exercised in the best interest of the individual or others, whether requested protected health information should be made available to an individual or the individual’s personal representative. Continue to grant the individual or the individual’s personal representative denied access, based on that exercise of professional judgment, the right to have another professional review the access denial. Allow the explanation for the denial to be, simply, "Information has been withheld based on the judgment of a qualified health care professional." (The revised rule and procedures would thus state: "§ 164.524(a) . . . "(3) Reviewable grounds for denial. A covered entity may deny an individual or an individual’s personal representative access to specific protected health information concerning the individual if a licensed health care professional has determined, in the exercise of professional judgment, that providing access to that protected health information is not in the best interest of the individual or others. The individual or the individual’s personal representative has the right to have such denial reviewed in accordance with the procedures of paragraph (d)(4) of this section. "[Delete paragraphs (a)(3)(i)-(iii) and (a)(4) of this section.] "(b) Implementation specifications: requests for access and timely action. . . . "(2) Timely action by the covered entity. (i) . . . the covered entity must act on a request for access no later than 30 days after receipt of the request as follows. . . . "(B) if the covered entity denies the request, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d) of this section. . . . "(d) Implementation specifications: Denial of access. If the covered entity denies access, in whole or in part, to protected health information, the covered entity must comply with the following requirements. . . . "(2) Denial. The covered entity must provide a timely, written denial to the individual, in accordance with paragraph (b)(2) of this section. The denial must be in plain language and contain: "(i) The basis for the denial. If the denial of access is in accordance with paragraph (a)(3) of this section, it is sufficient to state, "Information has been withheld based on the judgment of a qualified health care professional." "(ii) If the denial is in accordance with paragraph (a)(3) of this section, a statement of the individual’s review rights under paragraph (d)(4) of this section, including a description of how the individual may exercise such review rights. "(iii) A description of how the individual may complain to the covered entity pursuant to the complaint procedures in § 164.530(d) or to the Secretary pursuant to the procedures in § 160.306. The description must include the name, or title, and telephone number of the contact person or office designated in § 164.530(a)(1)(ii) "(4) Review of denial requested. If the individual or the individual’s personal representative requests review of a denial of access under paragraph (a)(3) of this section, the covered entity must designate a licensed health care professional to review the decision to deny access. This designated reviewing official must not have been directly involved in the denial and must be qualified by training or experience to make an informed evaluation whether withholding the protected health information to which access has been denied is in the best interest of the individual or others. The covered entity must promptly refer the request for review to such designated reviewing official. The designated reviewing official must determine, within a reasonable time, whether to deny or grant the access requested based on the designated reviewing official’s professional judgment, exercised in the best interest of the individual or others. The covered entity must promptly provide written notice to the individual or the individual’s personal representative of the determination of the designated reviewing official, and take all action required by this section to carry out the designated reviewing official’s determination.")	Adopted June 2002; Re-adopted September 2002, with dissent from Dr. Olsen, Ms. Ryan and Mr. Toby
89	Allow an additional year for covered entities to conform pre-existing contracts with business associates to the Privacy Rule’s requirements and issue the model business associate terms suggested by the NPRM.	Adopted May 2002
90	Modify the Privacy Rule to specify that a covered entity serving as a business associate must comply with each provision of 45 CFR § 164.504(e)(2) applicable to that business associate relationship. Continue to require that the covered entity specify in writing the uses and disclosures that the business associate covered entity is allowed to make, as required by 45 CFR § 164.504(e)(2)(i). (This provision is needed because a business associate is permitted to use and disclose the protected health information of the covered entity it serves only as that covered entity allows. This approach can be implemented as follows. Revise 45 CFR § 164.502(e)(1)(iii) to state: "(iii) A covered entity acting as the business associate of another covered entity will be in noncompliance with the standards, implementation specifications, and requirements of this paragraph and § 164.504(e) of this subpart if the business associate covered entity violates any of the provisions of § 164.504(e)(2) of this subpart, including any use or disclosure of the protected health information of the covered entity on whose behalf the covered entity business associate is acting that is inconsistent with the uses and disclosures of such information specified in writing as required by paragraph (e)(2)(i) of this section by the covered entity on whose behalf the business associate covered entity is acting." Revise 45 CFR § 164.502(e)(2) to state: "(2) Implementation specification: satisfactory assurance. A covered entity must document the satisfactory assurances required by paragraph (e)(1) of this section by: "(i) For a business associate who is also a covered entity, specifying in writing the permitted and required uses and disclosures of the covered entity’s protected health information by the business associate in compliance with § 164.504(e)(2)(i) of this subpart. "(ii) For a business associate who is not a covered entity, obtaining a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e) of this subpart.")	Adopted May 2002
91	Adopt the NPRM proposal at 45 CFR §§ 160.202, 164.502(g) to clarify that parents’ access to the medical information of their unemancipated children is controlled by State law, and when State law is silent, by the covered entity’s professional judgment.	Adopted May 2002
92	Adopt the NPRM proposal at (45 CFR § 164.504(a)) to remove "primary" from the hybrid entity definition and give any covered entity with non-covered functions the option to designate itself a hybrid entity. (By adopting this proposal, the covered entity will be required to identify each of its operations that perform covered functions and subject these health care components, as well as each component that serves the health care components in a business associate capacity, to Privacy Rule compliance. The effect will be that the health care components, and the components serving them in a business associate capacity, may not disclose their protected health information to, or allow their protected health information to be used by, non-health care components unless the Privacy Rule allows such disclosure or use. For example, a health care component will not be allowed to disclose its protected health information to the covered entity’s human resources personnel performing non-covered employment functions. It also means that individually identifiable health information held by the covered entity’s non-health care components [e.g., health information in the human resources department is not protected health information subject to the Privacy Rule.])	Adopted May 2002; Re-Adopted September 2002 with dissents from Dr. Olsen and Mr. Toby
93	Adopt the NPRM proposal at 45 CFR §164.501 ("Protected Health Information") that would exclude employment records from the protected health information definition.	Adopted May 2002, with dissent from Dr. Olsen
94	Adopt the NPRM proposal at 45 CFR § 164.504(f) to explicitly state that a health plan may disclose enrollment data to the employer or other sponsor of the group health plan, even if the sponsor does not qualify under the Privacy Rule to perform plan administration functions.	Adopted May 2002
95	Adopt the NPRM proposal at 45 CFR § 164.514(b)(2)(i)(R) that would make clear that a re-identification code or key under 45 CFR § 164.514(c) does not have to be deleted to de-identify data.	Adopted May 2002
96	Clarify the de-identification safe harbor knowledge requirement 45 CFR § 164.514(b)(2) by making clear that "other information" must be available outside the covered entity and by clarifying the meaning of "actual knowledge" in the corporate context. (This may be accomplished by revising 45 CFR § 164.514(b)(2)(ii) as follows: "(ii) The covered entity determines, after documented inquiry of those of its components that may be reasonably expected to know, that it has no actual knowledge that the information could be used alone or in combination with other information available outside of the covered entity to identify an individual who is a subject of the information.")	Adopted May 2002
97	Set a defined schedule (45 CFR § 160.104) for issuance of final modifications, additions, and deletions to the privacy standards, and for compliance with those modifications and additions as follows: Publish final modifications, additions, and deletions to privacy standards as final rules in the Federal Register on the same, pre-set calendar date each year (for example, December 1 or nearest business day before that date). Establish a six-month compliance date for routine modifications and additions to privacy standards. Specify a longer compliance period for major privacy standards changes that require the industry to have very long planning periods. (This recommendation assumes that the nature of modifications will vary from year to year. In some years, changes may be minor in nature, while in others may be far-reaching.)	Adopted May 2002; Re-adopted November 2002
98	Establish a Privacy Rule advisory panel either within the National Committee on Vital and Health Statistics or as a separate advisory committee or task force, to concentrate on improving the operation and consumer privacy protections of the Privacy Rule and to advise HHS on the modification, additions, and deletions to the Privacy Rule’s standards and implementation specifications for the defined annual Privacy Rule Modification cycle. The advisory panel or task force should be comprised of health industry representatives, patients, and health plan enrollees with significant operational experience in the delivery and financing of health care and representative of various government agencies, including FDA, DOL, OIG, Department of Justice, State Medicaid programs, etc. that regulate activities affecting health care delivery or financing.	Adopted May 2002
99	CMS should eliminate the Evaluation & Management documentation guidelines.	Adopted May 2002, with dissent from Dr. Olsen
100	Encourage skilled nursing facilities (SNFs) certified to participate in Medicare to use the new shorter assessment form (called the Medicare Payment Assessment Form) to update a Medicare beneficiary’s condition on days 5, 14, 30, 60 and 90 of the person's stay in the nursing home. Maintain the policy that SNFs complete the full MDS to assess resident status on admission, annually and upon significant change in resident status thereafter. (Note: the requirement that the admission MDS is to be completed no later than l4 days after the resident’s admission would continue in force.)	Adopted June 2002
101	Consider the efficacy of making the collection of OASIS mandatory for Medicare patients only.	Adopted June 2002 with dissent from Dr. Olsen, Mr. Fay, and Mr. Bloom
102*	Establish incentives to encourage State Medicaid programs to discontinue requiring forms HCFA 1513, HCFA 1514, HCFA 1561, HCFA 2572 and other forms no longer used by CMS.	Adopted June 2002
103	Expand the J Code system to more accurately define the package size used. If available package sizes are 100 mg, 200 mg, and 1 gram, have separate codes for each of those sizes, with corresponding reimbursements.	Adopted June 2002
104	Further clarify the HIPAA final transaction rules to allow providers to make changes in the event the National Drug Code (NDC) system is going to remain a part of the initial HIPAA transactions codes implementation.	Adopted June 2002
105	Clearly define covered drug products instead of broadly defining what may qualify as self-administered.	Adopted June 2002
106	Use patient-specific modifiers that may move drugs into a covered category for patients with limited mobility and/or capability to understand therapeutic schedules.