|
Number |
Adopted
Recommendation |
Committee
Action |
|
1 |
Publish
a final rule on the previously proposed rule on Conditions of
Participation (COPs) for home health agencies (HHAs) currently
in the queue. |
Adopted
May 2002 |
|
2 |
Announce
removal of the Proposed Rules on HHA COPs from the docket if the
proposed rule remains dormant for more than six months from the date
of adopting this recommendation. |
Adopted
May 2002 |
|
3 |
Eliminate
or modify the definitions of branch office and sub-unit contained
within Medicares COPs for HHAs to reflect current technology and
accepted practices. |
Adopted
May 2002 |
|
4 |
Allow
Medicare+Choice Organizations (M+COs) to access State and county
codes and input changes to that data element during the summer of
2002 for payment reconciliation of special status Medicare
enrollees. (Direct access to proprietary information held in Federal
databases would be limited in accordance with the Privacy Act.) |
Adopted
May 2002 |
|
5 |
Determine
new procedures for processing working aged enrollments for M+CO
payment reconciliation purposes and establish pilot. Analyze systems
issues with ESRD enrollments and propose workarounds. |
Adopted
May 2002 |
|
6
* |
Simplify
the Medicare programs data filing process requirements in
Adjusted Community Rate Proposals (ACRPs) for Medicare+Choice (M+C)
health plans; prepare a report due September 30, 2002, to inform
that goal which examines the following options.
- Statutory
recommendations that would allow plans to use M+C only data in
doing their ACRs.
- Allow
M+COs to make greater use of actuarially-generated information
rather than information from the accounting systems in the ACR.
- Reduce
the number of filings for the 2004 filing.
- Reduce
the back-up documentation required for the 2004 filing.
- Use
simpler filing forms similar to those used in State Department
of Insurance filings.
- Reduce
the number of benefit categories submitted in the ACR for the
2004 filings.
|
Adopted
May 2002 |
|
7 |
Provide
additional comprehensive training for auditors concerning the
development of ACR proposals in order to decrease the occurrence of
erroneous and incorrect findings; include industry experts in the
faculty for the training sessions. Consult with industry experts in
the design of the training. |
Adopted
May 2002 |
|
8 |
Convene
a work group whose goal is to pursue alternative methods of
determining a M+COs compliance with Medicares regulations, such
as by data-driven and "focused review"-based, biennial
monitoring visits. (Plans with good performance should not be
subject to total review.) Implement work groups recommendations
no later than January 1, 2004. |
Adopted
May 2002 |
|
9
* |
Continue
to standardize and streamline the process of reviewing M+CO
marketing materials, including nationwide use of "use &
file" standards; establish uniform performance standards that
do not exceed statutory requirements and provide training prior to
their use by all CMS Regional Offices (ROs). |
Adopted
May 2002 |
|
10 |
Establish
a policy wherein joint training is conducted for M+CO CMS
Regional Office (RO) and Central Office (CO) staff in one setting
regarding major initiatives and issuance of significant changes in
existing M+C policy. |
Adopted
May 2002 |
|
11 |
Establish
a policy to provide sufficient notice to M+COs to implement major
CMS information systems changes allowing M+COs to adequately
budget for said changes, many of which occur when M+COs are in the
midst of implementing other statutory system upgrades, such as Year
2000 and HIPAA. |
Adopted
May 2002 |
|
12 |
Establish
a Special Election Period (SEP) for current M+CO members who wish to
enroll in a zero-premium plan offered by the same M+CO in 2002
consistent with the "lock-in" requirement. |
Adopted
May 2002 |
|
13 |
Establish
a policy that allows M+C plans to default members to replacement
plans based on the members primary care physician choice. |
Adopted
May 2002 |
|
14 |
Review
and revise the language of its template on Medicare Health Plan
Compare in situations where there is a $0 premium or $0 co-pay. The
fill-in-the-blank default template language does not make sense for
situations where the dollar amount is greater than $0. The result is
confusing, misleading, and possibly contradictory language as to
financial liability. |
Adopted
May 2002 |
|
15 |
Clarify
the 36-month payment reconciliation rule to ensure that the 36-month
window runs from the time an M+CO submits its information or claim
rather than the time CMS acts on and enters the information or claim
into the system. |
Adopted
May 2002 |
|
16 |
Publish
regulations in a timely fashion. States are left in limbo or held
financially responsible for unclear policies. (For example, finalize
and publish the newest revision of Medicaid and School Health: A
Technical Guide for States; clarify the policy related to
payment for these services. [The "old" version of the Technical
Guide still references Medicaid as a payer of last resort for
health-related services. The transmittal of May 2000 indicates the
opposite.]) |
Adopted
May 2002 |
|
17 |
Modify
the definition of "hospital property" to be only the
emergency department and any other health facility that holds itself
out to the public as being available to provide emergency or urgent
care, as well as the "immediate vicinity" to the hospital
property (such as the hospital lawn, parking lot, waiting room, or
similar location) in situations where someone seeking emergency care
is physically unable to proceed to the actual emergency department
or urgent care facility. |
Adopted
May 2002,
with dissent from
Mr. Martin.
|
|
18 |
Issue
immediate interpretive guidance that use of community-based
Emergency Medical Service (EMS) protocols, including established 911
protocols, is not a violation of the Emergency Medical Treatment and
Active Labor Act (EMTALA). |
Adopted
May 2002 |
|
19
* |
Exclude
from the purview of EMTALA patients who are referred to the
emergency department for diagnostic or scheduled therapeutic
services, unless the diagnosis is part of the EMTALA-required
screening or the treatment is part of the EMTALA-required
stabilization. |
Adopted
May 2002 |
|
20
* |
Resolve
the Medicare coverage issues underlying the need for advanced
beneficiary notices (ABNs) to have to be provided in
the emergency room. Consider waiving the requirement for ABNs and
the associated denial of coverage in emergency room and other urgent
care settings. |
Adopted
May 2002 |
|
21 |
Issue
interpretive guidance that EMTALA does not apply:
- In
the event of an attack involving multiple casualties and where
hospitals use an established disaster plan.
- In
the event of bioterrorism, or the threat of bioterrorism, to
those hospitals directly affected and where hospitals follow a
community-based, regional or Centers for Disease Control and
Prevention (CDC)-directed protocol (especially for highly
contagious outbreaks, like smallpox).
|
Adopted
May 2002 |
|
22 |
Review,
update, and clarify in regulation and interpretive guidance what is
mandated by EMTALA for the physician; clearly distinguish physician
medical staff responsibilities from hospital responsibilities. In
particular, Centers for Medicare & Medicaid Services (CMS)
guidance should provide an explanation as to whether there is a
recommended threshold for the application of EMTALA as it relates to
the number of specialists and type of specialists on staff who are
available to be "on-call" at a particular hospital (e.g.,
identify safe harbors when physician specialists who are in short
supply are "on-call" at more than one hospital at the same
time). |
Adopted
May 2002 |
|
23 |
Require
that hospitals be notified when EMTALA investigations are completed,
regardless of the outcome. |
Adopted
May 2002 |
|
24 |
Make
Quality Improvement Organization (QIO) review mandatory early in the
process and improve training of regional offices and State Agencies
to improve performance and consistency of review of complaints. (CMS
Atlanta Regional Office procedures should be used as a model.) |
Adopted
May 2002 |
|
25 |
Develop,
fund and implement a comprehensive, ongoing communications plan that
will be coordinated among HHS, CMS and its contractors, as
recommended by the Advisory Panel on Medicare Education, to
aggressively reach specific segments of the audience, using the
appropriate channels including radio, TV, 1-800-MEDICARE, web and
print media, as well as other strategies supported by research
results. |
Adopted
May 2002 |
|
26 |
Continuously
improve efforts to educate elderly individuals and/or individuals
with disabilities approaching Medicare eligibility. |
Adopted
May 2002 |
|
27 |
Add
the 1-800 MEDICARE phone number and website address to the
beneficiarys Medicare card. |
Adopted
May 2002 |
|
28 |
Eliminate
overly burdensome Medicare Secondary Payer requirements. |
Adopted
May 2002 |
|
29 |
Research,
consumer-test, and evaluate the current Medicare Summary Notice
(MSN) and incorporate those enhancements that result in improved
beneficiary understanding of the content. Incorporate reasons for
noncoverage or denial of service on MSNs in plain language and refer
beneficiaries to relevant regulations regarding the noncoverage or
denial. |
Adopted
May 2002 |
|
30 |
Improve
and consistently update the Medicare Plan Finder (which includes
original Medicare and Medicare+Choice). |
Adopted
May 2002 |
|
31 |
Develop/implement
performance standards for CMSprogram of beneficiary education and
communication efforts so that the program can be implemented
consistently by CMS and all its agents and partners. |
Adopted
May 2002 |
|
32 |
Develop
shorter versions of the Minimum Data Set (MDS) (e.g., one of the
quarterly assessments forms) for Medicare and Medicaid resident
assessment, to the maximum extent possible. Define the specific uses
of any data elements prior to retaining any element on the form as
part of an overall streamlining process. Delete or revise all MDS
data elements whose reliability is below generally accepted
statistical standards. |
Adopted
May 2002 |
|
33 |
Clarify
with interpretive guidance that the MDS is a source document and
does not require supporting documentation to justify coded
responses. |
Adopted
May 2002 |
|
34 |
Automate
the Resident Assessment Protocols (RAPs) process at the facility
level to free up more time to meet patient care needs. |
Adopted
May 2002 |
|
35 |
Update
the Coverage Manual relevant to Medicare Part A (e.g., who can be
covered, authorized benefit periods, breaking the spell of illness,
and other administrative issues). |
Adopted
May 2002 |
|
36 |
Integrate
updates of the MDS Manual and Resident Assessment (RAI) User Guide
and documentation into one manual, distribute the updated guide as
soon as possible, and keep the one manual up-to-date. Revise the
current manual to incorporate all interpretive guidance and answers
to frequently asked questions. Keep a downloadable, up-to-date
manual available on the CMS website and publish an annual print
edition each year on a set date which incorporates all life-to-date
regulation and guidance. Post quarterly updates on interpretive
guidance to the CMS website. |
Adopted
May 2002 |
|
37 |
Continue
to develop the MDS 3.0, which will include an analysis of the
clinical relevancy of its contents and the capability to capture
short stay assessment data, with an expected release date of 2004. |
Adopted
May 2002 |
|
38 |
Adopt
a continuous quality improvement process to keep the MDS tool and
the RAI process current with medical practice and changing delivery
systems. Establish a scientific and technical advisory panel to
guide MDS use (measure work-ups, interpretation of data quality, and
interpretation of results, quality reporting, assessment of need for
new measures). |
Adopted
May 2002 |
|
39 |
Give
providers joint property rights to any data submitted as part of the
MDS process. (This will allow the provider to access backup copies
and may reduce the need for providers to warehouse redundant manual
versions of the data.) |
Adopted
May 2002 |
|
40 |
Develop
facility-specific analytic reports that allow facilities to compare
their own performance in relation to local, regional and national
trends. Develop reports and other tools to share aggregate data with
all persons. |
Adopted
May 2002 |
|
41 |
Shorten
the interval from when MDS data were originally collected to when
the reports of those data are made public. The older the data are,
the less relevant the application and inferences to be drawn from
those data. |
Adopted
May 2002 |
|
42 |
Enhance
CMS investment in education related to the use of the Minimum
Data Set (MDS), including web-based training tools, such as the
Medicare Learning Network. Update the skilled nursing facility (SNF)
section of the Medicare Learning Network to include a detailed
tutorial on MDS. |
Adopted
May 2002 |
|
43 |
Eliminate
data elements that are not used for payment, quality measurement, or
survey purposes for those resident assessments performed solely for
the purpose of complying with Medicare payment requirements. |
Adopted
May 2002 |
|
44 |
Consolidate
the number and timing of all MDS assessments to those that are
required for care planning purposes, to the maximum extent possible.
Refine the time frames for MDS assessments so that payment and
quality cycles coincide and such cycles require the least number of
assessments during short periods of time. |
Adopted
May 2002 |
|
45 |
Add
case mix/risk adjustment to quality indicators, as appropriate. |
Adopted
May 2002 |
|
46 |
Improve
the legend of key terms on the Nursing Home Compare website. |
Adopted
May 2002 |
|
47 |
Further
automate the Minimum Data Set (MDS) process, including the design of
publicly available software with "interview wizards" and
other intuitive data accumulation methods. |
Adopted
May 2002 |
|
48 |
Improve
the balance of nursing home comparative data available for the
public to include both quality of life and quality of care measures. |
Adopted
May 2002 |
|
49 |
Standardize
the investigative protocols of HHS and State survey teams. Increase
training for State survey teams. Focus training on the proper
interpretation of the regulatory compliance requirements placed on
nursing facilities. |
Adopted
May 2002 |
|
50* |
Use
the Health Insurance Portability and Accountability Act (HIPAA)
mandate as the basis to standardize terminology and identify common
data elements used by payers, programs, providers, and suppliers of
care and to determine whether the Resident Assessment Protocols (RAPs)
are confidential and if any access protections are needed. |
Adopted
May 2002 |
|
51 |
Develop
a standard instrument for the assessment of the health and
functional status of patients receiving post acute services as
mandated by the Benefit Improvement and Protection Act (BIPA);
integrate, to the extent feasible, communication standards adopted
under the Consolidated Health Information (CHI) eGov initiative as
part of the development of this tool. |
Adopted
May 2002 |
|
52 |
Seek
greater partnerships and outreach to the full continuum of academic
medical, nursing, and other allied health care training programs in
order to expose all health care professionals (not just specialists)
to the value of training in gerontology and participation in
interdisciplinary teams, and to the utility of clinical patient care
data sets in the process of care planning. |
Adopted
May 2002 |
|
53* |
Establish
an appeal process for default Resource Utilization Group (RUG)
payments with a specified time frame for the appeal. Establish clear
and reasonable rules concerning submission of the MDS instrument so
that providers are not penalized with default RUG payments for
legitimate, minor delays in completing an MDS assessment. |
Adopted
May 2002 |
|
54 |
Change
the Outcome and Assessment Information Set (OASIS) policies to
better reflect actual home health agency (HHA) operations:
- Expand
the time for completion of the OASIS instrument, for example,
from 5 days to 7 days.
- Change
the lock-in time for the OASIS instrument, for example, from 7
days to 14 days. (For example, HHA nurses, especially in rural
areas, come to the HHA central office only once a week.)
|
Adopted
May 2002 |
|
55 |
Eliminate
separate form for significant change in condition when it occurs in
the 5-day window of the follow-up assessment. |
Adopted
May 2002 |
|
56 |
Create
the option to use one OASIS form for all situations of care or
change in status. |
Adopted
May 2002 |
|
57 |
Share
the Outcome and Assessment Information Set (OASIS) risk-adjustment
methodology with all users; make the information available on the
CMS website. |
Adopted
May 2002 |
|
58 |
Provide
access to the studies on the validity of OASIS data, adverse event
measurements, and the University of Colorado study on OASIS quality
and outcomes. |
Adopted
May 2002 |
|
59 |
Ensure
that data collection efforts facilitate development of care plan.
- Delete
elements that are duplicative or not used for payment (including
risk adjustment), quality management, or survey purposes. CMS
should particularly scrutinize elements listed in Miami
testimony, including MO190, MO340, MO640-680, and MO780.
- Eliminate
OASIS encounters that are not used for payment, quality
management, or survey purposes.
|
Adopted
May 2002 |
|
60 |
Consider
the impact of HIPAA on HHAs with respect to the timing of any
changes to the OASIS. |
Adopted
May 2002 |
|
61 |
Adopt
a continuous quality improvement process to keep the OASIS tool
current with medical practice and changing delivery systems.
Establish a scientific and technical advisory panel to guide OASIS
use (measure work-ups, interpretation of data quality,
interpretation of results, quality reporting, assessment of need for
new measures). |
Adopted
May 2002 |
|
62 |
Field
test new OASIS measures before they are put into use. |
Adopted
May 2002 |
|
63 |
Clarify
the definition of "significant change." Consider using
re-hospitalization as a proxy for "significant change." |
Adopted
May 2002 |
|
64 |
Conduct
an independent evaluation of the cost-benefit of using the OASIS
form. |
Adopted
May 2002 |
|
65 |
Create
modern-day electronic and on-line enrollment processes for
physicians and
Part
B suppliers.
- Immediately
implement a system that allows providers to submit electronic
applications via e-mail.
- Develop
a secure website for provider enrollment.
|
Adopted
May 2002 |
|
66
* |
Seek
legislation that would require all insurance companies and other
government payers to recognize the validity of the Medicare
enrollment process and prohibit them from developing their own
processes. (For provider enrollment.) |
Adopted
May 2002 |
|
67 |
Create
and maintain one central repository of forms required or allowed by
HHS or its principal components from all of the various HHS
websites. |
Adopted
May 2002 |
|
68 |
Create
a continuous review process for all forms with an eye to constantly
improving and streamlining existing forms and eliminating obsolete
forms. |
Adopted
May 2002 |
|
69 |
Redesign
all forms and data requirements to seamlessly interface with the
Information Technology (IT) architecture of HHS so as to minimize
human intervention and optimize IT output. Do not publish new forms
until IT issues have been addressed. |
Adopted
May 2002 |
|
70 |
Eliminate
Medicare credit balance reporting. |
Adopted
May 2002 |
|
71 |
Eliminate
forms HCFA 1513 and HCFA 1514. |
Adopted
May 2002 |
|
72 |
Incorporate
form HCFA 2572 into CMS 855. |
Adopted
May 2002 |
|
73 |
Reduce
costs and speed up administrative activities for providers,
suppliers, health plans, and consumers by modernizing HHS IT,
processes, and applications:
- Implement
use of electronic signatures.
- Implement
use of e-filing.
- Integrate
data acquisition into IT architecture of HHS and data providers.
- Maximize
use of web-based transactions.
|
Adopted
May 2002 |
|
74 |
Modernize
the current Medicare Cost Report (MCR), make it more useful, more
creative, and less burdensome:
- Eliminate
CMS 339; fold data into the MCR.
- Eliminate
need to file redundant manual data to support the MCR.
- Modernize
and speed up current audit process, settle MCRs within one year
and first round appeals within six months.
- Establish
a method to electronically file MCRs into a central repository
similar to the U.S. Securities and Exchange Commissions
Electronic Data Gathering and Retrieval (EDGAR) system.
|
Adopted
May 2002 |
|
75 |
Use
Generally Accepted Accounting Principles-based cost reporting for
providers who no longer receive cost reimbursement; continue to use
a simplified and streamlined version of the MCR for cost-based
providers. |
Adopted
May 2002, with dissent from
Ms. Pattee
|
|
76 |
Issue
clear directions to carriers and State Agencies that observations
made on the MDS, OASIS, and other HHS-approved survey instruments do
not require redundant manual documentation to support the
observations. |
Adopted
May 2002 |
|
77 |
Connect
data instruments and acquisition efforts so data can be transferred
and applied to another use or another site of service. |
Adopted
May 2002 |
|
78 |
Provide
resources to meet the January 1, 2005, deadline set by Congress for
the development of standard patient assessment instruments as
mandated by BIPA. Involve providers and patients in this process. |
Adopted
May 2002 |
|
79 |
Adopt
protocols for joint ownership of data thus eliminating the need for
manual backup copies of data. |
Adopted
May 2002 |
|
80 |
Establish
a task force funded to address specific issues related to current
practices, whereby a single provider or health plan may be
reviewed/surveyed/audited by numerous State and Federal entities
(especially those under the auspices of the Secretary of HHS), none
of which are required to be coordinated. The task force should also
address regulatory oversight. The task force will be established no
later than December 31, 2002 and it will have a six-month time frame
for recommendations to be submitted. |
Adopted
May 2002 |
|
81 |
Simplify
the authorization process by adopting the Notice of Proposed
Rulemaking (NPRM) proposal at 45 CFR § 164.508 that would permit a
single, relatively straightforward form to cover all authorization
settings. |
Adopted
May 2002 |
|
82 |
Require
a covered entity that obtains direct or indirect remuneration from a
third party for requesting any authorization relating to use or
disclosure of an individuals medical information to reveal that
fact, as well as the third party source of the remuneration. (This
may be achieved by including the following provisions within 45 CFR
§ 164.508(c)(2):
"(_)
If use or disclosure of protected health information by any
entity pursuant to an authorization requested by a covered
entity will result in direct or indirect remuneration to the
requesting covered entity from a third party, a statement that
such remuneration will result and identification of the third
party or class of third parties who will furnish the
remuneration.")
|
Adopted
May 2002 |
|
83 |
Allow
a covered entity to use and disclose the minimum necessary protected
health information without individuals authorizations to
distribute a newsletter or similar general circulation communication
to a broad cross-section of patients, enrollees or other broad group
of individuals. Clarify that this activity is allowed by adding the
following new rule as 45 CFR § 164.508(a)(3)(i)(C):
"(C)
A newsletter or similar type of general communication device
that the covered entity distributes to a broad cross-section of
patients, enrollees, or other broad group of individuals."
|
Adopted
June 2002;
Re-adopted
September 2002, with dissent from Dr. Olsen, Ms. Ryan, Mr. Toby
|
|
84 |
Redefine
activities that are not marketing as follows. As the NPRM
proposes, add "care coordination" and "case
management" to activities that are not marketing, and
allow medical information use and disclosure without authorization
for communications regarding (a) members of a providers or health
plans network, (b) products or services, or payments for such
products or services, provided by a covered entity or included in
health plan benefits, (c) treatment of the individual, or (d)
directing or recommending alternative treatments, therapies, health
care providers, or care settings.
Close
loopholes in the NPRM proposal by requiring covered entities to
reveal the fact and source of any third-party remuneration for
making "non-marketing" communications and allowing
individuals to opt out of future such communications. (This may be
accomplished by adding the following provisions as new 45 CFR
§ 164.514(e):
"(e)(1)
Standards: certain communications involving remuneration.
Except when the communication is contained in a newsletter or
similar type of general communication device that the covered
entity distributes to a broad cross-section of patients,
enrollees, or other broad group of individuals, a covered entity
that uses or discloses an individuals protected health
information to communicate with that individual by any means,
other than face-to-face with that individual, about any of the
matters described in paragraphs (e)(1)(i)-(iii) of this section,
and that receives or will receive direct or indirect
remuneration from a third party for making the communication,
must meet the requirements of paragraph (e)(2) of this section.
"(i)
The covered entity communicates with an individual to describe
the entities participating in a health care provider network or
a health plan network, or to describe if, and the extent to
which, a product or service (or payment for such product or
service) is provided by a covered entity or included in a plan
of benefits.
"(ii)
The covered entity communicates with an individual for treatment
of that individual.
"(iii)
The covered entity communicates with an individual for case
management or care coordination for that individual, or to
direct or recommend alternative treatments, therapies, health
care providers, or settings of care to that individual.
"(2)
Implementation specifications: requirements relating to
certain communications involving remuneration. Except when
the communication is contained in a newsletter or similar type
of general communication device that the covered entity
distributes to a broad cross-section of patients, enrollees, or
other broad group of individuals or is face-to-face with the
individual, a covered entity that makes a communication as
described in paragraphs (e)(1)(i)-(iii) of this section and that
receives or will receive direct or indirect remuneration from a
third party for making the communication must in the
communication:
"(i)
Identify the covered entity as the party making the
communication;
"(ii)
Prominently state that the covered entity has received or will
receive remuneration from a third party for making the
communication and disclose the name of the third party providing
the remuneration; and
"(iii)
Provide instructions describing how the individual may opt out
of receiving future such communications, and for each individual
who so opts-out, avoid any future such communications with that
individual.")
Clarify
in the rule, or at least in the preamble to the rule, that an
activity that the Privacy Rule characterizes as "not
marketing" may still be marketing regulated by other applicable
Federal and State laws, such as FDA regulations, CMS rules
addressing Medicare+Choice (M+C) materials, and the anti-kickback
and anti-influencing laws (Social Security Act
§§ 1128A(a)(5), 1128B(b)). HHS Office of Civil Rights (OCR)
should coordinate the final "marketing" provisions of the
Privacy Rule with the HHS Office of Inspector General, FDA, and
other appropriate Federal agencies to ensure consistency in
regulatory provisions among these agencies. |
Adopted
June 2002;
Re-adopted
September 2002, with dissent from Dr. Olsen, Mr. Toby
|
|
85 |
Clarify
that incidental use and disclosure is permitted (45 CFR §§
164.502(a), 164.530(c)) by adopting the NPRM provisions that specify
that uses and disclosures reasonably incidental to permitted uses
and disclosures of medical information are not violations of the
Privacy Rule. |
Adopted
May 2002 |
|
86 |
Clarify
the provisions on informal permission for persons involved in
payment related to an individuals health care, so that
communications with family or others acting for an individual
"not present" to resolve payment matters relating to the
individuals health care, are permitted. (This can be accomplished
by rewording of the first sentence of 45 CFR § 164.510(b)(3)
as follows:
"(3)
Limited uses and disclosures when the individual is not
present. If the individual is not present, or the
opportunity to agree or object to the use or disclosure cannot
practicably be provided because of the individuals incapacity
or an emergency circumstance, the covered entity may, in the
exercise of professional judgment, determine whether the
disclosure is in the best interests of the individual and, if
so, disclose only the protected health information that is
directly relevant to the persons involvement with the
individuals health care or payment related to the individuals
health care.")
|
Adopted
May 2002 |
|
87 |
Reconcile
potential conflict between confidential communications and
explanations of benefits (EOB) issuance (45 CFR §§ 164.501
("Payment"), 164.522(b)(1)) by clarifying that a health
plan may require the person demanding confidential communication to
explain how the health plan can perform its payment obligations of
issuing EOBs to the subscriber.
Require
the HHS OCR to coordinate the Privacy Rule with the rules of the
Department of Labors (DOL) Pension and Welfare Benefits
Administration, which regulates Employee Retirement Income Security
Act (ERISA) group health plans, in order to avoid conflicting
compliance obligations for ERISA group health plans and the health
insurers that administer or underwrite them.
(This
may be accomplished by rewording 45 CFR § 164.522(b)(2)(ii)(A)
to state, "When appropriate, information as to how payment
activities, including issuance of explanations of benefits to the
insured under a health plan, will be handled."
Another
potential solution is to allow a health plan to warn in its notice
of privacy practices that requests for confidential communications
may not prevent the insured under a health plan from receiving other
information, such as explanations of benefits for others covered by
the insureds policy or benefits plan, that may alert the insured
that the individual requesting confidential communications obtained
health care. Yet another is to permit a health plan to inform an
individual requesting confidential communication that the individual
may have to pay for the care to avoid the health plan providing
information to the insured through other explanations of benefits or
similar communications that may alert the insured that the
individual obtained health care in confidence.) |
Adopted
June 2002;
Re-adopted
September 2002, with dissent from Dr. Olsen, Ms. Ryan
|
|
88 |
Delete
the endangerment requirement at 45 CFR §§ 164.524(a)(3), (4),
(d)(2) and leave it to the health care professionals judgment,
exercised in the best interest of the individual or others, whether
requested protected health information should be made available to
an individual or the individuals personal representative.
Continue to grant the individual or the individuals personal
representative denied access, based on that exercise of professional
judgment, the right to have another professional review the access
denial. Allow the explanation for the denial to be, simply,
"Information has been withheld based on the judgment of a
qualified health care professional."
(The
revised rule and procedures would thus state:
"§
164.524(a) . . .
"(3)
Reviewable grounds for denial. A covered entity may deny an
individual or an individuals personal representative access to
specific protected health information concerning the individual if a
licensed health care professional has determined, in the exercise of
professional judgment, that providing access to that protected
health information is not in the best interest of the individual or
others. The individual or the individuals personal representative
has the right to have such denial reviewed in accordance with the
procedures of paragraph (d)(4) of this section.
"[Delete
paragraphs (a)(3)(i)-(iii) and (a)(4) of this section.]
"(b)
Implementation specifications: requests for access and timely
action. . . .
"(2)
Timely action by the covered entity. (i) . . . the covered
entity must act on a request for access no later than 30 days after
receipt of the request as follows. . . .
"(B)
if the covered entity denies the request, in whole or in part, it
must provide the individual with a written denial, in accordance
with paragraph (d) of this section. . . .
"(d)
Implementation specifications: Denial of access. If the
covered entity denies access, in whole or in part, to protected
health information, the covered entity must comply with the
following requirements. . . .
"(2)
Denial. The covered entity must provide a timely, written
denial to the individual, in accordance with paragraph (b)(2) of
this section. The denial must be in plain language and contain:
"(i)
The basis for the denial. If the denial of access is in accordance
with paragraph (a)(3) of this section, it is sufficient to state,
"Information has been withheld based on the judgment of a
qualified health care professional."
"(ii)
If the denial is in accordance with paragraph (a)(3) of this
section, a statement of the individuals review rights under
paragraph (d)(4) of this section, including a description of how the
individual may exercise such review rights.
"(iii)
A description of how the individual may complain to the covered
entity pursuant to the complaint procedures in § 164.530(d) or to
the Secretary pursuant to the procedures in § 160.306. The
description must include the name, or title, and telephone number of
the contact person or office designated in § 164.530(a)(1)(ii)
"(4)
Review of denial requested. If the individual or the
individuals personal representative requests review of a denial
of access under paragraph (a)(3) of this section, the covered entity
must designate a licensed health care professional to review the
decision to deny access. This designated reviewing official must not
have been directly involved in the denial and must be qualified by
training or experience to make an informed evaluation whether
withholding the protected health information to which access has
been denied is in the best interest of the individual or others. The
covered entity must promptly refer the request for review to such
designated reviewing official. The designated reviewing official
must determine, within a reasonable time, whether to deny or grant
the access requested based on the designated reviewing officials
professional judgment, exercised in the best interest of the
individual or others. The covered entity must promptly provide
written notice to the individual or the individuals personal
representative of the determination of the designated reviewing
official, and take all action required by this section to carry out
the designated reviewing officials determination.") |
Adopted
June 2002;
Re-adopted
September 2002, with dissent from Dr. Olsen, Ms. Ryan and Mr. Toby
|
|
89 |
Allow
an additional year for covered entities to conform pre-existing
contracts with business associates to the Privacy Rules
requirements and issue the model business associate terms suggested
by the NPRM. |
Adopted
May 2002 |
|
90 |
Modify
the Privacy Rule to specify that a covered entity serving as a
business associate must comply with each provision of 45 CFR
§ 164.504(e)(2) applicable to that business associate
relationship. Continue to require that the covered entity specify in
writing the uses and disclosures that the business associate covered
entity is allowed to make, as required by 45 CFR § 164.504(e)(2)(i).
(This
provision is needed because a business associate is permitted to use
and disclose the protected health information of the covered entity
it serves only as that covered entity allows.
This
approach can be implemented as follows. Revise 45 CFR §
164.502(e)(1)(iii) to state:
"(iii)
A covered entity acting as the business associate of another covered
entity will be in noncompliance with the standards, implementation
specifications, and requirements of this paragraph and § 164.504(e)
of this subpart if the business associate covered entity violates
any of the provisions of § 164.504(e)(2) of this subpart, including
any use or disclosure of the protected health information of the
covered entity on whose behalf the covered entity business associate
is acting that is inconsistent with the uses and disclosures of such
information specified in writing as required by paragraph (e)(2)(i)
of this section by the covered entity on whose behalf the business
associate covered entity is acting."
Revise
45 CFR § 164.502(e)(2) to state:
"(2)
Implementation specification: satisfactory assurance. A
covered entity must document the satisfactory assurances required by
paragraph (e)(1) of this section by:
"(i)
For a business associate who is also a covered entity, specifying in
writing the permitted and required uses and disclosures of the
covered entitys protected health information by the business
associate in compliance with § 164.504(e)(2)(i) of this
subpart.
"(ii)
For a business associate who is not a covered entity, obtaining a
written contract or other written agreement or arrangement with the
business associate that meets the applicable requirements of §
164.504(e) of this subpart.") |
Adopted
May 2002 |
|
91 |
Adopt
the NPRM proposal at 45 CFR §§ 160.202, 164.502(g) to clarify that
parents access to the medical information of their unemancipated
children is controlled by State law, and when State law is silent,
by the covered entitys professional judgment. |
Adopted
May 2002
|
|
92 |
Adopt
the NPRM proposal at (45 CFR § 164.504(a)) to remove
"primary" from the hybrid entity definition and give any
covered entity with non-covered functions the option to designate
itself a hybrid entity. (By adopting this proposal, the covered
entity will be required to identify each of its operations that
perform covered functions and subject these health care components,
as well as each component that serves the health care components in
a business associate capacity, to Privacy Rule compliance.
The
effect will be that the health care components, and the components
serving them in a business associate capacity, may not disclose
their protected health information to, or allow their protected
health information to be used by, non-health care components unless
the Privacy Rule allows such disclosure or use. For example, a
health care component will not be allowed to disclose its protected
health information to the covered entitys human resources
personnel performing non-covered employment functions. It also means
that individually identifiable health information held by the
covered entitys non-health care components [e.g., health
information in the human resources department is not protected
health information subject to the Privacy Rule.]) |
Adopted
May 2002; Re-Adopted September 2002 with dissents from Dr. Olsen and
Mr. Toby |
|
93 |
Adopt
the NPRM proposal at 45 CFR §164.501 ("Protected Health
Information") that would exclude employment records from the
protected health information definition. |
Adopted
May 2002, with dissent from
Dr. Olsen
|
|
94 |
Adopt
the NPRM proposal at 45 CFR § 164.504(f) to explicitly state that a
health plan may disclose enrollment data to the employer or other
sponsor of the group health plan, even if the sponsor does not
qualify under the Privacy Rule to perform plan administration
functions. |
Adopted
May 2002 |
|
95 |
Adopt
the NPRM proposal at 45 CFR § 164.514(b)(2)(i)(R) that would make
clear that a re-identification code or key under 45 CFR §
164.514(c) does not have to be deleted to de-identify data. |
Adopted
May 2002 |
|
96 |
Clarify
the de-identification safe harbor knowledge requirement 45 CFR §
164.514(b)(2) by making clear that "other information"
must be available outside the covered entity and by clarifying the
meaning of "actual knowledge" in the corporate context.
(This
may be accomplished by revising 45 CFR § 164.514(b)(2)(ii) as
follows:
"(ii)
The covered entity determines, after documented inquiry of those of
its components that may be reasonably expected to know, that it has
no actual knowledge that the information could be used alone or in
combination with other information available outside of the covered
entity to identify an individual who is a subject of the
information.") |
Adopted
May 2002 |
|
97 |
Set
a defined schedule (45 CFR § 160.104) for issuance of final
modifications, additions, and deletions to the privacy standards,
and for compliance with those modifications and additions as
follows:
- Publish
final modifications, additions, and deletions to privacy
standards as final rules in the Federal Register on the
same, pre-set calendar date each year (for example, December 1
or nearest business day before that date).
- Establish
a six-month compliance date for routine modifications and
additions to privacy standards.
- Specify
a longer compliance period for major privacy standards changes
that require the industry to have very long planning periods.
(This
recommendation assumes that the nature of modifications will vary
from year to year. In some years, changes may be minor in nature,
while in others may be far-reaching.) |
Adopted
May 2002; Re-adopted November 2002 |
|
98 |
Establish
a Privacy Rule advisory panel either within the National Committee
on Vital and Health Statistics or as a separate advisory committee
or task force, to concentrate on improving the operation and
consumer privacy protections of the Privacy Rule and to advise HHS
on the modification, additions, and deletions to the Privacy Rules
standards and implementation specifications for the defined annual
Privacy Rule Modification cycle. The advisory panel or task force
should be comprised of health industry representatives, patients,
and health plan enrollees with significant operational experience in
the delivery and financing of health care and representative of
various government agencies, including FDA, DOL, OIG, Department of
Justice, State Medicaid programs, etc. that regulate activities
affecting health care delivery or financing. |
Adopted
May 2002 |
|
99 |
CMS
should eliminate the Evaluation & Management documentation
guidelines. |
Adopted
May 2002, with dissent from Dr. Olsen |
|
100 |
Encourage
skilled nursing facilities (SNFs) certified to participate in
Medicare to use the new shorter assessment form (called the Medicare
Payment Assessment Form) to update a Medicare beneficiarys
condition on days 5, 14, 30, 60 and 90 of the person's stay in the
nursing home. Maintain the policy that SNFs complete the full MDS to
assess resident status on admission, annually and upon significant
change in resident status thereafter. (Note: the requirement that
the admission MDS is to be completed no later than l4 days after the
residents admission would continue in force.) |
Adopted
June 2002 |
|
101 |
Consider
the efficacy of making the collection of OASIS mandatory for
Medicare patients only. |
Adopted
June 2002 with dissent from Dr. Olsen, Mr. Fay, and Mr. Bloom |
|
102* |
Establish
incentives to encourage State Medicaid programs to discontinue
requiring forms HCFA 1513, HCFA 1514, HCFA 1561, HCFA 2572 and other
forms no longer used by CMS. |
Adopted
June 2002 |
|
103 |
Expand
the J Code system to more accurately define the package size used.
If available package sizes are 100 mg, 200 mg, and 1 gram, have
separate codes for each of those sizes, with corresponding
reimbursements. |
Adopted
June 2002 |
|
104 |
Further
clarify the HIPAA final transaction rules to allow providers to make
changes in the event the National Drug Code (NDC) system is going to
remain a part of the initial HIPAA transactions codes
implementation. |
Adopted
June 2002 |
|
105 |
Clearly
define covered drug products instead of broadly defining what may
qualify as self-administered. |
Adopted
June 2002 |
|
106 |
Use
patient-specific modifiers that may move drugs into a covered
category for patients with limited mobility and/or capability to
understand therapeutic schedules. |
|