Tag: HHS

PREP Act Immunity and Its Application in Shareholder Derivative Litigation: A Modest Proposal

Much has been published recently about the Public Readiness and Emergency Preparedness Act (“PREP Act” or “Act”) in the COVID-19 era.[1]  Its protections, including broad immunity from liability, have been extended to individuals and companies involved in the design, manufacture, distribution and administration of  “countermeasures” against the SARS-CoV-2 virus.  Although the PREP Act has been around for more than 15 years, its defensive application in litigation before COVID-19 was limited.  Now, more than a year into the pandemic, application of the PREP Act is being more actively litigated, primarily in the context of COVID-19 deaths in skilled nursing and assisted living facilities.[2] 

Still unresolved, however, is whether there is any basis for using the PREP Act defensively in shareholder derivative suits which allege that “materially deceptive statements” made by companies trying to make vaccines and other “countermeasures” are covered by the PREP Act.  While there has been no definitive judicial assessment of this question, there are reasons that companies facing such claims should consider seeking such a determination.

The PREP Act: Background

In 2005, Congress passed the PREP Act as a tool to combat public health emergencies.  It empowered the Secretary of the U.S. Department of Health and Human Services (“Secretary”) to issue a “Declaration” that “a disease or other health condition or other threat to health constitutes a public health emergency, or that there is a credible risk that the disease, condition, or threat may in the future constitute such an emergency.”[3]  If such a Declaration is issued, immunity from liability will apply to persons and companies engaged in providing “countermeasures” to combat the perceived public health threat.  Such a Declaration was issued by the Secretary of Health and Human Services in March 2020 in response to the COVID-19 pandemic.  Through various subsequent amendments to the Declaration, as well as guidance and advisory opinions, the scope of immunity was further illuminated and in some ways expanded.

Historical Application of the PREP Act

Prior to COVID-19, few cases invoked the PREP Act.  Among those that did, most favored supporting immunity despite various forms of harm.  Unsurprisingly, most of the cases focused on the vaccine for the H1N1 virus.

In Parker v. St. Lawrence County Public Health Department,[4] the claim was that a child was immunized against the H1N1 virus without parental consent.  The court disposed of this claim, holding that the PREP Act “preempts plaintiff’s state law claims for negligence and battery.”[5]

In Kehler v. Hood,[6] a plaintiff sued a physician and the physician’s employer, claiming that the defendants failed to obtain the plaintiff’s informed consent before administering the H1N1 vaccine.  This led to the development of “a severe case of transverse myelitis.”[7] The defendants then brought a third-party action against the vaccine manufacturer, Novartis Vaccines and Diagnostics.  Novartis moved to dismiss all claims against it under the PREP Act.  The court agreed, held that Novartis enjoyed absolute immunity from liability pursuant to the PREP Act, and dismissed those claims.

Not all cases allowed a defendant to benefit from the PREP Act.  In Casabianca v. Mount Sinai Medical Center,[8]the claim centered on the failure to administer a flu vaccine, which allegedly led to various serious medical consequences.  The Trial Order—not an officially published opinion—determined that withholding a vaccine (as opposed to administering it) was not covered by the statute.  In the COVID-19 context, this reasoning may not apply since the amendments of the Declaration related to the COVID-19 pandemic make clear that failure to administer a covered activity may still be covered by the PREP Act if withholding from one person is related to the need to administer to another.[9]

Application of the PREP Act During the COVID-19 Pandemic

COVID-19 has seen a plethora of lawsuits in which the PREP Act has been invoked.  Many involve skilled nursing or assisted living facilities where COVID-19 countermeasures were not administered and patients/residents passed away.[10]  Some decisions hinged on a determination as to whether the withholding of countermeasures was causally related to the administration of countermeasures to another person.  In other words, were there limited resources and the sued entity made decisions about who would have access to those limited resources?  In most cases, courts ruled that such withholding was not a resource issue and declined to rule that the PREP Act applied.[11] 

In Haro v. Kaiser Foundation Hospitals,[12] an employee of a Kaiser Foundation Hospital was required to report for work 15 minutes before her shift began for COVID-19 medical screening, without compensation for that extra time.  Here, the court also held that the PREP Act did not apply.[13]

PREP Act Immunity and Shareholder Derivative Suits

An unresolved question is whether the PREP Act provides protection to companies and their executives who are sued in shareholder class action suits.  A number of recently filed cases allege that manufacturers who engaged in efforts to formulate COVID-19 vaccines and other therapies, but failed to achieve regulatory approval in the U.S., committed violations of the Securities and Exchange Act of 1934 (“Securities Act”).  These complaints allege generally that (a) the companies and key executives made intentionally false and misleading statements that led investors to purchase securities; (b) the value of the securities was artificially inflated by the allegedly fraudulent statements; and (c) the value then declined upon the failure of the promised vaccine or other countermeasures to obtain regulatory approval.[14]

Undoubtedly, these companies can assert a number of different arguments which may militate in favor of dismissal of these putative class action complaints, most prominently that any statements made were not intentionally false, as required by the Securities Act.  One argument that has not been a traditional defense in shareholder derivative suits is PREP Act immunity.  The argument will need to focus on whether the terms of the PREP Act contemplate immunity to the type of injury alleged in shareholder derivative suits.

The terms of the PREP Act provide a starting point for this defense.  The PREP Act provides a list of the kinds of claims it seeks to limit by virtue of the grant of broad immunity.  Certainly, “garden variety” personal injury claims are covered, including when the harm alleged includes:

(i)    Death;

(ii)   Physical, mental or emotional injury, illness, disability or condition;

(iii)  Fear of physical, mental or emotional injury, illness, disability, or condition, including any need for medical monitoring.[15]

However, the PREP Act also includes an additional category of loss that, by its terms, clearly goes beyond personal injury:

(iv)  Loss of or damage to property, including business interruption loss.[16] 

The question is whether shareholder damages, e.g., the loss in share value alleged in recent shareholder claims, could be a “loss of or damage to property” under the PREP Act.[17]

Shareholder claims generally allege that false or misleading statements by a company and its executives induced a member of the public to purchase shares at inflated value, which subsequently diminished in value when the falsity of the statements became known.  Although there are several cases alleging shareholder losses due to allegedly “false or misleading” claims by companies involved in the manufacture or sale of COVID-19 “countermeasures,”[18] none of the cases considered the question whether “loss of or damage to property” could include diminution in value of the shares in such a company.  Indeed, none of the defendants appear to have pleaded the PREP Act as a defense. There are arguments to be made as to why they should consider doing so.

Like personal injury claims, fraud is a tort, albeit an intentional one.[19]  The PREP Act certainly envisions that some types of covered claims might not merely be ones of negligence or accidental torts since the compensation scheme provides for special treatment of conduct that constitutes “willful misconduct.”[20]  The section on “willful misconduct” makes clear that the only injuries for which there may be an exception to the blanket immunity otherwise granted by the Act, is willful misconduct that results in serious physical injury or death.[21]  The plain meaning of the text shows that for other kinds of “willful misconduct”—for example, willful misconduct causing “loss of or damage to property”—immunity still applies and no damages will be permitted outside of the limited compensation scheme under the PREP Act.[22] 

The question remains whether the statute applies to any harm—intentional or otherwise—other than personal injury.  Rules of statutory construction require that any such inquiry starts with the terms of the statute and whether the language “has a plain and unambiguous meaning with regard to the particular dispute in the case.”[23]  The United States Supreme Court has made clear that ‘‘[o]ur inquiry must cease if the statutory language is unambiguous and ‘the statutory scheme is coherent and consistent.’’’[24]  Here, the statute unambiguously creates a category of harm that is clearly different from the descriptions of personal injuries (or fear of personal injury) described in the preceding three definitional sections.  “Loss of property” suggests a pecuniary loss and supports the notion that the kinds of harm contemplated by the statute is broad enough to include the financial harm described in the shareholder suits.[25]

The terms of the PREP Act are further illuminated by the Declaration, which is statutorily required to invoke the PREP Act to combat a public health crisis.[26]  In his Declaration of March 17, 2020, the Secretary acknowledged that COVID-19 constituted a public health emergency and declared PREP Act immunity to be in effect to encourage “the design, development, clinical testing, or investigation, manufacture, labeling, distribution, formulation, packaging, marketing, promotion, sale, purchase, donation, dispensing, prescribing, administration, licensing, and the use of the Covered Countermeasures.”[27]  Thus, the “desirability of encouraging”[28] these activities lends credence to the argument that statements made in the course of “design, development, clinical testing or investigation”[29] are related to these countermeasures and fall within the purview of the grant of PREP Act immunity.  Clearly, the record shows that Congress recognized the need to impose limits on liability across a range of matters to encourage private industry participation in addressing the current public health crisis.  Extending immunity for shareholder derivative suits is consistent with this goal.[30]

Even the legislative history of the PREP Act provides evidence that the broadest interpretation of the kinds of harm that are covered by the statute’s grant of immunity is appropriate.  While the legislative history surrounding the PREP Act is sparse, particularly regarding the provision regarding “loss of or damage to property,” there is certainly some evidence to support the idea that the immunity should be read broadly.  Although there does not seem to be any specific consideration as to whether allegedly fraudulent statements by “covered persons” are covered by the PREP Act, several opponents of the Act voiced their concern about the breadth of immunity contemplated by the Act and, in doing so, provide guidance as to the legislative intent behind the statute.  For example, then-Senator Joe Biden stated:

[T]his is no typical grant of immunity. No, the breadth of this provision is staggering. A drug maker can be grossly negligent in making or distributing a drug, and still escape liability. It can even make that drug with wanton recklessness and escape scott-free after harming thousands of people.[31]

Then-Senator Hillary Clinton also weighed in on the scope of immunity and implicitly acknowledged that the PREP Act applied to more than just physical injury:

Mr. President, I would like to take this opportunity to object to insertion of a provision in the Department of Defense appropriations bill that would provide sweeping immunity protections to pharmaceutical manufacturers . . . . [T]his provision would grant immunity to all claims of loss, including death and disability, for a broad range of products, including any drug that the Secretary designated as one that would limit the harm caused by a pandemic—a definition so broad as to encompass nearly any drug.[32]

Senator Patrick Leahy also expressed alarm at the breadth of the grant of immunity:

Knowing violations as well as gross negligence would be immunized from accountability. Even if the drug company acted with the intent to harm people, it would nevertheless be immune from criminal conduct unless the Attorney General or Secretary of Health and Human Services initiates an enforcement action against a drug company that is still pending at the time a personal claim is filed.[33]

While it may be true that some opponents of this broad immunity were mainly concerned about immunizing conduct that resulted in physical injury to people, the conduct covered by the immunity granted by this legislation is clearly more than just conduct that causes physical injury.  As Senator Clinton’s comment reflects, there are reasons to conclude that it covers claims of allegedly fraudulent statements made by “covered persons” involved in the manufacture, distribution and administration of “countermeasures.”

Reasons to think otherwise do exist.  For example, the Act does not specifically mention loss of share value as a covered “loss.”  Nor does it reference “fraudulent conduct” as protected by immunity.  And, viewed as a whole, some might argue that the PREP Act seems mostly concerned with protecting “covered persons” from liability for personal injury claims.  Indeed, it might seem counterintuitive that Congress would have wanted to immunize a company or its executives in the face of knowingly false and misleading statements.  This argument, however, misses an important point.  Such conduct would not be completely immunized since the federal government would still be empowered to prosecute such false statements under various laws, including the Securities Act of 1933 and the Securities Act of 1934, pursuant to a carve-out in the PREP Act:

Nothing in this section shall be construed to abrogate or limit any right, remedy, or authority that the United States or any agency thereof may possess under any other provision of law . . . .[34]

Thus, the intent of the PREP Act would actually be promoted by protecting companies involved in trying to create vaccines or other types of treatment for COVID-19 from the burdens placed on those companies by shareholder derivative suits; while preserving the possibility of criminal prosecution by the U.S. Department of Justice and civil liability through governmental action mainly through the U.S. Securities and Exchange Commission.[35]

Conclusion

Until this is tested in the courts, no one can be sure if the hypothesis is correct—that PREP Act immunity should cover certain shareholder derivative suits.  But there appears to be good reason to put this to the test.  Asserting the Act’s immunity in affirmative defenses and moving for dismissal is the best way to find out if the courts will agree.

[1]See, e.g., Erik K. Swanholt, John J. Atallah & Jessica N. Walker, HHS Expands and Clarifies Scope of Immunity under the PREP Act, The National Law Review (Dec. 28, 2020), https://www.natlawreview.com/article/hhs-expands-and-clarifies-scope-immunity-under-prep-act; See also Eric Kraus & Jennifer Shah, COVID-19 Vaccines Unlikely to Create Litigation Opportunities, Law360 (Dec. 7, 2020)

[2] See, e.g., Estate of Smith ex rel. Smith v. Bristol at Tampa Rehab. & Nursing Ctr., LLC, No. 8:20-cv-2798-T-60SPF, 2021 WL 100376 (M.D. Fla. Jan. 12, 2021).

[3] 42 U.S.C. § 247d-6d(b).

[4] Parker v. St. Lawrence Cnty. Public Health Dep’t, 102 A.D.3d 140 (3rd Dep’t 2012).

[5]Id. at 142.

[6] Kehler v. Hood, 2012 WL 1945952, No. 4:11CV1416, 2012 WL 1945952 (E.D. Mo. May 30, 2012).

[7]Id. at *1

[8]Casabianca v. Mount Sinai Med. Ctr., No. 112790/10, 2014 WL 10413521  (Sup. Ct. N.Y. Cnty. Dec. 2, 2014).

[9] 42 U.S.C. § 247d-6d; Fourth Amendment to Declaration Under the Public Readiness and Emergency Preparedness Act for Medical Countermeasures Against COVID-19, 85 Fed. Reg. 79,190-01, 79,197 (Dec. 9, 2020).  See also  Advisory Opinion 21-01 on the Public Readiness and Emergency Preparedness Act Scope of Preemption Provision, https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/2101081078-jo-advisory-opinion-prep-act-complete-preemption-01-08-2021-final-hhs-web.pdf (Jan. 8, 2021).

[10]Anson v. HCP Prairie Vill. KS OPCO LLC, No. 20-2346, 2021 WL 308156 (D. Kan. Jan. 29, 2021).

[11] See, e.g., Baskin v. Big Blue Healthcare, Inc., No. 2:20-cv-2267, 2020 WL 4815074 (D. Kan. Aug. 19, 2020); Eaton v. Big Blue Healthcare, Inc., 480 F. Supp. 3d 1184 (D. Kan. 2020).

[12] No. 20-CV-6006, 2020 WL 5291014 (C.D. Cal. Sept. 3, 2020).

[13] Id.

[14] See, e.g., Leung v. Bluebird Bio, Inc., No. 1:21-cv-00777 (E.D.N.Y. filed Feb. 12, 2021) changed venue to No. 1:21-cv-10335 (D. Mass. filed Feb. 26, 2021); Monroe Cnty. Emps’. Ret. Sys. v. AstraZeneca PLC, No. 1:21-cv-00722 (S.D.N.Y. filed Jan. 26, 2021); Zhukov v. AstraZeneca PLC, No. 1:21-cv-00825 (S.D.N.Y. filed Jan. 29, 2021). [As of Apr. 29, 2021, Monroe Cnty. Emps’. Ret. Sys. v. AstraZeneca PLC and Zhukov v. AstraZeneca PLC were consolidated to In re AstraZeneca PLC Secs. Litig., No. 1:21-cv-00722 (S.D.N.Y. filed Jan. 26, 2021)].

[15] 42 U.S.C. § 247d-6d(a)(1)(A)(i-iii).

[16] 42 U.S.C. § 247d-6d(a)(1)(A)(iv) (emphasis added).

[17] The term “loss of or damage to property, including business interruption loss” has been, and continues to be, extensively litigated in COVID-19-related insurance coverage disputes.  Although the terminology is similar, these cases do not address the PREP Act but rather focus on the terms of the policies at issue.  In some cases, where the policy required “direct physical loss,” courts have ruled that the policy requires “tangible damage” and denied coverage.  See, e.g., Turek Enters., Inc. v. State Farm Mut. Auto. Ins. Co., 484 F. Supp. 3d 492 (E.D. Mich. Sept. 3, 2020). Other cases denied coverage on the basis of a policy’s express “virus exclusion.” See, e.g., Martinez v. Allied Ins. Co. of Am., 483 F. Supp. 3d 1189 (M.D. Fla. Sept. 2, 2020).

On the other hand, there are cases where the business plaintiff seeking coverage successfully drew a distinction between “loss of” and “damage to” property.  See, e.g., Studio 417, Inc. v. Cincinnati Ins. Co., 478 F. Supp. 3d 794, 800-03 (W.D. Mo. 2020) (insurers’ motion to dismiss denied, holding that plaintiff stated a claim, and that “direct physical loss” included the suspension of business due to COVID-19 and related governmental restrictions).

[18] See, e.g., Monroe Cnty. Emps’. Ret. Sys., supra note 9; Leung, supra note 9; Zhukov, supra note 9.

[19] Restatement (Third) of Torts: Liab. for Econ. Harm § 9 (2020).

[20] 42 U.S.C. § 247d-6d(c).

[21] 42 U.S.C. § 247d-6d(d)(1).

[22]See 42 U.S.C. § 247d-6e (which provides for the establishment of an “emergency fund” in the Treasury “designated as the ‘Covered Countermeasure Process Fund’ [to] provid[e] . . . compensation to eligible individuals”).

[23] See Robinson v. Shell Oil Co., 519 U.S. 337, 340 (1997). ‘‘A statute generally ‘should be enforced according to its plain and unambiguous meaning.’’’ Greathouse v. JHS Sec. Inc., 784 F.3d 105, 111 (2d Cir. 2015) (quoting United States v. Livecchi, 711 F.3d 345, 351 (2d Cir. 2013)).

[24]Robinson, 519 U.S. at 340 (quoting United States v. Ron Pair Enters., Inc., 489 U.S. 235, 240 (1989)).

[25] Dictionary definitions provide further support for this view.  For example, the Merriam-Webster online dictionary defines property as “something to which a person or business has a legal title.” https://www.merriam-webster.com/dictionary/property (last visited May 13, 2021).  See also The Oxford English and Spanish Dictionary, which defines property as “[t]he right to the possession, use, or disposal of something; ownership.”  https://www.lexico.com/en/definition/property  (last visited May 13, 2021).

[26] 42 U.S.C § 247d-6d(b)(1).

[27] Declaration Under the Public Readiness and Emergency Preparedness Act for Medical Countermeasures Against COVID-19, 85 Fed. Reg. 15,198-01, 15,201 (Mar. 17, 2020).

[28] 85 Fed. Reg. 15,198-01, 15,201.

[29]Id.

[30] Albeit in another context, the U.S. Supreme Court agreed that a statutory scheme that provided liability protections to encourage private industry participation in an effort to develop nuclear power was proper and constitutional.  Duke Power Co. v. Carolina Env’t Study Grp., Inc., 438 U.S. 59 (1978).

[31] 151 Cong. Rec. S14,242-01, S14,242 (daily ed. Dec. 21, 2005) (statement of Sen. Joseph Biden).

[32]Id. at S14,243 (statement of Sen. Hillary Clinton) (emphasis added).

[33]Id. at S14,247 (statement of Sen. Patrick Leahy).

[34] 42 U.S.C § 247d-6d(f).

[35] See 17 C.F.R. §§ 240.10b-5.  See also Securities Act of 1933 § 24 (“Securities Act”), 15 U.S.C. § 77x; Securities Exchange Act of 1934 § 32, 15 U.S.C. § 78ff(a).

© 2021 Phillips Lytle LLP

ARTICLE BY Eric M. Kraus and John G. Schmidt Jr. of Phillips Lytle LLP
For more articles on PREP Act Immunity, visit the NLRCorporate & Business Organizations section.

CMS/HHS Issues FAQs on Essential Health Benefits and COVID-19

As the President issues a state of emergency in response to the Coronavirus (COVID-19) outbreak, the Centers for Medicare & Medicaid Services, U.S. Department of Health and Human Services, issued frequently asked questions (FAQs) on COVID – 19 and essential health benefits (EHB) coverage through the individual and small group insurance markets.

These FAQs state first that EHB generally include coverage for the diagnosis and treatment of COVID-19. However, the exact coverage details and cost-sharing will depend upon the individual’s plan, and some plans may require preauthorization before these services are covered. Under current regulations, each state and the District of Columbia generally determines the EHB that plans in their locality must cover. Moreover, many states are encouraging, and some are requiring, insurance carriers to cover a variety of COVID-19 services, including testing and treatment, without cost-sharing or preauthorization.

The FAQs went on to say that medically necessary isolation and quarantine required by and under the supervision of a medical provider during hospital admission is generally covered as EHB. However, quarantine outside of a hospital setting, such as a home, is not a medical benefit, nor is it required as EHB.

Finally, the FAQs addressed the possibility of a future COVID-19 vaccine. Although not yet available, all vaccines are analyzed by the Advisory Committee on Immunization Practice of the Centers for Disease Control and Prevention, who will recommend whether the vaccine should be included as EHB without cost sharing and before any applicable deductible. Current guidance indicates that the process of evaluation and final implementation as an EHB can take over a year, but plans may voluntarily choose to cover a vaccine before that time. The FAQs also note that participants may use the plan’s drug exemptions process to request the vaccine be covered.

© 2007-2020 Hill Ward Henderson, All Rights Reserved

Federal Court Strikes Down HIPAA Fee Limitations for Third-Party Medical Records Requests

On Jan. 29, 2020, OCR released a notice regarding a recent federal court ruling in the case of Ciox Health, LLC v. Azar, et al., where a federal judge in the District Court for the District of Columbia vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to protected health information (“PHI”) of an individual … in an electronic format.”1 Additionally, the court held that the fee limitation set forth at 45 CFR § 164.524(c)(4) should only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.

The Ciox Health case centered on the restrictions the Department of Health and Human Services (“HHS”) and the Office for Civil Rights (“OCR”) put in place in the 2013 Omnibus Rule 2 and through informal guidance published in 2016 regarding fees that can be charged to patient in searching for, retrieving, and delivering their records and PHI as it pertains to third-party directives. Third-party directives are a mechanism promulgated by the HITECH Act that granted individuals the right to obtain a copy of their PHI maintained electronically, and “if the individual so chooses, to direct the covered entity to transmit such copy directly to an entity or person designed by the individual.”3 Additionally, the HIPAA Privacy Rule permits a reasonable cost-based fee to provide the individual (or the individual’s personal representative) with a copy of the individual’s PHI, or to direct a copy to a designated third party. The fee may include only the cost of certain labor, supplies, and postage (this fee is also referred to as the “Patient Rate”).4

The 2013 Omnibus Rule broadened the third-party directives to PHI maintained in any format, not just electronic records. Moreover, the 2013 Omnibus Rule amended the Patient Rate and required actual labor costs associated with the retrieval of electronic information to be excluded.5

In 2016, HHS issued a guidance document titled Individuals’ Right under HIPAA to Access their Health Information 45 C.F.R. § 164.524 (the “2016 Guidance”).6  The 2016 Guidance made two notable requirements that gave rise to the current litigation. Most significantly, HHS declared that the Patient Rate applies “when an individual directs a covered entity to send the PHI to a third party.”7

“This limitation,” HHS said, referring to the Patient Rate, “applies regardless of whether the individual has requested that the copy of PHI be sent to herself, or has directed that the covered entity send the copy directly to a third party designated by the individual (and it doesn’t matter who the third party is).”8

Additionally, in the 2016 Guidance, HHS provided a methodology to calculate the Patient Rate in requests for an electronic copy of PHI maintained electronically. The methodology would require the entity to determine a fee by calculating the actual allowable costs to fulfill each request or by using a schedule of costs based on the average allowable labor costs to fulfill standard requests. HHS also provided an option for entities to charge a flat rate for requests for electronic copies of PHI not to exceed $6.50 as an alternative to going through the process of calculating these costs.

In this case, HHS was sued by Ciox Health, a medical record retrieval company, over the changes to the Patient Rate set forth in both the 2013 Omnibus Rule and the 2016 Guidance. Ciox Health argued that the $6.50 flat fee is an arbitrary figure that bears no relation to the actual cost of honoring patient requests for copies of their health information, and such a low fee has negatively impacted its business. Ciox Health claims the 2013 Omnibus Rule and the 2016 Guidance, “unlawfully, unreasonably, arbitrarily and capriciously,” restrict the fees that can be charged by providers and their business associates for providing copies of the health information stored on patients.

The district court, in declaring the changes to the Patient Rate set forth in the 2013 Omnibus Rule unlawful, held that HHS cannot rely on its general rulemaking authority to supplement the limited-scope, third-party directive enacted by Congress in the HITECH Act. The court held that the 2013 Omnibus Rule’s expansion of the third-party directive is therefore arbitrary and capricious. Moreover, the district court held that the 2016 Guidance that worked a change into the Patient Rate was akin to a legislative rule that HHS had no authority to adopt without notice and comment. As a result, the court vacated the 2013 Omnibus Rule’s expansion of the HITECH Act’s third-party directive beyond requests for a copy of electronic records with respect to PHI of an individual in an electronic format. The court also declared unlawful and vacated the 2016 Guidance as it extended the Patient Rate to third-party directives without going through notice and comment.

Health care providers and medical records access companies are no longer required to limit the fees charged to their average costs, or charge a $6.50 flat fee, when a patient requests their medical records be transmitted to a third party. The fee limitations will still apply to individuals when they request their own records, however, as decided in the Ciox Health decision, on January 23, 2020.

OCR released a notice on Jan. 29, 2020 that the right of individuals to access their own records and any fee limitations that apply when exercising this right still apply. However, OCR appears to have at least accepted this ruling for now, as it pertains to third-party directives. OCR stated that it will continue to enforce the right of access provisions in 45 CFR § 164.524 that are not restricted by the court order. The court order can be viewed here.

[1] Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020)

[2] See Modifications to the HIPAA Privacy, Security,

Enforcement, and Breach Notification Rules Under the [HITECH] Act and the Genetic

Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, 78 Fed. Reg. 5,566

(Jan. 25, 2013).

[3] 42 U.S.C. § 17935(e);

[4] 45 CFR § 164.524(c)(4)

[5] 78 Fed. Reg. at 5,636.

[6] This guidance is available at this link: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

[7] Id. at 16.

[8] Id.

© 2020 Dinsmore & Shohl LLP. All rights reserved.

For more on HIPAA medical-records regulation, see the National Law Review Health Law & Managed Care section.

HHS Proposes to Revise Discount Safe Harbor Protection for Drug Rebates

On January 31, 2019, the Department of Health and Human Services (HHS) released a notice of proposed rulemaking (the Proposed Rule) as part of ongoing administration drug pricing reform efforts. The Proposed Rule would modify a regulatory provision that had previously protected certain pharmaceutical manufacturer rebates from criminal prosecution and financial penalties under the federal Anti-Kickback Statute.

Specifically, the Proposed Rule would exclude from “safe harbor” protection rebates and other discounts on prescription pharmaceutical products offered by pharmaceutical manufacturers to Medicare Part D plan sponsors or Medicaid Managed Care Organizations (MCOs), unless the price reduction is required by law (such as rebates required under the Medicaid Drug Rebate Program). The proposed exclusion would apply to rebates offered directly to Part D plan sponsors and Medicaid MCOs, as well as those negotiated by or paid through a pharmacy benefit manager (PBM). HHS stated that it does not intend for the revisions in this Proposed Rule to negatively impact protection of prescription pharmaceutical product discounts offered to other entities such as wholesalers, hospitals, physicians, pharmacies and third-party payors in other federal health care programs. The proposed effective date of this regulatory modification is January 1, 2020, although HHS has sought comments regarding whether this allows sufficient time for parties to restructure existing arrangements.

In addition, the Proposed Rule would add two new regulatory safe harbors for:

  • Certain price reductions that are fully passed through to the dispensing pharmacy and applied to the price charged to the member at the point-of-sale; and

  • Fixed fee payments from manufacturers to PBMs for the services that PBMs provide those manufacturers. In order to be protected, the fees would have to be for services that relate to the PBM’s arrangements with health plans (e.g., services that rely on data collected from health plan customers).

These new safe harbors would become effective 60 days after HHS publishes a final rule.

The potential implications of the Proposed Rule extend beyond the context of federal Anti-Kickback Statute compliance to drug reimbursement in the United States more broadly. The proposals will likely be subject to significant public debate and legal scrutiny.

The Proposed Rule is scheduled to be published in the Federal Register on February 6, 2019, and public comments on the proposals would be due 60 days later. The Proposed Rule can be found here and the HHS Factsheet is available here.

 

© 2019 McDermott Will & Emery

OCR Continues to Verify Entity Contact Info for Phase 2 HIPAA Audits

Covered Entities need to continue to check their inboxes for emails from the HHS Office for Civil Rights (“OCR”) requesting verification of contact information in connection with Phase 2 of the HIPAA Audit Program. OCR previously indicated that Covered Entities would begin to receive verification emails in May.  We understand that Covered Entities continue to receive emails requesting contact information verification this week.Inbox, Email, HIPAA Audit Notices

Emails are sent from OSOCRAudit@hhs.gov and request a response from the entity verifying its information within five days.  A sample copy of the email is available from OCR’s website.  The receipt of an email requesting contact verification does not necessarily mean that an entity will ultimately be selected for an audit.  Covered Entities can begin to prepare for the next step in the audit process by reviewing OCR’s audit pre-screening questionnaire.

For the time being, Business Associates are not being contacted.  OCR will request a list of Business Associates from Covered Entities and plans to begin contacting Business Associates selected for audit this summer.  Business Associates should use this extra time to ensure that they are ready for an audit should they be selected.   OCR has provided a sample template for Covered Entities to use to list their Business Associates.

In order to assist covered entities and business associates with their HIPAA compliance efforts, we have repackaged the audit protocol into a more user-friendly format that can be downloaded here.

Article By Kate F. Stewart of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

©1994-2016 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.

Health Care Companies Agree to “Core Commitments” to Improve Access to EHR

Last month, the Department of Health and Human Services (HHS) announced that a number of large health care companies and providers had “agreed to implement three core commitments” to improve access to electronic health records (EHR).  HHS touted the commitments as a significant step toward increased EHR interoperability.

The three core commitments to which the health care entities agreed are as follows:

  1. Consumer Access: To help consumers easily and securely access their electronic health information, direct it to any desired location, learn how their information can be shared and used, and be assured that this information will be effectively and safely used to benefit their health and that of their community.

  2. No Blocking/Transparency: To help providers share individuals’ health information for care with other providers and their patients whenever permitted by law, and not block electronic health information (defined as knowingly and unreasonably interfering with information sharing).

  3. Standards: Implement federally recognized, national interoperability standards, policies, guidance, and practices for electronic health information, and adopt best practices including those related to privacy and security.

HHS highlighted the number and importance of the entities that have agreed to this “Interoperability Pledge.”  According to HHS, the nation’s five largest private health care systems signed the Interoperability Pledge, as well as “[v]endors who provide 90 percent of hospital electronic health records used nationwide.”

Notably, the three commitments in the Pledge are not enforceable.  At most, the Interoperability Pledge represents an agreement by its signatories that access and interoperability are key goals of EHR use.

 
Article By Philip Peisch of Covington & Burling LLP

© 2016 Covington & Burling LLP

HHS Issues Final Rule on HIPAA and Firearm Background Check Reporting

On January 6, as part of President Obama’s executive action to combat gun violence, HHS promulgated a final regulation modifying the HIPAA Privacy Rule to allow certain HIPAA covered entities to disclose limited information to the National Instant Criminal Background Check System (NICS).

Background:  The NICS, maintained by the Federal Bureau of Investigation (FBI), is the national database used to conduct background checks on persons who may be disqualified from receiving firearms based on federal or state law.  Federal law identifies several categories of potential disqualifiers, known as “prohibitors” including a federal mental health prohibitor.  By statute, the federal mental health prohibitor applies to individuals who have been committed to a mental institution or adjudicated as a mental defective.  The Department of Justice has promulgated regulations that defines these categories to include the following individuals:

  • individuals committed to a mental institution for reasons such as mental illness or drug use;

  • individuals found incompetent to stand trial or not guilty by reason of insanity, or

  • individuals who have been otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease.

However, there is currently no federal law that requires state agencies to report data to the NICS, including the identity of individuals who are subject to the mental health prohibitor.  HHS believes that HIPAA poses a potential barrier to such reporting. Under current law, HIPAA only permits covered entities (e.g., state mental health agencies) to disclose such information to the NICS in limited circumstances: when the entity is a “hybrid” entity under HIPAA (and the Privacy Rule does not apply to these functions) or when state law otherwise requires disclosure, and thus disclosure is permitted under HIPAA’s “required by law” category.

Final Rule:  HHS finalized its proposed rule without any substantive changes. Under the final rule, a new section 164.512(k)(7) of the HIPAA Privacy Rule expressly permits certain covered entities to disclose information relevant to the federal mental health prohibitor to the NICS.

The permitted disclosure applies only to those covered entities that function as repositories of information relevant to the federal mental health prohibitor on behalf of a State or are responsible for ordering the involuntary commitments or the adjudications that would make someone subject to the prohibitor.  Thus, most treating providers may not disclose protected health information about their own patients to the NICS, unless otherwise permitted by the HIPAA Privacy Rule.  HHS also clarifies that individuals who seek voluntary treatment are not subject to the prohibitor.

The rule limits disclosure only to the NICS or an entity designated by the State to report data to the NICS.  And only that information that is “needed for purposes of reporting to the NICS” may be disclosed, though HHS gives States the flexibility to determine which data elements are “needed” to create a NICS record (consistent with requirements of the FBI, which maintains the NICS).  At present, the required data elements for the NICS are: name; date of birth; sex; and codes identifying the relevant prohibitor, the submitting state agency, and the supporting record.  The NICS also allows disclosure of certain optional data elements (e.g., social security number and identifying characteristics).  HHS notes that applicable covered entities may disclose such optional data elements “to the extent necessary to exclude false matches.”

HHS declined many commenters’ suggestion to expand the rule to permit the disclosure of information about individuals who are subject to state-only mental health prohibitors. HHS fears that expanding the scope of the permitted disclosure would disrupt the careful balance between public safety and encouraging patients to seek mental health care.

Finally, in the preamble, HHS defended its statutory authority to make this change, despite the fact that Congress did not address HIPAA in recent legislation to strengthen the NICS.  HHS explained that the “HIPAA statute confers broad authority on the Department to specify the permitted uses and disclosures of PHI by HIPAA covered entities.”

Article By Dena Feldman of Covington & Burling LLP

© 2015 Covington & Burling LLP

HHS Recognizes Changing Environment of Research: Still Time to Comment

Late last month the Department of Health and Human Services (HHS) and other Federal Departments and Agencies announced an extension until January 6, 2016  to the comment period for the Federal Policy for the Protection of Human Subjects notice of proposed rulemaking (NPRM). The proposed rulemaking is the most sweeping since 1991 when HHS codified The Common Rule, 45 C. F. R. part 46,  and  recognizes the changed research environment with many multisite studies and the  expansion of research with more data accessible through technology.  The NPRM seeks to further the principles of autonomy and  beneficence by protecting privacy and improving the consent process  in the new world of research while creating avenues to lessen the administrative burden  and to promote research.

The NPRM proposes to apply The Common Rule to all studies, regardless of funding source, conducted by a U.S. institution that receives federal funding for human subjects research.  Currently, The Common Rule applies to studies funded by certain federal agencies. Most significantly, the proposed rules impact the following areas:

Streamlined process  – To streamline the process of initiating certain activities the NPRM creates a  new category not currently in The Common Rule, exclusions.  Exclusions are for activity that is not research, that is low risk and for which there may be statutory protections.  Accordingly,  no procedures need to occur under the Common Rule to approve of the activity.  An example of an exclusion would include quality assurance activities.

The exemptions under The Common Rule are expanded in the NPRM. Exemptions are different than exclusions in that certain procedures need to occur for them to proceed such as recording, privacy safeguards, broad consent, or notice.  How HHS ultimately defines adequate notice will be critical in protecting privacy and autonomy rights in exempt research.

As well, a single institutional review board (IRB) would approve all multisite research. Independent IRBs would be held directly responsible for compliance with The Common Rule.

In addition, another streamline in the IRB process is not requiring continuing review of research where there is minimal risk. For instance, continuing review would not be required if a study undergoes expedited review or if there are completed interventions where only data continues to be analyzed. There would need only to be an annual confirmation that there are no changes.  An IRB would be able to require continuing review  with documentation of  the reason for the increased requirement.

Informed Consent  – The NPRM mandates a simplified  informed consent form with appendices with more detailed information. The goal is to provide potential research subjects all the essential information  that a reasonable person would need to consent to participation in research.  The NPRM suggests using the reasonable person standard as a means to gauge the protections in the process.  Currently, there are recommendations that informed consent forms should to be at no higher than an eighth grade education level, but the consent forms are often mired in so much detail human subjects may not easily comprehend the forms.

Research with Biospecimens – A particularly sweeping area of the NPRM is the protection of biospecimens (e.g., blood or urine) which is reflected in a proposed change in the definition of human subjects to include unidentified biospecimens. Hospitals, providers and laboratories  collect biospecimens from patients as part of medical care. Those biospecimens may be stored and used as part of research without the patient’s knowledge. The ethical issue regarding the use of biospecimens in research is well described by Professor Ellen Wright Clayton of Vanderbilt University, “[a] tremendous amount of epidemiological  research and other types of investigations have been done in the United States for decades without any informed consent or notification whatsoever….” [i] The proposed rule would require a broad consent  template covering the consent for storage  and maintenance of the biospecimens and the consent for future unspecified research. An alternative to the broad consent for the use of biospecimens would be a potential waiver of consent by the IRB for compelling scientific research, but consent could not be waived if the human subject declined to sign the broad consent form. Use of the IRB waiver of consent mostly likely would be rare, as proposed in the NPRM.

Secondary Research Use of Data – The NPRM also recognizes the growing business of information technology and the availability of data available for secondary use.  Researchers often can find data from sources such as the internet or through mHealth devices. The goal of the NPRM seems to be able to allow the secondary use of data in research or other activities while creating a balance for privacy protections. Secondary research activity excluded from The Common Rule would be a) publically available data (not biospecimens) or data recorded without identifiers; b) data protected through the provisions of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA); c) data confined to a single institution and its internal quality assurance programs and d)  data through federally conducted research.

Exempt secondary use research proposed in the NPRM would include a) identifiable private information where there is notice, privacy safeguards and use solely for specific research and b) storage and maintenance of data for secondary use where there are privacy safeguards, limited IRB review of the consent process, and  specific studies where the individual results will not be provided to the subjects.  Again, the procedures for notice will be a critical component of privacy protections with secondary use research.

There has been an overwhelming response to the NPRM which proposes comprehensive changes to The Common Rule. While there is seemingly a streamlined process to allowing certain activities or research to occur in the NPRM, there are areas in need of additional guidance such as the lack of clarity on certain privacy protections. A copy of the NPRM as well as details on how to submit comments can be found in this link.

Article By Dawn R. Crumel & Sonja S. Carlson of Sheppard, Mullin, Richter & Hampton LLP

© 2015, Sheppard Mullin Richter & Hampton LLP.

[i] Institute of Medicine (US) Roundtable on Translating Genomic-Based Research for Health, Establishing Precompetitive Collaborations to Stimulate Genomics-Driven Product Development: Workshop Summary, Washington (DC): National Academies Press (US); 2011, 6, Ethical Challenges in the Use of Biospecimens.

FDA Requests Comments on WHO Recommendation to Classify Two Common Industrial Solvents as Psychotropic Substances

Beveridge & Diamond PC environmental and energy law firm

On January 27, 2015, the Food and Drug Administration (“FDA”) requested comments on a recommendation by the World Health Organization (“WHO”) to classify two common industrial solvents – gamma-butyrolactone (“GBL”) and 1,4-butanediol (“BDO”) – as psychotropic substances under Schedule I of the 1971 Convention on Psychotropic Substances (“Psychotropic Convention”). See 80 Fed. Reg. 4283.  The comments will be used by the Secretary of Health and Human Services (“HHS”) to prepare a recommendation on the WHO proposal to the Secretary of State, which will be binding on the U.S. representative to the upcoming 58th Session of the UN Commission on Narcotic Drugs (“CND”) in Vienna, Austria, on March 9-17, 2015.  At the Vienna meeting, CND may accept the WHO recommendations, reject the recommendations, or decide to control the chemicals in another way (i.e., under a different Schedule of the Convention).

FDA notes that if either chemical – or any of the other chemicals that are also recommended for listing, but are not addressed here because they have few, if any, legitimate industrial uses – are added by CND to Schedule I of the Psychotropic Convention, the U.S. will have to impose additional controls on the chemical(s) under the Controlled Substances Act (“CSA”) administered by the Drug Enforcement Administration (“DEA”).  Although FDA does not elaborate on what those controls might consist of, they would likely include additional restrictions on manufacture, distribution, import, and export of the chemicals, as well as enhanced recordkeeping and reporting requirements. For example, Article 2(7)(a)(i) of the Psychotropic Convention states that parties shall require licenses for manufacture, trade, and distribution of Schedule I substances.  Moreover, Article 7(a) provides that parties must “[p]rohibit all use [of Schedule I substances] except for scientific and very limited medical purposes by duly authorized persons,” although Article 2(7)(a) allows individual parties to notify the UN that they cannot do so as a result of “exceptional circumstances,” in which case the party need only “take into account” the prohibition “as far as possible.”

It is worth noting that GBL is already regulated under the CSA as a precursor to gamma-hydroxybutyric acid (“GHB”), which is a commonly abused central nervous system depressant drug that is currently regulated under Schedule II of the Psychotropic Convention and Schedule I of the CSA.  In particular, GBL is classified under the CSA as a “List I” precursor (not to be confused with a CSA Schedule I or other controlled substance), and thus is already subject to significant DEA controls.  In addition, some U.S. states and authorities in some other countries already regulate GBL directly as a controlled substance or its equivalent.  Nevertheless, the addition of GBL to Schedule I of the Convention would likely require new and more stringent controls in most jurisdictions.  Additional information on the basis for the WHO recommendation for GBL (including the chemistry of the chemical, abuse potential, legitimate uses, and current regulation around the world) can be found in the 2014 GBL Critical Review Report of the WHO Expert Committee on Drug Dependence.

BDO is also a precursor to GHB, but is not currently regulated under the CSA.  It is regulated in several U.S. states and other countries as a precursor or controlled substance equivalent.  Once again, however, if it is added to Schedule I of the Psychotropic Convention, it will likely become subject to substantial additional restrictions.  Additional information on the basis for the WHO recommendation for BDO can be found in 2014 BDO Critical Review Report of the WHO Expert Committee on Drug Dependence.

FDA will accept written comments on the WHO recommendations until February 26, 2015.  Requests for a public meeting will be accepted until February 6, 2015.

ARTICLE BY

Aaron H. Goldberg
OF
Beveridge & Diamond PC

Health Resources and Services Administration (HRSA) Withdraws 340B Program Proposed Rule

Mcdermott Will Emery Law Firm

On November 14, 2014, the U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) withdrew a proposed rule that would have provided guidance on a variety of topics related to the 340B Federal Drug Pricing Program.  The “mega rule,” which had been submitted to the White House Office of Management and Budget in April 2014, was expected to cover important 340B Program matters, such as patient eligibility, contract pharmacy arrangements, and eligibility for hospitals and off-site facilities.  Now, in lieu of the proposed rule, HRSA has announced its intention to release notice-and-comment guidance to “address key policy issues raised by various stakeholders committed to the integrity” of the 340B Program.  Additionally, HRSA plans to issue proposed rules related to civil monetary penalties for manufacturers, calculating the 340B ceiling price and administrative dispute resolution.

The decision to withdraw the proposed rule, coupled with HRSA’s intention to release regulatory guidance on similar issues, may be viewed as a response by HHS to a recent federal court decision limiting HHS’s ability to promulgate notice-and-comment rules.  In a May 23, 2014, decision, the U.S. District Court for the District of Columbia held that HHS did not have the requisite statutory authority to promulgate a notice-and-comment rule pertaining to the purchase of orphan drugs by certain Covered Entities.  Further, the withdrawal may indicate a decision by HRSA to scale back its issuance of notice-and-comment rules for the 340B Program, limiting formal rulemaking to areas where the statutory authority to do so is explicit.  The withdrawal of the proposed mega rule demonstrates HRSA’s position that it does not possess the broad authority necessary to issue a formal rule of this scope.

Without the proposed rule, important facets of the 340B Program remain uncertain.  Manufacturers and Covered Entities that sought guidance on key practical issues such as patient definition now must continue to wait for clarification.  As noted, going forward HRSA will seek to clarify “key policy issues” but has yet to announce whether the topics covered by the proposed rule will be addressed.  HRSA’s regulatory guidance on these issues may never come, however, if the U.S. District Court for the District of Columbia (which is hearing further briefing on the aforementioned case concerning HHS’s regulatory guidance on the orphan drug rule) further restricts HHS’s ability to issue guidance.

In the face of continuing uncertainty, 340B Program participants, including Covered Entities, should stay current and closely follow available guidance from HRSA and the 340B Prime Vendor (Apexus).  Until clear guidance has been issued pertaining to subjects such as patient definition and contract pharmacy compliance, 340B Program participants should continue to follow and document best practices to ensure compliance with all 340B Program requirements.

ARTICLE BY

David S. Ivill
Emily J. Cook
Joseph M. Parise
OF
McDermott Will & Emery