The Department of Health and Human Services’ Office for Civil Rights (OCR) has announced that it will exercise its enforcement discretion for health care providers’ and their business associates’ noncompliance with the HIPAA rules with respect to their good faith use of online or web-based scheduling applications for scheduling COVID-19 vaccination appointments. OCR will not impose penalties for such noncompliance during the COVID-19 nationwide public health emergency.

With a notably sharply worded opinion, the Fifth Circuit recently vacated over $4.3 million in penalties levied against the University of Texas M.D. Anderson Cancer Center (M.D. Anderson) by the Department of Health and Human Services (HHS) for a series of alleged HIPAA violations. The case stems from three separate incidents that occurred between 2012 and 2013. In two instances, M.D. Anderson workforce members lost unencrypted protected health information (PHI), while the third incident involved the theft of a faculty member’s laptop also containing unencrypted PHI. On appeal, the Fifth Circuit concluded that HHS’s civil monetary penalties order against M.D. Anderson was arbitrary, capricious, and contrary to law, vacating the penalties and pointedly criticizing the agency’s actions and arguments in this matter.

Beyond its harsh words for HHS, this opinion is notable for calling into question some longstanding HHS enforcement practices and interpretations of the HIPAA regulations. The opinion also makes clear that regulated entities should check the math when HHS levies a fine. Although limited in its precedential authority, the Fifth Circuit’s opinion, at the very least, gives HIPAA-regulated entities some new food for thought if faced with an HHS enforcement action.

As we’re all painfully aware, public health issues dominated 2020 and with the country’s attention focused on COVID-19 testing, status, transmission and care, HIPAA went mainstream. Health information became critical not only for health care providers, but for all manner of businesses, employers, property owners, and the national media. HIPAA – or more often than not “HIPPA” – was frequently touted in the news and on social media as the reason why COVID-related information could or could not be shared. As we head into 2021 with the pandemic raging on, the vaccination program underway, and a new administration taking over, here is a look at what we expect for “HIPPA” in 2021.

The Department of Health and Human Services (HHS) is pushing ahead in its Regulatory Sprint to Coordinated Care with a new proposed rule, announced by HHS’ Office for Civil Rights on December 10, to modify the HIPAA Privacy Rule. This proposed rule follows HHS’ 2018 Request for Information on Modifying HIPAA Rules to Improve Coordinated Care, which sought to identify regulatory impediments to value-based care presented by HIPAA. With this proposed rule, HHS aims to “reduce burden on providers and support new ways for them to innovate and coordinate care on behalf of patients, while ensuring that [HHS] uphold[s] HIPAA’s promise of privacy and security,” according to HHS Deputy Secretary Eric Hargan. It would achieve these objectives through a variety of updates to the Privacy Rule, which we highlight in this blog post, along with initial reactions from our HIPAA privacy team.

On Friday, November 20, the Administration took bold action by releasing a contentious rule designed to disrupt the drug supply chain status quo. The Pharmaceutical Rebates final rule will alter how drug discounts offered by pharmaceutical manufacturers to plan sponsors or their PBMs, and service fees paid by such manufacturers to PBMs, are treated for purposes of the federal Anti-Kickback Statute (AKS). As we discuss in this alert, the policies set out in this final rule are not surprising, in light of other actions taken by the Trump Administration to date. However, the transformational effects the rule will have on the drug supply chain, coupled with a lack of consensus among lawmakers and industry stakeholders about the best approach to drug pricing reform, ensures that litigation of this new rule will inevitably ensue.

As the COVID-19 pandemic continues to upend our daily lives, the promise of a vaccine offers hope that life may, in the not-too-distant future, return to some version of normalcy. The path to getting a safe, accessible vaccine to market, however, presents a variety of its own challenges. As we’ve been exploring in our Bioethics in a Pandemic blog series, the pandemic has presented a host of bioethics issues pertinent to the vaccine development and distribution process. Mintz's Bridgette Keller recently shared her insights into how bioethics can (and should!) influence research and development at the M2D2 Challenge Awards. A video of her presentation is now available to view online.

President Trump has followed through on his threat to pharmaceutical manufacturers, signing new executive orders on Sunday that take a preliminary step toward the President’s goal of tying domestic drug prices to the prices manufacturers charge in foreign countries. The “Executive Order on Lowering Drug Prices by Putting America First” follows a trio of drug pricing-related executive orders the administration issued this past July. At that time, President Trump also signed a different executive order with the same name, but withheld the order in an attempt to force pharmaceutical manufacturers to the negotiating table. The President warned manufacturers that if they did not propose alternatives to lower drug pricing within 30 days, his administration would take action to implement its previously-abandoned plan to peg U.S. drug prices to foreign prices. Sunday’s order follows weeks of negotiations between the White House and drug manufacturers that have apparently not resulted in any mutually-acceptable proposals for lowering American drug prices.

As we noted in our previous post, the Johns Hopkins University Center for Health Security (Center) has been hard at work studying and providing thought leadership regarding the COVID-19 pandemic from a variety of angles. The Center, in conjunction with Texas State University and the Working Group on Readying Populations for COVID-19 Vaccine, recently released a report exploring the public’s role in COVID-19 vaccination (Report). The Report provides recommendations to U.S. policymakers, practitioners, and other stakeholders about how to advance public understanding of, access to, and acceptance of vaccines that protect against COVID-19.

As we discussed in our previous blog post, the Department of Health and Human Services’ Office for Civil Rights (OCR) released guidance this past June to address how health care providers could contact, in a HIPAA-compliant manner, recovered COVID-19 patients to provide them with information about donating blood and plasma to potentially help other COVID-19 patients. On August 24, OCR released an updated version of that guidance to address similar communications from health plans. The amended guidance provides that health plans may also reach out to recovered COVID-19 patients about blood and plasma donation, subject to the same restrictions applicable to health care providers.

Clinical trial sponsors and principal investigators can consider themselves on notice that the Food & Drug Administration (FDA) is poised to ramp up enforcement activity relating to responsible parties’ obligations regarding clinical trial registration and results reporting. In a new guidance it released on August 12, 2020, FDA outlines how it intends to identify parties who have failed to register a clinical trial on, or submit results to, the ClinicalTrials.gov databank, as required by the FDA Amendments Act of 2007 and final regulations promulgated in 2016 by the National Institutes of Health (NIH).