Incentives for nondiscriminatory wellness programs in group health plans. Final rule

This document contains final regulations, consistent with the Affordable Care Act, regarding nondiscriminatory wellness programs in group health coverage. Specifically, these final regulations increase the maximum permissible reward under a health-contingent wellness program offered in connection with a group health plan (and any related health insurance coverage) from 20 percent to 30 percent of the cost of coverage. The final regulations further increase the maximum permissible reward to 50 percent for wellness programs designed to prevent or reduce tobacco use. These regulations also include other clarifications regarding the reasonable design of health-contingent wellness programs and the reasonable alternatives they must offer in order to avoid prohibited discrimination.

Privacy and anonymity challenges when collecting data for public health purposes

Two contemporary problems face public health professionals in collecting data from health care providers: the de-identification of geospatial information in a manner that still allows meaningful analysis, and ensuring that provider performance data (e.g., infection or screening rates) is complete and accurate. In this paper, we discuss new methods for de-identifying geographic information that will allow useful de-identified data to be disclosed to public health. In addition, we propose privacy preserving mechanisms that will likely encourage providers to disclose complete and accurate data. However, this must be accompanied by steps to grow trust between the providers and public health.

The law of unintended (financial) consequences: the expansion of HIPAA business associate liability

The recent Omnibus Rule published by the Department of Health and Human Services greatly expanded liability for breaches of health information privacy and security under the HIPAA statute and regulations. This expansion could have dire financial consequences for the health care industry. The Rule expanded the definition of business associates to include subcontractors of business associates and made covered entities and business associates liable for breaches of the entities who perform a service for them involving the use of individually identifiable health information under the federal common law of agency. Thus, if a covered entity or its "do wnstream" business associate breaches security or privacy, the covered entity or "upstream" business associate may face HIPAA's civil money penalties or a lawsuit. Financial managers need to be aware of these changes both to protect against the greater liability and to plan for the compliance costs inherent in effectively, if not legally, making business associates into covered entities.

HIPAA update: changes to notice of privacy practices and new requirements for analyzing breaches

Timely compliance with the 2013 Omnibus Rule requires health care providers to review their NPPs and use the new breach risk assessment standard beginning on or after September 23, 2013.