Insights

Digital health companies, investors, and other healthcare organizations should follow policy developments with a strategic lens towards their market opportunities for key potential growth and risk mitigation. On a quarterly basis, we provide relevant legislative and regulatory updates on artificial intelligence (AI) and digital health policy developments.

On Monday, May 6th, the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) published a final rule to implement Section 1557 of the Affordable Care Act[1] (“Section 1557”), which prohibits discrimination on the basis of race, color, national origin, age, disability, or sex (including pregnancy, sexual orientation, gender identity, and sex characteristics), in covered health programs or activities (the “Final Rule”). Here, we focus on the Final Rule’s application of nondiscrimination principles under Section 1557 to the use of “patient care decision support tools” in clinical care. This Final Rule responds to the President’s Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence and comments received regarding the proposed rule for Section 1557. Other key provisions of the Final Rule, including the restoration of protections for LGBTQI+ and pregnant individuals, are summarized in a companion alert.

Digital health companies, investors, and other healthcare organizations should follow policy developments with a strategic lens towards their market opportunities for key potential growth and risk mitigation.

On January 17, 2024, the Centers for Medicare & Medicaid Services (CMS) issued the Interoperability and Prior Authorization Final Rule (Final Rule), which establishes requirements applicable to certain impacted payers which are intended to improve the electronic exchange of health information and prior authorization processes. The application programming interface (API) requirements will take effect January 1, 2027, while the operational provisions will take effect January 1, 2026. CMS has issued a helpful slide deck summarizing the Final Rule.

On December 13, 2023, the U.S. Department of Health and Human Services' (HHS) Office of the National Coordinator for Health Information Technology (ONC) released the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule. The effective date of the HTI-1 Final Rule is updated and is now March 11, 2024.

The Office of the Inspector General (OIG) of the U.S. Department of Health and Human Services (HHS) published the General Compliance Program Guidance (GCPG) on November 6, 2023. The GCPG provides updated descriptions of the seven elements of an effective compliance program that health care entities have long relied upon. The new guidance also includes recommendations to conduct annual internal risk assessments, to consider quality of care as a component of the compliance program, and to emphasize the importance of a board’s and executive leadership’s oversight of compliance.

On November 1, 2023, the Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC) at the Department of Health and Human Services (HHS) issued the “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking” proposed rule (Proposed Rule). Comments are due by January 2, 2024.

On October 30, President Joe Biden signed an Executive Order (“EO”) 14110 entitled, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence,” which establishes a policy framework to manage the risks of artificial intelligence (“AI”), to direct agency action to regulate the use of health AI systems and tools, and to guide AI innovation across all sectors, including in the health and human services sectors. OMB simultaneously released a draft memorandum that would specifically direct department and agency action by establishing new agency requirements in AI governance, innovation, and risk management and adopting specific minimum risk management practices for uses of AI. OMB is seeking public comment on the memorandum by December 5, 2023, which includes a list of questions requesting feedback on specific issues.

On October 30, 2023, President Biden released an Executive Order (EO) on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (AI).  This landmark EO seeks to advance the safe and secure development and deployment of AI by implementing a society-wide effort across government, the private sector, academia, and civil society to harness “AI for good,” while mitigating its substantial risks.

On June 27, 2023, the Department of Health and Human Services (“HHS”) Office of Inspector General (“OIG”) issued a final rule (“OIG Final Rule”) that implements statutory provisions for its enforcement of the information blocking penalties created by the 21stCentury Cures Act (“Cures Act”) and assessment of civil money penalties (“CMPs”) of up to $1 million per violation of information blocking for certain individuals or entities subject to the information blocking requirements.

On April 11, 2023, the U.S. Department of Health and Human Services' (“HHS”) Office of the National Coordinator for Health Information Technology (“ONC”) released the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule (“HTI-1 Proposed Rule”) to implement key provisions in the 21st Century Cures Act (“Cures Act”) governing health information technology (“health IT”) certification and information blocking, and other issues, as set forth further below.

On December 6, 2022, the Centers for Medicare & Medicaid Services (CMS) issued a Proposed Rule that would (i) further enhance health data exchange by establishing data exchange standards for certain payers, (ii) improve patient and provider access to health information, and (iii) streamline processes related to prior authorization for medical items and services. The regulations impact CMS-regulated payers and provide incentives for providers and hospitals that participate in the Medicare Promoting Interoperability Program and the Merit-based Incentive Payment System (MIPS).

On September 28, 2022, the Food and Drug Administration (FDA) issued Clinical Decision Support Software final guidance. The guidance clarifies the agency’s scope of oversight and regulation of clinical decision support software based on the definition of a device in the Federal Food, Drug, and Cosmetic Act (FD&C Act). It also describes the criteria used to assess whether software functions do not meet the definition of a device.

On November 4, 2021, the Centers for Medicare & Medicaid Services (CMS) published an interim final rule requiring health care workers at facilities enrolled with Medicare and Medicaid to be fully vaccinated as a condition of participation. Under the rule, if providers want to continue participating in Medicare, all applicable staff must have at least started the vaccination process by December 5, 2021. By January 4, 2022, all applicable facility staff must have all required vaccine doses, not including the 14-day incubation period after the final dose.

On January 8, 2021, the United States Department of Health and Human Services (HHS) released the “Securing Updated and Necessary Statutory Evaluations Timely,” or “SUNSET,” final rule. As discussed in a prior alert following HHS’s proposal of the SUNSET rule, the rule requires HHS to assess and review covered regulations every ten years for the regulations to remain effective. In doing so, the SUNSET rule imposes de facto expiration dates on most HHS regulations—the final rule estimates only one percent of HHS’s active parts of the Code of Federal Regulations are exempt from the rule. If HHS does not complete an assessment and review of a regulation that HHS determines has a significant economic impact upon a substantial number of small entities, by the applicable deadline, then the regulation “shall expire.”

On December 10, 2020, CMS released a new Notice of Proposed Rulemaking (NPRM) that would expand machine-readable access to health plans’ data, building on requirements finalized in March 2020 (see our blog on the CMS Final Rule). The NPRM proposes a second phase of application programming interface (API) development for certain impacted health plans that would allow patients—and now providers—to access prior authorization data in addition to claims, encounters, and clinical data in a standardized format.

On November 4, 2020, the Department of Health and Human Services (HHS) issued a notice of proposed rulemaking (NPRM) titled, “Securing Updated and Necessary Statutory Evaluations Timely” (85 Fed. Reg. 70096). Subject to certain exceptions, the NPRM would add expiration dates to regulations promulgated under Titles 21 (Food and Drugs), 42 (Public Health Service, Centers for Medicare and Medicaid Services, Office of Inspector General) and 45 (Public Welfare, including Health Information Technology) of the Code of Federal Regulations (CFR) (collectively, the Regulations). These Regulations would expire between two to ten years after the NPRM becomes effective, depending on the applicable calculation set forth in the NPRM. The Regulations would expire unless:

While the healthcare industry is evolving from fee-for-service to quality-based payment, the Stark Law (42 U.S.C. § 1395) and the Anti-Kickback Statute (42 U.S.C. § 1320a–7b) have remained stuck in the past. These two fraud and abuse laws have impeded the continued development and utilization of value-based arrangements that reward high quality health care and improved health outcomes. The Stark Law, for example, was created to combat the exchange of financial incentives in return for referring patients for designated health services (DHS) – an exchange that can incentivize the provision of unnecessary care under a fee-for-service payment system. However, with the healthcare industry’s recent shift toward value-based payments, overutilization is no longer the problem it used to be. The Stark Law and Anti-Kickback Statute are misaligned with the current health care industry payment landscape and as result have impeded forward progress toward value-based care.