Loyola University Chicago School of Law, JD 2021
On January 31, 2020, the Secretary of Health and Human Services (“HHS”) Alex Azar declared a public health emergency (“PHE”) over the outbreak of the new coronavirus. The PHE response requires coordination with a complex set of federal, state, tribal and local laws and effective compliance calls for a comprehensive understanding of the legal implications and ramifications—which impose challenges from adherence to certain federal laws.
What is PHE?
Under Section 319 of the Public Health Service Act, the Secretary of HHS can declare a PHE which lasts for 90 days unless the Secretary authorizes an earlier termination or extension. This determination triggers emergency powers that permit the federal government to engage in activities such as: assisting state and local governments, suspending or modifying certain legal requirements, and expending available funds to address the public health emergency. Public health powers used by local, state, and federal government may include surveillance, reporting, epidemiological investigation, laboratory capacity, vaccination, isolation and quarantine, treatment, and evacuation and powers over the property.
Historically, the U.S. Supreme Court has held that states may enact laws that restrict individual liberties when necessary to protect the community. In Jacobson v. Massachusetts, the Supreme Court upheld a mandatory vaccination law to protect the community against smallpox. It follows that states may enact laws to require reporting of private health data, search medical and hospital records to locate information about the source and spread of communicable disease, collect and test specimens, and disclose information to the extent necessary to protect the public from communicable diseases and other public health threats.
Emergency wavier of regulations
Section 1135 of the Social Security Act authorizes the secretary of HHS to waive or modify certain requirements of the Centers for Medicare and Medicaid Services (“CMS”), the Children’s Health Insurance Plan (“CHIP”), HIPAA, and Emergency Medical Treatment and Labor Act (“EMTALA”).
For example, under EMTALA, hospitals are required to screen all individuals who present to an emergency room to determine the conditions of all individuals and stabilize them before transferring or discharging them. These requirements may be waived by the Secretary for up to 72 hours, or even longer in the case of a pandemic.
For Healthcare Reimbursement, the Secretary may adjust Medicare reimbursement for certain Part B drugs which are paid on the basis of the manufacturers’ average sales price (“ASP”). During a PHE, the inability to access enough drugs or biologicals might occur due to an outburst of demand and the price of a drug will increase accordingly. The Secretary may use the wholesale acquisition cost or other measures instead of the ASP until the price of the drug or other biological has stabilized. Also, the Secretary will exempt certain providers from sanctions for fraud and abuse when they are in good faith to provide services to individuals enrolled in Medicare, Medicaid, and CHIP, and are unable to comply with certain statutory requirements but are nonetheless reimbursed.
For HIPAA compliance, the HIPAA Privacy Rule is not suspended during a national or public health emergency. However, the Secretary of HHS may waive certain sanctions for non-compliance with HIPAA under the Project Bioshield Act of 2004 and section 1135(b)(7) of the Social Security Act. The waiver of HIPAA Privacy Rule requirements is effective only if actions under the waiver do not discriminate on the basis of a patient’s source of payment or ability to pay. Such waiver only applies if the hospital has implemented its hospital disaster protocol. Healthcare providers are relieved from sanctions and penalties arising from noncompliance with actions related to 1) obtaining a patient’s authorization to speak with family members or friends; 2) distributing a notice of privacy practices, or 3) the patient’s right to quest privacy restriction or confidential communications. Though certain reprieve applies, healthcare organizations should seek a balance between disclosing patient information when necessary to respond to a public health crisis and protecting patient privacy.