Seventeen hospital associations and 30 providers filed amicus briefs last week in support of the American Hospital Association’s suit against the restrictions imposed by the U.S. Department of Health and Human Services (HHS) on website tracking. In the briefs, the parties warn the restrictions would threaten their ability to provide needed health services. Read more on the case and review HHS’ Use of Online Technologies by HIPAA Covered Entities and Business Associates.

The PA CHW Collaborative is conducting a Community Health Worker (CHW) Statewide Survey to gather information about the scope of practice for CHWs in Pennsylvania (PA), and specifically in Community Health Centers and Community Based Organizations. The aggregate information collected will be provided to the PA Department of Human Services and will help to shape the forthcoming state plan amendment which, if approved, will authorize payment for CHW services under PA Medicaid (anticipated 1/1/25). Please work with your CHWs and leadership teams to organize a response and submit only one per organization. Please respond by Friday, February 2.

The PA Department of Human Services (DHS) has launched a survey of Medicaid recipients on their Medicaid renewal experience. The survey is being conducted in partnership with the University of Pittsburgh’s Medicaid Research Center, and feedback collected will be used to inform renewal outreach strategies moving forward. Learn more.

Last week, the Ranking member of the Senate HELP Committee expanded his 340B investigation to include the nation’s two largest contract pharmacy companies. The senator sent letters to both CVS and Walgreens, seeking detailed information on a long list of topics, including:

• How much money they earn from the program, and through what fees/mechanisms
• How many covered entities they work with
• The relationship between CVS and their 340B TPA, Wellpartner

The letter highlighted that 340B does not limit the fees that contract pharmacies can charge covered entities or third-party administrators (TPAs), and that the two companies realize “significant profits” as a result. The letters are part of the senator’s ongoing probe into 340B, which began in September with letters to two major health systems and was expanded to two large community health centers in November. Sen. Cassidy has not specified how he intends to use any findings from his inquiries, and it remains unclear if his probe has the support of other members of the HELP Committee.

With one day to spare and a snowstorm looming, Congress approved its third Continuing Resolution (CR) for FY2024 last Thursday. Under the new CR, all health center funding (both mandatory and discretionary) for Section 330, the National Health Service Corps (NHSC), and Teaching Health Centers (THCs) has been extended at FY2023 levels through March 8. Operational funds for the Department of Health and Human Services (HHS) were also extended through March 8, while funding for four other Federal agencies, including the VA, will expire a week earlier, on March 1. March will be a busy time for lawmakers with expiration of the CR, Super Tuesday on March 5 and President Biden’s State of the Union on March 7.

Gov. Josh Shapiro praised a bipartisan effort to give medically vulnerable infants in Pennsylvania expanded access to potentially life-saving pasteurized donor human milk. Act 32 of 2023, Owen’s Law, took effect the week of January 15 and increases access to pasteurized donor human milk by expanding the number of health conditions eligible for Medicaid-covered donor human milk. The law will support supplementation of a mother’s milk and provide more options to support healthy growth for infants. Key components of the law include expanding the number of medical conditions that qualify for Medicaid coverage for pasteurized human donor milk; requiring the Department of Health (DOH) in consultation with the Department of Human Services (DHS) to produce a public information campaign on the availability of pasteurized human donor milk; and tasking DHS with creating and updating guidance about the usage of donor milk. Click here to learn more. Click here for the Medical Assistance Bulletin.

From Healthcare Dive

Dive Brief:

• The HHS released voluntary cybersecurity goals for healthcare and public health organizations on Wednesday, as the industry grapples with increasing large data breaches and ransomware attacks.
• The performance goals, broken down into essential and enhanced safeguards, aim to help organizations prevent cyberattacks, improve their response if an incident occurs and minimize remaining risk after security measures are applied.
• The resources come after the HHS released a concept paper in December, which detailed plans to create hospital cybersecurity requirements through Medicare and Medicaid and eventually update the HIPAA rule.

Dive Insight:

Healthcare data breaches — particularly those stemming from hacking — have risen over the past decade, exposing hundreds of millions of patients’ sensitive personal information or protected health data.

Breaches can be costly for healthcare organizations to manage, but cyberattacks that interrupt hospital operations are also a risk to patient safety.

Ransomware, where criminals demand payment in exchange for restored access to sensitive information and critical systems, can disrupt normal care for weeks.

Ardent Health Services, which runs facilities in multiple states, was hit by a ransomware attack on Thanksgiving, forcing the hospital operator to take its network offline and divert incoming ambulances. Ardent restored access to its electronic health record in early December and fully recovered its patient portal in January.

The new cybersecurity goals from the HHS aim to help healthcare organizations build layered protection against cyberattacks — so if one defense fails, another can serve as a backup — which the agency said is key to building resilience and protecting patients.

“We have a responsibility to help our health care system weather cyber threats, adapt to the evolving threat landscape, and build a more resilient sector,” HHS Deputy Secretary Andrea Palm said in a statement. “The release of these cybersecurity performance goals is a step forward for the sector as we look to propose new enforceable cybersecurity standards across HHS policies and programs that are informed by these CPGs.”

The essential goals, which include safeguards like email security, multifactor authentication and basic cybersecurity training for employees, create a base to help organizations manage common vulnerabilities.

The enhanced protections, like establishing processes to discover and address threats at vendors, separating critical assets into discrete network segments and cybersecurity testing, aim to help health systems mature their defenses.

Hospitals cheered the voluntary goals, with American Hospital Association president and CEO Rick Pollack recommending in an email statement that “all components of the healthcare sector implement these practices including third party technology providers and business associates.”

But the trade and lobbying group has previously argued that mandated cybersecurity standards tied to funding — which media reports suggest could be coming down the pike soon — could remove hospital resources that could be used to shore up their cyber defenses.

Multi-state compacts make licensing easier to navigate by streamlining the application process. Visit this page at Telehealth.HHS.gov to learn how multi-state licensing compacts work and specifics on the compact for your discipline, including physicians and nurses, allied and auxiliary health care workers, and emergency medical services personnel.  Get more telehealth resources, including funding opportunities, from HRSA’s Office for the Advancement of Telehealth.

Read the full article here.

Along with the Office of Personnel Management, the Internal Revenue Service, and the Departments of Labor and Treasury, HHS seeks comments on proposed rules related to the Federal independent dispute resolution process established under the No Surprises Act. The proposal includes new requirements for disclosing information along with the initial payment or notice of denial of payment for certain items and services subject to surprise billing protections.  Initially opened in the Federal Register on November 3, 2023, the proposal was republished on Monday of this week; comments will be accepted until February 5.

Read the full article here.