Healthcare reforms heading for enactment with the latest coronavirus relief package ease telehealth rules for high-deductible health plans (HDHPs) paired with health savings accounts (HSAs); permit group health plans — including healthcare accounts — to reimburse costs for over-the-counter (OTC) drugs; and require first-dollar coverage for COVID-19 testing and vaccines. The Coronavirus Aid, Relief and Economic Security (CARES) Act (HR 748) also modifies the healthcare and emergency leave requirements enacted earlier this month by the Families First Coronavirus Response Act (FFCRA) (Pub. L. No. 116-127). Along with offering a variety of relief to employers and individuals, the CARES Act conforms certain confidentiality standards for information about substance use disorders to the Health Insurance Portability and Accountability Act (HIPAA). President Trump has said he will immediately sign the bill, which cleared Congress today.
The CARES Act allows HDHP participants with HSAs to receive telemedicine free of cost sharing for plan years beginning on or before Dec. 31, 2021. A new safe harbor permits HDHPs to cover telehealth and other remote care services before participants have met their deductible. The legislation also makes clear that other coverage for telehealth and other remote care services while participating in an HDHP will not make an individual ineligible for HSA contributions.
For employers offering or considering telemedicine as part of their COVID-19 strategy, these changes to the HSA rules ensure that employers with HDHPs can cover telehealth without any cost sharing, as required for COVID-19 testing services under federal law and several states’ requirements for insured plans. However, employers offering telehealth services on a stand-alone basis — outside of a group health plan — to all or some employees still must consider whether those services qualify as an excepted benefit or instead must comply with the numerous requirements for group health plans under the Affordable Care Act (ACA) and ERISA.
The legislation eliminates the ACA’s ban on pretax reimbursement of the costs for OTC drugs not prescribed by a physician. This ACA restriction has applied to HSAs; Archer medical savings accounts (MSAs); and group health plans, including health flexible spending arrangements (FSAs) and health reimbursement arrangements (HRAs). The CARES Act also allows health accounts and plans to treat menstrual care products as medical expenses reimbursable on a pretax basis.
These changes are effective for expenses incurred after Dec. 31, 2019. With the elimination of this ACA restriction, the IRS may need to update prior guidance (Rev. Rul. 2003-102) that explains and provides examples of how health FSAs can reimburse OTC drugs.
The CARES Act modifies the recently enacted COVID-19 testing coverage mandate. Under the FFCRA, all group health plans (insured, self-insured, grandfathered and nongrandfathered) and health insurers in the group and individual markets must cover coronavirus tests and related services without cost sharing. Health plans also must provide this coverage without imposing prior-authorization or other medical-management standards. Similar no-cost coverage requirements apply to certain federal government health programs, such as Medicare beneficiaries and federal government employees. The mandate does not apply to excepted benefits.
This coverage mandate took effect March 18 with the FFCRA’s enactment and will remain in effect for the duration of the COVID-19 public health emergency. The mandate applies only to COVID-19 testing and related items and services provided — in person or via telehealth — at an urgent care center or an emergency room. Coverage for COVID-19 treatment is not addressed by the FFCRA or the CARES Act.
The CARES Act refines the FFCRA’s coverage mandate to set standards for determining reimbursement rates for COVID-19 testing and related items and services. The legislation also ensures that health plans will promptly provide cost-free coverage of COVID-19 vaccines recommended by the US Preventive Services Task Force (USPSTF) or the Centers for Disease Control and Prevention (CDC).
The CARES Act prescribes reimbursement standards for providers of COVID-19 diagnostic testing. All COVID-19 testing providers will have to post the test’s cash price on a public website. Group health plans and issuers must reimburse an in-network provider at the negotiated rate in effect before the emergency declaration. Reimbursements for diagnostic testing from an out-of-network provider must match the cash price listed on the provider’s website. Alternatively, a group health plan or issuer can negotiate a lower price with out-of-network providers. It’s unclear whether providers must also post the prices of items and services related to the diagnostic test, such as an office visit or evaluation. Clarification from regulators would be welcome.
The CARES Act requires group health plans and health insurance issuers to provide no-cost coverage for “qualifying coronavirus preventive services,” including vaccines. Cost-free coverage must be available within just 15 days after a coronavirus vaccine or preventive service receives an A or a B recommendation from the USPSTF or is recommended by the CDC.
This coverage deadline is dramatically shorter than the typical timetable for other newly recommended preventive services. Under the typical timetable, group health plans must extend cost-free coverage for new preventive services by the plan year that begins on or after one year from the last day of the month in which the USPSTF issued the recommendation.
The requirement to cover COVID-19 vaccines at no cost does not apply to excepted benefits or grandfathered group health plans.
The CARES Act clarifies some FFCRA issues regarding out-of-network reimbursement for COVID-19 tests and related services, but a number of other questions remain:
Guidance from federal regulators on these open questions would be welcome. Employers with fully insured group health plans should also look to state insurance directives that may go beyond the FFCRA and CARES Act requirements.
The CARES Act makes some modifications to the FFCRA’s emergency paid leave provisions.
Eligible employees. The legislation extends protected paid family leave to rehired employees. Emergency paid sick leave is available to all employees, but the emergency family leave provided under the FFCRA’s Family and Medical Leave Act (FMLA) expansion is only available to employees who have been working with the employer for at least 30 calendar days. The CARES Act extends this emergency family leave right to employees rehired after a layoff occurring on or after March 1, 2020, if they had worked for at least 30 of the 60 calendar days before the layoff. The CARES Act also gives the director of Office of Management and Budget authority to limit the FFCRA’s emergency paid leave for certain executive branch employees.
Advance tax credits for employers. The CARES Act makes the FFCRA’s employer tax credits available in advance to offset the costs of providing mandated paid sick and family leave.
Open questions. The FFCRA‘s paid leave mandates take effect no later than April 2, although the Department of Labor (DOL)’s Wage and Hour Division (WHD) has set a temporary nonenforcement period through April 17. Many questions remain regarding the FFCRA’s new emergency paid leave entitlements, including:
Guidance from federal regulators clarifying these and other issues would be welcome.
The CARES Act amends ERISA to give the DOL authority to postpone for up to a year any employee benefit plan deadline for a plan sponsor, administrator, participant or beneficiary during the public health emergency. The CARES Act also offers a variety of other relief to employers and individuals, including these provisions:
The CARES Act requires the Department of Health and Human Services (HHS) to issue HIPAA guidance on information sharing during the coronavirus public health emergency. The legislation also makes significant changes to a federal confidentiality law that governs the use and disclosure of certain substance use disorder (SUD) information.
The CARES Act directs HHS to issue guidance on the sharing of patients’ protected health information (PHI) during the COVID-19 public health emergency. Due within 180 days of the legislation’s enactment, the guidance should address compliance with existing HIPAA regulations, including any policies that may come into effect due to the national emergency.
HHS has already waived HIPAA penalties that could arise from certain hospitals’ failure to meet specific HIPAA requirements during the emergency, such as the law’s limitations on disclosures to family and friends or the required notice of privacy practices. Existing law gives the federal government authority to waive certain HHS requirements during a national emergency. The CARES Act appears to allow similar waivers for the COVID-19 emergency that would apply across the healthcare system —including to HIPAA covered group health plans — and to broaden HHS’s authority to waive HIPAA rules.
Telehealth enforcement flexibility. New guidance says HHS will not impose penalties during the COVID-19 emergency on providers using certain telehealth technologies that are not HIPAA compliant, such as popular video chat applications like Apple’s FaceTime. This enforcement discretion presumably applies to all HIPAA covered providers, including those providing care to patients covered by employer-sponsored plans.
COVID-19 disclosure guidance. HHS has also released guidance on when a HIPAA covered entity can disclose PHI under existing regulations to law enforcement, paramedics, first responders, and public entities like federal, state and local government health authorities. Plan sponsors should review the guidance to refresh their knowledge of these standards.
The CARES Act makes significant changes to federal confidentiality requirements governing the use and disclosure of certain SUD information. These requirements, contained in Section 543 of the Public Health Service Act (42 US § 290dd-2), are often referred to as “Part 2” since related regulations appear in Part 2 of Title 42 in the Code of Federal Regulations.
Part 2 standards. The Part 2 provisions are different and separate from HIPAA’s privacy and security protections. The scope of information addressed by Part 2 is narrower than the protected health information under HIPAA. Part 2 does not apply to every record about SUD treatment and instead covers only records generated from a “Part 2 provider” — a federally assisted treatment program that meets certain standards set out in regulations.
Part 2 has more stringent confidentiality requirements than HIPAA and requires covered providers to get a patient’s consent every time they disclose information that would identify the patient as having or having had an SUD. Any entity that has SUD information is generally prohibited from disclosing it without obtaining specific patient consent.
The law generally doesn’t apply to group health plans, unless they have obtained Part 2 information from covered providers and want to redisclose it. Employers adopting innovative value-based purchasing arrangements have had concerns about the potential need to meet Part 2’s more restrictive consent requirements. Those standards could limit the ability to provide incentives for improved care coordination and value-based designs, such as accountable care organizations. Some healthcare providers have criticized the law for having a chilling effect on providers’ sharing of information needed to effectively treat patients with SUDs.
CARES Act changes. The CARES Act addresses these Part 2 concerns, making permanent changes to the statute to align its requirements with HIPAA and update its language. Specific changes include the following:
The CARES Act requires HHS to revise existing Part 2 regulations consistent with these changes. The revised rules will apply to SUD information uses and disclosures starting 12 months after the legislation’s enactment.