Healthcare reforms heading for enactment with the latest coronavirus relief package ease telehealth rules for high-deductible health plans (HDHPs) paired with health savings accounts (HSAs); permit group health plans — including healthcare accounts — to reimburse costs for over-the-counter (OTC) drugs; and require first-dollar coverage for COVID-19 testing and vaccines. The Coronavirus Aid, Relief and Economic Security (CARES) Act (HR 748) also modifies the healthcare and emergency leave requirements enacted earlier this month by the Families First Coronavirus Response Act (FFCRA) (Pub. L. No. 116-127). Along with offering a variety of relief to employers and individuals, the CARES Act conforms certain confidentiality standards for information about substance use disorders to the Health Insurance Portability and Accountability Act (HIPAA). President Trump has said he will immediately sign the bill, which cleared Congress today.

Eased HSA rules for telemedicine

The CARES Act allows HDHP participants with HSAs to receive telemedicine free of cost sharing for plan years beginning on or before Dec. 31, 2021. A new safe harbor permits HDHPs to cover telehealth and other remote care services before participants have met their deductible. The legislation also makes clear that other coverage for telehealth and other remote care services while participating in an HDHP will not make an individual ineligible for HSA contributions.

For employers offering or considering telemedicine as part of their COVID-19 strategy, these changes to the HSA rules ensure that employers with HDHPs can cover telehealth without any cost sharing, as required for COVID-19 testing services under federal law and several states’ requirements for insured plans. However, employers offering telehealth services on a stand-alone basis — outside of a group health plan — to all or some employees still must consider whether those services qualify as an excepted benefit or instead must comply with the numerous requirements for group health plans under the Affordable Care Act (ACA) and ERISA.

Revised reimbursement rules for OTC drug costs

The legislation eliminates the ACA’s ban on pretax reimbursement of the costs for OTC drugs not prescribed by a physician. This ACA restriction has applied to HSAs; Archer medical savings accounts (MSAs); and group health plans, including health flexible spending arrangements (FSAs) and health reimbursement arrangements (HRAs). The CARES Act also allows health accounts and plans to treat menstrual care products as medical expenses reimbursable on a pretax basis.

These changes are effective for expenses incurred after Dec. 31, 2019. With the elimination of this ACA restriction, the IRS may need to update prior guidance (Rev. Rul. 2003-102) that explains and provides examples of how health FSAs can reimburse OTC drugs.

No-cost coverage, reimbursement rates for COVID-19 testing

The CARES Act modifies the recently enacted COVID-19 testing coverage mandate. Under the FFCRA, all group health plans (insured, self-insured, grandfathered and nongrandfathered) and health insurers in the group and individual markets must cover coronavirus tests and related services without cost sharing. Health plans also must provide this coverage without imposing prior-authorization or other medical-management standards. Similar no-cost coverage requirements apply to certain federal government health programs, such as Medicare beneficiaries and federal government employees. The mandate does not apply to excepted benefits.

This coverage mandate took effect March 18 with the FFCRA’s enactment and will remain in effect for the duration of the COVID-19 public health emergency. The mandate applies only to COVID-19 testing and related items and services provided — in person or via telehealth — at an urgent care center or an emergency room. Coverage for COVID-19 treatment is not addressed by the FFCRA or the CARES Act.

The CARES Act refines the FFCRA’s coverage mandate to set standards for determining reimbursement rates for COVID-19 testing and related items and services. The legislation also ensures that health plans will promptly provide cost-free coverage of COVID-19 vaccines recommended by the US Preventive Services Task Force (USPSTF) or the Centers for Disease Control and Prevention (CDC).

Reimbursement rates

The CARES Act prescribes reimbursement standards for providers of COVID-19 diagnostic testing. All COVID-19 testing providers will have to post the test’s cash price on a public website. Group health plans and issuers must reimburse an in-network provider at the negotiated rate in effect before the emergency declaration. Reimbursements for diagnostic testing from an out-of-network provider must match the cash price listed on the provider’s website. Alternatively, a group health plan or issuer can negotiate a lower price with out-of-network providers. It’s unclear whether providers must also post the prices of items and services related to the diagnostic test, such as an office visit or evaluation. Clarification from regulators would be welcome.

Coverage for COVID-19 vaccines

The CARES Act requires group health plans and health insurance issuers to provide no-cost coverage for “qualifying coronavirus preventive services,” including vaccines. Cost-free coverage must be available within just 15 days after a coronavirus vaccine or preventive service receives an A or a B recommendation from the USPSTF or is recommended by the CDC.

This coverage deadline is dramatically shorter than the typical timetable for other newly recommended preventive services. Under the typical timetable, group health plans must extend cost-free coverage for new preventive services by the plan year that begins on or after one year from the last day of the month in which the USPSTF issued the recommendation.

The requirement to cover COVID-19 vaccines at no cost does not apply to excepted benefits or grandfathered group health plans.

Open questions

The CARES Act clarifies some FFCRA issues regarding out-of-network reimbursement for COVID-19 tests and related services, but a number of other questions remain:

• Can a group health plan participant be balance-billed by an out-of-network provider or facility for the covered services?
• What types of items and services are included in the provider’s “evaluation” that must be covered at no cost when it leads to an order for or the administration of a COVID-19 test?
• If a healthcare provider’s evaluation of potential COVID-19 symptoms or exposure does not result in a diagnostic test, is the evaluation covered at no cost to the participant?
• If a group health plan doesn’t currently include telehealth among covered services, must it now cover telehealth screening, items and services related to COVID-19 testing?
• If a group health plan covers telehealth through a separate vendor (for example, Teladoc or MD Live), must the plan also cover telehealth visits with traditional providers (such as primary care physicians)?

Guidance from federal regulators on these open questions would be welcome. Employers with fully insured group health plans should also look to state insurance directives that may go beyond the FFCRA and CARES Act requirements.

Emergency paid leave changes

The CARES Act makes some modifications to the FFCRA’s emergency paid leave provisions.

Eligible employees. The legislation extends protected paid family leave to rehired employees. Emergency paid sick leave is available to all employees, but the emergency family leave provided under the FFCRA’s Family and Medical Leave Act (FMLA) expansion is only available to employees who have been working with the employer for at least 30 calendar days. The CARES Act extends this emergency family leave right to employees rehired after a layoff occurring on or after March 1, 2020, if they had worked for at least 30 of the 60 calendar days before the layoff. The CARES Act also gives the director of Office of Management and Budget authority to limit the FFCRA’s emergency paid leave for certain executive branch employees.

Advance tax credits for employers. The CARES Act makes the FFCRA’s employer tax credits available in advance to offset the costs of providing mandated paid sick and family leave.

Open questions. The FFCRA‘s paid leave mandates take effect no later than April 2, although the Department of Labor (DOL)’s Wage and Hour Division (WHD) has set a temporary nonenforcement period through April 17. Many questions remain regarding the FFCRA’s new emergency paid leave entitlements, including:

• How does FMLA leave already taken by an employee count against the new entitlement to emergency family leave?
• Will tax credits be available for qualified family or sick leave wages paid before March 18 (the FFCRA’s enactment date) or for qualified wages paid between March 18 and April 2?

Guidance from federal regulators clarifying these and other issues would be welcome.

ERISA deadlines and other relief for employers

The CARES Act amends ERISA to give the DOL authority to postpone for up to a year any employee benefit plan deadline for a plan sponsor, administrator, participant or beneficiary during the public health emergency. The CARES Act also offers a variety of other relief to employers and individuals, including these provisions:

• Small business loans to cover employment costs. A new loan program is available to employers with 500 or fewer employees (or the workforce size designated for a particular industry), including sole proprietors, independent contractors and self-employed individuals. Employers in the hotel and restaurant industry are eligible if they have 500 or fewer employees in a particular location, and a special rule applies to franchises. The loans (with interest limited to 4%) are available for costs incurred between Feb. 15 and June 30. A portion of the loan can be forgiven — essentially turning the loan into a grant — if employers use the funds to pay wages (up to $100,000 prorated) and tips; the costs of health, retirement or paid leave benefits; state or local taxes; or mortgage interest, rent and/or utility payments. The forgivable amount of the loan will be reduced by the number of employees who are laid off or have their wages reduced. The program offers opportunities for employers to rehire or increase wages.
• Payroll tax credit for shutdowns or steep revenue losses. A payroll tax credit is available to employers (including certain tax-exempt employers) that fully or partially shut down operations or have their revenue reduced by 50%. The tax credit applies to the first $10,000 of wages (including employer contributions for health coverage) paid to each employee after March 12, 2020, and before Jan. 1, 2021. The credit is not available to government employers.
• Employer contributions toward student loans. Employers can contribute up to $5,250 on a nontaxable basis toward an employee’s student loan for 2020.
• Direct payments to individuals and families below certain income limits. The Treasury Department will make a payment (by check or direct deposit) of $1,200 for individuals and $2,400 for families, with an additional $500 for each child. These amounts are phased out for individuals with income between $75,000 and $99,000 and families with income between $150,000 and $198,000.

Information confidentiality provisions

The CARES Act requires the Department of Health and Human Services (HHS) to issue HIPAA guidance on information sharing during the coronavirus public health emergency. The legislation also makes significant changes to a federal confidentiality law that governs the use and disclosure of certain substance use disorder (SUD) information.

New HIPAA guidance required

The CARES Act directs HHS to issue guidance on the sharing of patients’ protected health information (PHI) during the COVID-19 public health emergency. Due within 180 days of the legislation’s enactment, the guidance should address compliance with existing HIPAA regulations, including any policies that may come into effect due to the national emergency.

HHS has already waived HIPAA penalties that could arise from certain hospitals’ failure to meet specific HIPAA requirements during the emergency, such as the law’s limitations on disclosures to family and friends or the required notice of privacy practices. Existing law gives the federal government authority to waive certain HHS requirements during a national emergency. The CARES Act appears to allow similar waivers for the COVID-19 emergency that would apply across the healthcare system —including to HIPAA covered group health plans — and to broaden HHS’s authority to waive HIPAA rules.

Telehealth enforcement flexibility. New guidance says HHS will not impose penalties during the COVID-19 emergency on providers using certain telehealth technologies that are not HIPAA compliant, such as popular video chat applications like Apple’s FaceTime. This enforcement discretion presumably applies to all HIPAA covered providers, including those providing care to patients covered by employer-sponsored plans.

COVID-19 disclosure guidance. HHS has also released guidance on when a HIPAA covered entity can disclose PHI under existing regulations to law enforcement, paramedics, first responders, and public entities like federal, state and local government health authorities. Plan sponsors should review the guidance to refresh their knowledge of these standards.

Reforms to federal SUD information confidentiality provisions

The CARES Act makes significant changes to federal confidentiality requirements governing the use and disclosure of certain SUD information. These requirements, contained in Section 543 of the Public Health Service Act (42 US § 290dd-2), are often referred to as “Part 2” since related regulations appear in Part 2 of Title 42 in the Code of Federal Regulations.

Part 2 standards. The Part 2 provisions are different and separate from HIPAA’s privacy and security protections. The scope of information addressed by Part 2 is narrower than the protected health information under HIPAA. Part 2 does not apply to every record about SUD treatment and instead covers only records generated from a “Part 2 provider” — a federally assisted treatment program that meets certain standards set out in regulations.

Part 2 has more stringent confidentiality requirements than HIPAA and requires covered providers to get a patient’s consent every time they disclose information that would identify the patient as having or having had an SUD. Any entity that has SUD information is generally prohibited from disclosing it without obtaining specific patient consent.

The law generally doesn’t apply to group health plans, unless they have obtained Part 2 information from covered providers and want to redisclose it. Employers adopting innovative value-based purchasing arrangements have had concerns about the potential need to meet Part 2’s more restrictive consent requirements. Those standards could limit the ability to provide incentives for improved care coordination and value-based designs, such as accountable care organizations. Some healthcare providers have criticized the law for having a chilling effect on providers’ sharing of information needed to effectively treat patients with SUDs.

CARES Act changes. The CARES Act addresses these Part 2 concerns, making permanent changes to the statute to align its requirements with HIPAA and update its language. Specific changes include the following:

• Consent. Once a patient provides written consent to use or disclose protected SUD information, HIPAA covered entities and business associates and Part 2 providers (and other entities covered by Part 2) don’t have to obtain consent again to use or disclose this information for treatment, payment and healthcare operations (as defined in the HIPAA rules). Unless revoked, the patient’s initial consent continues to cover disclosures for these purposes. HIPAA rules will govern any redisclosure of information disclosed for treatment, payment or healthcare operations. This could ease the use and disclosure of information among providers and for payment and healthcare operations in new alternative value-based care arrangements.
• Disclosures to public health authorities. The CARES Act amends Part 2 to align with HIPAA rules for disclosing deidentified information to a public health authority.
• Penalties. The legislation removes existing criminal penalties under Part 2 and replaces them with certain civil and criminal penalties under HIPAA.
• Nondiscrimination. New antidiscrimination provisions prevent any entity from discriminating against an individual based on Part 2 information, however obtained. This extends to discrimination in access to healthcare; hiring, firing and employment terms; and the sale or rental of housing, among other areas.
• HITECH Act. The HITECH Act’s breach notice and other requirements will apply to Part 2 information.
• HIPAA notice of privacy practices. HHS must issue updated HIPAA regulations within a year of the CARES Act’s enactment to require that the HIPAA notice of privacy practices include “easily understandable” language describing patient rights and other items concerning Part 2 information.

The CARES Act requires HHS to revise existing Part 2 regulations consistent with these changes. The revised rules will apply to SUD information uses and disclosures starting 12 months after the legislation’s enactment.

Related resources

Non-Mercer resources

• HR 748, the Coronavirus Aid, Relief and Economic Security (CARES) Act (Congress, March 27, 2020)
• Section-by-section summary of the CARES Act (Senate Health, Education, Labor & Pensions Committee, March 25, 2020)
• COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities (HHS, March 24, 2020)
• Field Assistance Bulletin 2020-1, Temporary nonenforcement period applicable to the FFCRA (DOL, March 24, 2020)
• News release on FFCRA’s paid leave provisions (IRS and DOL, March 20, 2020)
• Pub. L. No. 116-127, the Families First Coronavirus Response Act (Congress, March 18, 2020)
• Notification of enforcement discretion for telehealth remote communications during the COVID-19 nationwide public health emergency (HHS, March 17, 2020)
• Waiver or modification of requirements under Section 1135 of the Social Security Act (HHS, March 13, 2020)

Mercer Law & Policy resources

• Stimulus bill gives DB funding relief, access to DC savings (March 26, 2020)
• COVID-19 triggers new state and local paid leave benefits, guidance (March 26, 2020)
• Roundup: Coronavirus (COVID-19) updated resources for employers (March 24, 2020)
• Virus aid legislation includes cost-sharing curbs, new leave rights (March 18, 2020)
• COVID-19 spurs IRS relief for HDHPs, state insurance guidance (March 18, 2020)

Other Mercer resources

• Stay informed on the coronavirus (regularly updated)
• COVID-19 stimulus package — employee benefit provisions to watch (March 26, 2020)
• Do benefits continue during furloughs? It’s a matter of plan interpretation (March 26, 2020)
• Your COVID-19 testing FAQs answered (March 26, 2020)
• US health insurers activate COVID-19 policy changes (March 26, 2020)
• The case for digital health in the age of COVID-19