Anthem has agreed to pay the Department of Health and Human Services (HHS) $16 million for a landmark 2015 breach that impacted nearly 79 million consumers.
It’s a record-setting settlement from the Office for Civil Rights (OCR), the HHS agency tasked with enforcing HIPAA. It’s nearly three times the agency’s previous highest settlement of $5.55 million paid by Advocate Health Care in 2016.
“The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history,” OCR Director Roger Severino said in a statement. “Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information.”
“We know that large health care entities are attractive targets for hackers, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR,” he added.
An investigation by OCR found that the insurance giant failed to conduct an enterprise-wide risk analysis, regularly review system activity or identify and respond to a known threat.
OCR also determined that Anthem failed to implement the minimum security controls to prevent hackers from accessing sensitive patient information. The attack, which began as early as Feb. 18, 2014, wasn’t discovered by Anthem until Jan. 29, 2015, but most of the information was stolen between Dec. 2, 2014 and Jan. 27, 2015.
Anthem has also agreed to take “substantial corrective action,” according to OCR. As outlined its corrective action plan with the agency, Anthem must conduct a risk analysis, review its policies and procedures, provide annual reports to HHS for a two-year period and notify HHS of any reportable events involving employee noncompliance.
Last year, the insurer agreed to pay $115 million to settle a class-action lawsuit from members affected by the breach.
- The U.S. Supreme Court agreed Thursday to review an appellate court ruling that HHS improperly changed the reimbursement formula for Medicare disproportionate share hospital payments.
- The crux of the case is whether HHS violated federal law by making the change in the DSH reimbursement calculation without public notice and comment.
- At stake for HHS is up to $4 billion in DSH reimbursements made between FY 2005 and 2013.
Policy changes since 2010 have cut payments to hospitals by billions of dollars, a report earlier this year from consulting firm Dobson DaVanzo & Associates forecast, with a prediction the cuts would reach $218.2 billion by 2028.
The cuts include $25.9 billion for Medicaid Disproportionate Share Hospital (DSH) payments, a key source of financing for hospitals that serve low-income populations.
HHS petitioned the high court to hear the case after the D.C. Circuit Court of Appeals ruled in favor of Minneapolis-based Allina Health Services and a group of hospitals. The decision, written by embattled Supreme Court nominee Brett Kavanaugh, overturned a lower court ruling that sided with HHS.
In his 2017 opinion, Kavanaugh concluded that HHS violated the Medicare Act when it revised its reimbursement adjustment formula with going through the usual rulemaking process. In particular, he rejected the government’s argument that the notice-and-comment requirement for regulations setting or modifying a “substantive legal standard” does not apply to “interpretive rules.”
Kavanaugh also held that HHS erred in including Medicare Part C enrollees with Part A enrollees in its new DSH payment calculations.
“That difference in interpretation makes a huge difference in the real world,” Kavanaugh wrote. “Part C enrollees tend to be wealthier than Part A enrollees. Including Part C days in Medicare fractions therefore tends to lead to lower reimbursement rates. Ultimately, millions of dollars are at stake for the Government and the hospitals.”
In its petition, HHS maintains that the appellate court’s decision would “significantly impair” its ability to administer annual Medicare reimbursements through the third-party contractors it employs to pay hospitals.
“The court of appeals’ decision threatens to undermine HHS’s ability to administer the Medicare Program in a workable manner,” the petition states. Given the time and cost involved in formal rulemaking, “converting the agency’s non-binding manuals and other interpretive materials into regulations requiring notice and comment would jeopardize the flexibility needed in light of Medicare’s complex and frequently changing statutory context and administrative developments.”
A discrepancy in eligibility ages for Medicare and Social Security benefits means that some Medicare-eligible individuals are not enrolled in the program, leaving them unknowingly open to penalties.
During a meeting on Thursday, the Medicare Payment and Advisory Commission (MedPAC) discussed why this problem exists and how to fix it.
Eligibility for both Medicare and Social Security has begun at age 65 for many years. Although Medicare eligibility still starts at age 65, the “full retirement” age for Social Security is gradually increasing to 67.
People who receive Social Security benefits are enrolled in Medicare automatically. But due to this change, about 40% of 65-year-olds who are not yet receiving Social Security benefits have not been auto-enrolled in Medicare.
Some can enroll after life events, such as losing employer-sponsored coverage after retirement. The rest, however, face delays in coverage and late enrollment penalties: $13.40 per month for each year delaying enrollment in Part B, and $4.20 per month for each year delaying enrollment in Part D.
There is an appeals process for people stuck with penalties, but they must prove that they received incorrect information from a government official.
Several commissioners saw those penalties as overly harsh, but a few said Medicare needs a better system to ensure the eligible population enrolls.
One commissioner suggested providing seniors a way to enroll in Medicare when they go to enroll in an exchange plan. Similarly, another commissioner said exchange plans could help communicate information about enrolling in Medicare to seniors.
Yet another commissioner, however, worried insurance companies would try to retain as many of their enrollees as possible—even those that could enroll in Medicare.
Little is known about the eligible-but-not-enrolled population—age 65 or otherwise. This population could be mostly healthy individuals deferring enrollment until they feel they need coverage, or they could be low-income individuals who feel they can’t afford the premiums.
Scott Harrison, Ph.D., a principal policy analyst who presented at Thursday’s session, suggested that MedPAC urge the Department of Health and Human Services (HHS) to work with the Social Security Administration (SSA) to better inform individuals about their Medicare eligibility.
Usually, beneficiaries receive enrollment information through the mail. But one commissioner, Karen DeSalvo, M.D.—who served as acting assistant secretary for health at HHS under President Obama—encouraged the group to “think broadly.”
HHS and the Social Security Administration can communicate via Federally Qualified Health Center networks, Substance Abuse and Mental Health Services Administration grantees, and more, DeSalvo said. Communicating through “a lot of avenues” could also reach individuals that lack a permanent address, she added.
MedPAC plans to collect more information about this population’s age, geographic distribution, income, and literacy before taking action.
The Department of Health and Human Services has released its long-promised request for information on reforming anti-kickback statutes.
The RFI (PDF) was posted to the Federal Register on Monday. The HHS Office of Inspector General is seeking feedback on ways it could adjust the implementation of the law to allow for better growth of value-based care programs.
OIG wants to build new safe harbors or modify existing ones to break down barriers to care coordination while still protecting against fraud and abuse, it said in the document.
“Through internal discussion and with the benefit of facts and information received from external stakeholders, OIG has identified the broad reach of the anti-kickback statute and beneficiary inducements [civil monetary penalty] as a potential impediment to beneficial arrangements that would advance coordinated care,” OIG said.
The agency first said the RFI was coming in mid-July, in congressional testimony from Deputy Secretary Eric Hargan. Changes to the way it enforces anti-kickback statutes are part of HHS’ “regulatory sprint” toward more coordinated care, which Hargan is spearheading.
Donald White, a spokesperson for OIG, told FierceHealthcare the RFI offers a “really great opportunity” for providers and other stakeholders to voice opinions that could direct the agency’s goals.
Hargan told legislators it’s important to HHS to ensure anti-kickback protections “aren’t strangling innovation and new models of care that will be for the benefit of the American people.”
The document was released as the comment period ended Friday for the Centers for Medicare & Medicaid Services’ request for information on potential changes to the enforcement of the Stark Law—another part of the agency’s “regulatory sprint.”
CMS Administrator Seema Verma said the Stark Law in its current form could hinder the expansion of value-based care.
“To achieve a truly value-based, patient-centered healthcare system, doctors and other providers need to work together with patients,” Verma said. “Many of the recent statutory and regulatory changes to payment models are intended to help incentivize value-based care and drive the Medicare system to greater value and quality.”
Comments on OIG’s request can be submitted for the next 60 days.
The growth of accountable care organizations is cutting physician work hours as well as the likelihood of doctors being self-employed, according to a new JAMA report.
The study of nearly 50,000 doctors found a 10% increase in ACO enrollment in a hospital referral region is connected with 0.82 fewer work hours per week for male physicians. The 10% number is also associated with a decrease of 2% in the probability of physicians being self-employed.
The study found that older physicians were more apt to shift to employment, potentially to receive retirement benefits after selling their practices by selling their practices to hospitals.
ACOs are becoming more popular alternatives as more systems move to value-based contracting.
UnitedHealth Group, which includes the nation’s largest private payer, expects to double the size of its national accountable care organization NexusACO at least once and maybe twice through the end of next year.
The JAMA report found there were 923 ACO contracts in 2017 that covered more than 32 million people.
The question is how further ACO growth will affect physician employment and work hours. The study found hospital-controlled ACOs are hiring physicians as employees. That is reducing doctors’ incentives to work long hours.
“Although our data do not offer a mechanism that underlies these findings, well-performing ACOs may make more efficient use of physician time by shifting tasks that do not require physicians to other team members,” the study authors wrote.
Though the study showed minor reductions in hours worked, the researchers suggested doctors could reduce work further as ACOs mature.
They said older physicians moving into employment for retirement benefits could “fuel further increases in ACO employment in the short run, but in the long run could raise questions about availability of physicians in ACOs.”
Physician hours will play an even bigger role in the coming years with the expected doctor shortage. At the same time, physicians complain about feeling burnt out from their current workload, which may get worse.
Are ACOs a way to resolve that issue? The study said future research should look at physician job satisfaction for doctors in ACOs to see if those contracts lessen burnout problems. “Given the rapid increases in the numbers of primary care nurse practitioners, future research should also examine the association between ACOs and employment patterns of … nonphysician clinicians,” they wrote.
Though ACOs show potential, the reality hasn’t always been positive. A recent report in Health Affairs found many innovations haven’t met promises of improving outcomes and efficiently using resources. However, ACOs present “new opportunities to develop the evidence necessary to implement, scale and sustain these needed innovations in healthcare delivery,” the authors of that study said.
Examples of ACOs finding success include CMS’ Next Generation ACO and Medicare Shared Savings Program. A 2017 report showed that 11 of 18 Next Generation ACOs earned savings in 2016. Also, the HHS Office of Inspector General found that the Medicare Shared Savings Program reduced spending and improved care quality in most ACOs during the program’s first three years.
The Trump administration is halting billions of dollars of payments to insurers under the Affordable Care Act’s risk-adjustment program, a move that further disrupts the insurance market and could lead to more premium increases next year.
Citing conflicting federal court decisions on the program, the CMS said it cannot collect or disburse funds under the risk-adjustment program. All in all, the program was slated to shift $10.4 billion among insurers in 2017, according to the agency.
The permanent program was meant to reduce the incentive for health insurers to cherry-pick healthy members. It shuffles money from plans with healthier-than-average members to those with larger numbers of sicker, higher-cost members. The program is based on a patient’s risk score, which is determined by a person’s demographic information and health condition.
But U.S. District Judge James Browning of New Mexico ruled in February that HHS couldn’t use statewide average premiums to come up with its risk-adjustment formula because the agency wrongly assumed the ACA required the program to be budget-neutral.
“CMS has asked the court to reconsider its ruling, and hopes for a prompt resolution that allows CMS to prevent more adverse impacts on Americans who receive their insurance in the individual and small group markets,” CMS Administrator Seema Verma said in a July 7 statement.
America’s Health Insurance Plans said it was “very discouraged” by the CMS’ decision, which comes as insurers determine their premiums for 2019 and states review those proposals.
“The decision will have serious consequences for millions of consumers who get their coverage through small businesses or buy coverage on their own,” the group said. “It will create more market uncertainty and increase premiums for many health plans—putting a heavier burden on small businesses and consumers, and reducing coverage options. And costs for taxpayers will rise as the federal government spends more on premium subsidies.”
The risk-adjustment program has been a source of frustration for small insurers and ACA co-ops that claim the formula makes their membership bases look healthier than they are. One reason could be that newer insurers have limited information on their members’ health status and claims history. Legacy insurers that have a wealth of patient data may have a leg up on coding. Small health plans also have far less capital than more established insurers to comfortably make large risk-adjustment payments.
The CMS has asked Judge Browning to reconsider his ruling and is awaiting a decision. The agency said it will release additional guidance for insurers on issues related to the risk-adjustment program, including appeals and how this will affect medical loss ratios.