The Weekly Articles

The U.S. Department of Health and Human Services (HHS) published its final rule modifying the Confidentiality of Substance Use Disorder Patient Records regulations at 42 C.F.R. Part 2 (Part 2) on February 8, 2024. This final rule aligns Part 2 with the confidentiality provisions of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (2020) and amends many of the long-standing special confidentiality protections for patient records maintained in connection with substance use disorder. The final rule aligns many of the Part 2 provisions with existing HIPAA regulations including, but not limited to, allowing for single consent for all future disclosures for treatment, payment, and health care operations, allowing redisclosure of records, permitting disclosure to public health authorities without patient consent, and aligning penalties and breach notification requirements with HIPAA. It also expressly states that segregating or segmenting Part 2 records is not required. For more information on a summary of the major new changes to Part 2, see the HHS Fact Sheet on the final rule here. While the final rule went into effect on April 16, 2024, the compliance deadline is not until February 8, 2026. The Office of Civil Rights also plans to finalize changes to the HIPAA Notice of Privacy Practices to address the Part 2 changes in an upcoming final rule modifying the HIPAA Privacy Rule.

On April 8, the U.S. District Court for the Eastern District of California dismissed a lawsuit challenging California’s Transgender Sanctuary State Law, SB 107 authored by state Senator Scott Wiener (D-San Francisco). SB 107 provides a safe harbor for people seeking gender-affirming care in California by protecting health care providers who provide such care, patients and their families who come to California for care that is banned in the state where they live, as well as providing safeguards from other states’ laws that penalize people for receiving or providing care that is legal in California. The court dismissed the case without leave to amend, finding that plaintiffs lacked standing.

In Ryan S. v. UnitedHealth Group, the Ninth Circuit recently held that allegations of a plaintiff's experience regarding UnitedHealthcare denying coverage of his substance abuse treatment plus citation to a 2018 report by the California Department of Managed Care were sufficient to overcome a motion to dismiss his ERISA claim. 

After UnitedHealthcare refused to cover most of the costs of his substance use disorder programs, Ryan S. filed a class action alleging violations of ERISA, breach of fiduciary duty, and breach of contract.  The district court granted UnitedHealthcare’s motion to dismiss.  On appeal, the Ninth Circuit noted that the Parity Act required that any limitations on “mental health or substance use disorder benefits” in an ERISA plan be “no more restrictive than the predominant treatment limitations applied to substantially all [covered] medical and surgical benefits.  29 USC § 1185(a)(3)(A)(ii).  Thus, “a plaintiff must show that an ERISA plan that offers both medical/surgical benefits and MH/SUD benefits imposed a ‘more restrictive limitation on [MH/SUD] treatment than limitations on treatment for medical and surgical issues.’”

Plaintiffs can allege that an ERISA plan violates the Parity Act:  (1) if it is discriminatory on its face, (2) it contains a facially neutral term that is discriminatorily applied to MH/SUD treatment, or (3) that the plan administrator applies an improper process that excludes some MH/SUD treatment.  The court acknowledged that the lower court was presented with a challenge due to “uncertainty and ambiguity regarding [the Parity Act’s] application to specific ERISA plan terms and situations.  However, the court also confirmed that claims based on the existence of an internal process need not necessarily prove a categorical process:  “Handling MH/SUD treatment claims more stringently violates the Parity Act regardless of whether such differential treatment leads to the uniform denial of all claims.”  In addition, a plaintiff need not identify an analogous category of claims with precision, it can be described quite broadly.

Simply alleging a denial of the plaintiff’s claims for behavioral health benefits was unlikely to support pleading standards for a violation of the Parity Act.  However, Ryan S. had cited a 2018 report by the California Department of Managed Care concluding that UnitedHealthcare processed MH/SUD claims differently.  According to the report, claims submitted to UnitedHealthcare were evaluated by an algorithm which determined that, if certain criteria were not met, the claim was referred for peer review and that could result in a denial of service.  The report had information that UnitedHealthcare staff reported that no comparable review process existed for outpatient medical/surgical treatment.  Therefore, the report concluded that the approval process for MH/SUD services was being applied in a more stringent manner.  According to the court, this was sufficient to meet the plaintiff’s burden of proof.  (2024 WL 1561668 decided 4/11/24)

Karen Kim recently joined Athene Law LLP.   Karen is a current member of CSHA's Board of Directors.

Over the next few weeks, we will be spotlighting the outstanding Platinum sponsors of the CSHA Annual Meeting and Spring Seminar.

CSHA is proud to acknowledge Latham & Watkins LLP as a valued platinum sponsor of the 2024 Annual Meeting and Spring Seminar.

Epstein Becker Green's ranks have recently grown to include five CSHA members.  Raja Sekaran, Melissa Borrelli and John Puente joined as Members, Paul DeMuro and Jeremy Avila joined as Senior Counsel and James Reilly joined as an associate.  Raj and Melissa were former presidents of CSHA and Jeremy is a current member of CSHA's Publications Committee.  

The California Healthy Youth Act (Healthy Youth Act) found in Education Code Section 51931 et seq. requires that public school students in grades 7-12 receive age appropriate and medically accurate comprehensive sexual health education and HIV prevention education. Existing law defines “comprehensive sexual health education” as instruction and materials on human development and sexuality, including education on pregnancy, contraception and sexually transmitted infections.

AB 2229, introduced by Assembly member Lori Wilson in February 2024 would revise the Healthy Youth Act to include menstrual health in the definition of comprehensive sexual health education. Instruction on menstrual health would include instruction and materials about premenstrual syndrome and pain management, menstrual hygiene, menstrual disorders, menstrual irregularities, menstrual stigma and other relevant topics related to the menstrual cycle. On April 4 the bill was reviewed by the Assembly Committee on Education. The Committee voted 7 to 0 to pass, amend and re-refer to the Assembly Appropriations Committee.

CMA Legal Counsel Charlotte Tsui welcomed baby boy Jacob, who arrived on March 8 at 7:02am. Mom and baby are doing well.

On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group (UnitedHealth), experienced a cyberattack that crippled its systems, resulting in disruptions to Change Healthcare's operations.  Change Healthcare provides many services that are critical to the financial aspects of healthcare in the United States.  According to Change Healthcare, the company processes 15 billion health care transactions annually and touches 1 in every 3 patient records.  These transactions include a range of services, like eligibility verifications and authorizations, claims processing, and pharmacy operations.  As a result, healthcare providers at all levels are struggling to submit claims and be reimbursed for services, placing a significant financial strain on these organizations.  Among other issues, patients are experiencing delays in obtaining prescriptions or confirming insurance statuses. 

While the legislative response has largely been federal, including various actions by the U.S. Department of Health and Human Services to streamline processes related to claim submission and prior authorization requirements, states have also initiated actions to help with the recovery. On March 13, the California Department of Health Care Services (DHCS) issued a memo to its contracted Medi-Cal managed care plans (MCPs) reminding them of their legal and contractual obligations to timely pay claims submitted by providers for covered services to members.  To address the impact of the Change Healthcare cyberattack on the MCPs' payment operations and the downstream impact on healthcare providers, the memo strongly encourages MCPs to take six steps to adopt "flexibilities" in their operations. 

The six steps, in summary, are:

1.  Waive requirements to submit claims electronically, and automatically accept paper claims from providers;

2. Temporarily remove or relax timely filing deadlines;

3.  Establish workarounds to ensure the MCP, and any related parties that may have been impacted by the cyberattack, such as its subcontractors, continue to pay claims within the statutory timeframes of 30 or 45 working days from receipt of a claim;

4.  Temporarily relax or remove prior authorization requirements or develop an efficient workaround for providers, in order to ensure members do not experience delays in receiving care;

5. Post information on their websites to ensure providers have up-to-date information, including contact information, about the extent to which the MCPs' systems are impacted by the Change Healthcare cyberattack;

6. Apply any flexibilities and/or workarounds developed to address the impact of the cyberattack to services the MCP has delegated to subcontractors and other third parties, to the extent that these third parties have also been impacted by the cyberattack; and 

UnitedHealth has announced resumption of Change Healthcare's services, including "99% of [its] pharmacy network services," its electronic payments platform, and as of March 18, release of medical claims preparation software for healthcare providers to submit claims. Despite these developments, the timeline to full recovery, including processing the backlog of claims and transactions, will require healthcare organizations of all types, and at all levels, to independently develop mitigation strategies and implement workarounds. The extent of disruptions nationwide has exposed the vulnerability of the healthcare system to cyberattacks on critical infrastructure, and the dependence of clinical operations on financial transactions.

Lois Richardson is overjoyed to announce the birth of her first grandchild! Logan Palmer arrived on March 6, weighing 7.0 pounds and measuring 19 inches long. Mom and baby are healthy and happy! Lois is CSHA's Executive Director and VP & Legal Counsel for the California Hospital Association.