Waivers do NOT mean HIPAA, CoP, EMTALA regulations not in effect

by A.J. Plunkett (aplunkett@decisionhealth.com)

Beware the myths and misperceptions going around about the blanket waivers and relaxed enforcement of some regulations issued by CMS to facilitate care for COVID-19 patients, cautions healthcare regulatory attorney Delphine O’Rourke, JD, former counsel for the Ascension health group and now a partner at the Duane Morris law firm in Philadelphia.

The blanket 1135 waivers were issued for the national emergency declared by the president, retroactive to March 1, to empower healthcare providers to take needed actions and to provide flexibility when preparing to receive and care for COVID-19 patients.

Some of the waivers ease requirements under certain Conditions of Participation (CoP), while others lift barriers to moving patients and partnering with other organizations. An HHS notification eased enforcement of some HIPAA privacy requirements relating to business associates.

However, the blanket waivers do not mean that all the CoPs are suspended or that the Emergency Medical Treatment and Labor Act (EMTALA) regulations do not apply for now, warns O’Rourke. Similarly, HIPAA requirements are still in place.

The blanket waivers will only last as long as the national emergency, she warns. Many of the waivers are contingent on whether a provider is in a region with a specific number of COVID-19 patients. Others may be superseded by local or state laws and regulations.

When (and if) you are changing policies and procedures based on the blanket 1135 waivers, she recommends that you:

• Make it obvious what the changes are—use capital letters, red type, or some other highlighting so personnel are clear on what they can and cannot do.
• Educate staff on the changes. However, remember that not all staff need to be aware of all the changes. Target your education.
• State clearly why you made the changes and what medical or evidence-based guidance they are based on.
• Also state when the changes are to be in effect.
• Note when the changes were made because you will have to revert to the old policies and procedures at some point in the future.

There has been speculation that many of the waivers may become permanent, but that will have to be done by legislation or regulatory changes using the normal process of implementing revisions, O’Rourke warns.

Also, keep those temporary policies and procedures on file, she advises. You may be asked to defend the changes or account for actions taken after the national emergency lifts. The waivers do not mean you won’t be investigated or held accountable for patient safety, she says.

You need to be able to show you were making a good-faith effort to protect patients and use the blanket waivers as they were intended.

What are the myths and the realities?

One of the most prevalent of the myths—and potentially most expensive given the possibility of civil penalties—is that HIPAA privacy requirements no longer apply.

The notice from HHS in the April 7 Federal Register said only that the Office of Civil Rights (OCR) will exercise discretion in enforcing and imposing penalties on business associates or other covered HIPAA entities in the disclosure of protected health information (PHI) to assist public health activities. That’s only during the national emergency, reiterates O’Rourke.

The intent is to facilitate needed information about who has contracted the novel coronavirus so that the data can be passed on to public health departments and other public health agencies as they try to contain the spread of COVID-19, and to facilitate the transfer of patients, she says.

The notice primarily covers business associates, not healthcare providers, notes O’Rourke.

The business associate can disclose certain information if it’s in a good-faith effort to help public health activity, and they have to inform the hospital or whatever covered entity is involved within 10 calendar days of the disclosure, O’Rourke says.

OCR’s enforcement discretion will not extend to other disclosures, such as selling PHI, she warns. Entities should make sure their business associates understand their responsibilities, she recommends, and communicate that the change is only for the duration of the national emergency. If your business associate agreement is modified, make sure changes are marked and that the policy is changed again after the emergency is ended.

The 1135 blanket waivers grow

Initially, the 1135 waivers that allow some rules and regulations to be relaxed during an emergency were being approved on a state-by-state basis. Then at the end of March, HHS and CMS issued several blanket waivers, retroactive to the March 1 emergency announcement.

The waivers continue to be updated and cover a variety of healthcare providers, including hospitals, long-term care, skilled nursing facilities, and home health agencies. (To find the latest list of waivers, go to CMS’ Coronavirus Waivers & Flexibilities website at https://www.cms.gov/about-cms/emergency-preparedness-response-operations/current-emergencies/coronavirus-waivers.)

The most sweeping waivers involved a collection of actions, dubbed the “Hospitals Without Walls” initiative, to increase hospital capacity.

The waivers are in three basic categories, explains O’Rourke:

• Flexibilities to increase access to bed space
• Actions to decrease time spent on administrative burden, pushing back deadlines and allowing more time to submit documentation
• Increasing access to providers

For instance, some of the waivers lifted the time necessary for a patient to be in acute care before moving to a skilled facility, or allowed some hospitals to move behavioral health patients to other areas as they sought to separate COVID-19 patients from other hospital populations.

CMS has created a list outlining all the blanket waivers—which by mid-April was more than three dozen pages long—and separated the waivers by provider type.

For hospitals under time pressure, O’Rourke recommends looking at only the waivers that apply to your situation. If you don’t have critical access hospitals under your umbrella, move on to the postacute care provider types you might need to have information about.

Two areas of key importance to hospitals are waivers involving the credentialing and privileging of providers, as well as the increased availability of telehealth.

Just make sure you double-check with your local or state authorities having jurisdiction before you change policies and procedures, she says.

Other waivers ease enforcement of when and how patients can be transferred to other levels of care. But safety is still key, she warns.

“You need to have a safe discharge plan for patients. That requirement isn’t waived.”

EMTALA requirements still intact

While the waivers provide hospitals and other providers many flexibilities to deal with a surge in COVID-19 patients, there are still key regulations that must be met, reminds O’Rourke.

That includes EMTALA.

CMS waived the enforcement of parts of the act to “allow hospitals, psychiatric hospitals, and critical access hospitals (CAHs) to screen patients at a location offsite from the hospital’s campus to prevent the spread of COVID-19, so long as it is not inconsistent with a state’s emergency preparedness or pandemic plan,” according to the blanket waivers summary.

Part of that effort is in recognition of the limitations on rural hospitals, says O’Rourke, which may not have the necessary space to isolate large numbers of COVID-19 patients.

The waivers allow hospitals to screen patients off-site from the hospital. However, the requirements for providing stabilizing emergency care are still in effect. Patients still cannot be transferred based on their ability to pay.

When does the national emergency end?

While the start of the national emergency declared by the president is retroactive to March 1 for the purposes of actions covered by the waivers and notifications, its end date may depend on geography.

There may be a national declaration that the COVID-19 crisis is over. Or it may be incremental by region, depending on the number of cases and when social distancing or isolation orders are lifted from state to state, says O’Rourke.

However, there will remain a concern about people from regions still under emergency and isolation restrictions deciding to travel to non-emergency regions. That debate likely points to a national order to lift the emergency, O’Rourke says.

At the same time, some infectious disease experts are estimating that the national emergency could last a year or more.

Stay in touch with your local or state public health authorities on what the status of the emergency is in your area, if you don’t know.

For more information on CMS and HHS actions related to COVID-19, go to CMS’ emergencies website: https://www.cms.gov/About-CMS/Agency-Information/Emergency/EPRO/Current-Emergencies/Current-Emergencies-page.

Sidebars

HHS summary April 7 privacy rule notification

OCR will exercise its enforcement discretion and will not impose penalties against a business associate or covered entity under the Privacy Rule provisions 45 CFR 164.502(a)(3), 45 CFR 164.502(e)(2), 45 CFR 164.504(e)(1) and (5) if, and only if:

• The business associate makes a good faith use or disclosure of the covered entity's PHI for public health activities consistent with 45 CFR 164.512(b), or health oversight activities consistent with 45 CFR 164.512(d); and
• The business associate informs the covered entity within ten (10) calendar days after the use or disclosure occurs (or commences, with respect to uses or disclosures that will repeat over time).

Examples of such good faith uses or disclosures covered by this Notification include uses and disclosures for or to:

• The Centers for Disease Control and Prevention (CDC), or a similar public health authority at the state level, for the purpose of preventing or controlling the spread of COVID-19, consistent with 45 CFR 164.512(b).
• The Centers for Medicare and Medicaid Services (CMS), or a similar health oversight agency at the state level, for the purpose of overseeing and providing assistance for the health care system as it relates to the COVID-19 response, consistent with 45 CFR 164.512(d).

To read the full notification, go to https://www.govinfo.gov/content/pkg/FR-2020-04-07/pdf/2020-07268.pdf.

What does CMS say on the EMTALA waivers?

According to CMS, only “Only two aspects of the EMTALA requirements can be waived under 1135 Waiver Authority: 1) Transfer of an individual who has not been stabilized, if the transfer arises out of an emergency or, 2) Redirection to another location (offsite alternate screening location) to receive a medical screening exam under a state emergency preparedness or pandemic plan. A waiver of EMTALA sanctions is effective only if actions under the waiver do not discriminate as to source of payment or ability to pay. Hospitals are generally able to manage the separation and flow of potentially infectious patients through alternate screening locations on the hospital campus.”

“Therefore, waivers to provide Medical Screening Examinations at an offsite alternate screening location not owned or operated by the hospital will be reviewed on a case-by-case basis. Please note, there is no waiver authority available for any other EMTALA requirement. For the duration of the COVID-19 national emergency, CMS is waiving the enforcement of section 1867(a) of the Social Security Act (the Emergency Medical Treatment and Active Labor Act, or EMTALA). This will allow hospitals, psychiatric hospitals, and CAHs to screen patients at a location offsite from the hospital’s campus to prevent the spread of COVID-19, in accordance with the state emergency preparedness or pandemic plan.”