122 pages. "The HIPAA Security Rule focuses on safeguarding electronic protected health information (ePHI) held or maintained by regulated entities. The ePHI that a regulated entity creates, receives, maintains, or transmits must be protected against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures. This publication provides practical guidance and resources that can be used by regulated entities of all sizes to safeguard ePHI and better understand the security concepts discussed in the HIPAA Security Rule." [Also available: HIPAA Security Rule Resources (18 pages)]  MORE >>

"The guidance in this area is in flux ... Beginning in 2021, HHS regulations permitted, but did not require, plans and insurers to count drug manufacturers' assistance toward the cost-sharing limit. However, in 2023 a court vacated the applicable provision in the regulations.... [It] is uncertain how the rules will be applied in the absence of the vacated provision in the regulations. "  MORE >>

"CMS released instructions for the third prescription drug data collection (RxDC) reports due June 1, 2024 -- and they may cause plan sponsors to reconsider whether they need to make 'plan level' submissions, instead of relying on their vendors to make 'aggregate' submissions on their behalf.... CMS plans to enforce the 'aggregation restriction' ... [which] may cause headaches for some plan sponsors, who find that they can no longer rely on their PBM's aggregate submission of pharmacy data but must instead submit plan level data."  MORE >>

"Fourteen states have enacted ground ambulance surprise billing laws before and after the passage of the NSA ... but federal action is needed to provide comprehensive protection. Fewer than a third of states have protections in place, and states lack the authority to regulate all types of health insurance -- specifically, self-funded employer-sponsored insurance where 65 percent of workers in the U.S. get their coverage." [View an interactive map.]  MORE >>

"[T]he new FAQs outline a 'therapeutic equivalence' medical management technique that can be used by group health plans (along with an exceptions process) to administer required contraceptive coverage.... The FAQs emphasize that the plan's maintenance of a compliant exceptions process is key, as the Departments continue to receive reports of non-compliant exceptions processes and participants encountering barriers to contraceptive coverage."  MORE >>

"[As] a precondition of payment or reimbursement of expenses for qualified benefits, the health FSA must require substantiation by an independent third-party. The independent third-party substantiation must include ... [1] Information describing the service or product; [2] The date of the service or sale; and [3] The amount of the expense."  MORE >>

"According to the [Tenth Circuit], the district court abused its discretion because it treated Ms. Watson's Section 502(a)(3) claim for fiduciary breach as a Section 502(a)(1) claim to recover under the plan, when, in fact, '[t]hese provisions provide for distinct claims' ... In a footnote, the Tenth Circuit panel addressed EMC's argument that a surcharge award would, in essence, constitute 'compensatory damages' that are not recoverable under Section 502(a)(3)(B)'s catchall provision." [Watson v. EMC Corp., No. 22-1356 (10th Cir. Feb. 9, 2024)]  MORE >>

"With several more GLP-1 drugs expected to hit the market by 2026, costs for employer health plans are likely to continue to rise. Employers are considering various coverage and management strategies ... such as prior authorization, limiting coverage to certain individuals and setting higher cost-sharing requirements.... [T]he increasing use of these drugs raises several challenges and questions for employers."  MORE >>

"[1] Consider all plans offered ... [2] Focus on full compliance ... [3] Don't rely on the TPA for compliance ... [4] Conduct a risk analysis ... [5] Properly identify PHI ... [6] Identify Business Associates ... [7] Tailor the Notice of Privacy Practices ... [8] Provide training ... [9] Hybrid entity [status]."  MORE >>

"The impact of Medicare’s bargaining over drug prices for privately insured Americans remains unclear. States have taken additional steps, such as cutting copays for insulin for the privately insured. However, insurers are increasing premiums in response to their higher costs under the IRA. Monthly premiums on traditional Medicare drug plans jumped to $48 from $40 this year, on average."  MORE >>

"[CMS] will be allowed to negotiate the lowest possible maximum fair price (MFP), as long as that price is no higher than what Medicare currently pays and is a specified discount from the average private market price.... The MFP is public ... Manufacturers will be concerned about a low MFP in part because it determines their revenue from Medicare but in addition because it can influence prices from other payers. Since the law does not preclude manufacturer agreements to pay confidential rebates to CMS (discounts off the MFP), they will have an interest in doing so if they can secure a higher MFP in return."  MORE >>

"Having HHS set the maximum fair price (MFP) for Medicare without knowing the actual, post-rebate (net) prices received by a manufacturer from all payers -- including Medicaid, the 340B program, and commercial payers -- creates uncertainty about the magnitude of the actual price cut and complicates understanding the value of a drug relative to therapeutic alternatives."  MORE >>

"[I]ndividuals and businesses in parts of Michigan affected by severe storms, tornadoes and flooding that began on Aug. 24, 2023 ... now have until June 17, 2024, to file various federal individual and business tax returns and make tax payments.... individuals and households that reside or have a business in Eaton, Ingham, Ionia, Kent, Livingston, Macomb, Monroe, Oakland, and Wayne counties, qualify for tax relief."  MORE >>

"Notifying participants and beneficiaries about your employee benefits is an important part of compliance and getting the most out of your benefits by ensuring employees know what their options are. [This article outlines] what disclosures and notices are required, who needs to receive them, and when to send them out ... for the two most common types of plans (401(k) retirement plans and health and welfare plans)."  MORE >>