Tag: Office of Civil Rights (OCR)

OCR Issues Guidance on Civil Rights Protections Prohibiting Race, Color, and National Origin Discrimination During COVID-19

News Release from the U.S. Department of Health and Human Services |  Monday, July 20, 2020

OCR Issues Guidance on Civil Rights Protections Prohibiting Race, Color, and  National Origin Discrimination During COVID-19

Yesterday, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) is issuing guidance to ensure that recipients of federal financial assistance understand that they must comply with applicable federal civil rights laws and regulations that prohibit discrimination on the basis of race, color, and national origin in HHS-funded programs during COVID-19. This Bulletin focuses on recipients’ compliance with Title VI of the Civil Rights Act of 1964 (Title VI).

To help ensure Title VI compliance during the COVID-19 public health emergency, recipients of federal financial assistance, including state and local agencies, hospitals, and other health care providers, should:

  • Adopt policies to prevent and address harassment or other unlawful discrimination on the basis of race, color, or national origin.
  • Ensure – when site selection is determined by a recipient of federal financial assistance from HHS – that Community-Based Testing Sites and Alternate Care Sites are accessible to racial and ethnic minority populations.
  • Confirm that existing policies and procedures with respect to COVID-19 related services (including testing) do not exclude or otherwise deny persons on the basis of race, color, or national origin.
  • Ensure that individuals from racial and ethnic minority groups are not subjected to excessive wait times, rejected for hospital admissions, or denied access to intensive care units compared to similarly situated non-minority individuals.
  • Provide – if part of the program or services offered by the recipient – ambulance service, non-emergency medical transportation, and home health services to all neighborhoods within the recipient’s service area, without regard to race, color, or national origin.
  • Appoint or select individuals to participate as members of a planning or advisory body which is an integral part of the recipient’s program, without exclusions on the basis of race, color, or national origin.
  • Assign staff, including physicians, nurses, and volunteer caregivers, without regard to race, color, or national origin. Recipients should not honor a patient’s request for a same-race physician, nurse, or volunteer caregiver.
  • Assign beds and rooms, without regard to race, color, or national origin.
  • Make available to patients, beneficiaries, and customers information on how the recipient does not discriminate on the basis of race, color, or national origin in accordance with applicable laws and regulations.

OCR is responsible for enforcing Title VI’s prohibitions against race, color, and national origin discrimination. As part of the federal response to this public health emergency, OCR will continue to work in close coordination with our HHS partners and recipients to remove discriminatory barriers which impede equal access to quality health care, recognizing the high priority of COVID-19 testing and treatment.

Roger Severino, OCR Director, stated, “HHS is committed to helping populations hardest hit by COVID-19, including African-American, Native American, and Hispanic communities.” Severino concluded, “This guidance reminds providers that unlawful racial discrimination in healthcare will not be tolerated, especially during a pandemic.

“Minorities have long experienced disparities related to the medical and social determinants of health – all of the things that contribute to your health and wellbeing. The COVID-19 pandemic has magnified those disparities, but it has also given us the opportunity to acknowledge their existence and impact, and deepen our resolve to address them,” said Vice Admiral Jerome M. Adams, Surgeon General, MD, MPH. “This timely guidance reinforces that goal and I look forward to working across HHS and with our states and communities to ensure it is implemented.”

To read the new OCR Bulletin, please visit: Title VI Bulletin – PDF

To learn more about non-discrimination on the basis of race, color, national origin, sex, age, and disability; conscience and religious freedom; and health information privacy laws, and to file a complaint with OCR, please visit: www.hhs.gov/ocr.

For more OCR announcements related to civil rights and COVID-19, please visit: https://www.hhs.gov/civil-rights/for-providers/civil-rights-covid19/index.html.

Final Rule for ACA Section 1557

On June 12, 2020, the Office of Civil Rights (OCR) of the Department of Health and Human Services (HHS) published the long-awaited final rule which significantly changes several of the anti-discrimination provisions of Section 1557 of the Affordable Care Act.  The final rule, which is a departure from the agency’s previous interpretation of the rules which were enacted 2016 during the Obama administration.  Since, the enactment of the 2016 rules, there have been numerous legal challenges to these provisions in federal court.  HHS believes that these final rules will reduce or eliminate provisions that they state were ineffective, unnecessary, and confusing and will save roughly covered entities roughly $2.9 billion in costs.

2016 Section 1557 Requirements

Section 1557 of the ACA were the anti-discrimination provisions geared at ensuring all individuals had access to essential benefits.  When originally released in 2016, the Section 1557 rules prohibited discrimination on the basis of race, color, national origin, sex, age, or disability in certain health programs or activities, including discrimination on the basis of pregnancy, gender identity, and sex stereotyping.  The 2016 Rule also required that covered entities:

  • Establish a written Grievance Procedure.
  • Identify and maintain a Compliance Coordinator.
  • Publish non-discrimination notices in the top 15 languages spoken in the covered entity’s state.
  • Publish taglines informing individuals of the availability of aides and services in the top 15 languages spoken in the covered entity’s state.
  • Make available assistance for individuals with Limited English Proficiency (LEP) and those with disabilities, including communications related disabilities.
  • Include the mailing of non-discrimination notices and taglines in every “substantial communication” with individuals.
  • Included non-discrimination protections for individuals “on the basis sex” which was interpreted by OCR to include gender identity, sexual orientation, and termination of pregnancy.

2020 Section 1557 Final Rule

The Final Rule eliminated several key provisions of the 2016 Rule. The provisions that were eliminated included:

  • Discrimination protections for individuals “on the basis of sex”
  • Specific non-discrimination provisions “on the basis of sex”, including gender identity, sexual orientation, and termination of pregnancy.
  • Written Grievance Procedure.
  • Compliance Coordinator.
  • Publishing of non-discrimination notices in top 15 languages informing individuals of aides and services for individuals with Limited English Proficiency (LEP).
  • Publishing of taglines in top 15 languages informing individuals of aides and services for individuals with Limited English Proficiency (LEP).

In addition to eliminating certain provisions, the final rule also relaxed the requirements relative to providing meaningful access to interpreter services for individuals with Limited English Proficiency (LEP).  Under the 2016 rule, the agency assessed compliance with the meaningful access requirement by whether a covered entity established and implemented a Language Access Plan.  This included providing access to interpreter services to individuals with LEP.  The 2020 final rule requires covered entities only make “reasonable efforts” to ensure meaningful access to aides and services for individuals with LEP.  However, the final rule does not change the requirements for meaningful access for individuals with disabilities or communication related disabilities.

The Bottom Line for EMS Providers

When the 2016 Section 1557 rule was enacted, the AAA sought guidance from OCR due to what we perceived to be compliance challenges for mobile-based healthcare providers.  Our concerns were related to how mobile-based healthcare providers can ensure that the public and the patients we serve receive adequate notice of the protections afforded under Section 1557.  As is often the case, when new regulations are enacted, they are enacted for standard “brick and mortar” healthcare providers, not ambulance services.  At the time, our guidance was to post the required notices and taglines on your organization’s website and in the patient signature areas of your patient care report.

From a practical perspective, the enactment of this final rule will have limited impact for ambulance providers.  Presuming an ambulance service’s compliance with the provisions of the 2016 rule, member companies can decide if they wish to eliminate their existing Compliance Coordinator position and Grievance Procedure.  However, OCR still requires a covered entity to have written process for handling discrimination complaints.  Therefore, it may be beneficial to simply maintain the 2016 requirements to ensure you can demonstrate compliance.

One welcome change is the elimination of the need to include the Section 1557 non-discrimination notices and taglines in every “substantial communication” with individuals.  Many members voiced that they incurred a significant expense mailing the nondiscrimination notice and tagline requirements in every invoice or patient communication.  This often added several additional pages to all patient communications which increased printing and postage costs substantially.  Our recommendation is for ambulance providers to continue to make the non-discrimination notices and taglines available on your organizational website and in any electronic communications as these mediums do not significantly increase costs.

Compliance Assistance

OCR has numerous compliance assistance documents on their website.  Additionally, members can contact the AAA for assistance with these regulatory changes.

OCR Guidance on COVID-19 and HIPAA Disclosures

Office for Civil Rights Guidance on COVID-19 and HIPAA disclosures to law enforcement, paramedics, other first responders, and public health authorities
 by Kathy Lester, J.D., M.P.H.

 On March 24, the Office for Civil Rights (OCR) released guidance clarifying that any covered entity may share the name or other identifying information of an individual who has been infected with, or exposed to, COVID-19 with law enforcement, paramedics, other first responders, and public health authorities without an individual’s authorization.  This clarification allows ground ambulance entities and their personnel to share the information consistent with the guidance.  It also allows other covered entities such as hospitals, physicians to share the information with ground ambulance entities and their personnel.  Finally, there are no HIPAA restrictions on non-covered entities, such as law enforcement, families, public health departments, and 911 call centers (not otherwise covered entities), from sharing the information.  There may be State confidentiality laws that apply as well, and the AAA encourages ground ambulance entities to review the laws in the States in which they operate.

The authority to share this information is in the existing HIPAA regulation – this is not a waiver or a change in the current law.  OCR highlights the current authority in the guidance.

  • Disclosure of PHI pursuant to treatment (45 C.F.R. § 164.506(c)(2)). Covered entities may disclose PHI to another covered entity for purposes of treatment, payment, or health care operations.  The guidance provides the example of a skilled nursing facility (SNF) disclosing PHI about a COVID-19 positive individual to emergency transport personnel who will be treating a patient during the transport of the individual to a hospital emergency department.  This is an example and not the only scenario to which the disclosure policy applies.
  • Disclosures required by law (45 C.F.R. § 164.512(a)). Covered entities may disclose PHI when such disclosure is required by law.  The guidance provides the example of a hospital disclosing PHI about a COVID-19 positive individual to public health officials when such a disclosure is required by state law.  Again, this is an example and not the only scenario to which the disclosure policy applies.
  • Disclosure to public health authorities (45 C.F.R. §§ 164.512(b)(1) & 164.501 (definition of public health authority). Covered entities may disclose PHI about a COVID-19 positive individual to a public health authority that is authorized by law to collect or receive such information for the purpose of controlling disease, injury, or disability.  The purposes include public health surveillance, public health investigations, and public health interventions.  Examples of public health authorities include the Centers for Disease Control and Prevention and state, tribal, local, and territorial public health departments).
  • Disclosures when risk of infection to a person (45 C.F.R. § 512(b)(1)(iv)).  Covered entities or public health authority may disclose to a person – including first responders – who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation.  The guidance provides the example of a county health department disclosing such information to a police office to prevent or control the spread of COVID-19.  This authority would also apply to ground ambulance personnel, even though the example does not reference them specifically.
  • Disclosures to prevent or lessen a serious and imminent threat to the health and safety of a person or the public (45 C.F.R. § 164.512(j)(1)). Covered entities may disclose PHI to a person or the public to prevent or lessen a serious and imminent threat to the health and safety of a person or the public when the disclosure is made to someone the person making the disclosure believes that doing so will prevent or lessen the threat.  The guidance provides an example of disclosing COVID-19 status to firefighters, child welfare workers, mental health crisis personnel, or others – which would include ground ambulance personnel as well.  The covered entity must believe in good faith that the disclosure is necessary to prevent or minimize the threat of imminent disclosure to the person or public.
  • Disclosure to a correctional institution or law enforcement having lawful custody of an inmate or other individual under certain circumstances (45 C.F.R. § 164.512(k)(5)). Covered entities may disclose PHI related to an inmate’s positive COVID-19 status under the following circumstances:
  • Providing health care to the individual;
  • The health and safety of the individual, other inmates, officers, employees, and others present at the correctional institution, or persons responsible for the transporting or transferring of inmates;
  • Law enforcement on the premises of the correctional institution; or
  • The administration and maintenance of the safety, security, and good order of the correctional institution.

The guidance provides the example of a physician at a medical facility sharing an inmate’s positive COVID-19 status with correctional guards.

For all of these disclosures, with the exception of those that are required by law or for the purpose of treatment, the covered entity must provide the minimum amount of information necessary to accomplish the purpose.  For example, the guidance states that a hospital should not distribute a list of individuals who are COVID-19 positive or suspected to have the virus to EMS personnel, but rather disclose the information on a case-by-case basis about the specific patient being treated.  Similarly, a 911 call center that is a covered entity may provide such information to a police office or similar personnel being dispatched to the scene to allow the responder to take the necessary precautions.

The guidance also provides additional examples that reference specific types of covered entities, but these are just examples.  The laws apply to all covered entities and not just those highlighted in the examples.

HHS OCR Requests Feedback on HIPAA Privacy Rule

On January 28, 2019, the Office of Health and Human Services the Office for Civil Rights (HHS OCR) issues a Request for Information (RFI) seeking input from covered entities regarding several aspects of the Health Insurance Portability and Accountability Act (HIPAA).  Specifically, the HHS OCR is seeking input regarding several elements of the Privacy Rule, including the following:

  • Encouraging information-sharing for treatment and care coordination
  • Facilitating parental involvement in care
  • Addressing the opioid crisis and serious mental illness
  • Accounting for disclosures of PHI for treatment, payment, and health care operations as required by the HITECH Act
  • Changing the current requirement for certain providers to make a good faith effort to obtain an acknowledgment of receipt of the Notice of Privacy Practices

I am aware that several AAA member services who have struggled with many of the HIPAA restrictions regarding the sharing of PHI with other healthcare entities.  In particular, with regard to individuals who suffer opioid overdoses and efforts to ensure the individual has access to drug treatment programs.  Additionally, HHS OCR is seeking input from covered healthcare providers regarding the “good faith” efforts to obtain acknowledgement of the receipt of Privacy Practices.  This has been a considerable challenge for EMS given the nature of our healthcare delivery model.  The relaxing of this regulatory requirement would substantially reduce the burden on EMS agencies.

The AAA recommends that our members review the HHS OCR Request for Information and submit comments by the February 12, 2019 deadline.  If members have any questions or need assistance in submitting their comments, the AAA is here to help.

HHS Releases Communication Checklist to Aid First Responders

HHS Releases Checklist to Aid First Responders in Communicating Effectively with Patients

The U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) has released a plain language checklist that is intended to aid First Responders during emergencies that involve individuals with Limited English Proficiency (LEP) and communications related disabilities. The AAA issued numerous articles to its members in 2016 about the newly published requirements for all healthcare providers, including EMS agencies, under the nondiscrimination provisions of the Affordable Care Act (ACA) Section 1557. The requirements are intended to prevent discrimination in the provision of healthcare and ensure that all individuals can meaningfully participate in their healthcare treatment, including those patients with LEP and other communications related disabilities.

The announcement yesterday is intended to provide additional resources for healthcare providers to ensure compliance with the ACA Section 1557. The checklist includes numerous recommendations and action steps that EMS agencies can utilize to ensure that they are serving all members of a community in a meaningful way. These recommendations include conducting research about the communities by accessing U.S. Census Bureau data, engaging Centers for Independent Living and local assistance groups, and by preparing emergency messaging that can be disseminated quickly to individuals with LEP and communications related disabilities.

It is important that EMS agencies recognize their obligations under Section 1557 of the ACA to ensure that they can meaningfully serve their communities and remain compliant with their obligations under the law. HHS OCR has published several resources to assist healthcare providers on their website. EMS agencies that are unsure if ACA Section 1557 rules apply to them or have questions about how they can comply can contact the AAA for assistance.

Access the checklist here►

HIPAA Breach Results in Highest Settlement in OCR History

The U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) announced earlier this month that is has entered into the largest settlement agreement in the history of the Department with Anthem, Inc., the largest Blue Cross and Blue Shield health benefit companies in the country.  Anthem, Inc. agreed to pay $16 million to HHS and take substantial corrective action to settle numerous potential violations of both HIPAA Privacy and Security Rules after it exposed protected health information (PHI) for nearly 79 million people.

In March 2015 Anthem filed a breach report with OCR after they discovered that their Information Technology (IT) systems were infiltrated by cyber-attackers who had gained access to their systems after an Anthem employee opened a phishing email.  This email released an undetected continuous persistent threat attack that permitted the cyber-attackers to access their systems from December 2014 through the end of January 2015.  This attack opened access that ultimately resulted in the PHI of nearly 79 million people to be stolen.

OCR’s investigation revealed that Anthem failed to conduct an enterprise-wide risk analysis.  Additionally, OCR determined that Anthem “failed to have sufficient policies and procedures to regularly review IT system activity, identify and respond to suspected or known security incidents, and failed to implement adequate minimum access controls to prevent impermissible access to electronic PHI.”

As part of the settlement, Anthem must comply with a Corrective Action Plan (CAP) for a period or two years.  As part of that CAP, Anthem must conduct an “accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI held by Anthem.” This risk assessment must be submitted to OCR for review and approval.  The CAP includes the review, revision, and distribution of all written policies and procedures addressing Information System Activity Review and Access Control for systems containing ePHI.  The CAP requires regular and ongoing reporting to OCR for actions taken under the Plan and for any reportable events.

The day following the Anthem, Inc. settlement press release, OCR and the Office of the National Coordinator for Health Information Technology (ONC) announced that they have strengthened the Security Risk Assessment (SRA) Tool to improve functionality.  The SRA is designed for use by small to medium sized health care providers to help them identify risks and vulnerabilities to ePHI within their practices.  All HIPAA covered entities and business associations are required to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI in their organizations.

Ambulance services should conduct a comprehensive Risk Analysis of their systems.  This Risk Analysis should include all provisions and requirements under HIPAA.  While this settlement highlights the significant risks associated with ePHI and IT systems, there remains significant risks to PHI in non-electronic forms as well.  This settlement is a great illustration of how apathy or reduced focus can result in potentially devastating results.

Contact the American Ambulance Association (AAA) with questions or assistance regarding any HIPAA related or other ambulance service compliance issue.

Update on Section 1557 of ACA

This past June the AAA notified our members of the new Non-Discrimination Rules under Section 1557 of the ACA. Under the new rules, covered entities are required to provide auxiliary aides and services for individuals with Limited English Proficiency (LEP) and communications related disabilities. For a full description of all of the Section 1557 requirements, see the AAA Member Advisories.

While there is usually a period of time before enforcement actions occur with new Regulations, the Office of Civil Rights published a press release announcing a Voluntary Resolution Agreement between the OCR, the U.S. Attorney’s Office of the District of Connecticut (DOJ), and a healthcare system who is subject to the Section 1557 Rules. The Agreement, which resolved a complaint and subsequent investigation involving a hearing impaired patient who requested auxiliary aides due to a hearing impairment upon arriving at the hospital for care. The patient never received any communication aides during the course of the stay. This should serve as a notice to all ambulance providers that they must comply with all of the requirements of the Section 1557 Rules. For assistance or guidance on the requirements of Section 1557 and how ambulance services can be comply, be sure to read the AAA Member Advisories or seek assistance through the members area or by calling the AAA.

Have an HR Question?  Ask Scott!