Health Law Scan

In honor of Rare Disease Day on February 28, 2025, we will publish a series of posts throughout the month on As Prescribed and Health Law Scan, focusing on issues impacting the rare disease community.

Section 1557 of the Affordable Care Act (ACA) prohibits discrimination on the basis of race, color, national origin, sex, age, or disability in certain healthcare activities. Among other requirements, all healthcare providers that receive, directly or indirectly, federal financial assistance, including but not limited to participation in Medicare or Medicaid must now provide a notice of availability of language assistance services free of charge. The US Department of Health and Human Services’ (HHS) new set of requirements was finalized in April 2024.

Through the issuance of Inauguration Day executive orders, the Trump Administration signaled its apparent intent to tackle drug pricing reforms over the next four years. However, Biden-era policies are likely to limit a comprehensive overhaul of existing reforms in the near term.

First passed into law in 2018, the California Consumer Privacy Act (CCPA) received its first major update in 2020 by way of the California Privacy Rights Act (CPRA), through which the California Privacy Protection Agency (CPPA) was established. Now, in 2024, the CPPA and California Attorney General (AGO) have swung into action with advisory and enforcement activity.

US Congress on December 20, 2024 passed a last-minute temporary government funding bill that keeps the government open for three months. As part of this package, a number of existing telehealth flexibilities were also extended to March 31, 2025. This includes the flexibility permitting the use of audio/video telehealth technologies to conduct hospice face-to-face visits, which many hospices and their physicians and nurse practitioners have come to rely upon since Medicare allowed that flexibility during the COVID public health emergency.

The enormous impact of Medicare Star Ratings on payments received by Medicare Advantage plans cannot be overstated. And with billions of dollars in bonus payments at stake, it may come as no surprise that stringent standards set out by the Centers for Medicare and Medicaid Services (CMS) have led to plans to push back against agency interpretations and seek judicial redress. We discuss the issues here.

Bipartisan efforts to lower prescription drug costs remains a core focus for the US Congress. Effective October 1, 2024, the Centers for Medicare and Medicaid Services (CMS) has announced the follow-on cohort for its coinsurance savings program under the Medicare Prescription Drug Inflation Rebate Program.

Through its passage, the Inflation Reduction Act (IRA) ushered in several reforms directed at rising prescription drug costs, aiming to lower costs for Medicare enrollees and reduce spending by the federal government. Included in these reforms is the establishment of the Medicare Prescription Payment Plan (M3P), a monthly installment plan that allows enrollees to pay back prescription drug costs overtime instead of all at once at the pharmacy. While M3P will reduce monthly out-of-pocket costs for enrollees, it requires plan sponsors to cover all up-front costs until payments are collected. Given the potential for non-payment, Medicare Part D plans would be well advised to prepare and account for potential financial losses.

At the end of last year, the US Department of Health and Human Services Office of Inspector General (OIG) issued an Advisory Opinion (AO 23-11, the Opinion) in which OIG approved an arrangement where a medical device manufacturer would provide up to $2,000 in subsidies to Medicare beneficiaries for cost sharing obligations as part of the beneficiary’s participation in a clinical trial.

Shortly after our prior blog post discussing the need for healthcare entities to shore up protections against phishing attacks, the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory (CSA) to alert members of the healthcare industry of indicators of compromise and tactics, techniques, and procedures used in phishing social engineering campaigns. This recent guidance underscores that phishing attacks have the attention of the FBI and HHS, and that health systems should proactively update their policies, procedures, and security to remain compliant with industry standards.