[ Wednesday, December 11, 2024 ]
The Blinding, Amazing Stupidity of Xavier Becerra's HHS.
OK, there are plenty examples of this, but the one I'm wrestling with right now is so frustratingly idiotic, and an example of all the problems that happen when a governmental department is run as a virtue-signaling platitude operation rather than a serious governmental agency serving its constituents, the public. It is all the more frustrating that it comes while so many people are questioning the competence or credentials of Trump's cabinet selections, while ignoring the utter incompetence of Xavier Becerra.
I speak, of course, of the Biden Administration's so-called "HIPAA Privacy Rule to Support Reproductive Health Care Privacy," which was published in final form on June 25, 2024. Let's be honest, this rule change is solely about one thing: the impotent, petulant cry of the pro-abortion lobby at the Supreme Court's decision in the Dobbs Case, which threw out the social experiment that was Roe v. Wade and returned the question of whether abortion should be legal or not to the legislatures of the various states or, if it chooses, Congress.
I don't care which way you come down on the abortion debate. There are intellectually (and societally) consistent rationales on both sides. But it is not a matter that 9 lawyers, not matter how smart, should decide for the other 330 million of us. It is a matter best dealt with by the democratic process. And I will fight you on that.
Back to the matter at hand. A little background:
Texas passed a law, the Texas Heartbeat Act, in 2021 (i.e., pre-Dobbs), which outlawed abortions once a fetal heartbeat is detectible. The statute has a peculiar provision: state officials are prohibited from enforcing it, but private citizens may do so. This prevented abortion-rights groups like Planned Parenthood from suing Texas state officials to have the law deemed unconstitutional under Roe (and Casey's "undue burden" test). (The Texas statute that was the subject of the Roe decision, which is effectively a total ban on abortions, was never repealed by the legislature, despite being declared unconstitutional by the Roe court; thus, it was still on the books to be "resuscitated" after Dobbs overturned Roe.)
The Heartbeat Act also prohibits anyone from "assisting" any post-heartbeat abortion; theoretically, this could mean that a private citizen could sue a company that offers to assist Texas woman who want to travel to another state to receive a post-heartbeat abortion, claiming that they are providing the assistance in Texas, where it is illegal. The Texas Attorney General in fact sent threatening letters to some large employers in the state in an effort to prevent them from offering abortion travel assistance as an employee benefit.
Rather than stay out of the fray, the Biden Administration jumped in with both left feet. This regulation would have single-handedly destroyed any basis for Chevron deference: if governmental agencies are capable of drafting something as stupid, incoherent, and unwieldy as the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, they should not only not get deference, those challenging the regulations should get the benefit of the doubt.
Basically, the new rule (i) prohibits uses and disclosures that could possibly be used to conduct any type of investigation into someone seeking, obtaining, or facilitating reproductive care (extremely broadly defined); (ii) requires covered entities to get an attestation prior to making any use or disclosure for health oversight, legal proceedings, law enforcement, or to coroners/medical examiners if the use or disclosure might touch on reproductive care (again, broadly defined), and (iii) requires specific reference in every Notice of Privacy Practices to specifically reference the prohibition in (i) and the attestation in (ii).
How bad is this? Let me count the ways:
- The rule addresses "reproductive health," rather than abortion. All of the provisions apply where someone (patient, provider, third party) is "seeking, obtaining, providing, or facilitating reproductive care." The definition of "reproductive care" is extremely broad: "health care . . . that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes." It applies to men, women, and children of all ages (erectile dysfunction fits; a hysterectomy on a post-menopausal woman fits, even though the woman can no longer reproduce, because it relates to the reproductive system; cholesterol screening fits, because you could die from atherosclerosis, and your death would "affect" your reproductive system, since it would die with you; and pediatric services could potentially "relate" to the reproductive system under a similar analysis). If the regulation drafters were honest, they could have made the rule applicable where PHI relating to abortion is sought. But they didn't.
- The attestation requirement applies to uses, as well as disclosures. Uses are when the PHI doesn't leave the covered entity; who provides the attestation in that case? If a physician wants to review a patient's chart (use PHI) to be prepared to defend himself in a deposition, and the PHI relates to reproductive care (which as defined could mean anything), he would have to issue an attestation to himself first.
- The section heading of the attestation requirement says attestations are not required for disclosures to covered entities and business associates, but text isn't limited that way. It's unclear whether it would be safe to assume that you don't need an attestation from a covered entity or business associate; thus, to be safe, a physician would have to get an attestation from his attorney (in addition to a BAA) before disclosing PHI to him if it relates to reproductive care. The disclosure is permitted, but the attestation is required.
- The rule adds language to the "Personal Representative" provisions (45 CFR 164.502(g)(5)) that are apparently intended to allow a provider to refuse to treat a parent or other personal representative as such if the provider thinks the parent wants to report his daughter for getting an abortion. However, as drafted, the language doesn't work in the least. First, the language is basically indecipherable, as written. 37 years of practicing health law and 25 years of doing HIPAA, and I can't for certain say what this section actually means. Secondly, 502(g)(5) as previously drafted gives providers the right to refuse to treat the parent as the personal representative if the provider thinks the patient has been abused and treating the parent as the personal representative would endanger the individual. Sounds good, right? Well, the new Rule detracts from the ability of the provider to make that determination. In fact, if the reason the provider thinks the parent is an abuser is because of what the provider has seen from providing reproductive care, the provider CANNOT refuse to treat the parent as the personal representative.
- Section 164.512(c) allows uses and disclosures without authorization to report abuse, neglect, or domestic violence. In other words, a provider can report child abuse even though the parent/guardian (as personal representative) refuses to authorize the reporting. However, the new rule changes the section by eliminating the ability of the provider to make the report without authorization if the reason for the report comes from the provision of reproductive care. For example, if a father brought his 4-year-old daughter to the clinic and she tested positive for Chlamydia, and that's all the evidence there is, the clinic cannot report it as sexual abuse without the authorization of the parent.
Given the awful drafting of this Rule and the confusion regarding its meaning and effect, I can safely say that well over 95% of all healthcare providers will be arguably in violation this Rule as soon as it becomes effective
It does not require mentioning that the decision-makers at HHS will be gone 40 days from now. The likelihood that this bill will survive in the new administration is extremely low. And the Texas Attorney General filed suit in September, seeking to have enforcement of the rule enjoined, although the court has not acted yet.
But the stated effective date for all but the Notice of Privacy Practices provisions is December 23, 2024 (less than a month prior to Trump's upcoming inauguration). Given the lost election, do you think HHS would back off and delay enforcement until the new administration decides to keep it or junk it?
Hell no. HHS wants all entities subject to HIPAA to have to jump through all of these hoops unnecessarily. They want covered entities and business associates to require unnecessary attestations, draft unnecessary policies and procedures, and revise their Notices of Privacy Practices for no good reason.
Finally, I would note that, while noises have been made by the Texas Attorney General and others, I am unaware of anyone actually attempting to enforce the statute that triggered this Rule. Certainly, I am unaware of anyone anywhere trying to enforce the Heartbeat Act in a manner that this Rule would prevent. Thus, the cherry on top here, the chef's kiss, is this: this is a solution in search of a problem, a fix for a non-existent calamity. All of this is entirely unnecessary.
Is it any wonder everyone hates the government?
Jeff [4:37 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
