Midweek Update

Let's start with a piece of good news. The FEHBlog nearly fell off his chair yesterday when he read that Congress as part of the doc fix law enacted last month repealed a flawed part of the Affordable Care Act. SHRM explains that "Section 213 of the law now eliminates deductible limits imposed under the ACA (found in Section 1302) for the small-group market employer health plans. The new law, which took effect immediately, will allow more flexibility for plan designs."

The Internal Revenue Service announced the health savings account contribution limits and high deductible health plan floor amounts for deductibles and ceilings for in-network out of pocket maximums.The IRS informally has said that high deductible plans must use the lower of the IRS out of pocket maximum and the HHS out of pocket maximum under the ACA for 2015 and future years. The IRS response to a question actually posed by the FEHBlog may be found on page 2 of the linked American Bar Association document.

Bloomberg reports that Gilead beats its first quarter sales projection for its recently approved "Hep C" drug Sovaldi by $1 billion.  Total quarterly sales hit $2.27 billion which is not that surprising considering there are 3 million Americans with this disease and Gilead charges $1,000 per pill for Sovaldi which adds up to $84,000 per course of treatment according to this SFGate report. Hepatitis C is considered a silent epidemic because the disease can be asymptomatic for several years. The U.S. Preventive Services Task Force last year identified as a Class B recommendation "screening for hepatitis C virus (HCV) infection in persons at high risk for infection and "offering one-time screening for HCV infection to adults born between 1945 and 1965." This means that Hepatitis C testing will become cost sharing free (in-network) for this large cadre of FEHBP members next year. Sovaldi could be an actuarial time bomb for FEHB plans. Bloomberg adds that

Express Scripts Holding Co. (ESRX), the largest benefit manager, has said it may try to start a price war once competing medicines from AbbVie Inc. and Merck & Co. reach the market. CVS Caremark Corp., the second-biggest pharmacy manager, has said it might try to slow down the use of the drug.

Competition sounds like the preferable route.

The HHS Office for Civil Rights announced yesterday (hat tip to my colleague Theresa Defino)

OCR opened a compliance review of Concentra Health Services (Concentra) upon receiving a breach report that an unencrypted laptop was stolen from one of its facilities, the Springfield Missouri Physical Therapy Center.  OCR’s investigation revealed that Concentra had previously recognized in multiple risk analyses that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing electronic protected health information (ePHI) was a critical risk.  While steps were taken to begin encryption, Concentra’s efforts were incomplete and inconsistent over time leaving patient PHI vulnerable throughout the organization. OCR’s investigation further found Concentra had insufficient security management processes in place to safeguard patient information. Concentra has agreed to pay OCR $1,725,220 to settle potential violations and will adopt a corrective action plan to evidence their remediation of these findings.  

OCR received a breach notice in February 2012 from QCA Health Plan, Inc. of Arkansas reporting that an unencrypted laptop computer containing the ePHI of 148 individuals was stolen from a workforce member’s car.  While QCA encrypted their devices following discovery of the breach, OCR’s investigation revealed that QCA failed to comply with multiple requirements of the HIPAA Privacy and Security Rules, beginning from the compliance date of the Security Rule in April 2005 and ending in June 2012.  QCA agreed to a $250,000 monetary settlement and is required to provide HHS with an updated risk analysis and corresponding risk management plan that includes specific security measures to reduce the risks to and vulnerabilities of its ePHI.  QCA is also required to retrain its workforce and document its ongoing compliance efforts.

Encrypt your laptops and mobile devices without delay!

Speaking of HHS's Office for Civil Rights, the ACA includes a health care and health insurance non-discrimination provision (Section 1557) that falls under its purview. HHS is planning on proposing an implementing rule this summer. Last year HHS ask the public to submit comments to assist the agency with this rule-making. HHS received 169 comments. Here are links to the AHIP and BCBSA comments which suggest to this reader that the Section 1557 rulemaking may impact the FEHBP.