Compliance Monthly Update: July 2024
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Supreme Court permits (at least temporarily) emergency abortions in Idaho.
On June 27, the U.S. Supreme Court considered whether the federal Emergency Medical Treatment and Active Labor Act (EMTALA) preempts a more restrictive Idaho state law. Idaho has an almost total ban on abortion, with exceptions (a) to prevent the death of the pregnant woman and (b) in the first trimester for rape and incest. However, the federal EMTALA law prohibits hospitals with emergency departments from refusing to provide stabilizing treatment to individuals with an emergency medical condition. The question is whether EMTALA preempts the state’s more restrictive ban, thereby allowing abortion in an emergency medical situation where a physician determines it is necessary to stabilize a patient’s condition (not just to save the pregnant woman’s life). The Supreme Court found that the appeal was not ready for review, vacated the district court’s preliminary injunction, and reinstated a previous lower court order blocking enforcement of the Idaho ban in medical emergencies. The impact of the ruling is that physicians in Idaho are permitted to provide abortions to stabilize patients with emergency conditions (including those threatening the health of the pregnant woman) on a temporary basis while the litigation continues. And while this case only involves Idaho law, a decision by the Supreme Court on the merits would resolve the debate of whether EMTALA preempts the most restrictive state law bans on abortion. Currently, Texas, Arkansas, Oklahoma, and South Dakota ban abortion except when a person’s life is at risk, which is narrower than EMTALA’s requirement to treat emergency medical conditions.
Temporary injunctions on ACA Section 1557 regulations.
A Mississippi court issued a nationwide injunction on portions of recently released regulations under ACA Section 1557. As a reminder, Section 1557 prohibits discrimination in certain health programs and activities on the basis of race, color, national origin, sex, age, or disability. Separately, a Texas court stayed all provisions of the Section 1557 regulations in Texas and Montana.
- As background, HHS published final regulations earlier this year that provided that “discrimination on the basis of sex” specifically includes discrimination based on sexual orientation, gender identity, sex characteristics, pregnancy, and sex stereotypes.
- Several states sued to block HHS from enforcing the regulations and to stay the effective date, arguing that the regulations’ redefinition of sex discrimination was, among other things, unlawful under the Administrative Procedure Act (APA). The Mississippi and Texas court rulings each invoked the recent Supreme Court Loper Bright decision (that overruled Chevron deference and was discussed in last month’s compliance update) to find that HHS had exceeded its statutory authority.
- Under the Mississippi ruling, HHS is now enjoined nationwide from implementing or enforcing the 1557 provisions as to gender identity.
- The Texas ruling stayed the effective date of all portions of the regulations—not just portions relating to the interpretation of sex discrimination to include discrimination on the basis of gender identity—for Section 1557 covered entities in Texas and Montana.
- Remember that employers (which are generally not covered by Section 1557 directly) may still be sued under Title VII—which prohibits discrimination in the workplace on the basis of race, religion, national origin and sex. In Bostock, the Supreme Court ruled that “sex” is a distinct characteristic but inseparable from the concepts of sexual orientation and gender identity, and therefore workplace discrimination on that basis is illegal.
HHS updates HIPAA privacy rule resources.
HHS has updated their HIPAA and Reproductive Health webpage with tools and resources to help covered entities and business associates comply with the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Final Rule”) that was issued in April earlier this year. Under the Final Rule, when a regulated entity receives a request for PHI relating to health oversight activities, judicial or administrative proceedings, law enforcement purposes, or disclosures to coroners or medical examiners, and the PHI is potentially related to reproductive health care—the regulated entity must obtain a signed attestation. With their updates to the HIPAA and Reproductive Health webpage, HHS has now provided a model attestation that can be used when a regulated entity receives a request for PHI potentially related to reproductive health care. Note also that the Final Rule will require the notice of privacy practices to be updated, but this has a later compliance date of February 16, 2026, and HHS has not yet updated their model notices of privacy practices to reflect the changes that will be required under the Final Rule. We will be monitoring this and notify you when the model notices are updated.
State/Local Compliance Update: July 2024
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
California
New California workplace violence prevention mandate takes effect. On July 1, California SB 553 went into effect that requires California employers to implement a workplace violence prevention plan (WVPP), provide training to employees regarding the WVPP, and keep records of workplace violence incidents. As of January 1, 2025, the law also expands employers’ and employee representatives’ rights to obtain restraining orders on behalf of employees impacted by threats of workplace violence.
Illinois
New Illinois law bans step therapy and prior authorization for emergency mental health care. Illinois HB 5395 was signed into law by Governor Pritzker on July 10 and will take effect on January 1, 2025. The new law prohibits fully insured plans issued in Illinois from (a) requiring step therapy (a practice in which physicians are required to treat covered patients with less expensive treatments before moving to more expensive ones) for certain emergency mental health treatments or (b) requiring prior authorization for those emergency mental health treatments. The law does not cover self-insured ERISA plans.
Maryland
Maryland amends pay transparency law to require wage range disclosure in job postings. As background, Maryland implemented a pay transparency law in 2020 that requires employers, when requested by an applicant, to provide the wage range for the position to which the applicant applied. With HB 649, Maryland has now broadened that law (effective October 1, 2024) to require employers to proactively disclose in their public and internal job postings the wage range for the position. Note that this law only requires that the wage range be disclosed for a position where the work will be physically performed in Maryland “at least in part.”
Michigan
Michigan Supreme Court reinstates 2018 version of state’s paid sick leave. On July 31, the Michigan Supreme Court ruled that Michigan’s current paid sick leave law (the Paid Medical Leave Act) is unconstitutional and reinstated Michigan’s original Earned Sick Time Act of 2018. This revision, that takes effect February 21, 2025, will (among other things) expand the paid sick leave available to eligible employees, provide a faster accrual rate, and require smaller employers that were previously exempt to have to comply. The decision also held that Michigan’s Amended Wage Act was similarly unconstitutional—which will result in an increase to Michigan’s minimum wage rate to $12/hour. Employer should monitor the Michigan Department of Labor and Economic Opportunity website for updated regulations and guidance.
Pennsylvania
Pennsylvania expands use and reimbursement of telemedicine. SB 739 was signed into law by Governor Shapiro on July 3 to expand the use of and ensure reimbursement for telemedicine services provided by health care providers in Pennsylvania. The law specifically requires health insurance policies to provide coverage for medically necessary health care services provided through telemedicine and delivered by a participating network provider who provides a covered health care service through telemedicine consistent with the insurer’s medical policies. And the law mandates that a health insurance policy may not exclude a health care service from coverage solely because the health care service is provided through telemedicine.
Pennsylvania enacts PBM legislation. On July 17, Governor Shapiro signed HB 1993 into law to increase transparency, provide patient protections, and increase regulatory oversight of PBMs. This law will apply to health plans not exempted by ERISA (e.g., fully-insured plans). Highlights of the legislation include:
- Prohibiting certain “steering” practices, such as requiring a policyholder to purchase drugs exclusively through a mail order pharmacy or at a pharmacy owned or controlled by the PBM.
- Prohibiting a pharmacy from charging a price that is more than the consumer would pay if they walked in off the street and paid in cash or that is more than the pharmacy would receive from the insurer or PBM.
Providing network adequacy requirements that will require a PBM to establish a network that meets or exceeds federal Medicare access standards.
Minnesota enacts data privacy law. Minnesota has become the latest state to enact a comprehensive consumer data privacy law. The Minnesota law adopts a similar framework as most other state privacy laws. The law applies to legal entities that conduct business in Minnesota or produce products or services targeted to Minnesota residents and: (a) during a calendar year, control or process personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) derive over 25% of gross revenue from the sale of personal data and process or control personal data of at least 25,000 consumers. Note, however, that the law exempts covered entities and business associates subject to HIPAA and exempts data that is considered PHI under HIPAA.
Rhode Island
Rhode Island enacts comprehensive data privacy law. The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) was passed into law on June 28 and makes Rhode Island the 20th state to enact comprehensive data privacy legislation. Note that the law contains entity-level exemptions—including for covered entities or business associates regulated by HIPAA. And the law contains data-level exemptions—including for protected health information (PHI) subject to HIPAA.
Rhode Island increases length of Temporary Caregiver Insurance benefits. Governor McKee signed into law amendments to the Temporary Caregiver Insurance (TCI) law that will increase the amount of paid leave benefits available to employees beginning January 1, 2025. Currently, eligible employees can take six weeks of leave under TCI to care for a newborn, newly adopted child, or to care for a family member with a serious health condition. As of January 1, 2025, employees will be entitled to seven weeks of leave. Then as of January 1, 2026, employees will be entitled to eight weeks.
