The Economic Stimulus Bill:
What's in it for the Health Care, Technology, and Life Science Industries?

By Jeff Drummond, Joanna Napp, and Virginia Alverson

The American Recovery and Reinvestment Act of 2009 (the ARRA), also commonly referred to as the Economic Stimulus Bill, provides billions of dollars in federal funding for the health care, technology, and life sciences industries. The portion of the ARRA that addresses the health care, technology, and life science industries is several hundred pages long and is full of complex policies and information that has yet to be interpreted. This e-Brief is intended to highlight the provisions of the ARRA that will likely have a significant effect on these particular industries.

We have divided our discussion into three parts, each addressing different portions of the ARRA. These parts are:

(1) Health Information Technology: Standards, Subsidies, and Penalties

(2) HIPAA Revisions and Data Breach Rules

(3) Increased Government Funding for Health Care Services

Nevertheless, due to the length and intricate nature of the ARRA, it is impossible for a brief such as this to cover all aspects of the ARRA that will affect these industries. As a result, we have attached a link to the ARRA and encourage you to look up specific information you may be interested in. We would also recommend contacting your outside advisors with more specific questions about the ARRA and for specific interpretations of certain provisions in the ARRA. CLICK HERE to view the ARRA.

Health Information Technology:
Standards, Subsidies, and Penalties

The ARRA includes among its provisions the creation of the National Coordinator of Health Information Technology and incentives for the adoption and use of electronic health records (EHR) technology by Medicare and Medicaid professionals and hospitals. Below is a discussion of some of the most significant portions of the ARRA affecting health information technology.

National Coordinator of Health Information Technology

The ARRA calls for the creation of a National Coordinator for Health Information Technology (National Coordinator). The duties of the National Coordinator include:

• Review and determine whether to endorse each standard, implementation specification, and certification created for the electronic exchange and use of health information that is recommended by the HIT Standards Committee (as described below).
• Coordinate health information technology policy and programs of the Department of Health and Human Services with those of other relevant executive branch agencies with a goal of avoiding duplication of efforts and of helping to ensure that each agency undertakes health information technology activities primarily within the areas of its greatest expertise and technical capability and in a manner towards a coordinated national goal.
• Serve as the leading member in the establishment and operations of the HIT Policy Committee (as described below) and the HIT Standards Committee and serve as a liaison among these two committees and the Federal Government.

HIT Policy Committee and HIT Standards Committee

The ARRA also calls for the creation of an HIT Policy Committee and an HIT Standards Committee.

• The HIT Policy Committee has been created to make policy recommendations to the National Coordinator relating to the implementation of a nationwide health information technology infrastructure, including implementation of the strategic plan outlined in the ARRA.
• The HIT Standards Committee has been created to recommend to the National Coordinator standards, implementation specifications, and certification criteria for the electronic exchange and use of health information for purposes of adoption under the ARRA, consistent with the implementation of the strategic plan described in the ARRA and in accordance with the policies developed by the HIT Policy Committee.

Medicare Payment Incentive for Hospitals

The ARRA provides both incentives and disincentives to encourage eligible hospitals to adopt EHR technology. Specifically, eligible hospitals will receive incentive payments for being "meaningful" EHR users starting in 2011 and can continue to qualify for payments through 2015. However, the ARRA also provides for the reduction in Medicare and Medicaid payments in the event the eligible hospital does not implement and use EHR by 2015.

• A hospital is eligible for incentive payments if it is either a subsection (d) hospital (as defined in Section 1886 of the Social Security Act) or a Critical Access Hospital (CAH).
• "Meaningful Use" shall be determined by the Secretary of the Department of Health and Human Services (the Secretary) using factors that include (1) EHR technology is connected in a manner the provides for the electronic exchange of health information to improve the quality of health care, such as promoting care coordination and (2) the eligible hospital's submission of information on clinical quality measures and such other measures selected by the Secretary.
• The amount that an eligible hospital can qualify for is determined pursuant to a formula. The formula is as follows:

Incentive Payment = (Base Amount of $2,000,000 + the Discharge Amount) x (the Medicare Share) x (the Transition Factor)

• The "Discharge Amount" is equal to $200 for each discharge starting with the hospital's 1,150th discharge and continuing through is 23,000th discharge. The hospital receives no payments for discharges greater than 23,000.
• The "Medicare Share" is made up of a numerator and a denominator. The numerator is the number of inpatient bed days attributable to Part A and Part C of Medicare. The denominator is the total number of inpatient bed days multiplied by total hospital charges (excluding charity care), divided by the total amount of charges during the period.
• The "Transition Factor" is equal to the following amounts: eligible hospital's first payment period: 1; eligible hospital's second payment period: ¾; eligible hospital's third payment period: ½; eligible hospital's fourth payment period: ¼; and for any succeeding payment year: 0.

• An eligible hospital can qualify for different amounts based on when it becomes a meaningful user of certified EHR technology. The earlier a hospital becomes a meaningful user, the more money it can receive.
• Eligible hospitals that are not "meaningful" users by 2015 shall not receive incentive payments.
• Eligible hospitals that are not "meaningful" users by 2015 will have three-quarters of their market basket update reduced by 33.33% in FY 2015; 66.66% in FY 2016; and 100% for FY 2017 and beyond.
• There are additional rules which address incentive payments and penalties in connection with CAHs.

Medicare Payment for Eligible Professionals (Physicians)

Just as with the eligible hospitals, there are incentives for eligible professionals to become "meaningful" users of certified EHR technology as well as disincentives for those eligible professionals who do not become "meaningful" users of certified EHR technology by 2015.

• An "eligible professional" means (1) a doctor of medicine or osteopathy; (2) a doctor of dental surgery or dental medicine; (3) a doctor of podiatric medicine; (4) a doctor of optometry; and (5) a chiropractor.
• Under the ARRA, an eligible professional is considered a meaningful EHR user for a reporting period for a payment year if each of the following requirements is met:

• The eligible professional demonstrates to the satisfaction of the Secretary that during such period the professional is using certified EHR technology in a meaningful manner, which shall include the use of electronic prescribing.
• The eligible professional demonstrates to the satisfaction of the Secretary that during such period, such certified EHR technology is connected in a manner that provides for the electronic exchange of health care information to improve the quality of health care, such as promoting care coordination.
• The eligible professional submits information for such period in a form and manner specified by the Secretary, on such clinical quality measures and such other measures as selected by the Secretary.

• In addition to the amount otherwise paid under the Social Security Act, an eligible professional who is a "meaningful" EHR user will also receive an incentive payment equal to 75% of the Secretary's estimate of the allowed charges for all such covered professional services furnished by the eligible professional during such year, but is limited to the following maximums over a five year period.

• Year 1: $15,000 (or, if the first payment year for such eligible professional is 2011 or 2012, $18,000)
• Year 2: $12,000
• Year 3: $8,000
• Year 4: $4,000
• Year 5: $2,000; all subsequent years: $0

Moreover, the incentive payment may be made in the form of a single consolidated payment or in the form of periodic installments as the Secretary may specify.

• Thus, the payment amounts available to eligible professionals varies depending on the year that they become a "meaningful" user. For example, if the eligible professional becomes a meaningful user in 2011, the maximum amount available over five years is $44,000. The maximum amount available to an eligible professional decreases in each subsequent year. Eligible professionals that first become "meaningful" users after 2014 will not qualify for any incentive payments.
• No incentive payments will be made to any eligible professionals after 2016. Thus, whether you become a "meaningful" user in 2012 or in 2014, you can only qualify for incentive payments through 2016.
• Eligible professionals who furnish services predominately in a federally designated health professional shortage area will receive 10% more in incentive payments than other eligible professionals.
• The ARRA also states that no incentive payment shall be made to hospital-based eligible professionals. For purposes of the ARRA, a hospital-based eligible professional means an eligible professional such as a pathologist, anesthesiologist, or emergency physician who furnishes substantially all of such services in a hospital setting (whether inpatient or outpatient) and through the use of the facilities and equipment, including computer equipment, of the hospital.
• Clearly, there is a large monetary benefit for eligible professionals who adopt certified EHR technology in 2011 and 2012. Therefore, all eligible professionals who intend to adopt certified EHR technology should adopt such technology as soon as possible to enjoy the full benefits of the incentive payments.
• The Secretary shall post on the Centers for Medicare and Medicaid Services website, in an easily understandable format, a list of the names, business addresses, and business phone numbers of the eligible professionals who are meaningful EHR users.
• Eligible professionals who do not become meaningful users of certified EHR technology by 2015 shall be penalized for not adopting such technology. The penalty will come in the form of a reduced reimbursement rate as shown on the chart below.

• If in the year 2018 and each subsequent year, if the Secretary finds that the proportion of eligible professionals who are meaningful EHR users is less than 75%, the applicable percent shall be decreased by one percentage point from the applicable percent in the proceeding year, but in no case shall the applicable percent be less than 95%.

Medicaid Incentive Payments

The ARRA also provides for certain eligible Medicaid Providers to receive up to 85% of the net allowable cost for certified EHR technology.

• A "Medicaid provider" means (1) an eligible professional who is not a hospital-based physician and has at least 30% of such professional's patient volume attributable to Medicaid patients; (2) a non-hospital based pediatrician who has 20% of patient volume attributable to Medicaid patients; (3) a children's hospital; (4) an acute care hospital that has at least 10% of the hospital's patient volume attributable to Medicaid patients; or (5) a Federally-qualified health center or rural health clinic that has at least 30% of the center's or clinic's patient volume attributable to Medicaid patients.
• To avoid duplicate payments, a Medicaid provider can only qualify for Medicaid incentives if they waive their rights to Medicare incentives. Thus, providers should carefully calculate whether the benefits under the Medicare program or Medicaid program will be greater.

HIPAA Revisions and Data Breach Rules

In an apparent attempt to create work for HIPAA lawyers, Congress included in the ARRA provisions to revise and increase the scope of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the primary federal statute governing the privacy of an individual's health information. The primary impact is to increase the number of parties subject to HIPAA; specify when and how HIPAA-covered entities deal with data breaches; and increase the types of activities that can result in a civil or criminal penalty, the people who can be charged with a violation, and the governmental entities that can prosecute a violation of HIPAA.

• Business Associates Now Covered, Too
  Under the original structure of HIPAA, only health care providers, health plans, and health care clearinghouses were "covered entities." The vendors and other parties with which they dealt, and which received "protected health information" or PHI from them, were not directly covered by HIPAA, and therefore, could not be directly prosecuted for a HIPAA breach. Rather, HIPAA required covered entities to enter into business associate agreements (BAAs) with these "business associates" to restrict the business associate's use of the information and effectively apply HIPAA to the business associate via contract. The ARRA explicitly (although somewhat inartfully) directly applies the same HIPAA requirements that are applicable to covered entities to their "business associates." If a business associate breaches a BAA, it will not simply be at risk of a breach of contract action, rather it will be directly subject to prosecution under HIPAA.
• Data Breach Notification Requirements
  Covered entities and business associates who suffer a "breach" of unsecured PHI must notify all affected individuals. There are several complicating factors here: the definition of "breach" is relatively specific and excludes some unintentional or inadvertent disclosures; if the PHI was "secured" (again, a specific definition applies, but basically encrypted or otherwise made indecipherable) then no notice is required; the information to be contained in the breach notification is somewhat specific; and it may be difficult to determine exactly when a breach was "discovered," thereby starting the clock on notification timelines. Furthermore, if a company suffers a data breach involving the unsecured PHI of 500 or more people, the company will have to notify not only the affected individuals, but the Department of Health and Human Services and "prominent media outlets" serving the area.
• Special Rules for EHR Users
  Covered entities that use electronic health records are subjected to specific HIPAA requirements under the ARRA. Under HIPAA, covered entities are required to provide an accounting of disclosures to individuals who ask, but need not account for disclosures made for treatment, payment, or health care related reasons. Under the ARRA, if the covered entity has an EHR, it must also account for those disclosures, but only for a period half as long as required of other covered entities (i.e., three years). An EHR (or PHI in an EHR) cannot be sold or exchanged for remuneration except in specific situations (as part of a research project, the sale of a practice, etc.). Additionally, a covered entity that uses an EHR must also provide an electronic copy of an individual's information in the EHR to the individual or any other person the individual designates and may not charge anything for the service other than the covered entity's actual labor cost in obtaining the information.
• Improved Enforcement
  There was some confusion whether an employee of a covered entity could be subject to HIPAA criminal penalties. Normally, an employee does not personally meet the definition of a covered entity, and the Department of Justice had released an internal memorandum noting that employees would generally not be subject to prosecution for HIPAA violations. However, most if not all of the federal criminal cases that resulted in convictions for HIPAA violations involved employees who arguably did not meet the definition of a "covered entity." This possible loophole has now been closed and employees who wrongfully use or disclose PHI may be prosecuted for a HIPAA violation. Additionally, "willful neglect" is now a potential HIPAA violation. Individuals who were harmed by a wrongful disclosure may now be able to receive a part of any civil monetary penalty recovered for a HIPAA violation, with an increase in possible financial penalties for HIPAA violations. More importantly, the ARRA now specifically authorizes attorneys general from all of the states to independently pursue HIPAA violations that occur in their states.
• Other Specific Disclosure Rules
  There are several additional rules included in the HIPAA provisions of the ARRA intended to address specific situations. A patient may now require his doctor not to disclose information to his insurance plan if the patient pays in cash. The existing "minimum necessary" rule continues to apply to non-treatment disclosures of PHI, but the "limited data set" requirements (removing most indentifying information from the PHI) are now treated as the baseline for determining what is the minimum necessary information. The definition of marketing has been significantly tightened by removing many communications from the definition of "health care operations." Individuals must be given a clear and easy way to "opt out" from receiving fundraising information. Companies that sell electronic "personal health records" (electronic record sets that are primarily controlled by the individual, such as the Microsoft/Google product "HealthVault" or AHIMA's "myPHR") are subject to specific breach notification rules. Health information exchanges are specifically defined as business associates.

These provisions have varying start times, and most are subject to further rulemaking by the Secretary of Health and Human Services. Many of these provisions raise as many questions as they answer, so the regulations that are ultimately drafted and adopted will be very important. Until then, entities that deal with medical records or other health information should be prepared to make some changes to their operations and documentation. Specifically, most covered entities will need to make some changes to their BAAs to address the changes noted above. Depending on the specific provisions of the final regulations, some covered providers will want to change their standards and processes for obtaining patient authorizations, particularly to avoid the issues raised by the new definition of marketing, and especially if the covered entity uses an electronic medical record. Providers should also consider whether these changes will require them to revise the "Notice of Privacy Practices" they give their patients on their first visit.

More importantly, given the breach notification requirements and their applicability to unsecured PHI, covered entities should review their current IT policies to ensure that they are currently taking (or are ready to adopt once regulations are drafted) the appropriate steps to make the PHI they hold and exchange "unusable, unreadable, or indecipherable to unauthorized users." Those covered entities that have not adopted strict security provisions, such as encryption, should start taking those steps now and be prepared to take further action as soon as regulations are issued.

Increased Government Funding of Health Care Services

The ARRA provides billions of dollars in federal funding for the health care, technology, and life sciences sectors and many of these dollars are allocated to increase federal funding of certain Medicare and Medicaid programs and to extend certain moratoria on passing additional cost-saving measures. However, many billions of dollars are also allocated toward other key areas in health care and the life sciences, including funding (1) to improve community health centers, (2) to address the health professional workforce shortages, (3) to create a prevention and wellness fund, and (4) for certain research and technology. Key components of the stimulus bill relevant to health care and life sciences industries include:

• $220 million to the National Institute of Standards and Technology for scientific and technical research and services and an additional $360 million for the construction of research facilities.
• $2.5 billion to the National Science Foundation for research and related activities. $300 million of that is to be available solely for the Major Research Instrumentation program, and $200 million of that is to be available for academic research facilities modernization.
• $2.5 billion for Health Resources and Services, which is allocated to provide: (1) $500 million for grants to community health centers authorized under section 330 of the Public Health Service Act (PHS Act), (2) $1.5 billion for grants for construction, renovation, and equipment and for the acquisition of health information technology systems for these centers and certain health center controlled networks, and (3) $500 million to address the health professions workforce shortages (such funds may be used to provide certain scholarships, loan repayments, and grants to training programs for equipment authorized under the PHS Act and under grants under the PHS Act).
• $1.3 billion to the National Institutes of Health – National Center for Research Resources, of which $1 billion is for grants and contracts under the PHS Act to construct, renovate or repair existing non-Federal research facilities.
• $400 million for the Defense Health Program to improve, repair, or modernize military medical facilities.
• $1.1 billion in funding for Healthcare Research and Quality to carry out various titles of the PHS Act, the Social Security Act, and the Medicare Prescription Drug Improvement and Modernization Act of 2003. $700 million of this is allocated for Comparative Effectiveness Research, of which $400 million is to be transferred to NIH to conduct comparative effectiveness research under the PHS Act, and the other $300 million to the Agency for Healthcare Research and Quality. The remaining $400 million is allocated directly to the Secretary of Health and Human Services (HHS) to accelerate the development and dissemination of research assessing comparative effectiveness of health care treatments and strategies through efforts that: (1) conduct, support, or synthesize appropriateness of items, services, and procedures that are used to prevent, diagnose, or treat diseases, disorders, and other health conditions; and (2) encourage the development and use of clinical registries, clinical data networks, and other forms of electronic health data that can be used to generate or obtain outcomes data. HHS can make grants and contracts with appropriate entities, which include agencies within DHHS, other governmental agencies, and private sector entities. Research with funds appropriate under this section must be consistent with departmental policies relating to the inclusion of women and minorities in research.
• $ 1 billion to establish a Prevention and Wellness Fund to be administered by HHS. $650 million of that is allocated to carry out evidence-based clinical and community-based prevention and wellness strategies authorized under the PHS Act, $50 million is allocated to provide states with funds to carry out activities to implement health care associated infections reduction strategies, and $300 million is allocated to the CDC to carry out its immunization program under the PHS Act.
• In addition to these expenditures, the ARRA also contains the following programs:

• Temporary Increase of Medicaid FMAP (Federal Medical Assistance Percentage)
  The purpose of this is protect and maintain state Medicaid programs during the period of economic downturn and includes help to avert cuts to provider rates and benefits or services. This provides, subject to certain restrictions and exclusions, a general 6.2 percentage point increase for states as well as an additional increase for states with significant increases in unemployment. The increases in FMAP for a state do not apply with respect to disproportionate share hospital payments, CHIP payments, and certain other payments.
• Temporary Increase in Disproportionate Share Hospital (DSH) Allotments During the Recession
  DSH allotments increased by 2.5% for fiscal year 2009 and another 2.5% in 2010 above the fiscal year 2009 allotment. After 2010, the allotment is equal to the DSH allotment as determined currently.
• Extension of Moratoria on Certain Medicaid Final Regulations
  This covers certain regulations relating to optional case management services and allowable provider taxes, final regulations regarding school-based administration and transportation, and final regulations relating to outpatient hospital facility services. The bill also notes that it is the sense of Congress that HHS should not promulgate as final regulations any of the proposed Medicaid regulations regarding (1) cost limits for certain providers, (2) payments for graduate medical education, and (3) rehabilitative services.
• Moratoria on Certain Medicare Regulations
  This includes a delay in the phase-out of the Medicare hospice budget neutrality adjustment factor during fiscal 2009 and non-application of the phased-out indirect medical education (IME) adjustment factor for fiscal year 2009.
• Long-Term Care Hospital (LTCH) Technical Corrections
  The bill amends the Medicare, Medicaid, and SCHIP Extension Act of 2007 to cover certain LTCHs that were previously excluded from delayed application of the 25% patient threshold payment adjustment.
• Implementation and Expansion of Broadband Technology
  There are actually two separate sections devoted to the implementation and expansion of broadband technology.

  (1) $2.5 billion is provided for the cost of broadband loans and loan guarantees authorized under the Rural Electrification Act and for grants (including, for technical assistance).

  (2) The bill separately provides for the establishment of the Broadband Technology Opportunities Program. The purposes of this Program are (a) to provide broadband service to consumers residing in unserved areas of the U.S.; (b) to provide improved access to broadband service to consumers in underserved areas of the U.S.; and (c) to provide broadband education, awareness, training, access, equipment, and support to schools, libraries, medical and health care providers, and various other organizations. Competitive grants may be made under this program to acquire equipment, hardware, software, and other technology components and to construct and deploy necessary infrastructures.

• Office of Inspector General
  Throughout the stimulus bill are various allocations to the Office of Inspector General (OIG). There is also a stand-alone section for significant funding to the OIG for its oversight of the expenditure of certain federal funds. Such funding suggests the OIG will be well-equipped for increasing its investigative and enforcement efforts.

For additional information concerning the information discussed in the above e-Brief, please contact:

Jeff Drummond at jdrummond@jw.com

Joanna Napp at jnapp@jw.com

Virginia Alverson at valverson@jw.com

If you wish to be added to the e-Brief mailing list, please CLICK HERE to sign up. If you wish to be removed, please reply to this e-mail with REMOVE in the subject line and include your first and last name.