Designing a Coherent Policy Consistent with Resident Privacy Rights and New Federal and State Requirements
As the COVID-19 crisis has unfolded, Skilled Nursing Facilities (SNFs) and Assisted Living Facilities (ALFs) have faced new transparency requirements imposed by both federal and state authorities that mandate certain specified disclosures of the COVID-19 status of residents and staff to other residents and their family members. Most recently, such “transparency” requirements have arrived in the form of new regulations mandating specific COVID-19 transparency disclosures as a condition of Medicare certification. The new requirements, codified at (new) 42 CFR § 483.80 (g)(3), issued by the Centers for Medicare and Medicaid Services (CMS) as an interim final rule on April 30, require that a Medicare-certified SNF must:
(3) Inform residents, their representatives, and families of those residing in facilities by 5 p.m. the next calendar day following the occurrence of either a single confirmed infection of COVID-19, or three or more residents or staff with new-onset of respiratory symptoms occurring within 72 hours of each other. This information must—
(i) Not include personally identifiable information;
(ii) Include information on mitigating actions implemented to prevent or reduce the risk of transmission, including if normal operations of the facility will be altered; and
(iii) Include any cumulative updates for residents, their representatives, and families at least weekly or by 5 p.m. the next calendar day following the subsequent occurrence of either: each time a confirmed infection of COVID-19 is identified, or whenever three or more residents or staff with new onset of respiratory symptoms occur within 72 hours of each other.
This new transparency requirement adds to other required disclosures to CMS and the CDC and is notable in several ways.
- While the new regulation precludes a SNF from revealing “personally identifiable information”, the information that is required to be disclosed is in fact “protected health information (PHI)” within the meaning of HIPAA (with which all SNFs are required to comply), since information required to be disclosed includes both dates and geographic information. While HIPAA provides an exception for disclosures of PHI when “required by law”, the regulatory language has the potential to create confusion.
- By requiring not only disclosure of confirmed infections but also “new onset of respiratory symptoms” the new regulation goes beyond the reporting processes that have been instituted by many SNFs as the result of resident and resident families’ need for information.
- The new regulation also imposes a tight timeframe on reporting of both “confirmed infections” and “new onset of respiratory symptoms,” by requiring that this information be shared by 5:00 pm the next business day. The timetable is especially challenging insofar as it may be unclear exactly when a resident has begun to experience “new onset” of respiratory symptoms.
- The requirement for “cumulative” updates is subject to interpretation. For example, are “cumulative” updates required to include resident or staff who have recovered from infection? Those residents who develop infections after they are discharged? Those staff who have voluntarily absented themselves from the facility from the inception of the crisis? Such ambiguities have the potential to hinder objective comparisons among SNFs with respect to the extent of COVID-19 at the facility.
- Compliance with the new regulation is necessary—but may not be sufficient—for many SNFs, since a number of state health departments have issued their own transparency requirements, which may differ significantly from those imposed by CMS. States may also publish the data that they obtain, which may be (or appear to be) inconsistent with the data that SNFs are required to disclose under the new regulation.
- In addition to the transparency requirements above, the regulation also requires electronic reporting of completely different data to the CDC and CMS. As this data will be made public in a way that identifies the reporting SNF, it is possible—indeed likely—that the data that a SNF self-discloses to residents and their family members will be inconsistent with publicly available federal sources.
What About Assisted Living Facilities?
While the new CMS requirements impose extensive transparency requirements on SNFs, ALFs may be left without clear direction from state and federal authorities regarding how much COVID-19 related information should be reported to residents and family members and when such data should be reported. The transparency requirements imposed by the new regulation do not apply to ALFs, and while some states have adopted their own transparency requirements governing ALF disclosures to residents and their families, others have not.
To complicate the decision of what/when to self-disclose, some ALFs, such as those that electronically transmit health information in conjunction with certain transactions, are required to comply with the HIPAA Privacy Rule. Others, such as those that are located on the same campus as SNFs subject to HIPAA and that find segregation of SNF information impracticable, have chosen to comply with HIPAA restrictions. Even if HIPAA restrictions do not apply, however, state licensure laws may impose privacy restrictions on access to residents’ health records or other personally identifiable information. While HIPAA regulations authorize health care providers to share protected health information with anyone as necessary to “prevent or lessen a serious and imminent threat to the health and safety of a person or the public”, such disclosures must be consistent with applicable law (such as state statutes, regulations, or case law) and the provider’s standards of ethical conduct. 45 CFR 164.512(j). For this reason, ALFs located in states that confer broad privacy rights on residents need to consider HIPAA (if applicable) and state repercussions of disclosures, at least with respect to any disclosure not specifically required by a state authority. Thus, many ALFs will need to establish policies that balance transparency with privacy considerations in a legal environment that might be charitably described as a state of limbo.
For more information, please contact your regular Powers attorney, Diane Millman (Diane.Millman@PowersLaw.com; or Natalie Dobek (Natalie.Dobek@PowersLaw.com).