The CARES Act and its Impact on Health Plans

On March 27, 2020, the third major piece of legislation relating to the ongoing COVID-19 pandemic was signed in law. The Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) includes multiple provisions affecting employers and employee benefit plans, which are highlighted below.

Expansion of Coverage for COVID-19 Testing – Updates to the FFCRA

The CARES Act expands coverage for COVID-19 diagnostic testing from what was previously mandated in the Families First Coronavirus Response Act (FFCRA) signed into law on March 18, 2020 (see our previous blog for a recap). Group health plans must cover, without cost-sharing, the following diagnostic tests:

• FDA-approved tests (which was previously in the FFCRA);
• Tests for which the developer has requested or intends to request FDA emergency use authorization (unless the test is denied by the FDA);
• Tests developed in and authorized by a State that has notified the Secretary of Health and Human Services of its intention to review tests intended to diagnose COVID-19; or
• Other tests that the Secretary determines appropriate.

Reimbursement for COVID-19 Testing

A group health plan or health insurance issuer must reimburse the “provider of the diagnostic testing” with one of the following rates:

• The negotiated rate with the provider prior to the public health emergency (i.e., an emergency with respect to COVID-19 declared by a Federal, State, or local authority); or
• Absent a negotiated rate, the plan shall reimburse the provider in an amount equal to the cash price for such service listed on a public internet website (however, the plan is permitted negotiate a lower rate with the provider).

The CARES Act also mandates that each provider of a diagnostic test for COVID-19 must post the cash price for the test on the provider’s public website or incur a civil monetary penalty.

Coverage for Preventive Services and Vaccines for Coronavirus

The CARES Act will require group health plans and issuers to cover any “qualifying coronavirus preventive service” – meaning any items, service, or immunization intended to prevent or mitigate coronavirus. These plans must comply within 15 days after a recommendation is made relating to the qualifying coronavirus preventive service.

Coverage Confidentiality & Disclosure of Records Relating to Substance Use Disorder, including HIPAA Updates

The CARES Act modifies the Public Health Service Act (PHSA), (42 USC 290 dd-2(b) regarding the confidentiality and disclosure of records relating to substance use disorders. Changes underscore the importance of HIPAA’s Privacy Rule for Covered Entities (CEs) (i.e., health plans, health care providers, and health care clearinghouses), particularly regarding the required Notice of Privacy Practices document. Congress’ purposes for language modifications are to (1) ensure patient’s rights to request restriction on uses or disclosures of their records and compel CE to make “every reasonable effort” to comply with a patient’s request to restrict. A summary of changes by the CARES Act:

• Ensures regulations consistently use the term “substance use disorder.”
• Expands Consent language: once prior written consent of a patient has been obtained, contents may be used or disclosed by CE, business associates, or special programs in accordance with HIPAA. Written consent, until revoked, need only be given once for future uses and disclosures for treatment, payment, and health care operations. HITECH restrictions on such uses applies.
• Adds Antidiscrimination language clarifying that no entity or recipient of federal funds shall discriminate against an individual based upon inadvertent or intentional disclosure of substance use disorder records. Discriminatory actions include, among others, treatment for health care, terms of employment, sale or rental of housing, access to courts, or maintenance of social services.

DOL’s Ability to Postpone Deadlines

The Act also includes a “public health emergency” as a reason the Department of Labor (DOL) may postpone certain deadlines related to the Employee Retirement Income Security Act (ERISA) (e.g., filing Form 5500). As always, we’ll be sure to update you with additional guidance the DOL publishes regarding these deadlines.

Over-the-Counter Drugs and Menstrual Care Products

The CARES Act deleted the requirement that individuals must obtain a prescription from a doctor to be reimbursed for over-the-counter (OTC) medicines and drugs under health saving accounts (HSAs), health flexible spending accounts (health FSAs), archer MSAs, and health reimbursement arrangements (HRAs) (i.e.,  it appears that any OTC drug may now be treated as “being for medical care”). The Act also added menstrual care products as eligible medical expenses for purposes of these accounts. It does not appear that this alters the more general rule for OTC products (and other medical care as well) that the treatment must be for the diagnosis, cure, mitigation, treatment, or prevention of disease. It’s important to note that products intended for general health or well-being still do not qualify as medical care.

Telehealth Services Encouraged

Various provisions within the CARES Act encourage the use of telehealth services and permit the Secretary of Health and Human Services (HHS) to permit such uses, including:

• HDHP Telehealth Safe Harbor Provision. In the case of plan years beginning on or before December 31, 2021, the Act added a safe harbor provision to section 233(c)(2) of the Internal Revenue Code (IRC), which states that plans will not fail to be a high deductible health plan (HDHP) for providing coverage of “telehealth or other remote care services” without a deductible. In other words, an individual may have a plan that includes telehealth (and other remote care) without disqualifying them from having an HDHP.
• Increasing Medicare Telehealth Flexibilities. During the COVID-19 emergency period, the Secretary of HHS may waive all statutory Medicare coverage requirements for telehealth.
• Medicare Assessments and Certification through Telehealth. Prior to the CARES Act, certain assessments and certification requirements for Medicare beneficiaries must be done through an in-person face-to-face encounter. During the emergency period, these requirements may be conducted through telehealth services.

*Additional changes to the Public Health Service Act (PHSA), (42 USC 290 dd-2(b)) included within Section 3221 of the CARES Act include the following:

• Adds public health authorities (subject to HIPAA’s Other Uses & Disclosures Rules) to the list of entities that may secure patient records, regardless of consent.
• Adds a Definitions section to the end of the regulations.
• Expands Scope of Uses in a criminal, civil or administrative context: an applicable patient record (existing) or testimony relating information within the record (newly added) may not be disclosed or used in several circumstances outlined in the language, including rules of evidence and application for a warrant.
• Expands the Penalties provision by applying Sections §1776 & §1777 of the Social Security Act.
• Adds Breach Notification provisions (Section 13402 of HITECH) to apply to a “program or activity” to the same extent and manner as a CE.
• Requires the Secretary of Health and Human services to consult with experts and update HIPAA (45 CFR 164.520) to ensure CE provide the Notice of Privacy Practices document in “plain language” that includes a “statement of patient rights” and “description of each purpose” for a CE permitted or required uses and disclosures.

The information and content contained in this blog post are for general informational purposes only, and does not, and is not intended to, constitute legal advice. As always, for specific questions concerning your health plan, or for help in operating and/or amending your plan in response to the CARES Act provisions, please consult your own ERISA attorney or advisor.