The Washington Debrief
provides CHIME members weekly news and information related to important healthcare IT legislative, regulatory and political developments in Washington, D.C.
|
|
Volume 5, No. 21
|
June 5, 2017
|
|
|
|
Cyber Task Force
Key Takeaway: HHS Cybersecurity Task Force sends much-anticipated
report to Congress
Why it Matters: Late Friday, the HHS Cybersecurity Task Force released the report they were tasked by law with completing. The Task Force was established by HHS in March 2016 as required by Section 405 of the Cybersecurity Act of 2015 included in the FY2015 Omnibus appropriations bill. The Task Force was charged with:
- Analyzing how other industries have implemented strategies and safeguards for addressing cybersecurity threats within their respective industries;
- Analyzing challenges and barriers private entities (excluding state and federal governments) in the healthcare industry face securing themselves against cyber attacks;
- Reviewing challenges that covered entities and business associates face in securing networked medical devices and other software or systems that connect to an EHR;
- Providing the Department of Health and Human Services (HHS) with information to disseminate to healthcare industry stakeholders of all sizes for purposes of improving their preparedness for and response to cybersecurity threats affecting the industry;
- Establishing a plan for implementing cyber threat information sharing so that the federal government and healthcare industry stakeholders may in real time share actionable cyber threat indicators and defensive measures;
- Reporting to appropriate Congressional Committees on the findings and recommendations of the task force.
|
|
|
|
WORKING FOR YOU IN WASHINGTON
|
Leslie Krigstein
VP Congressional Affairs, CHIME
Mari Savickis
VP Federal Affairs, CHIME
Thoughts, Questions or Comments? Please contact
Leslie
or
Mari
Office Hours:
9:00am - 5:00pm
|
|
|
The Task Force came back with a report spanning 96 pages and dozens of recommendations for the healthcare industry. Below are some of the key findings:
- The state of cybersecurity in healthcare must improve and coordination across all industry stakeholders (federal agencies, Congress, healthcare providers, medical device manufacturers, accreditors, insurers, professional associations) is paramount.
- The federal government should provide additional resources and opportunities, starting with a new federal official to serve as a single point of contact to the industry on cybersecurity.
- Efforts must be undertaken to streamline and harmonize the federal requirements that may be in conflict or impeding enhanced cybersecurity hygiene.
- More can be done under current capabilities to enhance the security of medical devices and electronic health records (EHRs), but provider organizations must be able to manage and administer patches and improvements.
CHIME and AEHIS have tirelessly advocated for several protections and improvements to federal policies that will improve the cybersecurity climate for them and the patients they serve. The report recommends many of the actions we have requested are needed such as payers offering incentives for investing in tools that will improve cyber hygiene as well as harmonizing federal policies providers must meet.
CHIME and AEHIS have prepared a summary of the report
here.
|
|
WannaCry Update
Key Takeaway: HHS Issues
new bulletin on lingering effects of WannaCry - this time in the U.S. New emergency hotline established to report attacks.
Why it Matters: Late last Friday HHS issued another
bulletin on the WannaCry saga alerting stakeholders to two large, multi-state hospital systems in the U.S. that reported experiencing interruptions to operations stemming from the original WannaCry attack. While they have noted that this is not a new WannaCry attack, they wanted to alert the healthcare industry to this new development.
The bulletin highlights a new way to contact the FDA should they need to report a vulnerability impacting one of their devices. They have established an emergency hotline,
1-866-300-4374, that can be used 24/7. They state that reports of impact on multiple devices should be aggregated on a system/facility level.
The Department of Homeland Security (DHS)'s ICS-CERT also released
an updated bulletin,
Indicators Associated With WannaCry Ransomware (Update H)
. This updated alert is a follow-up to the updated alert titled ICS-ALERT-17-135-01G Indicators Associated With WannaCry Ransomware that was published May 30, 2017, on the NCCIC/ICS-CERT web site. Still not signed up for ICD-CERT bulletins? Go
here
to join their listserv.
|
|
We Need Members to Weigh in Now!
Key Takeaway: Worried about the January 1, 2018, deadline to migrate to 2015 Edition CEHRT and the start of Stage 3 Meaningful Use? Weighing in with
Centers for Medicare and Medicaid Service (CMS) is as easy as 1-2-3!
Why it Matters: CHIME will respond to CMS' Inpatient Prospective Payment System (IPPS) rule, which outlines CMS' ongoing plans to move ahead with the previously scheduled
deadline of January 1, 2018, to start using the 2015 Edition of Certified EHRs and Meaningful Use
Stage 3.
However, we encourage members to click
here and make their voice heard. This link will take you to the federal website to make comments; it requires only a few sentences about why the mandatory use of 2015 Edition CEHRT and Stage 3 should not be initiated sooner than 2019. The more comments CMS receives, the greater the likelihood that the delay will occur.
CMS is accepting comments through 5 p.m. ET June 13. Still need details on what CMS is proposing for 2018? Check out our CIO Fact sheet on the proposed IPPS rule
here.
|
|
Congress Examines Use of SSNs by Federal Agencies
Key Takeaway: In a
joint hearing between subcommittees of the House Oversight and Government Reform Committee and the Ways and Means Committee, lawmakers examined the current use of Social Security numbers (SSNs) across federal programs.
Why It Matters: Committee members questioned the continued value in using the SSN as well as potential ways to reduce the proliferation of other identifiers across the federal government, which could be costly and burdensome to American citizens.
In a
statement submitted for the hearing record, CHIME reminded the members of the Information Technology subcommittee of the Oversight and Government Reform Committee and the Social Security subcommittee of the Ways and Means Committee that SSNs are widely used in healthcare to identify patients, given the lack of a national solution for patient identification.
During the
hearing titled, "Protecting Americans' Identities: Examining Efforts to Limit the Use of Social Security Numbers," lawmakers heard from representatives from the Social Security Administration (SSA), Department of Veterans Affairs (VA), the (CMS), the Office of Personnel Management (OPM) and the Government Accountability Office (GAO).
Some committee members suggested the use of a token system for identity management across the federal government. Other members expressed concern that individual agencies are independently generating identification numbers. Another pointed to Estonia's e-Identity card, which is used nationally for standard identification purposes. It acts as a health insurance card and is used to access government databases, among other capabilities.
Further, on May 24, the House passed, by voice vote, the Social Security Number Fraud Prevention Act of 2017 (
HR 624). It would prohibit federal agencies from including the SSNs on any document sent by mail unless the department or agency head determines that inclusion of that Social Security number on the document is necessary.
|
|
CMS SSN Removal Initiative Advancing
Key Takeaway: The CMS is moving ahead on the mandate to remove Social Security Numbers (SSNs) from Medicare beneficiary cards.
Why it Matters: Announced quietly and with little fanfare last year, CMS rolled out plans to replace SSNs on Medicare cards with a new alphanumeric identifier. Over the past decade as more information is stored and moved electronically and identity theft has risen, added scrutiny has been placed on the use of SSNs. This issue has been ballyhooed for years by advocates and Congress acted in 2015 by requiring their removal under Section 501 of Medicare Access and CHIP Reauthorization Act (MACRA). The law requires CMS remove the numbers by April 2019.
Last week CMS released a
press release announcing more publicly their plans. As noted above, CMS
testified on the agency's plans for replacing the numbers. The new number that will take the place of the SSN is being referred to as the Medicare Beneficiary Identifier, or MBI.
Get the 411 on CMS' plans with CHIME's CIO Cheat Sheet, which breaks it all down
here.
|
|
APM Update
Key Takeaway: CMS releases list of qualifying predictive alternative payment model (APM) participants.
Why it Matters: Last Friday CMS announced the predictive Qualifying APM Participant (QP) status for 2017 Advanced APMs under the QPP. CMS said they would supply 2017 Advanced APM eligible clinicians with a predictive QP status based on historical claims. By looking at historical Part B claims data, CMS predicts that nearly 100% of eligible clinicians in Advanced APMs with data currently available will be QPs in performance year 2017. CMS has published a
Methodology Fact Sheet (PDF) and more information can also be found on the CMS
Quality Payment Program web site.
|
|
New Resource Available
Why it Matters: Understanding the details of the Quality Payment Program (QPP), which encompasses the Medicare-based Incentive Program (MIPS) and Advanced Alternative Payment Models (APMs), can be daunting even for the most well-resourced providers.
CMS recently published a technical assistance guide aimed at helping small providers navigate the two pathways under the QPP. For those with fewer than 15 clinicians, CMS offers 11 local, experienced organizations to provide hands-on training and support. Practices in rural locations, health professional shortages areas (HPSAs) and medically underserved areas (MUAs) will be helped first. For those in practices with more than 15 clinicians, CMS has 14 knowledgeable QIN-QIOs around the country ready to give you direct technical support. A list with contact information is contained in the
guide.
|
|
Webinar on Cybersecurity Executive Order
Key Takeaway: The National Institute for Standards and Technology (NIST) will host a webinar at noon ET today on "The President's Executive Order on Cybersecurity Workforce: Next Steps and How to Engage."
Why it Matters: On May 11, 2017, President Trump issued an
Executive Order to strengthen federal networks and critical infrastructure cybersecurity. The webinar will provide an overview of the cybersecurity workforce provisions of the Executive Order, present a summary of existing federal government legislation and programs for additional context, and describe plans to engage the community to collect input and receive feedback. To register for the webinar, go
here.
|
|
OCR's May Newsletter
Key Takeaway: The Office for Civil Rights' (OCR) May newsletter focuses on cybersecurity.
Why it Matters: OCR considers ransomware attacks to be a breach. Deciding whether they are reportable or not to OCR depends on whether patient data is compromised. In May's newsletter, they cover:
- What's a Security Incident? When is it a Breach?
- Handling an Incident - An Incident Occurs; How's your Capability to Respond?
- Information Sharing - Coordination and Communicate
- Breach Reporting - Prompt Notice to Help Mitigate Potential Harm
Still not getting OCR's newsletters? Go
here to join the OCR listserv.
|
|
Securing the Internet Feedback Opportunity
Key Takeaway: National Institute for Standards and Technology (NIST) seeks feedback on secure inter-domain routing.
Why it Matters: NIST's National Cybersecurity Center of Excellence (NCCoE) announced the release of a new draft project description:
Secure Inter-Domain Routing: Route Hijacks. The default routing protocol to route traffic over the internet among organizations (Internet Service Providers (ISPs) and Autonomous Systems (ASes)) has been the Border Gateway Protocol (BGP). A lack of built-in security means it is open for exploitation. NIST aims to improve this by undertaking the development of a Special Publication (SP 800-189) that provides security recommendations for the use of Inter-domain protocols and routing technologies. NIST is seeking comment on the draft by June 29, 2017. More information can be found
here.
|
|
Telehealth Caucus Formed, Telehealth Expansion Bills Reintroduced in the House
Key Takeaway: A bipartisan group of House members formed the Congressional Telehealth Caucus last month.
Why It Matters: Telehealth proposals have garnered considerable attention from House and Senate lawmakers this Congress. With increased support from the Administration, Congress could see the advance of telehealth expansion policies in the 115th Congress.
Representatives Mike Thompson (D-CA), Gregg Harper (R-MS), Diane Black (R-TN) and Peter Welch (D-VT)
announced the formation of the Congressional Telehealth Caucus in addition to reintroducing two telehealth legislative proposals: the Medicare Telehealth Parity Act and CONNECT for Health Act of 2017.
The Medicare Telehealth Parity Act (
HR 2550) would phase in the expansion of telehealth services, removing the geographic barriers under current law, and allow for the provision of telehealth services in rural, underserved and metropolitan areas. Further, it would cover remote patient monitoring (RPM) for patients with chronic conditions such as heart failure, chronic obstructive pulmonary disease (COPD) and diabetes. The bill would also allow the beneficiary's home to serve as a site of care for home dialysis, hospice care, eligible outpatient mental health services and home health services.
The Creating Opportunities Now for Necessary and Effective Care Technologies or "CONNECT" for Health Act of 2017 (
HR 2556), which CHIME has
endorsed in the Senate and supported in the 114th Congress, would expand originating sites for telehealth care, lift restriction on the use of telehealth in Accountable Care Organizations (ACOs) and in Medicare Advantage, among other provisions.
|
|
2018 Budget Proposal
Key Takeaway: President sends budget proposal to Congress with series of cuts for healthcare.
Why it Matters: On May 23 President Trump submitted his 2018 budget proposal to Congress with a goal of balancing the budget within 10 years, a goal predicated on various assumptions. In it the President outlines what he calls "eight pillars of reform": 1) health reform; 2) tax reform and simplification; 3) immigration reform; 4) reductions in federal spending; 5) regulatory rollback; 6) American energy development; 7) welfare reform; and 8) education reform. The budget calls for $69 billion in discretionary funding and another $1,046 billion in mandatory funding. The HHS budget, which is chronicled in its
Budget in Brief, estimates it reduces spending by cutting $665 billion over 10 years by reducing Medicaid spending. Below is a recap of some of the healthcare items:
- Office of the National Coordinator (ONC) would see a drop in funding from $60 million at the current level to $38 million (page 97 of budget in brief)
- Office for Civil Rights (OCR) would see a drop in funding from $39 million to $33 million (page 95 of budget in brief)
- CMS would see an increase of $13 billion to its current $1 trillion spending (see page 49 of budget in brief)
- Food and Drug Administration would see an increase of $456 million added to its current level of $5.1 billion (see page 15 of the budget in brief)
- Agency for Healthcare Research & Quality (AHRQ) is being folded into the National Institutes of Health and will no longer be a stand-alone agency, keeping $272 million in funding for this under NIH (see page 39 of the budget in brief)
HHS Secretary Tom Price, M.D., will be on Capitol Hill this week, appearing before the Senate Finance Committee and the House Ways and Means Committee to defend the President's FY18 Budget request. FDA Commissioner Scott Gottlieb fielded question on the budget before the House Labor-Health and Human Services (Labor-H) Appropriations subcommittee on May 25. |
 |
Click here to view our
CHIME Public Policy Playbook
|
|
College of Healthcare Information Management Executives (CHIME)
|
|
|
|
|
