Australian Privacy Regulator Commences Penalty Proceedings Against Medibank

On 5 June 2024, the Australian Information Commissioner commenced civil penalty proceedings in the Australian Federal Court against Medibank Private Limited (an Australian health insurance provider) in relation to an October 2022 data breach.

On 25 October 2022, Medibank notified the Office of the Australian Information Commissioner (OAIC) of a data breach concerning sensitive personal information of 9.7m Australians (representing approximately 37% of Australia’s total population). As a result of a cyber-attack, malicious actors had gained access to a vast library of customer data which included identity details, government identifiers and medical and insurance records. Over the course of a number of weeks, the malicious actors ‘leaked’ sensitive personal information of Medibank customers and other impacted individuals onto the dark-web in the course of pursuing cyber ransoms from the major insurance-provider.

Switching Data – A Potent Tonic for Obtaining CMA Clearance at Phase 1

By Francesco Liberatore and James Mosely on June 5, 2024 Posted in Antitrust, United Kingdom

Customer switching data is an important factor that the Competition and Markets Authority (CMA) considers when assessing the closeness of competition of merging parties. However, as the completed acquisition by Pharmacy2U Limited (Pharmacy2U) of Lloyds Direct demonstrates, switching data can also be determinative when it comes to market definition.

Pharmacy2U is a Distance Selling Pharmacy (DSP) that supplies prescription-only medicines (POMs) in England. POMs are pharmaceutical drugs that require a prescription and are dispensed by a pharmacist. Pharmacy2U also provides other healthcare services, runs an online doctor consultation service and sells a range of health and wellbeing products. Metabolic Healthcare Limited (trading as Lloyds Direct, together with Pharmacy2U, the Parties) is also a DSP and supplies POMs in England. Following the completed acquisition of the entire share capital of Lloyds Direct by Pharmacy2U on 5 October 2023 (Transaction), the CMA called in the Transaction for review and decided to clear the Transaction on 12 March 2024.

CMS Finalizes a New Rule to Require Extensive API Implementation and Quicker Turnaround for Prior Authorization Decisions: What Payers Should Know

By Doug Anderson on May 13, 2024 Posted in CMS, Insurance, Managed Care, Medicare Advantage, Payer/Insurance Reform

On January 17, 2024, the Centers for Medicare & Medicaid Services (“CMS”) issued a final rule regarding interoperability and prior authorization (the “Rule”). CMS-0057-F. The Rule’s goals, according to CMS, are to facilitate the electronic exchange of health-care data, improve and expedite prior authorization processes, and reduce related burdens for payers, healthcare providers, and patients, with estimated savings of $15 billion over 10 years. The Rule’s changes focus on two areas: (1) interoperability advancement and (2) prior authorization streamlining. Both changes target federally regulated health insurers such as Medicare Advantage Organizations, state Medicaid and Children’s Health Insurance Program (“CHIP”) Fee-for-Service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (“QHP”) issuers on the Federally Facilitated Exchanges (“FFEs”), (collectively, “Impacted Payers”).

For interoperability advancement, Impacted Payers must implement and maintain four application programing interfaces (“APIs”), which are software that allow other software applications to exchange information and features more efficiently. These four APIs are (1) the Patient Access API, (2) the Provider Access API, (3) the Payer-to-Payer API, and (4) the Prior Authorization API. Although compliance dates vary based on payer type, Impacted Payers must generally implement these four APIs by January 1, 2027.

Private Equity’s Involvement in Health Care Under Increasing Scrutiny

By Robert Nauman on May 8, 2024 Posted in Antitrust, FTC, HHS, Mergers and Acquisitions, Policy

Private equity’s investment in healthcare has increased rapidly over the past decade, and this is now drawing attention from regulators. Signifying this increased scrutiny is a joint Request for Information (RFI) issued in March by the Department of Justice’s (DOJ) Antitrust Division, Federal Trade Commission (FTC), and Department of Health and Human Services (HHS) seeking comments from the public on “private-equity and other corporations’ increasing control over health care”. (Access the RFI here.) While the RFI has made headlines, it is part of a broader regulatory effort to evaluate private equity’s role as a major player in healthcare. This post summarizes some of those efforts and the concerns among regulators over private equity investment in healthcare that regulators are seeking to address.

Private Equity Investment

Private equity’s investment in healthcare has increased drastically over the last decade. While exact numbers aren’t available, reliable estimates point to a one hundred and eighty-nine percent (189%) increase in annual private equity deal value in the healthcare industry from 2010 to 2019,[1] with the number of reported deals increasing from 352 in 2010 to 937 in 2020.[2] These investments in the industry are wide ranging and include everything from hospitals and physician practices to specialty facilities and managed care plans.[3] This investment, driven in part by the increasingly complex regulatory environment for healthcare delivery and reimbursement, has engendered speculation and studies on the effect private equity has on the pricing and quality of healthcare services. A concern among regulators is that private equity is making healthcare more expensive and less effective, and this concern is the driving force behind the actions described below.

The Status of Non-Competes in Healthcare: How the FTC Rule and Other Recent Developments Affect Non-Competes for Doctors, Nurses, and Other Healthcare Practitioners

By Paul Erian and Will Kishman on April 30, 2024 Posted in Antitrust, FTC, Labor and Employment, NLRB

For healthcare providers and practitioners, the rules surrounding non-competition agreements have evolved rapidly over the last two years, and that evolution accelerated even more this month. Over the past 18 months, states and the federal government enacted several new laws that substantially limit when healthcare entities can enforce non-competes. Then, on April 24, the Federal Trade Commission issued a rule that will bar most non-competes in the U.S. if it survives legal challenges (albeit no sooner than late August 2024). This creates yet another potential hurdle for a healthcare entity seeking to enforce a non-compete. Going forward, healthcare entities wishing to utilize non-competes with their employees and contractors should ensure they account for all of the following developments.

The FTC’s rule would bar many healthcare entities from using non-competes, but it arguably would not restrict tax-exempt hospitals and other non-profit providers.

The FTC rule would cover many healthcare employees in the U.S., but not all of them. In terms of employer coverage, the rule applies to for-profit healthcare systems, private medical practices, private equity funds, and most other entities that are “organized to carry on business for [their] own profit or that of [their] members.” The rule does not categorically exempt non-profits, tax-exempt hospitals, and other tax-exempt entities, but these entities will have a good argument that they fall outside the rule’s coverage by its terms.

Are you Ready for Washington and Nevada’s Consumer Health Data Laws?

By Squire Patton Boggs on April 23, 2024 Posted in Data Protection, Privacy

Washington’s My Health My Data Act (“MHMDA”) and Nevada’s SB 370 (“NV CHD Law”) (collectively, “CHD Laws”) went into effect at the end of last month, on March 31, 2024 (as many know, MHMDA’s geofencing prohibition went into effect last summer). Unlike the Health Insurance Portability and Accountability Act (“HIPAA”), a federal law which governs privacy and security in traditional healthcare settings, CHD Laws regulate “consumer health data” or “CHD”– a very broadly defined term – collected by companies in a broad swath of health and non-health related industries alike. Even ancillary purposes like providing accessibility accommodations and defending personal injury claims are enough to trigger the laws. CHD Laws impose restrictions and obligations on regulated entities far more burdensome than state consumer privacy laws, many of which already regulate some of the same health data, and unlike those general consumer privacy laws are not proposed to be preempted by the potential federal America Privacy Rights Act.

Squire Patton Boggs attorneys Alan Friel, Kyle Fath, Niloufar Massachi and Gicel Tomimbang provide a detailed discussion of these new CHD Laws on our Privacy World Blog, which you can read here.

42 C.F.R. Part 2 Final Rule to Align with the HIPAA Privacy Rules

By John Wyand, Kimberly Donovan and John Bunch on April 11, 2024 Posted in Department of Health and Human Services, HHS, HIPAA, Privacy

The US Department of Health and Human Services, Office for Civil Rights (OCR)
and the Substance Abuse and Mental Health Services Administration issued a Final Rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 C.F.R. Part 2 (Part 2), applicable to certain federally assisted SUD treatment programs (Part 2 Programs), and to SUD patient records (Part 2 Records).

The effective date of the Final Rule is April 16, 2024, and entities have until February 16, 2026, to comply.

The Final Rule includes several changes to align Part 2 more closely with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which applies to protected health information, and to reduce administrative burdens, as summarized below:

President Biden Announces Groundbreaking Restrictions on Access to Americans’ Sensitive Personal Data by Countries of Concern

By Squire Patton Boggs on March 27, 2024 Posted in Cybersecurity, Data Protection, Policy

On February 28, 2024, President Biden issued a groundbreaking executive order (EO) establishing the framework for new restrictions on transactions involving US persons’ sensitive personal data and “countries of concern,” including China, or related parties.

FEPA: the New Tool in the DOJ’s Fight Against Corruption

By Squire Patton Boggs on February 5, 2024 Posted in DOJ, International, International Healthcare, Legislation

Members of our Government Investigations & White Collar team recently presented a timely webinar on the new Foreign Extortion Prevention Act (FEPA). The Act, which has been referred to as “the most consequential anti-foreign-bribery law passed in almost 50 years,” allows the DOJ to prosecute foreign officials who demand or accept a bribe from a U.S. citizen or company. Understanding FEPA is critical for US companies with international business interactions and other companies whose business subjects them to US jurisdiction. Read on at the link below for an outline of FEPA’s core provisions and relevant enforcement considerations for companies, international organizations and foreign governments.

FEPA: the New Tool in the DOJ’s Fight Against Corruption | Global Investigations & Compliance Review

The End of “Chevron” or Its Rebirth?

By Squire Patton Boggs on January 29, 2024 Posted in Regulations, U.S. Supreme Court

Fishermen in the small town of Cape May, New Jersey, are at the epicenter of a legal challenge that could reshape the landscape of agency authority. The fishermen are challenging the entrenched “Chevron” doctrine, which for years has afforded deference to government agencies with respect to reasonable interpretation of ambiguous statutes. Once again, the US Supreme Court is in the spotlight as it hears pivotal cases – Relentless v. Department of Commerce and Loper Bright Enterprises v. Raimondo, which may presage the dismantling of “Chevron”. Squire Patton Boggs attorneys Keith Bradley, Peter Gould, Rebekah Singh, and Austin Harrison discuss the Court’s review and possible implications in a recent article, available here.