{"description":"Documents matching '\"HIPAA Security Rule\"' and of type Rule","count":51,"total_pages":3,"next_page_url":"https://www.federalregister.gov/api/v1/documents?conditions%5Bterm%5D=%22HIPAA+Security+Rule%22&conditions%5Btype%5D%5B%5D=RULE&format=json&page=2","results":[{"title":"Health Data, Technology, and Interoperability: Trusted Exchange Framework and Common Agreement (TEFCA)","type":"Rule","abstract":"This final rule has finalized certain proposals from a proposed rule published in August 2024 and in doing so advances interoperability and supports the access, exchange, and use of electronic health information. Specifically, this final rule amends the information blocking regulations by including definitions related to the Trusted Exchange Framework and Common Agreement (TEFCA) Manner Exception. It also implements provisions related to the TEFCA, which will support the reliability, privacy, security, and trust within TEFCA. Lastly, this final rule includes corrections and updates to current regulatory provisions of the Office of the National Coordinator for Health Information Technology (ONC) Health IT Certification Program.","document_number":"2024-29163","html_url":"https://www.federalregister.gov/documents/2024/12/16/2024-29163/health-data-technology-and-interoperability-trusted-exchange-framework-and-common-agreement-tefca","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-12-16/pdf/2024-29163.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-29163.pdf?1733924732","publication_date":"2024-12-16","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"expected to meet a high bar for security, including compliance with the <span class=\"match\">HIPAA Security Rule</span> or the standards required by the <span class=\"match\">HIPAA Security Rule</span>. We make the distinction between “compliance with the <span class=\"match\">HIPAA Security Rule</span>” and compliance with the standards required by QHIN participation that mirror the <span class=\"match\">HIPAA Security Rule</span> requirements because some entities may not be a covered entity or business associate (\n i.e., \n a Non-HIPAA Entity) that are regulated by the <span class=\"match\">HIPAA Security Rule</span>. In order for TEFCA to have consistent security standards, we proposed"},{"title":"Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2026 Rates; Changes to the FY 2025 IPPS Rates Due to Court Decision; Requirements for Quality Programs; and Other Policy Changes; Health Data, Technology, and Interoperability: Electronic Prescribing, Real-Time Prescription Benefit and Electronic Prior Authorization","type":"Rule","abstract":"This final rule revises the Medicare hospital inpatient prospective payment systems (IPPS) for operating and capital-related costs of acute care hospitals; makes changes relating to Medicare graduate medical education (GME) for teaching hospitals; updates the payment policies and the annual payment rates for the Medicare prospective payment system (PPS) for inpatient hospital services provided by long-term care hospitals (LTCHs); updates and makes changes to requirements for certain quality programs; and makes other policy- related changes. We are also finalizing the provisions of the interim final action with comment period regarding the changes to the FY 2025 IPPS rates due to the court decision in Bridgeport Hosp. v. Becerra. Lastly, it finalizes certain updates to the ONC Health Information Technology (IT) Certification Program.","document_number":"2025-14681","html_url":"https://www.federalregister.gov/documents/2025/08/04/2025-14681/medicare-program-hospital-inpatient-prospective-payment-systems-for-acute-care-hospitals-ipps-and","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-08-04/pdf/2025-14681.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-14681.pdf?1753992911","publication_date":"2025-08-04","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"},{"raw_name":"Office of the Secretary"}],"excerpts":"308(a)(1)(ii)(B), the <span class=\"match\">HIPAA Security Rule</span> implementation specification for risk management requires the implementation of security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 45 CFR 164.306(a). We note the <span class=\"match\">HIPAA Security Rule</span> does not prescribe a specific methodology for conducting and documenting a risk analysis or managing risk (45 CFR 164.308(a)(1)(ii) and 164.316(b)(1)). We refer readers to educational resources and information on conducting a <span class=\"match\">HIPAA Security Rule</span> risk analysis available"},{"title":"Confidentiality of Substance Use Disorder (SUD) Patient Records","type":"Rule","abstract":"The United States Department of Health and Human Services (HHS or \"Department\") is issuing this final rule to modify its regulations to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The Department is issuing this final rule after careful consideration of all public comments received in response to the notice of proposed rulemaking (NPRM) for the Confidentiality of Substance Use Disorder (SUD) Patient Records. This final rule also makes certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates.","document_number":"2024-02544","html_url":"https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-16/pdf/2024-02544.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-02544.pdf?1707408916","publication_date":"2024-02-16","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"HIPAA regulations by applying the <span class=\"match\">HIPAA Security Rule</span>, or components of it, to \n \n part 2 programs and other lawful holders with respect to electronic part 2 records. A majority of commenters who addressed this issue recommended applying the <span class=\"match\">HIPAA Security Rule</span> to part 2 programs; however, few of these comments were from part 2 programs. Further, the CARES Act did not make the <span class=\"match\">HIPAA Security Rule</span> applicable to part 2 programs. The Department is not finalizing any additional modifications to align the <span class=\"match\">HIPAA Security Rule</span> and part 2 at this time, but will"},{"title":"Medicare and Medicaid Programs; CY 2027 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; and Medicare Prescription Drug Inflation Rebate Program","type":"Rule","abstract":"This final rule addresses: changes to the physician fee schedule (PFS); other changes to Medicare Part B payment policies to ensure that payment systems are updated to reflect changes in medical practice, relative value of services, and changes in the statute; codification of establishment of new policies for: the Medicare Prescription Drug Inflation Rebate Program under the Inflation Reduction Act of 2022; limiting Medicare coverage of certain individuals; the Ambulatory Specialty Model; updates to drugs and biological products paid under Part B; Medicare Shared Savings Program requirements; updates to the Quality Payment Program; updates to policies for Rural Health Clinics and Federally Qualified Health Centers; update to the Ambulance Fee Schedule regulations; codification of the Inflation Reduction Act and Consolidated Appropriations Act, 2026 provisions; updates to Clinical Laboratory Fee Schedule regulations; updates to the Medicare Promoting Interoperability Program.","document_number":"2026-22743","html_url":"https://www.federalregister.gov/documents/2026/11/09/2026-22743/medicare-and-medicaid-programs-cy-2027-payment-policies-under-the-physician-fee-schedule-and-other","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-11-09/pdf/2026-22743.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-22743.pdf?1793829612","publication_date":"2026-11-09","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"the <span class=\"match\">HIPAA Security Rule</span> at 45 CFR 164.306. \n Given that MIPS eligible clinicians are covered entities under the <span class=\"match\">HIPAA Security Rule</span> and the requirements of the Security Risk Analysis measure derive from the <span class=\"match\">HIPAA Security Rule</span> requirements, removal of the Security Risk Analysis measure will not weaken any cybersecurity requirements for MIPS eligible clinicians. When the Security Risk Analysis measure was adopted in the CY 2017 Quality Payment Program final rule, we determined that requiring an attestation regarding certain <span class=\"match\">HIPAA Security Rule</span> requirements"},{"title":"Medicare and Medicaid Programs; CY 2026 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; and Medicare Prescription Drug Inflation Rebate Program","type":"Rule","abstract":"This major final rule addresses: changes to the physician fee schedule (PFS); other changes to Medicare Part B payment policies to ensure that payment systems are updated to reflect changes in medical practice, relative value of services, and changes in the statute; codification of establishment of new policies for: the Medicare Prescription Drug Inflation Rebate Program under the Inflation Reduction Act of 2022; the Ambulatory Specialty Model; updates to the Medicare Diabetes Prevention Program expanded model; updates to drugs and biological products paid under Part B; Medicare Shared Savings Program requirements; updates to the Quality Payment Program; updates to policies for Rural Health Clinics and Federally Qualified Health Centers; update to the Ambulance Fee Schedule regulations; codification of the Inflation Reduction Act and Consolidated Appropriations Act, 2023 provisions; updates to the Medicare Promoting Interoperability Program.","document_number":"2025-19787","html_url":"https://www.federalregister.gov/documents/2025/11/05/2025-19787/medicare-and-medicaid-programs-cy-2026-payment-policies-under-the-physician-fee-schedule-and-other","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-11-05/pdf/2025-19787.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-19787.pdf?1761945018","publication_date":"2025-11-05","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"appropriate level to comply with the general requirements of the <span class=\"match\">HIPAA Security Rule</span> at 45 CFR 164.306(a) and the risk management requirements at 45 CFR 164.308(a)(1)(ii)(B).\n \n \n \n 444 \n  The U.S. Department of Health and Human Services has proposed to modify the <span class=\"match\">HIPAA Security Rule</span> to strengthen the cybersecurity of electronic protected health information, including proposals to revise the existing requirements to conduct a risk analysis and risk management. \n See generally \n <span class=\"match\">HIPAA Security Rule</span> to Strengthen the \n \n Cybersecurity of Electronic Protected"},{"title":"Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity","type":"Rule","abstract":"This final rule focuses on deregulatory actions identified in HHS regulations regarding health information technology standards, implementation specifications, and certification criteria and regarding certification programs for health information technology. This final rule reduces burden, offers flexibility to both developers and providers, and supports innovation through the removal and revision of certain certification criteria and regulatory provisions.","document_number":"2026-21943","html_url":"https://www.federalregister.gov/documents/2026/10/28/2026-21943/health-data-technology-and-interoperability-onc-deregulatory-actions-to-unleash-prosperity","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-10-28/pdf/2026-21943.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-21943.pdf?1793027710","publication_date":"2026-10-28","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"services). However, it cannot, in isolation or independently, provide the necessary P&amp;S capabilities across all relevant technologies in the enterprise-wide setting for covered entities to comply with the Health Insurance Portability and Accountability Act of 1996 (<span class=\"match\">HIPAA) Security Rule</span> (45 CFR part 160 and subparts A and C of part 164).\n \n Third, while certified health IT has always been “linked” to the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category, those programs have not required participating"},{"title":"Medicare Program; FY 2026 Hospice Wage Index and Payment Rate Update and Hospice Quality Reporting Program Requirements","type":"Rule","abstract":"This final rule updates the hospice wage index, payment rates, and aggregate cap amount for Fiscal Year (FY) 2026. This rule also finalizes changes to the admission to hospice regulations and the hospice face-to-face attestation requirements under the certification of terminal illness regulations and includes technical changes to the hospice telehealth policy and wage index. This final rule also includes a technical correction to the regulatory text and provides updates to the Hospice Quality Reporting Program requirements.","document_number":"2025-14782","html_url":"https://www.federalregister.gov/documents/2025/08/05/2025-14782/medicare-program-fy-2026-hospice-wage-index-and-payment-rate-update-and-hospice-quality-reporting","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-08-05/pdf/2025-14782.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-14782.pdf?1754079306","publication_date":"2025-08-05","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"commenter stated that hospices incur substantial travel-related costs in their state. A commenter stated they believe the proposed payment update does not reflect the increased costs of the new EMR and information-technology management contracts to comply with the revised <span class=\"match\">HIPAA Security Rule</span>; the increased training and education requirements to meet new CMS hospice regulatory demands; and the additional administrative personnel required to manage medical reviews and investigations secondary to new CMS regulations, and payment issues from Managed Care and"},{"title":"Grants, Contracts, and Other Agreements: Fraud and Abuse; Information Blocking; Office of Inspector General's Civil Money Penalty Rules","type":"Rule","abstract":"This final rule amends the civil money penalty (CMP) regulations of the Department of Health and Human Services (HHS) Office of Inspector General (OIG) to: incorporate new CMP authority for information blocking; incorporate new authorities for CMPs, assessments, and exclusions related to HHS grants, contracts, other agreements; and increase the maximum penalties for certain CMP violations.","document_number":"2023-13851","html_url":"https://www.federalregister.gov/documents/2023/07/03/2023-13851/grants-contracts-and-other-agreements-fraud-and-abuse-information-blocking-office-of-inspector","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-07-03/pdf/2023-13851.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-13851.pdf?1688129119","publication_date":"2023-07-03","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of Inspector General, Department of Health and Human Services","name":"Inspector General Office, Health and Human Services Department","id":245,"url":"https://www.federalregister.gov/agencies/inspector-general-office-health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/245","parent_id":221,"slug":"inspector-general-office-health-and-human-services-department"}],"excerpts":"retention duration requirements, ONC explained that many exceptions with documentation conditions are related to other existing regulatory requirements that have document retention standards. For example, the Security Exception at 45 CFR 171.203 is closely aligned to the <span class=\"match\">HIPAA Security Rule</span>, which has a six-year documentation retention requirement in 45 CFR 164.316. 85 FR 25819, May 1, 2020. \n We also note that the ONC Final Rule established records and information retention requirements for health IT developers of certified health IT as part of the ONC"},{"title":"Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing","type":"Rule","abstract":"This final rule implements the Electronic Health Record (EHR) Reporting Program provision of the 21st Century Cures Act by establishing new Conditions and Maintenance of Certification requirements for health information technology (health IT) developers under the ONC Health IT Certification Program (Program). This final rule also makes several updates to certification criteria and standards recognized by the Program. The Program updates include revised certification criteria for \"decision support interventions,\" \"patient demographics and observations,\" and \"electronic case reporting,\" as well as a new baseline version of the United States Core Data for Interoperability (USCDI) standard to Version 3. Additionally, this final rule provides enhancements to support information sharing under the information blocking regulations. The implementation of these provisions advances interoperability, improves algorithm transparency, and supports the access, exchange, and use of electronic health information (EHI). This final rule also updates numerous technical standards in the Program in additional ways to advance interoperability, enhance health IT certification, and reduce burden and costs for health IT developers and users of health IT.","document_number":"2023-28857","html_url":"https://www.federalregister.gov/documents/2024/01/09/2023-28857/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-01-09/pdf/2023-28857.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-28857.pdf?1704230116","publication_date":"2024-01-09","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"523(f)(1)(xxi).\n \n \n This approach also aligns with <span class=\"match\">HIPAA Security Rule</span> requirements for covered entities and business associates. HIPAA covered entities, such as health care providers and health plans, are generally among the customers of developers of certified health IT. In many cases, developers of certified health IT serve as HIPAA business associates to their covered entity customers, such as health care providers or health plans,\n 140 \n \n and thus must comply with the <span class=\"match\">HIPAA Security Rule</span>. The <span class=\"match\">HIPAA Security Rule</span> requires covered entities and business"},{"title":"HIPAA Privacy Rule To Support Reproductive Health Care Privacy","type":"Rule","abstract":"The Department of Health and Human Services (HHS or \"Department\") is issuing this final rule to modify the Standards for Privacy of Individually Identifiable Health Information (\"Privacy Rule\") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The Department is issuing this final rule after careful consideration of all public comments received in response to the notice of proposed rulemaking (NPRM) for the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (\"2023 Privacy Rule NPRM\") and public comments received on proposals to revise provisions of the HIPAA Privacy Rule in the NPRM for the Confidentiality of Substance Use Disorder (SUD) Patient Records (\"2022 Part 2 NPRM\").","document_number":"2024-08503","html_url":"https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-08503.pdf?1713816919","publication_date":"2024-04-26","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"2009, Public Law 111-5, 123 Stat. 226 (Feb. 17, 2009) (codified at 42 U.S.C. 1390w-4(O)(2)).\n \n \n \n \n 2 \n  45 CFR parts 160 and 164, subparts A and E. For a history of the Privacy Rule, \n see infra \n Section II.B., “Regulatory History.”\n \n \n \n \n 3 \n  \n See also \n the <span class=\"match\">HIPAA Security Rule</span>, 45 CFR parts 160 and 164, subparts A and C; the HIPAA Breach Notification Rule, 45 CFR part 164, subpart D; and the HIPAA Enforcement Rule, 45 CFR part 160, subparts C, D, and E.\n \n \n \n \n 4 \n  45 CFR 160.103 (definition of “Protected health information”).\n \n \n \n \n"},{"title":"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program","type":"Rule","abstract":"This final rule will improve the electronic exchange of health care data and streamline processes related to prior authorization through new requirements for Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children's Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs). This final rule will also add new measures for eligible hospitals and critical access hospitals (CAHs) to report under the Medicare Promoting Interoperability Program and for MIPS eligible clinicians to report under the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS). These policies, taken together, will reduce overall payer and provider burden and improve patient access to health information while continuing CMS's drive toward interoperability in the health care market.","document_number":"2024-00895","html_url":"https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-08/pdf/2024-00895.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-00895.pdf?1705612517","publication_date":"2024-02-08","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"},{"raw_name":"Office of the Secretary"}],"excerpts":"not affect or alter any obligations under the HIPAA Privacy and Security Rules.\n \n \n \n 19 \n  See \n also \n the <span class=\"match\">HIPAA Security Rule</span>, 45 CFR parts 160 and 164, subparts A and C.\n \n \n \n While FHIR itself does not define security-related functions, when used in combination with appropriate security controls (such as authentication and access control), a FHIR API can and should be implemented and maintained to comply with the <span class=\"match\">HIPAA Security Rule</span>, at 45 CFR parts 160 and 164, subparts A and C, for secure data exchange.\n 20 \n \n Furthermore, a covered entity"},{"title":"Medicare and Medicaid Programs; CY 2025 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; Medicare Prescription Drug Inflation Rebate Program; and Medicare Overpayments","type":"Rule","abstract":"This final rule addresses: changes to the physician fee schedule (PFS); other changes to Medicare Part B payment policies to ensure that payment systems are updated to reflect changes in medical practice, relative value of services, and changes in the statute; codification of establishment of new policies for, the Medicare Prescription Drug Inflation Rebate Program under the Inflation Reduction Act of 2022; updates to the Medicare Diabetes Prevention Program expanded model; payment for dental services inextricably linked to specific covered medical services; updates to drugs and biological products paid under Part B including immunosuppressive drugs and clotting factors; Medicare Shared Savings Program requirements; updates to the Quality Payment Program; Medicare coverage of opioid use disorder services furnished by opioid treatment programs; updates to policies for Rural Health Clinics and Federally Qualified Health Centers; electronic prescribing for controlled substances for a covered Part D drug under a prescription drug plan or a Medicare Advantage Prescription Drug (MA-PD) plan under the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act); update to the Ambulance Fee Schedule regulations; codification of the Inflation Reduction Act and Consolidated Appropriations Act, 2023 provisions; updates to Clinical Laboratory Fee Schedule regulations; updates to the diabetes payment structure and PHE flexibilities; expansion of colorectal cancer screening and Hepatitis B vaccine coverage and payment; establishing payment for drugs covered as additional preventive services; Medicare Parts A and B Overpayment Provisions of the Affordable Care Act and Medicare Parts C and D Overpayment Provisions of the Affordable Care Act.","document_number":"2024-25382","html_url":"https://www.federalregister.gov/documents/2024/12/09/2024-25382/medicare-and-medicaid-programs-cy-2025-payment-policies-under-the-physician-fee-schedule-and-other","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-12-09/pdf/2024-25382.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-25382.pdf?1730492138","publication_date":"2024-12-09","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"Security Risk Analysis and SAFER Guides measures. On February 14, 2023, the National Institute of Standards and Technology (NIST) published updated guidance for health care entities implementing requirements of the Health Insurance Portability and Accountability of 1996 (<span class=\"match\">HIPAA) Security Rule</span> (45 CFR part 160 and subparts A and C of 45 CFR part 164). The guidance, NIST SP 800-66r2, provides information and resources to HIPAA-covered entities to improve their cybersecurity risk practices.\n 874 \n \n We also wish to alert readers of additional HHS resources"},{"title":"Medicare and Medicaid Programs and the Children's Health Insurance Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year 2025 Rates; Quality Programs Requirements; and Other Policy Changes","type":"Rule","abstract":"This final rule revises the Medicare hospital inpatient prospective payment systems (IPPS) for operating and capital-related costs of acute care hospitals; makes changes relating to Medicare graduate medical education (GME) for teaching hospitals; updates the payment policies and the annual payment rates for the Medicare prospective payment system (PPS) for inpatient hospital services provided by long-term care hospitals (LTCHs); and makes other policy- related changes.","document_number":"2024-17021","html_url":"https://www.federalregister.gov/documents/2024/08/28/2024-17021/medicare-and-medicaid-programs-and-the-childrens-health-insurance-program-hospital-inpatient","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-08-28/pdf/2024-17021.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-17021.pdf?1722960072","publication_date":"2024-08-28","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"Security Risk Analysis and the SAFER Guides measures. On February 14, 2023, the National Institute of Standards and Technology (NIST) published updated guidance for health care entities implementing requirements of the Health Insurance Portability and Accountability (<span class=\"match\">HIPAA) Security Rule</span> (45 CFR \n part 160 \n and subparts A and C of \n part 164; \n see also, most recently, 75 FR 40868 and 78 FR 5566). The guidance, NIST SP 800-66r2, provides information and resources to HIPAA-covered entities to improve their cybersecurity risk practices.\n 828 \n \n We"},{"title":"Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year 2024 Rates; Quality Programs and Medicare Promoting Interoperability Program Requirements for Eligible Hospitals and Critical Access Hospitals; Rural Emergency Hospital and Physician-Owned Hospital Requirements; and Provider and Supplier Disclosure of Ownership; and Medicare Disproportionate Share Hospital (DSH) Payments: Counting Certain Days Associated With Section 1115 Demonstrations in the Medicaid Fraction","type":"Rule","abstract":"This final rule will: revise the Medicare hospital inpatient prospective payment systems (IPPS) for operating and capital-related costs of acute care hospitals; make changes relating to Medicare graduate medical education (GME) for teaching hospitals; update the payment policies and the annual payment rates for the Medicare prospective payment system (PPS) for inpatient hospital services provided by long-term care hospitals (LTCHs); and make other policy- related changes. This final rule also revises our regulations on the counting of days associated with individuals eligible for certain benefits provided by section 1115 demonstrations in the Medicaid fraction of a hospital's disproportionate patient percentage (DPP) used in the disproportionate share hospital (DSH) calculation.","document_number":"2023-16252","html_url":"https://www.federalregister.gov/documents/2023/08/28/2023-16252/medicare-program-hospital-inpatient-prospective-payment-systems-for-acute-care-hospitals-and-the","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-08-28/pdf/2023-16252.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-16252.pdf?1690920924","publication_date":"2023-08-28","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"the Medicare Promoting Interoperability Program was developed in consultation with ONC. The SAFER Guides themselves are not intended to be used for legal compliance purposes, and implementation of a recommended practice does not guarantee compliance with HIPAA, the <span class=\"match\">HIPAA Security Rule</span>, Medicare or Medicaid Conditions of Participation, or any other laws or regulations. The SAFER Guides are for informational purposes only and are not intended to be an exhaustive or definitive source, nor do they constitute legal advice. Users of the SAFER Guides are"},{"title":"21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program","type":"Rule","abstract":"This final rule implements certain provisions of the 21st Century Cures Act, including Conditions and Maintenance of Certification requirements for health information technology (health IT) developers under the ONC Health IT Certification Program (Program), the voluntary certification of health IT for use by pediatric health care providers, and reasonable and necessary activities that do not constitute information blocking. The implementation of these provisions will advance interoperability and support the access, exchange, and use of electronic health information. The rule also finalizes certain modifications to the 2015 Edition health IT certification criteria and Program in additional ways to advance interoperability, enhance health IT certification, and reduce burden and costs.","document_number":"2020-07419","html_url":"https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2020-05-01/pdf/2020-07419.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2020-07419.pdf?1587500136","publication_date":"2020-05-01","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"7536), however, that while our proposed approach would be consistent with the regulation of security practices under the <span class=\"match\">HIPAA Security Rule</span>, the fact that a practice complies with the <span class=\"match\">HIPAA Security Rule</span> would not establish that it meets the conditions of the exception to the information blocking provision. We emphasized (84 FR 7536) that the <span class=\"match\">HIPAA Security Rule</span> and the proposed exception have different foci. The <span class=\"match\">HIPAA Security Rule</span> establishes a baseline by requiring certain entities to ensure the confidentiality, integrity, and availability of ePHI"},{"title":"Requirements Related to Surprise Billing; Part II","type":"Rule","abstract":"This document sets forth interim final rules implementing certain provisions of the No Surprises Act, which was enacted as part of the Consolidated Appropriations Act, 2021. These interim final rules implement provisions of the No Surprises Act that provide for a Federal independent dispute resolution (IDR) (Federal IDR) process to permit group health plans and health insurance issuers offering group or individual health insurance coverage and nonparticipating providers, facilities, and providers of air ambulance services to determine the out-of-network rate for items and services that are emergency services, nonemergency services furnished by nonparticipating providers at participating facilities, and air ambulance services furnished by nonparticipating providers of air ambulance services, under certain circumstances. The Department of Health and Human Services (HHS), the Department of Labor (DOL), and the Department of the Treasury (collectively, the Departments) are issuing these interim final rules with largely parallel provisions that apply to group health plans and health insurance issuers offering group or individual health insurance coverage and certified IDR entities, providers, facilities, and providers of air ambulance services. In addition to the interim final rules issued jointly by the Departments, this document also includes interim final rules issued by the Office of Personnel Management (OPM) to clarify how certain No Surprises Act provisions apply to health benefits plans offered by carriers under the Federal Employees Health Benefits (FEHB) Act. In addition to the interim final rules issued jointly by the Departments and OPM, this document includes interim final rules issued by HHS that address good faith estimates of health care items and services for uninsured or self-pay individuals and the associated patient-provider dispute resolution process. The HHS-only interim final rules apply to selected dispute resolution (SDR) entities, providers, facilities, and providers of air ambulance services.","document_number":"2021-21441","html_url":"https://www.federalregister.gov/documents/2021/10/07/2021-21441/requirements-related-to-surprise-billing-part-ii","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2021-10-07/pdf/2021-21441.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2021-21441.pdf?1633032929","publication_date":"2021-10-07","agencies":[{"raw_name":"OFFICE OF PERSONNEL MANAGEMENT","name":"Personnel Management Office","id":406,"url":"https://www.federalregister.gov/agencies/personnel-management-office","json_url":"https://www.federalregister.gov/api/v1/agencies/406","parent_id":null,"slug":"personnel-management-office"},{"raw_name":"DEPARTMENT OF THE TREASURY","name":"Treasury Department","id":497,"url":"https://www.federalregister.gov/agencies/treasury-department","json_url":"https://www.federalregister.gov/api/v1/agencies/497","parent_id":null,"slug":"treasury-department"},{"raw_name":"Internal Revenue Service","name":"Internal Revenue Service","id":254,"url":"https://www.federalregister.gov/agencies/internal-revenue-service","json_url":"https://www.federalregister.gov/api/v1/agencies/254","parent_id":497,"slug":"internal-revenue-service"},{"raw_name":"DEPARTMENT OF LABOR","name":"Labor Department","id":271,"url":"https://www.federalregister.gov/agencies/labor-department","json_url":"https://www.federalregister.gov/api/v1/agencies/271","parent_id":null,"slug":"labor-department"},{"raw_name":"Employee Benefits Security Administration","name":"Employee Benefits Security Administration","id":131,"url":"https://www.federalregister.gov/agencies/employee-benefits-security-administration","json_url":"https://www.federalregister.gov/api/v1/agencies/131","parent_id":271,"slug":"employee-benefits-security-administration"},{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"}],"excerpts":"Departments' audits as applicable. Furthermore, the 6-year timeframe matches the record retention requirements for certified IDR entities under these interim final rules as well as other record retention requirements under ERISA. These standards are also similar to <span class=\"match\">HIPAA Security Rule</span> requirements \n 43 \n \n under 45 CFR 164.310(d)(2)(i) and (ii), except that the Departments have tailored the requirements in section 26 CFR 54.9816-8T(e)(2)(v)(B)(\n 4 \n ), 29 CFR 2590.716-8(e)(2)(v)(B)(\n 4 \n ), and 45 CFR 149.510(e)(2)(v)(B)(\n 4 \n ) to apply to IIHI"},{"title":"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Interoperability and Patient Access for Medicare Advantage Organization and Medicaid Managed Care Plans, State Medicaid Agencies, CHIP Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, and Health Care Providers","type":"Rule","abstract":"This final rule is intended to move the health care ecosystem in the direction of interoperability, and to signal our commitment to the vision set out in the 21st Century Cures Act and Executive Order 13813 to improve the quality and accessibility of information that Americans need to make informed health care decisions, including data about health care prices and outcomes, while minimizing reporting burdens on affected health care providers and payers.","document_number":"2020-05050","html_url":"https://www.federalregister.gov/documents/2020/05/01/2020-05050/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2020-05-01/pdf/2020-05050.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2020-05050.pdf?1587503751","publication_date":"2020-05-01","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"},{"raw_name":"Office of the Secretary"}],"excerpts":"Response: \n We appreciate the commenters' concerns. As discussed in the CMS Interoperability and Patient Access proposed rule, the criteria and process for assessing unacceptable risk to a payer's system are part of the payer's responsibilities under the <span class=\"match\">HIPAA Security Rule</span> (84 FR 7635). The <span class=\"match\">HIPAA Security Rule</span> requires a covered entity to perform risk analysis as part of its security management processes.\n 35 \n \n HHS makes a number of tools available to assess risk.\n 36 \n \n Additional tools are available through the National Institute of Standards and Technology"},{"title":"Program of Comprehensive Assistance for Family Caregivers Improvements and Amendments Under the VA MISSION Act of 2018","type":"Rule","abstract":"The Department of Veterans Affairs (VA) adopts as final, with changes, a proposed rule to revise its regulations that govern VA's Program of Comprehensive Assistance for Family Caregivers (PCAFC). This final rule makes improvements to PCAFC and updates the regulations to comply with the recent enactment of the VA MISSION Act of 2018, which made changes to the program's authorizing statute. This final rule allows PCAFC to better address the needs of veterans of all eras and standardize the program to focus on eligible veterans with moderate and severe needs.","document_number":"2020-15931","html_url":"https://www.federalregister.gov/documents/2020/07/31/2020-15931/program-of-comprehensive-assistance-for-family-caregivers-improvements-and-amendments-under-the-va","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2020-07-31/pdf/2020-15931.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2020-15931.pdf?1596113119","publication_date":"2020-07-31","agencies":[{"raw_name":"DEPARTMENT OF VETERANS AFFAIRS","name":"Veterans Affairs Department","id":520,"url":"https://www.federalregister.gov/agencies/veterans-affairs-department","json_url":"https://www.federalregister.gov/api/v1/agencies/520","parent_id":null,"slug":"veterans-affairs-department"}],"excerpts":"medical information. We consider this comment outside the rulemaking, but note that VA has implemented security mechanisms, including access and audit controls, within VA's Veterans Health Information System Technology Architecture (VistA)/CPRS that comply with the <span class=\"match\">HIPAA Security Rule</span>. All staff with access to patient information are required, in the performance of their duties, to know their responsibilities in maintaining the confidentiality of VA sensitive information, especially patient information, by completing the annual Cyber Security and"},{"title":"Medicare Program; Revisions to Payment Policies Under the Physician Fee Schedule and Other Revisions to Part B for CY 2019; Medicare Shared Savings Program Requirements; Quality Payment Program; Medicaid Promoting Interoperability Program; Quality Payment Program-Extreme and Uncontrollable Circumstance Policy for the 2019 MIPS Payment Year; Provisions From the Medicare Shared Savings Program-Accountable Care Organizations-Pathways to Success; and Expanding the Use of Telehealth Services for the Treatment of Opioid Use Disorder Under the Substance Use-Disorder Prevention That Promotes Opioid Recovery and Treatment (SUPPORT) for Patients and Communities Act","type":"Rule","abstract":"This major final rule addresses changes to the Medicare physician fee schedule (PFS) and other Medicare Part B payment policies to ensure that our payment systems are updated to reflect changes in medical practice and the relative value of services, as well as changes in the statute. This final rule also finalizes policies included in the interim final rule with comment period in \"Medicare Program; CY 2018 Updates to the Quality Payment Program; and Quality Payment Program: Extreme and Uncontrollable Circumstance Policy for the Transition Year\" that address the extreme and uncontrollable circumstances MIPS eligible clinicians faced as a result of widespread catastrophic events affecting a region or locale in CY 2017, such as Hurricanes Irma, Harvey and Maria. In addition, this final rule addresses a subset of the changes to the Medicare Shared Savings Program for Accountable Care Organizations (ACOs) proposed in the August 2018 proposed rule \"Medicare Program; Medicare Shared Savings Program; Accountable Care Organizations--Pathways to Success\". This final rule also addresses certain other revisions designed to update program policies under the Shared Savings Program. The interim final rule implements amendments made by the SUPPORT for Patients and Communities Act to the Medicare telehealth provisions in the Social Security Act and regarding permissible telehealth originating sites for purposes of treatment of a substance use disorder or a co-occurring mental health disorder for telehealth services furnished on or after July 1, 2019 to an individual with a substance use disorder diagnosis.","document_number":"2018-24170","html_url":"https://www.federalregister.gov/documents/2018/11/23/2018-24170/medicare-program-revisions-to-payment-policies-under-the-physician-fee-schedule-and-other-revisions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2018-11-23/pdf/2018-24170.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2018-24170.pdf?1541438783","publication_date":"2018-11-23","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"report that they completed the actions included in the Security Risk Analysis measure at some point during the calendar year in which the performance period occurs. We stated our belief that the Security Risk Analysis measure involves critical tasks and noted that the <span class=\"match\">HIPAA Security Rule</span> requires covered entities to conduct a risk assessment of their health care organization. This risk assessment will help MIPS eligible clinicians comply with HIPAA's administrative, physical, and technical safeguards. Therefore, we stated that every MIPS eligible clinician"},{"title":"Patient Protection and Affordable Care Act; HHS Notice of Benefit and Payment Parameters for 2019","type":"Rule","abstract":"This final rule sets forth payment parameters and provisions related to the risk adjustment and risk adjustment data validation programs; cost-sharing parameters; and user fees for Federally- facilitated Exchanges and State Exchanges on the Federal platform. It finalizes changes that provide additional flexibility to States to apply the definition of essential health benefits (EHB) to their markets, enhance the role of States regarding the certification of qualified health plans (QHPs); and provide States with additional flexibility in the operation and establishment of Exchanges, including the Small Business Health Options Program (SHOP) Exchanges. It includes changes to standards related to Exchanges; the required functions of the SHOPs; actuarial value for stand-alone dental plans; the rate review program; the medical loss ratio program; eligibility and enrollment; exemptions; and other related topics.","document_number":"2018-07355","html_url":"https://www.federalregister.gov/documents/2018/04/17/2018-07355/patient-protection-and-affordable-care-act-hhs-notice-of-benefit-and-payment-parameters-for-2019","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2018-04-17/pdf/2018-07355.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2018-07355.pdf?1523304922","publication_date":"2018-04-17","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"}],"excerpts":"and security standards due to the operational requirements of the current direct enrollment processes and any potential future enhancements. This would include demonstrated experience with current National Institute of Standards and Technology (NIST) SP 800-53 or the <span class=\"match\">HIPAA Security Rule</span> standards, and the review of compliance with those standards. We proposed that auditors must also be capable of performing penetration testing on all interfaces that collect personally identifiable information or connect with HHS. We proposed to modify § 155.221(b)(2)"}]}