On April 5, 2019, the Centers for Medicare & Medicaid Services (CMS) issued a final rule that updates the Medicare Advantage (MA or Part C) and Medicare Prescription Drug Benefit (Part D) programs by promoting innovative plan designs, improved quality, and choices for patients.
CMS took significant action to increase MA plan choices for the 2019 plan year and aims to continue to expand opportunities so that patients have access to MA plans that meet their unique health needs. In continuing the efforts to increase plan flexibility and plan choices for patients, CMS is finalizing additional flexibilities that will provide patients with more MA options and new benefits.
This fact sheet discusses the major provisions of the final rule (CMS-4185-F) that will implement certain provisions of the Bipartisan Budget Act of 2018, improve MA and Part D program quality and accessibility, and clarify program integrity policies. The final rule can be downloaded from the Federal Register at: https://www.federalregister.gov/public-inspection/.
Implementing the Bipartisan Budget Act of 2018 Provisions
CMS is implementing several sections of the Bipartisan Budget Act of 2018 (Public Law 115-123):
Section 50323 allows MA plans to offer “additional telehealth benefits” as part of the government-funded “basic benefits”;
Section 50311 requires increased integration of Medicare and Medicaid benefits and appeals and grievance processes for MA Dual Eligible Special Needs Plans (D-SNPs); and
Section 50354 requires the Secretary to establish a process to allow Part D plan sponsors to request standard extracts of Medicare Parts A and B claims data regarding their enrollees.
Medicare Advantage Plans Offering Additional Telehealth Benefits
The Bipartisan Budget Act of 2018 allows MA plans to include “additional telehealth benefits” (telehealth benefits beyond what Original Medicare allows) in their bids for the basic Medicare benefits, starting in plan year 2020. Under this final rule, MA enrollees may have great opportunities to receive healthcare services from places like their homes, rather than being required to go to a healthcare facility. MA plans will now have broader flexibility than is currently available in how they pay for coverage of telehealth benefits to meet the needs of their enrollees.
These changes will provide MA plans with the ability to offer expanded telehealth coverage to meet the needs of their patients. Patients in MA plans have always been able to receive more telehealth services than those in original Medicare, and with the final rule there is an even greater likelihood that these patients will have access to telehealth services from more providers and in more parts of the country than before, whether they live in rural or urban areas.
Integration Requirements for D-SNPs
CMS is finalizing new minimum criteria for Medicare and Medicaid integration in D-SNPs for contract year 2021 and subsequent years. Pursuant to the requirements in the Bipartisan Budget Act of 2018, we will require that D-SNPs meet the integration criteria either by, at a minimum, (1) covering Medicaid long-term services and supports and/or behavioral health services through a capitated payment from a state Medicaid agency; or (2) notifying the state Medicaid agency (or its designee) of hospital and skilled nursing facility admissions for at least one group of high-risk full-benefit dual eligible individuals, as determined by the state Medicaid agency.
Unified Grievance and Appeals Procedures for D-SNPs
CMS is finalizing rules to unify Medicare and Medicaid grievance and appeals processes for certain D-SNPs and affiliated Medicaid managed care plans. The processes will apply to D-SNPs with fully aligned enrollment and the affiliated Medicaid managed care organization, where one organization is responsible for managing Medicare and Medicaid benefits for all enrollees. In such D-SNPs, enrollees will have simpler, more straightforward grievance and appeals processes. The Bipartisan Budget Act of 2018 requires compliance with unified grievance and appeal procedures beginning in contract year 2021.
The FDA released guidance last year noting that electronic health records (EHRs) have the potential to improve clinical trials, leading to greater safety and efficacy. But tapping that potential, according to the agency, requires interoperability — the ability of two or more products, technologies or systems to 1) exchange information, and 2) to use the information that has been exchanged without special effort on the part of the user.
The healthcare industry, driven by meaningful-use requirements, is focused on wider efforts to promote interoperability. Many of them emphasize technology, including advances such as Fast Healthcare Interoperability Resources (FHIR) tools and Substitutable Medical Applications, Reusable Technologies (SMART) standards. But while the technology is crucial, it is equally as important to recognize the group of stakeholders who could play a critical role in making systems more interoperable, and thus improve the clinical trials process:
The patients themselves.
Interoperability
Interoperability has the potential to help increase care coordination, improve safety, support patients in making the most informed healthcare decisions, reduce costs, and help public health and health promotion efforts. In addition, interoperability can have a role in drug development, as the 21st Century Cures Act mandates that the FDA include Real-World Data (RWD) — data gathered during routine clinical care – in regulatory decision making. This RWD can be in part derived from the EHR-generated data, standardized and shared through the interoperability process.
The growing availability of information (digital health data is increasing by 48 percent each year) creates the potential for better patient care, including improved clinical trials. Unfortunately, despite strides made in interoperability, data in medical records are still too often packaged in ways (i.e., handwritten notes and medical device feeds) that are hard to share or standardized.
By Abhinav Shashank, CEO and co-founder, Innovaccer.
Abhinav Shashank
Articles on social media channels that carry a sense of apprehension regarding the future of our healthcare system sadden me. However, I learned a long time ago that you never win by arguing with the referee, and that the most logical way to react to apprehensions is to prove them wrong based on concrete evidence.
Building a sustainable model for care delivery is not a tough nut to crack as long as organizations have the right approach. If healthcare leaders can adapt to the constantly changing needs of providers and payers alike, they can steer their organizations towards a better future.
What if we already know all the answers?
Patient outcomes depend on a number of factors. I know cities with poor air quality have a higher percentage of patients with lung-related diseases than the green countryside. Similarly, patients who follow-up with their doctors more often usually take less time to recover from a problem as compared to less engaged patients.
Care management is one area I genuinely believe is an answer to a plethora of problems that surround our healthcare system. However, enabling a culture of managed care is easier said than done. To begin with, it is quintessential to make providers and patients believe in its very significance. This can be achieved by promoting patient engagement, streamlining referrals, increasing annual wellness visits, and regular follow-up meetings, among others.
Creating pathways for automated care management procedures
Baby boomers, millennials, middle-aged people, and kids? everyone has different needs and expectations. However, every patient longs for comfortable, connected, and cost-effective care.
Continuity of care is the key here. Care delivery is an end-to-end process. Care coordination and its various domains? transitional, chronic, and post-acute, among others? holds the potential to improve care and cost outcomes drastically. The more providers know about their patients, the easier it gets to impart care in a much more personalized and evidence-based manner.
Making things easier for patients shouldn’t come at the cost of frustrated providers. Provider and patient satisfaction are, in fact, interdependent. For instance, organizations should ensure that there are little or no skipped appointments and at the same time, calling patients to remind them of their scheduled meetings should be the least of providers’ concerns.
Medfusion announces a partnership with athenahealth, Inc. through athenahealth’s Marketplace program. As part of the athenahealth Marketplace, this newly integrated application is now available to athenahealth’s growing network of 120,000 healthcare providers, allowing patients to book appointments directly from a provider’s website — that fully conform to practice rules.
“Medfusion solutions simplify practice workflows and improve the patient experience,” said Kimberly Labow, Medfusion CEO. “We are excited to partner with athenahealth to accelerate the adoption of patient-and-provider-friendly patient self-scheduling solutions. By providing 24/7 access to scheduling—according to practice-defined rules — providers can fill schedule gaps, decrease call volume, attract new patients, and reduce no-shows.”
athenahealth is a network-enabled, results-oriented services company that offers medical record, revenue cycle, patient engagement, care coordination, and population health services for hospital and ambulatory clients. The company’s vision is to build a national health information backbone to help make healthcare work as it should. As a Marketplace partner, Medfusion joins a network of like-minded healthcare professionals who are looking to disrupt established approaches in healthcare that simply aren’t working, aren’t good enough, or aren’t advancing the industry and help providers thrive in the face of industry change.
Amazon announced that a version of their virtual assistant technology, Alexa, is now HIPAA-eligible. This means it’s available for applications that are subject to the data privacy and security requirements of HIPAA. The new HIPAA-eligible version of Alexa, specifically the Alexa Skills Kit, is now available to a limited number of developers by invitation only.
Why?
Amazon has seen increasing interest in Alexa’s potentialto serve as a virtual healthcare assistant. While devices like PCs, tablets, and smartphones have contributed to advances in healthcare, they’ve been problematic for some aspects of patient engagement – particularly among the elderly and others whophysically cannot – or will not – use them.
The idea of a smart, always-available, hands-free, voice-powered virtual assistant that can answer questions, deliver medication reminders, facilitate communication with one’s doctor, provide health coaching, and more, has piqued the interest of the healthcare community. Amazon has responded.
What’s different
Until now, Alexa’s use in healthcare has been mostly limited to questionanswering services – voice apps, or “skills” in Alexa parlance, that answer general questions about health conditions, treatments, symptoms, etc. Amazon Echo users, for example, canaccess health benefit information from a skill like Answers by Cigna, or tap into one of many symptom checkers in the Alexa marketplace. The big change is that Alexa can now be used in certain applications that collect and transmit protected health information (PHI).
Thisopensa whole new world of voice applications beyond basic Q&A, such as remote patient monitoring population health, medication adherence and clinical trial optimization. It seemed inevitable that voice assistants like Alexa and smart speaker-equipped devices like the Amazon Echo would find their way into clinical applications. Amazon’s announcement confirms this.
Beware
Organizations must understand the full range of issues surrounding the “what, why and how” of securing, voice-first healthcare applications. HIPAA is just the start. There is no formal certification process for HIPAA, and it applies only in the U.S.Also, many healthcare IT departments use other industry standards or ?have created their own standards for data privacy and security. In their eyes, completely securing a voice application may go well beyond ensuring that a service provider will sign a HIPAAbusiness associate agreement. Issues like user authentication, data privacy in shared spaces,network and device hacking, secure system integration (e.g. with an EHR), should all be addressed.Continue Reading
Get Real Health has been chosen by Microsoft as a destination for HealthVault users who will be moving their existing data after the pending retirement of HealthVault, announced on April 5. As personal health experts who have worked with the HealthVault platform since before it was publicly launched, Get Real Health was the logical choice to provide a secure future for all of the information currently gathered in HealthVault.
Robin Wiener
“This is like getting back to our roots—to the heart of what we do,” says CEO and president, Robin Wiener. “Connecting a client to HealthVault was how we first developed a passion for connected health and was the impetus for our shift away from professional services to creating patient engagement tools.”
By simply clicking on three buttons, HealthVault account holders will have data migrated to Get Real Health’s Lydia platform boasting enhanced features and usability. Some of the advanced features that HealthVault users will see in Lydia include:
Apple and Android native apps
A brand new sleek user experience
Connection to a growing number of health devices
The ability to upload health data from any doctor or hospital
Securely share all health data for your entire family
Access simply through Touch ID and (upcoming) Face ID
Continuity of using HealthVault credentials for Lydia login
“We have come a long way since those early HealthVault days,” explains Wiener. “We are excited to let these consumers see their data come to life with our app.”
All data will be available to individuals through the yourlifeyourdata.com website and Lydia Your Life Your Data from the Android and Apple app stores. Your Life Your Data is the mantra driving Lydia users to be able to interact with their personal health data in more dynamic ways. Tracking chronic disease, exercise, diet and health metrics will not only be easier but also have broader practical applications.
“We applaud Microsoft for launching HealthVault and launching millions of users on the journey to better health,” says Wiener. “Now we want to give those people even better tools to use that data in more meaningful ways to improve habits and overall wellness.”
Advancements in medical device technology has allowed for services, initiatives and changes in healthcare delivery to evolve at a break-neck pace. Smartphones are increasingly integrated into patient care planning, providing internet connectivity to share data to healthcare delivery organizations (HDO), doctors and researchers. It is unfortunately also true that as the medical treatment landscape has evolved, it has been challenged by cyber-attacks. While shows like Homeland have portrayed the vice president’s wireless pacemaker introducing a vulnerability that can be used in an assassination attempt, individual patient harm is not the common scenario HDOs and patients face.
Instead, as a recent report from Positive Technologies indicates, healthcare hackers seem motivated to seek sensitive information and control over a system, compared to stealing financial information, or even money. How does this motivation impact a defense strategy in the already complicated healthcare ecosystem?
Location of care delivery
Let’s begin by understanding the volume of the situation. The average hospital bed has 10 to 15 devices connected to it. With the American Hospital Association count of hospital beds above 6,000 in 2019, this is in the frame of 900,000 devices inside U.S. hospitals. These devices often have Bluetooth or wireless capabilities. An adverse player in the ecosystem can potentially exploit this connectivity with the intention to expand into the HDO network, hospital/device database or elsewhere.
Healthcare has been shifting outside of the HDO to accommodate increasing costs in care delivery, remote patient geography and to accommodate populations that are unable to access an HDO on an ongoing basis. These changes have been great for patients and providers, enabling ongoing monitoring of patients even when they’re not in the HDO. But it also means that some connected devices operate outside of the secured and monitored HDO network, while sending data back to providers within the HDO network. The introduction of these connection points also serve as the introduction of additional threat vectors that need to be managed.
Types of data available
It’s not immediately obvious what data used in clinical care could be used by hackers to elicit monetary benefit for themselves. The idea of a blood pressure or ECG reading doesn’t exactly bring dollar signs to mind.
HDOs and care providers regularly obtain patient social security numbers (SSN), which can be relevant for billing purposes, or in an attempt to share data between HDO systems. This same data can be used by a malicious actor to commit requests for loans, prescriptions or insurance claims, open bank accounts, perform online transactions and even file taxes or claim rebates. Imagine the SSNs from a pediatrician’s office being sold and the fraudulent activity going undetected for a prolonged period, or the SSN of a deceased person that can be used with zero concern for active monitoring by the individual.
Records can also include communication methods for patients, such as email and phone numbers, which can be used for spreading spam/malware with the intention of running phishing campaigns. This is to say nothing of personal distress that can be introduced if patient medical conditions are known by individuals without the patient’s best interest in mind.
Individuals who use commercial trackers to identify fitness patterns and metrics to discuss with providers have intentions of bringing more data to a potentially difficult diagnostics. However they are also capturing information that can be correlated to determine physical location. The army base location that was disclosed because of GPS-related workout data demonstrates how different types of information can appear unrelated, yet end up unintentionally giving something crucial away.
The threat of ransomware being used as a highly effective form of cyber terrorism has been receiving a lot of media attention lately. The story line stems from a recent Lloyds of London report that boldly states a large-scale ransomware attack could cost the global economy $193 billion and impact more than 600,000 businesses worldwide.
The report further speculates that if coordinated and executed properly, a global attack like WannaCry could cause even more severe damage and cost companies significantly more when you factor in all the business disruption and recovery related costs that would follow in the wake of a wide-scale attack.
With doomsday projections like these, it’s easy for people to become numb to the associated cyber security risks. Yet security professionals must always remain objective when assessing the scope of a threat versus the cost of implementing security measures to arrive at a risk-based recommendation.
What is ransomware terrorism?
Terrorism is broadly defined as the use or threat of violence that aims to spread fear in a population, and to advance a political, ideological or religious cause. Ransomware can be used in this context to disrupt the life of individuals and organizations, which depend on the smooth functioning of information technology to maintain operations.
While historically, the main goal of ransomware has been to extract, or extort, money or other valuable consideration from the affected party. NotPetya made us aware that there is a lot more damage an attacker could do with access to an army of computers spread across the globe than just turning them into bricks.
To prevent or avoid the consequences of an attack of terrorism, the defenders must effectively repel every single attempt to perpetrate the crime. Ultimately, the attackers only need to overcome the defenses once in any given situation to prevail.
Exploring the potential impacts of ransomware terrorism
In the proposed scenarios created by the Cyber Risk Management (CyRiM) project and Cambridge Centre for Risk Studies (CCRS), put forth in the report called, “Bashe Attack: Global infection by contagious malware,” a ransomware terrorist attack could be launched through an infected email, which once opened would be forwarded to all stored contacts.
Then within 24 hours, the malware could encrypt all data on 30 million devices worldwide. In the worst case scenario of the event, even the backups would be erased—meaning companies of all sizes would be forced to pay a ransom to decrypt their data or replace their infected devices.
It is easy to conceive that a ransomware attack on this scale would cause substantial economic damage to a wide range of business sectors through reduced productivity and consumption, inaccessible data files, IT clean-up costs, ransom payments and supply chain disruption.
The moral of the story according to Lloyds is that all businesses should pay close attention to systemic risk across all lines of business, not just within the silo of cyber and businesses should buy insurance to help protect against such catastrophic scenarios.
Medfusion 
Amazon 
