Early Start to Health Care Reform: Economic Stimulus Law Promotes Advances in Health Information Technology and Expands HIPAA Privacy Protections

President Obama got off to a quick start on his mission to change our nation's health care delivery and reimbursement systems. Although a delay in the appointment of a Secretary of the Department of Health and Human Services (DHHS) will delay the issuance of regulations and the implementation of changes, the enactment of two major legislative initiatives, and other changes signal that health care reform will be an early priority in the new administration.

Two Major Legislative Initiatives

The American Recovery and Reinvestment Act of 2009 (ARRA), the economic stimulus bill, establishes health care reform as a cornerstone of efforts to revive and endure an ailing economy. ARRA contains provisions that:

  • make the largest commitment ever - approximately $20 billion - to promote and advance the use of health information technology (Health IT) in the American health system;

  • halt various Medicare payment reductions scheduled for Fiscal Year 2009 for disproportionate share hospitals, hospice providers, and teaching hospitals; and

  • subsidize COBRA continuation health care coverage for unemployed workers, at an estimated cost of over $21 billion.

ARRA also substantially amends the Health Insurance Portability and Accountability Act (HIPAA) to expand privacy and security protections for personal health information.

At the same time, the recently enacted State Children's Health Insurance Program Act (SCHIP) extends and expands the federal government's support for state health care insurance programs for children.

Health IT

Acting on the belief that more effective digitalization of health care information will create jobs, cut costs, and save lives, Congress included provisions in ARRA that invest significant amounts to improve Health IT. These investments aim to:

  • develop the nationwide electronic exchange and use of health information in a secure, private, accurate manner, which may include updating and implementing the infrastructure necessary within different agencies of the DHHS;

  • integrate Health IT, including electronic medical records, into the initial and ongoing training of health professionals and others in the health care industry;

  • provide training on the dissemination of information on best practices to integrate Health IT, such as electronic records into a provider's delivery of care, including community health centers receiving assistance under Section 330 of the Public Health Services Act; 

  • develop infrastructure and tools for promotion of telemedicine, including coordination among federal agencies in the promotion of telemedicine;

  • promote the interoperability of clinical data repositories or registries; and

  •  improve and expand the use of Health IT by public health departments.

The DHHS, which is guiding the development and implementation of Health IT systems, will receive the ARRA funding through several of its agencies:

Office of the National Coordinator for Health Information Technology (ONCHIT) - ONCHIT will be the primary agency involved in the management of the Health IT and electronic health record (EHR) effort and shall receive $2 billion to fund certain initiatives addressed in ARRA. ONCHIT will assist in the development of a nationwide health information technology infrastructure, including standards, implementation specifications, and certification criteria, to facilitate the electronic use and exchange of information. ARRA also establishes a Health IT Policy Committee, consisting of both public and private stakeholders. This committee will provide recommendations on the framework of the infrastructure to be developed by ONCHIT. ARRA introduces a number of new programs to be administered by ONCHIT, such as:

  • grants to create regional health information technology and research centers to provide technical assistance and develop or recognize best practices to support and accelerate efforts to adopt, implement, and effectively utilize Health IT;

  • grants to assist health care providers to adopt, implement, and effectively use certified electronic health records technology that allows for the electronic exchange and use of health information; 

  • appointment of a Chief Privacy Officer to advise the national coordinator on privacy, security, and data stewardship of electronic health information and to coordinate with state and other agencies with respect to such issues;

  • the updating of the federal Health IT strategic plan for issues including the exchange of electronic health information, utilizing electronic health records by each person in the United States by 2014, and privacy and security protections for electronic health information; and

  • grants to states or qualified state-designated entities to facilitate and expand electronic health information exchange.

Health Resources and Services Administration (HRSA) - ARRA makes $2.5 billion available to HRSA, to be used as follows: $500 million for grants for health centers that are authorized under Section 330 of the PHS Act; $1.5 billion for construction, renovation, equipment, and acquisition of Health IT technology systems, including health center-controlled networks; and $5 million to address the shortage of health professionals by providing scholarships, loan repayment, and grants to training programs for equipment. ARRA authorizes competitive grants to medical, dental, and nursing schools to integrate Health IT into clinical education of health care professionals and to provide financial assistance to universities to establish or expand medical informatics programs. There are limits on the percentage of costs for which assistance can be granted and time limits on when grants must be received.

Centers for Medicare and Medicaid Services (CMS) - ARRA provides approximately $17 billion for Health IT initiatives through the Medicare and Medicaid reimbursement systems as incentive payments for providers and hospitals to adopt and use certified electronic health records, provided they can demonstrate they are "meaningful electronic health record (EHR) users."  Reimbursement to physicians and hospitals will start in 2011, and physicians and hospitals that wish to apply for reimbursement must have systems in place by 2011. Time is of the essence for physicians and hospitals not yet using Health IT who wish to receive an incentive payment for Health IT adoption. The incentive payments are significant for each physician, and decline by 1 percent each year a physician is not in the program. Eligible professionals will suffer penalties through reduced Medicare reimbursement payments if they do not become "meaningful EHR users" by 2015.

National Institutes of Health (NIH) - The NIH will receive $1.3 billion for initiatives related to Health IT, $1 billion of which will be designated for grants or contracts to construct, renovate, or repair existing non-federal research facilities. The NIH may use the additional $300 million to provide shared instrumentation and other capital research equipment to recipients of grants and contracts.  The NIH will also receive $8.2 billion for additional scientific research.

Agency for Healthcare Research and Quality (AHRQ) - AHRQ will receive $1.1 billion for the evaluation of clinical and practice effectiveness, as well as cost effectiveness.  AHRQ provides technical assistance and shares knowledge and findings to transform everyday clinical practice. ARRA also provides for development of a program for funding universities to establish multidisciplinary centers for health care information to generate innovative approaches to technology integration through cutting-edge, multidisciplinary research and Health IT development.

Indian Health Services (IHS) - IHS will receive $85 million under ARRA for Health IT technology activities that include telehealth services development and related infrastructure requirements. This grant can be awarded to American Indian tribes to establish loan programs for health care providers to purchase certified EHR technology, train personnel, and improve the secure electronic exchange of health information.


ARRA significantly expands HIPAA's privacy and security requirements to address what has been perceived as weaknesses in HIPAA's protection of personal health information (PHI). The law requires a new wave of HIPAA compliance efforts on covered entities and their business associates.  ARRA:

  • imposes most of the statutory privacy and security requirements, penalties, and enforcement rules that currently apply only to entities covered under HIPAA on business associates and their subcontractors. (Until now, these obligations have been imposed by contract between the covered entity and the business associate.)

  • written notice of certain types of breaches to DHHS and any individual affected by a breach;

  • tightens the minimum necessary rules;

  • expands an individual’s right to restrict certain uses and disclosures of PHI;

  • requires accountings of certain disclosures of electronic PHI for treatment, payment, or health care operations;

  • establishes additional rules regarding the unauthorized sale of PHI and an individual’s access to his or her own PHI maintained electronically; 

  • restricts the use of PHI for marketing purposes and requires a notice on fundraising materials to inform recipients how to opt not to receive future communications;

  • requires DHHS to issue annual guidance (starting in 2010) on the most effective and appropriate technical safeguards for purposes of maintaining the security of PHI;

  • authorizes State Attorneys General to bring enforcement actions (including a discretionary right of the court to award attorneys' fees); and

  • increases the civil monetary penalties under HIPAA and requires DHHS, within three years, to publish a regulation permitting individuals affected by a breach to receive a share of civil monetary penalties.

Effective dates vary. Most of the new security rules will take effect later this year (30 days after DHHS publishes regulations). Most of the new privacy rules will take effect one year from the date ARRA was signed into law, February 17, 2009. The new penalty and enforcement rules are effective immediately.

COBRA Continuation Health Coverage

ARRA aims to make health coverage more affordable for employees who lose their jobs by lowering the cost of COBRA coverage for many individuals. Any qualifying individual whose employment is involuntarily terminated between September 1, 2008, and December 31, 2009, and who is eligible for continuation coverage under COBRA because of the termination will be able to continue health coverage at only 35 percent of the ordinary COBRA premium for up to nine months. Employers (and, in certain cases, insurers) will subsidize the remaining 65 percent, but have the right to recover the subsidy amount from the federal government through a credit on their payroll tax deposits. 

For further information, see the Employee Benefits and Executive Compensation Group alert titled  Stimulus Package Modifies COBRA, HIPAA, And Other Welfare Benefit Provisions.


In addition to the extension of funding and eligibility limits, SCHIP also included significant changes to the CHIP program insofar as it relates to employer-sponsored benefits. Various details of those rules, which will allow states to pay part of the premiums for qualifying dependent coverage and may require employers to offer certain special enrollment rights, are still being worked out. We plan to address these matters in a future legal alert. 

Energy and Sustainability Incentives

Nonprofit medical institutions may qualify for a wide range of financial incentives included in ARRA relating to renewable energy, energy efficiency, and other sustainability solutions to energy and resource needs. ARRA provides new or greatly expanded forms of bond financing directly intended for, or that can be deployed to support, sustainability initiatives. Several loan and grant programs have been adopted or expanded as well. Tax incentives, such as investment tax credits and production tax credits, which are available to private developers, can help draw private capital to fund public-private partnerships. In addition, a number of provisions are aimed at assisting the recovery of bond markets and private finance markets by removing impediments to participation of certain classes of investors.

For further information on ARRA provisions relating to energy and sustainability incentives available for medical institutions, see the Energy and Project Finance Group alert titled American Recovery and Reinvestment Act of 2009: Will Hospitals Get an Energy Education and Universities Get an Energy Transfusion? For the bond provisions of the legislation, see the Public Finance Group outline by clicking here.

For further information on the topics covered in this legal alert, contact Jean C. Hemphill (hemphill@ballardspahr.com or 215.864.8539), Edward I. Leeds (leeds@ballardspahr.com or 215.864.8419), or any other member of Ballard's Health Care Group.

Copyright © 2009 by Ballard Spahr LLP.
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This newsletter is a periodic publication of Ballard Spahr LLP and is intended to alert the recipients to new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own lawyer concerning your situation and specific legal questions you have.