Health Law Advisor

More than just New Year’s resolutions went into effect when the clock struck midnight on January 1, 2023. The California Privacy Rights Act (“CPRA”) and the Virginia Consumer Data Protection Act (“VCPDA”) are now effective in California and Virginia, respectively. These comprehensive data privacy laws, along with three other state laws going into effect this year, establish new and complex obligations for businesses. If your business has not taken steps to prepare for these privacy laws, it is high time to start that process to avoid violations and enforcement likely to follow later in the year. See below for a timeline of key dates.

The regulatory environment at the US Food and Drug Administration (“FDA”) has a tremendous impact on how companies operate, and consequently data on that environment can be quite useful in business planning.  In keeping with the theme of these posts of unpacking averages, it’s important to drill down sufficiently to get a sense of the regulatory environment in which a particular company operates rather than rely on more global averages for the entire medical device industry.  On the other hand, getting too specific in the data and focusing on one particular product category can prevent a company from seeing the forest for the trees.

Recently, I was asked by companies interested in the field of digital medical devices used in the care of people with diabetes to help them assess trends in the regulatory environment.  To do that, I decided to create an index that would capture the regulatory environment for medium risk digital diabetes devices, trying to avoid getting too specific but also avoiding global data on all medical devices.  In this sense, the index is like any other index, such as the Standard & Poor 500, which is used to assess the economic performance of the largest companies in terms of capitalization.  My plan was to first define an index of product codes for these medium risk digital diabetes products, then use that index to assess the regulatory environment in both premarket and postmarket regulatory requirements.

It is certainly easy, when writing code to accomplish some data science task, to start taking the data on face value.  In my mind, the data can simply become what they claim to be.  But it’s good to step back and remember the real world in which these data are collected, and how skeptical we need to be regarding their meaning.  I thought this month might be an opportunity to show how two different FDA databases produce quite different results when they should be the same.

On December 1, 2022, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) published a bulletin warning that commonly used website technologies, including cookies, pixels, and session replay, may result in the impermissible disclosure of Protected Health Information (“PHI”) to third parties in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The bulletin advises that “[r]egulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of Protected Health Information (“PHI”) to tracking technology vendors or any other violations of the HIPAA Rules.” The bulletin is issued amidst a wider national and international privacy landscape that is increasingly focused on regulating the collection and use of personal information through web-based technologies and software that may not be readily apparent to the user.

In this episode of the Diagnosing Health Care Podcast:  In the aftermath of the Dobbs v. Jackson Women’s Health Organization decision, important questions have emerged about the current legal and regulatory landscape surrounding patient access to drugs that have historically been used to induce abortions.

How can health care providers and pharmacies navigate these new restrictions?

Effective November 16, 2022,  non-governmental health care entities must offer eligible employees continued employment for at least four months following a change in control without any reduction in their wages and benefits – including paid time off, health care, retirement, and education benefits in accordance with Senate Bill No. 315 (the Law). Change in control includes sales, transfers, assignments, mergers, and reorganizations and is deemed to “occur on the date of execution of the document effectuating the change.”

Interest in and acceptance of telehealth services continues to grow. Recent events, like the COVID-19 pandemic and the U.S. Supreme Court’s ruling in Dobbs v. Jackson Women's Health Organization, have put more pressure than ever on federal and state legislators to promote access to telehealth services.

However, the greater use of telehealth services also increases the potential for fraudulent behavior and enforcement activity. Providers should continue to monitor developments in federal and state laws, regulations, and policies to capitalize on telehealth opportunities while staying compliant with applicable laws.

Since 2016, Epstein Becker Green has researched, compiled, and analyzed state-specific content relating to the regulatory requirements for professional mental/behavioral health practitioners and stakeholders seeking to provide telehealth-focused services. We are pleased to release our latest compilation of state telehealth laws, regulations, and policies within the mental/behavioral health practice disciplines.

In this episode of the Diagnosing Health Care Podcast:  Following the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, some states have banned abortion in all or most circumstances and many more have enacted new restrictions or enforced old ones.

Announced in the Consolidated Appropriations Act of 2021, Rural Emergency Hospitals (REHs) will be a new type of Medicare provider starting January 1, 2023.  REHs are meant to help address the stressed health care system of rural providers by providing an option to closure for distressed critical access hospitals (CAHs) and small rural hospitals.

Existing CAHs and rural hospitals with fewer than 50 beds will be eligible to convert to an REH.  CMS is streamlining this process so that this conversion to be an REH can be accomplished through a change of information on an existing Medicare 855A enrollment rather than through a new provider application, which carries potentially significant delays and potential gaps in payment.  REHs are designed to provide primarily emergency department, observation, and outpatient services.  Because REHs will not provide inpatient care, an area that often creates a significant financial and operational burden on CAHs and small rural hospitals, REHs will allow locally-delivered healthcare to continue to be furnished by existing providers.

The motivation for this month’s post was my frustration with the techniques for searching the FDA’s 510(k) database.  Here I’m not talking about just using the search feature that FDA provides online. Instead, I have downloaded all of the data from that database and created my own search engine, but there are still inherent limitations in what the data contain and how they are structured.  For one, if you want to submit a premarket notification for an over-the-counter product, it really isn’t easy to find predicates that are specifically cleared for over-the-counter without a lot of manual work.

To see if I could find an easier way, I decided to use the database FDA maintains for unique device identifiers, called the Global Unique Device Identification Database (GUDID).  You can search that database using the so-called AccessGUDID through an FDA link that takes you to the NIH where the database is stored. That site only allows for pretty simple search, so for what I needed to do, I downloaded the entire database so I could work directly on the data myself.

While the UDI database is enormous at this juncture (over 3 million products), what I found left me with questions about just how comprehensive and complete the data are.  At the same time, it seems like a good way to supplement the information that can be gleaned from the 510(k) database.