Chapter 22: Key U.S. Healthcare Regulations and Acts

Regulatory Landscape

This chapter provides a curated list of U.S. healthcare regulations shaping IT implementations, with brief descriptions and compliance implications.

Core Regulations

HIPAA (Health Insurance Portability and Accountability Act, 1996)

Privacy Rule: Protects PHI, patient rights (access, amendment, accounting of disclosures)
Security Rule: Administrative, physical, technical safeguards for ePHI
Breach Notification: Notify patients, HHS within 60 days of breach (>500 = immediate media notification)
Enforcement: OCR audits, penalties $100-$1.5M per violation per year

HITECH Act (2009)

Meaningful Use: EHR adoption incentives ($44K-$63K per provider over 5 years)
Breach Enforcement: Increased penalties, state AG enforcement authority
Business Associates: Extended HIPAA to BAs, BAA requirements

ACA (Affordable Care Act, 2010)

Coverage Expansion: Medicaid expansion, insurance marketplaces
Quality Programs: MACRA/MIPS for value-based payment
Price Transparency: Hospital price lists, provider directories (compliance 2021+)

21st Century Cures Act (2016)

Interoperability: Patient Access API (FHIR R4), provider directory, payer-to-payer exchange
Information Blocking: Prohibits practices that restrict data access (exceptions: privacy, security, fees)
ONC Certification: EHRs must support USCDI, FHIR APIs (enforced 2021+)

Interoperability Regulations

ONC Cures Act Final Rule (2020)

Patient Access API: Certified EHRs must support FHIR R4 API for patient apps (USCDI v1 minimum)
Provider Directory: Publicly accessible FHIR Practitioner/Location endpoints
Information Blocking: 8 exceptions (security, privacy, fees, performance, licensing, health IT performance, content/manner, infeasibility)
Certification: 2015 Edition criteria + USCDI, FHIR, SMART on FHIR

CMS Interoperability Rule (2020)

Patient Access API: Payers must provide FHIR API for claims/clinical data (by 2021)
Payer-to-Payer: Exchange data when patient switches plans (by 2022)
Provider Directory: FHIR-based provider directories for payers (by 2021)

TEFCA (Trusted Exchange Framework and Common Agreement, 2022)

QHINs: Qualified Health Information Networks for nationwide exchange
Common Agreement: Legal/technical framework for trust, security, patient consent
Rollout: Phased 2024-2027 (initial QHINs certified, expansion ongoing)

Payment & Quality Regulations

No Surprises Act (2021)

Balance Billing: Protects patients from surprise bills (emergency, out-of-network)
Good Faith Estimates: Providers must estimate costs for uninsured/self-pay
IT Impact: Price transparency tools, estimate calculators, claims adjudication updates

MACRA/MIPS (Medicare Access and CHIP Reauthorization Act, 2015)

MIPS (Merit-Based Incentive Payment System): Quality, cost, improvement, interoperability → payment adjustment (±9%)
APMs (Alternative Payment Models): Risk-sharing models (ACOs, bundled payments) for bonus payments
Reporting: EHR-based quality measure reporting, registry submissions

340B Drug Pricing Program

Purpose: Discounted drugs for safety-net providers (critical access hospitals, FQHCs)
IT Requirements: Track 340B purchases separately, prevent duplicate discounts (Medicaid)
Audit Readiness: HRSA audits, manufacturer disputes

Privacy & Security Regulations

42 CFR Part 2 (Substance Use Disorder Records)

Stricter than HIPAA: Special protections for SUD treatment records
Consent: Explicit written consent for disclosure (even to other providers)
2020 Updates: Aligned with HIPAA for care coordination, still stricter for many uses

21 CFR Part 11 (FDA Electronic Records/Signatures)

Scope: Electronic records for FDA-regulated activities (clinical trials, drug manufacturing)
Requirements: Validation, audit trails, electronic signatures, controls to prevent tampering
IT Impact: Clinical trial systems (EDC), manufacturing systems (MES), quality systems

21 CFR Part 820 (Quality System Regulation)

Scope: Medical device manufacturers
Requirements: Design controls, risk management, CAPA (corrective/preventive action), DHF (design history file)
IT Systems: Quality management systems (QMS), document control, complaint tracking

Stark Law / Anti-Kickback Statute

Stark Law: Prohibits physician self-referral for Medicare/Medicaid services (e.g., physician can't refer to own imaging center)
Anti-Kickback Statute: Prohibits remuneration for patient referrals
IT Implications: Donation of EHR/interoperability tech (safe harbors exist), data analytics arrangements

GINA (Genetic Information Nondiscrimination Act, 2008)

Protections: Prohibits health insurance/employment discrimination based on genetic information
IT Requirements: Extra consent for genomic data use, access controls, audit trails

Compliance Tips

Maintain Controls Catalog

Mapped Controls:

HIPAA Security Rule: Map 18 standards to implemented controls (encryption, access controls, audit logs)
HITRUST CSF: 19 domains, 156 control objectives → evidence (policies, screenshots, logs)
SOC 2: 5 trust service criteria → controls matrix with testing results

Evidence Management:

Centralized Repository: SharePoint, Confluence (policies, audit reports, training records)
Versioning: Track control updates, attestation history
Annual Review: Update for regulatory changes, new controls

Track Regulatory Updates

Monitoring:

ONC/CMS: Subscribe to updates (federalregister.gov, CMS.gov/regulations)
HHS OCR: HIPAA guidance, enforcement actions (hhs.gov/ocr)
HL7/Sequoia Project: Standards updates, TEFCA progress

Impact Assessment:

New Regulation: Assess impact (systems, processes, timeline)
Gap Analysis: Current state vs. requirements
Remediation Plan: Prioritize by deadline, risk, effort

Engage Legal/Compliance Early

Product Development:

Pre-Design: Consult legal on FDA pathway (SaMD classification), HIPAA requirements
Design Review: Validate privacy-by-design, informed consent, data minimization
Pre-Launch: Final compliance review, BAA templates, customer-facing docs

Deals & Partnerships:

RFPs: Legal review of compliance requirements, contract redlines (liability, data residency)
Partnerships: BAA for PHI access, IP ownership, audit rights

Conclusion

U.S. healthcare is heavily regulated across privacy (HIPAA, 42 CFR Part 2), interoperability (21st Century Cures, TEFCA), payment (MACRA, No Surprises Act), and safety (FDA 21 CFR Parts 11, 820). Maintain a controls catalog, monitor updates, and engage legal early in product/deal cycles.

Key Takeaways:

HIPAA/HITECH: Privacy, security, breach notification (OCR enforcement, up to $1.5M penalties)
21st Century Cures: Patient Access API (FHIR R4), information blocking rules (enforced 2021+)
CMS Interoperability: Payer APIs, payer-to-payer exchange, provider directories
TEFCA: Nationwide exchange via QHINs (rollout 2024-2027)
Compliance: Controls catalog (HIPAA/HITRUST/SOC 2), regulatory monitoring, legal engagement

Next Chapter: Chapter 23: Case Studies of Successful IT Implementations