a printer iconClick here for a printer-friendly version.

  1. HHS continues to assess penalties for HIPAA violations, including a $4.75 million settlement with a medical center over an employee’s sale of protected health information (PHI) to identity thieves. HHS also assessed penalties for failures to timely give individuals access to their health information.
    New HHS regulations strengthen the privacy of PHI relating to reproductive health care, such as by prohibiting disclosure of PHI to law enforcement investigating a patient for obtaining a lawful abortion in another state.1Updates to HIPAA policies and procedures were required by December 23, 2024, and updates to Notices of Privacy Practices are required by February 16, 2026.
  2. The DOL, HHS, and IRS (Departments) issued final regulations under Section 1557 of the Affordable Care Act (ACA), which prohibits discrimination in certain health programs and activities on the basis of race, color, national origin, sex, age, or disability.2 The 2024 version reinstates many of the 2016 regulation’s previously reversed protections (such as language taglines and protections against sexuality and gender identity discrimination) and expands it to cover third-party administrators and PBMs as well as health plans and insurers receiving federal financial assistance. The 2024 regulations have already seen challenges in court with portions of the rule currently on hold in specific states or nation-wide.3
    Meanwhile, participants continue to challenge plans’ coverage restrictions for infertility benefits4 and gender affirming care5under the statutory language of Section 1557 and similar sex-discrimination rules in Title VII.6
  3. The Departments finalized Mental Health Parity and Addiction Equity Act (Parity Act) regulations, which enhanced its non-quantitative treatment limitation (NQTL) requirements.7 Under the key requirements, each health plan must:

    • Cover a “core treatment” for each covered mental health condition and substance abuse disorder in every classification in which the plan covers one or more core medical conditions or surgical procedures.
    • Collect and evaluate data on each NQTL to assess the outcomes and impact of the NQTL on mental health and substance abuse benefits compared to medical and surgical benefits.
    • Perform a comparative analysis of each NQTL. The new regulations clarify the required content and impose deadlines for responding to agency requests.
    • Provide a certification by a Plan fiduciary that a service provider was prudently selected to perform the NQTL comparative analysis.

    The regulations are effective the first plan year beginning on or after January 1, 2025. However, the effective date for the “core treatment” and “data collection and evaluation” requirements is delayed until the first plan year beginning on or after 1/1/26.

  4. As we previously reported, a federal district court in Texas ruled that the United States Preventive Services Task Force (USPSTF) lacked authority to determine which services are covered by the Affordable Care Act’s preventive care mandate and invalidated all agency action implementing or enforcing the preventive care coverage requirements based on USPSTF ratings. On appeal, the Fifth Circuit agreed but narrowed the ruling to invalidate USPSTF-recommended preventive care coverage requirements only for the parties in that lawsuit.8 The Supreme Court has agreed to hear an appeal on this case.
  5. Several ERISA health plan fiduciaries were sued for fiduciary breach related to the cost of outpatient prescription drugs. Suits against Johnson & Johnson and Wells Fargo allege their health plans paid thousands of dollars per script for certain drugs that would cost a fraction of that price at a pharmacy. In both cases the plans prefunded prescription drugs through a trust (a VEBA), and the plaintiffs claimed the plans should have paid less for drugs. More litigation is expected, particularly given the plenary data that health plans must now publish.In the backdrop is a governmental focus on pharmacy benefit managers (PBMs), with which plans negotiate to set the price of outpatient drugs. Continuing a trend we previously observed, states have sued PBMs for the high cost of insulin and other drugs while the Federal Trade Commission sued the three largest PBMs, alleging that anticompetitive and unfair drug rebate practices resulted in higher insulin cost.
  6. Each January, employers send each employee a Form 1095-C to report the months in which the employee received ‘minimum essential’ health coverage from the employer’s health plan. Beginning in January 2025 (for 2024 forms), employers may send the form only upon request, so long as employees are notified (per IRS requirements) of their right to request it.9 Although the IRS has not yet issued their requirements for the notice, a companion law sanctions e-delivery.
  7. Under the Departments’ new preventive care guidance, health plans and insurers must cover, without cost-sharing, all in-network claims coded as preventive care unless they have individualized information the claim is not for preventive care. Plans’ claims processing systems must be updated to administer preventive care claims accordingly.
  8. Cybersecurity attacks on health data have increased significantly in recent years, with a 264% increase in reported ransomware attacks since 2018 resulting in multiple HHS enforcement actions and settlements with providers. The DOL has clarified that its 2021 cybersecurity guidance applies not only to retirement plans, but also health plans.
  9. Following Hurricanes Helene and Milton, the DOL and IRS extended certain deadlines for COBRA, HIPAA special enrollment, and claim, appeal, and external review for individuals affected by the storms, similar to extensions issued in response to COVID-19.10
  10. Interpretation and enforcement of the No Surprises Act (NSA) and transparency in coverage mandates continue to evolve, including a continued pause to the advanced explanation of benefits requirement and clarification of the requirements for plans’ cost-sharing tools.Final regulations on the Independent Dispute Resolution process under the NSA remain in flux following Fifth Circuit decisions upholding and vacating parts of the rule and the Fifth Circuit’s conclusion that the rule improperly requires arbitrators to give undue weight to the qualifying payment amount (QPA).11 In response, the Departments extended previously issued enforcement relief in connection with the calculation of QPAs and clarified other aspects of the NSA and rules restricting gag clauses in health plan contracts.
  11. The annual dollar limit on employee contributions to Flexible Savings Accounts (FSAs) increased from $3,200 to $3,300. The limit on Health Savings Account (HSA) contributions on self-only coverage increased from $4,150 to $4,300, and from $8,300 to $8,550 for family coverage. The age 55+ HSA catch-up limit remains at $1,000.
  12. The Patient Centered Outcomes Research Institute (PCORI) fee increased from $3.22 to $3.47 per covered life for plan years ending on or after October 1, 2024, and before October 1, 2025. The fee is due by July 31, 2025.

Not intended as legal advice.

  1. 89 Fed. Reg. 32,976 (April 26, 2024).
  2. 89 Fed. Reg. 37,522 (May 6, 2024).
  3. Texas v. Becerra, No. 6:24-CV-211-JDK, 2024 WL 4490621 (E.D. Tex. Aug. 30, 2024); Florida v. Department of Health & Human Services, No. 8:24-CV-1080-WFJ-TGW, 2024 WL 3537510 (M.D. Fla. July 3, 2024); Tennessee v. Becerra, No. 1:24CV161-LG-BWR, 2024 WL 3283887 (S.D. Miss. July 3, 2024).
  4. Berton v. Aetna Inc., No. 23-CV-01849-HSG, 2024 WL 869651 (N.D. Cal. Feb. 29, 2024) (denying health plan administrator’s motion to dismiss Section 1557 challenge to plan requirement for proof of infertility).
  5. Lange v. Houston Cnty., Georgia, 101 F.4th 793 (11th Cir. 2024) (Title VII ruling on plan exclusion of gender-affirming care); Kadel v. Folwell, 100 F.4th 122 (4th Cir. 2024) (Section 1557 ruling on plan exclusion of gender-affirming care). The Lange decision has since been vacated while the full Eleventh Circuit reviews the appeal. See Lange v. Houston Cnty., Georgia, 110 F.4th 1254 (11th Cir. 2024).
  6. See here and here for our articles noting both areas of burgeoning case law.
  7. 89 Fed. Reg. 77,586 (Sept. 23, 2024).
  8. Braidwood Management, Inc. v. Becerra, 104 F.4th 930 (5th Cir. 2024).
  9. See Paperwork Burden Reduction Act, Pub. L. No. 118-167 (2024); Employer Reporting Improvement Act, Pub. L. No. 118-168 (2024).
  10. 89 Fed. Reg. 88,642 (Nov. 8, 2024).
  11. Texas Medical Association v. United States Department of Health & Human Services, 120 F.4th 494 (5th Cir. 2024); Texas Medical Association v. United States Department of Health & Human Services, 110 F.4th 762 (5th Cir. 2024).