What the Chevron Decision Could Mean for Healthcare Regulations Impacting Health IT

With the overturn of the Chevron decision by the US Supreme Court, many have been speculating what may happen with existing regulations that might fit the description of regulatory discretion by federal agencies acting under what they believed flexibility that they had under statutory purview. I will say up front - I am not an attorney, and I do not offer anything as legal advice. I am a CPA. But I have been around a lot of healthcare regulation impacting the use of Health IT in my long tenure at Cerner dealing with the regulatory requirements that needed to be enabled or supported through our products.

You may recall the Chevron decision established a principle that federal agencies could act with flexibility under their statutory authority from Congress as they understood it by applying their technical and administrative expertise to establish regulations for statutory implementation. This flexibility allowed agency discretion over matters that were not explicitly stated or limited by statute. A criticism of the Chevron principle was generally that agencies exceeded their statutory authority on occasions and required more by regulation than statute spelled out. One could say that rests with whether the regulatory agencies worked within purview (is it proper to defer to an agency to define the details of implementation through regulation when not stated by statute?) or beyond purview (is it proper that an agency defines requirements that operate at the edge of the vagueness that a statute may leave open?).

The Supreme Court decision broadly indicated it was the purview of the courts to determine if an agency acts appropriately within statutory purview. Now this does not seem to mean that courts must weigh in on regulatory developments before they are finalized, but it does mean that the courts seem to reserve for themselves the prerogative to decide such matters if there is a legal challenge to new regulations. An open question despite Chief Justice John Roberts's statement is whether such challenge will be made of existing regulations? Many observers believe that very possible . There already has been at least one circumstance where this has already happened. In Mississippi, a federal district court judge has used the Supreme Court decision as a basis to grant preliminary injunction to temporarily suspend the Biden Administration's access to health services related non-discrimination rule provisions related to gender under Section 1557 of the Affordable Care Act.

So just for fun (one must question my sense of fun), let's play out a few healthcare examples should they come under challenge for existing regulation.

First, how about the HIPAA Security Rule ? The HIPAA statute did not specify exactly what covered entities must do for compliance as to technical security measures. The statute only said that appropriate technical security measures should be adopted. It did not spell out which ones. It did not specify a specific level of encryption or integrity as was later done under the Health Information Technology for Economic and Clinical Health (HITECH) Act updates to HIPAA that included a safe harbor of sorts for breach notification if electronic Personal Health Information (PHI) was rendered unreadable, unusable, and indecipherable. But it did give the Secretary of Health and Human Services (HHS) the authority to recognize such methods that were required to be met if a covered entity was to avoid breach notification. So, what if this came under challenge? Would the courts then have to convene cybersecurity experts to determine if what the Secretary recognized was an appropriate exercise of authority? Would the courts subsume the Secretary's authority? Would then the courts have to come back to periodically rehear if technical security measures established as required by HHS were sufficient or in need of update? These are the kinds of things one could imagine possible taken to maybe not even an extreme.

Second, how about the authorities given to the Center for Medicare/Medicaid Services (CMS) to experiment with value-based payment model approaches to test for improvements in the way covered services are paid for under Medicare and Medicaid? This is an authority given to CMS under the Affordable Care Act that led to the creation of the Innovation Center . There has been a lot of experimentation with only some of it showing real benefit to the CMS programs in terms of cost savings and improved patient outcomes. One could argue that for the sake of some of the programs that have had mandatory participation aspects to them that the programs create regulatory burden to participants. If any given program was challenged such that the courts became involved in determining if the programs were burdensome or not functioning as designed, who would the courts turn to as the experts to determine this if not the agency itself? Would independent health economists and actuaries be called upon to weigh in?

And last, how about one of my favorites - Promoting Interoperability ? Now there were requirements defined in the original HITECH Act that was a part of the "Stimulus" law back in 2009 such as for interoperability, and for computerized provider order entry (CPOE), and the statute did lay out the provisions for provider payments under meaningful use. Further, the 21st Century Cures Act provided for successor provisions for much of what we have seen with the interoperability movement towards Application Programming Interfaces. And between the Medicare Modernization Act , and the various statutes that call for HIT certification, electronic prescribing standards have been an important element. However, not all certification requirements ONC has adopted, performance measurements for Promoting Interoperability CMS has implemented, or quality measurements CMS has adopted were defined by statute. These were things CMS and ONC developed working within statutory purview as they understood it. But what if stakeholders challenged certain provisions as burdensome or impractical or as of insufficient relevance or value? Would the courts then apply whatever expertise they sought to weigh in on what should or should not be an interoperability standard or a performance measurement for clinical outcomes or "use" of HIT?

I am only trying to lay out some things one could imagine becoming areas of challenge should challenges come for current regulations. I am not saying they will or that my examples are necessarily correct. But if such challenges could come, they may be plausible. So, I leave you with a couple of questions for food for thought:

• Are the courts the best convener of the kind of technical and administrative expertise that would develop the appropriate requirements that has been the purview of regulatory agencies for the last 40 years?
• Would it become necessary for regulatory agencies to "test" new regulations for passing muster with a judicial review before becoming final or effective?
• Will we see existing long adopted regulations come under challenge, and is it more beneficial to see something of long standing possibly undone with the uncertainty that creates or to leave such regulations stand?
• And last, is it appropriate to only allow agencies to undertake regulatory development where there has been a literal statement in statute that spells out what agencies may do, and that effectively demarks where authority does not go?

I leave you to decide. Have fun!

As always, you can engage me if you wish at [email protected] or in response to this post. I welcome better examples than mine of potential regulatory challenge or undoing!

#ONC #CEHRT #CuresAct #healthit #hit #ehr #hipaa #CMS #OIG #InformationBlocking #Medicare