Cheat Sheet – 2024 and Beyond – Federal Health IT Compliance Deadlines

Download PDF

Price Transparency

Policy Compliance Date Description

Payer Price Transparency 1/01/2024 The Transparency in Coverage final rule was issued in November 2020 by the Department of Health and Human Services (HHS), the Department of Labor (DOL) and the Department of the Treasury (DOT). The rule requires most group health plans, and health insurance issuers in the group and individual market to disclose price and cost-sharing information to participants, beneficiaries, and enrollees. This includes giving consumers real-time, personalized access to cost-sharing information, including an estimate of their cost-sharing liability, through an internet based self-service tool. CMS Fact sheet here . The final rule is here .

An initial list of 500 shoppable services was required to be available via the internet based self-service tool for plan years beginning January 1, 2023. Starting in 2024, the remainder of all items and services are required to be listed online.

Hospital Price Transparency 1/01/2024-25 The Centers for Medicare & Medicaid Services’ (CMS) 2024 Outpatient Prospective Payment System (OPPS) final rule included provisions aimed at bolstering hospital price transparency. CMS fact sheet here. Final Rule here.

On March 28, 2024, CMS released a tool to validate price transparency file compliance.

• January 1, 2024 - Hospitals will be required to add a footer link to their homepage directing users to price transparency resources. A text file must be added to the root folder of the site, pointing to a download link of the current machine-readable file ( MRF).
• July 1, 2024 - A required schema for hospital MRFs (standardization). Addition of several new fields and accountability parameters.
• Jan 1, 2025 - Average expected allowed amount rates, and additional Part B reporting.

ONC HTI-1 Final Rule

Policy Compliance Date Description

Decision Support Interventions (DSI) Certification Criterion 12/31/2024 On December 13, 2023, HHS’ Office of the National Coordinator for Health Information Technology (ONC) finalized their Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule. Several fact sheets from ONC are available here . Final Rule here . See CHIME’s summary here .

Developers of Health IT Modules that are certified to current clinical decision support (CDS) criterion must update their health IT and provide the HTI-1 final rule predictive decision support (DSI) criterion to their customers to remain compliant with the Base EHR definition. Additionally, developers of Certified Health IT with a module certified to the Program must apply Intervention Risk Management (IRM) practices for each Predictive DSI it supplies as part of its Health IT Module and submit summary information to its ONC-ACB via publicly accessible hyperlink before this date

CDS Criterion Expiration & New Maintenance of Certification Requirements Begin 1/01/2025 Existing CDS criterion expires from the ONC Health IT Certification Program; Certified Health IT developers must comply with the Maintenance of Certification requirement adopted in the HTI-1 final rule. The DSI criterion will become the criterion required for healthcare providers to have health IT that continues to meet the Base EHR definition and thus be in a position to have “Certified EHR Technology” for the purposes of certain CMS programs.

Assurances Condition and Maintenance of Certification 1/01/2025 ONC has finalized an “Assurances” Maintenance of Certification requirement. Health IT developers must review and update source attribute information, risk management practices, and summary information provided.

USCDI v3 1/01/2026 USCDI Version 1 (v1) expires and USCDI v3 becomes the new data set baseline across applicable certification criteria.

CMS Interoperability and Prior Authorization Final Rule

Policy Compliance Date Description

Payer Interoperability 1/01/2026 CMS released their Interoperability and Prior Authorization Final Rule on January 17, 2024. Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs), (collectively “impacted payers”) are required to implement and maintain certain Health Level 7® (HL7®) Fast Healthcare Interoperability Resources® (FHIR®) application programming interfaces (APIs) to improve the electronic exchange of health care data, as well as to streamline prior authorization processes. Impacted payers must also implement certain operational provisions, generally beginning January 1, 2026. Final Rule here . Fact sheet here .

Patient Access API 1/01/2026 To facilitate care coordination and support movement toward value-based payment models, CMS is requiring impacted payers implement and maintain a Provider Access API to share patient data. They are also requiring impacted payers to report annual metrics to CMS about Patient Access API usage (March 31, 2026).

FHIR API 1/01/2027 CMS is requiring impacted payers to implement an HL7® FHIR® Patient Access API. And, they are requiring impacted payers to add information about prior authorizations (excluding those for drugs) to the data available via that Patient Access API.

Payer-to-Payer API 1/01/2027 CMS is requiring impacted payers implement and maintain a Payer-to-Payer API to make available claims and encounter data (excluding provider remittances and enrollee cost-sharing information), data classes and data elements in the USCDI and information about certain prior authorizations (excluding those for drugs).

New Promoting Interoperability Measure on Prior Authorization 1/01/2027 CMS is requiring impacted payers to implement and maintain a Prior Authorization API that is populated with its list of covered items and services, can identify documentation requirements for prior authorization approval, and supports a prior authorization request and response.

Promoting Interoperability Prior Authorization Measure 1/01/2027 CMS established a new electronic prior authorization measures for MIPS eligible clinicians under the MIPS Promoting Interoperability performance category and for eligible hospitals and critical access hospitals under the Medicare Promoting Interoperability Program. The measure will be under the Health Information Exchange (HIE) objective and will be a Y/N attestation.

CMS Appropriate Use Criteria Program

Policy Compliance Date Description

Appropriate Use Criteria Program Paused Indefinitely Per the CMS CY 2024 Physician Fee Schedule Final Rule, effective January 1, 2024, CMS has paused efforts to implement the Appropriate Use Criteria (AUC) program for reevaluation and rescinded the AUC regulations.

CMS fact sheet here. Final Rule here . AUC webpage here.

ePrescribing

Policy Compliance Date Description

CMS EPCS Program 1/01/2024 CMS’ 2024 Physician Fee Schedule Final Rule clarified that the CMS ePrescribing of Controlled Substances (EPCS) Program will automatically align with Part D e-prescribing standards. Medicare Part D has an existing electronic prescribing regulation that permits the use of either HL7 messages or the NCPDP SCRIPT standard to transmit prescriptions or prescription-related information internally when the sender and the beneficiary are part of the same legal entity while still maintaining the requirement for e-prescribing. Final rule here.

EPCS Part D for LTC Facilities 01/01/2025 Section 2003 of the SUPPORT Act mandates that the prescribing of a Schedule II, III, IV, or V controlled substance under Medicare Part D prescription drug plans (Medicare Part D) be done electronically in accordance with an electronic prescription drug program. Most mandates began on January 1, 2023 but there was a longer compliance period for long-term care (LTC) facilities which begins in 2025. CMS FAQs here .

Affordable Care Act

Policy Compliance Date Description

§ 1557 and Decision Support 6/05/2024 On May 6, 2024 HHS published a final rule concerning Section 1557 of the Affordable Care Act pertaining to nondiscrimination requirements including through the use of Patient Care Decision Support Tools. The rule also requires those covered by the rule to take steps to identify and mitigate discrimination when they use AI and other forms of decision support tools for care. HHS press release here. Final rule here.

HIPAA

Policy Compliance Date Description

HIPAA Privacy Changes to Support, and Remove Barriers to Coordinated Care and Individual Engagement TBD The Office for Civil Rights (OCR) previously proposed an update to the Health Insurance Portability and Accountability Act (HIPAA) rules to address barriers that limit or discourage coordinated care and case management (including care coordination challenges arising from the opioid crisis) among hospitals, physicians (and other providers), payers and patients, and to support (and remove barriers) the engagement of individuals with the healthcare system, or otherwise impose regulatory burdens. In 2021 the comment period was extended, and a final rule was delayed.

Privacy Rule to Support Reproductive Health Care Privacy ____ 12/23/24 On April 24, 2024 OCR issued a final rule intended to enhance the HIPAA Privacy Rule privacy protections for medical records and health information related to reproductive health. HHS press release here and fact sheet here . Final rule here.

The compliance date for this rule is December 23, 2024; however, for the specific requirements of 45 CFR 164.520 (related to privacy practices) in this final rule, entities must comply by February 16, 2026.

HIPAA Security Rule TBD OCR is expected to re-open the HIPAA Security Rule. The date targeted for release of a proposed rule is September 2024.

Provider Penalties for Information Blocking TBD On October 30, 2023 OCR released a proposed rule , 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking, that would establish a penalty structure for providers found to be information blocking. OCR has not yet published a final rule.

Distribution of Civil Monetary Penalties Stemming from HIPAA Settlements TBD In 2022 OCR issued a request for information to solicit feedback on proposals for the distribution of civil money penalty and monetary settlements with those harmed by a HIPAA offense and on proposals on some of the annual limits on civil money penalties (CMP) under the HITECH Act. Along with this RFI on CMPs, OCR also solicited feedback on enforcement discretion for impacted providers that utilize cybersecurity industry best practices.

SAMHSA’s Part 2 & Alignment with HIPAA 2/16/2026 HHS’ Substance Abuse and Mental Health Services Administration (SAMHSA) together with the OCR released a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”). The final rule brings the Part 2 program into closer alignment with HIPAA. It includes modifications to Part 2 involving patient consent, other uses and disclosures, penalties, Patient Notice requirements, and the creation of a safe harbor. Final rule here . SAMHSA press release here . HHS fact sheet here .

Telehealth

Policy Compliance Date Description

Telehealth Pandemic Flexibilities End 12/31/2024 The telehealth pandemic flexibilities are slated to end after December 31, 2024 unless further extended by Congress. These include:

• Geographic and originating site
• Audio-only coverage ends
• Waiver of in-person Medicare telemental services (except use of audio only for mental health as this was permanently changed)

A complete list of the policy changes that must be extended or made permanent after December 31 can be found here .

Opioid Treatment Programs Effective 4/02/2024, compliance date 10/02/2024 SAMHSA published a final rule to comprehensively update regulations governing Opioid Treatment Programs (OTPs) for access to methadone. While the final rule offers flexibility to certified OTPs, it does not apply to electronic prescribing of controlled substances more broadly through Drug Enforcement Administration (DEA) regulation. It allows initiation of treatment via telehealth, including methadone via audio-visual telehealth technology and buprenorphine via audio-only technology. It also makes permanent COVID-19 era flexibilities that expand eligibility for patients to receive take-home doses of methadone.

Press release here . Final Rule here .

Prescribing Controlled Substances via Telehealth 12/31/2024 The DEA is considering loosening their stance around EPCS over telehealth. The agency issued a proposal in February 2023 and received significant pushback from many stakeholders. Under their initial proposal, electronically prescribing controlled substances (schedule 2-5), including buprenorphine, via telemedicine would necessitate an in-person visit with a clinician for prescriptions for more than 30 days.

The DEA subsequently announced that they were extending the flexibilities to continue permitting e-prescribing of controlled substances using telehealth without the need for an in-person visit through December 31, 2024. Stakeholders are pressing DEA to continue allowing EPCS without an in-person requirement past this temporary deadline.