Healthcare in Flux: Changes Are Likely on the Horizon for the Federal Healthcare Portfolio, in Areas Including Cybersecurity and in Regulatory Enforcement

November 27, 2024

Federal healthcare administration undoubtedly will look different in 2025 than it does as we close 2024.

In the aftermath of the Republican party victories during this month’s Federal elections – and if the past is prelude – the Federal focus concerning the healthcare sector will be shifting. We will move away from a Biden administration predisposition to engage in detailed regulatory and oversight processes, to a posture in a second Trump administration – much as in the first one – focused on deregulation and lesser agency engagement. And unlike in the first term of President Trump, the administration may be emboldened by jurisprudence such as the June 2024 Supreme Court Loper Bright v. Raimondo decision, which shifts the nature of courts’ deference to agency determinations, generally.

HHS and HIPAA Security Rule Enforcement

During the end of October, Mr. Oberfield (in his capacity as a member of the Federal 405(d) task group), attended a two-day Federal conference on healthcare cybersecurity, “Safeguarding Health Information: Building Assurance through HIPAA Security 2024”, (conference materials available here). Governmental presenters covered a variety of topics, including but not limited to the role of the Department of Health and Human Services in regulating healthcare providers’ adherence to data safety standards. The talk of the conference was a proposed omnibus regulatory update to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) security standards, including the October engagement Federal Office of Management and Budget in review.

Other topics on the agenda included medical device cybersecurity and several presentations from HHS divisions including its Office for Civil Rights. And on the heels of the conference, just before November OCR announced a number of enforcement actions concerning shortcomings it observed in health providers’ upstream risk analysis efforts (see. e.g., fines levied against Plastic Surgery Associates of South Dakota and Bryan County Ambulance Authority).

It is evident that the Republican victories could affect the rollout of various HHS priorities – including the completion of OMB’s review and the enforcement prerogatives of OCR. This would not be a surprise, to the extent the first Trump administration made the diminishment of regulation, generally, a key priority, including through the appointment of a regulatory reform task force, among other initiatives. Moreover, during President Trump’s first term, OCR focused on issues including objections by healthcare providers in performing certain duties on religious conscience grounds, occupying a space quite distinct from one focused on providers’ security rigor.  

Skilled Nursing is Just One of Many Arenas Likely to Shift in Trump Administration

The Security Rule is only one aspect of the Federal healthcare portfolio likely to see change come January 20th. In long term care, the outgoing Biden administration has focused on facility staffing as a patient safety vehicle for skilled nursing facilities. Relatedly, the Centers for Medicare and Medicaid Services (“CMS”) issued a final rule, introducing “minimum staffing standards” for the purpose of ensuring “safety and quality” of the services provided to residents of long term care facilities certified by Medicare and Medicaid. See 89 Fed. Reg. 40876, 40876 (May 10, 2024). The rule requires covered facilities to “meet or exceed a minimum of 3.48 hours per resident day for total nurse staffing including but not limited to—

(i) A minimum of 0.55 hours per resident day for registered nurses; and
(ii) A minimum of 2.45 hours per resident day for nurses[’] aides.”

The rule also requires these facilities to “ensure there are a sufficient number of staff with the appropriate competencies and skills set necessary to assure resident safety and to attain or maintain the highest practicable physical, mental and psychosocial well-being of each resident,” to be determined based on facility assessments. Id.

GOP Attorneys General[1] and various organizations commenced a judicial action in an attempt to invalidate the Minimum Staffing Rule under three theories:

(1) that CMS did not have statutory authority to promulgate the rule;

(2) that the rule contradicts congressional intent; and

(3) that the rule is arbitrary and capricious.

As to the first cause of action, asserting that CMS did not have statutory authority to promulgate the minimum staffing requirement rule, the plaintiffs argue that CMS, an agency created by statute, promulgated the rule without Congressional authority to do so, thereby violating the Administrative Procedures Act (“APA”) specifically as to the (a) requirement that long term care facilities “have a registered nurse onsite 24 hours per day, for 7 days a week,” and (b) quantitative staff-to-patient ratio for long term care facilities.

As to the second cause of action, asserting that the rule contradicts Congressional intent, the plaintiffs argue that the requirement of 24/7 registered nurse staffing set forth in the rule “rewrites” the minimum staffing requirement established by Congress, in addition to the scope of services performed by registered nurses. Plaintiffs also assert that the quantitative staff-to-patient (hours per resident per day) requirement is unlawful because it contradicts the qualitative statutory requirement that long term care facilities provide services “sufficient to meet the nursing needs of its residents.”

Concerning the third cause of action, asserting that the rule is arbitrary and capricious, the plaintiffs argue that by promulgating the rule, CMS deviated from its past practices of adhering to “the plain text of the Social Security Act” permitting nursing homes to determine their staffing requirements. Plaintiffs next argue that the minimum staffing requirement set forth in the rule exceeds the very minimum requirements set forth by “nearly all States,” ignoring the State governments that had already made subjective determinations on this issue that “reflect [each State’s respective] local conditions.” Finally, the plaintiffs argue that the rule is arbitrary and capricious because “it fails to consider the possibility that it is virtually impossible for LTCs to comply with the [r]ule.”

Plaintiffs are also seeking preliminary injunctive relief, to maintain the staffing requirement status quo as it was prior to the promulgation of the minimum staffing requirement rule. Oral argument is scheduled right around the corner, on Dec. 6, 2024.

Yet the results of the litigation may end up superseded by the Trump administration’s enforcement priorities, come 2025. Indeed, many in the long term care industry and in related fields see the staffing standards as ripe for a downshift during President Trump’s second term – which may render the litigation to be a sideline activity.

What’s Next

Bond is closely following the dynamics in agency enforcement attendant to the forthcoming leadership change in Washington – in HHS and beyond – and will continue to provide updates.

For more information, please contact Nicole K. Macris, Gabriel S. Oberfield or any attorney in Bond’s health care, cyber security and data privacy, government and regulatory affairs practice or the Bond attorney with whom you are regularly in contact.

[1] Attorneys General of Kansas, Iowa, South Carolina, Alabama, Alaska, Arkansas, Florida, Georgia, Idaho, Indiana, Kentucky, Missouri, Montana, Nebraska, Oklahoma, North Carolina, South Dakota, Utah, Virginia, and West Virginia. LeadingAge of Kansas, South Carolina, Iowa, Colorado, Maryland, Michigan, Minnesota, Missouri, Nebraska, New Jersey/Delaware, Ohio, Oklahoma, Pennsylvania, Southeast, Tennessee, Virginia.

View as PDF