Executive Order Delay Trumps Administration Policy Development

President Trump’s first hundred days did not produce the event that most people in the cybersecurity community expected – a Presidential Executive Order supplanting or supplementing the Obama administration’s cyber policy – but that doesn’t mean that this period has been uneventful, particularly for those in the health care space.

The events of the period have cautioned us not to look for an imminent Executive Order. While White House cybersecurity coordinator Robert Joyce recently stated that a forthcoming executive order will reflect the Trump administration’s focus on improving the security of federal networks, protecting critical infrastructure, and establishing a global cyber strategy based on international law and deterrence, other policy demands have intruded. Indeed as the 100-day mark approached, President Trump announced that he has charged his son-in-law, Jared Kushner, with developing a strategy for “innovation” and modernizing the government’s information technology networks. This is further complicating an already arduous process for drafting the long-awaited executive order on cybersecurity, sources and administration officials say.

The Importance of NIST Has Been Manifested Throughout the Hundred Days

The expected cyber order likely will direct federal agencies to assess risks to the government and critical infrastructure by using the framework of cybersecurity standards issued by the National Institute of Standards and Technology, a component of the Department of Commerce.

The NIST framework, which was developed with heavy industry input and released in 2014, was intended as a voluntary process for organizations to manage cybersecurity risks. It is not unlikely that regulatory agencies, including the Office of Civil Rights of the Department of Health and Human Services, the enforcement agency for HIPAA, will mandate the NIST framework, either overtly or by implication, as a compliance hallmark and possible defense against sanctions.

NIST has posted online the extensive public comments on its proposed update to the federal framework of cybersecurity standards that includes new provisions on metrics and supply chain risk management. The comments are part of an ongoing effort to further revise the cybersecurity framework. NIST will host a public workshop on May 16-17, 2017

Health Industry Groups Are Urging NIST to Set up a ‘Common’ Framework for Cybersecurity Compliance

Various health care industry organizations including the College of Healthcare Information Management Executives and the Association for Executives in Healthcare Information Security have asked NIST to help the industry develop a “common” approach for determining compliance with numerous requirements for protecting patient data. Looking for a common security standard for compliance purposes, commenters also argue that the multiplicity of requirements for handling patient data is driving up healthcare costs. Thus, the groups urge NIST to work with the Department of Health and Human Services and the Food and Drug Administration “to push for a consistent standard” on cybersecurity. One expects this effort, given strong voice in the First Hundred Days, to succeed.

The Federal Trade Commission is Emerging as the Pre-eminent Enforcement Agency for Data Security and Privacy

With administration approval, the Federal Communications Commission is about to release today a regulatory proposal to reverse Obama-era rules for the internet that is intended to re-establish the Federal Trade Commission as the pre-eminent regulatory agency for consumer data security and privacy. In repealing the Obama’s “net neutrality” order, ending common carrier treatment for ISP and their concomitant consumer privacy and security rules adopted by the FCC, the result would be, according to FCC Chairman Pai, to “restore FTC to police privacy practices” on the internet in the same way that it did prior to 2015. Federal Trade Commission authority, especially with regard to health care, is not without question, especially considering that the FTC’s enforcement action against LabMD is still pending decision in the 9th Circuit. However, the FTC has settled an increasing number of the largest data breach cases The Federal Trade Commission’s acting bureau chief for consumer protection, Thomas Pahl, this week warned telecom companies against trying to take advantage of any perceived regulatory gap if Congress rolls back the Federal Communications Commission’s recently approved privacy and security rules for internet providers.

OCR Isn’t Abandoning the Field; Neither is DoJ

While there have been no signal actions during the First Hundred Days in either agency. The career leadership of both has signaled their intentions not to make any major changes in enforcement policy.  OCR is considering expanding its policies with respect to overseeing compliance programs and extending that oversight to the conduct off Boards of Directors.

The Supreme Court Reaches Nine

Many would argue that the most important, or at least most durable, accomplishment of the Trump Administration to date is the nomination and confirmation of Neil Gorsuch to the Supreme Court. Justice Gorsuch is a conservative in the Scalia mold and is expected to case a critical eye on agency regulatory actions. There is no cybersecurity matter currently on the Supreme Court’s docket, but there will be as the actions and regulations of agencies like the FTC, FCC and DHHS are challenged.

Congress is currently considering two bills that would dramatically alter the ways in which all federal agencies develop and publish rules. If enacted, both would create significant new obligations for agencies such as CMS and the FDA, expand the scope of judicial review of rules, and would increase the potential for political influence over the rulemaking process. Both bills passed the House on party-line votes, and are under consideration by the Senate.

The first bill, H.R. 5, would overhaul multiple phases of the federal rulemaking process. These proposed changes would make the rulemaking process significantly longer and more complex for agencies, and includes provisions that could prevent some rules from ever taking effect. The key provisions of the bill are summarized below:

  • Prior to publishing any rule (1) with an expected annual impact of $100 million or more, (2) that may reduce employment, or (3) that involves a novel legal or policy issue, an agency would have to publish an advance notice that it intends to publish a proposed notice of rulemaking, and must solicit comments on the notice. A proposed rule could only be published after this new additional process is complete.
  • Whenever an agency publishes a proposed rule for public comment in any of the categories described above, it would have to explain the basis for the rule, the data it relied on, and would have to explain the alternatives to the rule and justify why they were not adopted. In addition to the current public comment period, once a proposed rule was published an interested party could then request a hearing to contest the quality of the information relied on by the agency. Any resolution of this new step would slow down the rulemaking process further.
  • In all cases where a rule is expected to have an annual impact of at least $1 billion annually, the agency would now be required to conduct a public hearing limited to fact issues. This would add to the time and cost of publishing a new or revised rule.
  • When a final rule is published, the agency would be required to explain in the preamble to that rule why the rule will have the lowest possible cost unless it involves public health, safety, or welfare.
  • All agencies would be required to publish all documents considered by an agency prior to publishing the rule.  This would eliminate the deliberative process privilege that has been in place for decades, which is intended to promote the exchange of views within an agency, and may have a chilling effect on agency deliberation. In many cases, a final rule could not take effect until all of the information relied on by the agency had been made available electronically for at least six months unless the agency or the President claims an exception.
  • Recipients of federal funds would be prohibited from advocating for or against the rule, or appealing to the public to either support or oppose the rule.
  • Guidance documents issued by agencies, including manuals, circulars, and other subregulatory publications would no longer have any legal effect and could not be relied on by the agency for any actions. The bill does not explain how many important parts of federal programs, such as the administration of grants or cost accounting for hospitals in the Medicare program would be handled. These and other programs rely heavily on the detailed information found only in agency manuals and guidance. Without these guidelines, health care providers, suppliers, manufacturers, and researchers among others would find it increasingly difficult to comply with federal laws.

The bill would also make drastic changes in the scope of any judicial review of published agency rules. The bill would overturn the Supreme Court’s landmark Chevron decision, which established the principle that when an agency is charged with administering a statute and interprets ambiguous statutory language in a regulation, courts will defer to the agency’s permissible interpretation of the law. In its place, the bill would authorize courts to review all questions of law involving a regulation without giving weight to the agency’s experience or expertise. Courts would be empowered to impose their own constructions of the law on an agency, upending decades of precedents. This has the potential to increase federal courts’ dockets and place those courts in the position of reviewing technical information without all of the resources available to conduct a review. In addition, by allowing courts to decide cases without relying on the agency’s rationale, this increases the potential for inconsistent decisions and confusion among regulated entities such as health care providers, suppliers, and manufacturers seeking to comply with federal laws.

The second bill, H.R. 26, focuses more on expanding Congress’s control over the rulemaking process once an agency has completed the public notice and comment procedure under current law. It also expands the legislative veto over rules, which currently is authorized only when Congress disapproves of a rule and requires the President’s concurrence.

Under the bill, agencies would be required to report all new rules to Congress, and must identify all “major rules” as determined by the Office of Management and Budget that (1) will have an annual impact of $100M or more, (2) increases costs or prices, or (3) will have a significant impact on competition, employment, investment, or foreign trade. The report to Congress must also contain an analysis of the projected number or jobs that would be gained or lost as result of the rule. All major rules with the exception of those necessary for an emergency, enforcement of criminal laws, or to implement a trade agreement would not go into effect unless both houses of Congress approve the rule by a joint resolution within 70 legislative days after the agency submits its report. There is only one chance to obtain approval of a major rule during a session of Congress; if the joint resolution is not approved, or if no action is taken, the bill would bar Congress from considering a second resolution on the same rule during the same two-year session of Congress. This would allow Congress to override an agency and force the agency to begin the rulemaking anew, if at all. Congress would retain the authority to disapprove all other rules by a joint resolution. The bill also allows for judicial review of Congress’s actions only to review whether or not it followed the procedure in the statute; the merits of any action would be unreviewable.

In addition to expanding control over prospective rules, the bill would also add a sunset provision for existing rules. All agencies would be required to review current rules at least once every ten years and report to Congress; if Congress then failed to enact a joint resolution to retain the rules, they would be nullified.

Although the bills passed the House, it will be much harder for the Senate to pass them as well. Under Senate rules, 60 votes are required to end debate and bring the bills to a vote. Since the Republicans only hold 52 seats, they would need additional votes from Democrats in order for the bills to pass.

Stuart Gerson
Stuart Gerson

Today, the U.S. Supreme Court decided (6-2, with Kennedy writing for the majority and  Ginsburg and Sotomayor dissenting) the case of Gobeille v. Liberty Mutual Insurance Co.  The matter before the Court involved Vermont law requiring certain entities, including health insurers, to report payments relating to health care claims and other information relating to health care services to a state agency for compilation in an all-inclusive health care database. 

In an important victory for pre-emption advocates, the Court held that this law was pre-empted by The Employee Retirement Income Security Act of 1974 (ERISA) which expressly pre-empts “any and all State laws insofar as they may now or hereafter relate to any employee benefit plan.” And that includes any  state law that has an impermissible “connection with” ERISA plans, i.e., a law that governs, or interferes with the uniformity of, plan administration.  

In the context of this case pre-emption is necessary in order to prevent multiple jurisdictions from imposing differing, or even parallel, regulations, creating wasteful administrative costs and threatening to subject plans to wide-ranging liability. ERISA’s uniform rule design also makes clear that it is the Secretary of Labor, not the separate States, that is authorized to decide whether to exempt plans from ERISA reporting requirements or to require ERISA plans to report data such as that sought by Vermont. The Court went on to reject Vermont’s arguments about the lack of economic loss by Liberty Mutual or its traditional power to regulate in the area of public health. 

Finally, the Court held that ERISA’s pre-existing reporting, disclosure, and recordkeeping provisions maintain their pre-emptive force regardless of whether the newer Affordable Care Act’s reporting obligations also pre-empt state law.  

Supreme CourtWith the untimely passing of Supreme Court Justice Antonin Scalia, perhaps the best known and most controversial Justice on the Court, commentators, including this one, have been called upon to assess his legacy – both immediate and long term – in various areas of the law.

Justice Scalia was not known primarily as an antitrust judge and scholar. Indeed, in his confirmation hearing for the Court, he joked about what he saw as the incoherent nature of much of antitrust analysis. What he was best known for, of course, is his method of analysis of statutes and the Constitution: a literal textualism with respect to statutes and a reliance on “originalism” with respect to the Constitution.

Probably his most influential antitrust opinion was the 2004 decision in Verizon Communications Inc. v. Law Offices of Curtis V. Trinko LLP which limited antitrust plaintiffs’ ability to hold a company with monopoly power liable for failing to cooperate with rivals.

Taking a literalist view of the Sherman Act, Justice Scalia wrote that there was a good reason why Section 2 claims required a showing of anti-competitive conduct, not just a monopoly.

The mere possession of monopoly power, and the concomitant charging of monopoly prices, is not only not unlawful; it is an important element of the free-market system,” he wrote. “The opportunity to charge monopoly prices — at least for a short period — is what attracts ‘business acumen’ in the first place; it induces risk-taking that produces innovation and economic growth.

Thus, Justice Scalia fashioned a majority in holding that the competitive conduct of a monopolist that had earned its hegemony was not inherently suspect. This has come to be a dominant view generally in the antitrust field, but critics have argued that the decision entrenches power and judicial liberals who might succeed Justice Scalia could take a more restrictive, less literal view of the law.

In 1991, Justice Scalia led a majority in Columbia v. Omni Outdoor Advertising Inc., a case in which a competitor had claimed that an advertising rival and a municipality had conspired in passing an ordinance favoring the incumbent. In ruling against the plaintiff, Justice Scalia wrote that there was no “conspiracy exception” to Parker v. Brown, the 1943 Supreme Court case that established antitrust immunity for anti-competitive restraints imposed by state governments. On the other hand, in the recent North Carolina Dentists litigation with the FTC, Justice Scalia joined a majority that held the state action exemption did not apply to certain guild behavior where there was no active supervision by the state – again, a literalist approach.

Justice Scalia was influential in limiting class actions, enforcing arbitration agreements and requiring strict rules of pleading plausible causes of action. Cases like the antitrust actions in AT&T v. Concepcion and American Express v. Italian Colors, backing enforcement of arbitration agreements that blocked class treatment of claims, and the now often-cited cases of Twombley and Iqbal with respect to pleading currently rule the entry gate for large-case litigation, particularly antitrust.

For all of his conservative rulings, Justice Scalia was not a results-oriented judge determined to put antitrust plaintiffs in their place, I think that he would have argued that he was strictly neutral on the merits and didn’t care whether business prevailed or whether the class action plaintiffs prevailed. Whether, the conservative majority that adopted his methods will continue to hold, or whether some of these methods will be superseded by a more-elastic interpretive mode of judging will be at the forefront of the confirmation hearing of the next Justice.

Stuart M. GersonOn December 15, 2014, the Supreme Court of the United States decided Dart Cherokee Basin Operating Co. v. Owens, a class action removal case.

In short, the Dart case is welcome news to employers. Standards for removing a case from state to federal court have been an abiding point of concern for employers faced with “home town” class actions. In more recent times, this problem has become a point of interest to employers in health care and other industries that are beset by cybersecurity and data breach cases originating in state courts but calling for the application of federal privacy standards. Dart should help them substantially.

In the Dart decision, the Supreme Court held that a defendant seeking to remove a case from state to federal court – who must file in the federal forum a notice of removal “containing a short and plain statement of the grounds for removal”  pursuant to 28 U. S. C. §1446(a) – need include only a plausible allegation that the amount in controversy exceeds the jurisdictional threshold. The notice need not contain evidentiary submissions. Section 1446(a) thus tracks the general pleading requirement traditionally required by the Federal Rules of Civil Procedure.

The Dart decision also resolves a longstanding split among the Circuit Courts of Appeals, adopting the view of a majority of the lower courts while categorically rejecting the Tenth Circuit’s requirement that an evidentiary submission had to accompany the notice of removal under the Class Action Fairness Act.

Perhaps even more noteworthy than its rejection of any requirement to submit evidence in support of removal is the Supreme Court’s categorical refusal to imply any presumption against removal to federal court. Parties have been attempting to rely upon such a presumption, often with success, for years. The Supreme Court, however, has now made it clear that there is no basis in law for it and for that reason, coupled with the requirement that a party do no more than plausibly allege the jurisdictional amount in controversy, has substantially eased the burden on a defendant’s removal of a state court action to federal court.

For those who think that the judicial conservatives and liberals always vote in a bloc and that the conservatives are always pro-business, one notes that this arguably pro-business decision was authored by Justice Ginsburg, who was joined by the Chief Justice and by Justices Breyer, Alito, and Sotomayor.  Justices Scalia, Kennedy, Thomas, and Kagan were all in dissent. One also notes that the 5-4 split should not be taken as a sign of potential weakness in the majority opinion.  The four dissenters did not dwell on the merits; they simply believed that, for jurisdictional reasons, the issue decided was not properly before the Court.

Stuart M. GersonOnly last week, we informed you of the Supreme Court’s somewhat surprising grant of cert. in the Fourth Circuit case of King v. Burwell, in which the court of appeals had upheld the government’s view that the Affordable Care Act makes federal premium tax credits available to taxpayers in all states, even where the federal government, not the state, has set up an exchange.

The Administration has taken something of a PR buffeting in the week following, after its principal ACA technical advisor’s comments on this issue were made public.

In any event, we suggested that the scheduled DC Circuit en banc argument in Halbig v. Burwell, which raises the same issue as the King case, would never take place. We were correct. The DC Circuit yesterday stayed action in its case pending Supreme Court resolution of King. We’ll continue to follow related developments.

Speaking of the DC Circuit, a panel of its most liberal judges today upheld religious organization accommodation for contraceptive coverage under the ACA, holding under Hobby Lobby that opt-out procedure does not substantially burden employer’s religious beliefs. Priests for Life v. U.S. Dep’t of Health & Human Services. There will be similar cases brought in other federal circuits, and we’ll report on those as well.

Stuart M. GersonIn something of a surprise, the Supreme Court today granted certiorari in the Fourth Circuit case of King v. Burwell, in which the court of appeals had upheld the government’s view that the Affordable Care Act makes federal premium tax credits available to taxpayers in all states, even where the federal government, not the state, has set up an exchange. In doing so, the Supreme Court rebuffed the Solicitor General’s request that the Court decline cert. as various cases worked their way through the Courts of Appeals.

It was only a few days ago that the government had filed a brief in anticipation of the December 17 en banc oral argument in Halbig v. Burwell.  As you will recall, a DC Circuit panel held that the Affordable Care Act makes federal premium tax credits available to taxpayers only in states where the state has established an exchange – which is what the ACA literally provides.  On the same day, the Fourth Circuit issued a contrary decision in King v. Burwell, accepting the government’s argument that where HHS sets up an exchange in a state, that is a state exchange. The same argument is being made by the appellant (the government lost in District Court) in Oklahoma ex rel. Scott Pruitt v. Burwell, which is pending before the 10th Circuit.  Immediately following the contradictory decisions of DC Circuit and Fourth Circuit panels, the DC Circuit vacated the panel decision and set the case down for rehearing en banc.

It would now seem likely that all pending cases on the subject of the ACA tax credits will be stayed pending the decision of the Supreme Court, before which the King case will not be argued until early next year.

At issue is whether the program of tax credits applies only in exchanges set up by 16 states, and not at federally-run sites in 34 states. The Obama administration’s economic model for the ACA depends upon the tax subsidies being generally available and therein lies the significance of the case which puts a keystone element of the Affordable Care Act at risk.

By Stuart Gerson

As we noted in our various blogs and communications on the subject (HEAL Advisory and HEAL Blog), the United States Court of Appeals for the District of Columbia Circuit’s action today, to rehear in December the Halbig case (Halbig v. Burwell, D.C. Cir., No. 14-508 ), challenging  Obamacare subsidies in the federal health exchange, is not unexpected given the current makeup of the Court. This development now makes it more likely that the Supreme Court will not take action on the King cert petition (King v. Burwell, U.S. 4th Circuit , No. 14-1158) until after the DC Circuit decides the Halbig case, which will be argued on December 17th.  The DC Circuit’s likely action (either vacating the panel opinion or overturning it) also will erase the split in the circuits and thus make it less likely that there will be four SCOTUS  Justices who will vote to take the case.

By Stuart Gerson

In the wake of the Hobby Lobby ruling with respect to the Affordable Care Act’s contraceptive coverage mandate, the Administration (which already has taken steps to fund contraception for employees affected by their employers’ exemption) is attempting also to deal with the issue by a recently-published DHHS regulation setting forth the procedures that “religious” employers might follow to gain exemption from having to provide contraceptive coverage in their sponsored health plans. The proposed rule covers both religious not-for-profits and closely held religious for-profits.

The not-for-profit element has been spawned by religious employers, particularly Notre Dame University and the Little Sisters of the Poor Order, who have challenged the requirement that the ACA allows them to sign a form indicating their objection under a process that allows their employees to obtain contraceptives without the employer paying. These plaintiffs object even to signing the form, which they claim aids and abets the employees’ getting coverage.  The 7th Circuit ruled against them and they have petitioned for cert. The proposed reg would seem to moot the case as it provides that all the non-profit has to do is notify DHHS in writing and the government will do the rest.  One guesses that the plaintiffs won’t accept even this but that the Supreme Court will.

In the Hobby Lobby context  of closely held religiously motivated corporations, the proposed reg would treat them in the same way that non-profits would be treated, which the government believes would be the less-restrictive manner that the Supreme Court’s opinion would allow. The significant open question that remains is how to define how closely held such a company must be to qualify for the exemption. The proposed reg sets forth several possible definitions.

The public comment period runs until October 21.

 

Our colleague Stuart Gerson of Epstein Becker Green has a new post on the Supreme Court’s recent decisions: Divided Supreme Court Issues Decisions on Harris and Hobby Lobby.”

Following is an excerpt:

As expected, the last day of the Supreme Court’s term proved to be an incendiary one with the recent spirit of Court unanimity broken by two 5-4 decisions in highly-controversial cases. The media and various interest groups already are reporting the results and, as often is the case in cause-oriented litigation, they are not entirely accurate in their analyses of either opinion.

In Harris v. Quinn, the conservative majority of the Court, in an opinion written by Justice Alito, held that an Illinois regulatory program that required quasi-public health care workers to pay fees to a labor union to cover the costs of wage bargaining violated the First Amendment. The union entered into collective-bargaining agreements with the State that contained an agency-fee provision, which requires all bargaining unit members who do not wish to join the union to pay the union a fee for the cost of certain activities, including those tied to the collective-bargaining process. …

An even more controversial decision is the long-awaited holding in Burwell v. Hobby Lobby Stores, Inc. Headlines already are blasting out the breaking news that “Justices Say For-Profits Can Avoid ACA Contraception Mandate.” Well, not exactly. …

Both sides of the discussion are hailing Hobby Lobby as a landmark in the long standing public debate over abortion rights. It is not EBG’s role to enter that debate or here to render legal advice, but we respectfully suggest that the decision’s reach is already being overstated by both sides. In the first place, the decision does not allow very many employers to opt out of birth control coverage – only closely-held for-profit companies that have a good-faith ideological core, as clearly was the case for Hobby Lobby. That renders such companies functionally the same as non-profits that are exempted from the mandate by the government. Publicly-held companies are not affected by the decision (though some are likely to argue that Citizens United might require such an extension. Nor are privately-held companies that can’t demonstrate an ingrained belief system.

Read the full post here.