Little-Noticed HIPAA Regulations Create New Burdens for Employers

Transcription

1 Little-Noticed HIPAA Regulations Create New Burdens for Employers Earlier this month the federal government released new regulations which could affect an employer's health plans, if those health plans are subject to HIPAA's Privacy and Security Rule. These new regulations require health plans to certify that they comply with certain electronic transactions described in HIPAA's Standard Transaction Rule. Unfortunately, the new regulations contain significant ambiguity regarding which health plans, exactly, must follow this new rule. In addition, the new rules relate to -- and serve as a helpful reminder of -- a different health plan identifier requirement which will apply later in 2014 or, for certain small health plans, This identifier requirement will require many employers to act before November Both of these requirements are discussed in this Alert. Background on Standard Transaction Rules HIPAA's Standard Transaction Rules first became effective a little more than a decade ago. The Rules generally require hospitals, clinics and payors -- such as insurers and self-funded group health plans -- to use specified software when conducting certain electronic transactions (such as paying claims). The Rules have increased the efficiency of many health plan activities. Employer-sponsored group health plans are generally subject to the Standard Transaction Rules. However, most employers have little to do with these Rules. Instead, the insurers and TPAs for the plans generally conduct the Standard Transactions on behalf of the plans. Very few employers purchase software and conduct Standard Transactions themselves. New Requirement: Obtain an HPID by November 2014 / 2015 In a little-noticed regulation from September 2012, the Centers for Medicare & Medicaid Services (CMS) issued rules relating to unique health plan identifiers (called HPIDs in the regulations). These HPIDs are used in some Standard Transactions. Generally, each health plan in the United States will obtain an HPID from CMS. The HPID can then be used for Standard Transactions. Large group health plans must apply for their HPID by November 5, Small group health plans must apply by November 5, All health plans (regardless of size) must be able to use their HPIDs by November 7, 2016.

2 What is a Large or Small Group Health Plan? The new regulations do not specifically define when a plan is large or small. However, prior HIPAA guidance focused on the amount of claims paid by the plan (for self-funded plans) or premiums paid by the employer (for fully-insured plans). Specifically, the guidance provided: * Fully-insured health plans should use the amount of total premiums they paid for health insurance benefits during the plan s last full fiscal year; and * Self-insured plans should use the total amount paid for health care claims by the employer, plan sponsor or benefit fund, as applicable to their circumstances, on behalf of the plan during the plan s last full fiscal year. This guidance still appears to be valid and likely should continue to be used by employers. Note that the term fiscal year in this context likely refers to the plan year. We Have Very Minor Plans -- Like a Health FSA. Can We Ignore This Rule? The HPID regulations are not favorable to employers with regard to fully-insured major medical plans or minor health plans, such as health flexible spending accounts (Health FSAs), dental plans, vision plans, employee assistance programs (EAPs) and health reimbursement arrangements (HRAs). The HPID regulations do not contain any exception for such plans. We have informally discussed this with a government official, who confirmed that there is no exception for such plans.

3 Alliant Insight: This requirement is probably overkill for these minor plans. They rarely conduct Standard Transactions themselves, or through an insurer or TPA. Thus, arguably, there is little need for them to obtain an HPID. However, unless the law or regulations are relaxed, it appears that these plans must obtain an HPID -- even though they likely will never use it. (Note that major medical plans probably will use an HPID, so the regulation makes sense for these plans.) Employers should discuss this situation with their insurers and TPAs to determine if they can assist with the HPID process. The regulations discuss the process of obtaining an HPID. It will involve registering with a CMS website and applying for the HPID. Once an employer has obtained the HPID, it likely should provide it to its TPAs and insurers, in the event those entities need the HPID when conducting HIPAA Standard Transactions. Additional Requirement: Some Major Medical Plans Must Certify Compliance by 2015 / 2016 On January 2, 2014 the U.S. Department of Health and Human Services (HHS) issued an additional HIPAA regulation. This regulation implements a provision in the Affordable Care Act (ACA). This ACA rule requires that health plans certify that they comply with various Standard Transaction rules. This new certification requirement was supposed to have applied by December 31, However, because the regulations were delayed, HHS also delayed the effective date. The new effective date varies, depending on when the health plan receives its HPID (as discussed above). If the health plan receives its HPID before January 1, 2015, it must provide HHS with the certification of compliance by December 31, If the health plan receives its HPID on or after January 1, 2015, it must provide HHS with the certification within 365 calendar days of obtaining the HPID. Plans Subject to Certification Rule Which health plans must comply with the new rules? Unfortunately, this simple question has a complex answer. The ACA itself simply states that health plans must comply with the requirement. This suggests that all types of health plans -- major medical, dental, health FSA, HRA -- may have to comply. It also suggests that all health plans must comply, regardless of whether they are fully-insured or self-funded.

4 The new regulations do not specifically answer the question of which plans must comply. The regulations provide that a penalty will be assessed against a health plan only with respect to its major medical policies. This suggests that non-major medical benefits (likely including health FSA, dental, vision, EAP and wellness benefits) are not technically exempt from this requirement -- but non-compliance should result in no penalties. Also, the reference to "policies" suggests that self-funded major medical plans are exempt (because the term "policy" usually refers to a fully-insured plan). However, the preamble to the new rules muddies the waters because it notes that thousands of self-insured plans could be subject to the new rules. If self-funded major medical plans are exempt, this leaves only fully-insured major medical plans to comply with the rule. Insurance carriers themselves are subject to the rule (they are considered health plans under HIPAA). If so, it is possible that the insurance carriers' certifications of compliance will also cover their customers with fully-insured major medical plans. This seems logical, but the new regulations do not directly discuss this possibility. Thus, considerable ambiguity remains. Bottom Line: What to Do Now with Certification Rules. The new certification rules are only proposed. HHS will receive industry comments by March Hopefully these comments will cause HHS to clarify how these new rules apply to employer-sponsored group health plans. Employers should revisit this issue when HHS issues final regulations (probably later this year). Until the final regulations are released, employers likely should sit tight and not take any action yet with regard to the certification rules. Note, though, that doing nothing is not the recommended approach for the HPID rules, discussed earlier. Those rules are final and, for many plans, require compliance later this year. Thus, employers should not ignore those rules. Will We Need to Update our Business Associate Agreements Because of These New Rules? Alliant provides a model HIPAA business associate agreement to its clients. The current version of the business associate agreement contains language requiring business associates -- such as TPAs -- to comply with the Standard Transaction Rules. This model language should be sufficient, for now. However, keep in mind that the certification regulations are only proposed, not final, so there could be some changes in the future.

5 Also note that HIPAA does not require a business associate to assist a health plan in obtaining an HPID. But, the employer may still want the business associate to assist, to the extent possible. This assistance goes outside the scope of a typical business associate agreement. So, the employer may need to change the underlying service agreement with the business associate, if such assistance will be provided. Links to Further Guidance A link to the HPID regulations (and some technical corrections to the regulations) is here. A link to the certification regulations is here. Compliance Alert is presented by the Compliance Practice Group of Alliant Employee Benefits CA License No. 0C Alliant Employee Benefits, a division of Alliant Insurance Services, Inc. All rights reserved.