Although the nearly three-week government shutdown did real damage to the nation’s economy, it did have its bright side.  For three weeks those of us who scan the Federal Register for new regulatory issuances had time to catch up on our other work, even to relax a little.  But the federal government has been back in business for a week, and on October 24, 2013, the Department of Health and Human Services issued its first post-shutdown final rule:  Program Integrity: Exchange, Premium Stabilization Programs, and Market Standards; Amendments to the HHS Notice of Benefit and Payment Parameters for 2014.

The rule ties up a number of odds and ends that have been pending for some time.  It finalizes portions of the program integrity rule proposed in June, 2013,  much of which had gone final in August.  I blogged about the proposed rule here.  The regulation also finalizes interim final provisions of the 2014 HHS Notice of Benefit and Payment Parameters Rule published in March, 2011.

The rule is quite technical and is indeed concerned primarily with program integrity.  It provides for oversight of state-operated reinsurance and risk adjustment programs, state exchanges, qualified health plan issuers in the federally facilitated exchange, and enrollee satisfaction survey vendors.  The rule establishes requirements and standards for refunds where an exchange or QHP improperly applies advance premium tax credits or cost-sharing reduction payments, or assigns an enrollee incorrectly to the wrong plan variation or to a standard plan without cost-sharing reductions.

The rule includes provisions to align risk corridor calculations with the single risk pool and to provide an alternate methodology for calculating the value of cost-sharing reductions for reconciliation with estimated cost-sharing reduction payments made in advance.  It sets out procedures for the administrative review of QHP issuer sanctions (civil penalties and decertifications) in the federally facilitated exchange.  And finally, the regulation touches on a few issues not directly related to program integrity, such as establishing a special enrollment period for individuals who are harmed by enrollment in an inappropriate plan because of misconduct by non-exchange entities, such as navigators or agents and brokers.

The rule begins by amending several definitions in the section of the Public Health Services Act created by the Health Insurance Portability and Accountability Act and updated by the Affordable Care Act. The most important of these is the definition of “small employer,” defined as “an employer who employed an average of at least 1 but not more than 100 employees on business days during the preceding calendar year and who employs at least 1 employee on the first day of the plan year.”  Prior to 2016, states may substitute 50 for 100 employees.   Before the ACA and under the laws of some states, an employer with one employee could be treated as being in the individual market, but that is not true under the ACA.  The implementing departments continue to maintain that retiree-only plans are not group plans, since they include no current employees, and are thus not subject to the ACA.

The rule clarifies that for purposes of the guaranteed availability requirement, a group insurer is only required to market group products in a particular market segment — large or small group — rather than all group market products.  Insurers can discontinue products in one market segment without having to do so in both.  All non-grandfathered coverage in the individual or merged individual-small group markets must be offered on a calendar year basis as of January 1, 2015.  Many insurers have renewed 2013 policies into 2014.  When these policies expire during 2014, they will be followed by a prorated partial year policy ending on December 31, 2014, and then will go on a calendar year basis.

Under the guaranteed renewability requirement, a small (or large) employer has the right to renew or continue in force the coverage it purchased in the small (or large) group market, even though it has become a large (small) group because of an increase (or decrease) in employees.   However, provisions of the ACA that apply only to groups of a particular size, such as the premium rating or single risk pool requirements that apply only to small groups, would not apply to a small group that becomes a large group, even if it renews a small group product.

The Reinsurance, Risk Adjustment, And Risk Corridor Programs.

Taft-Hartley plans.  The rule changes or clarifies certain standards pertaining to the three premium stabilization programs: the reinsurance, risk adjustment, and risk corridor programs.  The preface observes that further changes are also in the works.  To alleviate the burden caused by the requirement of contributions for the three-year reinsurance program, contributions will be collected in two installments, one at the beginning of the year and another at the end.  HHS also states enigmatically that it intends to exempt “certain self-insured, self-administered plans” from the reinsurance contribution for the 2015 and 2016 benefit years.  This description would seem to include the Taft-Hartley plans, which have objected to being subjected to the reinsurance fee.

The preface reviews at some length the rules as to which entity must contribute to the reinsurance program when the coverage offered by a group health plan is partially insured and partially self-insured.  In this situation, the insurer owes the reinsurance contribution if it covers the major medical portion of the group plan.  The rule also addresses the question of which insurer is responsible for the reinsurance contribution where group health plan members are covered by more than one insurance policy which in combination constitute major medical coverage, but no one policy in itself constitutes major medical coverage.  In this situation, the insurer that offers coverage that constitutes the greatest portion of inpatient hospitalization benefits will be responsible for the reinsurance contribution.  In no instance should more than one insurer or self-insured plan be responsible for reinsurance contributions for the same covered life.

The rule next addresses oversight of state risk adjustment and reinsurance programs.   States can operate the ACA reinsurance program if they choose to do so while states that operate a state exchange can also run the risk adjustment program.  States that operate only a SHOP exchange may, for 2015 and later years, also operate their state’s risk adjustment program if they use a methodology that addresses risk selection in both the individual and small group markets.

The rule requires state reinsurance and risk adjustment programs, as well as entities that contribute to or receive payments from the reinsurance and risk adjustment programs, to maintain records for 10 years, the statute of limitations period for the False Claims Act.  Records may be maintained electronically.  They must be made available to federal oversight agencies on request.

State reinsurance programs must submit to HHS and make public a summary report of their activities every year.  They must also undergo an annual external audit.  The ACA prohibits states from using federal reinsurance payments for administrative expenses, and states must ensure that they do not do so.  State risk adjustment programs must submit an interim report to HHS on their activities for the first 10 months of the first benefit year to allow HHS time to determine whether to allow the state to continue to operate the program for the third benefit year.  Risk adjustment programs must also provide to HHS and the public a detailed annual summary report of their activities, including an external audit.

The rule clarifies how the risk adjustment methodology applies to the handful of states with community rating, which will use a “family tiering” (adult, one adult and one or more children, two adults, etc.) rating scheme rather than the standard ACA rating scheme based on age and number of family members.  This methodology is complex and will not be described here other than to say that it is part of the larger project of deriving a formula that will base risk adjustment transfers solely on the relative health risk of enrollee populations and exclude from consideration factors unrelated to risk.

The rule next turns to the risk corridor program.  It clarifies that stand-alone dental plans are not part of the program.  It also provides that, consistent with the single risk pool requirements of the ACA, insurers must allocate their allowable costs and administrative expenses pro rata across all of their non-grandfathered plans in the relevant market (nongroup or small group) in a state on the basis of premiums earned for purposes of the risk corridor program.  QHPs must maintain documents and records sufficient to evaluate their compliance with risk corridor requirements for at least 10 years.

The risk adjustment and reinsurance programs depend on insurers providing HHS access to secure masked enrollee-level plan enrollment information and enrollee claims or encounter data on the issuers’ own servers and adhering to reinsurance and risk adjustment data submission requirements when HHS is itself operating these programs in a state.  HHS must be given access to risk adjustment data by April 30 of the year following the benefit year.  HHS itself will not store any personally identifiable enrollee or individual claim-level information except when conducting data validation or audits.   This scheme presents a problem, however:  What happens if an insurer fails to cooperate with data requirements?

HHS has the authority to impose civil money penalties on noncompliant insurers, although here as elsewhere, HHS intends to work collaboratively with insurers to ensure compliance and will scale penalties to the seriousness of the violation.  In particular, HHS intends not to impose civil penalties on insurers that make good faith efforts to comply with requirements during 2014, the first year of program operation.

If an insurer fails to submit reinsurance claim information, it simply will not receive reinsurance payments, which in itself will be a serious sanction if the insurer were otherwise qualified for the payments.  If an insurer fails to provide access to risk adjustment data, however, this could skew the program if the insurer would otherwise have owed risk adjustment payments.  HHS will thus impose a default risk adjustment charge on noncompliant insurers.  This charge will be based on the insurer’s actual enrollment, determined from MLR or risk corridor data, or from other reliable data from a state Department of Insurance.  HHS has not yet determined the amount of the charge per enrollee, but is considering a charge two standard deviations above the mean or the highest charge that any other insurer in the risk pool was charged.

Error remedies.  The rule next addresses the problem of what action to take if an exchange that handles premium payments from enrollees fails to reduce an enrollee’s premium payment by the amount of the advance premium tax credit to which the enrollee is entitled.  In this situation, the exchange must refund the excess premium collected within 45 days of discovery of the underpayment if the enrollee requests a refund, but in the absence of such a request may apply the amount to monthly premium payments owed for the rest of the benefit year until the amount is fully repaid.  If the exchange has overpaid an insurer, it is responsible for recouping the overpayment from the insurer.

The final rule tweaks earlier exchange special enrollment period rules. Specifically, a special enrollment period of 60 days is created for a qualified individual when misconduct by a non-exchange entity (such as a navigator, certified application counselor, insurer conducting direct enrollment, or agent or broker) causes the individual to be enrolled incorrectly or inappropriately such that the individual is not enrolled in QHP coverage or not in the QHP selected, or does not receive premium tax credits or cost-sharing reduction payments for which the individual is determined eligible. The special enrollment period is only available if the consumer is harmed by the misconduct.  This special enrollment period is also available to SHOP exchange enrollees.

The rule subjects state exchanges to program integrity requirements similar to those imposed on other entities.  Exchanges must keep an accurate account of receipts and expenditures and file a variety of reports with HHS, including an annual independent audit, a summary of which must be made public.  State exchanges must also maintain records for at least 10 years and make them available to federal oversight entities on request.

Insurers in the individual market and in merged individual and small group markets may only update their market-wide adjusted premium rate and plan-specific pricing on an annual basis.  Insurers in the small group market may update their rates and premiums quarterly, but only once the federally facilitated SHOP exchange has the capacity to accommodate quarterly updates, currently expected in the third quarter of 2014.  Insurers in the individual market can only introduce new products on an annual basis for January 1 of each year.

QHPs in the federally facilitated exchange that undergo a change of ownership must report the change at least 30 days prior to the date of the change.

If a QHP insurer mistakenly assigns an individual who qualifies for cost-sharing reduction payments to the wrong plan variation or the standard silver plan such that the individual fails to receive cost-sharing reductions to which the enrollee is entitled, the insurer must notify the enrollee and refund any excess cost sharing paid by or for the enrollee to the enrollee or provider, as appropriate, within 45 days.  On the other hand, if the insurer erroneously assigns the enrollee to a plan with greater cost-sharing reduction than that which is appropriate, the insurer cannot collect reimbursement from the federal government or recoupment from the enrollee or provider if the overpayment was due to the insurer’s error.  The insurer must also reassign an improperly assigned enrollee to the correct cost-sharing variation plan.  If the enrollee does not request an immediate refund, the insurer may credit the funds due the enrollee to reduce premiums over the remaining months of the benefit year.  Insurers can rely on exchange determinations and will not be penalized for exchange errors or enrollee misrepresentations.

If a QHP discovers that it failed to reduce an enrollee’s premium to take account of an advance payment of a premium tax credit, the insurer must return the overpayment at the enrollee’s request within 45 days.  If the enrollee does not request immediate repayment, the insurer may apply the refund to reduce the premium the enrollee owes over the remaining months of the plan year.

QHPs must make annual reports to HHS with summary statistics as to the application of cost-sharing reduction payments and premium tax credits, including reporting of the failure to adhere to standards. The rule also imposes upon QHPs participating in the exchange the 10 year record maintenance requirement.  The rule provides for HHS compliance reviews for insurers in the federal exchange and for extensive procedures for administrative review of QHP issuer sanctions (civil money penalties and decertifications) in the federal exchange.   Insurers must file a monthly report, the HIX 820, that will reflect any funds owed to the insurer by the federal government or owed by the insurer to the government.  Any discrepancies in these reports must be reported within 15 days of the time they are identified.

Much of the preface to the rule and the rule itself is consumed with the description of a “simplified methodology” for reconciling advance cost-sharing reduction payments to insurers with plan expenditures.  Under the standard methodology, every claim would essentially be processed twice, once with and once without the cost-sharing reduction, and the government and reconciliation would be based on the actual difference in cost.   Under the simplified methodology, insurers calculate the amount of cost sharing that enrollees would have paid without the reductions by using formulas based on certain summary cost-sharing parameters—such as deductibles, coinsurance, and the effective claims ceiling, applied to the total allowed costs of each policy.  The “simplified methodology” is in fact very complicated, but apparently much less expensive to apply than the standard methodology.  It will be available to issuers for benefit years 2014 to 2016, after which they will need to adapt to the standard methodology.

Finally, the rule provides for the establishment of standards for enrollee satisfaction survey vendors.  The ACA requires exchanges to provide information on QHP enrollee satisfaction surveys.  The obligation to provide this data has been delayed and to date very little information has been released as to how these surveys will be conducted.  The rule provides for annual contracts and does specify that the hope is that there will be multiple vendors from whom the QHPs can choose.  The preface does note that HHS will provide satisfaction surveys in at least English, Spanish, and Chinese and that the satisfaction survey will likely be modeled on the CAHPS® 5.0 Health Plan Survey.

Problems with and resources.  Like everyone else, I continue to be frustrated at the difficulties experienced by the website.  HHS has announced that it has identified the problems with the website and has a “punch list” which it is working on fixing. It expects the website to continue to improve and to be more or less fully operational by the end of November, hopefully in time for the December 15 deadline for applying for coverage January 1, 2014. I have found particularly useful in following developments Bob Laszewski’s Healthcare Policy and Marketplace Review blog and Sarah Kliff’s reporting at the Washington Post’s WonkblogDan Diamond’s Daily Briefing Blog at the Advisory Board Company also provides regular updates on exchange enrollment data.

Enrollment deadline to avoid individual mandate penalty.  I conclude by mentioning a couple of current legal issues.  First, there is still confusion as to whether the deadline for enrollment to avoid the individual responsibility requirement for 2014 can or has been extended.  I have heard within the past 24 hours that it has been extended to March 31, that it always was March 31, and that no decision has been reached.  My understanding continues to be that the ACA requires enrollment by February 15, but that HHS has the discretion to extend the deadline if necessary.  I will pass on guidance as soon as it becomes available.

HIPAA misunderstandings.  Second, at the October 24, 2013, House Energy and Commerce Committee hearings an issue arose in questioning of contractors by Representative Blackburn as to whether government contractors had improperly obtained access to information protected by the Health Insurance Portability and Accountability Privacy Rule.  This line of questioning seems to have been based on a misunderstanding of HIPAA.

First, HIPAA only deals with personally identifiable health information.  It is arguable that the federal exchange contains no health care information, as health status is irrelevant to the determination of eligibility for enrollment in a qualified health plan or for eligibility for premium tax credits or cost-sharing reduction payments.  To the extent, however, that the exchange collects information relevant to the payment for health services, this information may be considered personally identifiable health information even though it includes no actual health information.

A second question is whether the federal exchange is a covered entity under HIPAA.  It is not a health care provider or clearinghouse.  It doesn’t seem to fit the definition of health plan either.  It may be a business associate of health plans although the HIPAA rule provides that the business associate definition does not apply to “(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.”

In any event, even if the rule applies to the information and to the exchange, sharing information with a contractor would be a routine operation, and HIPAA allows disclosure of information without consent for operations.  Surely a health plan that contracted with a company to build its software would not be violating HIPAA as long as the computer company also observed HIPAA protections.  The exchange is subject to the privacy rule, but the HHS privacy rule permits disclosure to contractors, who would also be under an obligation of confidentiality.