After you have reviewed this file, we urge you to look at these other documents relating to HIPAA:

hipaa03.htm
hipaaQ&A.htm
hipaa-ebsa.htm

The Health Insurance Portability and Accountability Act's (HIPAA) privacy rule, which sets out standards for protecting the privacy of individually identifiable health information, became effective on April 14, 2003. Although employers are not included in the rule's definition of covered entities -- defined as "health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions (electronic billing and funds transfers) electronically" -- experts say that it doesn't necessarily mean they aren't subject to the rule's provisions.

Any time there is an exchange of a person's identifiable health information -- for example, when an employee with a chronic illness contacts the HR department with a question about a claim under the company health plan -- HIPAA's privacy rule comes into play.  

Considering that non-compliance with the rule can lead to both civil and criminal penalties, not to mention invasion of privacy lawsuits, it's important that employers have a plan in place to ensure that if such a situation arises, their policies, procedures, and processes are in line with the privacy rule's requirements.

Fortunately, there's a great deal of information available online to help organizations get into compliance with the privacy rule. Here are a few you may find especially helpful and informative:

--  The American Health Information Management Association's "HIPAA Privacy Checklist," available at
http://link.ixs1.net/s/lt?id=428054&si=j29610435&pc=95&ei=212813.

--  The U.S. Department of Health and Human Services's (HHS) fact sheet, "Protecting the Privacy of Patients' Health Information," that can be obtained at
http://link.ixs1.net/s/lt?id=e28055&si=j29610435&pc=j6&ei=212813.

--  The HHS's guidance -- including background, general provisions, and frequently asked questions -- on the privacy rule, "Standards for Privacy of Individually Identifiable Health Information," that you can view at
http://link.ixs1.net/s/lt?id=09950&si=j29610435&pc=k7&ei=212813.

HIPAA provides for a series of incremental health reforms intended to ensure better access to health care. These reforms were carried out through amendments to the Employee Retirement Income Security Act of 1974 (ERISA), the Public Health Services Act (PHSA), and the Internal Revenue Code (IRC).

The central provisions of HIPAA impose burdensome requirements on employer health plans and health insurers that will make health insurance more portable from job-to-job or from group coverage to the individual person health insurance marketplace.

HIPAA also enhances access to health insurance by barring denials of coverage based on health-related factors.

Other provisions that directly benefit employees include COBRA modifications, favorable tax treatment for long-term care insurance and expenses, an exclusion from income for accelerated death benefits paid from life insurance policies to the terminally ill, an increase in the tax deduction for health insurance premiums paid by self-employed people, and an experimental medical savings account program.

HIPAA also includes a health care fraud and abuse control program and, as a revenue offset measure, repeals the deduction for interest on loans to company-owned life insurance, other than contracts on a limited number of key persons.

Group Health Plan Portability
Limits on Pre-existing Condition Exclusions.

HIPAA takes a small but important step towards the goal of ensuring access to health insurance coverage for individuals who change jobs. The primary means of reaching this goal is the imposition of substantial limitations on preexisting condition exclusions by group health plans and health insurance carriers.

Under HIPAA employer health plans and insurance carriers may refuse to provide benefits to new enrollees with respect to certain preexisting conditions for a period of time after enrollment. A preexisting condition, for this purpose, is a physical or mental condition for which an person sought medical advice or received care within the six-month period ending on the date the person's enrollment waiting period for enrollment in a health plan begins.

HIPAA prohibits imposing preexisting condition exclusions on most new enrollees with prior health coverage. For certain preexisting conditions, employers and carriers may not exclude coverage regardless of whether the enrollee had prior coverage. A preexisting conditions may not be excluded unless medical advice or care was sought or received for the condition within the six-month period ending on the enrollment date.

No preexisting condition limitations may be imposed on pregnant women, newborn infants, and newly adopted children under age 18.  Newborns and newly adopted children do not receive this protection unless they are enrolled in the employer's health plan or obtain other health coverage within 30 days of the date of birth or adoption.

Where preexisting condition exclusions are permitted, the maximum possible exclusion period generally is 12 months. The 12-month period can be extended for up to 18 months for individuals who enroll in the health plan after their initial enrollment opportunity.

The 12- or 18- month exclusion period is reduced by aggregate periods of "creditable coverage." Creditable coverage means coverage under any kind of health benefit policy or program, including a group health plan, health insurance coverage, Medicare or Medicaid, other federally mandated health programs, or a government health benefits risk pool.

An employer health plan is not required to treat an enrollee's prior health benefit coverage as creditable coverage if that enrollee has experienced a lapse in coverage of at least 63 days between the prior coverage and the enrollment date. Enrollment waiting periods may not be counted in determining whether the 63-day period has lapsed.

In reducing the maximum period during which a plan may refuse to cover a preexisting condition, employers and insurance carriers may choose between two methods of determining creditable coverage.

Under the standard method, creditable coverage is counted without regard to the specific benefits provided during the coverage period.  Under the alternative method, periods of coverage must be treated as creditable coverage for a class or category of benefits if any level of benefits was covered within such class or category.

Organizations electing the alternative method must do so on a uniform basis for all participants and beneficiaries.

Group health plans and carriers choosing the alternative method must prominently disclose their election and describe its effects to affected parties.

Coverage Certifications

To carry out the new portability requirements, HIPAA imposes a new administrative burden on employer health plans- creditable coverage certifications. Employers and carriers will be required to provide written certification of periods of creditable coverage when coverage ends and when any COBRA period begins or ends. The certification must state the coverage period, the COBRA coverage period, if any, and the length of any applicable waiting period.

Certifications should be provided at the same time as COBRA notices. If the health insurance carrier issues the certification, the employer does not have to. If the person seeking coverage has individual-not group-coverage, the carrier must provide the written certification.

An employer or insurance company that elects the alternative method of crediting coverage (discussed above) may ask the employer or carrier providing the coverage certification for information about the classes and categories of health benefits available under its health plan or policy. That party must promptly disclose the information, but may charge the reasonable cost of doing so.

Special Enrollment Provisions

Mandatory special enrollment periods for certain individuals are another means to enhance portability and another new burden for employer plans. An employee or dependent who would be eligible to participate in an employer health plan, but for having declined coverage, must be permitted to enroll after losing other health coverage under certain conditions.

The person must have had health coverage when enrollment was declined and, if required to by the employer or the carrier, stated in writing that they were declining coverage based on coverage under another plan. The employee must have lost the other coverage under the terms of the plan or exhausted their COBRA coverage. Finally, the employee must request coverage under the employer's plan within 30 days of having lost coverage. For plans that provide dependent coverage, HIPAA also requires a special 30-day enrollment period for employees and people who become dependents through marriage, birth, or adoption.

Group Plan Accessibility
Prohibition Against Denying Coverage Based on Health Status.

In addition to the portability provisions, HIPAA makes it easier for people to get health coverage. Group health plans may not base eligibility for coverage on any health-related factors, such as medical conditions, claims experience, receipt of health care, medical history, genetic information, disability, or evidence of insurability. Nor may group health plans or insurance carriers charge more for coverage to similarly situated persons based on those factors.

HIPAA does not guarantee people the specific health coverage they may need. The new law does not require a plan to provide particular benefits other than those provided under the plan. Nor does it prevent a plan from limiting coverage, restricting the amount and level of specific benefits, or imposing lengthy waiting periods, although those restrictions must apply to everyone who is similarly situated under the plan.

Other laws may require plans to provide certain benefits -- for example, pregnancy coverage or childhood immunizations -- or limit the ability to restrict coverage for certain conditions.

Guaranteed Availability and Renewability.

To enable health plan sponsors to meet their obligations to provide nondiscriminatory health care coverage, HIPAA requires insurance carriers to continue or renew group health insurance coverage at the sponsor's option. Once a health insurance policy is in effect, an issuer may not refuse coverage except for these reasons: the employer's failure to pay premiums; the employer's committing fraud or violating participation and contribution rules; in limited situations involving network plans, an employer's ceasing to have a sufficient number of enrollees within the service area; or the issuer's discontinuing coverage or types of coverage. An issuer must comply with certain requirements before discontinuing any coverage.

HIPAA also attempts to ensure that small employers (companies with between two and 50 employees) can purchase health insurance coverage for their employees. If a carrier offers health insurance coverage to small employer groups of 50 or fewer employees, that carrier must make policies available to all eligible small employers -- regardless of the health status of their employees and prior claims experience.

Policies must be offered without restrictions that would prevent an employer from meeting its obligations under HIPAA. (Special exceptions apply to network plans.)

Although HIPAA requires insurance carriers to guarantee the availability and renewability of the health insurance policies they sell, it does not limit the premiums they may charge an employer for group health insurance. Even if a health insurance policy is available, it may not be affordable.

Application, Enforcement, and Effective Dates

Application -- The new requirements for health plan portability, availability, and renewability apply to virtually all health plans covering two or more current employees and insurance carriers that offer group health policies.  Even group plans that are exempt from ERISA, such as church plans and governmental employers, are subject to the new requirements under the PHSA. Non-federal government plans may elect out of most requirements, other than the certification rules, on an annual basis or for collective bargaining employees, for the duration of the collective bargaining agreement.

Certain limited types of health benefit coverage are excluded from the new rules. They are: coverage only for accident or disability income; liability insurance and supplements; workers' compensation insurance; automobile medical insurance; credit insurance; on-site medical clinics; limited scope dental or vision benefits offered separately from other health coverage; separately offered long-term care, nursing care, home health care, or community-based care benefits; coverage for specified diseases and fixed indemnity insurance if not coordinated with other coverage; and Medicare supplemental coverage.

Enforcement -- HIPAA provides for enforcement of the group portability, availability, and renewability requirements through standard ERISA remedies (for employers subject to ERISA), COBRA-like penalty taxes under the Code, and civil monetary penalties imposed by the Secretary of Health and Human Services.  Under ERISA, plan beneficiaries may sue plan fiduciaries for relief and the Secretary of Labor has the authority to investigate violations.

To make plan beneficiaries aware of their rights under HIPAA, employers are subject to new disclosure requirements. Employers must insert a statement in the summary plan description (SPD) concerning whether a health insurance carrier is responsible for financing or administration of the plan and, if so, the carrier's address.

The SPD must also advise participants that they may seek assistance and information regarding their health benefit rights under ERISA and HIPAA. In addition to the new SPD disclosures, employers must notify employees of any material reduction in covered health benefits or services within 60 days of adoption, or must furnish a description of covered benefits and services at least once every 90 days.

Under the Code, a tax of $100 a day is imposed on an employer (or a plan, in the case of a multi-employer plan) for each day the employer fails to comply. The tax applies  separately for each individual affected by the failure. In general, the tax is not imposed if the failure was unintentional and is corrected within the 30-day period beginning on the date the employer knew or should have known of the failure. 

(Church plans have up to 270 days without penalty to correct unintentional failures after the IRS notifies them of the failure.) Nor is the tax imposed on an employer or plan that could not know a failure existed after exercising reasonable diligence. The maximum tax for unintentional violations is the lesser of 10% of the employer's payments for health care or $500,000. States are to enforce the provisions of HIPAA as they apply to insurers in the first instance.

If the Secretary of Health and Human Services determines that a jurisdiction has failed to implement these provisions, the Secretary may impose civil monetary penalties against the insurer or the employer of  up to $100 a day for each individual affected by a compliance failure.

Effective Date -- The health care portability, availability, and renewability requirements generally apply to group health plans, and health insurance policies offered in connection with group health plans, for plan years beginning after June 30, 1997.  The effective date was delayed for a plan subject to a collective bargaining agreement until the plan year beginning after the date the current agreement expires. In general, and except as determined by the Secretary of Labor or Health and Human Services, periods before July 1, 1996 did not have to be taken into account in determining creditable coverage.

Recommended Employer Action

Review group health plans and modify as required to comply with  pre-existing condition and accessibility rules. 

Establish coverage certification procedure.

Modify enrollment procedures to permit special enrollment periods for individuals who previously refused coverage and new dependents, if necessary.

Revise summary plan descriptions.

If reductions in health services or benefits are planned, notify participants within 60 days.

Take action in advance of effective dates.

Individual Portability Provisions

HIPAA also enhances health care portability by requiring health insurers that offer individual health insurance policies in any state to cover eligible people in that jurisdiction. In general, the insurer must make available to eligible individuals at least two different forms of health care policies that it actively markets to other individual health insurance policyholders. The representative policies must include a higher and lower level of coverage. The actuarial value of the benefits of each must meet prescribed requirements. Insurers are exempt from these requirements if the state of residence has implemented an acceptable alternative mechanism to provide people with access to health care benefits.

To be eligible for the individual market portability protection, a person must have had at least 18 months of creditable coverage under a group health plan, have exhausted COBRA coverage, be ineligible for their health coverage, and must not have been terminated from prior coverage for failure to pay or fraud. The coverage provided may  not contain any preexisting condition exclusions. Once offered, the issuer must guarantee renewability and may not cancel a policy, except for reasons like nonpayment of premiums, fraud, or the insurer's is continuation of coverage in the market. The insurer may not terminate market coverage without meeting prescribed conditions.

HIPAA directs the states to enforce the individual portability and renewability requirements. If a state fails to enforce them, the Secretary of Health and Human Services may do so by imposing the same penalties that may be applied to group health plan insurers. The portability provisions affect policies in effect since June 30, 1997.

COBRA Changes
Continuation Period

Under HIPAA the COBRA continuation period is coordinated with the new preexisting condition rules. COBRA continuation coverage may be terminated as soon as the COBRA beneficiary becomes covered under another health plan, even if that health plan contains preexisting condition limitations, as long as those limitations would not apply to the COBRA beneficiary.

Disabled COBRA Beneficiaries. Under current law, if the Social Security Administration (SSA) determines that a former employee was disabled at the time they terminated employment, the former employee may extend the initial 18- month COBRA continuation period for 11 months at a higher premium charge.

Any COBRA beneficiary who is determined by the SSA to be disabled at any time within 60 days of the qualifying event that resulted in COBRA entitlement, is entitled to 29 months of COBRA coverage, regardless of when the qualifying event occurred.

The disabled COBRA beneficiary is required to notify the plan administrator of the SSA's determination within 60 days of the determination date to obtain the benefit extension.

Newborns and Adoptees -- Just as HIPAA requires a special enrollment period for newborns and newly adopted dependents, it requires extension of COBRA continuation rights to children born to, or adopted by, a COBRA beneficiary during the COBRA continuation period. This provision was effective January 1, 1997, regardless of when the initial qualifying event occurred.

Notice Requirements -- Plan administrators were required to notify each qualified beneficiary who had elected continuation coverage of the changes on November 1, 1996.

Recommended Employer Action

Revise COBRA procedures, notices and election forms to comply with new rules.

Other Tax-Related Employee Benefit Provisions

Long-Term Care Benefits. HIPAA makes available a new tax-favored employee benefit-long-term care insurance. This type of insurance only covers qualified long-term care services (although it may be provided as a rider to a life insurance contract) and meets certain other requirements, including certain consumer protection provisions. Qualified long-term care services include necessary services relating to the care of a  chronically ill individual who is certified by a licensed health practitioner to have been incapable of self-care for at least 90 days within the prior 12 months.

Under HIPAA, long-term care insurance and expenses receive tax treatment similar, but not identical, to that given to accident and health insurance and medical expenses. Employer-paid long-term care insurance premiums are excluded from an employee's income unless provided through a cafeteria plan.

Amounts received under a long-term care insurance contract are excluded from the recipient's income, subject to a cap of $175 per day on per diem contracts (to be adjusted for inflation). Premiums paid by an individual for long-term care insurance, subject to annual maximums, and long-term care expenses are treated as deductible to the same extent as medical expenses.

The annual maximums range from $200 for persons who are age 40 and under -- to $2,500 for those over age 70, and are subject to indexing for medical care inflation.

The new tax treatment generally applies to long-term care insurance contracts issued after 1996 and expenses incurred after 1996.  A grandfather rule provides favorable tax treatment to certain long-term insurance contracts issued before 1997.

Accelerated Death Benefits -- Many employers recently have added low-cost riders to their employee life insurance policies that accelerate benefits for those expected to live less than one year. The new law provides a new reason to consider these riders.  Federal income tax on accelerated death benefits paid from life insurance policies to terminally ill policyholders is eliminated. To qualify for the tax exclusion, a physician must certify that the policyholder has a life expectancy of 24 months or less or is permanently and severely disabled.

A terminally ill policyholder whose insurance does not include accelerated death benefits paid directly by the insurer may sell their policy to a viatical settlement company at a discount.  Viatical settlements are tax-exempt.

A chronically ill policyholder may exclude from their income a portion of any accelerated death benefits paid under a long-term care insurance contract. This exclusion is permitted only if the payment is for qualified long-term care costs the payee incurs that are not otherwise compensated by insurance or Medicare. Per diem or other periodic payments are also excludable subject to the daily cap for long-term care benefits.

Self-Employed Health Insurance Deduction --