Health plans, including some employer-sponsored plans, face a looming deadline to obtain a HIPAA health plan identifier (HPID). There have been many questions surrounding this requirement, particularly as it applies to employer-sponsored plans. Recent FAQ guidance from CMS (here) has provided some key clarifications, although questions remain. Here's what you need to know.
Background. HIPAA requires health plans and other covered entities to engage in certain covered transactions in a standardized way. This is sometimes referred to as the HIPAA "transactions rule." The details of that rule are beyond what can be addressed here. But the key thing to understand is that the ACA amended the transactions rule to require health plans to obtain a specific identifier (the HPID) to be used in connection with covered transactions.
Deadline. For plans that are required to get an HPID, the deadline is November 5, 2014, unless the plan is a "small" health plan, in which case the deadline is November 5, 2015.
Small Health Plan. A small health plan is a plan that has $5 million or less in annual receipts. The CMS FAQs tell us that annual receipts mean premiums paid during the last full fiscal year, in the case of fully insured plans, and health care claims paid during the last full fiscal year, in the case of self-insured plans. Plans that are partially insured and partially self-insured combine the premiums and health care claims paid to determine their total annual receipts.
Stop-Loss Premiums. It's not clear whether annual receipts are intended to include stop-loss premiums paid in connection with self-insured plans. They arguably aren't plan expenses. (The stop-loss policy generally insures the employer, not the plan.) But if the stop-loss premium is the difference between being a small plan and a large plan, the safe bet is to count the premiums as part of annual receipts and observe the earlier compliance deadline applicable to a large plan.
Plans Required to Comply. The obligation to obtain an HPID applies only to "controlling health plans" (CHPs). This sounds like it should be straightforward. And it is - until it’s not. Let’s break it down.
Controlling Health Plan. To be a CHP, a plan must first be a "health plan" within the meaning of HIPAA. This is a broad definition that sweeps in most employer group health plans, including plans that are often excepted benefits for other purposes, such as health FSAs and limited-scope dental and vision plans. There is a narrow exception that excludes self-administered, self-insured plans covering less than 50 employees, but pretty much everything else is in.
With me so far?
If a plan is a health plan then it may also be a CHP, but only if it is not controlled by another health plan. Specifically, a health plan is a CHP if it controls its own business activities, actions, or policies or is controlled by an entity that is not a health plan.
Sub-Health Plans. Health plans that are controlled by another health plan are referred to as "sub-health plans" (SHPs). SHPs aren't required to get an HPID. This turns out to be an important rule for many employers. Really.
Fully Insured Plans. Employer-sponsored plans that are fully insured were a big question mark. It wasn't clear whether, at the employer level, a fully insured plan would be treated as a CHP or a SHP. But the CMS FAQs clarify that, at the employer level, fully insured plans are not CHPs. They are SHPs that are controlled by the carrier issuing the policy. So fully insured plans aren’t required to obtain an HPID. Why? Because - say it with me - SHPs aren't required to get an HPID.
I told you it was an important rule.
Self-Insured Plans. But it turns out the rule is not as favorable for self-insured plans. Self-insured employer-sponsored plans generally will qualify as CHPs, because they are not controlled by any other health plan. This means most self-insured plans are required to obtain an HPID, even if they do not engage directly in transactions covered by the HIPAA transactions rule.
Self-Insured Dental and Vision Plans. The rule regarding self-insured plans isn't limited to major-medical plans. It applies to self-insured dental and vision plans as well, even if those plans otherwise qualify as "excepted benefits" for purposes of the ACA and HIPAA's portability requirement. Thus, if a self-insured dental or vision plan is a CHP, it is required to obtain an HPID.
Health FSAs, HSAs, and HRAs. So how about some good news? Health FSAs and HRAs are a type of self-insured health plan, which would suggest they fall under the HPID rule too. But the CMS FAQs create some special exceptions. FSAs are treated as exempt because they “are individual accounts directed by the consumer to pay health care costs.” (The same rule applies to HSAs.) And most HRAs will be treated as exempt too, so long as they cover only deductibles or out-of-pocket costs (as most “integrated” HRAs do).
How to Obtain an HPID. If one or more plans requires an HPID, it will be obtained through the “Health Plan and Other Entity Enumeration System” maintained as part of the CMS Enterprise Portal. A link to this portal is here. CMS has created a “quick reference guide” to obtaining an HPID, which is available here.
Updated: A newer version of the graphical quick reference guide is here, and a text version of the updated quick reference guide is here. The revised process no longer requires approval by an "authorizing official."
So now you're up to speed on the HPID requirement. Figure out if your plan is a CHP, and if it is, make sure you go through the HPID process by November 5th (or determine that you can wait a year).
Additional information on the HPID requirement is available on the CMS website here.
