This update reflects new guidance provided by the Centers for Medicare & Medicaid Services (CMS) since the publication of Alston & Bird’s previous health plan identifier (HPID) advisory, including Frequently Asked Questions issued on the CMS website.[1] This guidance provides helpful clarity on the HPID application process, but plan sponsors of large Controlling Health Plans (CHPs)[2] should act quickly to complete the HPID registration process before the November 5, 2014, deadline.

Helpful information from this new guidance includes:

  • CMS confirmed that individual, fully insured, employer group health plans/policies are subhealth plans (SHPs) controlled by the health insurance company that issued and controls the plans/policies. Thus, as many commentators expected, to the extent that an HPID is needed for such a fully insured plan, the issuing insurance company would be expected to apply for the HPID on behalf of the fully insured plan.
  • CMS also confirmed previous guidance regarding the proxy measures to be used by health plans—such as Employee Retirement Income Security Act (ERISA) regulated employer sponsored group health plans—that do not have “receipts” in applying the term “annual receipts” to determine whether a health plan is large or small (which affects the deadline to apply for an HPID). Fully insured plans should use the premiums paid during the last fiscal year to calculate their annual receipts, while self-insured plans should use the total amount paid for health care claims on behalf of the plan during the last full fiscal year (but not stop-loss premiums or other administrative fees). Health plans that provide health benefits through a mix of insurance and self-insurance should combine the proxy measures to determine their total annual receipts. For HIPAA purposes, including obtaining an HPID, a large health plan is a plan with more than $5 million in annual receipts. Large CHPs must complete the HPID registration process by November 5, 2014, while small CHPs (i.e., plans with annual receipts of $5 million or less) have until November 5, 2015.
  • In a notable FAQ, CMS stated that neither health flexible spending accounts (FSAs) nor health savings accounts (HSAs) are required to obtain an HPID because they are “individual accounts directed by the consumer to pay health care costs.” In addition, CMS stated that whether a health reimbursement arrangement (HRA) needs an HPID depends on what it reimburses. HRAs that cover only deductibles or out-of-pocket costs do not require HPIDs; however, HRAs that pay for other costs (e.g., health insurance premiums) still need HPIDs. 

We note that, while this guidance may appear to be welcome news for employers with only fully insured plans and health FSAs or HRAs (whose only potential HPID enumeration responsibility would be because of the health FSA or HRA), it is not consistent with HIPAA’s definition of health plan, under which both health FSAs and HRAs are health plans, as CMS has previously recognized. Employers should be able to rely on CMS’s clear statement in this guidance that FSAs and certain HRAs do not require HPIDs, but we advise caution. Given the inconsistency with previous guidance on FSAs and HRAs and the manner in which CMS has phrased the FAQ, the guidance may not create as broad an exception as it first appears.

  • Third-party administrators (TPAs) may apply for HPIDs on behalf of their clients’ self-insured group health plans, pursuant to authorization or direction from the client group health plan. However, the HPID belongs to, and remains attached to, the plan, not the TPA.

Practice Pointer: Do not assume that a TPA will automatically obtain CHP HPIDs for its clients’ self-insured group health plans. A group health plan that wants its TPA to do so should direct its TPA to do so. 

  • Plans that do not have an NAIC number or Payer ID (e.g., self-insured plans) should insert “Not Applicable” into the required Payer ID field.
  • CMS issued an FAQ distinguishing between a “health plan” (an individual plan or group health plan that provides or pays the cost of medical care) and a “payer” (an industry term that includes health plans, but also includes other entities such as TPAs that are not health plans under HIPAA). Entities conducting electronic transactions under HIPAA may need to understand the difference in order to properly use HPIDs in standard transactions once the use of HPIDs in such transactions is required.

CMS has also published a Quick Reference Guide explaining the technical steps of the HPID application process, which applicants will likely find helpful.[3] In addition, CMS has updated its User Manual that provides details about the registration process.[4] Finally, CMS is no longer requiring applicants to have “Authorizing Official” approval before an HPID application can be submitted, which is a significant simplification of the process. As a result, CMS updated the Health Plan and Other Entity Enumeration System (HPOES) so that the HPOES automatically approves the application and generates an HPID for the health plan upon submission of the required information.