Background

		Insurance Risk in Health Care

When issuers set their premiums, they consider a number of factors, such  as trends in the cost of paying providers for medical services and data on  the utilization of services in the population they are serving. Issuers are  able to more accurately predict these costs when they have historic  claims data for the population eligible to purchase coverage. However,  issuers must also consider the risk that the cost of the healthcare  delivered to their enrollees will exceed the premiums that they developed  based on historic claims data.
Prior to the implementation of PPACA, issuers offering individual and  small group market health insurance plans generally mitigated risks for  unexpectedly high health care costs by tailoring premiums to specific  individuals and small groups through a process known as medical  underwriting and, in the individual market, by denying coverage to certain  individuals based on factors such as health status. Issuers generally  were not subject to uniform federal requirements in regards to rules for  setting premiums and guaranteed issuance of coverage for individuals,  and therefore consumer protections varied among states. For example,  we reported that, prior to the passage of PPACA, the majority of states  did not prohibit issuers from denying enrollment of individuals because of  their health status and issuers in many states were able to vary premiums  based on the individual’s health status, gender, and age.

		PPACA Provisions

Several PPACA provisions that became effective January 1, 2014, limited  the ability of issuers to deny coverage or charge higher premiums to  individuals and small groups based on health risks or certain other  factors. For example, PPACA requires that issuers offering individual and  small group market plans guarantee coverage regardless of the existence  of a person’s pre-existing conditions. Further, issuers are restricted in  the amount they can vary premiums based on age and tobacco use, and  they cannot set premiums for individual and small group plans based on  an individual’s health status, gender, or other characteristics.result, issuers may have an incentive to try to attract healthier individuals  through certain marketing practices, benefit designs, drug formularies,  and provider networks, leaving to other issuers those individuals who are  in worse health and likely to require costly medical care.
PPACA also included a requirement that most individuals purchase health  insurance or pay a tax penalty if coverage meeting affordability standards  is available (this is known as the “individual mandate”).  As a result,  many previously uninsured individuals entered the insurance market,  possibly for the first time, and issuers lacked historical information about  their health care and use of medical services.uninsured individuals who are most in need of health care may be more  likely than others to purchase insurance during the transition, resulting in  a pool of enrollees that have unknown and potentially higher medical  costs than the broader population. In this situation, issuers might set plan  premiums higher than they would otherwise due to uncertainty about  enrollees’ health status.
In addition, previously  PPACA also required the creation in all states of health insurance  exchanges—marketplaces where individuals and small employers can  compare and select among insurance plans offered by participating  private issuers. To participate on the exchanges issuers must offer  plans that meet certain state and PPACA requirements for benefit design,  rate setting, and other factors. Approved plans are referred to as qualified  health plans. It is through the exchanges that qualifying individuals may  apply for premium tax credits and cost-sharing reductions, and certain  small employers may apply for small business health insurance tax  credits. Issuers participating in an exchange must meet certain criteria; for  example, criteria related to marketing, provider networks, and  accreditation.
PPACA does not require issuers offering coverage in the individual and  small group markets to offer plans through the exchanges but, with limited  exceptions, issuers in these markets are required to comply with other  provisions, such as requiring coverage of specified benefit categories at  standardized levels of cost-sharing and prohibitions on annual and  lifetime limits on the dollar value of required benefits. Some of these  market reforms do not apply to “grandfathered plans.”

		PPACA Risk Mitigation Programs

To mitigate issuer risk in the individual and small group health insurance  markets, PPACA required the creation of the permanent risk adjustment  program and temporary reinsurance and risk corridors programs. States  have the option to either establish their own state-run risk adjustment and  reinsurance programs or allow the federal government to administer  these programs.is required to administer the risk corridors program.
The Department of Health and Human Services (HHS)
Each of the risk mitigation programs applies to a different group of  issuers. For example, the risk adjustment program transfers funds among  individual and small group market issuers, while the reinsurance program  collects funds from all issuers and third party administrators on behalf of  group health plans and distributes it to only individual market issuers.  Further, issuers do not have to comply with these requirements for certain  types of plans. Specifically, grandfathered plans do not participate in the  risk adjustment program, and they do not receive reinsurance payments.  Similarly, HHS determined in 2013 that states could decide whether to  allow enrollees to continue coverage under certain non-grandfathered  plans established prior to 2014. plans—did not have to comply with all PPACA provisions and do not  participate in the reinsurance or risk adjustment programs.
These plans—referred to as transitional  For a summary of each program’s key functions, years of operation, and  the issuers required to participate, see table 1.
Centers for Medicare & Medicaid Services, Center for Consumer Information &  Insurance Oversight Letter to Insurance Commissioners (Washington, D.C.: Nov. 14,  2013). The Center for Consumer Information & Insurance Oversight (CCIIO), within CMS,  is responsible for overseeing the implementation the provisions of PPACA related to  private health insurance.

			Risk Adjustment Program

Risk adjustment provides a way to correct for market imbalances that  occur when some issuers attract a larger share of enrollees at low risk for  expensive claims and other issuers attract a larger share of enrollees at  high risk for expensive claims. Risk adjustment programs have previously  been used in Medicare Advantage—the managed care option for  Medicare beneficiaries—and Medicare Part D—the Medicare prescription  drug program. PPACA’s requirements for the design of the risk  adjustment program allowed for discretion by CMS in the design of the  program. Under the program designed by CMS, payments are transferred  from issuers with a larger share of enrollees at low risk for expensive  claims to those with a larger share of enrollees at high risk for expensive  claims. The amount to be transferred between issuers is determined  using the following steps: determine individual enrollee risk scores—for example, how much  more or less costly each enrollee is expected to be relative to the  average enrollee—based on demographic and diagnostic information; determine the average risk score for each plan based on individual  enrollee risk scores plus adjustments for a variety of factors, such as  the extent of enrollee cost-sharing in the plan;  compare each plan’s average risk score to the average risk score of  the market within its geographic area; and  calculate the amount that CMS will transfer between issuers.

			Reinsurance Program

Reinsurance programs are designed to limit issuer risks for enrollees with  very high-cost claims. Such reinsurance coverage has traditionally been  available to issuers in the private insurance market, Medicare Part D, and  through state-subsidized programs. Generally, a provider of reinsurance  assumes full or partial liability when costs for any single enrollee during a  year exceed a specified dollar threshold, while the issuer is usually  required to retain at least some liability for costs so that it will have an  incentive to continue managing the enrollee’s care.
Under the PPACA reinsurance program, CMS expects that premium  increases that might otherwise occur in the individual health insurance  market because of the increased enrollment of higher risk individuals will  be limited. CMS collects contributions from all issuers and third party  administrators based on the size of their enrollment and then transfers  payments to issuers in the individual market, both inside and outside the  exchanges, that have enrollees with high claims costs. PPACA specified  the total amount issuers are to contribute each year to cover payments for  enrollees with high claims costs. For example, the amount of  reinsurance funds that was to be collected from and distributed to issuers  for the 2014 benefit year was $10 billion. Each year CMS specifies the  per-enrollee contribution issuers must make and the parameters for  determining the amount to be paid to issuers for their high cost enrollees.  These payment parameters define the two elements that are used to  calculate issuers’ reinsurance payments: “attachment point,” which is the  dollar value above which an enrollee is considered high-cost and when  reinsurance payments would begin, and the “coinsurance rate”, which is  the percentage of issuer cost above the attachment point and below the  cap of $250,000 that is eligible for reimbursement. For example, for 2014,  CMS determined an attachment point of $45,000 and a coinsurance rate  of 80 percent, which means that CMS reimburses issuers for 80 percent  of an enrollee’s medical costs above $45,000 and up to $250,000. Costs  above the $250,000 cap are fully paid by the issuer. For the reinsurance  program contribution amounts and payment parameters for 2014 through  2016, see table 2.
A risk corridors program, as has been used in Medicare Part D, helps limit  excessive issuer profits or losses that may result from market volatility or  inaccurate rate setting. Under the PPACA risk corridors program, CMS  and issuers of qualified health plans may share in profits and losses that  exceed a certain threshold. The program determines profits and losses by  comparing an issuer’s actual spending to its expected spending. The  actual spending is known as “allowable costs”—costs for medical care  claims, quality improvement, and health information technology. The  expected spending is known as the “target amount”—premiums collected  less certain administrative costs and profits.
CMS will make program payments to an issuer if its losses exceed a  certain threshold, and issuers whose profits exceed a certain threshold  will make program payments to CMS. The amount of that payment  depends on the extent of the losses or profits. Issuers with allowable  costs within a specified range, or corridor, of the target amount do not  make or receive any payments. In total, the program has three corridors:  one for issuers whose costs are within the specified range, and two  others for issuers with relatively greater or lesser costs compared to the  target amount. When an issuer’s costs are within 3 percent of its target  amount, between 97 and 103 percent, the issuer makes no payments and  receives no payments. Issuers whose profit or loss is greater than   3 percent of its target amount share in that profit or loss with CMS. An  issuer whose profit or loss is greater than 8 percent of its target amount  will pay a greater portion of its profit or will be reimbursed for a greater  portion of its loss. (See fig. 1.)

		Risk Mitigation Programs in Medicare

PPACA directed HHS to consider the design of the Medicare risk  mitigation programs in developing the PPACA risk mitigation programs,  although it also set requirements that differed from the Medicare  programs. While PPACA established the risk corridors and reinsurance  programs as temporary programs for the 3-year period 2014 through  2016, the Medicare Part D programs were not required to be temporary  and have operated since 2006. In addition, according to CMS, the  PPACA risk adjustment and reinsurance programs are budget neutral, in  that payments to issuers will be adjusted to reflect, and not exceed,  contributions. CMS originally indicated that the PPACA risk corridors  program would not be operated in a budget neutral manner but  subsequently indicated its intent to operate the program as budget neutral  in 2014 and 2015, and then in 2016, if collections are insufficient to make  payments, it would use other sources of funding subject to availability. For  the Medicare Advantage and Medicare Part D risk mitigation programs,  the payments that CMS makes to issuers are not limited to issuer  contributions.

	CMS Considered Market Characteristics and Program Duration When Designing PPACA’s Three Risk Mitigation Programs

CMS considered a range of insurance market characteristics—such as  demographics and the availability of market data—in making decisions  about how to design PPACA’s three risk mitigation programs. CMS’s  design decisions also reflected the temporary status of the reinsurance  and risk corridors programs.

		CMS’s Design of the Risk Adjustment Program Reflects Multiple Factors That Influence Cost Variation in the Individual and Small Group Markets under PPACA

While the Medicare risk adjustment programs served as the basis for the  PPACA risk adjustment program, CMS’s design of the PPACA program  reflects key differences that exist between Medicare and PPACA markets,  including differences in demographics, the availability of enrollee data,  and each program’s benefit design and premium-setting structure. For  example, while Medicare primarily serves the elderly and certain  individuals with disabilities, the markets covered by the PPACA risk  adjustment program provide coverage for the general non-elderly  population. Therefore, while both the Medicare and PPACA risk  adjustment programs incorporate information about enrollee age when  estimating risk, the PPACA program includes separate analyses for  infants, children, and adults to reflect the inherent differences in the  medical needs and costs of these three population groups. On the other  hand, the PPACA risk adjustment program does not incorporate certain  demographic characteristics that are important for the Medicare  population, such as Medicaid enrollment, and whether an individual  resides in a nursing home.
In designing the PPACA risk adjustment program, CMS also had to  account for uncertainty surrounding the population that would enroll in  2014 health plans and for the lack of historical claims data for this  population. Therefore, to develop risk adjustment rates for different age,  sex, and diagnostic categories, CMS used claims data from private health  plans including employer-based plans for a population that was similar to  those individuals expected to enroll in individual and small group  coverage in 2014. CMS also chose to develop a concurrent risk adjustment program model, which uses enrollees’ diagnoses during the  current benefit year as the basis for developing the risk scores for that  same year. In contrast, historical claims data was available on the  Medicare population and its risk adjustment program is a prospective  model, which uses data from a prior year to calculate the risk adjustment  score in the current benefit year.
CMS also considered other market characteristics in designing the  PPACA risk adjustment program, such as the option for issuers to offer  different benefit levels and the availability of subsidies that may affect  enrollees’ use of health services. As with demographics and the  availability of enrollee data, these characteristics are different in the  Medicare and PPACA markets. See table 3 for additional information  about key market characteristics and design features of the Medicare  Advantage and PPACA risk adjustment programs.

		CMS’s Design of the PPACA Reinsurance and Risk Corridors Programs Reflects Their Temporary Nature and Specific Characteristics of the Insurance Market under PPACA

			PPACA Reinsurance Program

CMS indicated that it designed the PPACA reinsurance program to  minimize administrative burden for issuers and maximize simplicity, in  part because the program is temporary. For example, CMS initially  proposed basing the amount an issuer contributes to the reinsurance pool  on a percent of the premiums paid by each of its enrollees. CMS  indicated that this would be the fairest method as it would ensure that  issuers with higher premiums and costs—and thus potentially higher  reinsurance claims—contribute additional funds towards reinsurance.  However, because of the temporary nature of the reinsurance program,  and after reviewing comments from rule-making, which included  comments from issuers, CMS ultimately chose to base contributions on a  flat per-enrollee amount because it is more straightforward for issuers and  less complex for CMS to administer. Additionally, in establishing the  basis for identifying enrollees as high-cost, CMS chose to use actual  claims costs incurred by the plan for each enrollee, rather than a list of  medical conditions identified as high risk. Although CMS acknowledged  that payments made solely on the basis of actual claims costs may not as  strongly encourage efficient care, CMS chose this approach because  issuers would still be responsible for costs above the reinsurance cap and  because it was simpler and consistent with the structure of other   CMS also initially proposed that issuers  reinsurance programs.determine whether an enrollee’s costs exceeded the attachment point  based on claims for essential health benefits in order to ensure that  reinsurance payments are based on a comparable set of benefits across  issuers. However, CMS subsequently decided to use all covered  benefits—not only essential health benefits—because of the  administrative burden for issuers of distinguishing claims for essential  health benefits from other claims.
CMS also considered specific characteristics of the insurance market  under PPACA when designing the reinsurance program. For example,  CMS developed a model to estimate market enrollment and expenditures  in 2014 to help it set the rate that each issuer must contribute per enrollee  in order for CMS to collect the full amount authorized by PPACA. also used the model to estimate what payment parameters—the  attachment point, coinsurance rate, and cap—would allow it to distribute  the full collected amount.
The Affordable Care Act Health Insurance Model uses Current Population Survey data  and was developed with reference to existing models such as those of the Congressional  Budget Office and the CMS Office of the Actuary to characterize medical expenditures  and enrollment choices across the 2014 market place. The model predicts coverage  status of individuals and incorporates the effects of state and federal policy choices. See  PPACA: HHS Notice of Benefit and Payment Parameters for 2014, CMS final rule,   78 Fed. Reg.15410, 15461 (Mar. 11, 2013)(preamble.III.C.3.a). reinsurance payments, CMS considered the variation among states in the  relative size of the individual and group insurance markets that could  affect the balance of contributions and payments. CMS determined that  the availability of reinsurance contributions to make payments will vary  significantly between states, and some states may not have sufficient  contributions to meet the need for all reinsurance payments in that state.  Therefore, after initially proposing that contributions would remain in each  state, CMS determined that contributions would be pooled nationally and  then distributed to issuers. CMS also modified the reinsurance program to  accommodate market changes resulting from its policy allowing states to  renew certain transitional plans until October 2, 2016. As a result of this  policy, CMS was concerned that healthier individuals were more likely to  remain enrolled in these non-PPACA compliant transitional plans, leaving  less healthy and higher-cost individuals to enroll in PPACA-compliant  plans. Because the policy was implemented in November 2013, after  issuers had set their premiums for 2014, there was an increased risk that  the premiums would not be adequate to cover higher than anticipated  claims costs. Therefore, in March 2014, CMS lowered the attachment  point for 2014 from $60,000 to $45,000 to provide increased protection to  plans that enrolled individuals with high costs.

			PPACA Risk Corridors Program

While various aspects of the risk corridors program were prescribed in  statute, CMS officials told us that, due to the temporary nature of the  program, they sought to minimize issuer burden for the elements of the  program that were left to the agency’s discretion. Specifically, CMS  aligned the risk corridors program formula with the definition of allowable  costs under the medical loss ratio (MLR) requirements that issuers have   For example, under both programs,  been required to meet since 2011.the cost of certain health care quality improvement activities—such as  developing quality data reporting—and certain health information  technology activities are included in “allowable costs” and profits are  included in “allowable administrative costs.”
CMS modified the risk corridors program for the 2014 and 2015 benefit  years to account for changes to the insurance market resulting from its  policy to let states allow continued coverage by non-PPACA compliant  transitional plans. CMS noted that issuers may incur increased claims  costs because of this policy, but were not able to incorporate assumptions  about additional costs into their premium rates because the policy was  initiated after issuers had set their premiums. Therefore, CMS made  certain adjustments to the risk corridors calculation to allow issuers to  retain a larger share of profits. For benefit year 2014, CMS planned to  make adjustments based on the number of enrollees in each state’s  transitional plans. For benefit year 2015, CMS established a national  adjustment to the risk corridors program formula, regardless of the  presence of transitional plans in the state.
CMS guidance to issuers about how it will manage the risk corridors  program if collections do not cover required payments changed  significantly over time:  In March 2013, CMS confirmed that it would make payments to  issuers as required under PPACA, and would not operate the risk  corridors program in a budget neutral manner.
In March 2014, after issuers had set 2014 premiums and after the  start of the benefit year, CMS indicated that it would seek to operate  the risk corridors program in a budget neutral manner by making all  risk corridors payments with risk corridors collections. In April 2014 it  issued further guidance explaining that if collections were insufficient  for one year, the agency would reduce risk corridors payments to  issuers proportionately and later use funds collected in the next year  to make full payments. CMS also noted that it would issue future  guidance indicating what it would do if collections did not cover  payments as of the final year of the risk corridors program.
In February 2015 CMS clarified what it would do in the event that risk  corridors program collections for the three years of the program were  not sufficient to cover payments to issuers. CMS indicated that “in the  unlikely event of a shortfall in the 2016 benefit year, HHS will use  other sources of funding, subject to availability of appropriations.”

	CMS Considered Privacy and Security in Developing Systems for Collecting Issuer Risk Mitigation Data and Experienced Significant Delays CMS Considered Privacy, Security, and Efficiency When Developing Data Collection Systems for PPACA’s Risk Mitigation Programs

CMS chose data collection systems for the risk mitigation programs that  were intended to address privacy and security concerns and maximize  efficiencies. CMS delayed implementation of the new data collection  system for the risk adjustment and reinsurance programs by nearly a year  as it revised its plans for implementing the distributed data approach.  Because of these changes, the agency was not able to adhere to its  original timeline for collecting and reporting data to issuers.
CMS chose a data collection system for the risk adjustment and  reinsurance programs that was intended to address privacy and security  concerns and to maximize efficiencies across the programs. According to  CMS, the system it developed—known as the distributed data  approach—allows enrollee claims data, which are needed to calculate  risk adjustment payments and charges and reinsurance payments and  contributions, to remain on the issuers’ own servers. CMS provides each  issuer with software to calculate contributions but only the summary  reports generated by CMS’s software are sent to the agency and not the  actual claims data. CMS told us that the system was designed to   (1) address privacy and data security concerns by minimizing the number  of transfers and amount of enrollee health information transferred,   (2) ensure that issuers’ proprietary data remains with the issuer, and   (3) standardize software processes, timing, and rules uniformly across  issuers.
CMS elected to use the distributed data approach after considering  comments from the industry through its rule-making process. In particular,  CMS initially considered three data collection options: a centralized data  collection system in which issuers send individual enrollee claims data  directly to CMS, a state-level approach in which states collected enrollee  claims data on behalf of CMS, and the distributed data approach. CMS  indicated that it received many comments in favor of the distributed data  approach because of the increased privacy and the fact that it eliminated  the administrative complexity of issuers transmitting claims data to CMS.
In selecting the distributed data approach, however, CMS identified  potential tradeoffs. Specifically, it noted that this approach raises the  possibility that issuers could make errors when calculating their risk  scores. To address this concern, the agency said that it would augment  its data audit processes. CMS also indicated that some issuers,  particularly smaller companies, may be challenged by the administrative  complexity of the distributed data approach, and therefore this approach  may require more resources from CMS to support issuers with  implementation.
CMS decided to leverage the distributed data approach to collect data for  both the risk adjustment and reinsurance programs in order to maximize  efficiency. As reinsurance is a temporary program, agency officials  believed it was not worth the resource investment for issuers or CMS to  develop a separate data collection system. As a result, the distributed  data approach is used for both programs, and issuers submit data to  CMS on the same schedule for both programs.
For the risk corridors program, CMS officials said that the agency is using  an existing data system in an effort to maximize efficiency. Issuers will  submit data to CMS for calculating payment transfers through CMS’s  Health Insurance Oversight System (HIOS), which issuers already use to  submit MLR data. Specifically, issuers use HIOS to submit data on their  total medical claims costs, expenses for quality improvement activities,  premiums, taxes and fees, and non-claims costs, which CMS will then  use to calculate whether issuers qualify for risk corridors payments or  owe contributions. As the calculations for the risk corridors program do  not require transmitting enrollee claims data, CMS did not have the same  privacy and security concerns related to data submission that they had for  the risk adjustment and reinsurance programs.

		CMS Delayed Data Collection and Reporting for the Risk Adjustment and Reinsurance Programs

CMS delayed implementation of data collection for the risk adjustment  and reinsurance programs by nearly a year as it revised its plans for  implementing the distributed data approach. An initial delay occurred  when CMS changed the server requirements due to its concerns about  the administrative burden for the agency and to accommodate issuer  preferences. The servers used for the distributed data approach are  called the external data gathering environment (EDGE) servers. CMS  initially decided in May 2012 that each issuer would set up and maintain  its own physical EDGE servers, with the issuer downloading CMS  software to a server located on its premises. However, according to CMS  officials, when the agency tested these servers with a small sample of  issuers in late 2012 and early 2013, it found that it took the agency longer  than expected to load the necessary software onto each issuer’s  individual server. CMS officials also said that the issuers involved in the  initial testing requested that CMS consider a virtual approach, in which  another entity would host the server rather than the issuers themselves.  In response to these concerns, CMS officials said that the agency  decided to develop a virtual EDGE server for issuers in late 2013 and  early 2014, furnished by Amazon Web Services. Once issuers uploaded  their claims data on to the virtual EDGE server, CMS’s software would  generate detailed and summary reports to be transmitted to CMS.
CMS’s timeline for implementing the EDGE servers was delayed again  when it changed its plan for these servers a second time. After CMS  made the switch to the virtual EDGE server, some issuers that had  already purchased a physical on-premise server to comply with CMS’s  initial requirements requested that CMS allow them to use those servers.  Therefore, in May 2014, CMS decided to allow issuers to use either  option, as well as an option to use a virtual server provided by an entity  other than Amazon Web Services—known as a virtual on-premise server.  All three options allow issuers to maintain their data on private servers  that are only accessible to the issuer and use CMS software to generate  summary reports that are sent to the agency (see side bar). CMS officials  said that in addition to being responsive to issuer requests for flexibility,  they wanted to create multiple approaches to reflect the variation in issuer  size. For example, smaller issuers might find the virtual server option   more appealing if they do not have the administrative resources available  to purchase and maintain a physical on-premise server.
Because of these changes in CMS’s EDGE server requirements, the  agency was not able to adhere to its original timeline for uploading data  and providing program reports to issuers. CMS initially planned to have  issuers acquire and set up their servers in the first part of 2013 and to  then load software and configure the servers in the latter part of 2013.  This would have allowed issuers to upload enrollment and claims data on  a monthly basis starting in January 2014, and CMS planned to use these  data to generate issuer reports during 2014:
CMS planned to provide quarterly reports to issuers with the  estimated amount of reinsurance program payments they would  receive for benefit year 2014. CMS officials said that these estimates  would allow issuers to more accurately account for reinsurance  payments when setting their premiums for benefit year 2015 and  beyond, as issuers set premiums in the year prior to the benefit year.
CMS planned to provide interim estimate reports on risk adjustment  calculations throughout the benefit year as it did with the reinsurance  program. These reports were to include preliminary calculations of an  issuer’s average risk score for each of its plans but not any data about  how an issuer’s score compared to other issuers in its market, which  would be necessary for an issuer to estimate its potential contribution  or payment. CMS officials said that they did not plan to provide  relative market data to issuers in the estimate reports because CMS  may not have complete or correct data for all the issuers in a market  until the final data submission deadline on April 30 of the year  following the benefit year. They said that relative market data risk  scores based on incomplete data could present a misleading estimate  of an issuer’s potential contribution or payment.
However, CMS’s plans for data collection and reporting were delayed. As  issuers were not able to begin loading data onto the EDGE servers until  September 27, 2014, CMS was not able to provide either quarterly  reinsurance reports or interim risk adjustment reports for benefit year  2014. Therefore, issuers did not have estimates of reinsurance payments  available from CMS to incorporate into their 2015 premium calculations.  CMS next planned to produce two risk adjustment estimate reports for  issuers, one in mid-December 2014 and one in May 2015. However, CMS  experienced further delays as issuers began uploading their data to the  EDGE servers. CMS officials noted that they were implementing a new  technology in a compressed timeframe, and that there were ongoing fixes  as they deployed the new software. As a result, CMS postponed the  deadline for issuers to upload their data to the EDGE servers from the  beginning to the end of December 2014, thus delaying CMS’s issuance of  the first risk adjustment estimate reports to December 29, 2014, and the  first reinsurance estimate report to January 12, 2015 (see fig. 2). CMS  announced in January 2015 that it would provide monthly risk adjustment  and reinsurance estimate reports for the remainder of the data collection  period for benefit year 2014, which runs through April 30, 2015. Officials  said that the purpose of these monthly estimate reports is to allow CMS to  look at data discrepancies and quality issues before issuers upload their  final data. After benefit year 2014, CMS officials said the agency plans to  provide periodic risk adjustment and reinsurance estimate reports  throughout each benefit year.
For the risk corridors program, CMS indicated that it expects to propose  and finalize a data collection tool from January to May 2015. Although  CMS is using an existing data system, HIOS, CMS officials said the  agency must still develop a new data collection tool within HIOS, which  will include new fields specifically for the risk corridors program. However,  the timeline for collecting these data is later, relative to the other two  programs. The calculation of risk corridors payments, as is also the case  with MLR rebates, incorporates risk adjustment program transfers and  reinsurance program payments and therefore must take place after CMS  makes those other calculations. Issuers must annually submit data for  both the risk corridors program and MLR payments by July 31 of the year  following the benefit year—for example, July 31, 2015, for the 2014  benefit year. CMS plans to collect risk corridors program contributions  from issuers that are required to make them beginning in mid-September  2015 and to issue payments to eligible issuers beginning in mid-October  2015.

	CMS Established Some Processes to Monitor the Accuracy of Issuer Data for the Three Risk Mitigation Programs and Initiated Efforts to Evaluate the Permanent Risk Adjustment Program CMS Established Some Data Verification Processes and Audit Procedures for the Risk Mitigation Programs, and Others Are under Development

To a varying extent, CMS has developed or has plans to develop data  verification checks or audit procedures for each of PPACA’s three risk  mitigation programs. In addition, CMS has initiated efforts to evaluate the  permanent risk adjustment program but has not finalized the details of the  evaluation.
For the reinsurance and risk adjustment program data that issuers upload  to the EDGE server, the software on the EDGE server allows issuers to  conduct data verification checks to identify errors. Issuers are able to run  test reports to identify errors in what is called the test zone. Each record  included on the four files submitted to the EDGE server—enrollment,  medical, pharmacy, and supplemental diagnoses—is either accepted or  rejected, and records that are rejected are given an error code and a  description of the erroneous field. For instance, a record may be rejected  if it has a value that is not the correct data type or the value is outside the  permitted range. The software on the EDGE server produces detailed  error reports—with information on the errors in specific records—for  issuers and provides summary error reports to CMS that aggregate the  number of records that were submitted, accepted, and rejected by plan,  year, and month. CMS plans to use the summary error reports to  understand if issuers have submitted data for all of their plans and  whether the data submission includes claims and enrollment data for all  months of the benefit year. CMS officials said that the reports will also be  used to identify software problems and particular issuers that may need  additional support. Going forward, the agency plans to use the reports for  additional analyses, such as analyses of the type and volume of issuer  claims for the risk adjustment program. Issuers are also supposed to  report data discrepancies to CMS for benefit year 2014 as they receive  monthly estimate reports from January through May 2015, including if the  results of the calculations in the reports are inconsistent with either the  risk adjustment or reinsurance payment methodologies, or if any claims or  enrollment data were incorrectly excluded from the calculations. For the  risk corridors program, CMS officials told us that the agency was in the  process of developing data verification procedures at the time of our  report, including automatic data checks that were going to be built into the  data collection system. Officials said that they are applying lessons  learned from the MLR data verification procedures to the data verification  procedures for the risk corridors program.
In addition to automatic data verification checks, CMS requires issuers to  conduct a third-party risk adjustment data validation audit of their risk  adjustment program, starting with a 2015 audit of 2014 benefit year data.  The third-party audits address individual claims data that CMS does not  receive in the summary reports generated by issuers in the distributed  data approach. CMS will require issuers to conduct the data audits  annually in two phases. For the first phase, each issuer must have a  sample of its risk adjustment data, as selected by CMS, audited by an  independent party. The audit must include validation of all enrollment,  demographic, and medical data for enrollees in the data sample. For the  second phase, CMS will audit a sub-sample of validated data from the  initial audit. Beginning with 2016 benefit year data, CMS will adjust the  amount issuers owe or receive under the risk adjustment program based  on the audit results. Given the complexity of the risk adjustment program  and the audit process, the agency was concerned that adjusting  payments and charges without first gathering information on the  prevalence of data errors could lead to a costly and potentially ineffective  audit program.
CMS officials told us that they are in the process of developing standard  operating procedures for auditing the reinsurance and risk corridors  programs. They said that they are developing a contract for auditing  issuers’ reinsurance and risk corridors data submissions. The audits will  review a variety of things, such as compliance with definitions of terms  used to identify issuers that are required to make reinsurance  contributions and accurate enrollment reporting for reinsurance  contributions.

		CMS Has Initiated Efforts to Evaluate the Risk Adjustment Program

CMS officials told us that an evaluation of the risk adjustment program  would be conducted under contract by an organization with expertise in  design and evaluation of risk adjustment models. A permanent risk  adjustment program that accurately predicts the expected costs of  enrollees is a critical factor in ensuring the long-term stability of health  insurance markets under PPACA. If certain groups of enrollees are not  accurately scored under the program, it could undermine the program’s  integrity and result in issuers seeking to avoid enrolling sicker individuals  or deciding to leave the market. In November 2014, CMS issued a  request for contractors to submit bids to conduct a range of services  related to Medicare and the PPACA insurance market reforms, including  research and development for the PPACA risk adjustment program. The  bid request identified general research and development tasks for the risk  adjustment program, such as analysis of the impact of market and  enrollee factors on the model, evaluation of the accuracy of the risk  adjustment program, and research to support adaptation of the model.  The bid request also required the contractor to develop the specific  details of the evaluation.
At the time of this report, CMS was reviewing contract bids to evaluate  the PPACA risk adjustment program. As of April 2015, CMS expected to  award this contract in the spring of 2015, although the agency had not  specified the timing and scope of the evaluation. In addition, CMS was in  the process of procuring an audit contractor and expected to award the  audit contract near the end of fiscal year 2015.
Past evaluations of the Medicare risk adjustment program have improved  the predictive accuracy of that model. Specifically, evaluations for  Medicare Advantage and Medicare Part D have identified areas for  improvement in these programs’ risk adjustment models and have led to  greater predictive accuracy, which refers to how well the models predict  the cost of enrollees. CMS contracted for five evaluations of the predictive  accuracy of the Medicare risk adjustment models between 2004 and  2012—three of the Medicare Advantage program and two of the Medicare  Part D program—and CMS officials told us that these evaluations have  had important implications for the programs. It is critical that CMS  similarly understands whether or not the new PPACA risk adjustment  model is accurately reflecting costs, and CMS’s continued effort to carry  out this evaluation will be important to the program’s success.

	Interviewed Issuers Described Benefits of the PPACA Risk Mitigation Programs, Although Some Had Concerns Related to Design and Implementation

Most of the 12 issuers we interviewed said that the three risk mitigation  programs encouraged their participation in the individual health insurance  market, and two of the programs allowed them to lower their premiums.  Issuers identified design concerns specific to each PPACA risk mitigation  program and provided mixed responses regarding the effect of CMS’s  implementation delays and technical assistance.

		Most Issuers Interviewed Said That All Three Risk Mitigation Programs Encouraged Their Participation in the Individual Health Insurance Market, and Two Programs Affected Their Premiums

Most of the 12 issuers we interviewed said that, beginning in 2014, the  PPACA risk adjustment program positively influenced their participation in  the individual health insurance market and that the PPACA reinsurance  and risk corridors programs positively influenced their participation in the  market and also led them to set lower premiums than they otherwise  would have offered. (See table 4 for specific counts for each program.)  Results for each program are as follows:
Risk adjustment: Eight issuers said that the risk adjustment program  positively influenced their decision to participate in the individual  market; for example, one issuer that was new to the market said that it  would not have participated without the risk adjustment program  because it believed that established issuers would seek to attract the  healthiest individuals. With respect to premiums, seven issuers (six  of which cited an influence on participation) said that the risk  adjustment program had no impact on the premiums they offered for  2014. Some of these issuers indicated that the lack of market-wide  risk score data limited the influence of risk adjustment on their  premiums because issuers were only able to calculate estimates of  their own risk scores and not relative market-wide risk scores. Without  knowing its relative market-wide risk score, an issuer does not know  whether it will be a payer or receiver under the risk adjustment  program and therefore cannot incorporate such information into its  financial planning and accounting processes. Two issuers specifically  suggested that CMS should provide periodic risk adjustment reports  that contain relative market-wide information. Another issuer said  that such information would be useful, but that they would not rely on  the information if it was incomplete—for example, if it was based on  data from a portion of the year or did not include data for all issuers in  the market.
Reinsurance: Seven issuers said that the reinsurance program  positively influenced their decision to participate in the individual  market, including two issuers which described the reinsurance  program as the most influential of the three risk mitigation programs  on their decision to participate. With respect to premiums, ten  issuers said that the reinsurance program allowed them to offer lower  premiums in 2014 and 2015. Seven of these issuers reported this  reduction to be in the range of 8 to 13 percent lower than they would  have otherwise set for 2014. Five of these seven issuers indicated a  smaller reduction for 2015, with some explaining that this smaller  reduction reflects the decrease in funding statutorily available to pay  reinsurance claims.
Risk corridors: Nine issuers said that the risk corridors program  positively influenced their decision to participate in the individual  market in 2014. However, one of these issuers characterized the  program as the least influential of the three risk mitigation programs  for this decision. Three issuers that credited the program with  encouraging their participation nevertheless expected that the  program’s effect would diminish over time as they gain more  experience. With respect to premiums, seven issuers said that the  program influenced their premiums in 2014; five of these issuers said  that the program allowed them to set lower premiums than they  otherwise would have due to the mitigation of potential financial loss.  Two issuers noted that their state regulators do not allow itemized  references to the risk corridors program when the issuers submit their  premiums to the states’ insurance regulators.

		Issuers Identified Design Concerns Specific to Each PPACA Risk Mitigation Program, Including Concerns about Data Sources, Funding Availability, and Program Tenure

Issuers identified concerns with specific aspects of each of the three risk  mitigation programs, including concerns about the sources of data used  for the risk adjustment program and about the availability of funding for  and temporary tenure of the reinsurance and risk corridors programs.
Risk Adjustment: All 12 issuers we interviewed said that they would  prefer the risk adjustment model to include prescription drug data in its  risk score calculations.information about enrollee diagnoses, is available quickly, and would  improve the accuracy of risk adjustment calculations and payments to  issuers. Other issuers commented that prescription drug data is less  prone to errors and misreporting and is administratively straightforward  for issuers to manage, compared to other sources of diagnostic data.  However, 2 issuers acknowledged that the inclusion of pharmacy data in  the risk score calculation would pose an additional administrative burden  on CMS.
One issuer noted that such data provides useful  Reinsurance: Most of the 12 issuers we interviewed expressed concerns  about the availability of funding and about the timing of reinsurance  payments and payment estimate reports. Six issuers expressed  uncertainty about whether the program will receive its planned  contributions. For example, 1 issuer said that because the contribution  amount and the payment parameters are based on an estimate made by  CMS, it is possible that CMS may collect less than it targeted if the  estimate is incorrect. Eight issuers said that more frequent payments  from CMS would improve cash flow. However, 2 other issuers said that  more frequent payments would increase the temporary program’s  administrative burden. With regards to the quarterly reports of estimated  payments and contributions that CMS could not provide in 2014 due to  the EDGE server implementation delays, 6 issuers said that these reports  would have provided them with information to incorporate into their  financial planning and reporting processes. However, several issuers  noted that these reports are less important than those in the risk  adjustment program, because issuers do not need additional data or  modeling from CMS to generate their own reinsurance payments  estimates.
Risk Corridors: Most of the 12 issuers we interviewed cited uncertainty  about the extent to which funds would be available. Ten issuers said that  they did not support the agency’s decision to manage the risk corridors  program in a budget neutral manner. One of these issuers described  CMS’s decision to operate the program as budget neutral in 2014 and  2015 as a reversal of previous guidance, but noted that CMS has since  been clear about operating in a budget neutral manner by limiting risk  corridors payments for 2014 and 2015 to available collections.issuers described scenarios in which a budget neutral policy would not be  sufficient to make needed payments; if an issuer priced premiums very  low, that issuer may have significant losses and the remaining issuers  may not have sufficient profit to cover those losses. Another 2 of these   Two  issuers indicated that the status of the program’s funding as budget  neutral and the possibility that there will not be enough funds collected to  pay for losses will have a material impact on their premium decisions for  2016.
Tenure of Temporary Programs: Eleven of the 12 issuers we  interviewed said that the 3-year timeline for the temporary reinsurance  and risk corridors programs may not afford enough time for issuers to  adjust to the market changes under PPACA. Some issuers said that this  was particularly true given ongoing policy changes and delays that  contributed to lower than expected enrollment and limited the availability  of data on new enrollees. They said that without these data, they do not  have sufficient information to confidently set premiums. For example, 6  issuers described lower than expected enrollment rates in their market  due to CMS policy changes, such as delaying implementation of a  requirement that certain employers provide health insurance to their  employees, and allowing transitional plans. As a result of this lower  than expected enrollment, issuers may have less information on the  population that may eventually enroll under PPACA. When the programs  expire, issuers will have less enrollee data than they originally expected  with which to formulate their premiums. Two issuers who were new to the  individual market in 2014 said that extending the temporary programs  would provide more time for them to gather additional data. Otherwise,  they will be at a disadvantage when the temporary programs expire in  2016 in contrast to more established issuers that already possess prior  claims data.
Due to concerns about the adequacy of the 3-year time period, 10 of the  12 issuers suggested extending the reinsurance program beyond its  scheduled expiration. Nine of the 12 issuers suggested that the temporary  reinsurance program be extended for 1 or 2 years and 5 of these issuers  noted that they expect that premiums will rise significantly in 2017 in  response to the expiration of the program at the end of 2016. Seven of  the 12 issuers suggested extending the risk corridors program, with 5 of  them specifying that the program be extended for either 1 or 2 years.

		Issuers Provided Mixed Responses Regarding the Effect of CMS’s Implementation Delays and Technical Assistance

Most of the 12 issuers we interviewed supported CMS’s choice of the  distributed data collection approach for the risk adjustment and  reinsurance programs, although they offered mixed responses about how  they were affected by CMS’s decision to change how it implemented the  EDGE servers and the resulting delays in implementation:
Six of the issuers we interviewed said that the delays in implementing  the EDGE servers were exceedingly disruptive or significant to them.  They indicated that CMS’s policy changes resulted in wasted time and  resources and required them to redevelop their plans for procuring  and launching the servers. Although noting that the policy changes  caused problems for them, five of these six issuers said that they  supported CMS’s final decision to allow issuers to use either virtual or  on-premise EDGE servers.
The other six issuers—four of whom were new to the individual  market in 2014, including two COOPs—said that EDGE server delays  did not affect them. Three of these issuers told us that they had  already purchased a physical server when CMS announced that all  issuers had to use the Amazon Web Services option. However, they  said that they were able to repurpose the physical servers and chose  to use the Amazon option; therefore, CMS’s decision did not have a  significant negative effect on their companies.
In addition, 8 of the 12 issuers we interviewed expressed concerns about  CMS’s ongoing implementation of data collection systems. For example,  these issuers noted that they have continued to experience challenges  uploading data using the EDGE servers and incorporating CMS’s ongoing  corrections to its software code. For instance, 1 issuer described how  CMS released software code for issuers to use the following morning to  run risk adjustment calculations, but then rescinded the code the following  afternoon because of an error. The issuer said that this example  illustrates how CMS was releasing software before conducting the  necessary quality assurance checks and was correcting problems as it  went. This issuer also described how CMS released software that was  missing 7,000 diagnostic codes. Five issuers raised concerns about  another aspect of CMS’s implementation of data collection systems.  Specifically, these issuers noted that the small window of time CMS  allotted between when it informs issuers of estimated payments and  contributions and when issuers’ final data submissions are due could be  problematic if there is a need for significant reconciliations between  CMS’s and issuers’ calculations.
Finally, nearly all 12 issuers said that they experienced challenges  obtaining technical assistance from CMS during implementation of the  EDGE servers. However, with respect to CMS’s ongoing technical  assistance and timeliness in responding to requests, they reported both  positive and negative experiences:
EDGE server implementation. Ten issuers reported challenges with  CMS technical assistance during EDGE server implementation,  including several issuers who reported an extended period of time  when CMS did not provide any guidance to issuers. Issuers reported  that during the period from the fall of 2013 through the spring of 2014,  they received no guidance from CMS about the EDGE servers. One  issuer noted that previously active user groups were disabled, and  therefore they had to put their implementation plans on hold. It was  during part of this period that individuals were first able to enroll in  health plans available on the health care exchanges.
Ongoing technical assistance. Issuers noted both positive and  negative experiences in terms of their ongoing efforts to get technical  assistance from CMS. For instance, four issuers told us that CMS  assigned individual account managers to each issuer in December  2014 to help with technical assistance, and two of these issuers said  that the account managers have helped them get more timely  responses from CMS. Another issuer said it had mixed results with  this manager, who sometimes provided useful information and other  times provided information that was contradicted by another source.  With regard to other forms of technical assistance, five issuers said  they were participating in regular calls and webinars with CMS  officials, and three of these issuers said they found these sessions to  be useful. However, some of these issuers also said that it was very  difficult to get their questions answered during these sessions due to  the high volume of questions being submitted to the agency.
Timeliness. Issuers provided mixed responses about CMS’s  timeliness in responding to current requests for assistance. Two  issuers told us that the timeliness had improved. However, two other  issuers told us that there were still unresolved requests related to data  submission issues, even though the relevant submission deadline had  passed.

	Agency Comments

We provided a draft copy of this report to HHS for its review and HHS  provided written comments, which are reprinted in appendix I. HHS  explained that CMS implemented the data collection strategy for these  programs utilizing new innovative technology as well as existing data  systems, and carried out the implementation in a phased approach. HHS  indicated that issuer data submissions through the EDGE server began in  September 2014 and CMS was on target to meet the regulatory deadline  of April 30, 2015, to upload final submissions by issuers of claims and  enrollment data for benefit year 2014. Further, HHS described CMS’s  efforts to ensure the appropriate level of technical support, including the  use of cross-functional teams that include software developers and  dedicated account managers for each issuer. HHS noted that CMS  solicited feedback directly from issuers and provided technical guidance  and multiple trainings.
In addition, HHS provided technical comments, which we incorporated  where appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of the Centers for Medicare &  Medicaid Services, and other interested parties. In addition, the report will  be available at no charge on the GAO website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-7114, or dickenj@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of our report. Key contributors to this report are listed in appendix II.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, William Hadley, Assistant  Director; George Bogart; Keara Castaldo; Julianne Flowers; Mary Giffin;  Sarah-Lynn McGrath; Laurie Pachter; Vikki Porter; and Leslie Powell  made key contributions to this report.

Summary:
Why GAO Did This Study

PPACA resulted in significant changes to the private individual and small group health insurance markets in 2014 that expanded the availability and affordability of coverage. However, some of these provisions reduced issuers' ability to mitigate the risk of high-cost enrollees by limiting their ability to deny coverage or charge higher premiums based on individuals' health risks and other factors. Issuers also faced increased risk starting in 2014 because these provisions were expected to result in the enrollment of many previously uninsured individuals, who have unknown and potentially higher medical costs than the broader population. To limit these risks, PPACA required the establishment of three risk mitigation programs.
GAO was asked to provide information on the design and development of these three programs and on issuer perspectives on them. In this report, GAO describes: (1) the factors that guided CMS's design of these programs, (2) the data collection systems CMS developed for these programs, (3) CMS's plans to monitor and evaluate the programs, and (4) issuer experiences with the programs. GAO reviewed regulations, guidance, and documentation about design and implementation activities and interviewed CMS officials. GAO also interviewed officials from a non-representative sample of 12 issuers that offered individual market coverage in 2014 and were selected based on variation in enrollment, location, and market experience.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) considered market characteristics and program duration in designing the three programs mandated by the Patient Protection and Affordable Care Act (PPACA) to mitigate the risks issuers of health insurance faced starting in 2014. Each of the three programs—risk adjustment, reinsurance, and risk corridors—was intended to account for a different source of issuer risk, such as enrollee health status or high-cost medical claims. CMS considered a range of market characteristics—including demographics and the availability of data—in making decisions about how to design each of the programs. CMS's design decisions also reflected the temporary status of the reinsurance and risk corridors programs, which are set to expire after 3 years. While CMS considered similar Medicare risk mitigation programs during the design process, key differences in the markets served by Medicare and the PPACA programs resulted in different approaches to their design.
CMS considered privacy and security concerns in developing systems for collecting issuer data for the risk mitigation programs and experienced multiple implementation delays. For example, for the risk adjustment and reinsurance programs, CMS elected to use a system that allows sensitive enrollee claims data to remain with issuers while providing CMS with only summary data. However, CMS delayed implementation of data collection systems for these programs by nearly a year as it revised its plans to reduce administrative burden and accommodate issuer preferences. Therefore, CMS was unable to provide issuers with most of the periodic, interim reports it had originally planned to generate throughout 2014.
CMS developed or had plans to develop data verification or audit procedures for all three programs. CMS had also initiated efforts to evaluate the permanent risk adjustment program but had not finalized the details of the evaluation. In November 2014, CMS issued a request for contractors to submit bids to conduct a range of services, including research and development tasks for the risk adjustment program such as: analyze the impact of market and enrollee factors on the model; evaluate the accuracy of the program; and conduct research to support adaptation of the model. As of April 2015, CMS officials expected to award the contract in the spring of 2015, although the agency had not finalized a date for completing that evaluation. CMS's continued effort to carry out this evaluation will be important to assessing the program's success.
Most of the 12 issuers GAO interviewed said that the three risk mitigation programs encouraged their participation in the individual health insurance market, and two of the programs allowed them to lower their premiums. Issuers identified design concerns specific to each PPACA risk mitigation program and provided mixed responses regarding the effect of CMS's implementation delays and technical assistance.
In commenting on a draft of this report, the Department of Health and Human Services described CMS's data collection strategy for these programs and its efforts to ensure the appropriate level of technical support for issuers.