GAO-01-652R Federal Enforcement of Health Insurance Standards

United States General Accounting Office

Washington, DC 20548

May 7, 2001

The Honorable James M. Jeffords

Chairman

Committee on Health, Education, Labor, and Pensions

United States Senate

 Subject: Private Health Insurance: Federal Role in Enforcing New Standards

Continues to Evolve

Dear Mr. Chairman:

In recent years, the Congress has passed the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) and three subsequent laws1 that create new

federal standards for private health insurance, which covers nearly 175 million

Americans under the age of 65. These laws include standards guaranteeing access to

health insurance for small employers and individuals with existing health conditions

as well as requirements for health plans regarding mental health services, hospital

care for mothers and newborns following childbirth, and reconstructive surgery

following a mastectomy. Responsibility for enforcing the new federal standards

established by these four laws is divided among state insurance regulators and three

federal agencies. Specifically, states maintain their traditional responsibility for

regulating insurance products sold in their states, but if they fail to substantially

enforce the minimum federal standards, the Department of Health and Human

Services (HHS), through the Health Care Financing Administration (HCFA), is

responsible for enforcing the federal laws. HCFA is also responsible for enforcing

the federal standards for nonfederal government health plans, such as health plans

offered to state and local government or school district employees. These laws also

expanded the Department of Labor’s responsibilities for ensuring that private

employer-sponsored group health plans meet federal requirements and provided the

Department of the Treasury with new authority to impose an excise tax on employers

found to violate the federal standards.

Because the Congress is currently considering new patient protection standards—

and because some proposals would model enforcement on the approach used in

HIPAA and other laws—you asked us to provide an update on federal agencies’

enforcement of the existing health insurance standards. Specifically, we examined

 1

The Mental Health Parity Act of 1996, the Newborns’ and Mothers’ Health Protection Act of 1996, and

the Women’s Health and Cancer Rights Act of 1998.
Page 2 GAO-01-652R Federal Enforcement of Health Insurance Standards

• HCFA’s progress in enforcing these new federal health insurance standards,

• Labor’s enforcement of standards on private employer-sponsored health plans,

and

• Treasury’s imposition of an excise tax for noncompliant employers.

To address these objectives, we interviewed headquarters and regional

representatives of HCFA, officials from Labor and Treasury, and insurance

regulators in several states, and we obtained and reviewed documents from HCFA

and Labor. We conducted our work in March and April of 2001 in accordance with

generally accepted government auditing standards.

In brief, federal agencies have continued to make progress in developing and

implementing mechanisms to ensure that employers and carriers comply with new

federal health insurance standards. HCFA’s enforcement role has evolved since our

last report in March 2000 when the agency was largely responding to consumer

complaints and attempting to ascertain the scope of its responsibilities in view of

state responsiveness to the legislation.2 Since that time, HCFA has completed its

review of state laws related to three of the four recent federal laws and identified five

states—Colorado, Delaware, Massachusetts, Missouri, and Wisconsin—where it is

necessary for HCFA to enforce federal standards. The agency has not fully assessed

state conformance with the Mental Health Parity Act, which is scheduled to sunset

later this year. The agency has undertaken relatively comprehensive enforcement

activities in Missouri—including reviews of carriers’ policy forms and business

practices and responding to consumers’ complaints—where it has had a role

enforcing HIPAA standards since 1997 when the state notified HCFA that it was not

enforcing the federal law. HCFA has more recently initiated enforcement activities in

the remaining four states. HCFA’s role in enforcing federal standards for nonfederal

government health plans in all states has been limited to responding to a relatively

small number of inquiries and complaints from participants in these plans.

The Department of Labor’s enforcement activities for private employer-sponsored

health plans have also expanded from its complaint-driven enforcement of limited

federal reporting and disclosure requirements under the Employee Retirement

Income Security Act of 1974 (ERISA). The agency has undertaken a more proactive

role in measuring health plan compliance with the new federal standards. In

particular, Labor has developed and implemented a system to conduct random

compliance reviews of employer-sponsored health plans so that next year it can

estimate the extent of HIPAA compliance nationwide. Finally, the Department of the

Treasury has not yet developed an enforcement strategy focused specifically on the

new federal standards, nor has it exercised its new authority to impose an excise tax

on noncompliant employers. We provided a draft of this report to the three agencies

for their review. In written comments, HCFA and Labor generally agreed with our

characterization of their evolving enforcement roles. Treasury did not provide

written comments.

 2

Implementation of HIPAA: Progress Slow in Enforcing Federal Standards in Nonconforming States

(GAO/HEHS-00-85, March 31, 2000). A list of related products is included at the end of this letter.
Page 3 GAO-01-652R Federal Enforcement of Health Insurance Standards

BACKGROUND

Since 1996, the Congress has passed four laws that establish new federal standards

for private health plans. HIPAA includes minimum standards to improve the access,

portability, and renewability of health insurance coverage in employer-sponsored

group plans and individually purchased nongroup plans. Subsequent laws established

minimum requirements for health plans covering mental health services, hospital

maternity care, and mastectomies. Specifically, see the following.

• HIPAA (1) requires insurance carriers to offer coverage to all small employers

(defined as those with 2 to 50 employees) that apply (a standard known as

guaranteed issue), (2) requires all health coverage to be renewable upon

expiration of the policy term (guaranteed renewal), (3) prohibits excluding an

employee from a group health plan, or varying benefits, premiums, or employer

contributions, on the basis of health status (nondiscrimination), (4) sets a

maximum length of time that group health plans may exclude coverage for

preexisting conditions, (5) provides credit against any preexisting condition

exclusion for individuals with prior continuous coverage (group-to-group

portability), and (6) guarantees eligible individuals losing group coverage access

to coverage through individually purchased insurance or alternatives, such as

state-sponsored high-risk pools (group-to-individual portability).3

• The Mental Health Parity Act of 1996 prohibits group plans that provide mental

health benefits from imposing annual and lifetime dollar limits that are more

restrictive for mental health benefits than for other medical and surgical

benefits.4

• The Newborns’ and Mothers’ Health Protection Act of 1996 prohibits plans that

provide maternity benefits from restricting benefits for a hospital stay in

connection with childbirth to less than 48 hours following a vaginal delivery or

96 hours following a cesarean section.5

• The Women’s Health and Cancer Rights Act of 1998 requires all plans that

provide mastectomy coverage to also provide coverage for related

reconstructive surgery and certain other follow-up care.

The responsibility for ensuring that consumers receive these protections is shared by

the states and multiple federal agencies. State insurance regulators have primary

 3

An eligible individual has had at least 18 months of creditable coverage with no break of more than 63

consecutive days; has exhausted any federal or state mandated continuation coverage; is not eligible

for any other group coverage, Medicare, or Medicaid; and did not lose group coverage because of

nonpayment of premiums by the individual or certain other reasons including fraud. To meet the

group-to-individual portability requirement, states may require individual market carriers to offer

coverage to eligible individuals or use an alternative means, such as a high-risk pool.

4

The Mental Health Parity Act applies only to groups with more than 50 employees.

5

In contrast to the other laws that establish minimum federal standards, under the Newborns’ and

Mothers’ Health Protection Act certain state laws that meet some, but not all, of the federal

requirements are deemed to be acceptable.
Page 4 GAO-01-652R Federal Enforcement of Health Insurance Standards

enforcement authority for insurance carriers in states that have laws that

substantially conform to or exceed these federal standards or that otherwise

substantially enforce the federal standards.6

 HCFA is responsible for directly

enforcing the federal health insurance standards for carriers in states that fail to

substantially enforce the federal standards. In this role, HCFA must assume many of

the responsibilities undertaken by state insurance regulators, such as responding to

consumers’ inquiries and complaints, reviewing carriers’ policy forms and business

practices, and imposing civil monetary penalties on noncomplying carriers.7 In all

states, HCFA is generally required to enforce the federal standards for nonfederal

government health plans, such as plans covering state and local government

employees. Enforcement responsibility for the standards under HIPAA and the

related federal laws was added to Labor’s existing oversight role for private

employer-sponsored benefits established under ERISA. HIPAA also provided

Treasury with authority to impose an excise tax on noncompliant employers and plan

administrators.

In March 2000, we reported that nearly 4 years after HIPAA’s enactment, HCFA was

still in the early stages of fully identifying where federal enforcement was needed.

We recommended that HCFA promptly complete its determination of which states

required federal enforcement and develop a consistent strategy for doing so. The

agency had assumed enforcement activities, such as reviewing carrier policies and

business practices in three states (California, Missouri, and Rhode Island) that had

voluntarily notified HCFA of their failure to enforce some HIPAA standards.

However, the agency was still in the process of fully determining state conformance

with the standards under HIPAA and the related laws and was largely reacting to

consumers’ inquiries and complaints. HCFA had contacted states without

conforming laws to determine whether they were substantially enforcing the federal

standards through other means, such as regulations or advisory bulletins. It had yet

to fully determine its enforcement responsibilities among nonfederal government

plans and was also relying on complaints from enrollees to identify compliance

problems. In earlier reports, we also examined Labor’s increased enforcement

responsibilities under HIPAA, and we found that the agency tended to rely largely on

consumer complaints to identify noncompliance.8

 Recognizing the increased scope

and complexity of its responsibilities under HIPAA and related federal laws, Labor

was attempting to enhance its customer service function. It increased the number of

customer service staff available to respond to public inquiries, provided consumer

education materials, and was undertaking other improvements, such as conducting

compliance reviews of randomly selected employers.

 6

HCFA officials said, absent conforming laws, they consider states to be substantially enforcing the

federal standards if alternative means exist, such as regulations, advisory bulletins, or other guidance

issued by state regulatory agencies directing insurers to meet standards consistent with the federal

requirements.

7

HIPAA provides for the imposition of a civil monetary penalty of up to $100 per day per violation for

each individual affected by a carrier’s failure to comply.

8

Private Health Insurance: Progress and Challenges in Implementing 1996 Federal Standards

(GAO/HEHS-99-100, May 12, 1999).
Page 5 GAO-01-652R Federal Enforcement of Health Insurance Standards

THE SCOPE OF HCFA’S ENFORCEMENT RESPONSIBILITIES CONTINUES TO

EVOLVE

HCFA has completed its review of state laws for conformance with three of the four

statutes with new federal health insurance standards. In doing so, it has

accomplished an important task it had previously identified as needed to clarify the

scope of its enforcement role and has largely responded to the recommendation we

made in our March 2000 report. The agency identified five states—Colorado,

Delaware, Massachusetts, Missouri, and Wisconsin—that do not substantially enforce

at least one of the four federal standards, thus requiring HCFA to assume a direct

enforcement role. Although the agency has undertaken fairly extensive enforcement

activities in Missouri, where it has had a role enforcing HIPAA standards since 1997,

in the remaining four states it is in the initial stages of enforcement activities. In

addition to specific enforcement responsibilities in these five states, HCFA will

regularly reevaluate conformance with the federal standards in the remaining states

and continue to field inquiries and complaints from consumers nationwide. HCFA

continues to rely on consumer complaints to enforce standards on nonfederal

governmental plans, but limited consumer knowledge of their rights may hinder the

effectiveness of this approach. HCFA staff dedicated for the enforcement of these

federal standards has declined as its role has diminished and become more clearly

defined. Several factors, however, including the possible reauthorization of the

Mental Health Parity Act, could change the scope of HCFA’s enforcement

responsibilities in the future.

HCFA Has Identified Five States Where It Will Enforce Federal Standards

HCFA has completed its analysis of state laws to determine conformance with

standards contained in three laws—HIPAA, the Newborns’ and Mothers’ Health

Protection Act, and the Women’s Health and Cancer Rights Act—and has determined

that five states lack laws, regulations, or administrative mechanisms that address the

requirements of one of the federal statutes, requiring HCFA to assume enforcement

responsibilities.9 HCFA did not make a determination as to whether each state fully

conformed to the Mental Health Parity Act. Rather, because the federal parity law

will sunset on September 30, 2001, unless reauthorized by the Congress, the agency

chose to confirm only that each state had some standard related to parity in mental

health coverage, but not that the standard fully met the federal minimum

requirement. HCFA officials told us they intend to more fully determine each state’s

conformance if the Congress acts to extend or modify the federal parity law.

HCFA determined that each of the five states did not conform with only one of the

three laws. For HIPAA, Missouri remains the only state without conforming

legislation. Two of the three states in which HCFA had assumed HIPAA enforcement

activities for the past several years—California and Rhode Island—passed

 9

For the Newborns’ and Mothers’ Health Protection Act, HCFA relied on Labor’s analysis of state

conformance.
Page 6 GAO-01-652R Federal Enforcement of Health Insurance Standards

conforming legislation in 2000. Accordingly, HCFA has largely phased out

enforcement activities in these states. HCFA determined that Wisconsin does not

fully conform to the Newborns’ and Mothers’ Health Protection Act, and Colorado,

Delaware, and Massachusetts do not fully conform to the Women’s Health and

Cancer Rights Act.10 (See table 1.)

Table 1: States That Do Not Fully Conform With Three Federal Laws

HIPAA Newborns’ and

Mothers’ Health

Protection Act

Women’s

Health and

Cancer Rights

Act

Colorado X

Delaware X

Massachusetts X

Missouri X

Wisconsin X

Source: HCFA, April 2001.

State officials in some of these states commented on the likelihood of passing

conforming legislation in the future. While a Delaware official told us that the state

was likely to enact conforming legislation this year, officials in Colorado,

Massachusetts, and Wisconsin said they did not believe that their states would pass

conforming legislation in the near term and therefore would require an ongoing role

by HCFA. Some of these officials suggested that their state legislatures did not view

enactment as a high priority, believing most carriers complied with the federal

standards even without the state taking any action. For example, the Colorado

Division of Insurance conducted a survey of the 10 largest carriers in the state and

determined that each already provided coverage for reconstructive surgery after a

mastectomy, even though the state had not passed conforming legislation. Based on

the survey results and lack of consumer complaints related to the issue, the state

decided not to pursue conforming legislation.

HCFA Has Direct Enforcement Authority in Five States and Assumes a More Limited

Role in the Remaining States

Although HCFA has been actively enforcing HIPAA in Missouri for several years, its

enforcement activities in the other four states have generally just begun. In addition,

HCFA’s activities in California and Rhode Island, where it has had an enforcement

role since 1997, are being phased out because both states passed HIPAA conforming

legislation in 2000.

In 1997 when Missouri notified HCFA of its failure to pass HIPAA conforming

legislation, HCFA assumed enforcement responsibilities in the state for several

 10HCFA earlier determined that North Dakota did not conform to the Women’s Health and Cancer

Rights Act and initiated enforcement activities by sending letters to issuers in the state in January

2001. However, the state has since passed conforming legislation and has assumed enforcement

responsibility for the standard.
Page 7 GAO-01-652R Federal Enforcement of Health Insurance Standards

HIPAA standards in both the individual and group markets. Although HCFA’s

enforcement role began with responding to consumer inquiries and complaints, its

Kansas City regional office began reviewing carrier policies for compliance in 1998

and has since reviewed policies representing approximately 95 percent of the state’s

small group, individual, and health maintenance organization markets.11 In addition,

the regional office began on-site market conduct examinations in June 1999. In a

market conduct examination, HCFA’s contractor reviews a carrier’s business

practices for compliance with HIPAA standards. As of April 2001, HCFA had

completed two market conduct examinations and an additional six were under way.

These eight carriers collectively insure about 60 percent of Missouri’s private

insurance market. A common problem identified during policy and market conduct

reviews was lack of guaranteed access to individual insurance market products for

eligible individuals. For example, HCFA officials said that some carriers in Missouri

did not attempt to determine whether an applicant was eligible for group-toindividual portability under HIPAA and did not inform eligible individuals about the

availability of guaranteed issue products. In the market conduct reviews, HCFA also

identified problems with HIPAA’s guaranteed issue standard in the small group

market. Officials cited examples of carriers structuring agent commissions in a

manner that discouraged the referral of very small groups.

Because of the expertise it has developed in Missouri, HCFA has decided to

centralize responsibility for enforcement of the applicable federal standards in the

remaining four states in the Kansas City regional office. Much as it did in Missouri,

HCFA will field consumer inquiries and complaints, review policies, and conduct

market examinations related narrowly to provisions of the Newborns’ and Mothers’

Health Protection Act or Women’s Health and Cancer Rights Act with which the four

states are not in conformance. However, although the coordination between HCFA

and each state is delineated in letters sent to the states last year, regulatory and

enforcement activities are essentially just under way in three of the four states. For

example, HCFA has recently sent letters to carriers operating in Colorado, Delaware,

and Massachusetts notifying them of its intent to enforce the Women’s Health and

Cancer Rights Act and requesting policies to review. Enforcement efforts are further

along in Wisconsin, where HCFA has sent letters to the 37 largest carriers notifying

them of HCFA’s role in enforcing the Newborns’ and Mothers’ Health Protection Act

and has reviewed policies representing about 40 percent of the state’s group market

and 10 percent of its individual market.

In addition to specific enforcement responsibilities in these five states, HCFA will

regularly update its legislative review of other states’ laws to ensure that they

continue to substantially enforce the federal standards. HCFA will also continue to

field inquiries and complaints from all states. Since January 1997, the agency has

been recording inquiries and complaints it has received related to the federal

standards. To collect consistent data from across all regions, HCFA developed an

electronic complaint tracking system that was implemented in June 2000. From

March 2000 through March 2001, HCFA documented 1,492 inquiries and 133

 11According to regional officials, HCFA is likely to conduct a comprehensive rereview of Missouri

carrier policies for HIPAA compliance on a 3-year cycle similar to many state insurance departments.

HCFA will conduct more frequent reviews if complaints received indicate nonconformance.
Page 8 GAO-01-652R Federal Enforcement of Health Insurance Standards

complaints; over half of the complaints dealt with the standards for the individual

market.12 A common complaint involved allegations that carriers delayed processing

applications, which resulted in qualified individuals becoming ineligible for HIPAA’s

protections.

Although HIPAA provides for the imposition of a civil monetary penalty on

noncomplying carriers, and the final enforcement regulations include detailed

standards to follow in imposing penalties, HCFA has yet to impose such a penalty on

a carrier. In lieu of civil monetary penalties, officials in the Kansas City regional

office said that they have successfully negotiated voluntary settlements totaling

$187,000 with several carriers that agreed to pay consumers for claims that were

wrongly denied.

HCFA’s Enforcement Efforts for Nonfederal Governmental Plans Have Been Limited

HCFA is also responsible for enforcing federal insurance standards on state and local

government health plans, such as health plans for public universities and city, county,

and state governments.13 Unlike private employer-sponsored plans, nonfederal

government plans are generally not subject to many of the employee benefit

protections under ERISA. For example, these plans are not required to file plan

information with the federal government or provide participants with a description of

their plans. In addition, HIPAA and the related laws permitted self-funded,

nonfederal government plans to exempt themselves from federal standards related to

access, portability, and renewability, as well as those related to mental health,

hospital stays connected with childbirth, and reconstructive surgery following a

mastectomy.

HCFA maintains responsibility for enforcing the federal standards on self-funded,

state and local government plans that do not exempt themselves from the standards.

However, according to HCFA officials, the agency lacks authority to collect

information from states regarding the number of nonfederal government plans

operating in them and is not otherwise aware of reference sources that would provide

such information. Thus, HCFA has been unable to determine the universe of

nonfederal government plans for which it has responsibility and has instead relied on

consumer complaints to identify possible areas of noncompliance. Few such

 12According to HCFA officials, about 35 to 40 percent of the complaints originated in states where

HCFA had enforcement authority.

13Nonfederal government health plans that elect exemption from one or more of the standards must

file or renew their exemptions with HCFA annually under procedures set out in regulation, notify

participants about the election, and provide for the certification and disclosure of creditable coverage.

As of March 2001, 533 plans in 35 states had exempted themselves from at least one of the standards.

About 90 percent opted out of standards related to limits on preexisting condition exclusion periods,

special enrollment periods, prohibition against discrimination based on an individual’s health status,

and mental health parity; nearly three-quarters opted out of the standards related to newborns and

mothers; and about one-third opted out of the requirement to provide reconstructive surgery following

a mastectomy. A fully insured nonfederal government plan that buys insurance coverage from a

carrier does not have the ability to opt out since the carrier must comply with all HIPAA group market

standards.
Page 9 GAO-01-652R Federal Enforcement of Health Insurance Standards

complaints have been received—less than 10 percent of the HIPAA-related

complaints received in the last year were related to nonfederal governmental plans.

However, enrollees’ potential lack of knowledge about their rights and the

appropriate manner in which to pursue grievances may limit the effectiveness of

HCFA’s complaint-driven oversight approach for these plans.

Number of HCFA Staff Needed for HIPAA Enforcement Has Continued to Decline,

but Questions Remain About the Extent of HCFA’s Future Enforcement

Responsibilities

As of April 2001, HCFA had about 16 full-time equivalent (FTE) staff assigned to

HIPAA implementation and enforcement efforts. Of this total, 10 were assigned to

HCFA’s central office within the Center for Medicaid and State Operations, 3.5 to the

Kansas City regional office and about 0.25 FTE to each of the remaining nine regional

offices.14 These 16 FTEs—which include former state insurance regulators, attorneys,

and an insurance examiner—represent a continued decline in HCFA staff dedicated to

enforcing these standards, from about 39 in July 1998 and 31.5 in March 2000. HCFA

officials told us that its resources are adequate for its current enforcement activities

because its enforcement role is now more clearly defined and the need for resources

has been reduced, in part, because several states have recently passed laws to

enforce HIPAA at the state level. In addition, officials said they have benefited from

the experience gained in conducting insurance regulatory functions over the past few

years.

Several factors could change the scope of HCFA’s enforcement responsibilities in the

future. Some of the five states where HCFA has an enforcement role may come into

conformance, thus diminishing HCFA’s role. Also, HCFA’s plan to regularly update

its legislative review of other states’ laws to ensure that they continue to substantially

enforce the federal standards could also increase or decrease its level of effort.

Further, because HCFA has not fully established whether states are substantially

enforcing the Mental Health Parity Act, HCFA will need to review state laws if the

Congress decides to reauthorize the law beyond September 30, 2001. We previously

reported that, as of March 2000, laws in eight states and the District of Columbia

might not conform to the federal parity law, and seven states had no law addressing

mental health coverage.15 Although several of these states have since enacted laws,

several may remain out of conformance. Unless these states issue regulatory

bulletins or otherwise demonstrate that they are substantially enforcing the federal

standards, HCFA could be required to take an enforcement role in the states. Finally,

HCFA’s enforcement role could expand if the Congress enacts patient protection

legislation that requires HCFA to assume similar enforcement responsibilities.

 14HCFA also uses an external contractor to perform market conduct examinations.

15Mental Health Parity Act: Despite New Federal Standards, Mental Health Benefits Remain Limited

(GAO/HEHS-00-95, May 10, 2000).
Page 10 GAO-01-652R Federal Enforcement of Health Insurance Standards

LABOR HAS EXPANDED ITS ENFORCEMENT ACTIVITIES TO BETTER ENSURE

PRIVATE EMPLOYER COMPLIANCE

Labor has had a long-standing responsibility for ensuring that private employersponsored group health plans meet certain fiduciary, reporting, and disclosure

requirements related to the provision of health benefits under ERISA. Its

enforcement approach has traditionally been largely complaint-driven. Because of

the increased scope and complexity of its role in enforcing new federal standards

under HIPAA and the related laws, Labor has modified this process to better ensure

that these health plans comply also with these new standards and has increased the

level of resources devoted to health plan enforcement.16 For example, it has

implemented a system of coding consumer inquiries and complaints to better capture

information related specifically to standards under HIPAA and the related federal

laws. In addition, it has developed and refined a checklist that it uses for conducting

compliance reviews of private employers. The checklist includes specific steps for its

investigators to follow in examining health plan compliance. Labor officials note that

all compliance reviews now include a full review for all federal standards under

HIPAA and the related laws, regardless of the initial reason for the review. Officials

told us that they have adequate resources to meet their increased responsibilities.

In fiscal year 1999, Labor undertook a pilot project to conduct compliance reviews of

a sample of private employer-sponsored health plans.17 The agency conducted about

230 of these reviews in fiscal year 1999 and an additional 356 from fiscal year 2000

through the second quarter of fiscal year 2001. The agency plans to conduct about

1,250 additional, randomly selected reviews this fiscal year. This random selection

method will, for the first time, enable the agency to project these results nationally.

This will provide a baseline for assessing the extent to which private, employersponsored group health plans are complying with the federal standards, and the

results are expected to be available in the second quarter of fiscal year 2002.

In its fiscal year 1999 pilot reviews, Labor found noncompliance rates of about 21

percent for certain HIPAA standards, 12 percent for Mental Health Parity Act

standards,18 and 26 percent for the Newborns’ and Mothers’ Health Protection Act

standards.19 According to Labor officials, many of the violations are largely technical

in nature, such as employers or plan administrators who do not update their plan

 16Labor FTEs devoted solely to health related activities grew from about 66 in 1997 to about 101

currently. This number includes FTEs allocated to compliance assistance and outreach activities.

17These audits are in addition to those it conducts in response to consumer complaints.

18We previously reported that a significant minority of private employers may not be fully complying

with the federal Mental Health Parity Act (GAO/HEHS-00-95). Based on a random sample of nearly 900

private employers in 26 states and the District of Columbia with laws not more comprehensive than

the federal standards, we reported that about 14 percent of plans were not compliant in that they had

annual or lifetime dollar limits for mental health benefits that were more restrictive than those for

medical and surgical benefits.

19The Women’s Health and Cancer Rights Act was passed more recently than HIPAA and the related

laws and was therefore not addressed in the pilot audits.
Page 11 GAO-01-652R Federal Enforcement of Health Insurance Standards

documents to reflect required changes or issue required notices to enrollees

concerning new protections. Another relatively common violation is the imposition

of a “hidden” preexisting condition exclusion clause. Under such a clause, a health

plan excludes coverage for a certain condition without specifically referring to it as a

preexisting condition exclusion clause. Upon identifying a violation, Labor will send

a letter to the employer or plan administrator outlining the violation and initiating a

dialogue seeking voluntary correction. Accordingly, the vast majority of compliance

problems are resolved voluntarily, according to Labor officials. The agency has not

resorted to legal action or made any referrals to the Department of the Treasury for

the imposition of an excise tax.

TREASURY RELIES ON VOLUNTARY COMPLIANCE AND REFERRALS FROM

LABOR

Treasury’s enforcement of the standards under HIPAA and the related laws currently

relies on voluntary employer compliance and referrals from Labor. The divisions

within Treasury that have enforcement authority were created following a recent

agencywide reorganization and, according to officials, as of April 2001, they have not

yet begun to develop a strategy focused on these standards. Nevertheless, agency

staff said that employers are responsible for ensuring that their health plans comply

with the standards and for correcting any areas of noncompliance. Also, to help

ensure that employer-sponsored health plans are designed in accordance with federal

standards, Treasury regularly provides guidance to employee benefits advisors.

Officials told us they did not believe the agency has assessed, nor has any employer

voluntarily paid, an excise tax associated with noncompliance. Officials also said

they would impose an excise tax penalty in response to violations identified and

referred by Labor, but indicated they have not received any such referrals.

CONCLUDING OBSERVATIONS

Since HIPAA’s enactment in 1996, federal agencies’ enforcement roles have continued

to evolve as they have established new or expanded existing enforcement activities to

ensure compliance with standards under HIPAA and the related federal laws. Agency

officials state that they have an appropriate level of staff resources and expertise to

carry out their current enforcement responsibilities. HCFA’s future role remains

contingent on the actions of states in enforcing the federal standards, as well as on

congressional decisions about whether to reauthorize the Mental Health Parity Act or

to enact additional patient protection legislation. In addition, the scope of Labor’s

future enforcement activities may depend on the extent of noncompliance

determined through its compliance reviews of a nationwide random sample of

employer-sponsored health plans. The audit results could lead to Labor’s referral of

noncompliant plans to Treasury for the imposition of an excise tax. Thus, while the

agencies have been able to carry out their required enforcement roles, the scope and

extent of these agencies’ continuing enforcement roles will depend on the actions of

employers, carriers, states, and the Congress.
Page 12 GAO-01-652R Federal Enforcement of Health Insurance Standards

AGENCY COMMENTS

We provided a draft of our report to HCFA, Labor, and Treasury for comment. In its

written comments, HCFA noted that, at the time of HIPAA’s enactment, it had not

anticipated that it would have to assume a role in directly enforcing the federal

insurance standards. (See enclosure I.) Given this unanticipated role, HCFA

highlighted the progress it has made in working closely with the states and in

developing and implementing mechanisms to ensure that health carriers comply with

HIPAA and the related laws. HCFA also noted that its ability to determine the

universe of nonfederal government plans is limited; however, individuals in fully

insured, nonfederal government plans are generally subject to state oversight with

respect to compliance with these standards. In its written comments, Labor generally

concurred with our findings and highlighted the compliance assistance and education

and outreach activities it is undertaking to heighten consumer and employer

awareness of the protections and responsibilities under the federal health insurance

standards. (See enclosure II.) Treasury did not provide written comments. Each

agency provided technical comments and suggestions for clarification that we

incorporated as appropriate.

- - - - -

As we agreed with your office, unless you publicly announce the contents of this

correspondence earlier, we plan no further distribution of it until 30 days after its

issue date. We will then send copies to the Honorable Michael McMullan, Acting

Deputy Administrator of the Health Care Financing Administration; the Honorable

Elaine L. Chao, Secretary of Labor; the Honorable Paul H. O’Neill, Secretary of the

Treasury; and other interested congressional committees and members and agency

officials. We will also make copies available to others on request.

The information presented in this correspondence was developed by Susan Anthony,

John Dicken, and Randy DiRosa. Please call me at (202) 512-7118 if you have any

questions.

Sincerely yours,

Kathryn G. Allen

Director, Health Care—Medicaid

 and Private Health Insurance Issues

Enclosures - 2
Enclosure I Enclosure I

Page 13 GAO-01-652R Federal Enforcement of Health Insurance Standards
Enclosure I Enclosure I

Page 14 GAO-01-652R Federal Enforcement of Health Insurance Standards
Enclosure I Enclosure I

Page 15 GAO-01-652R Federal Enforcement of Health Insurance Standards
Enclosure II Enclosure II

Page 16 GAO-01-652R Federal Enforcement of Health Insurance Standards
Enclosure II Enclosure II

Page 17 GAO-01-652R Federal Enforcement of Health Insurance Standards
Enclosure II Enclosure II

Page 18 GAO-01-652R Federal Enforcement of Health Insurance Standards
Page 19 GAO-01-652R Federal Enforcement of Health Insurance Standards

RELATED GAO PRODUCTS

Mental Health Parity Act: Employers’ Mental Health Benefits Remain Limited Despite

New Federal Standards (GAO/T-HEHS-113, May 18, 2000).

Mental Health Parity Act: Despite New Federal Standards, Mental Health Benefits

Remain Limited (GAO/HEHS-00-96, May 10, 2000).

Implementation of HIPAA: Progress Slow in Enforcing Federal Standards in

Nonconforming States (GAO/HEHS-00-85, March 31, 2000).

Private Health Insurance: Progress and Challenges in Implementing 1996 Federal

Standards (GAO/HEHS-99-100, May 12, 1999).

Private Health Insurance: HCFA Cautious in Enforcing Federal HIPAA Standards in

States Lacking Conforming Laws (GAO/HEHS-98-217R, July 22, 1998).

Implementation of HIPAA: State-Designed Mechanisms for Group-to-Individual

Portability (GAO/HEHS-98-161R, May 20, 1998).

Health Insurance Standards: Implications of New Federal Law for Consumers,

Insurers, Regulators (GAO/T-HEHS-98-114, March 19, 1998).

Health Insurance Standards: New Federal Law Creates Challenges for Consumers,

Insurers, Regulators (GAO/HEHS-98-67, February 1998).

The Health Insurance Portability and Accountability Act of 1996: Early

Implementation Concerns (GAO/HEHS-97-200R, September 1997).

(290054)