Title I of HIPAA established standards for health coverage access, portability, and renewability that apply to employer-sponsored plans in the group market and, to a more limited extent, to the individual market.Group market provisions include limitations on preexisting condition exclusion periods; a requirement that previous coverage be credited to reduce or eliminate a new employee’s preexisting condition exclusion period; restrictions against excluding an employee from the health plan on the basis of his or her health status; and special enrollment opportunities for certain employees, such as those who did not enroll because they were previously covered under a spouse’s health plan. With limited exceptions, carriers must renew all group coverage at the employer’s request, regardless of the health status or historic health costs of the employee members. HIPAA also requires carriers in the small group market to guarantee coverage to all small employers (defined as those with 2 to 50 employees) that apply. In the individual market, HIPAA guarantees that eligible individuals losing group coverage have access to at least two individual market insurance products. This provision is referred to as group-to-individual portability. States may comply with this provision using either the federal rules—which require individual market carriers to guarantee access to certain insurance policies to eligible individuals—or an “alternative mechanism.” Under an alternative mechanism, states may, within broad federal parameters, design other approaches to provide eligible individuals with a choice of coverage. Twelve states are operating under the federal rules, and 38 are using an alternative mechanism. Of the latter, 22 are using a high-risk pool to provide coverage to these eligible individuals. A high-risk pool is a state entity that offers comprehensive health insurance to individuals with preexisting health conditions who are otherwise unable to obtain coverage in the individual market or who may be able to obtain coverage only at a cost-prohibitive rate. (App. II contains a summary of HIPAA access, portability, and renewability standards by market segment.) HIPAA was signed into law on August 21, 1996, and by the end of June 1998, all substantive provisions were effective for almost all plans. HIPAA regulations were issued on an interim final basis, and federal agencies issued most of the implementing regulations on April 8, 1997. Enhancements and clarifications to the regulations followed and will continue in 1999. Officials expect to finalize HIPAA regulations in 2000. Finally, after HIPAA was enacted, three additional federal laws—the Mental Health Parity Act (MHPA), the Newborns’ and Mothers’ Health Protection Act, and the Women’s Health and Cancer Rights Act (WHCRA)—imposed federal standards on private insurance coverage of mental health, maternity and newborn, and reconstruction after mastectomy benefits. Carrier and employer officials we interviewed expressed concerns about the lead time given them to comply with HIPAA and subsequent federal insurance reforms. The adoption of the new standards requires issuers to perform various tasks, including educating staff, issuing notices to enrollees, revising premium prices and marketing materials, and retooling information systems. Carrier officials consistently said that such changes require at least 6 months’ lead time or, preferably, 1 full year. Regulations implementing HIPAA were issued less than 2 months before certain provisions became effective, although carriers and employers have generally overcome the early start-up hurdles. Neither the MHPA nor the WHCRA had statutory provisions that provided for lead times of 6 months or more. Although the MHPA was signed into law in September 1996, its implementing regulations were not issued until December 22, 1997—only 9 days before some group plans became subject to the law. Similarly, while the WHCRA was signed into law on October 21, 1998, issuers were required to begin issuing notices to enrollees less than 3 months later, by January 1, 1999. Federal agencies, recognizing the short lead time, provided for a period during which no MHPA enforcement action would be taken against issuers making a good-faith effort to comply. Responsibility for enforcing HIPAA standards is divided among three federal agencies and the states. The Department of Labor is responsible for ensuring that employer-sponsored group health plans comply with HIPAA—an extension of Labor’s current regulatory role under the Employee Retirement Income Security Act of 1974 (ERISA). In states that do not adopt and enforce statutes or regulations that meet or exceed the HIPAA standards, the Department of Health and Human Services—through HCFA—is responsible for directly enforcing HIPAA standards for carriers in the group and individual markets. The Department of the Treasury enforces HIPAA requirements for group health plans by imposing an excise tax under the Internal Revenue Code as a penalty for noncompliance with the HIPAA standards. In states that have standards that conform to HIPAA, state insurance regulators have primary enforcement authority over insurance carriers. Notwithstanding early start-up challenges, the adoption of HIPAA’s group market access and portability provisions has proceeded relatively well—particularly for larger group plans. Noncompliance with these standards may be more common among smaller group plans. With respect to guaranteed coverage for small employers, quantitative evidence about the effects of the provision does not yet exist, but early evidence suggests that experiences vary considerably among states, in large part on the basis of the extent of pre-HIPAA state reforms. Larger employer plans appear to have adopted HIPAA access and portability provisions relatively easily. The Director of the Department of Labor’s health care task force said the Department has uncovered no systemic problems in the group market related specifically to HIPAA. A senior Labor field official told us that large employers and insurance companies are generally informed about HIPAA and make good-faith efforts to comply, although questions of interpretation still arise. The field office had no formal investigations related to HIPAA pending at the time of our visit in December 1998. Similarly, large employers and health benefit consultants we interviewed reported few ongoing problems in adopting HIPAA portability standards. Many carriers and large employers we interviewed said that their health plans tended to require few changes to comply with HIPAA. This was probably the case because many large employer plans had already incorporated portability protections similar to those of HIPAA. For example, many large employers had not excluded preexisting conditions from coverage before HIPAA became law. Many more have since dropped preexisting condition exclusion periods, partly because of the increased complexity of administering them under HIPAA. Table 1 shows that less than half of all group plans offered by employers with more than 200 employees continue to include preexisting condition exclusion periods.Further, a large midwestern telecommunications company official told us that before HIPAA, the company’s health plans (1) did not exclude preexisting conditions from coverage, (2) did not exclude individuals from the plan because of health status, and (3) provided later enrollment opportunities for those initially declining coverage. Thus, few changes were necessary. The degree of compliance with HIPAA portability provisions among small employer group plans has not been measured, but health insurance agents and regulators suspect noncompliance to be more common among these plans than among medium and large group plans. Whereas medium and large employers rely on carriers, third-party administrators, or a health benefits professional staff to implement HIPAA requirements, small employers may have fewer resources and may rely largely on carriers and agents to learn about changes in health benefits required by law. Further, observations made by health insurance agents and others suggest that some small employers either misunderstand the HIPAA requirements or are entirely unaware of them. In addition, several of the agents we surveyed volunteered that many of their colleagues do not understand HIPAA. An official of a small employer whom we interviewed in California told us an anecdote that illustrates this point. The individual responsible for human resource issues at this company with about 80 employees relied exclusively on the company’s insurance agent to learn about HIPAA’s certificate issuance requirement. The agent told the human resources staff person that certificates need be issued only upon the request of the employee; this is contrary to the law, which requires that certificates be issued automatically to anyone losing coverage. The discrepancy became apparent only as a result of our visit. Moreover, an agent in Florida indicated that perhaps 25 percent of her clients, most commonly the smaller employers, are not in compliance with one or more HIPAA provisions and are not making an effort to comply. Department of Labor officials also expressed concern about compliance among smaller employers. One field office official said that smaller employers know far less than larger employers about HIPAA and are more likely to be in violation of it. This field official is particularly concerned about small employers that self-fund their health plans and do not use the services of a third-party administrator. While this arrangement is not common, such employers have virtually no contact with health benefits professionals and, according to Labor officials, are very likely to be uninformed. Officials from another Labor field office noted that the Department’s experience in overseeing employer pension plans suggests that smaller employers are more likely to be in violation of requirements than larger employers. The extent to which HIPAA’s guaranteed issue provision affects market access for small employers in a given state is largely dependent on the extent of state reforms preceding HIPAA. Most states had already passed laws requiring carriers in the small group market to guarantee access to at least one health insurance plan for any small employer that applied. While most of these state laws were more limited than HIPAA, a substantial minority were equally or more stringent. In 13 states, reforms that preceded HIPAA required all products in the small group market to be guaranteed to be accessible to all small employers, just as HIPAA now does. Moreover, these states defined a small employer at least as inclusively as HIPAA. Therefore, HIPAA imposed virtually no changes in the way small group coverage is sold in these states. In 26 states, existing reforms included small group market guaranteed issue provisions that were more limited than the HIPAA provisions. Often, state reforms defined small employers as having 3 to 25 employees, as opposed to HIPAA’s 2 to 50 employees. These states also imposed the guaranteed issue provision on fewer health plans. Thus, in these states, HIPAA’s impact was to modify, to varying degrees, the existing regulations. In 11 states and the District of Columbia, a guaranteed issue provision applicable to all carriers did not exist in the small group market. Here HIPAA imposed significant changes on the regulation of the small group market. Figure 1 shows the requirements of the 50 states and the District of Columbia for small group guaranteed issue coverage before HIPAA. The effects of HIPAA’s small group market guaranteed issue provision on cost and access to coverage have not been evaluated, and, among the health insurance agents we surveyed, observations on its effects varied widely. Asked a general question about the effects of the provision, 46 percent of the agents we surveyed in states where existing guaranteed issue reforms were more limited than HIPAA’s said that access had improved: for example, the choices of products available to small employers had increased. Agents also noted that, because every small employer has access to every small group product on the market, employers are better able to compare carriers’ products and rates. Conversely, 44 percent of the agents said that HIPAA had not improved access for small groups. Many agents observed that while access is now guaranteed to groups that were previously excluded from coverage—high-risk groups—these groups may be unable to afford the available coverage. Carrier representatives we interviewed generally corroborated agent observations concerning increased comparison shopping by agents among all carrier products and high premiums for high-risk groups. Several carrier representatives said that small group market premiums have risen overall, but these representatives could not determine what proportion of the increase might be attributable to HIPAA’s guaranteed issue provision. Several carrier officials also pointed out that the guaranteed issue requirement limits carriers’ flexibility in designing benefit plans. Because every plan offered must be available to every small employer group, these carriers have reduced the number of plans they offer and are less able to customize plans to specific groups. Further, one carrier was concerned that very small employer groups might change health plans to obtain certain benefits, such as maternity coverage, when one or more individuals in the group needed that coverage. Another carrier cited concerns that very small groups tend to obtain coverage only when it becomes apparent that it will be needed. HIPAA’s group-to-individual portability provision ensures that people who are losing group coverage are guaranteed access to at least two individual market products, although these individuals, if in poor health, will probably pay more than the standard rate. The amount of the premium increase varies considerably. Our survey showed that in states using the federal rules, an individual in poor health would usually pay a premium greater than 200 percent of the standard rate, while in states using a high-risk pool, the increase was never greater than 200 percent of the standard rate. The exact number of individuals relying on this portability right to obtain coverage is difficult to quantify but appears small. HIPAA does not limit the premium price carriers may charge eligible individuals for coverage. Thus, premiums charged to individuals eligible for coverage under HIPAA, especially those in poor health, are often substantially higher than carriers’ standard rates—the rates healthy individuals pay. The extent of the increase in the premium rate is largely dependent upon whether a state restricts the amount carriers can vary premium rates and on the state’s approach to complying with HIPAA’s group-to-individual portability provision. Our premium survey of selected carriers in states using federal rules to guarantee group-to-individual portability under HIPAA showed that a particular individual eligible for HIPAA, with a preexisting condition, would be charged between 100 and 464 percent of the standard rate for a commonly sold product. In terms of monthly premiums, the rates quoted ranged from as low as $149 for a health maintenance organization (HMO) product in California to $951 for a preferred provider organization (PPO) product with a $500 deductible in the District of Columbia. As table 2 shows, the premium quotes provided by almost half of the carriers for this individual were 300 percent or more of their standard rates. As the table demonstrates, carriers in these states almost always charge an individual in poor health who is eligible for coverage under HIPAA a higher-than-standard monthly premium, which is similar to what unhealthy people without HIPAA portability rights experience if accepted for individual coverage in states without premium rate restrictions. Before HIPAA, however, many unhealthy people in these states could have been rejected outright for any type of individual private health insurance or could have faced an exclusion for their preexisting condition. In the 22 states using a high-risk pool as an alternative mechanism,individuals in poor health who are HIPAA-eligible also pay a higher premium, although the amount of the increase is generally less than in the states using federal rules, because the risk-pool coverage is subsidized. All 22 states using their high-risk pool as an alternative mechanism impose a premium cap for coverage in the pool of 200 percent of the standard rate or less, and about half cap premiums at 150 percent of the standard rate or less. The actual cost of covering these individuals is subsidized, most commonly by assessments on carriers. In several of these states, this assessment is offset against state premium or income taxes. As table 3 indicates, monthly premiums for the same individual discussed above for the most commonly sold product in each state ranged from $107 for a $1,000 deductible, fee-for-service plan in Minnesota to $336 for a $1,000 deductible, PPO plan in Louisiana. These premiums in about half of the 22 states were below $200 and between $200 and $336 in the other half. The number of people that rely on HIPAA’s group-to-individual portability provision to obtain coverage is difficult to quantify, particularly in states using the federal rules and states using an alternative mechanism other than a high-risk pool. In these states, carriers and state entities have not undertaken a systematic effort to count these individuals. However, in states using the federal rules, each of three national carriers estimated it had HIPAA enrollment of fewer than 200 individuals. In contrast, most states that use a high-risk pool as an alternative mechanism are able to separately track the enrollment of people eligible for coverage under HIPAA. Enrollment data suggest that the number of individuals relying on their HIPAA portability rights in these states is also relatively low. In 20 states that track HIPAA enrollment, approximately 6,500 HIPAA-eligibles are enrolled in the risk pools—or about 10 percent of the total risk-pool enrollment of over 63,000. Further, high-risk-pool enrollment reaches 1,000 HIPAA-eligibles in only two states. Consumer awareness and understanding of HIPAA remain limited, and those who have heard of the law often believe it provides broader access and protections than it does. Consumers who are unfamiliar with HIPAA may not receive the law’s protections or may make poor choices. Consequently, federal agencies and other entities have undertaken educational efforts that target specific populations—such as those changing jobs or losing group coverage—in an attempt to reach those who are most likely to benefit from HIPAA’s protections. In February 1998, we reported that many consumers misunderstood HIPAA and believed that the federal law provided broader access and protections than it actually does. Over 1 year later, most consumers are still largely unfamiliar with the law, according to agents, carriers, and state regulators. Sixty-five percent of the agents we surveyed indicated that their clients do not understand HIPAA and often approach the agents with questions. Similarly, several carriers and a third-party administrator we interviewed agreed that consumers know little about the law. For example, insurance regulators from two states told us that although consumers may have a vague understanding that HIPAA provides certain health care rights, most consumers are still unaware of specific HIPAA provisions. Consumers often misunderstand (1) the restrictions HIPAA imposes on former group enrollees’ guarantee of access to individual market coverage and (2) HIPAA’s definition of portability. First, for a former group enrollee to be eligible for individual market coverage under HIPAA, the individual must have had at least 18 months of creditable insurance coverage (the most recent coverage must have been through a group) with no break of more than 63 consecutive days; have exhausted any Consolidated Omnibus Budget Reconciliation Act (COBRA) or other continuation coverage available; not be eligible for any other group coverage, or for Medicare or Medicaid; not have lost group coverage because of nonpayment of premiums or fraud. Consumers continue to misunderstand these restrictions, according to agents and carrier officials. For example, one of the agents we surveyed said that out of 10 applications he received for individual coverage from former group enrollees, only 3 qualified for a HIPAA-guaranteed access product. The remaining seven were ineligible for such reasons as failing to select or exhaust COBRA or having a lapse in coverage of more than 63 days. Similarly, data provided by a large carrier suggest that over a quarter of all applicants for HIPAA portability coverage in 1998—61 of 231—were denied because they did not meet one or more of these eligibility criteria. Second, consumers commonly misunderstand the scope of HIPAA’s protections and its definition of portability. According to agents we surveyed, a number of consumers mistakenly believe that HIPAA guarantees access to individual insurance coverage for everyone, including those previously uninsured. Others believe HIPAA eliminates the use of preexisting condition exclusion periods altogether. Still others believe that portability allows them to carry their current health benefits with them when they change or lose jobs, according to regulators. In reality, portability under HIPAA is much more limited and simply means that once an individual has health coverage, time spent under that coverage may be used to reduce or eliminate any preexisting condition exclusion imposed by a subsequent employer’s health plan. Consumers and small employers may not receive HIPAA protections if they do not know they exist and may make poor choices based on ignorance. Although HIPAA may affect relatively few people at any given point, a clear understanding of their rights is imperative for eligible individuals. The following scenarios describe hypothetical cases in which consumers who qualified for HIPAA protections were not aware of their rights and were unable to take advantage of the law’s protections. Employee A has chronic asthma and decided to quit her job to become self-employed. Although she received a certificate of creditable coverage and a notice from her prior employer’s health plan administrator explaining her COBRA continuation-of-coverage rights, she declined COBRA because she perceived it to be expensive and she had heard that HIPAA provided a guarantee of access to coverage in the individual market. Several months later, she approached an agent to obtain coverage. She learned that because she had not elected COBRA and more than 63 days had elapsed since her group coverage expired, she was ineligible for a HIPAA group-to-individual portability product. The agent told her that consequently, most carriers would reject her application for coverage because of her health condition. Moreover, if she obtained coverage, carriers would exclude coverage for her preexisting condition for 1 year. Employee B has chronic back problems and had been continuously insured through his company’s health plan for the past 5 years. During his first 12 months of coverage, all expenses associated with treating his costly back condition were excluded. Employee B changed jobs but never received a certificate of creditable coverage and was not otherwise aware of HIPAA’s portability rights. Without this certificate, which would have documented Employee B’s previous coverage, the new employer applied a preexisting condition exclusion to Employee B, not covering any costs associated with treating his back condition for another full year. Therefore, Employee B incurred an additional year of medical costs for a health condition for which he had previously fulfilled the maximum allowable waiting period. Recognizing that many consumers do not understand their rights under HIPAA, employers, federal agencies, and others have undertaken, to varying degrees, efforts to inform consumers about their rights under HIPAA. Although several employers question the value of extensive education efforts, most have external and internal resources available to respond to consumer inquiries. In addition, federal, state, and other entities are attempting to better target consumer education efforts to individuals who are experiencing a transition in employment so these individuals have access to relevant information when they need it. The extent of employer educational efforts varies, depending largely on the size of the employer and the resources available. Officials of several multistate employers said that their health plans already included many of HIPAA’s protections, and an official from one of these employers said that efforts to provide employees with information specific to HIPAA would only generate confusion. Consequently, in some cases, employers have simply amended their summary plan descriptions to include HIPAA protections and refer employees to this document when they have questions about their coverage. An official from one employer believes more extensive educational efforts are not an efficient use of resources, since HIPAA only affects employees in transition. Some employers noted that their human resources personnel can answer employee questions or conduct interviews with exiting employees, at which time they can explain HIPAA and other federal laws. Some officials emphasized that just as it took several years for consumers to become familiar with COBRA protections, it will take some time for employees to understand their rights under HIPAA. Smaller employers tend to rely on their carriers or their agents to resolve questions and to educate them about changes in federal law. Carriers we interviewed have amended their contracts to comply with the law and have customer service representatives available to answer questions. Further, many carriers have issued notices and educational materials to clarify areas of confusion and to explain HIPAA’s requirements to plan enrollees. Officials at both the Department of Labor and HCFA said that they are attempting to better target consumer education efforts to individuals who are experiencing a transition in employment so that these individuals will have access to relevant information when they need it. For example, the Worker Adjustment and Retraining Notification Act, among other things, requires any employer who intends to order a plant closing or mass layoff to notify state dislocated worker units. Labor has encouraged its regional offices to participate in state dislocated worker programs, allowing Department officials to provide educational materials directly to those individuals in transition. Labor’s regional offices are also encouraged to meet with state insurance departments to discuss HIPAA and other federal laws. Through its education outreach program, Labor has conducted presentations about the law to employers and health associations. Although HCFA does not yet have a coordinated outreach program, the two regional offices we visited plan to coordinate with state programs by distributing HIPAA informational materials at selected sites, such as unemployment, Social Security, and Railroad Retirement Board offices, where people in employment transition often go. Finally, both agencies have Internet sites that contain HIPAA information, have customer service representatives to answer questions, and make educational publications available. States have also undertaken a variety of efforts to better educate consumers about HIPAA, although the extent of these efforts varies among states. At least 20 states have developed consumer information materials that address HIPAA provisions. For example, insurance department officials in Montana have conducted training seminars for agents, large employers, and provider groups, and Oklahoma has incorporated HIPAA information in its continuing education requirement for agents. In addition, a number of states that use their high-risk pool as an alternative mechanism, such as Illinois, have undertaken educational efforts to inform the public about the availability of coverage through the pool. Also, two of the states we visited require carriers to notify consumers whom they decline to cover about the availability of coverage through the pool. In contrast, regulators in California do not believe they have an obligation to inform consumers about changes in federal law, and they emphasized that their primary mission is to regulate insurers. Finally, all of the states we visited have customer service personnel who are available to answer consumer inquiries related to HIPAA or to refer these questions to the appropriate federal authorities. Other entities are also conducting an assortment of educational efforts. Employee benefits consulting firms have assembled educational materials on HIPAA and have sponsored training seminars for employers. Also, Georgetown University’s Institute for Health Care Research and Policy has prepared a consumer guide for each state that explains the protections available to individual consumers and small businesses under HIPAA and state insurance laws. As noted above, HIPAA requires carriers and employers to issue a certificate of creditable coverage that documents the length of prior coverage to all individuals losing health coverage. To help issuers comply with this requirement, federal agencies developed a model certificate that was published in the Federal Register and is available electronically on HCFA and Labor’s Internet sites. Several issuers we interviewed have essentially adopted the model certificate, which, in part, requires information about (1) the date coverage began, or a statement that an individual has at least 18 months of creditable coverage, and (2) the date coverage ended, or whether coverage is continuing, such as through COBRA. (The model certificate is included as app. V.) As an educational tool, however, the model certificate has limitations. First, it does not explicitly inform consumers that they may have a group-to-individual portability right, nor does it highlight any of the restrictions placed on this right. Second, the certificate does not explicitly inform consumers changing jobs that they may not have to fulfill another preexisting condition period under their subsequent employer’s health plan. Consequently, consumers who receive certificates may not understand their purpose and may discard them, never realizing their connection to HIPAA’s access and portability rights. The experiences of employers and carriers seem to indicate that this is indeed the case: according to employer and carrier estimates, few enrollees have a certificate at the time they apply for coverage either because they discarded the certificate provided by a prior employer or carrier or never received one. Carriers and employers continue to question the value of certificates for proving creditable coverage. They point out that since most enrollees do not have a certificate, the law requires carriers and employers to otherwise verify prior coverage, as was generally the practice in states with portability laws predating HIPAA. Moreover, carriers and employers assert that since most employer plans no longer include preexisting condition exclusion clauses, most of the certificates issued are not needed. Finally, employers and carriers indicated that the cost and administrative resources needed to issue a certificate to every departing enrollee pose a significant burden. Carriers and employers would prefer to issue certificates on demand—that is, to only those who request them. Nevertheless, HIPAA currently requires that certificates be issued to all individuals losing health coverage. Individuals who clearly understand their rights under the law are better able to make use of its protections. Regulatory authorities we interviewed agreed that certificates that clearly delineate a consumer’s rights, and the restrictions placed on these rights, could serve as an important educational tool and increase the likelihood that consumers in transition have the information they need to take advantage of their HIPAA rights. HIPAA established a complex regulatory framework in which oversight and enforcement of the law are shared among multiple federal agencies and state regulators. While the law essentially expanded Labor’s existing oversight responsibilities under ERISA, it created a new regulatory role for HCFA. Thus far, HCFA’s enforcement efforts have been limited. Under ERISA, Labor is responsible for ensuring that employer-sponsored group health plans meet certain fiduciary, reporting, and disclosure requirements related to the provision of health benefits. Labor’s approach to identifying noncompliance among ERISA plans has been largely complaint-driven, and investigative and enforcement efforts tend to focus on firms from which patterns of employee complaints are received. HIPAA significantly expanded the complexity of Labor’s health plan oversight role: Labor is now also charged with ensuring that employer plans comply with access and portability standards. While its role in overseeing ERISA plans has expanded, Labor continues to rely on consumer complaints to identify noncompliance. However, recognizing the increased complexity of its role brought about by HIPAA and other federal insurance laws, Labor has attempted to enhance its customer service function and undertake other oversight improvements, as discussed below. Before 1996, Labor’s customer service function was centralized in Washington, D.C. The Department has decentralized customer service staff to its field offices in an effort to be more responsive to employers and employees. In addition, Labor has increased the number of staff dedicated to this purpose. In 1998, Labor added about 9 customer service staff-years to its 1997 levels and will add up to 23 additional staff-years during 1999. (App. III describes the resources Labor estimates it has used in the implementation of HIPAA.) The customer service staff position has evolved from an administrative/clerical position to that of a paraprofessional or professional. Labor’s eventual goal is to have all customer service positions filled by college-educated professionals. The national question/complaint tracking system has been enhanced to better capture information related specifically to HIPAA. Whereas all HIPAA-related questions and complaints were captured under a single category before October 1998, they are now differentiated into separate categories relating to their specific nature. Labor is developing a series of HIPAA compliance review steps to be added to guidelines it uses in investigating employers. These review steps will be followed regardless of the reason for the investigation. Whereas Labor was able to build upon an existing regulatory role, HIPAA created broad new regulatory responsibilities for HCFA. In states that do not adopt and enforce statutes or regulations that meet or exceed HIPAA standards, HCFA is responsible for directly enforcing them. To do this, HCFA has had to assume responsibilities typically undertaken by state insurance regulators, such as providing guidance to carriers, reviewing carrier policy forms, and monitoring carrier marketing practices. To date, HCFA’s regulatory and enforcement activities have been limited primarily to the five states known not to have passed statutes or regulations that fully conform to HIPAA: California, Massachusetts, Michigan, Missouri, and Rhode Island. Further, the extent of HCFA’s efforts within four of the five states remains limited, still consisting largely of responding to consumer queries and complaints. Also, HCFA has yet to comprehensively evaluate the extent to which the other 45 states conform to HIPAA. We reported in July 1998 that the extent of HCFA’s efforts in the direct enforcement states varied. For example, in California, Missouri, and Rhode Island, HCFA developed guidance that delineated state and federal regulatory responsibilities; HCFA also held informational meetings with carriers in Missouri and Rhode Island. Further, while HCFA had begun to review carriers’ policies sold in Missouri to ensure compliance, it had not initiated any regulatory activities beyond responding to consumer inquiries and complaints in Massachusetts and Michigan. Since that report, the extent of HCFA’s enforcement efforts has not dramatically changed; however, HCFA has awarded three external contracts to assist in enforcement tasks, and regional officials have held informational meetings in California. Enforcement efforts in the direct enforcement states remain largely complaint driven except for policy reviews in Missouri where carriers voluntarily submit policies for review. Further, HCFA has not determined the extent to which the remaining states have passed conforming legislation, and regional officials said they are just beginning to determine how they can identify any gaps in state laws and what their role should ultimately be in states in which gaps are identified. Although evidence suggests that most of these states have standards in place that meet or exceed HIPAA requirements, isolated gaps are likely to remain. For example, several officials noted that many states have not adopted the certificate of creditable coverage issuance requirement or a definition of a small group that is consistent with HIPAA’s. HCFA officials acknowledge that the agency has thus far pursued a minimalist approach to regulating under HIPAA and largely attribute their limited efforts to a lack of enforcement regulations and insufficient staff capacity. While HIPAA provides for a civil monetary penalty for noncomplying carriers, the statute is largely silent about the standards and processes by which HCFA will carry out its regulatory role in states. According to agency officials, the enforcement regulations will clearly delineate these standards and processes to the regulated community, thereby enhancing HCFA’s ability to carry out necessary enforcement actions. Although officials had anticipated publishing the regulations by late 1998, they remain unpublished. HCFA officials also attribute their limited efforts to insufficient staff capacity. When HIPAA was originally passed, the Congress did not provide any additional resources for HCFA to implement the provisions of the law. Thus, the agency initially reassigned staff from other functions to assist in HIPAA’s implementation. HCFA did receive a supplemental appropriation of $2.2 million in May 1998. Although these funds allowed the agency to hire and train 22 additional regional staff, including some who have specialized expertise in health insurance, they were not sufficient to allow the agency to move forward with the “full range of HIPAA enforcement activities,” according to the HCFA Administrator. Given the current level of resources, HCFA intends to focus on (1) completing the enforcement regulations and (2) conducting direct enforcement responsibilities in the states that have not passed conforming legislation. According to agency officials, HCFA has not begun to review the insurance laws of the remaining states to determine compliance with HIPAA. (App. IV describes the resources HCFA estimates it has used in the implementation of HIPAA.) Since our February 1998 report, progress has continued in implementing HIPAA. The law’s provisions, which were intended to improve consumers’ access to private health insurance, are now applicable to nearly all group and individual private health plans. Consequently, minimum standards of protection now apply to group (both fully insured and self-funded) and individual insurance coverage sold in all states. As a result of these new federal standards many consumers face fewer preexisting condition exclusions, enrollees should be able to more easily renew their health plans, employees may not be excluded from group health plans on the basis of small employers must have guaranteed access to all coverage sold in the small group market, and high-risk individuals losing group coverage may have better access to either individual health insurance or a subsidized high-risk pool. Nonetheless, some concerns persist. High-risk individuals and some small groups may continue to face high premiums for guaranteed coverage because HIPAA does not constrain carriers’ rating practices beyond existing state laws. Partly because of this, relatively few eligible high-risk individuals who lost group coverage appear to have purchased HIPAA-guaranteed individual insurance. Consumers’ lack of awareness or understanding of HIPAA can in some cases impede their ability to exercise the rights afforded by the law. Federal agencies and others are attempting to target education efforts at consumers in employment transition, but such efforts could take years, as was the case with educating consumers about COBRA. One potentially effective education tool is the certificates of creditable coverage that the law requires be issued to every enrollee who loses insurance coverage. The certificates’ value as an educational tool, however, is diminished because model guidance on these certificates does not explicitly and comprehensively outline the protections provided by HIPAA. Finally, both HCFA and Labor have become better equipped over the last year to oversee compliance with HIPAA. Nonetheless, both agencies recognize that further efforts are needed, including targeting consumer education efforts; proactively ensuring employers’ compliance; and, for HCFA, ensuring that all states’ insurance regulations fully conform with the federal standards. Moreover, HCFA recognizes that its ability to fully perform its new regulatory role will be enhanced when enforcement regulations are issued. Until HCFA issues these regulations, its efforts to guarantee consumers in all states the protections to which they are entitled under HIPAA may be hindered. We recommend that HCFA and the Department of Labor revise the model certificate of creditable health plan coverage to more explicitly inform consumers of their new rights under HIPAA. At a minimum, the model certificate should inform consumers about appropriate contacts for additional information about HIPAA and highlight key provisions and restrictions, including the limits on preexisting condition exclusion periods and the guaranteed renewability of all health coverage, the reduction or elimination of preexisting condition exclusion periods for employees changing jobs, the prohibition against excluding an individual from an employer health plan on the basis of his or her health status, and the guarantee of access to insurance products for certain individuals losing group coverage and the restrictions placed on that guarantee. Also, to ensure that HCFA is able to fully perform its new oversight role under HIPAA, we recommend that the agency promptly promulgate enforcement regulations. HCFA and the Department of Labor commented on a draft of this report and generally agreed with our findings and recommendations. Both HCFA and Labor highlighted recent initiatives to increase outreach and oversight related to HIPAA. For example, the Director of Labor’s Health Care Task Force, Pension and Welfare Benefits Administration, noted that additional outreach efforts have been initiated through partnerships with consumer, labor, and business organizations and that additional materials have been developed to support the agency’s consumer service staff and investigators. For its part, HCFA noted that it has recently hired a new director with expertise in insurance regulation to oversee HIPAA enforcement, submitted the agency’s enforcement regulation for review by the Office of Management and Budget, and expanded the agency’s review of insurers’ policy forms. HCFA also noted that it has begun to review states’ conformance with HIPAA’s provisions and intends to initiate market conduct exams. In addition, HCFA commented that our report should have emphasized some of the agency’s efforts since February 1998, such as obtaining additional funding and staff resources. We addressed HCFA’s fiscal year 1998 supplemental appropriation and the agency’s hiring of additional regional staff in our July 1998 report, as well as on pages 23 and 24 of this report. Both agencies also provided technical comments, which we have incorporated as appropriate. Appendix VI contains the comment letter from HCFA. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies to the Honorable Nancy-Ann Min DeParle, Administrator of the Health Care Financing Administration; the Honorable Alexis M. Herman, Secretary of Labor; and other interested congressional committees and members and agency officials. We will also make copies available to others upon request. The information presented in this report was developed by Susan Anthony, Randy DiRosa, Mary Freeman, and Betty Kirksey under the direction of John Dicken. Please call me at (202) 512-7114 if you have any questions about the information provided in this report. To address our objectives, we visited five states—California, Florida, Illinois, Montana, and Oklahoma—and interviewed regulators, carriers, agents, and employers. We selected these states on the basis of their geographic dispersion and approach to implementing the group-to-individual portability provision of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). With officials in these states, we discussed a multitude of issues, including each state’s implementation of HIPAA provisions, monitoring and enforcement efforts, educational efforts, and challenges faced in implementing the various provisions of the law. We collaborated with the National Association of Health Underwriters to survey agents in 13 states and the District of Columbia that are using the federal rules (or a similar approach) to guarantee eligible individuals group-to-individual portability under HIPAA. In these states, agents obtained premium rate quotes from selected carriers for a commonly sold product for a specified high-risk individual losing group coverage and for a demographically similar, but healthy, individual. In addition, the survey queried agents about consumers’ knowledge of the law and their experiences. We also selected eight states not using the federal rules and surveyed an additional 40 agents to obtain comparable information about consumers’ and agents’ experiences. For states using a high-risk pool to guarantee access for those losing group coverage, we reviewed published enrollment and premium data and interviewed representatives of each state’s risk pool. In addition, we interviewed officials at the Health Care Financing Administration (HCFA) and the Department of Labor to discuss monitoring and enforcement issues and educational efforts undertaken to inform consumers about the law. We also interviewed individuals at national organizations, including the National Association of Insurance Commissioners, the Health Insurance Association of America, the BlueCross BlueShield Association, and the Council for Affordable Health Insurance. In addition, we hosted forums, at which over 25 national insurance carriers discussed their experiences with HIPAA and challenges they faced in its implementation. Finally, we interviewed representatives of research organizations, such as Georgetown University’s Institute for Health Care Research and Policy, and reviewed available literature. To achieve its goals of improving access to and portability and renewability of private health insurance, HIPAA set forth standards that variously apply to the individual small group (2 to 50 employees) and large group (more than 50 employees) markets of all states. Most HIPAA standards became effective on July 1, 1997. However, group plans do not become subject to the applicable standards until their first plan year beginning on or after July 1, 1997. HIPAA’s health coverage access, portability, nondiscrimination, and renewability standards are summarized in table I.1. Small group employer (2 to 50 employees) Large group employer (over 50 employees) HIPAA requires issuers of health coverage to provide certificates of creditable coverage to enrollees whose coverage terminates. The certificates must document the period during which the enrollee was covered so that a subsequent health issuer can credit this time against its preexisting condition exclusion period. The certificates must also document any period during which the enrollee had applied for coverage but was waiting for coverage to take effect—the waiting period—and must include information on an enrollee’s dependents covered under the plan. In the small group market, carriers must make all plans available and issue coverage to any small employer that applies, regardless of the group’s claims history or health status. Under individual market guaranteed access—often referred to as group-to-individual portability—eligible individuals must have guaranteed access to at least two different coverage options. Generally, eligible individuals are defined as those with at least 18 months of prior group coverage who meet several additional requirements. Depending on the option states choose to implement this requirement, coverage may be provided by carriers, through state high-risk insurance pool programs, or in other ways. HIPAA requires that all health plan policies be renewed regardless of the health status or claims experience of plan participants, with limited exceptions. Exceptions include cases of fraud, enrollee failure to pay premiums, enrollee movement out of a plan service area, and the withdrawal of an issuer from the market. Group plan issuers generally may deny, exclude, or limit an enrollee’s benefits arising from a preexisting condition for no more than 12 months following the effective date of coverage. A preexisting condition is defined as a condition for which medical advice, diagnosis, care, or treatment was received or recommended during the 6 months preceding the date of coverage or the first day of the waiting period for coverage. Pregnancy may not be considered a preexisting condition, nor can preexisting conditions be imposed on newborn or adopted children in most cases. Group plan issuers may not exclude a member within the group from coverage on the basis of the individual’s health status or medical history. Similarly, the benefits provided, premiums charged, and contributions to the plan may not vary for similarly situated group plan enrollees on the basis of health status or medical history. Issuers of group coverage must credit an enrollee’s period of prior coverage against the group issuer’s preexisting condition exclusion period. Prior coverage must have been consecutive with no breaks of more than 63 days to be creditable. For example, an individual who has been covered for 6 months and changes employers may be eligible to have the subsequent employer’s plan’s 12-month waiting period for preexisting conditions reduced by 6 months. Time spent in a prior health plan’s waiting period may not count as part of a break in coverage. Individuals who do not enroll for coverage in a group plan during their initial enrollment opportunity may be eligible for a special enrollment period later if they originally declined to enroll because they had other coverage, such as under the Consolidated Omnibus Budget Reconciliation Act (COBRA), or if they were covered as a dependent under a spouse’s coverage and later lost that coverage. In addition, if an enrollee has a new dependent because of marriage or the birth or adoption of a child, the enrollee and dependents may become eligible for coverage during a special enrollment period. HIPAA also includes certain other standards that relate to private health coverage, including limited expansions of COBRA coverage rights, new disclosure requirements for Employee Retirement Income Security Act plans, and new requirements for uniform enrollee and claims information, to be phased in through 1999. Tax law changes authorize federally tax-advantaged medical savings accounts for small employer and self-employed plans. For employers with 50 or more employees that provide mental health benefits, the Mental Health Parity Act requires that the annual and lifetime dollar maximums for mental health be the same as dollar maximums for medical/surgical benefits. The law does not establish a separate lifetime dollar maximum for mental health services. If medical/surgical benefits do not have annual or lifetime dollar maximums, mental health benefits cannot have lifetime maximums. Plans may continue to otherwise set the terms and conditions of mental health coverage, such as by imposing an annual limit on the number of inpatient days, the number of visits, or the percentage of cost-sharing for services. Group plans that can demonstrate that compliance will result in a cost increase of 1 percent or more may be exempt from the law. Under the Newborns’ and Mothers’ Health Protection Act, group health plans may not restrict benefits for any hospital stay in connection with childbirth for the mother or newborn child following a normal vaginal delivery to less than 48 hours, restrict benefits for any hospital stay for a cesarean section to less than 96 hours, or require that a provider obtain authorization from the plan for prescribing any length of stay required. The minimum stays do not apply if the decision to discharge the mother or newborn is made by the mother and her doctor. The Women’s Health and Cancer Rights Act contains protections for breast cancer patients who elect breast reconstruction in connection with a mastectomy. Under the act, reconstructive benefits must include coverage for reconstruction of the breast on which the mastectomy was performed, surgery and reconstruction of the other breast to produce a symmetrical appearance, and prostheses and physical complications at all stages of treatment related to a mastectomy. Benefits under the act may be subject to annual deductibles and coinsurance consistent with those established for other benefits under the plan or coverage. Private Health Insurance: HCFA Cautious in Enforcing Federal HIPAA Standards in States Lacking Conforming Laws (GAO/HEHS-98-217R, July 22, 1998). Implementation of HIPAA: State-Designed Mechanisms for Group-to-Individual Portability (GAO/HEHS-98-161R, May 20, 1998). Health Insurance Standards: Implications of New Federal Law for Consumers, Insurers, Regulators (GAO/T-HEHS-98-114, Mar. 19, 1998). Health Insurance Standards: New Federal Law Creates Challenges for Consumers, Insurers, Regulators (GAO/HEHS-98-67, Feb. 25, 1998). The Health Insurance Portability and Accountability Act of 1996: Early Implementation Concerns (GAO/HEHS-97-200R, Sept. 2, 1997). Private Health Insurance: Millions Relying on Individual Market Face Cost and Coverage Tradeoffs (GAO/HEHS-97-8, Nov. 25, 1996). Health Insurance Portability: Reform Could Ensure Continued Coverage for Up to 25 Million Americans (GAO/HEHS-95-257, Sept. 19, 1995). Health Insurance Regulation: National Portability Standards Would Facilitate Changing Health Plans (GAO/HEHS-95-205, July 18, 1995). Health Insurance Regulation: Variation in Recent State Small Employer Health Insurance Reforms (GAO/HEHS-95-161FS, June 12, 1995). The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO provided information on: (1) the implementation status of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) provisions in the group insurance market; (2) the price of coverage for certain individuals losing group insurance; (3) the extent of consumer understanding of HIPAA as well as federal, state, and private efforts undertaken to educate consumers about the law's protections; and (4) federal efforts undertaken to ensure HIPAA compliance. GAO noted that: (1) implementation of HIPAA's insurance standards in the group market has proceeded relatively smoothly--particularly among larger group plans--although carriers and employers continue to express some concerns about certain administrative and interpretive aspects of HIPAA; (2) this ease of transition has occurred partly because many of these group plans had already provided key HIPAA protections before the law was enacted; (3) concerns exist about the extent to which some smaller employers are performing certain required tasks; (4) with respect to HIPAA's requirement that carriers guarantee access to coverage for certain smaller employers, early evidence suggests experiences vary considerably among states, largely depending on the extent of state-level reforms that preceded HIPAA; (5) HIPAA's group-to-individual portability provision ensures that certain consumers who lose group coverage are guaranteed access to at least two individual market insurance products; (6) the so-called HIPAA-eligible individuals who have certain health conditions often pay a higher-than-standard premium for individual coverage, although the amount of the premium increase varies considerably; (7) all but 3 of the 41 carriers GAO surveyed in states using HIPAA standards would charge a HIPAA-eligible with a specified health condition a higher-than-standard rate, and nearly half of these would charge 300 to 464 percent of the standard rate; (8) the average premium for individual coverage for HIPAA-eligibles with a specified health condition that would be charged by the 41 carriers was $381 per month; (9) the 22 states that use a high-risk pool as an alternative to the federal portability standards limit premiums to 200 percent or less of the standard rate, or an average subsidized rate of $221 per month; (10) the exact number of individuals who rely on HIPAA's group-to-individual portability provision to obtain coverage is difficult to determine but appears small according to carrier estimates and risk-pool enrollment figures; (11) consumers' understanding of HIPAA remains limited, and many are largely unfamiliar with the law; (12) federal agencies and others have targeted educational efforts to specific populations in an attempt to reach those most likely to benefit from HIPAA; and (13) HIPAA established a complex regulatory framework in which oversight and enforcement of the law are shared among multiple federal agencies and state regulators.