Among other protections, HIPAA’s standards for health coverage, access, portability, and renewability guarantee access to coverage for certain employees and individuals, prohibit carriers from refusing to renew coverage on the basis of a person’s health status, and place limits on the use of preexisting condition exclusion periods. However, not all standards apply to all markets or individuals. For example, guarantees of access to coverage for employers apply only in the small-group market, and the individual market guarantee applies only to certain eligible individuals who lose group coverage. (The appendix contains a summary of these standards by market segment.) ensuring that group health plans comply with HIPAA standards, which is an extension of its current regulatory role under the Employee Retirement Income Security Act of 1974 (ERISA). Treasury also enforces HIPAA requirements on group health plans but does so by imposing an excise tax under the Internal Revenue Code on employers or plans that do not comply with HIPAA. HHS is responsible for enforcing HIPAA with respect to insurance carriers in the group and individual markets, but only in states that do not already have similar protections in place or do not enact and enforce laws to implement HIPAA standards. This represents an essentially new role for that agency. The implementation of HIPAA is ongoing, in part, because the regulations were issued on an “interim final” basis. Further guidance needed to finalize the regulations has not yet been issued. In addition, various provisions of HIPAA have different effective dates. Most of the provisions became effective on July 1, 1997, but group-to-individual guaranteed access in 36 states and the District of Columbia had until January 1, 1998, to become effective. And although all provisions are now in effect, individual group plans do not become subject to the law until the start of their plan year on or after July 1, 1997. For some collectively bargained plans, this may not be until 1999 or later, as collective bargaining agreements may extend beyond 12 months. During the first year of implementation, federal agencies, the states, and issuers have taken various actions in response to HIPAA. In addition to publishing interim final regulations by the April 1, 1997, statutory deadline, Labor and HHS have conducted educational outreach activities. State legislatures have enacted laws to implement HIPAA provisions, and state insurance regulators have written regulations and prepared to enforce them. Issuers of health coverage have modified their products and practices to comply with HIPAA. To ensure that individuals losing group coverage have guaranteed access—regardless of health status—to individual market coverage, HIPAA offers states two different approaches. The first, which HIPAA specifies, is commonly referred to as the “federal fallback” approach and requires all carriers who operate in the individual market to offer eligible individuals at least two health plans. (This approach became effective on July 1, 1997.) The second approach, the so-called “alternative mechanism,” grants states considerable latitude to use high-risk pools and other means to ensure guaranteed access. (HIPAA requires states adopting this approach to implement it no later than Jan. 1, 1998.) Among the 13 states using the federal fallback approach, we found that some initial carrier marketing practices may have discouraged HIPAA eligibles from enrolling in products with guaranteed access rights. After the federal fallback provisions took effect, many consumers told state insurance regulators that carriers did not disclose the existence of a product to which the consumers had HIPAA-guaranteed access rights or, when the consumers specifically requested one, the carrier said it did not have such a product available. Also, some carriers initially refused to pay commissions to insurance agents who referred HIPAA eligibles. Insurance regulators in two of the three federal fallback states we visited told us that some carriers advised agents against referring HIPAA-eligible applicants or paid reduced or no commissions. Recently, though, this practice appears to have abated. We also found that premiums for products with guaranteed access rights may be substantially higher than standard rates. In the three federal fallback states we visited, we found rates ranging from 140 to 400 percent of the standard rate, as indicated in table 1. Anecdotal reports from insurance regulators and agents in federal fallback states suggest rates of 600 percent or more of the standard rate are also being charged. We also found that carriers typically evaluate the health status of applicants and offer healthy individuals access to their lower-priced standard products. This practice could cause HIPAA products to be purchased disproportionately by unhealthy, more costly individuals, which, in turn, could precipitate further premium increases. Carriers charge higher rates because they believe HIPAA-eligible individuals will, on average, be in poorer health, and they seek to prevent non-HIPAA-eligible individuals from subsidizing eligibles’ expected higher costs. Carriers permit or even encourage healthy HIPAA-eligible individuals to enroll in standard plans. According to one carrier official, denying HIPAA eligibles the opportunity to enroll in a less expensive product for which they qualify would be contrary to the consumers’ best interests. In any case, carriers that do not charge higher premiums to HIPAA eligibles could be subject to adverse selection. That is, once a carrier’s low rate for eligible individuals became known, agents would likely refer less healthy HIPAA eligibles to that carrier, which would put it at a competitive disadvantage. Finally, HIPAA does not specifically regulate premium rates and, with one exception, the regulations do not require a mechanism to narrow the disparity of rates for products with guaranteed access rights. The regulations offer three options for carriers to provide coverage to HIPAA-eligible individuals in federal fallback states, only one of which includes an explicit requirement to use some method of risk spreading or financial subsidy to moderate rates for HIPAA products. This limited attention to rates in the regulations, some state regulators contend, permits issuers to charge substantially higher rates for products with guaranteed access rights. expected to have guaranteed access to insurance coverage. One state reported receiving consumer calls at a rate of 120 to 150 a month, about 90 percent of which related to the group-to-individual guaranteed access provision. Similarly, an official from one large national insurer told us that many consumers believe the law covers them when it actually does not. Issuers of health coverage are concerned about the administrative burden and the unintended consequences of certain HIPAA requirements. One persistent concern has been the administrative burden and cost of complying with the requirement to issue certificates of creditable coverage to all enrollees who terminate coverage. Some issuers are concerned that certain information, such as the status of dependents on a policy, is difficult or time consuming to obtain. Some state officials are concerned that Medicaid agencies, which are also subject to the requirement, may face an especially difficult burden because Medicaid recipients tend to enroll in and disenroll from the Medicaid program frequently. This could require Medicaid agencies to issue a higher volume of certificates. Finally, issuers suggest that many of the certificates will not be needed to prove creditable coverage. Several issuers and state insurance regulators point out that portability reforms passed by most states have worked well without a certificate issuance requirement. Also, many group health plans do not contain preexisting condition exclusion clauses, and therefore the plans do not need certificates from incoming enrollees. While issuers generally appear to have complied with this requirement, some suggest that a more limited requirement, such as issuing the certificates only to consumers who request them, would serve the same purpose for less cost. National Association of Insurance Commissioners (NAIC) is concerned that if large numbers of older and less healthy individuals remain in the individual market, premiums for all individuals there could rise as a result. HIPAA’s guaranteed renewal requirements may also preclude issuers from canceling enrollees’ coverage, once they exceed eligibility limits, in insurance programs that are targeted for low-income populations. Therefore, these programs’ limited slots could be filled by otherwise ineligible individuals. Similarly, issuers could be required to renew coverage for children-only insurance products, for children who have reached adulthood—contrary to the design and intent of these products. Finally, issuers cite some HIPAA provisions that have the potential to be abused by consumers. For example, HIPAA requires group health plans to give new enrollees or enrollees switching between plans during an open enrollment period full credit for a broad range of prior health coverage. Since the law does not recognize differences in deductible levels, issuers and regulators are concerned that individuals may enroll in inexpensive, high-deductible plans while healthy and then switch to plans with comprehensive, low-deductible coverage when they become ill. Federal agencies have sought comments from industry on this matter. In a related example, because HIPAA does not permit pregnancy to be excluded from coverage as a preexisting condition, an individual could avoid the expense of health coverage and then enroll in the employer’s group plan as a late enrollee to immediately obtain full maternity benefits. Issuers contend that such abuses, if widespread, could increase the cost of insurance. State regulators have encountered difficulties implementing HIPAA provisions in instances in which federal regulations lacked sufficient clarity. Specifically, some regulators are concerned that the lack of clarity may result in various interpretations and in confusion among the many entities involved in implementation. For example, Colorado insurance regulators surveyed carriers in that state to determine how they interpreted regulations pertaining to group-to-individual guaranteed access. The survey results indicated that issuers had a difficult time interpreting the regulations and were thus applying them differently. discussed earlier, the ambiguity in the risk-spreading requirement for products available to HIPAA-eligible individuals has been cited as a factor contributing to high rates for these products, which in some states range from 140 to 600 percent or more of standard rates. Other areas in which state insurance regulators have sought additional federal guidance or clarification include use of plan benefit structure as a de facto preexisting condition exclusion period, treatment of late enrollees, market withdrawal as an exception to guaranteed renewability, and nondiscrimination provisions under group plans. Federal agency officials point to a number of factors that may explain the perceived lack of clarity or detail in some regulatory guidance. First, the statute, signed into law on August 21, 1996, required that implementing regulations be issued in less than 8 months, on April 1, 1997. Implicitly recognizing this challenge, the Congress provided for the issuance of regulations on an interim final basis. This time-saving measure helped the agencies to issue a large volume of complex regulations within the statutory deadline while also providing the opportunity to add more details or further clarify the regulations with the help of comments later received from industry and states. Therefore, some regulatory details necessarily had to be deferred until a later date. Furthermore, agency officials pointed out that in developing the regulations, they sought to balance states’ need for clear and explicit regulations with the flexibility to meet HIPAA goals in a manner best suited to each state. For example, under the group-to-individual guaranteed access requirement, states were given several options for achieving compliance. While the multiple options may have contributed to confusion in some instances, differences among the state insurance markets and existing reforms suggested to agency officials that a flexible approach was in the best interest of states. In fact, according to HHS officials, states specifically requested that regulations not be too explicit in order to allow states flexibility in implementing them. Finally, some of the regulatory ambiguities derive from ambiguities existing in the statute itself. For example, regulations concerning late enrollees closely track the language from the statute. States have the option of enforcing HIPAA’s access, portability, and renewability standards as they apply to fully insured group and individual health coverage. In states that do not pass laws to enforce these federal standards, HHS must perform the enforcement function. According to HHS officials, the agency as well as the Congress and others assumed HHS would generally not have to perform this role, believing instead that states would not relinquish regulatory authority to the federal government. However, five states—California, Massachusetts, Michigan, Missouri, and Rhode Island—reported they did not pass legislation to implement HIPAA’s group-to-individual guaranteed access provision, among other provisions, thus requiring HHS to regulate insurance plans in these states. Preliminary information suggests that up to 17 additional states have not enacted laws to enforce one or more HIPAA provisions, potentially requiring HHS to play a regulatory role in some of these states as well. HHS resources are currently strained by its new regulatory role in the five states where enforcement is under way, according to officials, and concern exists about the implications of the possible expansion of this role to additional states. Federal officials have begun to respond to some of the concerns raised during the first year of HIPAA implementation. HHS is continuing to monitor the need for more explicit risk-spreading requirements to mitigate the high cost of guaranteed access products in the individual market under the federal fallback approach. Federal officials believe a change to the certificate issuance requirement in response to issuer concerns would be premature; the officials note that the certificates also serve to notify consumers of their portability rights, regardless of whether consumers ultimately need to use the certificate to exercise those rights. As for guaranteed renewal for Medicare eligibles, federal officials interpret HIPAA to require that individuals, upon becoming eligible for Medicare, have the option of maintaining their individual market coverage. Moreover, HHS officials disagreed with the insurance industry and state regulators’ contention that sufficient numbers of individuals in poor health will remain in the individual market to affect premium prices there. nondiscrimination and late enrollment was published on December 29, 1997. This guidance clarifies how group health plans must treat individuals who, prior to HIPAA, had been excluded from coverage because of a health status-related factor. Further guidance and clarification in these and other areas is expected to follow. Finally, to address its resource constraints, HHS has shifted resources to HIPAA tasks from other activities. In its fiscal year 1999 budget request, HHS has also requested an additional $15.5 million to fund 65 new full-time-equivalent staff and outside contractor support for HIPAA-related enforcement activities. HIPAA reflects the complexity of the U.S. private health insurance marketplace. The law’s standards for health coverage access, portability, and renewability apply nationwide but must take account of the distinctive features of the small-group, large-group, and individual insurance markets, and of employees’ movements between these markets. From the drafting of regulations to the responses of issuers, implementation of this complex law has itself been complicated but has nonetheless moved forward. Notwithstanding this progress, though, participants and observers have raised concerns and noted challenges to those charged with implementing this law. Some challenges are likely to recede or be addressed in the near term. What could be characterized as “early implementation hurdles,” especially those related to the clarity of federal regulations, may be largely resolved during 1998, as federal agencies issue further regulatory guidance to states and issuers. Moreover, as states and issuers gain experience in implementing HIPAA standards, the intensity of their dissatisfaction may diminish. In any case, while criticizing the cost and administrative burden of issuing certificates of creditable coverage, issuers still seem able to comply. According to issuers and other participants in HIPAA’s implementation, HIPAA may have several unintended consequences, but predicting whether these possibilities will be realized is difficult. At this early point in the law’s history, these concerns are necessarily speculative because HIPAA’s insurance standards have not been in place long enough for evidence to accumulate. In addition, possible changes in the regulations or amendments to the statute itself could determine whether a concern about a provision’s effects becomes reality. However, two implementation difficulties are substantive and likely to persist, unless measures are taken to address them. First, in the 13 federal fallback states, some consumers are finding that high premiums make it difficult to purchase the group-to-individual guaranteed access coverage that HIPAA requires carriers to offer. This situation is likely to continue unless HHS interprets the statute to require (in federal fallback states) more explicit and comprehensive risk-spreading requirements or that states adopt other mechanisms to moderate rates of guaranteed access coverage for HIPAA eligibles. In addition, if the range of consumer education efforts on HIPAA provisions remains limited, many consumers may continue to be surprised by the limited nature of HIPAA protections or to risk losing the opportunity to take advantage of them. Second, HHS’ current enforcement capabilities could prove inadequate to handle the additional burden as the outcome of state efforts to adopt and implement HIPAA provisions becomes clearer in 1998. The situation regarding the implementation of HIPAA’s insurance standards is dynamic. As additional health plans become subject to the law, and as further guidance is issued, new problems may emerge and new corrective actions may be necessary. Consequently, because a comprehensive determination of HIPAA’s implementation and effects remains years away, continued oversight is required. Mr. Chairman, this concludes my prepared statement. I will be happy to answer your questions. To achieve its goals of improving the access, portability, and renewability of private health insurance, HIPAA sets forth standards that variously apply to the individual, small-group, and large-group markets of all states. Most HIPAA standards became effective on July 1, 1997. However, the certificate issuance standard became effective on June 1, 1997, and issuers had to provide certificates automatically to all disenrollees from that point forward as well as upon request to all disenrollees retroactive to July 1, 1996. In states that chose an alternative mechanism approach, the individual market guarantee access standard (often called “group-to-individual portability”) had until January 1, 1998, to become effective. Finally, group plans do not become subject to the applicable standards until their first plan year beginning on or after July 1, 1997. Table I.1 summarizes HIPAA’s health coverage access, portability, and renewability standards, by applicable market segment. The text following the table describes each standard. Small group (2-50 employees) Limitations on preexisting condition exclusion periodsCredit for prior coverage (portability) N/A = not applicable. HIPAA requires issuers of health coverage to provide certificates of creditable coverage to enrollees whose coverage terminates. The certificates must document the period during which the enrollee was covered so that a subsequent health issuer can credit this time against its preexisting condition exclusion period. The certificates must also document any period during which the enrollee applied for coverage but was waiting for coverage to take effect—the waiting period—and must include information on an enrollee’s dependents covered under the plan. In the small-group market, carriers must make all plans available and issue coverage to any small employer that applies, regardless of the group’s claims history or health status. Under individual market guaranteed access—often referred to as group-to-individual portability—eligible individuals must have guaranteed access to at least two different coverage options. Generally, eligible individuals are defined as those with at least 18 months of prior group coverage who meet several additional requirements. Depending on the option states choose to implement this requirement, coverage may be provided by carriers or under state high-risk insurance pool programs, among others. HIPAA requires that all health plan policies be renewed regardless of health status or claims experience of plan participants, with limited exceptions. Exceptions include cases of fraud, failure to pay premiums, enrollee movement out of a plan service area, cessation of membership in an association that offers a health plan, and withdrawal of a carrier from the market. Group plan issuers may deny, exclude, or limit an enrollee’s benefits arising from a preexisting condition for no more than 12 months following the effective date of coverage. A preexisting condition is defined as a condition for which medical advice, diagnosis, care, or treatment was received or recommended during the 6 months preceding the date of coverage or the first day of the waiting period for coverage. Pregnancy may not be considered a preexisting condition, nor can preexisting conditions be imposed on newborn or adopted children in most cases. Group plan issuers may not exclude a member within the group from coverage on the basis of the individual’s health status or medical history. Similarly, the benefits provided, premiums charged, and employer contributions to the plan may not vary within similarly situated groups of employees on the basis of health status or medical history. Issuers of group coverage must credit an enrollee’s period of prior coverage against their preexisting condition exclusion period. Prior coverage must have been consecutive, with no breaks of more than 63 days, to be creditable. For example, an individual who was covered for 6 months who changes employers may be eligible to have the subsequent employer’s plan’s 12-month waiting period for preexisting conditions reduced by 6 months. Time spent in a prior health plan’s waiting period cannot count as part of a break in coverage. Individuals who do not enroll for coverage in a group plan during their initial enrollment opportunity may be eligible for a special enrollment period later if they originally declined to enroll because they had other coverage, such as coverage under COBRA, or were covered as a dependent under a spouse’s coverage and later lost that coverage. In addition, if an enrollee has a new dependent as a result of a birth or adoption or through marriage, the enrollee and dependents may become eligible for coverage during a special enrollment period. HIPAA also includes certain other standards that relate to private health coverage, including limited expansions of COBRA coverage rights; new disclosure requirements for ERISA plans; and, to be phased in through 1999, new uniform claims and enrollee data reporting requirements. Changes to certain tax laws authorize federally tax-advantaged medical savings accounts for small employer and self-employed plans. Finally, although not included as part of HIPAA but closely related, new standards for mental health and maternity coverage became effective on January 1, 1998. Health Insurance Standards: New Federal Law Creates Challenges for Consumers, Insurers, Regulators (GAO/HEHS-98-67, Feb. 25, 1998). Medical Savings Accounts: Findings From Insurer Survey (GAO/HEHS-98-57, Dec. 19, 1997). The Health Insurance Portability and Accountability Act of 1996: Early Implementation Concerns (GAO/HEHS-97-200R, Sept. 2, 1997). Private Health Insurance: Continued Erosion of Coverage Linked to Cost Pressures (GAO/HEHS-97-122, July 24, 1997). Employment-Based Health Insurance: Costs Increase and Family Coverage Decreases (GAO/HEHS-97-35, Feb. 24, 1997). Private Health Insurance: Millions Relying on Individual Market Face Cost and Coverage Trade-Offs (GAO/HEHS-97-8, Nov. 25, 1996). Health Insurance Regulation: Varying State Requirements Affect Cost of Insurance (GAO/HEHS-96-161, Aug. 19, 1996). Health Insurance for Children: Private Insurance Coverage Continues to Deteriorate (GAO/HEHS-96-129, June 17, 1996). Health Insurance Portability: Reform Could Ensure Continued Coverage for Up to 25 Million Americans (GAO/HEHS-95-257, Sept. 19, 1995). Health Insurance Regulation: National Portability Standards Would Facilitate Changing Health Plans (GAO/HEHS-95-205, July 18, 1995). The Employee Retirement Income Security Act of 1974: Issues, Trends, and Challenges for Employer-Sponsored Health Plans (GAO/HEHS-95-167, June 21, 1995). Health Insurance Regulation: Variation in Recent State Small Employer Health Insurance Reforms (GAO/HEHS-95-161FS, June 12, 1995). The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO discussed the implementation of the private insurance market provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). GAO noted that: (1) although HIPAA gives people losing coverage a guarantee of access to coverage in the individual market, consumers attempting to exercise this right have been hindered in some states by carrier practices and pricing and by their own misunderstanding of this complex law; (2) in the 13 states using the federal fallback approach to guaranteed access, some carriers initially discouraged people from applying for the coverage or charge them as much as 140 to 600 percent of the standard rate; (3) many consumers also do not fully understand the eligibility criteria that apply and as a result may risk losing their right to coverage; (4) issuers of health coverage believe certain HIPAA provisions are burdensome to administer, may create unintended consequences, or may be abused by consumers; (5) issuers also fear that HIPAA's guaranteed renewal provision could cause those eligible for Medicare to pay for redundant coverage and hinder carriers' ability to sell products to children and other targeted populations; (6) certain protections for group plan enrollees may create an opportunity for consumer abuse, such as the guarantees of credit for prior coverage, which could give certain enrollees an incentive, when they need medical care, to switch from low-cost, high-deductible coverage to more expensive, low-deductible coverage; (7) state insurance regulators have encountered difficulties implementing and enforcing HIPAA provisions where federal guidance lacks sufficient clarity or detail; (8) federal regulators face an unexpectedly large role under HIPAA, which could strain the Department of Health and Human Service's (HHS) resources and weaken its oversight; (9) in states that do not pass legislation implementing HIPAA provisions, HHS is required to take on the regulatory role; (10) as federal agencies issue more guidance and states and issuers gain more experience with HIPAA, concerns about the clarity of its regulations may diminish; (11) whether unintended consequences will occur is as yet unknown, in part because sufficient evidence has not accumulated; (12) in federal fallback states, premiums for group-to-individual guaranteed access coverage are likely to remain high unless regulations with more explicit risk-spreading requirements are issued at the federal or state level; (13) HHS' ability to meet its growing oversight role may prove inadequate given the current level of resources, particularly if more states cede regulatory authority to the federal government; and (14) in any case, as early challenges are resolved during 1998, other challenges to implementing HIPAA may emerge.