When issuers set their premiums, they consider a number of factors, such as trends in the cost of paying providers for medical services and data on the utilization of services in the population they are serving. Issuers are able to more accurately predict these costs when they have historic claims data for the population eligible to purchase coverage. However, issuers must also consider the risk that the cost of the healthcare delivered to their enrollees will exceed the premiums that they developed based on historic claims data. Prior to the implementation of PPACA, issuers offering individual and small group market health insurance plans generally mitigated risks for unexpectedly high health care costs by tailoring premiums to specific individuals and small groups through a process known as medical underwriting and, in the individual market, by denying coverage to certain individuals based on factors such as health status. Issuers generally were not subject to uniform federal requirements in regards to rules for setting premiums and guaranteed issuance of coverage for individuals, and therefore consumer protections varied among states. For example, we reported that, prior to the passage of PPACA, the majority of states did not prohibit issuers from denying enrollment of individuals because of their health status and issuers in many states were able to vary premiums based on the individual’s health status, gender, and age. Several PPACA provisions that became effective January 1, 2014, limited the ability of issuers to deny coverage or charge higher premiums to individuals and small groups based on health risks or certain other factors. For example, PPACA requires that issuers offering individual and small group market plans guarantee coverage regardless of the existence of a person’s pre-existing conditions. Further, issuers are restricted in the amount they can vary premiums based on age and tobacco use, and they cannot set premiums for individual and small group plans based on an individual’s health status, gender, or other characteristics.result, issuers may have an incentive to try to attract healthier individuals through certain marketing practices, benefit designs, drug formularies, and provider networks, leaving to other issuers those individuals who are in worse health and likely to require costly medical care. PPACA also included a requirement that most individuals purchase health insurance or pay a tax penalty if coverage meeting affordability standards is available (this is known as the “individual mandate”). As a result, many previously uninsured individuals entered the insurance market, possibly for the first time, and issuers lacked historical information about their health care and use of medical services.uninsured individuals who are most in need of health care may be more likely than others to purchase insurance during the transition, resulting in a pool of enrollees that have unknown and potentially higher medical costs than the broader population. In this situation, issuers might set plan premiums higher than they would otherwise due to uncertainty about enrollees’ health status. In addition, previously PPACA also required the creation in all states of health insurance exchanges—marketplaces where individuals and small employers can compare and select among insurance plans offered by participating private issuers. To participate on the exchanges issuers must offer plans that meet certain state and PPACA requirements for benefit design, rate setting, and other factors. Approved plans are referred to as qualified health plans. It is through the exchanges that qualifying individuals may apply for premium tax credits and cost-sharing reductions, and certain small employers may apply for small business health insurance tax credits. Issuers participating in an exchange must meet certain criteria; for example, criteria related to marketing, provider networks, and accreditation. PPACA does not require issuers offering coverage in the individual and small group markets to offer plans through the exchanges but, with limited exceptions, issuers in these markets are required to comply with other provisions, such as requiring coverage of specified benefit categories at standardized levels of cost-sharing and prohibitions on annual and lifetime limits on the dollar value of required benefits. Some of these market reforms do not apply to “grandfathered plans.” To mitigate issuer risk in the individual and small group health insurance markets, PPACA required the creation of the permanent risk adjustment program and temporary reinsurance and risk corridors programs. States have the option to either establish their own state-run risk adjustment and reinsurance programs or allow the federal government to administer these programs.is required to administer the risk corridors program. The Department of Health and Human Services (HHS) Each of the risk mitigation programs applies to a different group of issuers. For example, the risk adjustment program transfers funds among individual and small group market issuers, while the reinsurance program collects funds from all issuers and third party administrators on behalf of group health plans and distributes it to only individual market issuers. Further, issuers do not have to comply with these requirements for certain types of plans. Specifically, grandfathered plans do not participate in the risk adjustment program, and they do not receive reinsurance payments. Similarly, HHS determined in 2013 that states could decide whether to allow enrollees to continue coverage under certain non-grandfathered plans established prior to 2014. plans—did not have to comply with all PPACA provisions and do not participate in the reinsurance or risk adjustment programs. These plans—referred to as transitional For a summary of each program’s key functions, years of operation, and the issuers required to participate, see table 1. Centers for Medicare & Medicaid Services, Center for Consumer Information & Insurance Oversight Letter to Insurance Commissioners (Washington, D.C.: Nov. 14, 2013). The Center for Consumer Information & Insurance Oversight (CCIIO), within CMS, is responsible for overseeing the implementation the provisions of PPACA related to private health insurance. Risk adjustment provides a way to correct for market imbalances that occur when some issuers attract a larger share of enrollees at low risk for expensive claims and other issuers attract a larger share of enrollees at high risk for expensive claims. Risk adjustment programs have previously been used in Medicare Advantage—the managed care option for Medicare beneficiaries—and Medicare Part D—the Medicare prescription drug program. PPACA’s requirements for the design of the risk adjustment program allowed for discretion by CMS in the design of the program. Under the program designed by CMS, payments are transferred from issuers with a larger share of enrollees at low risk for expensive claims to those with a larger share of enrollees at high risk for expensive claims. The amount to be transferred between issuers is determined using the following steps: determine individual enrollee risk scores—for example, how much more or less costly each enrollee is expected to be relative to the average enrollee—based on demographic and diagnostic information; determine the average risk score for each plan based on individual enrollee risk scores plus adjustments for a variety of factors, such as the extent of enrollee cost-sharing in the plan; compare each plan’s average risk score to the average risk score of the market within its geographic area; and calculate the amount that CMS will transfer between issuers. Reinsurance programs are designed to limit issuer risks for enrollees with very high-cost claims. Such reinsurance coverage has traditionally been available to issuers in the private insurance market, Medicare Part D, and through state-subsidized programs. Generally, a provider of reinsurance assumes full or partial liability when costs for any single enrollee during a year exceed a specified dollar threshold, while the issuer is usually required to retain at least some liability for costs so that it will have an incentive to continue managing the enrollee’s care. Under the PPACA reinsurance program, CMS expects that premium increases that might otherwise occur in the individual health insurance market because of the increased enrollment of higher risk individuals will be limited. CMS collects contributions from all issuers and third party administrators based on the size of their enrollment and then transfers payments to issuers in the individual market, both inside and outside the exchanges, that have enrollees with high claims costs. PPACA specified the total amount issuers are to contribute each year to cover payments for enrollees with high claims costs. For example, the amount of reinsurance funds that was to be collected from and distributed to issuers for the 2014 benefit year was $10 billion. Each year CMS specifies the per-enrollee contribution issuers must make and the parameters for determining the amount to be paid to issuers for their high cost enrollees. These payment parameters define the two elements that are used to calculate issuers’ reinsurance payments: “attachment point,” which is the dollar value above which an enrollee is considered high-cost and when reinsurance payments would begin, and the “coinsurance rate”, which is the percentage of issuer cost above the attachment point and below the cap of $250,000 that is eligible for reimbursement. For example, for 2014, CMS determined an attachment point of $45,000 and a coinsurance rate of 80 percent, which means that CMS reimburses issuers for 80 percent of an enrollee’s medical costs above $45,000 and up to $250,000. Costs above the $250,000 cap are fully paid by the issuer. For the reinsurance program contribution amounts and payment parameters for 2014 through 2016, see table 2. A risk corridors program, as has been used in Medicare Part D, helps limit excessive issuer profits or losses that may result from market volatility or inaccurate rate setting. Under the PPACA risk corridors program, CMS and issuers of qualified health plans may share in profits and losses that exceed a certain threshold. The program determines profits and losses by comparing an issuer’s actual spending to its expected spending. The actual spending is known as “allowable costs”—costs for medical care claims, quality improvement, and health information technology. The expected spending is known as the “target amount”—premiums collected less certain administrative costs and profits. CMS will make program payments to an issuer if its losses exceed a certain threshold, and issuers whose profits exceed a certain threshold will make program payments to CMS. The amount of that payment depends on the extent of the losses or profits. Issuers with allowable costs within a specified range, or corridor, of the target amount do not make or receive any payments. In total, the program has three corridors: one for issuers whose costs are within the specified range, and two others for issuers with relatively greater or lesser costs compared to the target amount. When an issuer’s costs are within 3 percent of its target amount, between 97 and 103 percent, the issuer makes no payments and receives no payments. Issuers whose profit or loss is greater than 3 percent of its target amount share in that profit or loss with CMS. An issuer whose profit or loss is greater than 8 percent of its target amount will pay a greater portion of its profit or will be reimbursed for a greater portion of its loss. (See fig. 1.) PPACA directed HHS to consider the design of the Medicare risk mitigation programs in developing the PPACA risk mitigation programs, although it also set requirements that differed from the Medicare programs. While PPACA established the risk corridors and reinsurance programs as temporary programs for the 3-year period 2014 through 2016, the Medicare Part D programs were not required to be temporary and have operated since 2006. In addition, according to CMS, the PPACA risk adjustment and reinsurance programs are budget neutral, in that payments to issuers will be adjusted to reflect, and not exceed, contributions. CMS originally indicated that the PPACA risk corridors program would not be operated in a budget neutral manner but subsequently indicated its intent to operate the program as budget neutral in 2014 and 2015, and then in 2016, if collections are insufficient to make payments, it would use other sources of funding subject to availability. For the Medicare Advantage and Medicare Part D risk mitigation programs, the payments that CMS makes to issuers are not limited to issuer contributions. CMS considered a range of insurance market characteristics—such as demographics and the availability of market data—in making decisions about how to design PPACA’s three risk mitigation programs. CMS’s design decisions also reflected the temporary status of the reinsurance and risk corridors programs. While the Medicare risk adjustment programs served as the basis for the PPACA risk adjustment program, CMS’s design of the PPACA program reflects key differences that exist between Medicare and PPACA markets, including differences in demographics, the availability of enrollee data, and each program’s benefit design and premium-setting structure. For example, while Medicare primarily serves the elderly and certain individuals with disabilities, the markets covered by the PPACA risk adjustment program provide coverage for the general non-elderly population. Therefore, while both the Medicare and PPACA risk adjustment programs incorporate information about enrollee age when estimating risk, the PPACA program includes separate analyses for infants, children, and adults to reflect the inherent differences in the medical needs and costs of these three population groups. On the other hand, the PPACA risk adjustment program does not incorporate certain demographic characteristics that are important for the Medicare population, such as Medicaid enrollment, and whether an individual resides in a nursing home. In designing the PPACA risk adjustment program, CMS also had to account for uncertainty surrounding the population that would enroll in 2014 health plans and for the lack of historical claims data for this population. Therefore, to develop risk adjustment rates for different age, sex, and diagnostic categories, CMS used claims data from private health plans including employer-based plans for a population that was similar to those individuals expected to enroll in individual and small group coverage in 2014. CMS also chose to develop a concurrent risk adjustment program model, which uses enrollees’ diagnoses during the current benefit year as the basis for developing the risk scores for that same year. In contrast, historical claims data was available on the Medicare population and its risk adjustment program is a prospective model, which uses data from a prior year to calculate the risk adjustment score in the current benefit year. CMS also considered other market characteristics in designing the PPACA risk adjustment program, such as the option for issuers to offer different benefit levels and the availability of subsidies that may affect enrollees’ use of health services. As with demographics and the availability of enrollee data, these characteristics are different in the Medicare and PPACA markets. See table 3 for additional information about key market characteristics and design features of the Medicare Advantage and PPACA risk adjustment programs. CMS indicated that it designed the PPACA reinsurance program to minimize administrative burden for issuers and maximize simplicity, in part because the program is temporary. For example, CMS initially proposed basing the amount an issuer contributes to the reinsurance pool on a percent of the premiums paid by each of its enrollees. CMS indicated that this would be the fairest method as it would ensure that issuers with higher premiums and costs—and thus potentially higher reinsurance claims—contribute additional funds towards reinsurance. However, because of the temporary nature of the reinsurance program, and after reviewing comments from rule-making, which included comments from issuers, CMS ultimately chose to base contributions on a flat per-enrollee amount because it is more straightforward for issuers and less complex for CMS to administer. Additionally, in establishing the basis for identifying enrollees as high-cost, CMS chose to use actual claims costs incurred by the plan for each enrollee, rather than a list of medical conditions identified as high risk. Although CMS acknowledged that payments made solely on the basis of actual claims costs may not as strongly encourage efficient care, CMS chose this approach because issuers would still be responsible for costs above the reinsurance cap and because it was simpler and consistent with the structure of other CMS also initially proposed that issuers reinsurance programs.determine whether an enrollee’s costs exceeded the attachment point based on claims for essential health benefits in order to ensure that reinsurance payments are based on a comparable set of benefits across issuers. However, CMS subsequently decided to use all covered benefits—not only essential health benefits—because of the administrative burden for issuers of distinguishing claims for essential health benefits from other claims. CMS also considered specific characteristics of the insurance market under PPACA when designing the reinsurance program. For example, CMS developed a model to estimate market enrollment and expenditures in 2014 to help it set the rate that each issuer must contribute per enrollee in order for CMS to collect the full amount authorized by PPACA. also used the model to estimate what payment parameters—the attachment point, coinsurance rate, and cap—would allow it to distribute the full collected amount. The Affordable Care Act Health Insurance Model uses Current Population Survey data and was developed with reference to existing models such as those of the Congressional Budget Office and the CMS Office of the Actuary to characterize medical expenditures and enrollment choices across the 2014 market place. The model predicts coverage status of individuals and incorporates the effects of state and federal policy choices. See PPACA: HHS Notice of Benefit and Payment Parameters for 2014, CMS final rule, 78 Fed. Reg.15410, 15461 (Mar. 11, 2013)(preamble.III.C.3.a). reinsurance payments, CMS considered the variation among states in the relative size of the individual and group insurance markets that could affect the balance of contributions and payments. CMS determined that the availability of reinsurance contributions to make payments will vary significantly between states, and some states may not have sufficient contributions to meet the need for all reinsurance payments in that state. Therefore, after initially proposing that contributions would remain in each state, CMS determined that contributions would be pooled nationally and then distributed to issuers. CMS also modified the reinsurance program to accommodate market changes resulting from its policy allowing states to renew certain transitional plans until October 2, 2016. As a result of this policy, CMS was concerned that healthier individuals were more likely to remain enrolled in these non-PPACA compliant transitional plans, leaving less healthy and higher-cost individuals to enroll in PPACA-compliant plans. Because the policy was implemented in November 2013, after issuers had set their premiums for 2014, there was an increased risk that the premiums would not be adequate to cover higher than anticipated claims costs. Therefore, in March 2014, CMS lowered the attachment point for 2014 from $60,000 to $45,000 to provide increased protection to plans that enrolled individuals with high costs. While various aspects of the risk corridors program were prescribed in statute, CMS officials told us that, due to the temporary nature of the program, they sought to minimize issuer burden for the elements of the program that were left to the agency’s discretion. Specifically, CMS aligned the risk corridors program formula with the definition of allowable costs under the medical loss ratio (MLR) requirements that issuers have For example, under both programs, been required to meet since 2011.the cost of certain health care quality improvement activities—such as developing quality data reporting—and certain health information technology activities are included in “allowable costs” and profits are included in “allowable administrative costs.” CMS modified the risk corridors program for the 2014 and 2015 benefit years to account for changes to the insurance market resulting from its policy to let states allow continued coverage by non-PPACA compliant transitional plans. CMS noted that issuers may incur increased claims costs because of this policy, but were not able to incorporate assumptions about additional costs into their premium rates because the policy was initiated after issuers had set their premiums. Therefore, CMS made certain adjustments to the risk corridors calculation to allow issuers to retain a larger share of profits. For benefit year 2014, CMS planned to make adjustments based on the number of enrollees in each state’s transitional plans. For benefit year 2015, CMS established a national adjustment to the risk corridors program formula, regardless of the presence of transitional plans in the state. CMS guidance to issuers about how it will manage the risk corridors program if collections do not cover required payments changed significantly over time: In March 2013, CMS confirmed that it would make payments to issuers as required under PPACA, and would not operate the risk corridors program in a budget neutral manner. In March 2014, after issuers had set 2014 premiums and after the start of the benefit year, CMS indicated that it would seek to operate the risk corridors program in a budget neutral manner by making all risk corridors payments with risk corridors collections. In April 2014 it issued further guidance explaining that if collections were insufficient for one year, the agency would reduce risk corridors payments to issuers proportionately and later use funds collected in the next year to make full payments. CMS also noted that it would issue future guidance indicating what it would do if collections did not cover payments as of the final year of the risk corridors program. In February 2015 CMS clarified what it would do in the event that risk corridors program collections for the three years of the program were not sufficient to cover payments to issuers. CMS indicated that “in the unlikely event of a shortfall in the 2016 benefit year, HHS will use other sources of funding, subject to availability of appropriations.” CMS chose data collection systems for the risk mitigation programs that were intended to address privacy and security concerns and maximize efficiencies. CMS delayed implementation of the new data collection system for the risk adjustment and reinsurance programs by nearly a year as it revised its plans for implementing the distributed data approach. Because of these changes, the agency was not able to adhere to its original timeline for collecting and reporting data to issuers. CMS chose a data collection system for the risk adjustment and reinsurance programs that was intended to address privacy and security concerns and to maximize efficiencies across the programs. According to CMS, the system it developed—known as the distributed data approach—allows enrollee claims data, which are needed to calculate risk adjustment payments and charges and reinsurance payments and contributions, to remain on the issuers’ own servers. CMS provides each issuer with software to calculate contributions but only the summary reports generated by CMS’s software are sent to the agency and not the actual claims data. CMS told us that the system was designed to (1) address privacy and data security concerns by minimizing the number of transfers and amount of enrollee health information transferred, (2) ensure that issuers’ proprietary data remains with the issuer, and (3) standardize software processes, timing, and rules uniformly across issuers. CMS elected to use the distributed data approach after considering comments from the industry through its rule-making process. In particular, CMS initially considered three data collection options: a centralized data collection system in which issuers send individual enrollee claims data directly to CMS, a state-level approach in which states collected enrollee claims data on behalf of CMS, and the distributed data approach. CMS indicated that it received many comments in favor of the distributed data approach because of the increased privacy and the fact that it eliminated the administrative complexity of issuers transmitting claims data to CMS. In selecting the distributed data approach, however, CMS identified potential tradeoffs. Specifically, it noted that this approach raises the possibility that issuers could make errors when calculating their risk scores. To address this concern, the agency said that it would augment its data audit processes. CMS also indicated that some issuers, particularly smaller companies, may be challenged by the administrative complexity of the distributed data approach, and therefore this approach may require more resources from CMS to support issuers with implementation. CMS decided to leverage the distributed data approach to collect data for both the risk adjustment and reinsurance programs in order to maximize efficiency. As reinsurance is a temporary program, agency officials believed it was not worth the resource investment for issuers or CMS to develop a separate data collection system. As a result, the distributed data approach is used for both programs, and issuers submit data to CMS on the same schedule for both programs. For the risk corridors program, CMS officials said that the agency is using an existing data system in an effort to maximize efficiency. Issuers will submit data to CMS for calculating payment transfers through CMS’s Health Insurance Oversight System (HIOS), which issuers already use to submit MLR data. Specifically, issuers use HIOS to submit data on their total medical claims costs, expenses for quality improvement activities, premiums, taxes and fees, and non-claims costs, which CMS will then use to calculate whether issuers qualify for risk corridors payments or owe contributions. As the calculations for the risk corridors program do not require transmitting enrollee claims data, CMS did not have the same privacy and security concerns related to data submission that they had for the risk adjustment and reinsurance programs. CMS delayed implementation of data collection for the risk adjustment and reinsurance programs by nearly a year as it revised its plans for implementing the distributed data approach. An initial delay occurred when CMS changed the server requirements due to its concerns about the administrative burden for the agency and to accommodate issuer preferences. The servers used for the distributed data approach are called the external data gathering environment (EDGE) servers. CMS initially decided in May 2012 that each issuer would set up and maintain its own physical EDGE servers, with the issuer downloading CMS software to a server located on its premises. However, according to CMS officials, when the agency tested these servers with a small sample of issuers in late 2012 and early 2013, it found that it took the agency longer than expected to load the necessary software onto each issuer’s individual server. CMS officials also said that the issuers involved in the initial testing requested that CMS consider a virtual approach, in which another entity would host the server rather than the issuers themselves. In response to these concerns, CMS officials said that the agency decided to develop a virtual EDGE server for issuers in late 2013 and early 2014, furnished by Amazon Web Services. Once issuers uploaded their claims data on to the virtual EDGE server, CMS’s software would generate detailed and summary reports to be transmitted to CMS. CMS’s timeline for implementing the EDGE servers was delayed again when it changed its plan for these servers a second time. After CMS made the switch to the virtual EDGE server, some issuers that had already purchased a physical on-premise server to comply with CMS’s initial requirements requested that CMS allow them to use those servers. Therefore, in May 2014, CMS decided to allow issuers to use either option, as well as an option to use a virtual server provided by an entity other than Amazon Web Services—known as a virtual on-premise server. All three options allow issuers to maintain their data on private servers that are only accessible to the issuer and use CMS software to generate summary reports that are sent to the agency (see side bar). CMS officials said that in addition to being responsive to issuer requests for flexibility, they wanted to create multiple approaches to reflect the variation in issuer size. For example, smaller issuers might find the virtual server option more appealing if they do not have the administrative resources available to purchase and maintain a physical on-premise server. Because of these changes in CMS’s EDGE server requirements, the agency was not able to adhere to its original timeline for uploading data and providing program reports to issuers. CMS initially planned to have issuers acquire and set up their servers in the first part of 2013 and to then load software and configure the servers in the latter part of 2013. This would have allowed issuers to upload enrollment and claims data on a monthly basis starting in January 2014, and CMS planned to use these data to generate issuer reports during 2014: CMS planned to provide quarterly reports to issuers with the estimated amount of reinsurance program payments they would receive for benefit year 2014. CMS officials said that these estimates would allow issuers to more accurately account for reinsurance payments when setting their premiums for benefit year 2015 and beyond, as issuers set premiums in the year prior to the benefit year. CMS planned to provide interim estimate reports on risk adjustment calculations throughout the benefit year as it did with the reinsurance program. These reports were to include preliminary calculations of an issuer’s average risk score for each of its plans but not any data about how an issuer’s score compared to other issuers in its market, which would be necessary for an issuer to estimate its potential contribution or payment. CMS officials said that they did not plan to provide relative market data to issuers in the estimate reports because CMS may not have complete or correct data for all the issuers in a market until the final data submission deadline on April 30 of the year following the benefit year. They said that relative market data risk scores based on incomplete data could present a misleading estimate of an issuer’s potential contribution or payment. However, CMS’s plans for data collection and reporting were delayed. As issuers were not able to begin loading data onto the EDGE servers until September 27, 2014, CMS was not able to provide either quarterly reinsurance reports or interim risk adjustment reports for benefit year 2014. Therefore, issuers did not have estimates of reinsurance payments available from CMS to incorporate into their 2015 premium calculations. CMS next planned to produce two risk adjustment estimate reports for issuers, one in mid-December 2014 and one in May 2015. However, CMS experienced further delays as issuers began uploading their data to the EDGE servers. CMS officials noted that they were implementing a new technology in a compressed timeframe, and that there were ongoing fixes as they deployed the new software. As a result, CMS postponed the deadline for issuers to upload their data to the EDGE servers from the beginning to the end of December 2014, thus delaying CMS’s issuance of the first risk adjustment estimate reports to December 29, 2014, and the first reinsurance estimate report to January 12, 2015 (see fig. 2). CMS announced in January 2015 that it would provide monthly risk adjustment and reinsurance estimate reports for the remainder of the data collection period for benefit year 2014, which runs through April 30, 2015. Officials said that the purpose of these monthly estimate reports is to allow CMS to look at data discrepancies and quality issues before issuers upload their final data. After benefit year 2014, CMS officials said the agency plans to provide periodic risk adjustment and reinsurance estimate reports throughout each benefit year. For the risk corridors program, CMS indicated that it expects to propose and finalize a data collection tool from January to May 2015. Although CMS is using an existing data system, HIOS, CMS officials said the agency must still develop a new data collection tool within HIOS, which will include new fields specifically for the risk corridors program. However, the timeline for collecting these data is later, relative to the other two programs. The calculation of risk corridors payments, as is also the case with MLR rebates, incorporates risk adjustment program transfers and reinsurance program payments and therefore must take place after CMS makes those other calculations. Issuers must annually submit data for both the risk corridors program and MLR payments by July 31 of the year following the benefit year—for example, July 31, 2015, for the 2014 benefit year. CMS plans to collect risk corridors program contributions from issuers that are required to make them beginning in mid-September 2015 and to issue payments to eligible issuers beginning in mid-October 2015. To a varying extent, CMS has developed or has plans to develop data verification checks or audit procedures for each of PPACA’s three risk mitigation programs. In addition, CMS has initiated efforts to evaluate the permanent risk adjustment program but has not finalized the details of the evaluation. For the reinsurance and risk adjustment program data that issuers upload to the EDGE server, the software on the EDGE server allows issuers to conduct data verification checks to identify errors. Issuers are able to run test reports to identify errors in what is called the test zone. Each record included on the four files submitted to the EDGE server—enrollment, medical, pharmacy, and supplemental diagnoses—is either accepted or rejected, and records that are rejected are given an error code and a description of the erroneous field. For instance, a record may be rejected if it has a value that is not the correct data type or the value is outside the permitted range. The software on the EDGE server produces detailed error reports—with information on the errors in specific records—for issuers and provides summary error reports to CMS that aggregate the number of records that were submitted, accepted, and rejected by plan, year, and month. CMS plans to use the summary error reports to understand if issuers have submitted data for all of their plans and whether the data submission includes claims and enrollment data for all months of the benefit year. CMS officials said that the reports will also be used to identify software problems and particular issuers that may need additional support. Going forward, the agency plans to use the reports for additional analyses, such as analyses of the type and volume of issuer claims for the risk adjustment program. Issuers are also supposed to report data discrepancies to CMS for benefit year 2014 as they receive monthly estimate reports from January through May 2015, including if the results of the calculations in the reports are inconsistent with either the risk adjustment or reinsurance payment methodologies, or if any claims or enrollment data were incorrectly excluded from the calculations. For the risk corridors program, CMS officials told us that the agency was in the process of developing data verification procedures at the time of our report, including automatic data checks that were going to be built into the data collection system. Officials said that they are applying lessons learned from the MLR data verification procedures to the data verification procedures for the risk corridors program. In addition to automatic data verification checks, CMS requires issuers to conduct a third-party risk adjustment data validation audit of their risk adjustment program, starting with a 2015 audit of 2014 benefit year data. The third-party audits address individual claims data that CMS does not receive in the summary reports generated by issuers in the distributed data approach. CMS will require issuers to conduct the data audits annually in two phases. For the first phase, each issuer must have a sample of its risk adjustment data, as selected by CMS, audited by an independent party. The audit must include validation of all enrollment, demographic, and medical data for enrollees in the data sample. For the second phase, CMS will audit a sub-sample of validated data from the initial audit. Beginning with 2016 benefit year data, CMS will adjust the amount issuers owe or receive under the risk adjustment program based on the audit results. Given the complexity of the risk adjustment program and the audit process, the agency was concerned that adjusting payments and charges without first gathering information on the prevalence of data errors could lead to a costly and potentially ineffective audit program. CMS officials told us that they are in the process of developing standard operating procedures for auditing the reinsurance and risk corridors programs. They said that they are developing a contract for auditing issuers’ reinsurance and risk corridors data submissions. The audits will review a variety of things, such as compliance with definitions of terms used to identify issuers that are required to make reinsurance contributions and accurate enrollment reporting for reinsurance contributions. CMS officials told us that an evaluation of the risk adjustment program would be conducted under contract by an organization with expertise in design and evaluation of risk adjustment models. A permanent risk adjustment program that accurately predicts the expected costs of enrollees is a critical factor in ensuring the long-term stability of health insurance markets under PPACA. If certain groups of enrollees are not accurately scored under the program, it could undermine the program’s integrity and result in issuers seeking to avoid enrolling sicker individuals or deciding to leave the market. In November 2014, CMS issued a request for contractors to submit bids to conduct a range of services related to Medicare and the PPACA insurance market reforms, including research and development for the PPACA risk adjustment program. The bid request identified general research and development tasks for the risk adjustment program, such as analysis of the impact of market and enrollee factors on the model, evaluation of the accuracy of the risk adjustment program, and research to support adaptation of the model. The bid request also required the contractor to develop the specific details of the evaluation. At the time of this report, CMS was reviewing contract bids to evaluate the PPACA risk adjustment program. As of April 2015, CMS expected to award this contract in the spring of 2015, although the agency had not specified the timing and scope of the evaluation. In addition, CMS was in the process of procuring an audit contractor and expected to award the audit contract near the end of fiscal year 2015. Past evaluations of the Medicare risk adjustment program have improved the predictive accuracy of that model. Specifically, evaluations for Medicare Advantage and Medicare Part D have identified areas for improvement in these programs’ risk adjustment models and have led to greater predictive accuracy, which refers to how well the models predict the cost of enrollees. CMS contracted for five evaluations of the predictive accuracy of the Medicare risk adjustment models between 2004 and 2012—three of the Medicare Advantage program and two of the Medicare Part D program—and CMS officials told us that these evaluations have had important implications for the programs. It is critical that CMS similarly understands whether or not the new PPACA risk adjustment model is accurately reflecting costs, and CMS’s continued effort to carry out this evaluation will be important to the program’s success. Most of the 12 issuers we interviewed said that the three risk mitigation programs encouraged their participation in the individual health insurance market, and two of the programs allowed them to lower their premiums. Issuers identified design concerns specific to each PPACA risk mitigation program and provided mixed responses regarding the effect of CMS’s implementation delays and technical assistance. Most of the 12 issuers we interviewed said that, beginning in 2014, the PPACA risk adjustment program positively influenced their participation in the individual health insurance market and that the PPACA reinsurance and risk corridors programs positively influenced their participation in the market and also led them to set lower premiums than they otherwise would have offered. (See table 4 for specific counts for each program.) Results for each program are as follows: Risk adjustment: Eight issuers said that the risk adjustment program positively influenced their decision to participate in the individual market; for example, one issuer that was new to the market said that it would not have participated without the risk adjustment program because it believed that established issuers would seek to attract the healthiest individuals. With respect to premiums, seven issuers (six of which cited an influence on participation) said that the risk adjustment program had no impact on the premiums they offered for 2014. Some of these issuers indicated that the lack of market-wide risk score data limited the influence of risk adjustment on their premiums because issuers were only able to calculate estimates of their own risk scores and not relative market-wide risk scores. Without knowing its relative market-wide risk score, an issuer does not know whether it will be a payer or receiver under the risk adjustment program and therefore cannot incorporate such information into its financial planning and accounting processes. Two issuers specifically suggested that CMS should provide periodic risk adjustment reports that contain relative market-wide information. Another issuer said that such information would be useful, but that they would not rely on the information if it was incomplete—for example, if it was based on data from a portion of the year or did not include data for all issuers in the market. Reinsurance: Seven issuers said that the reinsurance program positively influenced their decision to participate in the individual market, including two issuers which described the reinsurance program as the most influential of the three risk mitigation programs on their decision to participate. With respect to premiums, ten issuers said that the reinsurance program allowed them to offer lower premiums in 2014 and 2015. Seven of these issuers reported this reduction to be in the range of 8 to 13 percent lower than they would have otherwise set for 2014. Five of these seven issuers indicated a smaller reduction for 2015, with some explaining that this smaller reduction reflects the decrease in funding statutorily available to pay reinsurance claims. Risk corridors: Nine issuers said that the risk corridors program positively influenced their decision to participate in the individual market in 2014. However, one of these issuers characterized the program as the least influential of the three risk mitigation programs for this decision. Three issuers that credited the program with encouraging their participation nevertheless expected that the program’s effect would diminish over time as they gain more experience. With respect to premiums, seven issuers said that the program influenced their premiums in 2014; five of these issuers said that the program allowed them to set lower premiums than they otherwise would have due to the mitigation of potential financial loss. Two issuers noted that their state regulators do not allow itemized references to the risk corridors program when the issuers submit their premiums to the states’ insurance regulators. Issuers identified concerns with specific aspects of each of the three risk mitigation programs, including concerns about the sources of data used for the risk adjustment program and about the availability of funding for and temporary tenure of the reinsurance and risk corridors programs. Risk Adjustment: All 12 issuers we interviewed said that they would prefer the risk adjustment model to include prescription drug data in its risk score calculations.information about enrollee diagnoses, is available quickly, and would improve the accuracy of risk adjustment calculations and payments to issuers. Other issuers commented that prescription drug data is less prone to errors and misreporting and is administratively straightforward for issuers to manage, compared to other sources of diagnostic data. However, 2 issuers acknowledged that the inclusion of pharmacy data in the risk score calculation would pose an additional administrative burden on CMS. One issuer noted that such data provides useful Reinsurance: Most of the 12 issuers we interviewed expressed concerns about the availability of funding and about the timing of reinsurance payments and payment estimate reports. Six issuers expressed uncertainty about whether the program will receive its planned contributions. For example, 1 issuer said that because the contribution amount and the payment parameters are based on an estimate made by CMS, it is possible that CMS may collect less than it targeted if the estimate is incorrect. Eight issuers said that more frequent payments from CMS would improve cash flow. However, 2 other issuers said that more frequent payments would increase the temporary program’s administrative burden. With regards to the quarterly reports of estimated payments and contributions that CMS could not provide in 2014 due to the EDGE server implementation delays, 6 issuers said that these reports would have provided them with information to incorporate into their financial planning and reporting processes. However, several issuers noted that these reports are less important than those in the risk adjustment program, because issuers do not need additional data or modeling from CMS to generate their own reinsurance payments estimates. Risk Corridors: Most of the 12 issuers we interviewed cited uncertainty about the extent to which funds would be available. Ten issuers said that they did not support the agency’s decision to manage the risk corridors program in a budget neutral manner. One of these issuers described CMS’s decision to operate the program as budget neutral in 2014 and 2015 as a reversal of previous guidance, but noted that CMS has since been clear about operating in a budget neutral manner by limiting risk corridors payments for 2014 and 2015 to available collections.issuers described scenarios in which a budget neutral policy would not be sufficient to make needed payments; if an issuer priced premiums very low, that issuer may have significant losses and the remaining issuers may not have sufficient profit to cover those losses. Another 2 of these Two issuers indicated that the status of the program’s funding as budget neutral and the possibility that there will not be enough funds collected to pay for losses will have a material impact on their premium decisions for 2016. Tenure of Temporary Programs: Eleven of the 12 issuers we interviewed said that the 3-year timeline for the temporary reinsurance and risk corridors programs may not afford enough time for issuers to adjust to the market changes under PPACA. Some issuers said that this was particularly true given ongoing policy changes and delays that contributed to lower than expected enrollment and limited the availability of data on new enrollees. They said that without these data, they do not have sufficient information to confidently set premiums. For example, 6 issuers described lower than expected enrollment rates in their market due to CMS policy changes, such as delaying implementation of a requirement that certain employers provide health insurance to their employees, and allowing transitional plans. As a result of this lower than expected enrollment, issuers may have less information on the population that may eventually enroll under PPACA. When the programs expire, issuers will have less enrollee data than they originally expected with which to formulate their premiums. Two issuers who were new to the individual market in 2014 said that extending the temporary programs would provide more time for them to gather additional data. Otherwise, they will be at a disadvantage when the temporary programs expire in 2016 in contrast to more established issuers that already possess prior claims data. Due to concerns about the adequacy of the 3-year time period, 10 of the 12 issuers suggested extending the reinsurance program beyond its scheduled expiration. Nine of the 12 issuers suggested that the temporary reinsurance program be extended for 1 or 2 years and 5 of these issuers noted that they expect that premiums will rise significantly in 2017 in response to the expiration of the program at the end of 2016. Seven of the 12 issuers suggested extending the risk corridors program, with 5 of them specifying that the program be extended for either 1 or 2 years. Most of the 12 issuers we interviewed supported CMS’s choice of the distributed data collection approach for the risk adjustment and reinsurance programs, although they offered mixed responses about how they were affected by CMS’s decision to change how it implemented the EDGE servers and the resulting delays in implementation: Six of the issuers we interviewed said that the delays in implementing the EDGE servers were exceedingly disruptive or significant to them. They indicated that CMS’s policy changes resulted in wasted time and resources and required them to redevelop their plans for procuring and launching the servers. Although noting that the policy changes caused problems for them, five of these six issuers said that they supported CMS’s final decision to allow issuers to use either virtual or on-premise EDGE servers. The other six issuers—four of whom were new to the individual market in 2014, including two COOPs—said that EDGE server delays did not affect them. Three of these issuers told us that they had already purchased a physical server when CMS announced that all issuers had to use the Amazon Web Services option. However, they said that they were able to repurpose the physical servers and chose to use the Amazon option; therefore, CMS’s decision did not have a significant negative effect on their companies. In addition, 8 of the 12 issuers we interviewed expressed concerns about CMS’s ongoing implementation of data collection systems. For example, these issuers noted that they have continued to experience challenges uploading data using the EDGE servers and incorporating CMS’s ongoing corrections to its software code. For instance, 1 issuer described how CMS released software code for issuers to use the following morning to run risk adjustment calculations, but then rescinded the code the following afternoon because of an error. The issuer said that this example illustrates how CMS was releasing software before conducting the necessary quality assurance checks and was correcting problems as it went. This issuer also described how CMS released software that was missing 7,000 diagnostic codes. Five issuers raised concerns about another aspect of CMS’s implementation of data collection systems. Specifically, these issuers noted that the small window of time CMS allotted between when it informs issuers of estimated payments and contributions and when issuers’ final data submissions are due could be problematic if there is a need for significant reconciliations between CMS’s and issuers’ calculations. Finally, nearly all 12 issuers said that they experienced challenges obtaining technical assistance from CMS during implementation of the EDGE servers. However, with respect to CMS’s ongoing technical assistance and timeliness in responding to requests, they reported both positive and negative experiences: EDGE server implementation. Ten issuers reported challenges with CMS technical assistance during EDGE server implementation, including several issuers who reported an extended period of time when CMS did not provide any guidance to issuers. Issuers reported that during the period from the fall of 2013 through the spring of 2014, they received no guidance from CMS about the EDGE servers. One issuer noted that previously active user groups were disabled, and therefore they had to put their implementation plans on hold. It was during part of this period that individuals were first able to enroll in health plans available on the health care exchanges. Ongoing technical assistance. Issuers noted both positive and negative experiences in terms of their ongoing efforts to get technical assistance from CMS. For instance, four issuers told us that CMS assigned individual account managers to each issuer in December 2014 to help with technical assistance, and two of these issuers said that the account managers have helped them get more timely responses from CMS. Another issuer said it had mixed results with this manager, who sometimes provided useful information and other times provided information that was contradicted by another source. With regard to other forms of technical assistance, five issuers said they were participating in regular calls and webinars with CMS officials, and three of these issuers said they found these sessions to be useful. However, some of these issuers also said that it was very difficult to get their questions answered during these sessions due to the high volume of questions being submitted to the agency. Timeliness. Issuers provided mixed responses about CMS’s timeliness in responding to current requests for assistance. Two issuers told us that the timeliness had improved. However, two other issuers told us that there were still unresolved requests related to data submission issues, even though the relevant submission deadline had passed. We provided a draft copy of this report to HHS for its review and HHS provided written comments, which are reprinted in appendix I. HHS explained that CMS implemented the data collection strategy for these programs utilizing new innovative technology as well as existing data systems, and carried out the implementation in a phased approach. HHS indicated that issuer data submissions through the EDGE server began in September 2014 and CMS was on target to meet the regulatory deadline of April 30, 2015, to upload final submissions by issuers of claims and enrollment data for benefit year 2014. Further, HHS described CMS’s efforts to ensure the appropriate level of technical support, including the use of cross-functional teams that include software developers and dedicated account managers for each issuer. HHS noted that CMS solicited feedback directly from issuers and provided technical guidance and multiple trainings. In addition, HHS provided technical comments, which we incorporated where appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of the Centers for Medicare & Medicaid Services, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114, or dickenj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of our report. Key contributors to this report are listed in appendix II. In addition to the contact named above, William Hadley, Assistant Director; George Bogart; Keara Castaldo; Julianne Flowers; Mary Giffin; Sarah-Lynn McGrath; Laurie Pachter; Vikki Porter; and Leslie Powell made key contributions to this report.

Summary: PPACA resulted in significant changes to the private individual and small group health insurance markets in 2014 that expanded the availability and affordability of coverage. However, some of these provisions reduced issuers' ability to mitigate the risk of high-cost enrollees by limiting their ability to deny coverage or charge higher premiums based on individuals' health risks and other factors. Issuers also faced increased risk starting in 2014 because these provisions were expected to result in the enrollment of many previously uninsured individuals, who have unknown and potentially higher medical costs than the broader population. To limit these risks, PPACA required the establishment of three risk mitigation programs. GAO was asked to provide information on the design and development of these three programs and on issuer perspectives on them. In this report, GAO describes: (1) the factors that guided CMS's design of these programs, (2) the data collection systems CMS developed for these programs, (3) CMS's plans to monitor and evaluate the programs, and (4) issuer experiences with the programs. GAO reviewed regulations, guidance, and documentation about design and implementation activities and interviewed CMS officials. GAO also interviewed officials from a non-representative sample of 12 issuers that offered individual market coverage in 2014 and were selected based on variation in enrollment, location, and market experience. The Centers for Medicare & Medicaid Services (CMS) considered market characteristics and program duration in designing the three programs mandated by the Patient Protection and Affordable Care Act (PPACA) to mitigate the risks issuers of health insurance faced starting in 2014. Each of the three programs—risk adjustment, reinsurance, and risk corridors—was intended to account for a different source of issuer risk, such as enrollee health status or high-cost medical claims. CMS considered a range of market characteristics—including demographics and the availability of data—in making decisions about how to design each of the programs. CMS's design decisions also reflected the temporary status of the reinsurance and risk corridors programs, which are set to expire after 3 years. While CMS considered similar Medicare risk mitigation programs during the design process, key differences in the markets served by Medicare and the PPACA programs resulted in different approaches to their design. CMS considered privacy and security concerns in developing systems for collecting issuer data for the risk mitigation programs and experienced multiple implementation delays. For example, for the risk adjustment and reinsurance programs, CMS elected to use a system that allows sensitive enrollee claims data to remain with issuers while providing CMS with only summary data. However, CMS delayed implementation of data collection systems for these programs by nearly a year as it revised its plans to reduce administrative burden and accommodate issuer preferences. Therefore, CMS was unable to provide issuers with most of the periodic, interim reports it had originally planned to generate throughout 2014. CMS developed or had plans to develop data verification or audit procedures for all three programs. CMS had also initiated efforts to evaluate the permanent risk adjustment program but had not finalized the details of the evaluation. In November 2014, CMS issued a request for contractors to submit bids to conduct a range of services, including research and development tasks for the risk adjustment program such as: analyze the impact of market and enrollee factors on the model; evaluate the accuracy of the program; and conduct research to support adaptation of the model. As of April 2015, CMS officials expected to award the contract in the spring of 2015, although the agency had not finalized a date for completing that evaluation. CMS's continued effort to carry out this evaluation will be important to assessing the program's success. Most of the 12 issuers GAO interviewed said that the three risk mitigation programs encouraged their participation in the individual health insurance market, and two of the programs allowed them to lower their premiums. Issuers identified design concerns specific to each PPACA risk mitigation program and provided mixed responses regarding the effect of CMS's implementation delays and technical assistance. In commenting on a draft of this report, the Department of Health and Human Services described CMS's data collection strategy for these programs and its efforts to ensure the appropriate level of technical support for issuers.