The Health Insurance Portability and Accountability Act of 1996 ( P.L. 104-191 , HIPAA) provided for changes in the health insurance market and imposed certain federal requirements on health insurance plans offered by public and private employers. It guaranteed the availability and renewability of health insurance coverage for certain employees and individuals, and limited the use of preexisting condition restrictions. The Act established federal standards for insurers, health maintenance organizations (HMOs), and employer plans, including those who self-insure. However, it allowed states and sometimes insurers substantial state flexibility for compliance with the federal requirements. HIPAA also included tax provisions relating to health insurance. It permitted a limited number of small businesses and self-employed individuals to contribute to tax-advantaged medical savings accounts (MSAs) established in conjunction with high-deductible health insurance plans. It increased the deduction for health insurance that self-employed taxpayers may claim. In addition, it allowed long-term care expenses to be treated like deductible medical expenses and clarified the tax treatment of long-term care insurance. HIPAA amended the Employee Retirement Income Security Act (ERISA), the Public Health Service (PHS) Act, and the Internal Revenue Code (IRC). In general, requirements on employer plans are found in the ERISA and IRC amendments; requirements on health insurance issuers, such as insurance carriers and health maintenance organizations (HMOs) are found in the PHS Act and ERISA amendments. The increased deduction for the self-employed, tax-favored MSAs, and long-term care provisions are amendments to the IRC. The basic intent of HIPAA's health insurance provisions is to lower the possibility that people and small employers will lose existing health plan coverage, and to make it easier for individuals to switch plans or to purchase coverage on their own if they lose employer-offered coverage. The health insurance reforms ensure that people who are moving from one job to another or from employment to unemployment are not denied health insurance because they have a preexisting medical condition (portability) and limit the waiting time before a plan covers any preexisting medical condition for participants and beneficiaries in group health plans. The reforms were also intended to guarantee that individuals and employers who choose to purchase coverage are able to find a plan (guaranteed issue) and that individuals already covered, as well as employers that offer coverage to their employees, are able to renew their coverage (guaranteed renewal). Finally, the health insurance provisions prohibit discrimination on the basis of health status (non-discrimination) and require plans to offer special enrollment periods. Other HIPAA provisions seek to make health insurance more affordable. The Act raised the tax deduction for health insurance premiums paid by the self-employed. MSAs coupled with qualified high deductible health insurance plans were made available on a trial basis to a limited number of individuals. New tax incentives were made available to encourage individuals and employers to purchase long-term care insurance. Finally, the Act included administrative simplification and privacy provisions instructing the Secretary of HHS to issue standards addressing the electronic transmission of health information and the privacy of personally identifiable medical information. Additional federal protections have been added since the passage of HIPAA. The protections required plans that cover newborn delivery to allow for a minimum two-day hospital stay under certain conditions, required plans that offer mental health services to offer them subject to similar limitations as other health benefits, and required plans that cover mastectomy to also cover reconstructive surgery. In addition, the deduction allowed for premium costs for the self-employed was changed. HIPAA's insurance provisions were designed to help insured Americans who have a preexisting medical condition and have stayed in a job because they fear that they would lose coverage for such a condition if they change to a new employer or move to an individual policy. It also would help those who have been denied the option to purchase insurance as an individual or through their employer because of their health status. They do not address the larger problem of the uninsured, estimated to be 45 million people in 2003, although other HIPAA provisions, such as the tax deductibility of health insurance costs for the self-employed, may encourage some uninsured, self-employed individuals to purchase coverage for themselves. It is also the case that HIPAA largely addresses the availability of insurance and does not regulate the price of health insurance coverage. Some evidence suggests that the cost of health insurance in the individual market for individuals taking advantage of HIPAA's group-to-individual portability provisions is significantly higher than the cost for individuals who could otherwise obtain insurance. This may be discouraging many "HIPAA eligibles" from buying insurance. Whether this experience continues over the long run remains to be seen. No, the Act does not require employers to offer or pay for health insurance for their employees. Also, the Act does not require employers to offer or pay for family coverage (spouses and dependents). Finally, the Act does not require employers to cover part time, seasonal, or temporary employees. However, an employer who elects to sponsor a group health plan has to comply with certain requirements of the Act. These requirements: (a) restrict the use of preexisting condition limitation periods; (b) prohibit an employer plan from discriminating on the basis of health status in determining the eligibility of an employee to enroll in a group health plan (and the employee's spouse and dependents if the plan provides family coverage); (c) prohibit an employer plan from requiring an individual to pay premiums or contributions which are greater than those charged to a similarly situated individual on the basis of health status; and (d) mandate documentation of creditable coverage. HIPAA's "portability" protection means that once a person obtains creditable health plan coverage, he or she can use evidence of that coverage to reduce or eliminate any preexisting medical condition exclusion period that might otherwise be imposed when moving to another health plan. The protections apply when a person moves from one group health plan to another, from a group health plan to an individual policy, or from an individual policy to a group health plan. The concept of portability is really one of being able to maintain coverage and being given credit for having been insured when changing health plans. It does not mean that an individual can take a specific health insurance policy from one job to another. The concept of creditable coverage is that individuals are given credit for previous insurance when applying for a new plan. Under the Act, creditable coverage is coverage under any of the following: (a) a group health plan; (b) health insurance coverage , including individual health insurance coverage; (c) Medicare; (d) Medicaid; (e) military health care; (f) a medical care program of the Indian Health Service or of a tribal organization; (g) a state health benefits risk pool; (h) the Federal Employee Health Benefits Program; (i) a public health plan (as defined in regulations); (j) a health benefit plan under Section 5(e) of the Peace Corps Act (22 U.S.C. 2504(e)); or (k) the State Children's Health Insurance Program (SCHIP). Under the Act, a preexisting medical condition is a physical or mental condition for which medical advice, diagnosis, care, or treatment was recommended or received within the 6-month period ending on the enrollment date. The enrollment date is the date of enrollment of the individual in the health plan or insurance, if earlier, the first day of the waiting period for such enrollment. Pregnancy is not considered a preexisting medical condition. Also, a preexisting medical condition limit or exclusion may not be imposed on covered benefits for newborns who are covered under creditable coverage within 30 days of birth. Finally, a preexisting medical condition limit or exclusion may not be imposed on covered benefits for newly adopted children or children newly placed for adoption, if the child becomes covered under creditable coverage within 30 days of the adoption or placement. Final regulations implementing the health coverage portability provisions of HIPAA addressed other types of benefit exclusions that are not designated as preexisting condition exclusions by the plan, but are considered to be so by the regulators. Examples of these specific benefit exclusions include provisions excluding coverage of pregnancy until 12 months after the individual is eligible for benefits, or provisions excluding treatment of injuries relating to accidents that occurred prior to enrollment. Plans are required to bring those exclusions into compliance with HIPAA portability provisions by July 1, 2005. The Act also prohibits the use of genetic information as a preexisting condition, unless there is a diagnosis of a preexisting medical condition related to the information. For example, evidence of a positive test for the gene that predisposes a woman to inheritable breast cancer cannot be treated as a preexisting condition, unless a diagnosis of breast cancer is made within the 6-month period described above. During this period, a plan may exclude or restrict coverage of a participant's or beneficiary's preexisting medical condition. Under the Act, a group health plan is prohibited from imposing more than a 12-month preexisting condition limitation period (18 months for late enrollees) on an HIPAA-eligible participant or beneficiary. As described below, that period is reduced by the amount of the individual's creditable coverage. In the individual market, HIPAA-eligible individuals also have portability protection, although the circumstances under which those protections apply are complex as described in more detail below. HIPAA requires group health plans (plans that are offered to an employment-based group—including both employers and employee organizations) that are covered by the Act to meet the following requirements related to portability: When a person with prior creditable coverage first enrolls in a group health plan, the plan cannot impose a limitation period on a preexisting condition that is longer than 12 months (18 months for late enrollees as defined below). The length of the allowed preexisting condition limitation period is based on any creditable coverage that an individual may have. The plan cannot apply any preexisting condition waiting period on pregnancy, a covered newborn, or on any covered child under 18 who is adopted (even if the adoption is not finalized). However, the employer may still require individuals to work for a period of time before they are allowed to participate in the health plan. This is called a "waiting period" and should not be confused with a "preexisting condition limitation period." Employers who sponsor group health plans are required to provide enrollees with a certificate that states the amount of creditable coverage accumulated and whether or not the enrollee was subject to a waiting period under the employer's plan. Individuals can use this certificate to demonstrate prior creditable coverage when moving to a new group or individual health insurance plan. The Act does not require an employer to continue offering coverage to enrollees who have left their jobs, except under COBRA continuation provisions as described below. To benefit from the Act, individuals should maintain coverage under a health insurance plan without experiencing significant lapses in coverage. Since the portability protection only applies to people with "continuous coverage", which the statute defines as coverage with no lapses of 63 or more days, individuals should not allow their insurance coverage to lapse for 63 or more days. Coverage of a preexisting medical condition may be limited or excluded for up to 12 months for those who enroll in a health plan when first eligible to enroll. In the case of late enrollment, the maximum permitted limitation is 18 months. For those moving from one group plan to another group plan, or from individual to group coverage, the new plan must reduce any preexisting condition limitation period by one month for every month that such individuals had creditable coverage under a previous plan, provided that they enroll when first eligible and had no break in previous coverage of 63 or more continuous days. For example, individuals with 6 months of prior creditable coverage could face a maximum preexisting condition limitation period of 6 months. Individuals with 11 months of prior creditable coverage could face a maximum limitation period of 1 month. Once a 12-month limitation period is met, no new limitation may ever be imposed as long as continuous coverage is maintained (that is, there is no break in coverage lasting longer than 62 days), even if there is a change in jobs or health plans. If there is a period of 63 consecutive days during which individuals have no creditable coverage, they may be subject to as much as a 12-month preexisting condition exclusion period (or an 18 month exclusion for late enrollees). Individuals establish eligibility for a waiver of preexisting condition limitations by presenting certifications that document prior creditable coverage. Health plans and health insurance issuers must supply written certifications of: the period of creditable coverage under the plan; coverage (if any) under COBRA continuation provisions; and any waiting or affiliation periods imposed. The certification must be provided: (1) when a participant is no longer covered under the plan or otherwise becomes covered under a COBRA continuation provision; (2) after termination of COBRA coverage, if applicable; and (3) upon a request which is made not later then 24 months after coverage ends. The interim rules issued by the three agencies administering the Act provide guidance and model certification forms to streamline this process. In general, the certification must be provided in writing. Late enrollment occurs when an individual enrolls in a group health plan other than during: (a) the first period in which the individual is eligible to enroll under the plan, or (b) a special enrollment period. As described above, a group health plan may require a late enrollee to wait 18 months before a preexisting condition is covered. A waiting period is a set amount of time an employee must wait before he or she is eligible to enroll in a health plan. For example, an employer may require an employee to work for 6 months before health insurance benefits become available. The Act does not limit this type of waiting period—employers and health insurance issuers are free to determine the length of a waiting period. However, the Act requires that any waiting period be applied uniformly without regard to the health status of potential plan participants or beneficiaries. Also, days in a waiting period are not taken into account when determining whether an individual has experienced a break in coverage of 63 or more days. This differs from a preexisting condition exclusion limitation period which allows plans to exclude coverage for certain preexisting health conditions for up to 12 months (or 18 months), as described above. Any waiting period required before an employee or his or family member can become a plan participant or beneficiary must run concurrently with any preexisting condition limitation period. For example, if an employer required an employee without any creditable coverage to work for 5 months before he or she could enroll in the firm's health plan, then the preexisting condition limitation period imposed on the coverage of that individual could not exceed 7 months from the date of actual enrollment in the plan. If that individual had 7 or more months of creditable coverage, then no preexisting condition limitation period could be imposed on the coverage under the new plan. Yes, when an individual changes plans, the new benefit package may cover some benefits that were not covered under his or her most recent prior plan, and the law allows the new plan or issuer some discretion in applying prior creditable coverage to those new benefits. Plans and issuers may choose between two alternatives when determining creditable coverage: 1) they can chose to include all periods of coverage from qualified sources and thus not look at any specific benefits; or 2) they can examine prior coverage on a benefit-specific basis, and are allowed to exclude from creditable coverage any categories or classes of benefits not covered under the most recent prior plan. The April 8, 1997 interim rule defines the categories of benefits that may be considered separately to be: (a) mental health; (b) substance abuse treatment; (c) prescription drugs; (d) dental care; or (e) vision care. Thus, for example, if a prior plan did not cover prescription drugs, and the new plan includes this benefit, the new plan may exclude coverage of prescription drugs for up to 12 months under this second method. If the second method is chosen, plans or issuers must disclose its use at the time of enrollment or sale of the plan, and apply it uniformly. Under a group health plan, an employer is not required to offer coverage to an individual's spouse or children. If the employer does offer family coverage, the same protections apply to a spouse and dependents. Coverage may not be denied because a family member is sick, and preexisting condition restrictions are limited as described above. HIPAA guarantees the availability of a plan and prohibits pre-existing condition exclusions for certain eligible individuals who are moving from group health insurance to insurance in the individual market. States have the choice of either enforcing the HIPAA individual market guarantees, referred to as the "federal fallback", or they may establish an "acceptable alternative state mechanism". In states using the federal fallback approach, HIPAA requires all health insurance issuers operating in the individual health insurance market to offer coverage to all eligible individuals and prohibits them from placing any limitations on the coverage of any preexisting medical condition. Issuers can comply with the Act's requirements in three ways: they must offer eligible individuals access to coverage to every individual insurance policy they sell in the state; or they must offer eligible individuals access to coverage to their two most popular insurance policies (based on premium volume); or they must offer eligible individuals access to a lower-level and higher-level coverage. These two policies must include benefits that are substantially similar to other coverage offered by the issuer in the state, and must include risk adjustment, risk spreading, or financial subsidization. Issuers can refuse to cover individuals seeking portability from the group market if financial or provider capacity would be impaired. This means, for example, that if a network-based plan like an HMO can demonstrate that it is filled to capacity, then it would not have to accept eligible individuals. It would have to apply this exception uniformly, without regard to the health status of applicants. An eligible individual must have: creditable health insurance coverage for 18 months or longer; most recent coverage under a traditional employer group plan, governmental plan, or church plan; exhausted any COBRA (or other continuation) coverage; no eligibility for coverage under any employment-based plan, Medicare or Medicaid; and no breaks in coverage of 63 or more days. Individuals purchasing insurance on their own who do not meet these eligibility criteria, are not protected by HIPAA's portability and guaranteed availability provisions. These individuals may be protected under state laws. The group-to-individual portability and guaranteed availability protections apply only to individuals whose most recent coverage was provided through traditional employer-based group arrangements, governmental plans or church-sponsored plans. Group plans are defined as those meeting the ERISA definition, which is limited to those sponsored through a traditional employer-employee relationship or an employment-based association. Governmental plans are also defined in ERISA. They are plans that are established or maintained for its employees by the Government of the United States, the government of a state or a political subdivision of a state. This limitation means that people whose most recent coverage was sponsored by the military (CHAMPUS and TRICARE), many college-sponsored student plans, the Peace Corps, the Veterans Administration, the Indian Health Service, Medicare, Medicaid and SCHIP are not eligible for the federal group-to-individual portability and guaranteed availability protections. (State laws, however, may offer these individuals such protections.) An acceptable alternative state mechanism for coverage of eligible individuals must: provide a choice of health insurance coverage to all eligible individuals; not impose any preexisting condition restrictions; and include at least one policy form of coverage that is comparable to either comprehensive health insurance coverage offered in the individual market in the state, or a standard option of coverage available under the group or individual health insurance laws in the state. In addition to these requirements, a state may implement one of the following mechanisms: certain National Association of Insurance Commissioners (NAIC) Model Acts ; a qualified high-risk pool that meets certain specified requirements; or other risk spreading or risk adjustment approach, or financial subsidies for participating insurers or eligible individuals; or any other mechanism under which eligible individuals are provided a choice of all individual health insurance coverage otherwise available. Examples of potential alternative state mechanisms include health insurance coverage pools or programs, mandatory group conversion policies, guaranteed issue of one or more plans of individual health insurance coverage, open enrollment by one or more health insurance issuers, or a combination of such mechanisms. Table 1 provides information on how each state has implemented the Act's group-to-individual portability provisions. As of December 2003, the District of Columbia and 10 states (Arizona, Delaware, Hawaii, Maryland, Missouri, Nevada, North Carolina, Rhode Island, Tennessee, and West Virginia) utilize the federal fallback mechanism. Missouri is also the only state that does not enforce these standards itself, and as a result CMS is responsible for enforcement in Missouri. As shown in Table 1 , many states have elected to provide group-to-individual portability through high-risk pools, while others utilize a combination of high-risk pools, existing state insurance reform laws, or other mechanisms. To obtain more information on a state's health insurance regulation of the individual market, individuals may wish to contact that state's department of insurance. As an adjunct to its portability requirement, the Act provides for two different special enrollment periods to ensure that people losing group health insurance coverage can more easily obtain other group coverage when it is available. The two special enrollment periods are: (1) Individual Losing Other Coverage . A group health plan or an issuer offering coverage in connection with a group health plan must allow an employee who is eligible, but not enrolled, to become covered under the plan if the following conditions are met: The employee or dependent was covered under a group health plan or had health insurance coverage at the time coverage was previously offered to the employee or dependent. For example, the employee may have been covered by a spouse's employer and declined coverage under his own employer's plan. The employee stated in writing at the time of declining enrollment that the reason for declining was that he or she was covered under another health insurance plan. This condition applies only if the plan sponsor or issuer requires such a written statement. The employee's or dependent's previous coverage was under a COBRA continuation provision that had become exhausted or was under some other coverage that had been terminated as a result of a loss of eligibility for the coverage (for reasons such as: legal separation, divorce, death, termination of employment, or reduction in the number of hours of employment), or because the employer contribution towards such coverage was terminated. To take advantage of a special enrollment period, the employee would have to request enrollment no later than 30 days after the date in which his or her prior coverage was exhausted or terminated. (2) Dependent Beneficiaries. This special enrollment period applies to individuals who become dependents through marriage, birth, adoption, or placement of adoption. Generally, this provision applies if a group health plan makes dependent coverage available, and the new dependent's spouse or parent is either a participant or eligible (including meeting any waiting periods) to be a participant under the plan. The newly dependent individual must be allowed to enroll as a beneficiary under the plan; however, enrollment must be sought within 30 days of the qualifying event (e.g., the marriage). Employees or spouses who are eligible, but not previously enrolled in the plan, may also enroll during this special enrollment. Coverage is effective on the date of the birth, adoption, or placement for adoption. In the case of marriage, coverage is effective no later than the first day of the month beginning after the date the request for enrollment is received. No, the Act prohibits a group health plan and an issuer offering group health coverage from establishing rules for eligibility for any individual to enroll under the plan based on health status-related factors. These factors include health status, medical condition (including both physical and mental illnesses), claims experience, receipt of health care, medical history, genetic information, evidence of insurability (including conditions arising out of domestic violence) and disability. Group health plans are also prohibited from failing to re-enroll a participant or beneficiary on the basis of health status-related factors. HIPAA also prohibits plans from charging differential premiums for enrollees within a group plan based on these health status-related factors. No, the Act prohibits employer plans and issuers of group health coverage from establishing rules of eligibility to enroll under the terms of the plan that discriminate based on one or more health-status related factors. No, these individuals cannot be denied enrollment in a group health plan, based on HIPAA's non-discrimination provision. Group plans or issuers offering group health coverage cannot use information about an individual's health status to either deny coverage or charge differential premiums. On January 8, 2001, the Department of Labor issued a preliminary final ruling with comment period, defining the nondiscrimination provisions of HIPAA. In this ruling, "health status" is defined very broadly to include "evidence of insurability" which in turn includes a provision that prohibits excluding coverage for individuals who participate in high-risk activities. Thus, this broad interpretation extends the nondiscrimination protections to individuals who engage in high-risk recreational activities. HIPAA's protection extend to enrollment policies and premiums. The protection does not address the benefits that are covered by these plans. Therefore, there is no federal requirement to cover treatments for injuries associated with high-risk activities, even if these treatments are otherwise covered under the plan. For example, a plan may exclude coverage for a broken leg if it occurs as a result of a high-risk activity. Under a group health plan, an employer is not required to offer coverage to an individual's spouse or children. If the employer does offer family coverage, the same non-discrimination protections apply to a spouse and any other dependents as defined under the terms of the plan. Coverage may not be denied because a family member is sick, and preexisting condition restrictions are limited as described above. No, the Act does not restrict premium amounts that an employer or insurer can charge. It also expressly permits an employer or group health insurer to offer premium discounts or rebates, or modify otherwise applicable copayments or deductibles, for participation in health promotion and disease prevention programs. However, the Act does prohibit a health plan from charging an individual a higher premium than the premium charged for another similarly situated individual enrolled in the plan on the basis of any health-related factor, such as a preexisting medical condition. The Act requires insurers, HMOs, and other issuers of health insurance selling in the small group market to accept any small employer that applies for coverage, regardless of the health status or claims history of the employer's group. This requirement is often referred to as "guaranteed issue." The Act defines a small employer as one with two to 50 employees. (If, on the first day of the plan year, the plan has fewer than two participants who are current employees, it is not considered a small group and would not be covered by this "guaranteed issue" requirement.) Under guaranteed issue, the issuer must accept for enrollment under the policy, not just the employer's group, as a whole, but also every eligible individual in the employers' group who is eligible for and applies for timely enrollment. Exceptions to guaranteed issue are provided in the Act for network plans that might otherwise exceed capacity limits or in the event that the employer's employees do not live, work, or reside in the network plan's area. Employer groups with more than 50 employees are not protected by this requirement unless otherwise required under state law. In the past, health insurance issuers usually did not examine the health status or medical history of larger employer groups when deciding whether to accept such groups for coverage. The Act requires the Secretary of Health and Human Services (HHS) and the General Accounting Office (renamed the Government Accountability Office in July 2004) to report every three years, beginning in December 2002, on access to health insurance in the large group market. No, the Act requires all health insurance issuers to continue coverage for any group, regardless of health status or use of services, if the group requests renewal. This requirement is known as guaranteed renewability. An issuer may drop coverage in cases of non-payment of premiums, fraud, or similar reasons not related to health status, such as violation of participation or contribution rules. But, there are no limits on amounts insurers may charge. As originally passed, HIPAA did not require an employer or issuer of group health insurance to offer specific benefits. Twice since its passage Congress added to HIPAA's protections by mandating specific benefits, but in each case only for plans that cover certain services. As part of the FY1997 appropriations bill for the Departments of Veterans Affairs and Housing and Urban Development (VA-HUD), Congress included provisions that (1) require plans that cover mental health services to provide limited mental health "parity", and (2) prohibit plans that cover newborn delivery from limiting hospital stays for newborn delivery to less than two days. The FY1999 Omnibus Appropriations Act incorporated the Women's Health and Cancer Rights Act, which requires plans that cover mastectomy as a treatment for breast cancer to also cover reconstructive surgery. Private health insurers often provide less coverage for the treatment of mental illnesses than they do for the treatment of other illnesses. For example, health plans may limit treatment of mental illnesses by covering fewer hospital days and outpatient office visits, and increase cost sharing for mental health care by raising deductibles and copayments. Twenty-two states have passed full-parity laws that require health plans to impose the same treatment limitations and financial requirements on their mental health coverage as they do on their medical and surgical coverage. Several other states have enacted legislation that requires health plans to provide certain specified mental health benefits (but not full parity). However, these state laws have a limited impact because they do not cover self-insured plans. ERISA exempts self-insured plans from state regulation. Nationwide, about 52% of covered workers are in a self-insured plan, according to the 2003 KFF/HRET survey of employer health benefits. In 1996, Congress passed the Mental Health Parity Act (MHPA), which amended ERISA and the Public Health Service Act to establish new federal standards for mental health coverage offered by employer-sponsored plans. Identical provisions were later added to the Internal Revenue Code. The MHPA is limited in scope and does not compel insurers to provide full-parity coverage. For group plans that choose to offer mental health benefits, the MHPA requires parity only for annual and lifetime dollar limits on coverage. Plans may still impose more restrictive treatment limitations and cost sharing requirements on their mental health coverage. The MHPA includes several other limitations. Employers with 50 or fewer employees are exempt from the law. In addition, employers that experience an increase in claims costs of at least 1% as a result of MHPA compliance can apply for an exemption. The MHPA currently is authorized through December 31, 2005. The 107 th Congress tried unsuccessfully to enact legislation ( S. 543 ) that would have amended and expanded the MHPA by requiring plans that choose to offer mental health benefits to provide full-parity coverage. Full-parity legislation is strongly supported by advocates of the mentally ill and enjoys broad bipartisan support among lawmakers. Employers and health insurance organizations oppose such legislation because of concerns that it will drive up health care costs. For more information, see CRS Report RL31657, Mental Health Parity: Federal and State Action and Economic Impact , by [author name scrubbed] and [author name scrubbed]. The Newborns' and Mothers' Health Protection Act was also passed as part of P.L. 104-204 . This Act prohibits group health plans and issuers offering group coverage from restricting the hospital length of stay for childbirth for either the mother or newborn child to less than 48 hours for normal deliveries and to less than 96 hours for caesarian deliveries. Enacted in 1998, Title IX of the FY1999 Omnibus Appropriations Act requires group plans and health insurance issuers that provide coverage for mastectomies also to cover prosthetic devices and reconstructive surgery. The provision included a requirement that beneficiaries be notified of available coverage for prostheses and treatment of physical complications of reconstructive procedures. Federal law does not prohibit employers from excluding treatment of specific illnesses or conditions from their health benefit plans. On the other hand, a number of factors limit certain employers' ability to exclude specific illnesses from coverage. Most states have enacted legislation requiring that specific benefits or coverage be included in insured products. Some employers, particularly small ones, purchasing insurance products have little or no discretion in choosing or excluding specific types of services or procedures. This is because many insurance companies and HMOs have a set menu of products that do not vary considerably from one employer group to another. For self-funded plans, however, ERISA prevents state laws from applying and benefits are crafted by each individual employer plan. Thus only the few federal requirements enacted in HIPAA and its amendments (described above) place specific coverage requirements on these self-funded plans. No, such specific benefit plans do not have to comply with the requirements of the Act if they meet certain conditions spelled out in the Act. To be exempt, for example, the dental-only policy would have to be provided under a separate policy, certificate, or contract of insurance or not otherwise be an integral part of the plan. Yes, association plans must comply with the various requirements of the Act relating to group health coverage. For example, the sponsor of an association plan cannot drop a group from coverage because of the use of medical services by the group's members. Moreover, the association plan must comply with the restrictions on the use of preexisting medical condition limitation periods, provide for creditable coverage, and renew coverage except in limited cases. However, nothing under the Act requires that an association plan accept for coverage individuals who are not members of the association. Yes, states may impose their own requirements. But HIPAA ensures that state laws do not prevent the application of its consumer protections. For example, state laws regulating rating continue to apply because the Act generally does not address rating practices. On the other hand, the Act's provisions relating to portability, such as restrictions on the use of preexisting medical condition limitation periods override state laws. Exceptions include specific types of state laws that provide for greater portability , such as state laws that: define a preexisting medical condition to be one that existed for less than 6 months prior to becoming covered (instead of the 6 months required under the Act); provide for preexisting medical condition limitation periods shorter than 12 (and 18) months in the Act; and allow for breaks in continuous coverage longer than the 62-day period specified under the Act. Thus, for example, a state may prohibit issuers selling to group health plans from imposing more than a 6-month preexisting medical condition limitation period on enrollees, instead of the 12-month limit in the Act. However, state laws that allowed such limitation periods in excess of 12 months would be overridden by the requirement of the Act. While there are no specific references in HIPAA or the subsequent benefits mandates that apply the requirements specifically to FEHBP, the plans provided by the FEHBP program are presumed to fall under the HIPAA definition of "group health plan." As a result, the federal Office of Personnel Management, which administers the FEHBP program, complies with the HIPAA requirements. No, the Act does not place any restrictions on the premium amount that issuers can charge. However, some states limit insurance premiums in the individual market and more may decide to do so in the future. Such limits would then apply because the Act does not preempt or override either current or future state laws regulating the cost of insurance. The Secretaries of HHS, Labor, and Treasury are required to jointly enforce the provisions of the Act. The Secretary of Labor enforces the requirements on employer plans under Title I of ERISA. The Secretary of Labor is also generally given authority to promulgate regulations necessary to carry out the provisions of the Act relating to group health plans and health insurance issuers in connection with any group health plan. The Secretary of Treasury enforces requirements on all group health plans under the Internal Revenue Code. Requirements on health insurance issuers (such as insurance carriers and HMOs) are enforced by the Secretary of HHS to the extent that such requirements are not enforced by the states. The Secretaries are required to coordinate their activities to avoid duplication of effort. States have the primary responsibility for enforcing HIPAA's access, portability and renewability standards applying to insurers in both the group and individual markets. If they do not pass laws that substantially enforce these standards, however, DHHS must do the enforcing itself. As of 2001, only Missouri had not enacted enabling legislation. Noncomplying group health plans covered under ERISA may be subject to civil money penalties, and both plans and issuers can be sued by participants and beneficiaries to recover any benefits due under the plan. The Secretary of Labor has the investigative authority to determine compliance with the law's requirements. For group health plans, generally the IRS can fine a noncomplying employer $100 per day per violation. Requirements on issuers will be enforced by the states. For Missouri, the Secretary of HHS enforces the provisions. The Secretary may impose a fine of $100 for each day the entity (the issuer or a nonfederal governmental plan) is out of compliance. The Act gives the Secretary of HHS the authority to promulgate regulations needed to carry out the provisions of the Act relating to requirements on issuers of coverage. The following table lists the regulations regarding HIPAA's insurance provisions. For regulations on HIPAA's administrative simplification and privacy provisions see CRS Report RL30620, Health information standards, privacy and security: HIPAA ' s administrative simplification regulations , by Stephen Redhead. A person's COBRA continuation coverage is considered creditable coverage in the case of an individual who moves from one group policy to another group policy or from a group policy to an individual policy. This allows an individual to move from COBRA to a new health plan without having to wait for coverage of any preexisting medical condition under the new plan, providing the individual does not have a lapse in coverage of 63 or more days. With respect to HIPAA's individual market protections, the situation is somewhat more complex. One of the requirements for eligibility for guaranteed availability and portability in the individual market is that an individual must first have elected and exhausted any available COBRA or other continuation coverage. Eligible individuals who do not have access to COBRA or other continuation coverage may move directly to the individual market. Additionally, in the individual market, it is important to note that the insurer accepting the eligible individual for coverage can charge whatever rate is allowed under state law. (The Act does not limit the premiums that insurers can charge.) Yes, the Act makes several changes to the laws providing for COBRA continuation of coverage. It provides: a clarification that a disabled qualified beneficiary and all other qualified family members of the beneficiary are also eligible for the additional 11 months of COBRA; that the qualifying event of disability applies in the case of a qualified beneficiary who is determined under the Social Security Act to be disabled during the first 60 days of COBRA coverage; that a qualified beneficiary for COBRA coverage includes a child who is born to, or placed for adoption with, the covered employee during the period of COBRA coverage; and that COBRA can be terminated if a qualified beneficiary becomes covered under a group health plan which does not contain any exclusion or limitation affecting a participant or his or her beneficiaries because of the requirements of the Act. It should also be noted that under the Medical Savings Account (MSA) provisions of the Act (see below), individuals may withdraw funds from their MSAs without penalty to pay their COBRA premiums. In addition to the insurance provisions discussed above, HIPAA includes other provisions affecting health care. This section briefly summarizes these provisions and refers readers to other CRS reports where available. In addition to provisions relating to private health insurance, HIPAA directed the Secretary of HHS to issue standards to support and promote the electronic transmission of health care information between payers and providers. The standards specify the content and format of electronic health care claims and other common administrative and financial health care transactions (e.g., health plan enrollment, referrals). They are intended to streamline administrative operations within the health care system, which currently stores and transmits health information in numerous paper and electronic formats. In 2001 Congress enacted the Administrative Simplification Compliance Act ( P.L. 107-105 ), which enabled payers and providers to seek a one-year extension on the October 16, 2002 deadline for compliance with the electronic transactions and codes standards. HIPAA's administrative simplification provisions also instructed the Secretary of HHS to develop security standards and safeguards, which health plans and providers must incorporate into their operations to protect health information from unauthorized access, use, and disclosure. Health care providers and most health plans must be in compliance with the security standards by April 21, 2005. In addition, HIPAA directed the Secretary to develop standards for unique health identifiers (i.e., ID numbers) for patients, employers, health plans, and providers. CMS has issued standards for both the employer and provider identifiers, but the health plan identifier remains under development. In each fiscal year since FY1999, Congress has prevented CMS from developing a standard for the unique patient identifier by inserting language in the agency's annual appropriations bill. The language prohibits the use of funds for developing a unique patient identifier standard unless legislation is enacted specifically approving such a standard. The growing use of information technology in the management, administration, and delivery of health care has led to increasing public concern over the privacy of medical information. Patients are worried about who has access to their medical records without their express authorization. They fear that their personal health information will be used against them to deny insurance, employment, and housing, or to expose them to unwanted judgment and scrutiny. Lawmakers addressed these concerns by including in HIPAA's administrative simplification provisions a timetable for developing standards to protect the privacy of health information. HIPAA gave Congress until August 21, 1999, to enact comprehensive health privacy legislation, otherwise the Secretary was instructed to develop privacy standards. Congress was unable to meet its own deadline and so the Secretary proceeded to develop a health information privacy rule. The final rule was issued on December 28, 2000, and modifications to the rule were published on August 14, 2002. For more information on the privacy rule, see CRS Report RS20500, Medical Records Privacy: Questions and Answers on the HIPAA Rule , by [author name scrubbed] . Information on the status and implementation of all the HIPAA administrative simplification standards is at http://aspe.os.dhhs.gov/admnsimp . HIPAA authorized tax-advantaged medical savings accounts (MSAs) under a demonstration that began in 1997. MSAs (now formally called Archer MSAs) are personal savings accounts for unreimbursed medical expenses. They can be used to pay for health care not covered by insurance, including deductibles and copayments. The legislation provided that MSAs may be established by taxpayers who have qualifying high deductible insurance (and none other, with some exceptions) and who either are self-employed or are employees covered by the high deductible plan established by their small employer. Employer contributions to MSAs are not subject to either income or employment taxes, while contributions made by individuals—allowed only if the employer does not contribute—are allowed as an above-the-line deduction (not limited to itemizers). MSAs are held in trust by insurance companies, banks, and other financial institutions, and whatever earnings they have are exempt from taxes. Withdrawals are not taxed if they are for medical expenses unreimbursed by insurance or otherwise, while other distributions, being non-qualified, are included in gross income and subject with some exceptions to an additional 15% penalty. HIPAA set a deadline(originally December 31, 2000) for establishing new accounts and limited the total to various ceilings, eventually 750,000 accounts. In October, 2002, the IRS estimated that there would be 78,913 MSA returns filed for tax year 2001; it also determined that 20,592 taxpayers who did not make contributions in 2001 established accounts in the first six months of 2002. These numbers were far less than the 750,000 statutory ceiling. Later amendments extended the deadline for new accounts to December 31, 2003. Although no new MSAs may be created, with some exceptions, current owners can maintain their accounts and, provided they have a qualifying high-deductible insurance, can continue to make contributions. However, most MSA owners can now have HSAs, and their MSA balances can be rolled over into the new accounts. For more information about MSAs and HSAs, see CRS Report RS21573, Tax-Advantaged Accounts for Health Care Expenses: Side-by-Side Comparison , by [author name scrubbed] and [author name scrubbed], and CRS Report RL32467, Health Savings Accounts , by [author name scrubbed], [author name scrubbed], and Neela K. Ranade. For current legislative activity on tax-advantaged accounts, see CRS Issue Brief IB98037, Tax Benefits for Health Insurance and Expenses: Current Legislation , also by [author name scrubbed]. HIPAA increased the portion of premiums that self-employed taxpayers may deduct from income for the purposes of determining federal taxes owed. Under prior law, the deduction was 30% of health insurance costs; HIPAA increased it to 40% in 1997; 45% in 1998 through 2002; 50% in 2003; 60% in 2004; 70% in 2005; and 80% in 2006 and thereafter. Subsequent legislation ( P.L. 105-34 and P.L. 105-277 ) accelerated and increased the percentages set by HIPAA. Beginning in 2003, 100% of health insurance costs can be deducted. As discussed below, HIPAA also allowed self-employed taxpayers to take account of long-term care insurance premiums in making this deduction. HIPAA provided that payments for personal injury or sickness through an arrangement having the effect of accident or health insurance are excluded from gross income (that is, they are exempt from taxation), provided the arrangement has adequate risk shifting and is not merely a reimbursement arrangement. Thus with respect to taxes, payments from self-insured plans covering self-employed individuals are treated like payments from commercial insurance. HIPAA established new rules regarding the tax treatment of long-term care insurance and expenses, effective January 1, 1997. Qualified long-term care insurance is treated as accident and health insurance, and benefits are treated as amounts received for personal injuries and sickness and reimbursement for medical expenses actually incurred. As a consequence, benefits are excluded from gross income (that is, exempt from taxation). The exclusion for benefits paid on a per diem or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or (2) the cost of long-term care services. Employer contributions to the cost of qualified long-term care insurance premiums are excluded from the gross income of the employee. The exclusion does not apply to insurance provided through employer-sponsored cafeteria plans or flexible spending accounts. Unreimbursed long-term care expenses are allowed as itemized deductions to the extent they and other unreimbursed medical expenses exceed 7.5% of adjusted gross income. Long-term care insurance premiums can be counted as these expenses subject to age-adjusted limits. In 2005, these limits range from $270 for persons age 40 or less to $3,400 for persons over age 70. Self-employed individuals are allowed to include long-term care insurance premiums in determining their above-the-line deduction (not limited to itemizers) for health insurance expenses. Only amounts not exceeding the age-adjusted limits can be included. So limited, 100% of the cost of the insurance may be claimed as a deduction in 2005, as described above. Qualified long-term care insurance is defined as a contract that covers only long-term care services; does not pay or reimburse expenses covered under Medicare; is guaranteed renewable; does not provide for a cash surrender value or other money that can be paid, assigned, or pledged as collateral for a loan, or borrowed; applies all refunds of premiums and all policy holder dividends or similar amounts as a reduction in future premiums or to increase future benefits; and meets certain consumer protection standards. Policies issued before January 1, 1997, and meeting a state's long-term care insurance requirements at the time the policy was issued are considered qualified insurance for purposes of favorable tax treatment. Qualified long-term care services are defined as necessary diagnostic, preventive, therapeutic, curing, treating, mitigating, and rehabilitative services, and maintenance or personal care services, which are required by a chronically ill individual, and are provided according to a plan of care prescribed by a licensed health care practitioner. However, amounts paid for services provided by the spouse of a chronically ill person or by a relative directly or through a partnership, corporation, or other entity will not be considered a medical expense eligible for favorable tax treatment, unless the service is provided by a licensed professional. Chronically ill persons are defined as those individuals: unable to perform without substantial assistance from another individual at least two of the following activities of daily living (ADLs)for a period of at least 90 days due to a loss of functional capacity: bathing, dressing, transferring, toileting, eating, and continence; having a level of disability similar to the level of disability specified for functional impairments (as determined by the Secretary of the Treasury in consultation with the Secretary of Health and Human Services); or requiring substantial supervision to protect them from threats to health and safety due to severe cognitive impairment. HIPAA required that a licensed health practitioner (physician, registered professional nurse, licensed social worker, or other individual prescribed by the Secretary of the Treasury) certify that a person meets these criteria within the preceding 12-month period. HIPAA clarified that accelerated death benefits (that is, benefits paid before death) received under a life insurance contract on the life of an insured terminally or chronically ill individual are excluded from gross income. Also excluded are amounts received from a viatical settlement provider for the sale or assignment of a life insurance contract. These exclusions do not apply to amounts paid to persons other than the insured if they have an insurable interest in the insured for business reasons. A terminally ill individual is one who has been certified by a physician as having an illness or physical condition which can reasonably be expected to result in death within 24 months of the date of certification. A chronically ill individual is defined the same way as for long-term care (see the previous section). In this case, the exclusion of accelerated death benefits is limited to the actual costs of long-term care incurred by the individual that are not compensated by insurance or otherwise. The exclusion for benefits paid on a per diem or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or (2) the costs of long-term care services. Contracts must not pay or reimburse expenses which are reimbursable under Medicare or would be but for the application of a deductible or coinsurance amount. In addition, contracts are subject to the consumer protection provisions specified in the tax code for long-term care insurance, except for analogous standards specifically applying to chronically ill individuals that are adopted by the National Association of Insurance Commissioners or the state in which the policyholder resides. HIPAA added two types of organizations to the list of those expressly exempt from the federal income tax: (1) state-sponsored membership organizations that provide insurance coverage or medical care to high-risk individuals, and (2) state-sponsored workmen's compensation reinsurance organizations. Organizations in either classification must meet a number of requirements. HIPAA allowed health insurance providers (other than health maintenance organizations) that are organized and governed under state laws specifically and exclusively applying to not-for-profit health insurance or service organizations to deduct 25% of claims and expenses incurred during the year, less adjusted surplus. Previously this tax treatment applied only to Blue Cross and Blue Shield organizations. HIPAA provided that the 10% early withdrawal penalty would no longer apply to individual retirement account (IRA) distributions used to pay medical expenses in excess of 7.5% of adjusted gross income. In addition, it provided that the penalty would not apply to IRA distributions used to pay health insurance premiums after separation from employment in the case of an individual who receives 12 consecutive weeks of unemployment compensation. HIPAA required the Secretary of the Treasury to include organ and tissue donor information, to the extent practicable, in the mailing of individual income tax refunds from February 1, 1997 through June 30, 1997. authorized tax-advantaged medical savings accounts (MSAs) under a demonstration that began in 1997.

Summary: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (P.L. 104-191), provided for changes in the health insurance market. It guaranteed the availability and renewability of health insurance coverage for certain employees and individuals, and limited the use of preexisting condition restrictions. The Act created federal standards for insurers, health maintenance organizations (HMOs), and employer-provided health plans, including those that self-insure. It permitted, however, substantial state flexibility for compliance with the requirements on insurers. HIPAA also included tax provisions relating to health insurance. It permitted a limited number of small businesses and self-employed individuals to contribute to tax-advantaged medical savings accounts (MSAs) established in conjunction with high-deductible health insurance plans. It increased the deduction for health insurance that self-employed taxpayers may claim. In addition, it allowed long-term care expenses to be treated like deductible medical expenses and clarified the tax treatment of long-term care insurance. Finally, the Act included administrative simplification and privacy provisions instructing the Secretary of HHS to issue standards addressing the electronic transmission of health information and the privacy of personally identifiable medical information. Since the passage of HIPAA, there have been subsequent amendments. In 1996, new provisions required group health plans and insurers to cover minimum hospital stays for maternity care and for a limited period, to provide parity in certain mental health benefits. Parity was later extended for one year. In 1998, a provision was passed requiring health plans that cover mastectomy to also offer reconstructive breast surgery. Amendments have also increased the tax deduction for premiums paid by self-employed taxpayers. The Act, as amended, continues to generate numerous questions. What kinds of policies does it cover? Does it help people who are currently uninsured? Does it help people with preexisting medical conditions? How does it affect health insurance premiums? How do its requirements interact with the Consolidated Omnibus Budget Reconciliation Act (COBRA) continuation coverage? Answers to those questions, as well as other commonly asked questions, are provided, as well as descriptions of each of the major sections of HIPAA. Some of the answers provided may not be definitive. This is because, in some cases, final regulations have not yet been promulgated. Other regulations, such as those defining the administrative simplification provisions, remain under development. In addition, the answers to many questions about the requirements on the individual health insurance market depend upon particular state responses to the Act. For some provisions, states were allowed the choice of implementing the HIPAA requirements ("the federal fallback") or establishing acceptable alternative mechanisms.