Title I of HIPAA established standards for health coverage access, portability, and renewability that apply to employer-sponsored plans in the group market and, to a more limited extent, to the individual market.Group market provisions include limitations on preexisting condition exclusion periods; a requirement that previous coverage be credited to reduce or eliminate a new employee’s preexisting condition exclusion period; restrictions against excluding an employee from the health plan on the basis of his or her health status; and special enrollment opportunities for certain employees, such as those who did not enroll because they were previously covered under a spouse’s health plan. With limited exceptions, carriers must renew all group coverage at the employer’s request, regardless of the health status or historic health costs of the employee members. HIPAA also requires carriers in the small group market to guarantee coverage to all small employers (defined as those with 2 to 50 employees) that apply. In the individual market, HIPAA guarantees that eligible individuals losing group coverage have access to at least two individual market insurance products. This provision is referred to as group-to-individual portability. States may comply with this provision using either the federal rules—which require individual market carriers to guarantee access to certain insurance policies to eligible individuals—or an “alternative mechanism.” Under an alternative mechanism, states may, within broad federal parameters, design other approaches to provide eligible individuals with a choice of coverage. Twelve states are operating under the federal rules, and 38 are using an alternative mechanism. Of the latter, 22 are using a high-risk pool to provide coverage to these eligible individuals. A high-risk pool is a state entity that offers comprehensive health insurance to individuals with preexisting health conditions who are otherwise unable to obtain coverage in the individual market or who may be able to obtain coverage only at a cost-prohibitive rate. (App. II contains a summary of HIPAA access, portability, and renewability standards by market segment.) HIPAA was signed into law on August 21, 1996, and by the end of June 1998, all substantive provisions were effective for almost all plans. HIPAA regulations were issued on an interim final basis, and federal agencies issued most of the implementing regulations on April 8, 1997. Enhancements and clarifications to the regulations followed and will continue in 1999. Officials expect to finalize HIPAA regulations in 2000. Finally, after HIPAA was enacted, three additional federal laws—the Mental Health Parity Act (MHPA), the Newborns’ and Mothers’ Health Protection Act, and the Women’s Health and Cancer Rights Act (WHCRA)—imposed federal standards on private insurance coverage of mental health, maternity and newborn, and reconstruction after mastectomy benefits. Carrier and employer officials we interviewed expressed concerns about the lead time given them to comply with HIPAA and subsequent federal insurance reforms. The adoption of the new standards requires issuers to perform various tasks, including educating staff, issuing notices to enrollees, revising premium prices and marketing materials, and retooling information systems. Carrier officials consistently said that such changes require at least 6 months’ lead time or, preferably, 1 full year. Regulations implementing HIPAA were issued less than 2 months before certain provisions became effective, although carriers and employers have generally overcome the early start-up hurdles. Neither the MHPA nor the WHCRA had statutory provisions that provided for lead times of 6 months or more. Although the MHPA was signed into law in September 1996, its implementing regulations were not issued until December 22, 1997—only 9 days before some group plans became subject to the law. Similarly, while the WHCRA was signed into law on October 21, 1998, issuers were required to begin issuing notices to enrollees less than 3 months later, by January 1, 1999. Federal agencies, recognizing the short lead time, provided for a period during which no MHPA enforcement action would be taken against issuers making a good-faith effort to comply. Responsibility for enforcing HIPAA standards is divided among three federal agencies and the states. The Department of Labor is responsible for ensuring that employer-sponsored group health plans comply with HIPAA—an extension of Labor’s current regulatory role under the Employee Retirement Income Security Act of 1974 (ERISA). In states that do not adopt and enforce statutes or regulations that meet or exceed the HIPAA standards, the Department of Health and Human Services—through HCFA—is responsible for directly enforcing HIPAA standards for carriers in the group and individual markets. The Department of the Treasury enforces HIPAA requirements for group health plans by imposing an excise tax under the Internal Revenue Code as a penalty for noncompliance with the HIPAA standards. In states that have standards that conform to HIPAA, state insurance regulators have primary enforcement authority over insurance carriers. Notwithstanding early start-up challenges, the adoption of HIPAA’s group market access and portability provisions has proceeded relatively well—particularly for larger group plans. Noncompliance with these standards may be more common among smaller group plans. With respect to guaranteed coverage for small employers, quantitative evidence about the effects of the provision does not yet exist, but early evidence suggests that experiences vary considerably among states, in large part on the basis of the extent of pre-HIPAA state reforms. Larger employer plans appear to have adopted HIPAA access and portability provisions relatively easily. The Director of the Department of Labor’s health care task force said the Department has uncovered no systemic problems in the group market related specifically to HIPAA. A senior Labor field official told us that large employers and insurance companies are generally informed about HIPAA and make good-faith efforts to comply, although questions of interpretation still arise. The field office had no formal investigations related to HIPAA pending at the time of our visit in December 1998. Similarly, large employers and health benefit consultants we interviewed reported few ongoing problems in adopting HIPAA portability standards. Many carriers and large employers we interviewed said that their health plans tended to require few changes to comply with HIPAA. This was probably the case because many large employer plans had already incorporated portability protections similar to those of HIPAA. For example, many large employers had not excluded preexisting conditions from coverage before HIPAA became law. Many more have since dropped preexisting condition exclusion periods, partly because of the increased complexity of administering them under HIPAA. Table 1 shows that less than half of all group plans offered by employers with more than 200 employees continue to include preexisting condition exclusion periods.Further, a large midwestern telecommunications company official told us that before HIPAA, the company’s health plans (1) did not exclude preexisting conditions from coverage, (2) did not exclude individuals from the plan because of health status, and (3) provided later enrollment opportunities for those initially declining coverage. Thus, few changes were necessary. The degree of compliance with HIPAA portability provisions among small employer group plans has not been measured, but health insurance agents and regulators suspect noncompliance to be more common among these plans than among medium and large group plans. Whereas medium and large employers rely on carriers, third-party administrators, or a health benefits professional staff to implement HIPAA requirements, small employers may have fewer resources and may rely largely on carriers and agents to learn about changes in health benefits required by law. Further, observations made by health insurance agents and others suggest that some small employers either misunderstand the HIPAA requirements or are entirely unaware of them. In addition, several of the agents we surveyed volunteered that many of their colleagues do not understand HIPAA. An official of a small employer whom we interviewed in California told us an anecdote that illustrates this point. The individual responsible for human resource issues at this company with about 80 employees relied exclusively on the company’s insurance agent to learn about HIPAA’s certificate issuance requirement. The agent told the human resources staff person that certificates need be issued only upon the request of the employee; this is contrary to the law, which requires that certificates be issued automatically to anyone losing coverage. The discrepancy became apparent only as a result of our visit. Moreover, an agent in Florida indicated that perhaps 25 percent of her clients, most commonly the smaller employers, are not in compliance with one or more HIPAA provisions and are not making an effort to comply. Department of Labor officials also expressed concern about compliance among smaller employers. One field office official said that smaller employers know far less than larger employers about HIPAA and are more likely to be in violation of it. This field official is particularly concerned about small employers that self-fund their health plans and do not use the services of a third-party administrator. While this arrangement is not common, such employers have virtually no contact with health benefits professionals and, according to Labor officials, are very likely to be uninformed. Officials from another Labor field office noted that the Department’s experience in overseeing employer pension plans suggests that smaller employers are more likely to be in violation of requirements than larger employers. The extent to which HIPAA’s guaranteed issue provision affects market access for small employers in a given state is largely dependent on the extent of state reforms preceding HIPAA. Most states had already passed laws requiring carriers in the small group market to guarantee access to at least one health insurance plan for any small employer that applied. While most of these state laws were more limited than HIPAA, a substantial minority were equally or more stringent. In 13 states, reforms that preceded HIPAA required all products in the small group market to be guaranteed to be accessible to all small employers, just as HIPAA now does. Moreover, these states defined a small employer at least as inclusively as HIPAA. Therefore, HIPAA imposed virtually no changes in the way small group coverage is sold in these states.