Private Health Insurance: Federal Role in Enforcing New Standards
Continues to Evolve (07-MAY-01, GAO-01-652R).
In recent years, Congress has passed the Health Insurance
Portability and Accountability Act (HIPAA) and three subsequent
laws that create new federal standards for private health
insurance, which covers nearly 175 million Americans under the
age of 65. These laws include standards guaranteeing access to
health insurance for small employers and individuals with
existing health conditions as well as requirements for health
plans regarding mental health services, hospital care for mothers
and newborns following childbirth, and reconstructive surgery
following a mastectomy. Since HIPAA's enactment in 1996, federal
agencies' enforcement roles have continued to evolve as they have
established new or expanded existing enforcement activities to
ensure compliance with standards under HIPAA and the related
federal laws. Agency officials state that they have an
appropriate level of staff resources and expertise to carry out
their current enforcement responsibilities. The Health Care
Financing Administration's future role remains contingent on the
actions of states in enforcing the federal standards, as well as
on congressional decisions about whether to reauthorize the
Mental Health Parity Act or to enact additional patient
protection legislation. In addition, the scope of the Department
of Labor's future enforcement activities may depend on the extent
of noncompliance determined through its compliance reviews of a
nationwide random sample of employer-sponsored health plans. The
audit results could lead to Labor's referral of noncompliant
plans to Treasury for the imposition of an excise tax. Thus,
while the agencies have been able to carry out their required
enforcement roles, the scope and extent of these agencies'
continuing enforcement roles will depend on the actions of
employers, carriers, states, and Congress.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-01-652R
ACCNO: A01134
TITLE: Private Health Insurance: Federal Role in Enforcing New
Standards Continues to Evolve
DATE: 05/07/2001
SUBJECT: Health insurance
Public health legislation
Insurance regulation
Federal/state relations
Employee medical benefits
Excise taxes
Noncompliance
California
Colorado
Delaware
Massachusetts
Missouri
Rhode Island
Wisconsin
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-01-652R
GAO- 01- 652R Federal Enforcement of Health Insurance Standards
United States General Accounting Office Washington, DC 20548
May 7, 2001 The Honorable James M. Jeffords Chairman Committee on Health,
Education, Labor, and Pensions United States Senate
Subject: Private Health Insurance: Federal Role in Enforcing New Standards
Continues to Evolve
Dear Mr. Chairman: In recent years, the Congress has passed the Health
Insurance Portability and Accountability Act of 1996 (HIPAA) and three
subsequent laws 1 that create new federal standards for private health
insurance, which covers nearly 175 million Americans under the age of 65.
These laws include standards guaranteeing access to health insurance for
small employers and individuals with existing health conditions as well as
requirements for health plans regarding mental health services, hospital
care for mothers and newborns following childbirth, and reconstructive
surgery following a mastectomy. Responsibility for enforcing the new federal
standards established by these four laws is divided among state insurance
regulators and three federal agencies. Specifically, states maintain their
traditional responsibility for regulating insurance products sold in their
states, but if they fail to substantially enforce the minimum federal
standards, the Department of Health and Human Services (HHS), through the
Health Care Financing Administration (HCFA), is responsible for enforcing
the federal laws. HCFA is also responsible for enforcing the federal
standards for nonfederal government health plans, such as health plans
offered to state and local government or school district employees. These
laws also expanded the Department of Labor?s responsibilities for ensuring
that private employer- sponsored group health plans meet federal
requirements and provided the Department of the Treasury with new authority
to impose an excise tax on employers found to violate the federal standards.
Because the Congress is currently considering new patient protection
standards- and because some proposals would model enforcement on the
approach used in HIPAA and other laws- you asked us to provide an update on
federal agencies? enforcement of the existing health insurance standards.
Specifically, we examined
1 The Mental Health Parity Act of 1996, the Newborns? and Mothers? Health
Protection Act of 1996, and the Women?s Health and Cancer Rights Act of
1998.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 2
HCFA?s progress in enforcing these new federal health insurance standards,
Labor?s enforcement of standards on private employer- sponsored health
plans, and
Treasury?s imposition of an excise tax for noncompliant employers. To
address these objectives, we interviewed headquarters and regional
representatives of HCFA, officials from Labor and Treasury, and insurance
regulators in several states, and we obtained and reviewed documents from
HCFA and Labor. We conducted our work in March and April of 2001 in
accordance with generally accepted government auditing standards.
In brief, federal agencies have continued to make progress in developing and
implementing mechanisms to ensure that employers and carriers comply with
new federal health insurance standards. HCFA?s enforcement role has evolved
since our last report in March 2000 when the agency was largely responding
to consumer complaints and attempting to ascertain the scope of its
responsibilities in view of state responsiveness to the legislation. 2 Since
that time, HCFA has completed its review of state laws related to three of
the four recent federal laws and identified five states- Colorado, Delaware,
Massachusetts, Missouri, and Wisconsin- where it is necessary for HCFA to
enforce federal standards. The agency has not fully assessed state
conformance with the Mental Health Parity Act, which is scheduled to sunset
later this year. The agency has undertaken relatively comprehensive
enforcement activities in Missouri- including reviews of carriers? policy
forms and business practices and responding to consumers? complaints- where
it has had a role enforcing HIPAA standards since 1997 when the state
notified HCFA that it was not enforcing the federal law. HCFA has more
recently initiated enforcement activities in the remaining four states.
HCFA?s role in enforcing federal standards for nonfederal government health
plans in all states has been limited to responding to a relatively small
number of inquiries and complaints from participants in these plans.
The Department of Labor?s enforcement activities for private employer-
sponsored health plans have also expanded from its complaint- driven
enforcement of limited federal reporting and disclosure requirements under
the Employee Retirement Income Security Act of 1974 (ERISA). The agency has
undertaken a more proactive role in measuring health plan compliance with
the new federal standards. In particular, Labor has developed and
implemented a system to conduct random compliance reviews of employer-
sponsored health plans so that next year it can estimate the extent of HIPAA
compliance nationwide. Finally, the Department of the Treasury has not yet
developed an enforcement strategy focused specifically on the new federal
standards, nor has it exercised its new authority to impose an excise tax on
noncompliant employers. We provided a draft of this report to the three
agencies for their review. In written comments, HCFA and Labor generally
agreed with our characterization of their evolving enforcement roles.
Treasury did not provide written comments.
2 Implementation of HIPAA: Progress Slow in Enforcing Federal Standards in
Nonconforming States (GAO/ HEHS- 00- 85, March 31, 2000). A list of related
products is included at the end of this letter.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 3
BACKGROUND
Since 1996, the Congress has passed four laws that establish new federal
standards for private health plans. HIPAA includes minimum standards to
improve the access, portability, and renewability of health insurance
coverage in employer- sponsored group plans and individually purchased
nongroup plans. Subsequent laws established minimum requirements for health
plans covering mental health services, hospital maternity care, and
mastectomies. Specifically, see the following.
HIPAA (1) requires insurance carriers to offer coverage to all small
employers (defined as those with 2 to 50 employees) that apply (a standard
known as guaranteed issue), (2) requires all health coverage to be renewable
upon expiration of the policy term (guaranteed renewal), (3) prohibits
excluding an employee from a group health plan, or varying benefits,
premiums, or employer contributions, on the basis of health status
(nondiscrimination), (4) sets a maximum length of time that group health
plans may exclude coverage for preexisting conditions, (5) provides credit
against any preexisting condition exclusion for individuals with prior
continuous coverage (group- to- group portability), and (6) guarantees
eligible individuals losing group coverage access to coverage through
individually purchased insurance or alternatives, such as state- sponsored
high- risk pools (group- to- individual portability). 3
The Mental Health Parity Act of 1996 prohibits group plans that provide
mental health benefits from imposing annual and lifetime dollar limits that
are more restrictive for mental health benefits than for other medical and
surgical benefits. 4
The Newborns? and Mothers? Health Protection Act of 1996 prohibits plans
that provide maternity benefits from restricting benefits for a hospital
stay in connection with childbirth to less than 48 hours following a vaginal
delivery or 96 hours following a cesarean section. 5
The Women?s Health and Cancer Rights Act of 1998 requires all plans that
provide mastectomy coverage to also provide coverage for related
reconstructive surgery and certain other follow- up care.
The responsibility for ensuring that consumers receive these protections is
shared by the states and multiple federal agencies. State insurance
regulators have primary
3 An eligible individual has had at least 18 months of creditable coverage
with no break of more than 63 consecutive days; has exhausted any federal or
state mandated continuation coverage; is not eligible for any other group
coverage, Medicare, or Medicaid; and did not lose group coverage because of
nonpayment of premiums by the individual or certain other reasons including
fraud. To meet the group- to- individual portability requirement, states may
require individual market carriers to offer coverage to eligible individuals
or use an alternative means, such as a high- risk pool.
4 The Mental Health Parity Act applies only to groups with more than 50
employees. 5 In contrast to the other laws that establish minimum federal
standards, under the Newborns? and Mothers? Health Protection Act certain
state laws that meet some, but not all, of the federal requirements are
deemed to be acceptable.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 4
enforcement authority for insurance carriers in states that have laws that
substantially conform to or exceed these federal standards or that otherwise
substantially enforce the federal standards. 6 HCFA is responsible for
directly enforcing the federal health insurance standards for carriers in
states that fail to substantially enforce the federal standards. In this
role, HCFA must assume many of the responsibilities undertaken by state
insurance regulators, such as responding to consumers? inquiries and
complaints, reviewing carriers? policy forms and business practices, and
imposing civil monetary penalties on noncomplying carriers. 7 In all states,
HCFA is generally required to enforce the federal standards for nonfederal
government health plans, such as plans covering state and local government
employees. Enforcement responsibility for the standards under HIPAA and the
related federal laws was added to Labor?s existing oversight role for
private employer- sponsored benefits established under ERISA. HIPAA also
provided Treasury with authority to impose an excise tax on noncompliant
employers and plan administrators.
In March 2000, we reported that nearly 4 years after HIPAA?s enactment, HCFA
was still in the early stages of fully identifying where federal enforcement
was needed. We recommended that HCFA promptly complete its determination of
which states required federal enforcement and develop a consistent strategy
for doing so. The agency had assumed enforcement activities, such as
reviewing carrier policies and business practices in three states
(California, Missouri, and Rhode Island) that had voluntarily notified HCFA
of their failure to enforce some HIPAA standards. However, the agency was
still in the process of fully determining state conformance with the
standards under HIPAA and the related laws and was largely reacting to
consumers? inquiries and complaints. HCFA had contacted states without
conforming laws to determine whether they were substantially enforcing the
federal standards through other means, such as regulations or advisory
bulletins. It had yet to fully determine its enforcement responsibilities
among nonfederal government plans and was also relying on complaints from
enrollees to identify compliance problems. In earlier reports, we also
examined Labor?s increased enforcement responsibilities under HIPAA, and we
found that the agency tended to rely largely on consumer complaints to
identify noncompliance. 8 Recognizing the increased scope and complexity of
its responsibilities under HIPAA and related federal laws, Labor was
attempting to enhance its customer service function. It increased the number
of customer service staff available to respond to public inquiries, provided
consumer education materials, and was undertaking other improvements, such
as conducting compliance reviews of randomly selected employers.
6 HCFA officials said, absent conforming laws, they consider states to be
substantially enforcing the federal standards if alternative means exist,
such as regulations, advisory bulletins, or other guidance issued by state
regulatory agencies directing insurers to meet standards consistent with the
federal requirements.
7 HIPAA provides for the imposition of a civil monetary penalty of up to
$100 per day per violation for each individual affected by a carrier?s
failure to comply. 8 Private Health Insurance: Progress and Challenges in
Implementing 1996 Federal Standards (GAO/ HEHS- 99- 100, May 12, 1999).
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 5 THE
SCOPE OF HCFA?S ENFORCEMENT RESPONSIBILITIES CONTINUES TO
EVOLVE HCFA has completed its review of state laws for conformance with
three of the four statutes with new federal health insurance standards. In
doing so, it has accomplished an important task it had previously identified
as needed to clarify the scope of its enforcement role and has largely
responded to the recommendation we made in our March 2000 report. The agency
identified five states- Colorado, Delaware, Massachusetts, Missouri, and
Wisconsin- that do not substantially enforce at least one of the four
federal standards, thus requiring HCFA to assume a direct enforcement role.
Although the agency has undertaken fairly extensive enforcement activities
in Missouri, where it has had a role enforcing HIPAA standards since 1997,
in the remaining four states it is in the initial stages of enforcement
activities. In addition to specific enforcement responsibilities in these
five states, HCFA will regularly reevaluate conformance with the federal
standards in the remaining states and continue to field inquiries and
complaints from consumers nationwide. HCFA continues to rely on consumer
complaints to enforce standards on nonfederal governmental plans, but
limited consumer knowledge of their rights may hinder the effectiveness of
this approach. HCFA staff dedicated for the enforcement of these federal
standards has declined as its role has diminished and become more clearly
defined. Several factors, however, including the possible reauthorization of
the Mental Health Parity Act, could change the scope of HCFA?s enforcement
responsibilities in the future.
HCFA Has Identified Five States Where It Will Enforce Federal Standards HCFA
has completed its analysis of state laws to determine conformance with
standards contained in three laws- HIPAA, the Newborns? and Mothers? Health
Protection Act, and the Women?s Health and Cancer Rights Act- and has
determined that five states lack laws, regulations, or administrative
mechanisms that address the requirements of one of the federal statutes,
requiring HCFA to assume enforcement responsibilities. 9 HCFA did not make a
determination as to whether each state fully conformed to the Mental Health
Parity Act. Rather, because the federal parity law will sunset on September
30, 2001, unless reauthorized by the Congress, the agency chose to confirm
only that each state had some standard related to parity in mental health
coverage, but not that the standard fully met the federal minimum
requirement. HCFA officials told us they intend to more fully determine each
state?s conformance if the Congress acts to extend or modify the federal
parity law.
HCFA determined that each of the five states did not conform with only one
of the three laws. For HIPAA, Missouri remains the only state without
conforming legislation. Two of the three states in which HCFA had assumed
HIPAA enforcement activities for the past several years- California and
Rhode Island- passed
9 For the Newborns? and Mothers? Health Protection Act, HCFA relied on
Labor?s analysis of state conformance.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 6
conforming legislation in 2000. Accordingly, HCFA has largely phased out
enforcement activities in these states. HCFA determined that Wisconsin does
not fully conform to the Newborns? and Mothers? Health Protection Act, and
Colorado, Delaware, and Massachusetts do not fully conform to the Women?s
Health and Cancer Rights Act. 10 (See table 1.)
Table 1: States That Do Not Fully Conform With Three Federal Laws HIPAA
Newborns? and
Mothers? Health Protection Act
Women?s Health and Cancer Rights
Act Colorado X Delaware X Massachusetts X Missouri X Wisconsin X Source:
HCFA, April 2001.
State officials in some of these states commented on the likelihood of
passing conforming legislation in the future. While a Delaware official told
us that the state was likely to enact conforming legislation this year,
officials in Colorado, Massachusetts, and Wisconsin said they did not
believe that their states would pass conforming legislation in the near term
and therefore would require an ongoing role by HCFA. Some of these officials
suggested that their state legislatures did not view enactment as a high
priority, believing most carriers complied with the federal standards even
without the state taking any action. For example, the Colorado Division of
Insurance conducted a survey of the 10 largest carriers in the state and
determined that each already provided coverage for reconstructive surgery
after a mastectomy, even though the state had not passed conforming
legislation. Based on the survey results and lack of consumer complaints
related to the issue, the state decided not to pursue conforming
legislation.
HCFA Has Direct Enforcement Authority in Five States and Assumes a More
Limited Role in the Remaining States
Although HCFA has been actively enforcing HIPAA in Missouri for several
years, its enforcement activities in the other four states have generally
just begun. In addition, HCFA?s activities in California and Rhode Island,
where it has had an enforcement role since 1997, are being phased out
because both states passed HIPAA conforming legislation in 2000.
In 1997 when Missouri notified HCFA of its failure to pass HIPAA conforming
legislation, HCFA assumed enforcement responsibilities in the state for
several
10 HCFA earlier determined that North Dakota did not conform to the Women?s
Health and Cancer Rights Act and initiated enforcement activities by sending
letters to issuers in the state in January 2001. However, the state has
since passed conforming legislation and has assumed enforcement
responsibility for the standard.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 7 HIPAA
standards in both the individual and group markets. Although HCFA?s
enforcement role began with responding to consumer inquiries and complaints,
its Kansas City regional office began reviewing carrier policies for
compliance in 1998 and has since reviewed policies representing
approximately 95 percent of the state?s small group, individual, and health
maintenance organization markets. 11 In addition, the regional office began
on- site market conduct examinations in June 1999. In a market conduct
examination, HCFA?s contractor reviews a carrier?s business practices for
compliance with HIPAA standards. As of April 2001, HCFA had completed two
market conduct examinations and an additional six were under way. These
eight carriers collectively insure about 60 percent of Missouri?s private
insurance market. A common problem identified during policy and market
conduct reviews was lack of guaranteed access to individual insurance market
products for eligible individuals. For example, HCFA officials said that
some carriers in Missouri did not attempt to determine whether an applicant
was eligible for group- toindividual portability under HIPAA and did not
inform eligible individuals about the availability of guaranteed issue
products. In the market conduct reviews, HCFA also identified problems with
HIPAA?s guaranteed issue standard in the small group market. Officials cited
examples of carriers structuring agent commissions in a manner that
discouraged the referral of very small groups.
Because of the expertise it has developed in Missouri, HCFA has decided to
centralize responsibility for enforcement of the applicable federal
standards in the remaining four states in the Kansas City regional office.
Much as it did in Missouri, HCFA will field consumer inquiries and
complaints, review policies, and conduct market examinations related
narrowly to provisions of the Newborns? and Mothers? Health Protection Act
or Women?s Health and Cancer Rights Act with which the four states are not
in conformance. However, although the coordination between HCFA and each
state is delineated in letters sent to the states last year, regulatory and
enforcement activities are essentially just under way in three of the four
states. For example, HCFA has recently sent letters to carriers operating in
Colorado, Delaware, and Massachusetts notifying them of its intent to
enforce the Women?s Health and Cancer Rights Act and requesting policies to
review. Enforcement efforts are further along in Wisconsin, where HCFA has
sent letters to the 37 largest carriers notifying them of HCFA?s role in
enforcing the Newborns? and Mothers? Health Protection Act and has reviewed
policies representing about 40 percent of the state?s group market and 10
percent of its individual market.
In addition to specific enforcement responsibilities in these five states,
HCFA will regularly update its legislative review of other states? laws to
ensure that they continue to substantially enforce the federal standards.
HCFA will also continue to field inquiries and complaints from all states.
Since January 1997, the agency has been recording inquiries and complaints
it has received related to the federal standards. To collect consistent data
from across all regions, HCFA developed an electronic complaint tracking
system that was implemented in June 2000. From March 2000 through March
2001, HCFA documented 1,492 inquiries and 133
11 According to regional officials, HCFA is likely to conduct a
comprehensive rereview of Missouri carrier policies for HIPAA compliance on
a 3- year cycle similar to many state insurance departments. HCFA will
conduct more frequent reviews if complaints received indicate
nonconformance.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 8
complaints; over half of the complaints dealt with the standards for the
individual
market. 12 A common complaint involved allegations that carriers delayed
processing applications, which resulted in qualified individuals becoming
ineligible for HIPAA?s protections.
Although HIPAA provides for the imposition of a civil monetary penalty on
noncomplying carriers, and the final enforcement regulations include
detailed standards to follow in imposing penalties, HCFA has yet to impose
such a penalty on a carrier. In lieu of civil monetary penalties, officials
in the Kansas City regional office said that they have successfully
negotiated voluntary settlements totaling $187,000 with several carriers
that agreed to pay consumers for claims that were wrongly denied.
HCFA?s Enforcement Efforts for Nonfederal Governmental Plans Have Been
Limited HCFA is also responsible for enforcing federal insurance standards
on state and local government health plans, such as health plans for public
universities and city, county, and state governments. 13 Unlike private
employer- sponsored plans, nonfederal government plans are generally not
subject to many of the employee benefit protections under ERISA. For
example, these plans are not required to file plan information with the
federal government or provide participants with a description of their
plans. In addition, HIPAA and the related laws permitted self- funded,
nonfederal government plans to exempt themselves from federal standards
related to access, portability, and renewability, as well as those related
to mental health, hospital stays connected with childbirth, and
reconstructive surgery following a mastectomy.
HCFA maintains responsibility for enforcing the federal standards on self-
funded, state and local government plans that do not exempt themselves from
the standards. However, according to HCFA officials, the agency lacks
authority to collect information from states regarding the number of
nonfederal government plans operating in them and is not otherwise aware of
reference sources that would provide such information. Thus, HCFA has been
unable to determine the universe of nonfederal government plans for which it
has responsibility and has instead relied on consumer complaints to identify
possible areas of noncompliance. Few such
12 According to HCFA officials, about 35 to 40 percent of the complaints
originated in states where HCFA had enforcement authority. 13 Nonfederal
government health plans that elect exemption from one or more of the
standards must file or renew their exemptions with HCFA annually under
procedures set out in regulation, notify participants about the election,
and provide for the certification and disclosure of creditable coverage. As
of March 2001, 533 plans in 35 states had exempted themselves from at least
one of the standards. About 90 percent opted out of standards related to
limits on preexisting condition exclusion periods, special enrollment
periods, prohibition against discrimination based on an individual?s health
status, and mental health parity; nearly three- quarters opted out of the
standards related to newborns and mothers; and about one- third opted out of
the requirement to provide reconstructive surgery following a mastectomy. A
fully insured nonfederal government plan that buys insurance coverage from a
carrier does not have the ability to opt out since the carrier must comply
with all HIPAA group market standards.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 9
complaints have been received- less than 10 percent of the HIPAA- related
complaints received in the last year were related to nonfederal governmental
plans. However, enrollees? potential lack of knowledge about their rights
and the appropriate manner in which to pursue grievances may limit the
effectiveness of HCFA?s complaint- driven oversight approach for these
plans.
Number of HCFA Staff Needed for HIPAA Enforcement Has Continued to Decline,
but Questions Remain About the Extent of HCFA?s Future Enforcement
Responsibilities
As of April 2001, HCFA had about 16 full- time equivalent (FTE) staff
assigned to HIPAA implementation and enforcement efforts. Of this total, 10
were assigned to HCFA?s central office within the Center for Medicaid and
State Operations, 3.5 to the Kansas City regional office and about 0.25 FTE
to each of the remaining nine regional offices. 14 These 16 FTEs- which
include former state insurance regulators, attorneys, and an insurance
examiner- represent a continued decline in HCFA staff dedicated to enforcing
these standards, from about 39 in July 1998 and 31.5 in March 2000. HCFA
officials told us that its resources are adequate for its current
enforcement activities because its enforcement role is now more clearly
defined and the need for resources has been reduced, in part, because
several states have recently passed laws to enforce HIPAA at the state
level. In addition, officials said they have benefited from the experience
gained in conducting insurance regulatory functions over the past few years.
Several factors could change the scope of HCFA?s enforcement
responsibilities in the future. Some of the five states where HCFA has an
enforcement role may come into conformance, thus diminishing HCFA?s role.
Also, HCFA?s plan to regularly update its legislative review of other
states? laws to ensure that they continue to substantially enforce the
federal standards could also increase or decrease its level of effort.
Further, because HCFA has not fully established whether states are
substantially enforcing the Mental Health Parity Act, HCFA will need to
review state laws if the Congress decides to reauthorize the law beyond
September 30, 2001. We previously reported that, as of March 2000, laws in
eight states and the District of Columbia might not conform to the federal
parity law, and seven states had no law addressing mental health coverage.
15 Although several of these states have since enacted laws, several may
remain out of conformance. Unless these states issue regulatory bulletins or
otherwise demonstrate that they are substantially enforcing the federal
standards, HCFA could be required to take an enforcement role in the states.
Finally, HCFA?s enforcement role could expand if the Congress enacts patient
protection legislation that requires HCFA to assume similar enforcement
responsibilities.
14 HCFA also uses an external contractor to perform market conduct
examinations. 15 Mental Health Parity Act: Despite New Federal Standards,
Mental Health Benefits Remain Limited (GAO/ HEHS- 00- 95, May 10, 2000).
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 10
LABOR HAS EXPANDED ITS ENFORCEMENT ACTIVITIES TO BETTER ENSURE
PRIVATE EMPLOYER COMPLIANCE Labor has had a long- standing responsibility
for ensuring that private employersponsored group health plans meet certain
fiduciary, reporting, and disclosure requirements related to the provision
of health benefits under ERISA. Its enforcement approach has traditionally
been largely complaint- driven. Because of the increased scope and
complexity of its role in enforcing new federal standards under HIPAA and
the related laws, Labor has modified this process to better ensure that
these health plans comply also with these new standards and has increased
the level of resources devoted to health plan enforcement. 16 For example,
it has implemented a system of coding consumer inquiries and complaints to
better capture information related specifically to standards under HIPAA and
the related federal laws. In addition, it has developed and refined a
checklist that it uses for conducting compliance reviews of private
employers. The checklist includes specific steps for its investigators to
follow in examining health plan compliance. Labor officials note that all
compliance reviews now include a full review for all federal standards under
HIPAA and the related laws, regardless of the initial reason for the review.
Officials told us that they have adequate resources to meet their increased
responsibilities.
In fiscal year 1999, Labor undertook a pilot project to conduct compliance
reviews of a sample of private employer- sponsored health plans. 17 The
agency conducted about 230 of these reviews in fiscal year 1999 and an
additional 356 from fiscal year 2000 through the second quarter of fiscal
year 2001. The agency plans to conduct about 1,250 additional, randomly
selected reviews this fiscal year. This random selection method will, for
the first time, enable the agency to project these results nationally. This
will provide a baseline for assessing the extent to which private,
employersponsored group health plans are complying with the federal
standards, and the results are expected to be available in the second
quarter of fiscal year 2002.
In its fiscal year 1999 pilot reviews, Labor found noncompliance rates of
about 21 percent for certain HIPAA standards, 12 percent for Mental Health
Parity Act standards, 18 and 26 percent for the Newborns? and Mothers?
Health Protection Act standards. 19 According to Labor officials, many of
the violations are largely technical in nature, such as employers or plan
administrators who do not update their plan
16 Labor FTEs devoted solely to health related activities grew from about 66
in 1997 to about 101 currently. This number includes FTEs allocated to
compliance assistance and outreach activities. 17 These audits are in
addition to those it conducts in response to consumer complaints.
18 We previously reported that a significant minority of private employers
may not be fully complying with the federal Mental Health Parity Act (GAO/
HEHS- 00- 95). Based on a random sample of nearly 900 private employers in
26 states and the District of Columbia with laws not more comprehensive than
the federal standards, we reported that about 14 percent of plans were not
compliant in that they had annual or lifetime dollar limits for mental
health benefits that were more restrictive than those for medical and
surgical benefits.
19 The Women?s Health and Cancer Rights Act was passed more recently than
HIPAA and the related laws and was therefore not addressed in the pilot
audits.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 11
documents to reflect required changes or issue required notices to enrollees
concerning new protections. Another relatively common violation is the
imposition of a ?hidden? preexisting condition exclusion clause. Under such
a clause, a health plan excludes coverage for a certain condition without
specifically referring to it as a preexisting condition exclusion clause.
Upon identifying a violation, Labor will send a letter to the employer or
plan administrator outlining the violation and initiating a dialogue seeking
voluntary correction. Accordingly, the vast majority of compliance problems
are resolved voluntarily, according to Labor officials. The agency has not
resorted to legal action or made any referrals to the Department of the
Treasury for the imposition of an excise tax.
TREASURY RELIES ON VOLUNTARY COMPLIANCE AND REFERRALS FROM LABOR
Treasury?s enforcement of the standards under HIPAA and the related laws
currently relies on voluntary employer compliance and referrals from Labor.
The divisions within Treasury that have enforcement authority were created
following a recent agencywide reorganization and, according to officials, as
of April 2001, they have not yet begun to develop a strategy focused on
these standards. Nevertheless, agency staff said that employers are
responsible for ensuring that their health plans comply with the standards
and for correcting any areas of noncompliance. Also, to help ensure that
employer- sponsored health plans are designed in accordance with federal
standards, Treasury regularly provides guidance to employee benefits
advisors. Officials told us they did not believe the agency has assessed,
nor has any employer voluntarily paid, an excise tax associated with
noncompliance. Officials also said they would impose an excise tax penalty
in response to violations identified and referred by Labor, but indicated
they have not received any such referrals.
CONCLUDING OBSERVATIONS Since HIPAA?s enactment in 1996, federal agencies?
enforcement roles have continued to evolve as they have established new or
expanded existing enforcement activities to ensure compliance with standards
under HIPAA and the related federal laws. Agency officials state that they
have an appropriate level of staff resources and expertise to carry out
their current enforcement responsibilities. HCFA?s future role remains
contingent on the actions of states in enforcing the federal standards, as
well as on congressional decisions about whether to reauthorize the Mental
Health Parity Act or to enact additional patient protection legislation. In
addition, the scope of Labor?s future enforcement activities may depend on
the extent of noncompliance determined through its compliance reviews of a
nationwide random sample of employer- sponsored health plans. The audit
results could lead to Labor?s referral of noncompliant plans to Treasury for
the imposition of an excise tax. Thus, while the agencies have been able to
carry out their required enforcement roles, the scope and extent of these
agencies? continuing enforcement roles will depend on the actions of
employers, carriers, states, and the Congress.
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 12
AGENCY COMMENTS
We provided a draft of our report to HCFA, Labor, and Treasury for comment.
In its written comments, HCFA noted that, at the time of HIPAA?s enactment,
it had not anticipated that it would have to assume a role in directly
enforcing the federal insurance standards. (See enclosure I.) Given this
unanticipated role, HCFA highlighted the progress it has made in working
closely with the states and in developing and implementing mechanisms to
ensure that health carriers comply with HIPAA and the related laws. HCFA
also noted that its ability to determine the universe of nonfederal
government plans is limited; however, individuals in fully insured,
nonfederal government plans are generally subject to state oversight with
respect to compliance with these standards. In its written comments, Labor
generally concurred with our findings and highlighted the compliance
assistance and education and outreach activities it is undertaking to
heighten consumer and employer awareness of the protections and
responsibilities under the federal health insurance standards. (See
enclosure II.) Treasury did not provide written comments. Each agency
provided technical comments and suggestions for clarification that we
incorporated as appropriate.
- - - - As we agreed with your office, unless you publicly announce the
contents of this correspondence earlier, we plan no further distribution of
it until 30 days after its issue date. We will then send copies to the
Honorable Michael McMullan, Acting Deputy Administrator of the Health Care
Financing Administration; the Honorable Elaine L. Chao, Secretary of Labor;
the Honorable Paul H. O?Neill, Secretary of the Treasury; and other
interested congressional committees and members and agency officials. We
will also make copies available to others on request.
The information presented in this correspondence was developed by Susan
Anthony, John Dicken, and Randy DiRosa. Please call me at (202) 512- 7118 if
you have any questions.
Sincerely yours, Kathryn G. Allen Director, Health Care- Medicaid
and Private Health Insurance Issues Enclosures - 2
Enclosure I Enclosure I GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 13
Enclosure I Enclosure I GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 14
Enclosure I Enclosure I GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 15
Enclosure II Enclosure II GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 16
Enclosure II Enclosure II GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 17
Enclosure II Enclosure II GAO- 01- 652R Federal Enforcement of Health
Insurance Standards Page 18
GAO- 01- 652R Federal Enforcement of Health Insurance Standards Page 19
RELATED GAO PRODUCTS
Mental Health Parity Act: Employers? Mental Health Benefits Remain Limited
Despite New Federal Standards (GAO/ T- HEHS- 113, May 18, 2000). Mental
Health Parity Act: Despite New Federal Standards, Mental Health Benefits
Remain Limited (GAO/ HEHS- 00- 96, May 10, 2000). Implementation of HIPAA:
Progress Slow in Enforcing Federal Standards in Nonconforming States (GAO/
HEHS- 00- 85, March 31, 2000).
Private Health Insurance: Progress and Challenges in Implementing 1996
Federal Standards (GAO/ HEHS- 99- 100, May 12, 1999).
Private Health Insurance: HCFA Cautious in Enforcing Federal HIPAA Standards
in States Lacking Conforming Laws (GAO/ HEHS- 98- 217R, July 22, 1998).
Implementation of HIPAA: State- Designed Mechanisms for Group- to-
Individual Portability (GAO/ HEHS- 98- 161R, May 20, 1998).
Health Insurance Standards: Implications of New Federal Law for Consumers,
Insurers, Regulators (GAO/ T- HEHS- 98- 114, March 19, 1998).
Health Insurance Standards: New Federal Law Creates Challenges for
Consumers, Insurers, Regulators (GAO/ HEHS- 98- 67, February 1998).
The Health Insurance Portability and Accountability Act of 1996: Early
Implementation Concerns (GAO/ HEHS- 97- 200R, September 1997).
(290054)
*** End of document. ***