Private Health Insurance: Progress and Challenges in Implementing 1996
Federal Standards (Letter Report, 05/12/1999, GAO/HEHS-99-100).

Minimum standards of protection now apply to group (both fully insured
and self-funded) and individual insurance coverage sold in all states.
As a result, many consumers face fewer exclusions for preexisting
conditions, enrollees should be able to more easily renew their health
plans, employees may not be excluded from group health plans on the
basis of their health status, small employers must have guaranteed
access to all coverage sold in the small group market, and high-risk
individuals losing group coverage may have better access to either
individual health insurance or a subsidized high-risk pool. Nonetheless,
high-risk individuals and some small groups may continue to face high
premiums for guaranteed coverage, and relatively few high-risk
individuals who lost group coverage appear to have purchased individual
insurance guaranteed by the Health Insurance Portability and
Accountability Act of 1996. Consumers' lack of awareness or
understanding of the act can impede their ability to exercise their
rights. One potentially effective education tool is the certificate of
creditable coverage that must be issued to every enrollee who loses
insurance coverage. However, guidance on this certificate does not
explicitly and comprehensively outline the law's protections. Both the
Health Care Financing Administration (HCFA) and the Department of Labor
recognize that further efforts are needed, including targeting consumer
education efforts, proactively ensuring employers' compliance, and
ensuring that all states' insurance regulations fully conform with
federal standards. Moreover, HCFA recognizes that its ability to fully
perform its new regulatory role will be enhanced when enforcement
regulations are issued.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  HEHS-99-100
     TITLE:  Private Health Insurance: Progress and Challenges in
	     Implementing 1996 Federal Standards
      DATE:  05/12/1999
   SUBJECT:  Health insurance
	     Health insurance cost control
	     Insurance regulation
	     Insurance premiums
	     Consumer education
	     Employee medical benefits

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  This text was extracted from a PDF file.        **
** Delineations within the text indicating chapter titles,      **
** headings, and bullets have not been preserved, and in some   **
** cases heading text has been incorrectly merged into          **
** body text in the adjacent column.  Graphic images have       **
** not been reproduced, but figure captions are included.       **
** Tables are included, but column deliniations have not been   **
** preserved.                                                   **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

    United States General Accounting Office GAO                Report
    to the Chairman, Committee on Health, Education, Labor, and
    Pensions, U.S. Senate May 1999           PRIVATE HEALTH INSURANCE
    Progress and Challenges in Implementing 1996 Federal Standards
    GAO/HEHS-99-100 GAO      United States General Accounting Office
    Washington, D.C. 20548 Health, Education, and Human Services
    Division B-281547 May 12, 1999 The Honorable James M. Jeffords
    Chairman, Committee on Health, Education, Labor, and Pensions
    United States Senate Dear Mr. Chairman: By setting minimum federal
    standards for certain aspects of private health insurance held by
    over 160 million Americans, the Health Insurance Portability and
    Accountability Act of 1996 (HIPAA) established important new
    federal responsibilities. HIPAA instituted minimum standards of
    protection to improve access to health insurance for people
    obtaining coverage through employment as well as for those
    purchasing it as individuals. For example, HIPAA limits the time
    that preexisting conditions may be excluded from coverage for many
    people changing jobs (portability) and guarantees access to
    coverage for certain individuals losing group coverage (group-to-
    individual portability). Since the enactment of HIPAA, the
    Congress has enacted additional federal health insurance
    requirements, including minimum standards affecting mental health,
    maternity and newborn, and reconstruction after mastectomy
    benefits. Last year, we reported that the initial months of HIPAA
    implementation had posed some challenges for consumers, insurers,
    and regulators.1 We noted that * eligible consumers attempting to
    exercise their new rights to guaranteed access to individual
    insurance were hindered in some cases by insurance carrier
    practices and pricing as well as by their own misunderstanding of
    the law; * issuers of health coverage, including employers and
    insurance carriers, were concerned about administrative burdens
    and unanticipated consequences of the law, as well as the
    potential for consumer abuse of certain protections; * federal
    regulators faced a greater-than-expected role under HIPAA; and *
    state regulators sought additional guidance in interpreting the
    regulations. 1See Health Insurance Standards: New Federal Law
    Creates Challenges for Consumers, Insurers, Regulators (GAO/HEHS-
    98-67, Feb. 25, 1998), Implementation of HIPAA: State-Designed
    Mechanisms for Group-to-Individual Portability (GAO/HEHS-98-161R,
    May 20, 1998), and Private Health Insurance: HCFA Cautious in
    Enforcing Federal HIPAA Standards in States Lacking Conforming
    Laws (GAO/HEHS-98-217R, July 22, 1998). Page 1
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Since additional
    HIPAA provisions have come into effect over the last year and
    consumers, insurers, employers, and regulators have had an
    additional year to adapt to these requirements, you asked us to
    provide an update on the implementation status of HIPAA provisions
    in the group insurance market;2 the price of coverage for certain
    individuals losing group coverage; the extent of consumer
    understanding of HIPAA as well as federal, state, and private
    efforts undertaken to educate consumers about the law's
    protections; and federal efforts undertaken to ensure HIPAA
    compliance. To provide this information, we visited five states
    and interviewed regulators, carriers, employers, agents, trade
    organizations, and benefit consulting firms. In collaboration with
    the National Association of Health Underwriters (NAHU), we
    surveyed agents to obtain premium quotes in states that are using
    HIPAA's standards to guarantee eligible individuals access to
    individual market coverage and compared these quotes with premium
    data from states using an alternative method to do so. We
    conducted our work between September 1998 and April 1999 in
    accordance with generally accepted government auditing standards.
    Appendix I provides more details about our scope and methodology.
    Results in Brief    Implementation of HIPAA's insurance standards
    in the group market has proceeded relatively smoothly-particularly
    among larger group plans-although carriers and employers continue
    to express some concerns about certain administrative and
    interpretive aspects of HIPAA. This ease of transition has
    occurred partly because many of these group plans had already
    provided key HIPAA protections before the law was enacted, such as
    limits on coverage exclusions for preexisting health conditions.
    However, concerns exist about the extent to which some smaller
    employers are performing certain required tasks, such as issuing
    certificates of creditable coverage. With respect to HIPAA's
    requirement that carriers guarantee access to coverage for certain
    small employers, early evidence suggests experiences vary
    considerably among states, largely depending on the extent of
    state-level reforms that preceded HIPAA. 2An employer may provide
    group coverage to its employees either by purchasing a group
    policy from an insurance carrier (fully insured coverage) or by
    funding its own health plan (self-funded coverage). For more
    information on fully insured and self-funded group coverage, see
    The Employee Retirement Income Security Act of 1974: Issues,
    Trends, and Challenges for Employer-Sponsored Health Plans
    (GAO/HEHS-95-167, June 21, 1995). Individuals without group
    coverage may obtain coverage by purchasing a policy directly from
    a carrier in the individual insurance market. For more information
    on the individual insurance market, see Private Health Insurance:
    Millions Relying on Individual Market Face Cost and Coverage
    Tradeoffs (GAO/HEHS-97-8, Nov. 25, 1996). Page 2
    GAO/HEHS-99-100 HIPAA Implementation B-281547 HIPAA's group-to-
    individual portability provision ensures that certain consumers
    who lose group coverage are guaranteed access to at least two
    individual market insurance products. However, like others in poor
    health, the so-called "HIPAA-eligible" individuals who have
    certain health conditions often pay a higher-than-standard premium
    for individual coverage, although the amount of the premium
    increase varies considerably. All but 3 of the 41 carriers we
    surveyed in states using HIPAA standards would charge a HIPAA-
    eligible with a specified health condition a higher-than-standard
    rate, and nearly half of these would charge 300 to 464 percent of
    the standard rate. The average premium for individual coverage for
    HIPAA-eligibles with a specified health condition that would be
    charged by the 41 carriers was $381 per month. In contrast, the 22
    states that use a high-risk pool as an alternative to the federal
    portability standards limit premiums to 200 percent or less of the
    standard rate, or an average subsidized rate of $221 per month.
    The exact number of individuals who rely on HIPAA's group-to-
    individual portability provision to obtain coverage is difficult
    to determine but appears small according to carrier estimates and
    risk-pool enrollment figures. Consumers' understanding of HIPAA
    remains limited, and many are largely unfamiliar with the law.
    Among those who have heard of HIPAA, many believe it provides
    broader access and protections than it does or are unclear about
    specific provisions. Thus, federal agencies and others have
    targeted educational efforts to specific populations in an attempt
    to reach those most likely to benefit from HIPAA. For example,
    some Health Care Financing Administration (HCFA) regional offices
    are coordinating with state unemployment agencies to ensure that
    individuals who are changing jobs know that, if they previously
    had group coverage, subsequent employers generally cannot exclude
    preexisting conditions from coverage. Moreover, HIPAA requires
    that those losing health coverage receive a certificate that
    documents the length of prior coverage. Certificates that clearly
    explain HIPAA's protections and restrictions would provide
    consumers with the information they need to exercise their
    portability rights. HIPAA established a complex regulatory
    framework in which oversight and enforcement of the law are shared
    among multiple federal agencies and state regulators. While the
    law expanded the Department of Labor's existing oversight
    responsibilities for employer-sponsored health coverage, it
    created a new regulatory role for HCFA. HCFA's enforcement
    efforts, however, have been limited and have focused primarily on
    the states known not to have adopted statutes or regulations that
    fully meet Page 3                                     GAO/HEHS-99-
    100 HIPAA Implementation B-281547 the HIPAA standard. HCFA
    officials attribute their limited involvement to a lack of
    enforcement regulations and insufficient resources. This report
    contains recommendations aimed at better informing consumers of
    their HIPAA rights and improving HCFA's enforcement efforts.
    Background      Title I of HIPAA established standards for health
    coverage access, portability, and renewability that apply to
    employer-sponsored plans in the group market and, to a more
    limited extent, to the individual market.3 Group market provisions
    include * limitations on preexisting condition exclusion periods;
* a requirement that previous coverage be credited to reduce or
    eliminate a new employee's preexisting condition exclusion period;
* restrictions against excluding an employee from the health plan
    on the basis of his or her health status; and * special enrollment
    opportunities for certain employees, such as those who did not
    enroll because they were previously covered under a spouse's
    health plan. With limited exceptions, carriers must renew all
    group coverage at the employer's request, regardless of the health
    status or historic health costs of the employee members. HIPAA
    also requires carriers in the small group market to guarantee
    coverage to all small employers (defined as those with 2 to 50
    employees) that apply. In the individual market, HIPAA guarantees
    that eligible individuals4 losing group coverage have access to at
    least two individual market insurance products. This provision is
    referred to as group-to-individual portability. States may comply
    with this provision using either the federal rules-which require
    individual market carriers to guarantee access to certain
    insurance policies to eligible individuals-or an "alternative
    mechanism." Under an alternative mechanism, states may, within
    broad federal parameters, design other approaches to provide
    eligible individuals 3Some HIPAA standards also apply to certain
    federal, state, and local government insurance programs, such as
    Medicaid, state employee health plans, multiple-employer welfare
    arrangements, church plans, and bona fide associations. 4An
    eligible individual is one who has had at least 18 months of
    creditable coverage with no break of more than 63 consecutive
    days; has exhausted any Consolidated Omnibus Budget Reconciliation
    Act or other continuation coverage available under a similar state
    program; is not eligible for any other group coverage, Medicare,
    or Medicaid; and did not lose group coverage because of nonpayment
    of premiums by the individual or fraud. Page 4
    GAO/HEHS-99-100 HIPAA Implementation B-281547 with a choice of
    coverage. Twelve states are operating under the federal rules, and
    38 are using an alternative mechanism. Of the latter, 22 are using
    a high-risk pool to provide coverage to these eligible
    individuals.5 A high-risk pool is a state entity that offers
    comprehensive health insurance to individuals with preexisting
    health conditions who are otherwise unable to obtain coverage in
    the individual market or who may be able to obtain coverage only
    at a cost-prohibitive rate. (App. II contains a summary of HIPAA
    access, portability, and renewability standards by market
    segment.) HIPAA was signed into law on August 21, 1996, and by the
    end of June 1998, all substantive provisions were effective for
    almost all plans. HIPAA regulations were issued on an interim
    final basis, and federal agencies issued most of the implementing
    regulations on April 8, 1997. Enhancements and clarifications to
    the regulations followed and will continue in 1999. Officials
    expect to finalize HIPAA regulations in 2000. Finally, after HIPAA
    was enacted, three additional federal laws-the Mental Health
    Parity Act (MHPA), the Newborns' and Mothers' Health Protection
    Act, and the Women's Health and Cancer Rights Act (WHCRA)-imposed
    federal standards on private insurance coverage of mental health,
    maternity and newborn, and reconstruction after mastectomy
    benefits.6 Carrier and employer officials we interviewed expressed
    concerns about the lead time given them to comply with HIPAA and
    subsequent federal insurance reforms. The adoption of the new
    standards requires issuers to perform various tasks, including
    educating staff, issuing notices to enrollees, revising premium
    prices and marketing materials, and retooling information systems.
    Carrier officials consistently said that such changes require at
    least 6 months' lead time or, preferably, 1 full year. Regulations
    implementing HIPAA were issued less than 2 months before certain
    provisions became effective, although carriers and employers have
    generally overcome the early start-up hurdles. Neither the MHPA
    nor the WHCRA had statutory provisions that provided for lead
    times of 6 months or more. Although the MHPA was signed into law
    in September 1996, its implementing regulations were not issued
    until December 22, 1997-only 9 days before some group plans became
    subject to the law. Similarly, while the WHCRA was signed into law
    on October 21, 1998, issuers were required to begin issuing
    notices to enrollees less than 3 months later, by January 1, 1999.
    Federal agencies, recognizing the short lead time, provided for a
    5For more details on alternative mechanism approaches adopted by
    these 38 states, see GAO/HEHS-98-161R, May 20, 1998. 6See app. II
    for a description of these laws. Page 5
    GAO/HEHS-99-100 HIPAA Implementation B-281547 period during which
    no MHPA enforcement action would be taken against issuers making a
    good-faith effort to comply. Responsibility for enforcing HIPAA
    standards is divided among three federal agencies and the states.
    The Department of Labor is responsible for ensuring that employer-
    sponsored group health plans comply with HIPAA-an extension of
    Labor's current regulatory role under the Employee Retirement
    Income Security Act of 1974 (ERISA).7 In states that do not adopt
    and enforce statutes or regulations that meet or exceed the HIPAA
    standards, the Department of Health and Human Services-through
    HCFA-is responsible for directly enforcing HIPAA standards for
    carriers in the group and individual markets. The Department of
    the Treasury enforces HIPAA requirements for group health plans by
    imposing an excise tax under the Internal Revenue Code as a
    penalty for noncompliance with the HIPAA standards. In states that
    have standards that conform to HIPAA, state insurance regulators
    have primary enforcement authority over insurance carriers. HIPAA
    Group Market              Notwithstanding early start-up
    challenges, the adoption of HIPAA's group Provisions Have Been
    market access and portability provisions has proceeded relatively
    well-particularly for larger group plans. Noncompliance with these
    Smoothly Adopted                standards may be more common among
    smaller group plans. With respect Overall, but Questions to
    guaranteed coverage for small employers, quantitative evidence
    about the effects of the provision does not yet exist, but early
    evidence suggests Remain About Small              that experiences
    vary considerably among states, in large part on the basis
    Employer Compliance of the extent of pre-HIPAA state reforms.
    Overall, Adoption of            Larger employer plans appear to
    have adopted HIPAA access and portability Access and Portability
    provisions relatively easily. The Director of the Department of
    Labor's Provisions by Larger            health care task force
    said the Department has uncovered no systemic Group Plans Has
    problems in the group market related specifically to HIPAA. A
    senior Labor Proceeded Smoothly              field official told
    us that large employers and insurance companies are generally
    informed about HIPAA and make good-faith efforts to comply,
    although questions of interpretation still arise. The field office
    had no formal investigations related to HIPAA pending at the time
    of our visit in December 1998. Similarly, large employers and
    health benefit consultants 7ERISA allows employers to offer
    uniform national health benefits by preempting states from
    directly regulating employer benefit plans. As a result, states
    are unable to directly regulate self-funded plans, but can
    regulate health insurers. Under ERISA, Labor is responsible for
    assuring that employer-sponsored group health plans meet certain
    fiduciary, reporting and disclosure requirements related to the
    provision of health benefits. Page 6
    GAO/HEHS-99-100 HIPAA Implementation B-281547 we interviewed
    reported few ongoing problems in adopting HIPAA portability
    standards. Many carriers and large employers we interviewed said
    that their health plans tended to require few changes to comply
    with HIPAA. This was probably the case because many large employer
    plans had already incorporated portability protections similar to
    those of HIPAA. For example, many large employers had not excluded
    preexisting conditions from coverage before HIPAA became law. Many
    more have since dropped preexisting condition exclusion periods,
    partly because of the increased complexity of administering them
    under HIPAA. Table 1 shows that less than half of all group plans
    offered by employers with more than 200 employees continue to
    include preexisting condition exclusion periods.8 Further, a large
    midwestern telecommunications company official told us that before
    HIPAA, the company's health plans (1) did not exclude preexisting
    conditions from coverage, (2) did not exclude individuals from the
    plan because of health status, and (3) provided later enrollment
    opportunities for those initially declining coverage. Thus, few
    changes were necessary. Table 1: Percentage of Mid-Size and Large
    Group Plans Using Preexisting      Plan type
    1996                      1998 Condition Exclusion Periods, 1996
    and    Fee-for-service
    62%                     38% 1998
    Preferred provider organization
    70                      47 Point-of-service plan
    49                      23 Source: KPMG Peat Marwick, LLP, Health
    Benefits Surveys in 1996 and 1998. Questions Exist About the
    The degree of compliance with HIPAA portability provisions among
    small Extent of Compliance                     employer group
    plans has not been measured, but health insurance agents Among
    Small Employer                     and regulators suspect
    noncompliance to be more common among these Plans
    plans than among medium and large group plans. Whereas medium and
    large employers rely on carriers, third-party administrators, or a
    health benefits professional staff to implement HIPAA
    requirements, small employers may have fewer resources and may
    rely largely on carriers and agents to learn about changes in
    health benefits required by law. Further, observations made by
    health insurance agents and others suggest that 8While the use of
    preexisting condition exclusion periods has decreased, the length
    of waiting periods for health coverage eligibility has increased.
    KPMG Peat Marwick, LLP, reports that the average number of days
    that must elapse before a new employee is eligible for coverage
    has increased from 39 in 1997 to 57 in 1998. Some attribute this
    indirectly to HIPAA, suggesting that some employers may be
    replacing the preexisting condition exclusion period with a longer
    waiting period. Page 7
    GAO/HEHS-99-100 HIPAA Implementation B-281547 some small employers
    either misunderstand the HIPAA requirements or are entirely
    unaware of them. In addition, several of the agents we surveyed
    volunteered that many of their colleagues do not understand HIPAA.
    An official of a small employer whom we interviewed in California
    told us an anecdote that illustrates this point. The individual
    responsible for human resource issues at this company with about
    80 employees relied exclusively on the company's insurance agent
    to learn about HIPAA's certificate issuance requirement. The agent
    told the human resources staff person that certificates need be
    issued only upon the request of the employee; this is contrary to
    the law, which requires that certificates be issued automatically
    to anyone losing coverage. The discrepancy became apparent only as
    a result of our visit. Moreover, an agent in Florida indicated
    that perhaps 25 percent of her clients, most commonly the smaller
    employers, are not in compliance with one or more HIPAA provisions
    and are not making an effort to comply. Department of Labor
    officials also expressed concern about compliance among smaller
    employers. One field office official said that smaller employers
    know far less than larger employers about HIPAA and are more
    likely to be in violation of it. This field official is
    particularly concerned about small employers that self-fund their
    health plans and do not use the services of a third-party
    administrator. While this arrangement is not common, such
    employers have virtually no contact with health benefits
    professionals and, according to Labor officials, are very likely
    to be uninformed. Officials from another Labor field office noted
    that the Department's experience in overseeing employer pension
    plans suggests that smaller employers are more likely to be in
    violation of requirements than larger employers. New Guarantees of
    The extent to which HIPAA's guaranteed issue provision affects
    market Coverage for Small           access for small employers in
    a given state is largely dependent on the Employers Have Affected
    extent of state reforms preceding HIPAA. Most states had already
    passed States Differently           laws requiring carriers in the
    small group market to guarantee access to at least one health
    insurance plan for any small employer that applied. While most of
    these state laws were more limited than HIPAA, a substantial
    minority were equally or more stringent. * In 13 states, reforms
    that preceded HIPAA required all products in the small group
    market to be guaranteed to be accessible to all small employers,
    just as HIPAA now does. Moreover, these states defined a small
    employer at Page 8                                      GAO/HEHS-
    99-100 HIPAA Implementation B-281547 least as inclusively as
    HIPAA. Therefore, HIPAA imposed virtually no changes in the way
    small group coverage is sold in these states. * In 26 states,
    existing reforms included small group market guaranteed issue
    provisions that were more limited than the HIPAA provisions.
    Often, state reforms defined small employers as having 3 to 25
    employees, as opposed to HIPAA's 2 to 50 employees. These states
    also imposed the guaranteed issue provision on fewer health plans.
    Thus, in these states, HIPAA's impact was to modify, to varying
    degrees, the existing regulations. * In 11 states and the District
    of Columbia, a guaranteed issue provision applicable to all
    carriers did not exist in the small group market. Here HIPAA
    imposed significant changes on the regulation of the small group
    market. Figure 1 shows the requirements of the 50 states and the
    District of Columbia for small group guaranteed issue coverage
    before HIPAA. Page 9                                    GAO/HEHS-
    99-100 HIPAA Implementation B-281547 Figure 1: Summary of State
    Small Group Guaranteed Issue Requirements Predating HIPAA Notes:
    Michigan requires its BlueCross BlueShield plan to guarantee
    coverage to groups of one or more. Hawaii is the only state with
    mandated employer-sponsored health insurance. Virtually all
    employed individuals in Hawaii are guaranteed access to health
    insurance through their employer. The effects of HIPAA's small
    group market guaranteed issue provision on cost and access to
    coverage have not been evaluated, and, among the Page 10
    GAO/HEHS-99-100 HIPAA Implementation B-281547 health insurance
    agents we surveyed, observations on its effects varied widely.
    Asked a general question about the effects of the provision, 46
    percent of the agents we surveyed in states where existing
    guaranteed issue reforms were more limited than HIPAA's said that
    access had improved: for example, the choices of products
    available to small employers had increased. Agents also noted
    that, because every small employer has access to every small group
    product on the market, employers are better able to compare
    carriers' products and rates. Conversely, 44 percent of the agents
    said that HIPAA had not improved access for small groups.9 Many
    agents observed that while access is now guaranteed to groups that
    were previously excluded from coverage-high-risk groups-these
    groups may be unable to afford the available coverage. Carrier
    representatives we interviewed generally corroborated agent
    observations concerning increased comparison shopping by agents
    among all carrier products and high premiums for high-risk groups.
    Several carrier representatives said that small group market
    premiums have risen overall, but these representatives could not
    determine what proportion of the increase might be attributable to
    HIPAA's guaranteed issue provision. Several carrier officials also
    pointed out that the guaranteed issue requirement limits carriers'
    flexibility in designing benefit plans. Because every plan offered
    must be available to every small employer group, these carriers
    have reduced the number of plans they offer and are less able to
    customize plans to specific groups. Further, one carrier was
    concerned that very small employer groups might change health
    plans to obtain certain benefits, such as maternity coverage, when
    one or more individuals in the group needed that coverage. Another
    carrier cited concerns that very small groups tend to obtain
    coverage only when it becomes apparent that it will be needed.
    HIPAA Has Improved              HIPAA's group-to-individual
    portability provision ensures that people who Access, but Not
    Price,          are losing group coverage are guaranteed access to
    at least two individual market products, although these
    individuals, if in poor health, will for Certain Individuals
    probably pay more than the standard rate. The amount of the
    premium Losing Group                    increase varies
    considerably. Our survey showed that in states using the federal
    rules, an individual in poor health would usually pay a premium
    Coverage                        greater than 200 percent of the
    standard rate, while in states using a high-risk pool, the
    increase was never greater than 200 percent of the 9The total of
    these percentages does not equal 100 because a number of agents we
    surveyed did not know if HIPAA had affected small groups' access
    to health insurance in their respective states. Page 11
    GAO/HEHS-99-100 HIPAA Implementation B-281547 standard rate. The
    exact number of individuals relying on this portability right to
    obtain coverage is difficult to quantify but appears small. HIPAA-
    Eligibles With                      HIPAA does not limit the
    premium price carriers may charge eligible Health Problems
    Generally                 individuals for coverage. Thus, premiums
    charged to individuals eligible Pay Higher-Than-Standard
    for coverage under HIPAA, especially those in poor health, are
    often Premiums                                  substantially
    higher than carriers' standard rates-the rates healthy individuals
    pay. The extent of the increase in the premium rate is largely
    dependent upon whether a state restricts the amount carriers can
    vary premium rates and on the state's approach to complying with
    HIPAA's group-to-individual portability provision. Our premium
    survey of selected carriers in states using federal rules to
    guarantee group-to-individual portability under HIPAA10 showed
    that a particular individual eligible for HIPAA, with a
    preexisting condition,11 would be charged between 100 and 464
    percent of the standard rate for a commonly sold product. In terms
    of monthly premiums, the rates quoted ranged from as low as $149
    for a health maintenance organization (HMO) product in California
    to $951 for a preferred provider organization (PPO) product with a
    $500 deductible in the District of Columbia. As table 2 shows, the
    premium quotes provided by almost half of the carriers for this
    individual were 300 percent or more of their standard rates. Table
    2: Comparison of Selected Carriers' Standard Monthly Premiums With
    Carriers' Monthly Premiums for a HIPAA-Eligible With a Specified
    Health Condition Standard                     Monthly Increased
    premium Plan type/             monthly                premium for
    as percentage of State                       Insurer number
    deductible level           premium              HIPAA-eligible
    standard premium Arizona                                   1
    PPO/$500                  $104                         $416
    400 2                   PPO/500                    102
    306                           300 3                   PPO/500
    125                         501                           401 4
    PPO/500                    133                         266
    200 5                   PPO/500                     94
    187                           199 Californiaa
    6                 PPO/2,000                    127
    395                           311 7                 PPO/1,000
    192                         494                           257
    (continued) 10Although Hawaii also uses the federal rules, we were
    unable to obtain premium quotes from agents in the state. In
    addition, other states and the District of Columbia are using an
    alternative mechanism that essentially incorporates the federal
    rules. For this reason, we included Virginia and the District of
    Columbia in the premium survey. We included Michigan in the survey
    because before Mar. 1999, at which time it passed conforming
    legislation, it was using the federal rules to guarantee HIPAA's
    group-to-individual portability. 11A 43-year-old, nonsmoking male
    with juvenile-onset diabetes. Page 12
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Standard
    Monthly Increased premium Plan type/     monthly         premium
    for     as percentage of State                   Insurer number
    deductible level    premium       HIPAA-eligible standard premium
    8                 PPO/1,000          121                 452
    374 9                     HMO/0          153                 268
    175 10                     POSb/0         181                 317
    175 11                     HMO/0          149                 149
    100 12                     HMO/0          241                 590
    245 Coloradoa                          13
    PPO/500           96                 288                    300 14
    PPO/500          142                 426c                   300 15
    PPO/500          129                 387c                   300 16
    HMO/0          141                 170                    121 17
    PPO/500          137                 411                    300
    Delaware                           18                   PPO/500
    212                 636                    300 19
    Indemnity/1,000         132                 396
    300 District of Columbia               20
    PPO/500          317                 951                    300
    Maryland                           21              Indemnity/400
    130                 166                    128 Massachusetts
    22                     HMO/0          288                 288
    100 23                   PPO/250          332                 332
    100 Michigan                           24
    PPO/500           90                 180                    200 25
    PPO/500          223                 669                    300
    Missouria                          26                   PPO/300
    174                 374                    215 27
    HMO/0          107                 231                    216 28
    HMO/0          108                 216                    200 29
    PPO/250          184                 202                    110
    North Carolina                     30                   PPO/500
    114                 228                    200 31
    PPO/500          127                 247                    194 32
    Indemnity/500         147                 287
    195 Rhode Island                       33
    Indemnity/500         269                 807
    300 Tennesseed                         34
    Indemnity/500         171                 323
    189 35                   PPO/500          148                 443
    299 36                   PPO/500          134                 402
    300 37                   PPO/500          207                 621
    300 Virginia                           38
    Indemnity/300         128                 227
    177 39                   PPO/300          104                 473
    455 40                   PPO/750          100                 464
    464 West Virginia                      41
    PPO/500          143                 429                    300
    (Table notes on next page) Page 13
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Note: Carriers
    provided premium quotes based on the information provided by the
    insurance agents. Acceptance in the plan and actual premiums would
    be contingent upon verification of this information. aCertain
    individuals in poor health may also obtain coverage through a
    state high-risk pool or other program, although a waiting period
    or preexisting condition exclusion period may be imposed. bPoint-
    of-service plan. cPremium for HIPAA-eligible in poor health
    estimated by NAHU. dTennessee residents in poor health may also
    obtain coverage through the TENNCARE program. Source: GAO analysis
    of NAHU survey data. As the table demonstrates, carriers in these
    states almost always charge an individual in poor health who is
    eligible for coverage under HIPAA a higher-than-standard monthly
    premium, which is similar to what unhealthy people without HIPAA
    portability rights experience if accepted for individual coverage
    in states without premium rate restrictions. Before HIPAA,
    however, many unhealthy people in these states could have been
    rejected outright for any type of individual private health
    insurance or could have faced an exclusion for their preexisting
    condition. In the 22 states using a high-risk pool as an
    alternative mechanism,12 individuals in poor health who are HIPAA-
    eligible also pay a higher premium, although the amount of the
    increase is generally less than in the states using federal rules,
    because the risk-pool coverage is subsidized. All 22 states using
    their high-risk pool as an alternative mechanism impose a premium
    cap for coverage in the pool of 200 percent of the standard rate
    or less, and about half cap premiums at 150 percent of the
    standard rate or less. The actual cost of covering these
    individuals is subsidized, most commonly by assessments on
    carriers. In several of these states, this assessment is offset
    against state premium or income taxes. As table 3 indicates,
    monthly premiums for the same individual discussed above for the
    most commonly sold product in each state ranged from $107 for a
    $1,000 deductible, fee-for-service plan in Minnesota to $336 for a
    $1,000 deductible, PPO plan in Louisiana.13 These premiums in
    about half of the 22 states were below $200 and between $200 and
    $336 in the other half. 12States using their high-risk pool as an
    alternative mechanism cannot subject individuals eligible for
    coverage under HIPAA to enrollment waiting periods or preexisting
    condition exclusion periods. 13In seven states that vary premium
    rates for geographic location, we used the rate charged in an
    urban area. Monthly premiums in the rural areas of these states
    were between $5 and $96 less. Page 14
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Table 3: Monthly
    Premium for a HIPAA-Eligible With Juvenile-Onset
    Monthly Diabetes in Urban Areas of States     State
    premium Using a High-Risk Pool as an          Alabama
    $215 Alternative Mechanism                 Alaska
    292 Arkansas
    168 Connecticut
    255 Illinois
    283 Indiana
    200 Iowa
    270 Kansas
    239 Louisiana
    336 Minnesota
    107 Mississippi
    239 Montana
    179 Nebraska
    124 New Mexico
    236 North Dakota
    227 Oklahoma
    228 Oregon
    182 South Carolina
    249 Texas
    198 Utah
    254 Wisconsin
    200 Wyoming
    190 Few People Rely on                    The number of people
    that rely on HIPAA's group-to-individual portability HIPAA's
    provision to obtain coverage is difficult to quantify,
    particularly in states Group-to-Individual                   using
    the federal rules and states using an alternative mechanism other
    Portability Provision                 than a high-risk pool. In
    these states, carriers and state entities have not undertaken a
    systematic effort to count these individuals. However, in states
    using the federal rules, each of three national carriers estimated
    it had HIPAA enrollment of fewer than 200 individuals. In
    contrast, most states that use a high-risk pool as an alternative
    mechanism are able to separately track the enrollment of people
    eligible for coverage under HIPAA. Enrollment data suggest that
    the number of individuals relying on their HIPAA portability
    rights in these states is also relatively low. In 20 states that
    track HIPAA enrollment, approximately 6,500 HIPAA-eligibles are
    enrolled in the risk pools-or about 10 percent of the Page 15
    GAO/HEHS-99-100 HIPAA Implementation B-281547 total risk-pool
    enrollment of over 63,000. Further, high-risk-pool enrollment
    reaches 1,000 HIPAA-eligibles in only two states. Limited Consumer
    Consumer awareness and understanding of HIPAA remain limited, and
    Awareness and               those who have heard of the law often
    believe it provides broader access and protections than it does.
    Consumers who are unfamiliar with HIPAA Understanding of
    may not receive the law's protections or may make poor choices.
    HIPAA May Constrain         Consequently, federal agencies and
    other entities have undertaken educational efforts that target
    specific populations-such as those Benefit to Consumers
    changing jobs or losing group coverage-in an attempt to reach
    those who are most likely to benefit from HIPAA's protections.
    Consumers Lack a Clear      In February 1998, we reported that
    many consumers misunderstood HIPAA Understanding of HIPAA      and
    believed that the federal law provided broader access and
    protections than it actually does.14 Over 1 year later, most
    consumers are still largely unfamiliar with the law, according to
    agents, carriers, and state regulators. Sixty-five percent of the
    agents we surveyed indicated that their clients do not understand
    HIPAA and often approach the agents with questions. Similarly,
    several carriers and a third-party administrator we interviewed
    agreed that consumers know little about the law. For example,
    insurance regulators from two states told us that although
    consumers may have a vague understanding that HIPAA provides
    certain health care rights, most consumers are still unaware of
    specific HIPAA provisions. Consumers often misunderstand (1) the
    restrictions HIPAA imposes on former group enrollees' guarantee of
    access to individual market coverage and (2) HIPAA's definition of
    portability. First, for a former group enrollee to be eligible for
    individual market coverage under HIPAA, the individual must * have
    had at least 18 months of creditable insurance coverage (the most
    recent coverage must have been through a group) with no break of
    more than 63 consecutive days; * have exhausted any Consolidated
    Omnibus Budget Reconciliation Act (COBRA) or other continuation
    coverage available; * not be eligible for any other group
    coverage, or for Medicare or Medicaid; and * not have lost group
    coverage because of nonpayment of premiums or fraud. 14GAO/HEHS-
    98-67, Feb. 25, 1998. Page 16
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Consumers continue
    to misunderstand these restrictions, according to agents and
    carrier officials. For example, one of the agents we surveyed said
    that out of 10 applications he received for individual coverage
    from former group enrollees, only 3 qualified for a HIPAA-
    guaranteed access product. The remaining seven were ineligible for
    such reasons as failing to select or exhaust COBRA or having a
    lapse in coverage of more than 63 days. Similarly, data provided
    by a large carrier suggest that over a quarter of all applicants
    for HIPAA portability coverage in 1998-61 of 231-were denied
    because they did not meet one or more of these eligibility
    criteria. Second, consumers commonly misunderstand the scope of
    HIPAA's protections and its definition of portability. According
    to agents we surveyed, a number of consumers mistakenly believe
    that HIPAA guarantees access to individual insurance coverage for
    everyone, including those previously uninsured. Others believe
    HIPAA eliminates the use of preexisting condition exclusion
    periods altogether. Still others believe that portability allows
    them to carry their current health benefits with them when they
    change or lose jobs, according to regulators. In reality,
    portability under HIPAA is much more limited and simply means that
    once an individual has health coverage, time spent under that
    coverage may be used to reduce or eliminate any preexisting
    condition exclusion imposed by a subsequent employer's health
    plan. Uninformed Individuals             Consumers and small
    employers may not receive HIPAA protections if they Who Lose Group
    Coverage            do not know they exist and may make poor
    choices based on ignorance. or Change Jobs Risk
    Although HIPAA may affect relatively few people at any given
    point, a clear Losing Certain Protections         understanding of
    their rights is imperative for eligible individuals. The following
    scenarios describe hypothetical cases in which consumers who
    qualified for HIPAA protections were not aware of their rights and
    were unable to take advantage of the law's protections. Scenario
    One:                      Employee A has chronic asthma and
    decided to quit her job to become Group-to-Individual Portability
    self-employed. Although she received a certificate of creditable
    coverage and a notice from her prior employer's health plan
    administrator explaining her COBRA continuation-of-coverage
    rights, she declined COBRA because she perceived it to be
    expensive and she had heard that HIPAA provided a guarantee of
    access to coverage in the individual market. Several months later,
    she approached an agent to obtain coverage. She learned that
    because she had not elected COBRA and more than 63 days had
    elapsed since her group coverage expired, she was ineligible for a
    HIPAA Page 17                                    GAO/HEHS-99-100
    HIPAA Implementation B-281547 group-to-individual portability
    product. The agent told her that consequently, most carriers would
    reject her application for coverage because of her health
    condition. Moreover, if she obtained coverage, carriers would
    exclude coverage for her preexisting condition for 1 year.
    Scenario Two: Group-to-Group    Employee B has chronic back
    problems and had been continuously Portability
    insured through his company's health plan for the past 5 years.
    During his first 12 months of coverage, all expenses associated
    with treating his costly back condition were excluded. Employee B
    changed jobs but never received a certificate of creditable
    coverage and was not otherwise aware of HIPAA's portability
    rights. Without this certificate, which would have documented
    Employee B's previous coverage, the new employer applied a
    preexisting condition exclusion to Employee B, not covering any
    costs associated with treating his back condition for another full
    year. Therefore, Employee B incurred an additional year of medical
    costs for a health condition for which he had previously fulfilled
    the maximum allowable waiting period. Despite Multiple
    Recognizing that many consumers do not understand their rights
    under Efforts, Uncertainty            HIPAA, employers, federal
    agencies, and others have undertaken, to varying degrees, efforts
    to inform consumers about their rights under HIPAA. Remains About
    How               Although several employers question the value of
    extensive education Best to Educate                 efforts, most
    have external and internal resources available to respond to
    consumer inquiries. In addition, federal, state, and other
    entities are Consumers About                 attempting to better
    target consumer education efforts to individuals who HIPAA
    are experiencing a transition in employment so these individuals
    have access to relevant information when they need it. Employers
    Question the          The extent of employer educational efforts
    varies, depending largely on Need for Widespread             the
    size of the employer and the resources available. Officials of
    several Educational Efforts             multistate employers said
    that their health plans already included many of HIPAA's
    protections, and an official from one of these employers said that
    efforts to provide employees with information specific to HIPAA
    would only generate confusion. Consequently, in some cases,
    employers have simply amended their summary plan descriptions to
    include HIPAA protections and refer employees to this document
    when they have questions about their coverage. An official from
    one employer believes more extensive educational efforts are not
    an efficient use of resources, since HIPAA only affects employees
    in transition. Some employers noted that their human resources
    personnel can answer employee questions or conduct Page 18
    GAO/HEHS-99-100 HIPAA Implementation B-281547 interviews with
    exiting employees, at which time they can explain HIPAA and other
    federal laws. Some officials emphasized that just as it took
    several years for consumers to become familiar with COBRA
    protections, it will take some time for employees to understand
    their rights under HIPAA. Smaller employers tend to rely on their
    carriers or their agents to resolve questions and to educate them
    about changes in federal law. Carriers we interviewed have amended
    their contracts to comply with the law and have customer service
    representatives available to answer questions. Further, many
    carriers have issued notices and educational materials to clarify
    areas of confusion and to explain HIPAA's requirements to plan
    enrollees. Federal, State, and Other    Officials at both the
    Department of Labor and HCFA said that they are Efforts That
    Target          attempting to better target consumer education
    efforts to individuals who HIPAA-Eligibles Are Under    are
    experiencing a transition in employment so that these individuals
    will Way                          have access to relevant
    information when they need it. For example, the Worker Adjustment
    and Retraining Notification Act, among other things, requires any
    employer who intends to order a plant closing or mass layoff to
    notify state dislocated worker units. Labor has encouraged its
    regional offices to participate in state dislocated worker
    programs, allowing Department officials to provide educational
    materials directly to those individuals in transition. Labor's
    regional offices are also encouraged to meet with state insurance
    departments to discuss HIPAA and other federal laws. Through its
    education outreach program, Labor has conducted presentations
    about the law to employers and health associations. Although HCFA
    does not yet have a coordinated outreach program, the two regional
    offices we visited plan to coordinate with state programs by
    distributing HIPAA informational materials at selected sites, such
    as unemployment, Social Security, and Railroad Retirement Board
    offices, where people in employment transition often go. Finally,
    both agencies have Internet sites that contain HIPAA
    information,15 have customer service representatives to answer
    questions, and make educational publications available. States
    have also undertaken a variety of efforts to better educate
    consumers about HIPAA, although the extent of these efforts varies
    among states. At least 20 states have developed consumer
    information materials 15See the Department of Labor's HIPAA
    information at http://www.dol.gov/dol/pwba/public/health.htm; see
    HCFA's HIPAA information at http://www.hcfa.gov/hipaa/hipaahm.htm.
    Page 19                                               GAO/HEHS-99-
    100 HIPAA Implementation B-281547 that address HIPAA provisions.
    For example, insurance department officials in Montana have
    conducted training seminars for agents, large employers, and
    provider groups, and Oklahoma has incorporated HIPAA information
    in its continuing education requirement for agents. In addition, a
    number of states that use their high-risk pool as an alternative
    mechanism, such as Illinois, have undertaken educational efforts
    to inform the public about the availability of coverage through
    the pool. Also, two of the states we visited require carriers to
    notify consumers whom they decline to cover about the availability
    of coverage through the pool. In contrast, regulators in
    California do not believe they have an obligation to inform
    consumers about changes in federal law, and they emphasized that
    their primary mission is to regulate insurers. Finally, all of the
    states we visited have customer service personnel who are
    available to answer consumer inquiries related to HIPAA or to
    refer these questions to the appropriate federal authorities.
    Other entities are also conducting an assortment of educational
    efforts. Employee benefits consulting firms have assembled
    educational materials on HIPAA and have sponsored training
    seminars for employers. Also, Georgetown University's Institute
    for Health Care Research and Policy has prepared a consumer guide
    for each state that explains the protections available to
    individual consumers and small businesses under HIPAA and state
    insurance laws.16 Certificates of Creditable    As noted above,
    HIPAA requires carriers and employers to issue a certificate
    Coverage Could Be Used        of creditable coverage that
    documents the length of prior coverage to all to Educate Consumers
    individuals losing health coverage. To help issuers comply with
    this About Their HIPAA Rights      requirement, federal agencies
    developed a model certificate that was published in the Federal
    Register and is available electronically on HCFA and Labor's
    Internet sites. Several issuers we interviewed have essentially
    adopted the model certificate, which, in part, requires
    information about (1) the date coverage began, or a statement that
    an individual has at least 18 months of creditable coverage, and
    (2) the date coverage ended, or whether coverage is continuing,
    such as through COBRA. (The model certificate is included as app.
    V.) As an educational tool, however, the model certificate has
    limitations. First, it does not explicitly inform consumers that
    they may have a group-to-individual portability right, nor does it
    highlight any of the 16The consumer guides are available on
    Georgetown University's Internet site,
    http://www.georgetown.edu/research/ihcrp/hipaa (cited Mar. 23,
    1999). A consumer guide is not yet available for Massachusetts.
    Page 20                                                GAO/HEHS-
    99-100 HIPAA Implementation B-281547 restrictions placed on this
    right. Second, the certificate does not explicitly inform
    consumers changing jobs that they may not have to fulfill another
    preexisting condition period under their subsequent employer's
    health plan. Consequently, consumers who receive certificates may
    not understand their purpose and may discard them, never realizing
    their connection to HIPAA's access and portability rights. The
    experiences of employers and carriers seem to indicate that this
    is indeed the case: according to employer and carrier estimates,
    few enrollees have a certificate at the time they apply for
    coverage either because they discarded the certificate provided by
    a prior employer or carrier or never received one. Carriers and
    employers continue to question the value of certificates for
    proving creditable coverage. They point out that since most
    enrollees do not have a certificate, the law requires carriers and
    employers to otherwise verify prior coverage, as was generally the
    practice in states with portability laws predating HIPAA.
    Moreover, carriers and employers assert that since most employer
    plans no longer include preexisting condition exclusion clauses,
    most of the certificates issued are not needed. Finally, employers
    and carriers indicated that the cost and administrative resources
    needed to issue a certificate to every departing enrollee pose a
    significant burden. Carriers and employers would prefer to issue
    certificates on demand-that is, to only those who request them.
    Nevertheless, HIPAA currently requires that certificates be issued
    to all individuals losing health coverage. Individuals who clearly
    understand their rights under the law are better able to make use
    of its protections. Regulatory authorities we interviewed agreed
    that certificates that clearly delineate a consumer's rights, and
    the restrictions placed on these rights, could serve as an
    important educational tool and increase the likelihood that
    consumers in transition have the information they need to take
    advantage of their HIPAA rights. HIPAA Established    HIPAA
    established a complex regulatory framework in which oversight and
    New Federal          enforcement of the law are shared among
    multiple federal agencies and state regulators. While the law
    essentially expanded Labor's existing Regulatory
    oversight responsibilities under ERISA, it created a new
    regulatory role for Responsibilities     HCFA. Thus far, HCFA's
    enforcement efforts have been limited. Page 21
    GAO/HEHS-99-100 HIPAA Implementation B-281547 HIPAA Expanded
    Labor's          Under ERISA, Labor is responsible for ensuring
    that employer-sponsored Oversight Responsibilities      group
    health plans meet certain fiduciary, reporting, and disclosure
    Under ERISA                     requirements related to the
    provision of health benefits. Labor's approach to identifying
    noncompliance among ERISA plans has been largely complaint-driven,
    and investigative and enforcement efforts tend to focus on firms
    from which patterns of employee complaints are received. HIPAA
    significantly expanded the complexity of Labor's health plan
    oversight role: Labor is now also charged with ensuring that
    employer plans comply with access and portability standards. While
    its role in overseeing ERISA plans has expanded, Labor continues
    to rely on consumer complaints to identify noncompliance. However,
    recognizing the increased complexity of its role brought about by
    HIPAA and other federal insurance laws, Labor has attempted to
    enhance its customer service function and undertake other
    oversight improvements, as discussed below. Expanding and
    Decentralizing    Before 1996, Labor's customer service function
    was centralized in Customer Service Staff          Washington,
    D.C. The Department has decentralized customer service staff to
    its field offices in an effort to be more responsive to employers
    and employees. In addition, Labor has increased the number of
    staff dedicated to this purpose. In 1998, Labor added about 9
    customer service staff-years to its 1997 levels and will add up to
    23 additional staff-years during 1999. (App. III describes the
    resources Labor estimates it has used in the implementation of
    HIPAA.) Better Educating Customer       The customer service staff
    position has evolved from an Service Staff
    administrative/clerical position to that of a paraprofessional or
    professional. Labor's eventual goal is to have all customer
    service positions filled by college-educated professionals.
    Improving Tracking of HIPAA     The national question/complaint
    tracking system has been enhanced to Questions/Complaints
    better capture information related specifically to HIPAA. Whereas
    all HIPAA-related questions and complaints were captured under a
    single category before October 1998, they are now differentiated
    into separate categories relating to their specific nature.
    Including HIPAA Compliance      Labor is developing a series of
    HIPAA compliance review steps to be added Reviews During Employer
    to guidelines it uses in investigating employers. These review
    steps will be Investigations                  followed regardless
    of the reason for the investigation. Page 22
    GAO/HEHS-99-100 HIPAA Implementation B-281547 HIPAA Created a
    Broad       Whereas Labor was able to build upon an existing
    regulatory role, HIPAA New Regulatory Role for     created broad
    new regulatory responsibilities for HCFA. In states that do HCFA,
    but Agency Efforts    not adopt and enforce statutes or
    regulations that meet or exceed HIPAA Have Been Limited
    standards, HCFA is responsible for directly enforcing them. To do
    this, HCFA has had to assume responsibilities typically undertaken
    by state insurance regulators, such as providing guidance to
    carriers, reviewing carrier policy forms, and monitoring carrier
    marketing practices. To date, HCFA's regulatory and enforcement
    activities have been limited primarily to the five states known
    not to have passed statutes or regulations that fully conform to
    HIPAA: California, Massachusetts, Michigan, Missouri, and Rhode
    Island.17 Further, the extent of HCFA's efforts within four of the
    five states remains limited, still consisting largely of
    responding to consumer queries and complaints. Also, HCFA has yet
    to comprehensively evaluate the extent to which the other 45
    states conform to HIPAA. We reported in July 1998 that the extent
    of HCFA's efforts in the direct enforcement states varied.18 For
    example, in California, Missouri, and Rhode Island, HCFA developed
    guidance that delineated state and federal regulatory
    responsibilities; HCFA also held informational meetings with
    carriers in Missouri and Rhode Island. Further, while HCFA had
    begun to review carriers' policies sold in Missouri to ensure
    compliance, it had not initiated any regulatory activities beyond
    responding to consumer inquiries and complaints in Massachusetts
    and Michigan. Since that report, the extent of HCFA's enforcement
    efforts has not dramatically changed; however, HCFA has awarded
    three external contracts to assist in enforcement tasks, and
    regional officials have held informational meetings in
    California.19 Enforcement efforts in the direct enforcement states
    remain largely complaint driven except for policy reviews in
    Missouri where carriers voluntarily submit policies for review.
    Further, HCFA has not determined the extent to which the remaining
    states have passed conforming legislation, and regional officials
    said they are just beginning to determine how they can identify
    any gaps in state laws and what their role should ultimately be in
    states in which gaps are identified. Although evidence suggests
    that most of these states have standards in place that meet or
    exceed HIPAA requirements, isolated gaps are likely to remain. For
    example, several officials noted that many states have not
    17Michigan passed conforming legislation for its individual market
    in Mar. 1999. 18See GAO/HEHS-98-217R, July 22, 1998. 19HCFA
    devoted $1.7 million of its $2.2 million FY 98 supplemental budget
    allocation to contracts that assist the agency in its enforcement
    efforts. The three major contracts address HIPAA enforcement
    options ($98,200); actuarial support ($615,228); and market
    conduct ($685,650). Page 23
    GAO/HEHS-99-100 HIPAA Implementation B-281547 adopted the
    certificate of creditable coverage issuance requirement or a
    definition of a small group that is consistent with HIPAA's.
    HCFA's Enforcement           HCFA officials acknowledge that the
    agency has thus far pursued a Efforts Have Been Slowed
    minimalist approach to regulating under HIPAA and largely
    attribute their by Issues Surrounding Its    limited efforts to a
    lack of enforcement regulations and insufficient staff Regulatory
    Authority         capacity.20 While HIPAA provides for a civil
    monetary penalty for noncomplying carriers, the statute is largely
    silent about the standards and processes by which HCFA will carry
    out its regulatory role in states. According to agency officials,
    the enforcement regulations will clearly delineate these standards
    and processes to the regulated community, thereby enhancing HCFA's
    ability to carry out necessary enforcement actions. Although
    officials had anticipated publishing the regulations by late 1998,
    they remain unpublished. HCFA officials also attribute their
    limited efforts to insufficient staff capacity. When HIPAA was
    originally passed, the Congress did not provide any additional
    resources for HCFA to implement the provisions of the law. Thus,
    the agency initially reassigned staff from other functions to
    assist in HIPAA's implementation. HCFA did receive a supplemental
    appropriation of $2.2 million in May 1998. Although these funds
    allowed the agency to hire and train 22 additional regional staff,
    including some who have specialized expertise in health insurance,
    they were not sufficient to allow the agency to move forward with
    the "full range of HIPAA enforcement activities," according to the
    HCFA Administrator. Given the current level of resources, HCFA
    intends to focus on (1) completing the enforcement regulations and
    (2) conducting direct enforcement responsibilities in the states
    that have not passed conforming legislation. According to agency
    officials, HCFA has not begun to review the insurance laws of the
    remaining states to determine compliance with HIPAA. (App. IV
    describes the resources HCFA estimates it has used in the
    implementation of HIPAA.) Conclusions                  Since our
    February 1998 report, progress has continued in implementing
    HIPAA. The law's provisions, which were intended to improve
    consumers' access to private health insurance, are now applicable
    to nearly all group and individual private health plans.
    Consequently, minimum standards of 20The Paperwork Reduction Act
    also constrained HCFA's ability to carry out certain oversight
    functions. Page 24
    GAO/HEHS-99-100 HIPAA Implementation B-281547 protection now apply
    to group (both fully insured and self-funded) and individual
    insurance coverage sold in all states. As a result of these new
    federal standards * many consumers face fewer preexisting
    condition exclusions, * enrollees should be able to more easily
    renew their health plans, * employees may not be excluded from
    group health plans on the basis of their health status, * small
    employers must have guaranteed access to all coverage sold in the
    small group market, and * high-risk individuals losing group
    coverage may have better access to either individual health
    insurance or a subsidized high-risk pool. Nonetheless, some
    concerns persist. High-risk individuals and some small groups may
    continue to face high premiums for guaranteed coverage because
    HIPAA does not constrain carriers' rating practices beyond
    existing state laws. Partly because of this, relatively few
    eligible high-risk individuals who lost group coverage appear to
    have purchased HIPAA-guaranteed individual insurance. Consumers'
    lack of awareness or understanding of HIPAA can in some cases
    impede their ability to exercise the rights afforded by the law.
    Federal agencies and others are attempting to target education
    efforts at consumers in employment transition, but such efforts
    could take years, as was the case with educating consumers about
    COBRA. One potentially effective education tool is the
    certificates of creditable coverage that the law requires be
    issued to every enrollee who loses insurance coverage. The
    certificates' value as an educational tool, however, is diminished
    because model guidance on these certificates does not explicitly
    and comprehensively outline the protections provided by HIPAA.
    Finally, both HCFA and Labor have become better equipped over the
    last year to oversee compliance with HIPAA. Nonetheless, both
    agencies recognize that further efforts are needed, including
    targeting consumer education efforts; proactively ensuring
    employers' compliance; and, for HCFA, ensuring that all states'
    insurance regulations fully conform with the federal standards.
    Moreover, HCFA recognizes that its ability to fully perform its
    new regulatory role will be enhanced when enforcement regulations
    are issued. Until HCFA issues these regulations, its efforts to
    guarantee consumers in all states the protections to which they
    are entitled under HIPAA may be hindered. Page 25
    GAO/HEHS-99-100 HIPAA Implementation B-281547 Recommendations to
    We recommend that HCFA and the Department of Labor revise the
    model the Administrator of             certificate of creditable
    health plan coverage to more explicitly inform consumers of their
    new rights under HIPAA. At a minimum, the model the Health Care
    certificate should inform consumers about appropriate contacts for
    Financing                        additional information about
    HIPAA and highlight key provisions and restrictions, including
    Administration and the Secretary of Labor * the limits on
    preexisting condition exclusion periods and the guaranteed
    renewability of all health coverage, * the reduction or
    elimination of preexisting condition exclusion periods for
    employees changing jobs, * the prohibition against excluding an
    individual from an employer health plan on the basis of his or her
    health status, and * the guarantee of access to insurance products
    for certain individuals losing group coverage and the restrictions
    placed on that guarantee. Also, to ensure that HCFA is able to
    fully perform its new oversight role under HIPAA, we recommend
    that the agency promptly promulgate enforcement regulations.
    Agency Comments                  HCFA and the Department of Labor
    commented on a draft of this report and and Our Response
    generally agreed with our findings and recommendations. Both HCFA
    and Labor highlighted recent initiatives to increase outreach and
    oversight related to HIPAA. For example, the Director of Labor's
    Health Care Task Force, Pension and Welfare Benefits
    Administration, noted that additional outreach efforts have been
    initiated through partnerships with consumer, labor, and business
    organizations and that additional materials have been developed to
    support the agency's consumer service staff and investigators. For
    its part, HCFA noted that it has recently hired a new director
    with expertise in insurance regulation to oversee HIPAA
    enforcement, submitted the agency's enforcement regulation for
    review by the Office of Management and Budget, and expanded the
    agency's review of insurers' policy forms. HCFA also noted that it
    has begun to review states' conformance with HIPAA's provisions
    and intends to initiate market conduct exams. In addition, HCFA
    commented that our report should have emphasized some of the
    agency's efforts since February 1998, such as obtaining additional
    funding and staff resources. We addressed HCFA's fiscal year Page
    26                                   GAO/HEHS-99-100 HIPAA
    Implementation B-281547 1998 supplemental appropriation and the
    agency's hiring of additional regional staff in our July 1998
    report, as well as on pages 23 and 24 of this report. Both
    agencies also provided technical comments, which we have
    incorporated as appropriate. Appendix VI contains the comment
    letter from HCFA. As agreed with your office, unless you publicly
    announce its contents earlier, we plan no further distribution of
    this report until 30 days after its issue date. At that time, we
    will send copies to the Honorable Nancy-Ann Min DeParle,
    Administrator of the Health Care Financing Administration; the
    Honorable Alexis M. Herman, Secretary of Labor; and other
    interested congressional committees and members and agency
    officials. We will also make copies available to others upon
    request. The information presented in this report was developed by
    Susan Anthony, Randy DiRosa, Mary Freeman, and Betty Kirksey under
    the direction of John Dicken. Please call me at (202) 512-7114 if
    you have any questions about the information provided in this
    report. Sincerely yours, William J. Scanlon Director, Health
    Financing and Public Health Issues Page 27
    GAO/HEHS-99-100 HIPAA Implementation Contents Letter
    1 Appendix I
    30 Scope and               Site Visits
    30 Agent Survey and Premium Rate Collection
    30 Methodology             Other Interviews
    30 Appendix II
    31 HIPAA Access,           Certificate of Creditable Coverage
    31 Guaranteed Access/Availability
    32 Portability, and        Guaranteed Renewability
    32 Renewability            Limitations on Preexisting Condition
    Exclusion Periods                      32 Standards
    Nondiscrimination
    33 Credit for Prior Coverage (Portability)
    33 Special Enrollment Periods
    33 Other Insurance-Related Provisions
    33 Other Federal Insurance Standards Passed After HIPAA
    33 Appendix III
    35 Department of Labor Resources Used to Implement HIPAA Appendix
    IV
    42 HCFA Resources Used to Implement HIPAA Appendix V
    44 Model Certificate of Creditable Coverage Page 28
    GAO/HEHS-99-100 HIPAA Implementation Contents Appendix VI
    45 Comments From the Health Care Financing Administration Related
    GAO Products
    52 Tables                   Table 1: Percentage of Mid-Size and
    Large Group Plans Using                  7 Preexisting Condition
    Exclusion Periods, 1996 and 1998 Table 2: Comparison of Selected
    Carriers' Standard Monthly                  12 Premiums With
    Carriers' Monthly Premiums for a HIPAA-Eligible With a Specified
    Health Condition Table 3: Monthly Premium for a HIPAA-Eligible
    With                          15 Juvenile-Onset Diabetes in Urban
    Areas of States Using a High-Risk Pool as an Alternative Mechanism
    Table I.1: Summary of Applicability of HIPAA Access, Portability,
    31 and Renewability Standards by Market Segment Figure
    Figure 1: Summary of State Small Group Guaranteed Issue
    10 Requirements Predating HIPAA Abbreviations COBRA
    Consolidated Omnibus Budget Reconciliation Act ERISA
    Employee Retirement Income Security Act of 1974 HCFA
    Health Care Financing Administration HIPAA        Health Insurance
    Portability and Accountability Act of 1966 HMO          health
    maintenance organization MHPA         Mental Health Parity Act
    NAHU         National Association of Health Underwriters POS
    point-of-service plan PPO          preferred provider organization
    WHCRA        Women's Health and Cancer Rights Act Page 29
    GAO/HEHS-99-100 HIPAA Implementation Appendix I Scope and
    Methodology Site Visits         To address our objectives, we
    visited five states-California, Florida, Illinois, Montana, and
    Oklahoma-and interviewed regulators, carriers, agents, and
    employers. We selected these states on the basis of their
    geographic dispersion and approach to implementing the group-to-
    individual portability provision of the Health Insurance
    Portability and Accountability Act of 1996 (HIPAA). With officials
    in these states, we discussed a multitude of issues, including
    each state's implementation of HIPAA provisions, monitoring and
    enforcement efforts, educational efforts, and challenges faced in
    implementing the various provisions of the law. Agent Survey and
    We collaborated with the National Association of Health
    Underwriters to Premium Rate        survey agents in 13 states and
    the District of Columbia that are using the federal rules (or a
    similar approach) to guarantee eligible individuals Collection
    group-to-individual portability under HIPAA. In these states,
    agents obtained premium rate quotes from selected carriers for a
    commonly sold product for a specified high-risk individual losing
    group coverage and for a demographically similar, but healthy,
    individual. In addition, the survey queried agents about
    consumers' knowledge of the law and their experiences. We also
    selected eight states not using the federal rules and surveyed an
    additional 40 agents to obtain comparable information about
    consumers' and agents' experiences. For states using a high-risk
    pool to guarantee access for those losing group coverage, we
    reviewed published enrollment and premium data and interviewed
    representatives of each state's risk pool. Other Interviews    In
    addition, we interviewed officials at the Health Care Financing
    Administration (HCFA) and the Department of Labor to discuss
    monitoring and enforcement issues and educational efforts
    undertaken to inform consumers about the law. We also interviewed
    individuals at national organizations, including the National
    Association of Insurance Commissioners, the Health Insurance
    Association of America, the BlueCross BlueShield Association, and
    the Council for Affordable Health Insurance. In addition, we
    hosted forums, at which over 25 national insurance carriers
    discussed their experiences with HIPAA and challenges they faced
    in its implementation. Finally, we interviewed representatives of
    research organizations, such as Georgetown University's Institute
    for Health Care Research and Policy, and reviewed available
    literature. Page 30                                   GAO/HEHS-99-
    100 HIPAA Implementation Appendix II HIPAA Access, Portability,
    and Renewability Standards To achieve its goals of improving
    access to and portability and renewability of private health
    insurance, HIPAA set forth standards that variously apply to the
    individual small group (2 to 50 employees) and large group (more
    than 50 employees) markets of all states. Most HIPAA standards
    became effective on July 1, 1997. However, group plans do not
    become subject to the applicable standards until their first plan
    year beginning on or after July 1, 1997. HIPAA's health coverage
    access, portability, nondiscrimination, and renewability standards
    are summarized in table I.1. Table I.1: Summary of Applicability
    of HIPAA Access, Portability, and
    Small group             Large group Renewability Standards by
    Market
    employer (2 to 50 employer (over 50 Segment
    Individual             employees)              employees)
    Certificate of creditable       Yes                    Yes
    Yes coverage Guaranteed                      Only for eligible
    Yes                     No access/availability
    individuals leaving group coverage Guaranteed renewability
    Yes                    Yes                     Yes Limitations on
    preexisting Noa                         Yes
    Yes condition exclusion periods Nondiscrimination               b
    Yes                     Yes Portability                     No
    Yes                     Yes Special enrollment periods b
    Yes                     Yes Note: Some of these standards also
    apply to certain federal, state, and local government insurance
    programs, such as Medicaid, state employee health plans, multiple-
    employer welfare arrangements, church plans, and bona fide
    associations. aCarriers may not impose preexisting condition
    exclusions upon individuals eligible for group-to-individual
    guaranteed access. bApplicable to group plans only. Certificate of
    HIPAA requires issuers of health coverage to provide certificates
    of Creditable Coverage                       creditable coverage
    to enrollees whose coverage terminates. The certificates must
    document the period during which the enrollee was covered so that
    a subsequent health issuer can credit this time against its
    preexisting condition exclusion period. The certificates must also
    document any period during which the enrollee had applied for
    coverage but was waiting for coverage to take effect-the waiting
    period-and must include information on an enrollee's dependents
    covered under the plan. Page 31
    GAO/HEHS-99-100 HIPAA Implementation Appendix II HIPAA Access,
    Portability, and Renewability Standards Guaranteed
    In the small group market, carriers must make all plans available
    and issue Access/Availability      coverage to any small employer
    that applies, regardless of the group's claims history or health
    status. Under individual market guaranteed access-often referred
    to as group-to-individual portability-eligible individuals must
    have guaranteed access to at least two different coverage options.
    Generally, eligible individuals are defined as those with at least
    18 months of prior group coverage who meet several additional
    requirements.21 Depending on the option states choose to implement
    this requirement, coverage may be provided by carriers, through
    state high-risk insurance pool programs, or in other ways.
    Guaranteed               HIPAA requires that all health plan
    policies be renewed regardless of the Renewability
    health status or claims experience of plan participants, with
    limited exceptions. Exceptions include cases of fraud, enrollee
    failure to pay premiums, enrollee movement out of a plan service
    area, and the withdrawal of an issuer from the market.22
    Limitations on           Group plan issuers generally may deny,
    exclude, or limit an enrollee's Preexisting Condition    benefits
    arising from a preexisting condition for no more than 12 months
    following the effective date of coverage. A preexisting condition
    is defined Exclusion Periods        as a condition for which
    medical advice, diagnosis, care, or treatment was received or
    recommended during the 6 months preceding the date of coverage or
    the first day of the waiting period for coverage. Pregnancy may
    not be considered a preexisting condition, nor can preexisting
    conditions be imposed on newborn or adopted children in most
    cases. 21An eligible individual is one who has had at least 18
    months of creditable coverage with no break of more than 63
    consecutive days; has exhausted any Consolidated Omnibus Budget
    Reconciliation Act or other continuation coverage available under
    a similar state program; is not eligible for any other group
    coverage, Medicare, or Medicaid; and did not lose group coverage
    because of nonpayment of premiums by the individual or fraud. 22We
    reported in GAO/HEHS-98-67, Feb. 25, 1998, that carriers were
    concerned about the effect of this provision on individuals who
    become eligible for Medicare. Carriers continue to express these
    concerns. Before HIPAA, when an enrollee reached the age of
    Medicare eligibility, issuers typically terminated comprehensive
    coverage and offered Medicare supplemental coverage instead.
    HIPAA's requirement to renew the comprehensive coverage may have
    drawbacks. For example, individuals who retain comprehensive
    coverage rather than obtain Medicare supplemental coverage may
    permanently lose their right to enroll in a supplemental policy
    without preexisting condition exclusions. Carriers told us that
    although Medicare beneficiaries have generally not retained their
    comprehensive coverage, carriers have had to create new rate bands
    for those that have. One carrier said the high rates charged to
    this over-65 age band discourage renewal. Some carriers send
    notices to enrollees describing the implications of their choices
    and advising that they enroll in Medicare supplemental coverage,
    yet enrollees are often skeptical of carrier advice. Page 32
    GAO/HEHS-99-100 HIPAA Implementation Appendix II HIPAA Access,
    Portability, and Renewability Standards Nondiscrimination
    Group plan issuers may not exclude a member within the group from
    coverage on the basis of the individual's health status or medical
    history. Similarly, the benefits provided, premiums charged, and
    contributions to the plan may not vary for similarly situated
    group plan enrollees on the basis of health status or medical
    history. Credit for Prior                 Issuers of group
    coverage must credit an enrollee's period of prior Coverage
    (Portability) coverage against the group issuer's preexisting
    condition exclusion period. Prior coverage must have been
    consecutive with no breaks of more than 63 days to be creditable.
    For example, an individual who has been covered for 6 months and
    changes employers may be eligible to have the subsequent
    employer's plan's 12-month waiting period for preexisting
    conditions reduced by 6 months. Time spent in a prior health
    plan's waiting period may not count as part of a break in
    coverage. Special Enrollment               Individuals who do not
    enroll for coverage in a group plan during their Periods
    initial enrollment opportunity may be eligible for a special
    enrollment period later if they originally declined to enroll
    because they had other coverage, such as under the Consolidated
    Omnibus Budget Reconciliation Act (COBRA), or if they were covered
    as a dependent under a spouse's coverage and later lost that
    coverage. In addition, if an enrollee has a new dependent because
    of marriage or the birth or adoption of a child, the enrollee and
    dependents may become eligible for coverage during a special
    enrollment period. Other                            HIPAA also
    includes certain other standards that relate to private health
    Insurance-Related                coverage, including limited
    expansions of COBRA coverage rights, new disclosure requirements
    for Employee Retirement Income Security Act Provisions
    plans, and new requirements for uniform enrollee and claims
    information, to be phased in through 1999. Tax law changes
    authorize federally tax-advantaged medical savings accounts for
    small employer and self-employed plans. Other Federal
    For employers with 50 or more employees that provide mental health
    Insurance Standards              benefits, the Mental Health
    Parity Act requires that the annual and lifetime dollar maximums
    for mental health be the same as dollar maximums for Passed After
    HIPAA               medical/surgical benefits. The law does not
    establish a separate lifetime dollar maximum for mental health
    services. If medical/surgical benefits do Page 33
    GAO/HEHS-99-100 HIPAA Implementation Appendix II HIPAA Access,
    Portability, and Renewability Standards not have annual or
    lifetime dollar maximums, mental health benefits cannot have
    lifetime maximums. Plans may continue to otherwise set the terms
    and conditions of mental health coverage, such as by imposing an
    annual limit on the number of inpatient days, the number of
    visits, or the percentage of cost-sharing for services. Group
    plans that can demonstrate that compliance will result in a cost
    increase of 1 percent or more may be exempt from the law. Under
    the Newborns' and Mothers' Health Protection Act, group health
    plans may not restrict benefits for any hospital stay in
    connection with childbirth for the mother or newborn child
    following a normal vaginal delivery to less than 48 hours,
    restrict benefits for any hospital stay for a cesarean section to
    less than 96 hours, or require that a provider obtain
    authorization from the plan for prescribing any length of stay
    required. The minimum stays do not apply if the decision to
    discharge the mother or newborn is made by the mother and her
    doctor. The Women's Health and Cancer Rights Act contains
    protections for breast cancer patients who elect breast
    reconstruction in connection with a mastectomy. Under the act,
    reconstructive benefits must include coverage for reconstruction
    of the breast on which the mastectomy was performed, surgery and
    reconstruction of the other breast to produce a symmetrical
    appearance, and prostheses and physical complications at all
    stages of treatment related to a mastectomy. Benefits under the
    act may be subject to annual deductibles and coinsurance
    consistent with those established for other benefits under the
    plan or coverage. Page 34
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 35      GAO/HEHS-99-
    100 HIPAA Implementation Appendix III Department of Labor
    Resources Used to Implement HIPAA Page 36
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 37
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 38
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 39
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 40
    GAO/HEHS-99-100 HIPAA Implementation Appendix III Department of
    Labor Resources Used to Implement HIPAA Page 41
    GAO/HEHS-99-100 HIPAA Implementation Appendix IV HCFA Resources
    Used to Implement HIPAA Page 42      GAO/HEHS-99-100 HIPAA
    Implementation Appendix IV HCFA Resources Used to Implement HIPAA
    Page 43                                   GAO/HEHS-99-100 HIPAA
    Implementation Appendix V Model Certificate of Creditable Coverage
    Note: Model certificates were issued for both group and individual
    health plan coverage. The language describing the HIPAA
    protections is essentially the same in both. Page 44
    GAO/HEHS-99-100 HIPAA Implementation Appendix VI Comments From the
    Health Care Financing Administration Page 45      GAO/HEHS-99-100
    HIPAA Implementation Appendix VI Comments From the Health Care
    Financing Administration Page 46
    GAO/HEHS-99-100 HIPAA Implementation Appendix VI Comments From the
    Health Care Financing Administration Page 47
    GAO/HEHS-99-100 HIPAA Implementation Appendix VI Comments From the
    Health Care Financing Administration Page 48
    GAO/HEHS-99-100 HIPAA Implementation Appendix VI Comments From the
    Health Care Financing Administration Page 49
    GAO/HEHS-99-100 HIPAA Implementation Appendix VI Comments From the
    Health Care Financing Administration Page 50
    GAO/HEHS-99-100 HIPAA Implementation Page 51      GAO/HEHS-99-100
    HIPAA Implementation Related GAO Products Private Health
    Insurance: HCFA Cautious in Enforcing Federal HIPAA Standards in
    States Lacking Conforming Laws (GAO/HEHS-98-217R, July 22, 1998).
    Implementation of HIPAA: State-Designed Mechanisms for Group-to-
    Individual Portability (GAO/HEHS-98-161R, May 20, 1998). Health
    Insurance Standards: Implications of New Federal Law for
    Consumers, Insurers, Regulators (GAO/T-HEHS-98-114, Mar. 19,
    1998). Health Insurance Standards: New Federal Law Creates
    Challenges for Consumers, Insurers, Regulators (GAO/HEHS-98-67,
    Feb. 25, 1998). The Health Insurance Portability and
    Accountability Act of 1996: Early Implementation Concerns
    (GAO/HEHS-97-200R, Sept. 2, 1997). Private Health Insurance:
    Millions Relying on Individual Market Face Cost and Coverage
    Tradeoffs (GAO/HEHS-97-8, Nov. 25, 1996). Health Insurance
    Portability: Reform Could Ensure Continued Coverage for Up to 25
    Million Americans (GAO/HEHS-95-257, Sept. 19, 1995). Health
    Insurance Regulation: National Portability Standards Would
    Facilitate Changing Health Plans (GAO/HEHS-95-205, July 18, 1995).
    Health Insurance Regulation: Variation in Recent State Small
    Employer Health Insurance Reforms (GAO/HEHS-95-161FS, June 12,
    1995). (101774)      Page 52
    GAO/HEHS-99-100 HIPAA Implementation Ordering Information The
    first copy of each GAO report and testimony is free. Additional
    copies are $2 each. Orders should be sent to the following
    address, accompanied by a check or money order made out to the
    Superintendent of Documents, when necessary. VISA and MasterCard
    credit cards are accepted, also. Orders for 100 or more copies to
    be mailed to a single address are discounted 25 percent. Orders by
    mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC
    20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts.
    NW) U.S. General Accounting Office Washington, DC Orders may also
    be placed by calling (202) 512-6000 or by using fax number (202)
    512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of
    newly available reports and testimony.  To receive facsimile
    copies of the daily list or any list from the past 30 days, please
    call (202) 512-6000 using a touchtone phone.  A recorded menu will
    provide information on how to obtain these lists. For information
    on how to access GAO reports on the INTERNET, send an e-mail
    message with "info" in the body to: [email protected] or visit
    GAO's World Wide Web Home Page at: http://www.gao.gov PRINTED ON
    RECYCLED PAPER United States General Accounting Office
    Bulk Rate Washington, D.C. 20548-0001     Postage & Fees Paid GAO
    Permit No. G100 Official Business Penalty for Private Use $300
    Address Correction Requested

*** End of document. ***