Health Insurance Standards: Implications of New Federal Law for
Consumers, Insurers, Regulators (Testimony, 03/19/98, GAO/T-HEHS-98-114).

Pursuant to a congressional request, GAO discussed the implementation of
the private insurance market provisions of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA).

GAO noted that: (1) although HIPAA gives people losing coverage a
guarantee of access to coverage in the individual market, consumers
attempting to exercise this right have been hindered in some states by
carrier practices and pricing and by their own misunderstanding of this
complex law; (2) in the 13 states using the federal fallback approach to
guaranteed access, some carriers initially discouraged people from
applying for the coverage or charge them as much as 140 to 600 percent
of the standard rate; (3) many consumers also do not fully understand
the eligibility criteria that apply and as a result may risk losing
their right to coverage; (4) issuers of health coverage believe certain
HIPAA provisions are burdensome to administer, may create unintended
consequences, or may be abused by consumers; (5) issuers also fear that
HIPAA's guaranteed renewal provision could cause those eligible for
Medicare to pay for redundant coverage and hinder carriers' ability to
sell products to children and other targeted populations; (6) certain
protections for group plan enrollees may create an opportunity for
consumer abuse, such as the guarantees of credit for prior coverage,
which could give certain enrollees an incentive, when they need medical
care, to switch from low-cost, high-deductible coverage to more
expensive, low-deductible coverage; (7) state insurance regulators have
encountered difficulties implementing and enforcing HIPAA provisions
where federal guidance lacks sufficient clarity or detail; (8) federal
regulators face an unexpectedly large role under HIPAA, which could
strain the Department of Health and Human Service's (HHS) resources and
weaken its oversight; (9) in states that do not pass legislation
implementing HIPAA provisions, HHS is required to take on the regulatory
role; (10) as federal agencies issue more guidance and states and
issuers gain more experience with HIPAA, concerns about the clarity of
its regulations may diminish; (11) whether unintended consequences will
occur is as yet unknown, in part because sufficient evidence has not
accumulated; (12) in federal fallback states, premiums for
group-to-individual guaranteed access coverage are likely to remain high
unless regulations with more explicit risk-spreading requirements are
issued at the federal or state level; (13) HHS' ability to meet its
growing oversight role may prove inadequate given the current level of
resources, particularly if more states cede regulatory authority to the
federal government; and (14) in any case, as early challenges are
resolved during 1998, other challenges to implementing HIPAA may emerge.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-HEHS-98-114
     TITLE:  Health Insurance Standards: Implications of New Federal Law 
             for Consumers, Insurers, Regulators
      DATE:  03/19/98
   SUBJECT:  Public health legislation
             Health insurance
             Health care services
             Employee medical benefits
             Insurance premiums
             Health insurance cost control
             Federal/state relations
             Insurance companies
             Eligibility criteria
             Insurance regulation
IDENTIFIER:  Medicare Program
             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER


Before the Committee on Labor and Human Resources, U.S.  Senate

For Release on Delivery
Expected at 10:00 a.m.
Thursday, March 19, 1998

HEALTH INSURANCE STANDARDS -
IMPLICATIONS OF NEW FEDERAL LAW
FOR CONSUMERS, INSURERS,
REGULATORS

Statement of William J.  Scanlon, Director
Health Financing and Systems Issues
Health, Education, and Human Services Division

GAO/T-HEHS-98-114

GAO/HEHS-98-114T


(101712)


Abbreviations
=============================================================== ABBREV

  COBRA - ABC
  ERISA - ABC
  HIPAA - ABC
  HHS - ABC
  NAIC - ABC

HEALTH INSURANCE STANDARDS: 
IMPLICATIONS OF NEW FEDERAL LAW
FOR CONSUMERS, INSURERS,
REGULATORS
============================================================ Chapter 0

Mr.  Chairman and Members of the Committee: 

We are pleased to be here today to discuss the implementation of the
private insurance market provisions of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA).\1 Most
Americans--some 160 million--rely on the private health insurance
market, whether for employer-sponsored group coverage or an
individual market policy.  HIPAA provides, for the first time,
nationwide standards for access, portability, and renewability
protection for consumers in this market.  To implement these
standards, HIPAA requires coordinated action by many stakeholder
groups, including federal agencies, state insurance regulators,
private insurers, and employers.  The Departments of Health and Human
Services (HHS), Labor, and the Treasury issued regulations by the
April 1, 1997, statutory deadline and were widely commended for the
open and inclusive nature of the process.  Nonetheless, implementing
this new law has been a complex undertaking and, not surprisingly,
during HIPAA's first year some challenges have emerged. 

Today, I will discuss these challenges as they relate to

  -- consumers;

  -- issuers of health coverage, including employers and insurance
     carriers;

  -- state insurance regulators; and

  -- federal regulators. 

This statement relies primarily on our two recent reports:  Health
Insurance Portability and Accountability Act of 1996:  Early
Implementation Concerns and Health Insurance Standards:  New Federal
Law Creates Challenges for Consumers, Insurers, Regulators.\2

In summary, although HIPAA gives people losing group coverage a
guarantee of access to coverage in the individual market, consumers
attempting to exercise this right have been hindered in some states
by carrier practices and pricing and by their own misunderstanding of
this complex law.  In the 13 states using the "federal fallback"
approach to guaranteed access--so called because it is specified by
federal law--some carriers initially discouraged people from applying
for the coverage or charge them as much as 140 to 600 percent of the
standard rate because they believe that people seeking HIPAA's
individual market access guarantee will typically be less healthy
than others in the individual market.\3 Many consumers also do not
fully understand the eligibility criteria that apply and as a result
may risk losing their right to coverage. 

Issuers of health coverage believe certain HIPAA provisions are
burdensome to administer, may create unintended consequences, or may
be abused by consumers.\4 For example, although issuers generally
appear to be complying with the requirement to provide certificates
of creditable coverage to enrollees who terminate health coverage,
many continue to suggest that issuing these certificates to all
enrollees is unnecessary and costly.  Issuers also fear that HIPAA's
guaranteed renewal provision could cause those eligible for Medicare
to pay for redundant coverage and could also hinder carriers' ability
to sell products to children and other targeted populations.  And
certain protections for group plan enrollees may create an
opportunity for consumer abuse, such as the guarantees of credit for
prior coverage, which could give certain enrollees an incentive, when
they need medical care, to switch from low-cost, high-deductible
coverage to more expensive, low-deductible coverage. 

State insurance regulators have encountered difficulties implementing
and enforcing HIPAA provisions where federal guidance lacks
sufficient clarity or detail, such as that pertaining to
nondiscrimination and late enrollee requirements in the group market,
and to risk-spreading for products available to HIPAA eligibles in
the individual market.  While acknowledging that in some areas more
guidance is needed, federal officials noted that the Congress allowed
the regulations to be issued before a notice and comment period,
given the need to draft many complex regulations within tight
statutory deadlines. 

Federal regulators face an unexpectedly large role under HIPAA, which
could strain HHS' resources and weaken its oversight.  In states that
do not pass legislation implementing HIPAA provisions, HHS is
required to take on the regulatory role.  For at least five states
that reported they did not pass implementing legislation by the end
of 1997, HHS must perform that role.  Since it may have similar
responsibility for several other states that have not enacted such
legislation or reported on it, the full extent of HHS' regulatory
role under this law is not yet known. 

Some implementation challenges may soon recede; others are
hypothetical and may not materialize.  As federal agencies issue more
guidance and states and issuers gain more experience with HIPAA,
concerns about the clarity of its regulations may diminish.  Whether
unintended consequences will occur is as yet unknown, in part because
sufficient evidence has not accumulated.  However, two substantive
concerns are likely to persist.  First, in federal fallback states,
premiums for group-to-individual guaranteed access coverage are
likely to remain high unless regulations with more explicit
risk-spreading requirements are issued at the federal or state level
or states adopt other mechanisms to moderate these rates.  Second,
HHS' ability to meet its growing oversight role may prove inadequate
given the current level of resources, particularly if more states
cede regulatory authority to the federal government.  In any case, as
early challenges are resolved during 1998, other challenges to
implementing HIPAA may emerge.  That fact, coupled with the
incompleteness of the evidence, makes a comprehensive assessment of
HIPAA's implementation and effects premature and suggests the need
for continued oversight. 


--------------------
\1 Signed into law on Aug.  21, 1996 (P.L.  104-191). 

\2 GAO/HEHS-97-200R, Sept.  2, 1997, and GAO/HEHS-98-67, Feb.  25,
1998. 

\3 The federal fallback approach is one of two that HIPAA allows
states to use in ensuring its guarantee of group-to-individual
access.  This approach requires that all carriers in the individual
insurance market offer access to coverage to HIPAA-eligible
individuals. 

\4 Issuers include insurance carriers and employers who offer
self-insured health plans. 


   BACKGROUND
---------------------------------------------------------- Chapter 0:1

Among other protections, HIPAA's standards for health coverage,
access, portability, and renewability guarantee access to coverage
for certain employees and individuals, prohibit carriers from
refusing to renew coverage on the basis of a person's health status,
and place limits on the use of preexisting condition exclusion
periods.  However, not all standards apply to all markets or
individuals.  For example, guarantees of access to coverage for
employers apply only in the small-group market,\5 and the individual
market guarantee applies only to certain eligible individuals who
lose group coverage.\6 (The appendix contains a summary of these
standards by market segment.)

The Departments of Labor and the Treasury and HHS are required to
jointly develop and issue regulations implementing HIPAA, and each
agency is charged with various oversight responsibilities.  Labor is
responsible for ensuring that group health plans comply with HIPAA
standards, which is an extension of its current regulatory role under
the Employee Retirement Income Security Act of 1974 (ERISA).\7
Treasury also enforces HIPAA requirements on group health plans but
does so by imposing an excise tax under the Internal Revenue Code on
employers or plans that do not comply with HIPAA.  HHS is responsible
for enforcing HIPAA with respect to insurance carriers in the group
and individual markets, but only in states that do not already have
similar protections in place or do not enact and enforce laws to
implement HIPAA standards.\8

This represents an essentially new role for that agency. 

The implementation of HIPAA is ongoing, in part, because the
regulations were issued on an "interim final" basis.\9 Further
guidance needed to finalize the regulations has not yet been issued. 
In addition, various provisions of HIPAA have different effective
dates.  Most of the provisions became effective on July 1, 1997, but
group-to-individual guaranteed access in 36 states and the District
of Columbia had until January 1, 1998, to become effective.  And
although all provisions are now in effect, individual group plans do
not become subject to the law until the start of their plan year on
or after July 1, 1997.  For some collectively bargained plans, this
may not be until 1999 or later, as collective bargaining agreements
may extend beyond 12 months. 

During the first year of implementation, federal agencies, the
states, and issuers have taken various actions in response to HIPAA. 
In addition to publishing interim final regulations by the April 1,
1997, statutory deadline, Labor and HHS have conducted educational
outreach activities.  State legislatures have enacted laws to
implement HIPAA provisions, and state insurance regulators have
written regulations and prepared to enforce them.  Issuers of health
coverage have modified their products and practices to comply with
HIPAA. 


--------------------
\5 HIPAA defines the "small-group" market generally as insurance sold
to employers with 2 to 50 employees. 

\6 An employer may provide group coverage to its employees either by
purchasing a group policy from an insurance carrier (fully insured
coverage) or by funding its own health plan (self-funded coverage). 
For more information on fully and self-funded group coverage, see The
Employee Retirement Income Security Act of 1974:  Issues, Trends, and
Challenges for Employer-Sponsored Health Plans (GAO/HEHS-95-167, June
21, 1995) and Employment-Based Health Insurance:  Costs Increase and
Family Coverage Decreases (GAO/HEHS-97-35, Feb.  24, 1997). 
Individuals without group coverage may obtain coverage by purchasing
a policy directly from carriers in the individual insurance market. 
For more information on the individual insurance market, see Private
Health Insurance:  Millions Relying on Individual Market Face Cost
and Coverage Trade-Offs (GAO/HEHS-97-8, Nov.  25, 1996). 

\7 ERISA allows employers to offer uniform national health benefits
by preempting states from directly regulating employer benefit plans. 
As a result, states are unable to directly regulate self-funded
health plans but can regulate health insurers. 

\8 HHS is also responsible for enforcing group market provisions of
HIPAA for certain nonfederal government health plans. 

\9 Normal federal rulemaking procedures require agencies to publish a
Notice of Proposed Rulemaking in the Federal Register and provide for
a comment period before issuing regulations.  Under the interim final
approach, agencies may issue regulations prior to the notice and
comment period. 


   HIPAA GUARANTEES ACCESS TO
   COVERAGE FOR INDIVIDUALS
   LEAVING GROUP PLANS, BUT SOME
   CONSUMERS' ABILITY TO OBTAIN
   THIS COVERAGE IS COMPROMISED
---------------------------------------------------------- Chapter 0:2

To ensure that individuals losing group coverage have guaranteed
access--regardless of health status--to individual market coverage,
HIPAA offers states two different approaches.  The first, which HIPAA
specifies, is commonly referred to as the "federal fallback" approach
and requires all carriers who operate in the individual market to
offer eligible individuals at least two health plans.  (This approach
became effective on July 1, 1997.) The second approach, the so-called
"alternative mechanism," grants states considerable latitude to use
high-risk pools and other means to ensure guaranteed access.  (HIPAA
requires states adopting this approach to implement it no later than
Jan.  1, 1998.)\10

Among the 13 states using the federal fallback approach, we found
that some initial carrier marketing practices may have discouraged
HIPAA eligibles from enrolling in products with guaranteed access
rights.  After the federal fallback provisions took effect, many
consumers told state insurance regulators that carriers did not
disclose the existence of a product to which the consumers had
HIPAA-guaranteed access rights or, when the consumers specifically
requested one, the carrier said it did not have such a product
available.  Also, some carriers initially refused to pay commissions
to insurance agents who referred HIPAA eligibles.  Insurance
regulators in two of the three federal fallback states we visited
told us that some carriers advised agents against referring
HIPAA-eligible applicants or paid reduced or no commissions. 
Recently, though, this practice appears to have abated. 

We also found that premiums for products with guaranteed access
rights may be substantially higher than standard rates.  In the three
federal fallback states we visited, we found rates ranging from 140
to 400 percent of the standard rate, as indicated in table 1. 
Anecdotal reports from insurance regulators and agents in federal
fallback states suggest rates of 600 percent or more of the standard
rate are also being charged.  We also found that carriers typically
evaluate the health status of applicants and offer healthy
individuals access to their lower-priced standard products.  This
practice could cause HIPAA products to be purchased
disproportionately by unhealthy, more costly individuals, which, in
turn, could precipitate further premium increases. 



                          Table 1
          
          Premiums Relative to Standard Rates for
            Select Guaranteed Access Products in
              Arizona, Colorado, and Missouri

                                   Premium as a percentage
Carrier                                   of standard rate
----------------------------  ----------------------------
A                                                      140
B                                                      150
C                                                      185
D                                                      200
E                                                      200
F                                                      225
G                                                      300
H                                                      300
I                                                      400
----------------------------------------------------------
Carriers charge higher rates because they believe HIPAA-eligible
individuals will, on average, be in poorer health, and they seek to
prevent non-HIPAA-eligible individuals from subsidizing eligibles'
expected higher costs.  Carriers permit or even encourage healthy
HIPAA-eligible individuals to enroll in standard plans.  According to
one carrier official, denying HIPAA eligibles the opportunity to
enroll in a less expensive product for which they qualify would be
contrary to the consumers' best interests.  In any case, carriers
that do not charge higher premiums to HIPAA eligibles could be
subject to adverse selection.  That is, once a carrier's low rate for
eligible individuals became known, agents would likely refer less
healthy HIPAA eligibles to that carrier, which would put it at a
competitive disadvantage.  Finally, HIPAA does not specifically
regulate premium rates and, with one exception, the regulations do
not require a mechanism to narrow the disparity of rates for products
with guaranteed access rights.  The regulations offer three options
for carriers to provide coverage to HIPAA-eligible individuals in
federal fallback states, only one of which includes an explicit
requirement to use some method of risk spreading or financial subsidy
to moderate rates for HIPAA products.  This limited attention to
rates in the regulations, some state regulators contend, permits
issuers to charge substantially higher rates for products with
guaranteed access rights. 

A third potential obstacle facing consumers seeking HIPAA products
is, we found, widespread consumer confusion about consumers'
guaranteed access rights in the individual market.\11 Soon after
HIPAA was enacted, insurance regulators in several states received
numerous calls from individuals, including the uninsured, who
misunderstood their rights and expected to have guaranteed access to
insurance coverage.  One state reported receiving consumer calls at a
rate of 120 to 150 a month, about 90 percent of which related to the
group-to-individual guaranteed access provision.  Similarly, an
official from one large national insurer told us that many consumers
believe the law covers them when it actually does not. 


--------------------
\10 Because not all state alternative mechanisms were implemented
until Jan.  1, 1998, we did not evaluate states' experiences with
these approaches. 

\11 Individual market guaranteed access rights apply only to
individuals who lose group coverage and meet several other
eligibility criteria, as discussed in the appendix. 


   ISSUERS OF HEALTH COVERAGE ARE
   CONCERNED ABOUT HIPAA'S
   ADMINISTRATIVE BURDEN AND
   POSSIBLE UNINTENDED
   CONSEQUENCES
---------------------------------------------------------- Chapter 0:3

Issuers of health coverage are concerned about the administrative
burden and the unintended consequences of certain HIPAA requirements. 
One persistent concern has been the administrative burden and cost of
complying with the requirement to issue certificates of creditable
coverage to all enrollees who terminate coverage.  Some issuers are
concerned that certain information, such as the status of dependents
on a policy, is difficult or time consuming to obtain.  Some state
officials are concerned that Medicaid agencies, which are also
subject to the requirement, may face an especially difficult burden
because Medicaid recipients tend to enroll in and disenroll from the
Medicaid program frequently.  This could require Medicaid agencies to
issue a higher volume of certificates.  Finally, issuers suggest that
many of the certificates will not be needed to prove creditable
coverage.  Several issuers and state insurance regulators point out
that portability reforms passed by most states have worked well
without a certificate issuance requirement.  Also, many group health
plans do not contain preexisting condition exclusion clauses, and
therefore the plans do not need certificates from incoming enrollees. 
While issuers generally appear to have complied with this
requirement, some suggest that a more limited requirement, such as
issuing the certificates only to consumers who request them, would
serve the same purpose for less cost. 

Issuers are also concerned that HIPAA's guaranteed renewal
requirement may adversely affect certain populations.  For example,
in the individual market, issuers typically terminate the coverage of
enrollees who reach Medicare eligibility age, sometimes offering
Medicare supplemental coverage instead.  But because HIPAA requires
that coverage be renewed, issuers may no longer terminate the
coverage, and certain drawbacks may result.  Those who elect to
retain individual market coverage may miss the 6-month open
enrollment window during which they may enroll in a Medicare
supplemental policy without preexisting condition exclusions. 
Furthermore, these consumers could be worse off financially, since
individual market coverage generally costs more than Medicare
supplemental coverage.  In addition, because some states do not
permit issuers to coordinate their coverage with Medicare, some
consumers may pay for coverage that duplicates their Medicare
benefits.  Furthermore, the National Association of Insurance
Commissioners (NAIC) is concerned that if large numbers of older and
less healthy individuals remain in the individual market, premiums
for all individuals there could rise as a result.  HIPAA's guaranteed
renewal requirements may also preclude issuers from canceling
enrollees' coverage, once they exceed eligibility limits, in
insurance programs that are targeted for low-income populations. 
Therefore, these programs' limited slots could be filled by otherwise
ineligible individuals.  Similarly, issuers could be required to
renew coverage for children-only insurance products, for children who
have reached adulthood--contrary to the design and intent of these
products. 

Finally, issuers cite some HIPAA provisions that have the potential
to be abused by consumers.  For example, HIPAA requires group health
plans to give new enrollees or enrollees switching between plans
during an open enrollment period full credit for a broad range of
prior health coverage.  Since the law does not recognize differences
in deductible levels, issuers and regulators are concerned that
individuals may enroll in inexpensive, high-deductible plans while
healthy and then switch to plans with comprehensive, low-deductible
coverage when they become ill.  Federal agencies have sought comments
from industry on this matter.  In a related example, because HIPAA
does not permit pregnancy to be excluded from coverage as a
preexisting condition, an individual could avoid the expense of
health coverage and then enroll in the employer's group plan as a
late enrollee to immediately obtain full maternity benefits.\12
Issuers contend that such abuses, if widespread, could increase the
cost of insurance. 


--------------------
\12 HIPAA permits issuers to impose an 18- rather than a 12-month
preexisting condition exclusion period on late enrollees except for
pregnancy. 


   STATE INSURANCE REGULATORS SAY
   LACK OF SUFFICIENT CLARITY AND
   DETAIL IN SOME HIPAA
   REGULATIONS HINDERS
   IMPLEMENTATION EFFORTS
---------------------------------------------------------- Chapter 0:4

State regulators have encountered difficulties implementing HIPAA
provisions in instances in which federal regulations lacked
sufficient clarity.  Specifically, some regulators are concerned that
the lack of clarity may result in various interpretations and in
confusion among the many entities involved in implementation.  For
example, Colorado insurance regulators surveyed carriers in that
state to determine how they interpreted regulations pertaining to
group-to-individual guaranteed access.  The survey results indicated
that issuers had a difficult time interpreting the regulations and
were thus applying them differently. 

Such regulatory ambiguities can have negative consequences for
consumers and have created some situations in which, according to
NAIC, the intent of the statute may have been thwarted.  For example,
as discussed earlier, the ambiguity in the risk-spreading requirement
for products available to HIPAA-eligible individuals has been cited
as a factor contributing to high rates for these products, which in
some states range from 140 to 600 percent or more of standard rates. 
Other areas in which state insurance regulators have sought
additional federal guidance or clarification include

  -- use of plan benefit structure as a de facto preexisting
     condition exclusion period,

  -- treatment of late enrollees,

  -- market withdrawal as an exception to guaranteed renewability,
     and

  -- nondiscrimination provisions under group plans. 

Federal agency officials point to a number of factors that may
explain the perceived lack of clarity or detail in some regulatory
guidance.  First, the statute, signed into law on August 21, 1996,
required that implementing regulations be issued in less than 8
months, on April 1, 1997.  Implicitly recognizing this challenge, the
Congress provided for the issuance of regulations on an interim final
basis.  This time-saving measure helped the agencies to issue a large
volume of complex regulations within the statutory deadline while
also providing the opportunity to add more details or further clarify
the regulations with the help of comments later received from
industry and states.  Therefore, some regulatory details necessarily
had to be deferred until a later date. 

Furthermore, agency officials pointed out that in developing the
regulations, they sought to balance states' need for clear and
explicit regulations with the flexibility to meet HIPAA goals in a
manner best suited to each state.  For example, under the
group-to-individual guaranteed access requirement, states were given
several options for achieving compliance.  While the multiple options
may have contributed to confusion in some instances, differences
among the state insurance markets and existing reforms suggested to
agency officials that a flexible approach was in the best interest of
states.  In fact, according to HHS officials, states specifically
requested that regulations not be too explicit in order to allow
states flexibility in implementing them.  Finally, some of the
regulatory ambiguities derive from ambiguities existing in the
statute itself.  For example, regulations concerning late enrollees
closely track the language from the statute. 


   UNEXPECTEDLY LARGE ROLE FOR
   FEDERAL REGULATORS MAY STRAIN
   RESOURCES, HAMPER OVERSIGHT
---------------------------------------------------------- Chapter 0:5

States have the option of enforcing HIPAA's access, portability, and
renewability standards as they apply to fully insured group and
individual health coverage.  In states that do not pass laws to
enforce these federal standards, HHS must perform the enforcement
function.  According to HHS officials, the agency as well as the
Congress and others assumed HHS would generally not have to perform
this role, believing instead that states would not relinquish
regulatory authority to the federal government.  However, five
states--California, Massachusetts, Michigan, Missouri, and Rhode
Island--reported they did not pass legislation to implement HIPAA's
group-to-individual guaranteed access provision, among other
provisions, thus requiring HHS to regulate insurance plans in these
states.  Preliminary information suggests that up to 17 additional
states have not enacted laws to enforce one or more HIPAA provisions,
potentially requiring HHS to play a regulatory role in some of these
states as well.  HHS resources are currently strained by its new
regulatory role in the five states where enforcement is under way,
according to officials, and concern exists about the implications of
the possible expansion of this role to additional states. 


   FEDERAL AGENCIES RESPOND TO
   SOME HIPAA IMPLEMENTATION
   CONCERNS
---------------------------------------------------------- Chapter 0:6

Federal officials have begun to respond to some of the concerns
raised during the first year of HIPAA implementation.  HHS is
continuing to monitor the need for more explicit risk-spreading
requirements to mitigate the high cost of guaranteed access products
in the individual market under the federal fallback approach. 
Federal officials believe a change to the certificate issuance
requirement in response to issuer concerns would be premature; the
officials note that the certificates also serve to notify consumers
of their portability rights, regardless of whether consumers
ultimately need to use the certificate to exercise those rights.  As
for guaranteed renewal for Medicare eligibles, federal officials
interpret HIPAA to require that individuals, upon becoming eligible
for Medicare, have the option of maintaining their individual market
coverage.  Moreover, HHS officials disagreed with the insurance
industry and state regulators' contention that sufficient numbers of
individuals in poor health will remain in the individual market to
affect premium prices there. 

With respect to insurance products offered to targeted populations,
such as children or low-income families, HHS is considering industry
comments on this issue.  Officials said a change to the regulations
remains a possibility.  The agencies are also considering industry
comments about certain potential consumer abuses, such as switching
between high- and low-deductible plans, and are examining possible
changes.  To further clarify the regulations, supplemental guidance
concerning nondiscrimination and late enrollment was published on
December 29, 1997.  This guidance clarifies how group health plans
must treat individuals who, prior to HIPAA, had been excluded from
coverage because of a health status-related factor.  Further guidance
and clarification in these and other areas is expected to follow. 

Finally, to address its resource constraints, HHS has shifted
resources to HIPAA tasks from other activities.  In its fiscal year
1999 budget request, HHS has also requested an additional $15.5
million to fund 65 new full-time-equivalent staff and outside
contractor support for HIPAA-related enforcement activities. 


   CONCLUDING OBSERVATIONS
---------------------------------------------------------- Chapter 0:7

HIPAA reflects the complexity of the U.S.  private health insurance
marketplace.  The law's standards for health coverage access,
portability, and renewability apply nationwide but must take account
of the distinctive features of the small-group, large-group, and
individual insurance markets, and of employees' movements between
these markets.  From the drafting of regulations to the responses of
issuers, implementation of this complex law has itself been
complicated but has nonetheless moved forward.  Notwithstanding this
progress, though, participants and observers have raised concerns and
noted challenges to those charged with implementing this law. 

Some challenges are likely to recede or be addressed in the near
term.  What could be characterized as "early implementation hurdles,"
especially those related to the clarity of federal regulations, may
be largely resolved during 1998, as federal agencies issue further
regulatory guidance to states and issuers.  Moreover, as states and
issuers gain experience in implementing HIPAA standards, the
intensity of their dissatisfaction may diminish.  In any case, while
criticizing the cost and administrative burden of issuing
certificates of creditable coverage, issuers still seem able to
comply. 

According to issuers and other participants in HIPAA's
implementation, HIPAA may have several unintended consequences, but
predicting whether these possibilities will be realized is difficult. 
At this early point in the law's history, these concerns are
necessarily speculative because HIPAA's insurance standards have not
been in place long enough for evidence to accumulate.  In addition,
possible changes in the regulations or amendments to the statute
itself could determine whether a concern about a provision's effects
becomes reality. 

However, two implementation difficulties are substantive and likely
to persist, unless measures are taken to address them.  First, in the
13 federal fallback states, some consumers are finding that high
premiums make it difficult to purchase the group-to-individual
guaranteed access coverage that HIPAA requires carriers to offer. 
This situation is likely to continue unless HHS interprets the
statute to require (in federal fallback states) more explicit and
comprehensive risk-spreading requirements or that states adopt other
mechanisms to moderate rates of guaranteed access coverage for HIPAA
eligibles.  In addition, if the range of consumer education efforts
on HIPAA provisions remains limited, many consumers may continue to
be surprised by the limited nature of HIPAA protections or to risk
losing the opportunity to take advantage of them.  Second, HHS'
current enforcement capabilities could prove inadequate to handle the
additional burden as the outcome of state efforts to adopt and
implement HIPAA provisions becomes clearer in 1998. 

The situation regarding the implementation of HIPAA's insurance
standards is dynamic.  As additional health plans become subject to
the law, and as further guidance is issued, new problems may emerge
and new corrective actions may be necessary.  Consequently, because a
comprehensive determination of HIPAA's implementation and effects
remains years away, continued oversight is required. 


-------------------------------------------------------- Chapter 0:7.1

Mr.  Chairman, this concludes my prepared statement.  I will be happy
to answer your questions. 


HIPAA ACCESS, PORTABILITY, AND
RENEWABILITY STANDARDS
==================================================== Appendix Appendix

To achieve its goals of improving the access, portability, and
renewability of private health insurance, HIPAA sets forth standards
that variously apply to the individual, small-group, and large-group
markets of all states.  Most HIPAA standards became effective on July
1, 1997.  However, the certificate issuance standard became effective
on June 1, 1997, and issuers had to provide certificates
automatically to all disenrollees from that point forward as well as
upon request to all disenrollees retroactive to July 1, 1996.  In
states that chose an alternative mechanism approach, the individual
market guarantee access standard (often called "group-to-individual
portability") had until January 1, 1998, to become effective. 
Finally, group plans do not become subject to the applicable
standards until their first plan year beginning on or after July 1,
1997. 

Table I.1 summarizes HIPAA's health coverage access, portability, and
renewability standards, by applicable market segment.  The text
following the table describes each standard. 



                         Table I.1
          
               HIPAA Access, Portability, and
             Renewability Standards, by Market
                          Segment

                                Small group
                                (2-50
                  Individual    employees)    Large group
----------------  ------------  ------------  ------------
Certificate of    Yes           Yes           Yes
creditable
coverage

Guaranteed        Only for      Yes           No
access/           some
availability      individuals
                  leaving
                  group
                  coverage

Guaranteed        Yes           Yes           \Yes
renewability

Limitations on    No\b          Yes           Yes
preexisting
condition
exclusion
periods\a

Nondiscriminatio  N/A           Yes           Yes
n

Credit for prior  No            Yes           Yes
coverage
(portability)

Special           N/A           Yes           Yes
enrollment
period
----------------------------------------------------------
Notes:  Some of these standards also apply to certain federal, state,
and local government insurance programs, such as Medicaid or state
employee health plans.

N/A = not applicable. 

\a Preexisting conditions may be excluded from the coverage of a late
enrollee for up to 18 months. 

\b Issuers may not impose preexisting condition exclusions upon
individuals eligible for group-to-individual guaranteed access. 


   CERTIFICATE OF CREDITABLE
   COVERAGE
-------------------------------------------------- Appendix Appendix:1

HIPAA requires issuers of health coverage to provide certificates of
creditable coverage to enrollees whose coverage terminates.  The
certificates must document the period during which the enrollee was
covered so that a subsequent health issuer can credit this time
against its preexisting condition exclusion period.  The certificates
must also document any period during which the enrollee applied for
coverage but was waiting for coverage to take effect--the waiting
period--and must include information on an enrollee's dependents
covered under the plan. 


   GUARANTEED ACCESS/AVAILABILITY
-------------------------------------------------- Appendix Appendix:2

In the small-group market, carriers must make all plans available and
issue coverage to any small employer that applies, regardless of the
group's claims history or health status.  Under individual market
guaranteed access--often referred to as group-to-individual
portability--eligible individuals must have guaranteed access to at
least two different coverage options.  Generally, eligible
individuals are defined as those with at least 18 months of prior
group coverage who meet several additional requirements.\13 Depending
on the option states choose to implement this requirement, coverage
may be provided by carriers or under state high-risk insurance pool
programs, among others. 


--------------------
\13 An eligible individual also must have had no break in the prior
coverage of more than 63 consecutive days; must have exhausted any
Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA) or
other continuation coverage available; must not be eligible for any
other group coverage, or Medicare or Medicaid; and must not have lost
group coverage because of nonpayment of premiums or fraud. 


   GUARANTEED RENEWABILITY
-------------------------------------------------- Appendix Appendix:3

HIPAA requires that all health plan policies be renewed regardless of
health status or claims experience of plan participants, with limited
exceptions.  Exceptions include cases of fraud, failure to pay
premiums, enrollee movement out of a plan service area, cessation of
membership in an association that offers a health plan, and
withdrawal of a carrier from the market. 


   LIMITATIONS ON PREEXISTING
   CONDITION EXCLUSION PERIOD
-------------------------------------------------- Appendix Appendix:4

Group plan issuers may deny, exclude, or limit an enrollee's benefits
arising from a preexisting condition for no more than 12 months
following the effective date of coverage.  A preexisting condition is
defined as a condition for which medical advice, diagnosis, care, or
treatment was received or recommended during the 6 months preceding
the date of coverage or the first day of the waiting period for
coverage.  Pregnancy may not be considered a preexisting condition,
nor can preexisting conditions be imposed on newborn or adopted
children in most cases. 


   NONDISCRIMINATION
-------------------------------------------------- Appendix Appendix:5

Group plan issuers may not exclude a member within the group from
coverage on the basis of the individual's health status or medical
history.  Similarly, the benefits provided, premiums charged, and
employer contributions to the plan may not vary within similarly
situated groups of employees on the basis of health status or medical
history. 


   CREDIT FOR PRIOR COVERAGE
   (PORTABILITY)
-------------------------------------------------- Appendix Appendix:6

Issuers of group coverage must credit an enrollee's period of prior
coverage against their preexisting condition exclusion period.  Prior
coverage must have been consecutive, with no breaks of more than 63
days, to be creditable.  For example, an individual who was covered
for 6 months who changes employers may be eligible to have the
subsequent employer's plan's 12-month waiting period for preexisting
conditions reduced by 6 months.  Time spent in a prior health plan's
waiting period cannot count as part of a break in coverage. 


   SPECIAL ENROLLMENT PERIODS
-------------------------------------------------- Appendix Appendix:7

Individuals who do not enroll for coverage in a group plan during
their initial enrollment opportunity may be eligible for a special
enrollment period later if they originally declined to enroll because
they had other coverage, such as coverage under COBRA, or were
covered as a dependent under a spouse's coverage and later lost that
coverage.  In addition, if an enrollee has a new dependent as a
result of a birth or adoption or through marriage, the enrollee and
dependents may become eligible for coverage during a special
enrollment period. 


   OTHER INSURANCE-RELATED
   PROVISIONS
-------------------------------------------------- Appendix Appendix:8

HIPAA also includes certain other standards that relate to private
health coverage, including limited expansions of COBRA coverage
rights; new disclosure requirements for ERISA plans; and, to be
phased in through 1999, new uniform claims and enrollee data
reporting requirements.  Changes to certain tax laws authorize
federally tax-advantaged medical savings accounts for small employer
and self-employed plans.  Finally, although not included as part of
HIPAA but closely related, new standards for mental health and
maternity coverage became effective on January 1, 1998. 

RELATED GAO PRODUCTS

Health Insurance Standards:  New Federal Law Creates Challenges for
Consumers, Insurers, Regulators (GAO/HEHS-98-67, Feb.  25, 1998). 

Medical Savings Accounts:  Findings From Insurer Survey
(GAO/HEHS-98-57, Dec.  19, 1997). 

The Health Insurance Portability and Accountability Act of 1996: 
Early Implementation Concerns (GAO/HEHS-97-200R, Sept.  2, 1997). 

Private Health Insurance:  Continued Erosion of Coverage Linked to
Cost Pressures (GAO/HEHS-97-122, July 24, 1997). 

Employment-Based Health Insurance:  Costs Increase and Family
Coverage Decreases (GAO/HEHS-97-35, Feb.  24, 1997). 

Private Health Insurance:  Millions Relying on Individual Market Face
Cost and Coverage Trade-Offs (GAO/HEHS-97-8, Nov.  25, 1996). 

Health Insurance Regulation:  Varying State Requirements Affect Cost
of Insurance (GAO/HEHS-96-161, Aug.  19, 1996). 

Health Insurance for Children:  Private Insurance Coverage Continues
to Deteriorate (GAO/HEHS-96-129, June 17, 1996). 

Health Insurance Portability:  Reform Could Ensure Continued Coverage
for Up to 25 Million Americans (GAO/HEHS-95-257, Sept.  19, 1995). 

Health Insurance Regulation:  National Portability Standards Would
Facilitate Changing Health Plans (GAO/HEHS-95-205, July 18, 1995). 

The Employee Retirement Income Security Act of 1974:  Issues, Trends,
and Challenges for Employer-Sponsored Health Plans (GAO/HEHS-95-167,
June 21, 1995). 

Health Insurance Regulation:  Variation in Recent State Small
Employer Health Insurance Reforms (GAO/HEHS-95-161FS, June 12, 1995). 


*** End of document. ***