The HHS Office of Civil Rights (OCR) has announced the opening of its "Phase 2" HIPAA audit program. We have been anticipating this program for some time. It potentially affects all HIPAA covered entities, including employer-sponsored group health plans, as well as business associates of those covered entities, such as third-party administrators for self-insured health plans.

The purpose of the audit program is to "assess compliance" with the HIPAA privacy, security, and breach notification rules. Accordingly, these audits will be directed at a cross-section of HIPAA covered entities and business associates, rather than based on specific complaints or news reports.

Covered entities and business associates that are potential candidates for audit will be contacted by email (check your spam filter!) and asked to complete a pre-audit questionnaire. Not all covered entities and business associates that go through the pre-audit process will be selected for audit. But those who fail to respond to the pre-audit questionnaire will still be included in the potential audit pool, and it seems fair to assume that a failure to respond may increase OCR's interest in conducting a full-scope audit. 

Based on the updated audit protocol that OCR is using to train its auditors, we have a good idea what OCR will be looking for if it conducts an audit. In the case of an employer-sponsored group health plan, the audit is likely to include a review of the following:

• The plan document (to determine whether the proper HIPAA plan language has been adopted)
     Continue Reading...

The U.S. Supreme Court has held that a self-insured health plan may not exercise reimbursement rights against a plan participant after settlement proceeds recovered by the participant from a third party have been spent or otherwise “dissipated.”

In the case, the plan paid $120,000 toward medical expenses incurred by the participant after he was injured by a drunk driver. The participant later recovered a $500,000 settlement from the drunk driver. The plan was entitled to seek reimbursement of $120,000 from the settlement, but it did not take adequate steps to enforce its rights. By the time the plan brought suit to enforce its right to reimbursement, the settlement proceeds had been paid to the participant and were gone. The plan attempted to recover the $120,000 from the participant, but the court held that the equitable remedies available under ERISA did not include a right to obtain payment from the participant after the settlement dollars were no longer in an identifiable fund.

The take-away? A self-insured health plan with a right to subrogation or reimbursement must assert its claim while the proceeds of a judgment or settlement are still in an identifiable fund, such as the trust account of the lawyer representing the participant in the personal-injury action. Otherwise, there may be nothing left from which to seek recovery. 

A copy of the court's opinion is available here.

The IRS has released the 2016 inflation-adjusted amounts for health savings accounts (HSAs) and high-deductible health plans (HDHPs).

HDHP Minimums and Maximums. The minimum annual deductible for an HDHP will be $1,300 for self-only coverage and $2,600 for family coverage. These amounts have not changed from the 2015 amounts. The maximum annual out-of-pocket for an HDHP will increase to $6,550 for self-only coverage and $13,100 for family coverage.

"Embedded" ACA Out-of-Pocket Maximum. The Affordable Care Act also sets out-of-pocket maximums for non-grandfathered plans. For 2016, the ACA maximum will be $6,850 for self-only coverage and $13,700 for family coverage (compared to $6,550 and $13,100 for HDHPs). In addition, recent HHS guidance provides that, beginning in 2016, the self-only ACA out-of-pocket maximum must be "embedded" within the family ACA out-of-pocket maximum, meaning that no individual may be subject to out-of-pocket expenses in excess of the self-only maximum. In the case of a plan intended to be an HDHP, this means that (1) the out-of-pocket maximum cannot exceed the lower maximum applicable to HDHPs, and (2) the out-of-pocket maximum for an individual covered under a family plan cannot exceed the ACA maximum for self-only coverage. 

Example. An HDHP for 2016 has a family deductible of $13,100, with no other cost sharing. This is permissible because it does not exceed either the ACA out-of-pocket maximum limit ($13,700) or the lower HDHP out-of-pocket maximum limit ($13,100). However, the plan must further provide that no member of the family will be required to contribute more than $6,850 toward      Continue Reading...

On the eve of the deadline for large controlling health plans (CHPs) to obtain an HPID, CMS has announced that it is indefinitely delaying enforcement of the regulations that require obtaining an HPID and using the HPID in covered transactions. The announcement is effective October 31, 2014 and applies “to all HIPAA covered entities, including healthcare providers, health plans, and healthcare clearinghouses.”

What Does This Mean for Large Health Plans? The immediate impact of this announcement appears to be that large CHPs are no longer required to obtain an HPID by the November 5, 2014 deadline. Whether or when they may be required to do so in the future will depend on when (or if) CMS decides to begin enforcing the regulations again.

What Does This Mean for Small Health Plans? The deadline for small CHPs to obtain an HPID was November 5, 2015. Technically, that deadline has been suspended as well, although with a year between now and then, it’s possible that CMS could reverse course and begin enforcing the rule again before then. So small plans should monitor the status of the rule, but likely will not want to attempt to obtain an HPID until further notice.

Where Did This Come From? The CMS announcement references a September 23, 2014 report from the National Committee on Vital and Health Statistics (NCVHS). In that report, the NCVHS unequivocally recommended that covered entities not begin using an HPID in transactions involving health plans. The report argues that there is already a      Continue Reading...

Health plans, including some employer-sponsored plans, face a looming deadline to obtain a HIPAA health plan identifier (HPID). There have been many questions surrounding this requirement, particularly as it applies to employer-sponsored plans. Recent FAQ guidance from CMS (here) has provided some key clarifications, although questions remain. Here's what you need to know.

Background. HIPAA requires health plans and other covered entities to engage in certain covered transactions in a standardized way. This is sometimes referred to as the HIPAA "transactions rule." The details of that rule are beyond what can be addressed here. But the key thing to understand is that the ACA amended the transactions rule to require health plans to obtain a specific identifier (the HPID) to be used in connection with covered transactions.

Deadline. For plans that are required to get an HPID, the deadline is November 5, 2014, unless the plan is a "small" health plan, in which case the deadline is November 5, 2015.

Small Health Plan. A small health plan is a plan that has $5 million or less in annual receipts. The CMS FAQs tell us that annual receipts mean premiums paid during the last full fiscal year, in the case of fully insured plans, and health care claims paid during the last full fiscal year, in the case of self-insured plans. Plans that are partially insured and partially self-insured combine the premiums and health care claims paid to determine their total annual receipts.

Stop-Loss Premiums. It's not clear whether annual receipts are intended to      Continue Reading...

A continuing area of uncertainty under health care reform has been the treatment of health reimbursement arrangements (HRAs) and other arrangements that might be used to allow employees to purchase health insurance through individual policies with the employer subsidizing some or all of the cost. A new notice from the IRS, HHS, and DOL (here) provides some clarity on these - and some related - issues.

Employer Payment Plans. As a preliminary matter, this guidance gives us a new term: "employer payment plan." This refers to an arrangement by which an employer provides payment or reimbursement of individual market insurance premiums in the manner described in an old Revenue Ruling (Rev. Rul. 61-146). Historically, these employer payment plans have been permissible and have allowed employers to provide pre-tax subsidies of individual market coverage.

Integration of Plans with Individual Market Coverage. A concern with HRAs and employer payment plans is that they may be treated as violating two key health care reform mandates: the prohibition on annual limits and the requirement to provide no-cost preventive care services. Previous FAQ guidance (see coverage here) said that HRAs would be treated as satisfying the annual limit rule if they were "integrated" with other coverage that satisfies the annual limit rule.

This guidance effectively confirms that treatment and provides a similar rule for preventive care. But the guidance goes on to say that HRAs and employer payment plans may not be treated as integrated with individual market coverage. Thus, an HRA or employer payment plan      Continue Reading...

We have been anticipating guidance from the IRS on the treatment of same-sex spouses for tax and benefit purposes in light of the Supreme Court's overturning of DOMA, and here it is.

Married Anywhere. Rev. Rul. 2013-17 (here) says that a same-sex couple validly married anywhere (including in a foreign country) will be recognized as married for federal tax purposes, even if their marriage is not recognized under the law of their home state. In other words, it’s a state-of-celebration rule, not a state-of-residence rule.

All Tax Purposes. The rule applies for all tax purposes, including employee benefits. So in addition to filing joint tax returns, same-sex spouses may obtain tax-free coverage for each other under health or cafeteria plans and are entitled to spousal rights under 401(k) and other qualified retirement plans. Also, medical expenses incurred by one spouse in a same-sex marriage will qualify for reimbursement from a flexible spending account or health savings account maintained by the other spouse. Recognition of the same-sex marriage may present an issue for participants in dependent care assistance plans, because the spouse's income and employment must now be taken into account.

Retroactivity. Individuals in existing same-sex marriages may go back and claim a refund for taxes on any imputed income that resulted from coverage of a same-sex spouse or children of a same-sex spouse under a health or cafeteria plan. Employers may also be able to obtain refunds of employment taxes imposed on imputed income. The refunds are limited to years for which the statute      Continue Reading...

In a closely watched and sharply divided opinion today, the Supreme Court invalidated the federal Defense of Marriage Act (DOMA) and its directive that only opposite-sex spouses may be recognized as spouses for purposes of federal law. Although the details and impact of the decision are still being parsed and evaluated, the bottom line is that same-sex couples who are recognized as validly married under state law are entitled to be recognized as spouses for purposes of federal law.

Brief Background. The case involved a same-sex couple, Edith Windsor and Thea Spyer, who had been married in Canada and whose marriage was recognized as valid under New York law, where they lived. Ms. Spyer died and left her estate to Ms. Windsor, who was required to pay federal estate tax because, under DOMA, she could not rely on an estate tax exception that allows for tax-free transfers of property between spouses at death. She sued for a refund of the taxes, claiming DOMA was unconstitutional.

The Court’s Analysis. Five of the nine Supreme Court justices agreed that DOMA was unconstitutional because it violated the equal protection rights of same-sex individuals who were recognized under state law as validly married. The Court essentially said that if a same-sex couple and an opposite-sex couple are treated the same under state law, they are constitutionally entitled to equal treatment under federal law.

Implication for Employee Benefit Plans. The case has many implications for employee benefit plans. For health plans, qualifying same-sex spouses that are covered under      Continue Reading...

The U.S. Supreme Court issued an opinion last week (U.S. Airways v. McCutchen) affirming a health plan’s right to enforce express plan language allowing it to recover benefits paid on behalf of a participant when the participant later recovers those benefits from a third party. But the court created a new wrinkle with respect to a plan's obligation to share in the costs of that recovery.

Background. The facts of the case are fairly straightforward. An employee was injured in a car accident, and the plan paid $66,866 in benefits related to those injuries. The employee then sued the individual who caused the accident and recovered $110,000. 40% of the recovery went to the employee’s lawyer, leaving a net recovery of $66,000. The plan claimed it was entitled to the remaining $66,000 based on language in the plan giving it the right to be reimbursed out of any third­-party recoveries. The employee resisted paying the full $66,000 to the plan on the basis that it would be unfair for the plan to be reimbursed off the top without sharing in any of the costs of the recovery.

Plan Terms Control. The court first addressed whether general equitable principles (fairness, essentially) could override the express terms of the plan. In other words, could the participant defend against the plan's express right to reimbursement by asserting it was unfair? The court said no. The plan terms are controlling, even if they arguably work an unfair result.

But there was more.

Sharing the Costs of Recovery.      Continue Reading...

A federal appeals court has ruled against a Wisconsin employer seeking reimbursement under a stop-loss-insurance policy purchased in connection with its self-insured health plan.

The facts of the case are simple and all-too-common. An employee took FMLA leave and continued to receive health coverage through the employer's plan during the leave. At the end of the FMLA leave, the employee was unable to return to work, so the employer approved a further non-FMLA leave and continued to provide the employee with coverage under the health plan. But the plan language did not allow for continued eligibility during a non-FMLA leave of absence. The plan would have allowed for COBRA coverage to begin at the end of the FMLA leave, but no COBRA notice was issued and no COBRA election was made. (The employer subsequently offered COBRA when the employee was unable to return to work following the non-FMLA leave.) The employee incurred large claims under the health plan after the FMLA leave ended.

The stop-loss insurer argued - and the court agreed - that it was not obligated to reimburse the employer for claims incurred by the employee after the FMLA leave ended, because the stop-loss policy limited coverage to claims incurred by individuals who were eligible under the terms of the self-insured health plan, and the plan language did not extend eligibility during non-FMLA leaves. And even though the employee could have elected COBRA at the end of the FMLA leave and continued coverage for up to 18 (or even 29)      Continue Reading...