Important Deadline and Action Required: The Health Plan Identifier Number: HIPAA Expansion Under the ACA
It is hard to believe that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted almost 20 years ago. In its overly complicated and technical requirements, it included provisions that began the compliance rules regarding the integration of security, privacy, and administrative simplification. These requirements included standards for electronic healthcare transactions, which the government believed would improve efficiency and reduce costs in the nation’s healthcare system.
The ACA expanded these HIPAA transaction standards and directed HHS to craft regulations and standards for electronic transactions. The result of this expansion is the requirement that by November 7, 2016, all entities that meet the definition of a “health plan” must obtain a Health Plan Identifier (HPID). As with other HIPAA compliance standards, fully insured plans will be able to depend on the insurance carrier for compliance and will be covered by their insurance carrier’s unique identifier. Self-insured group plans are considered “covered entities” and must be compliant with the HPID mandate.
Self-insured health plans with more than $5 million in annual claims are required to register for a unique HPID by November 5, 2014. Those health plans with less than $5 million in annual claims are not required to obtain this HPID until November 5, 2015.
As with any regulations, especially regarding HIPAA and the ACA, simple and easy is not common. First, a plan must meet the definition of a “health plan.” The definition, for the purpose of the administrative simplification requirements, includes self-insured plans, as stated above. There are, of course, new rules that separate plans into two categories: Controlling Health Plan (CHP) and Sub-Health Plan (SHP).
Controlling Health Plan (CHP): This is a health plan that controls its own business activities, actions, or policies; OR
a. Is controlled by an entity that is not a health plan; and
b. If it has a sub-health plan(s), exercises sufficient control over the sub-health plan(s) to direct its/their business activities, actions, or policies.
Sub-health plan (SHP): SHP is defined as a health plan whose business activities, actions, or policies are directed by a controlling health plan. A self-insured plan that is an SHP may obtain a Health Plan Identifier number, but it is not directly required to do so.
The final regulations get more confusing in that they require any CHP self-insured plan to obtain a HPID, even if it does not conduct any of the electronic transactions and the identifier will not be used for this purpose. So, should all self-insured plans automatically obtain a HPID? Since no electronic transactions are being passed, it seems unnecessary. However, the regulations state that the HPID can be used for “any other lawful purpose,” so we must assume that at some future time, which could be next year or some day in the very distant future, this identifier will be used for some reporting purpose; therefore, it is best to follow the steps and obtain the number. Compliance is never a bad thing.
Health FSAs and HRAs
HIPAA treats FSAs and HRAs as self-insured and are typically subject to all HIPAA requirements. If an employer is using an insured plan, but offering a Health FSA or HRA (or both), the HPID requirement exists for these related plans. Self-insured health plans using these accounts would be responsible for obtaining separate identifiers, unless they meet the definition of the SHP.
November 5, 2014, is not that far away! The Centers for Medicare and Medicaid Services (CMS) created a website that has information about the HPID process. You can find it here.
They also provide a user guide for assistance in the application process.
Do not delay! November 5, 2014, will be here soon!