Updated September 2014
To meet federal requirements, large health plans must obtain a national health plan identifier number (HPID) by November 5, 2014. For this requirement, a large health plan is one with more than $5 million in annual receipts. The Department of Health and Human Services (HHS) has said that since health plans do not have receipts, insured plans should look at premiums for the prior plan year and self-funded plans should look at claims paid for the prior plan year. Small health plans (those with less than $5 million in claims during the prior plan year) have until November 5, 2015, to obtain an HPID.
Although this requirement applies to all health plans, the insurer will obtain the identifier number for fully insured plans. Self-funded plans will need to obtain the number, even if they use a third party administrator (TPA) to pay claims.
Unfortunately, there are a number of open questions about how a self-funded plan should comply with this requirement. We will update this article as additional information becomes available.
Why must health plans obtain an HPID?
One of the goals of the Health Insurance Portability and Accountability Act (HIPAA) is to pay claims and conduct other plan-related transactions more efficiently. Efficient electronic processing requires standardization, and the HPID requirement is part of that standardization and automation effort. An HPID is a 10-digit numeric identifier that will be used as the plan’s unique identification number for all HIPAA-covered transactions. Plans will be required to use HPIDs in specified HIPAA standard transactions by November 7, 2016.
Which health plans must obtain an HPID?
“Controlling Health Plans” (CHPs) are required to obtain an HPID. “Subhealth Plans” (SHPs) may obtain an HPID. A CHP is defined as a health plan that either:
- Controls its own business activities, actions, or policies; or
- Is not controlled by an entity that is not a health plan, and if it has one or more subhealth plans, exercises sufficient control over the subhealth plan to direct its business activities, actions, or policies.
An SHP is defined as a health plan whose business activities, actions, or policies are directed by a controlling health plan.
These definitions were written with insurance companies in mind, since they will be the ones obtaining and using most of the HPIDs. Applying them to self-funded plans can be a bit confusing and HHS has not released any guidance explaining how to handle multiple plans offered by a single employer. In the absence of specific instructions, a reasonable approach would seem to be to use the same approach as the employer uses with its Form 5500 filing. If an employer bundles all of its group health benefits into a single “wrap” plan and files a Form 5500 under a single plan number, the employer should probably apply for a single HPID for the wrap plan. Conversely, if an employer has self-funded dental or vision plans that are separate from the medical plan (for example, they have separate plan documents and a separate Form 5500 filing), each of those plans may need their own HPID.
Health reimbursement arrangements (HRAs) and health flexible spending accounts (HFSAs) generally are considered group health plans, so it is likely that these plans will need an HPID if claims or eligibility are handled electronically. If the HRA or HFSA cannot be bundled with a self-funded medical plan, it may need an HPID. However, most HRAs and HFSAs will have less than $5 million in annual claims, and so will not need to obtain the HPID until November 5, 2015. The employer may want to discuss options with its claims administrator(s). An HPID is not needed for a benefit that is not considered a group health plan, such as life, disability, or a health savings account (although the related high deductible health plan will need an HPID).
How does an employer determine if the group health plan has receipts of more than $5 million?
Self-funded plans should look at the total paid claims for the prior fiscal (plan) year. Stop-loss insurance premiums and administrative fees paid by an employer or plan sponsor should not be included. Paid claims are gross claims — any stop loss reimbursements should be disregarded.
Presumably, claims paid by all plans that are being included under one HPID should be totaled when determining if the plan exceeds the $5 million threshold that triggers a November 5, 2014, due date.
How will the HPID be used?
HIPAA-covered entities (health plans, health care clearinghouses, and health care providers) that electronically transmit health information relating to a covered transaction will be required to use the plan’s HPID beginning in November 2016. Covered transactions include the payment of health care claims, health care claim status, health plan eligibility, and the payment of health plan premiums.
How does a self-funded plan obtain an HPID?
An employer will apply for its HPID through the Centers for Medicare and Medicaid Services (CMS) website. Many employers will first need to register and set up a health insurance oversight system (HIOS) account at https://portal.cms.gov/wps/portal/unauthportal/home/. Note that an individual must have a login before they can register a new user account. To obtain a login, the individual must provide personally identifiable information (name, Social Security number, birthdate, home address, and primary phone number).
CMS has prepared step-by-step instructions in both graphic and text formats in its Quick Guide and it also has prepared a short YouTube video — Learn how a Controlling Health Plan can obtain a Health Plan Identifier! — that will also walk the submitter through the process. Keep in mind that there are several steps to this process, so it cannot be completed in one session.
To begin the process the employer will need to provide its legal name, federal EIN, state of incorporation and address. Employers typically do not have NAIC or A.M. Best numbers and those lines may be left blank.
When completing the HPID section, when asked to provide either an NAIC or Payer Identification Number, the NAIC line may be left blank and the submitter should enter “not applicable” under Payer Identification Number.
An “authorizing official,” who may not be the named submitter, must be designated. This official needs to be a company executive with the authority to approve the HPID application, such as the CEO, COO or CFO. The authorizing official’s name, email address and phone number must be provided.
Detailed information is available at: http://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/Affordable-Care-Act/Health-Plan-Identifier.html and at http://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/Affordable-Care-Act/Downloads/HPOESTrainingSlidesMarchSlideDeck.pdf.
What steps should self-funded plans take to comply with this requirement?
The employer needs to determine:
- Which self-funded plan(s) are its CHP
- Whether to include other group health benefits under the CHP or if any could or should be considered an SHP, or another CHP
- Whether the CHP paid enough claims during the prior plan year ($5 million or more) that it needs to obtain an HPID by November 5, 2014
If an HPID is needed, the employer or plan sponsor must take the steps described above to obtain the HPID. Once the HPID is received, the employer should provide the number to its claims administrator, and any other TPA that provides help with covered transactions. Employers also should review their business associate agreements to ensure that the business associate is required to include HPIDs in any covered transaction.
Health Plan Certification of Compliance with HIPAA Transaction Rules Due December 2015
Entities that sponsor self-funded group health plans also should be aware that health plans will be required to file two one-time certifications with HHS attesting that the plan is in compliance with certain HIPAA transaction requirements. Currently, one certification is due for all size plans by December 31, 2015, and the other is due by December 31, 2015, for large plans ($5 million or more in claims) and by December 31, 2016, for small plans. The certification process involves going through a specific technical systems testing process defined in proposed regulations. Insurers will file the certifications for fully insured plans, but self-funded plans will need to file these certifications. At this time, the requirements are not well defined, but employers with self-funded plans should keep this on their long-term “to do” list.