Due by November 5, 2014 for Self-funded plans that have more than $5 million in claims in the prior year
To meet federal requirements, large health plans must obtain a national health plan identifier number (HPID) by November 5, 2014. For this requirement, a large health plan is one with more than $5 million in annual receipts. The Department of Health and Human Services (HHS) has said that since health plans do not have receipts, insured plans should look at premiums for the prior plan year and self-funded plans should look at claims paid for the prior plan year. Small health plans (those with less than $5 million in claims during the prior plan year) have until November 5, 2015, to obtain an HPID.
Although this requirement applies to all health plans, the insurer will obtain the identifier number for fully insured plans. Self-funded plans will need to obtain the number, even if they use a third party administrator (TPA) to pay claims.
Since our September article, HHS has issued several FAQs that address some of the open questions about how a self-funded plan should comply with this requirement. The primary clarification in the FAQs is that health flexible spending accounts (HFSAs) and health savings accounts (HSAs) are not required to obtain an HPID. In addition, a health reimbursement arrangement (HRA) does not need to obtain an HPID if HRA funds may only be used to reimburse the deductible or other out-of-pocket costs, like co-pays and coinsurance. HHS has also — at least temporarily — removed the requirement that an “authorizing official” approve the request for the HPID.
Why must health plans obtain an HPID?
One of the goals of the Health Insurance Portability and Accountability Act (HIPAA) is to pay claims and conduct other plan-related transactions more efficiently. Efficient electronic processing requires standardization, and the HPID requirement is part of that standardization and automation effort. An HPID is a 10-digit numeric identifier that will be used as the plan’s unique identification number for all HIPAA-covered transactions. Plans will be required to use HPIDs in specified HIPAA standard transactions by November 7, 2016.
Which health plans must obtain an HPID?
“Controlling Health Plans” (CHPs) are required to obtain an HPID. “Subhealth Plans” (SHPs) may obtain an HPID. A CHP is defined as a health plan that either:
- Controls its own business activities, actions, or policies; or
- Is not controlled by an entity that is not a health plan, and if it has one or more subhealth plans, exercises sufficient control over the subhealth plan to direct its business activities, actions, or policies.
An SHP is defined as a health plan whose business activities, actions, or policies are directed by a controlling health plan.
These definitions were written with insurance companies in mind, since they will be the ones obtaining and using most of the HPIDs. Applying them to self-funded plans can be a bit confusing and HHS has not released any guidance explaining how to handle multiple plans offered by a single employer. In the absence of specific instructions, a reasonable approach would seem to be to use the same approach as the employer uses with its Form 5500 filing. If an employer bundles all of its group health benefits into a single “wrap” plan and files a Form 5500 under a single plan number, the employer should probably apply for a single HPID for all self-funded benefits under the wrap plan. Conversely, if an employer has self-funded dental or vision plans that are separate from the medical plan (for example, they have separate plan documents and a separate Form 5500 filing), each of those plans may need their own HPID.
Although HRAs and HFSAs generally are considered group health plans, HHS has said that these plans usually will not need an HPID. (An HRA does not need to obtain an HPID if HRA funds may only be used to reimburse the deductible or other out-of-pocket costs, like co-pays and coinsurance; HHS assumes that in this situation there will be a related medical plan obtaining an HPID.) An HPID is not needed for a benefit that is not considered a group health plan, such as life, disability, or a health savings account (although the related high deductible health plan will need an HPID).
How does an employer determine if the group health plan has receipts of more than $5 million?
Self-funded plans should look at the total paid claims for the prior fiscal (plan) year. Stop-loss insurance premiums and administrative fees paid by an employer or plan sponsor should not be included. Paid claims are gross claims — any stop loss reimbursements should be disregarded.
Presumably, claims paid by all plans that are being included under one HPID should be totaled when determining if the plan exceeds the $5 million threshold that triggers a November 5, 2014, due date.
How will the HPID be used?
HIPAA-covered entities (health plans, health care clearinghouses, and health care providers) that electronically transmit health information relating to a covered transaction will be required to use the plan’s HPID beginning in November 2016. Covered transactions include the payment of health care claims, health care claim status, health plan eligibility, and the payment of health plan premiums.
How does a self-funded plan obtain an HPID?
An employer will apply for its HPID through the Centers for Medicare and Medicaid Services (CMS) website. Many employers will first need to register and set up a health insurance oversight system (HIOS) account at https://portal.cms.gov/wps/portal/unauthportal/home/. Note that an individual must have a login before they can register a new user account. To obtain a login, the individual must provide personally identifiable information (name, Social Security number, birthdate, home address, and primary phone number).
CMS has prepared — and now updated — step-by-step instructions in both graphic and text formats in its Quick Guide and it also has prepared a short YouTube video — Learn how a Controlling Health Plan can obtain a Health Plan Identifier! — that will also walk the submitter through the process. Keep in mind that there are several steps to this process, so it cannot be completed in one session.
To begin the process the employer will need to provide its legal name, federal EIN, state of incorporation and address. Employers typically do not have NAIC or A.M. Best numbers and those lines may be left blank.
When completing the HPID section, when asked to provide either an NAIC or Payer Identification Number, the NAIC line may be left blank and the submitter should enter “not applicable” under Payer Identification Number.
Detailed information is available at: http://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/Affordable-Care-Act/Health-Plan-Identifier.html and at http://www.cms.gov/Regulations-and-Guidance/HIPAA-Administrative-Simplification/Affordable-Care-Act/Downloads/HPOESTrainingSlidesMarchSlideDeck.pdf. Questions may be directed to HPIDquestions@noblis.org.
What steps should self-funded plans take to comply with this requirement?
The employer needs to determine:
- Which self-funded plan(s) are its CHP
- Whether to include other group health benefits under the CHP or if any could or should be considered an SHP, or another CHP
- Whether the CHP paid enough claims during the prior plan year ($5 million or more) that it needs to obtain an HPID by November 5, 2014
If an HPID is needed, the employer or plan sponsor must take the steps described above to obtain the HPID. Once the HPID is received, the employer should provide the number to its claims administrator, and any other TPA that provides help with covered transactions. Employers also should review their business associate agreements to ensure that the business associate is required to include HPIDs in any covered transaction.
Health Plan Certification of Compliance with HIPAA Transaction Rules Due December 2015
Entities that sponsor self-funded group health plans also should be aware that health plans will be required to file two one-time certifications with HHS attesting that the plan is in compliance with certain HIPAA transaction requirements. Currently, one certification is due for all size plans by December 31, 2015, and the other is due by December 31, 2015, for large plans ($5 million or more in claims) and by December 31, 2016, for small plans. The certification process involves going through a specific technical systems testing process defined in proposed regulations. Insurers will file the certifications for fully insured plans, but self-funded plans will need to file these certifications. At this time, the requirements are not well defined, but employers with self-funded plans should keep this on their long-term “to do” list.