The Health Insurance Portability and Accountability Act (HIPAA) of 1996: Overview and Guidance on Frequently Asked Questions

CRS Report for Congress
The Health Insurance Portability and
Accountability Act (HIPAA) of 1996:
Overview and Guidance on
Frequently Asked Questions
Updated January 24, 2005
Hinda R. Chaikind, Jean Hearne,
Bob Lyke, and Stephen Redhead
Specialists in Social Legislation
Domestic Social Policy Division


Congressional Research Service ˜ The Library of Congress

The Health Insurance Portability and Accountability Act
(HIPAA) of 1996: Overview and Guidance on
Frequently Asked Questions
Summary
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (P.L.
104-191), provided for changes in the health insurance market. It guaranteed the
availability and renewability of health insurance coverage for certain employees and
individuals, and limited the use of preexisting condition restrictions. The Act created
federal standards for insurers, health maintenance organizations (HMOs), and
employer-provided health plans, including those that self-insure. It permitted,
however, substantial state flexibility for compliance with the requirements on
insurers.
HIPAA also included tax provisions relating to health insurance. It permitted
a limited number of small businesses and self-employed individuals to contribute to
tax-advantaged medical savings accounts (MSAs) established in conjunction with
high-deductible health insurance plans. It increased the deduction for health
insurance that self-employed taxpayers may claim. In addition, it allowed long-term
care expenses to be treated like deductible medical expenses and clarified the tax
treatment of long-term care insurance.
Finally, the Act included administrative simplification and privacy provisions
instructing the Secretary of HHS to issue standards addressing the electronic
transmission of health information and the privacy of personally identifiable medical
information.
Since the passage of HIPAA, there have been subsequent amendments. In 1996,
new provisions required group health plans and insurers to cover minimum hospital
stays for maternity care and for a limited period, to provide parity in certain mental
health benefits. Parity was later extended for one year. In 1998, a provision was
passed requiring health plans that cover mastectomy to also offer reconstructive
breast surgery. Amendments have also increased the tax deduction for premiums
paid by self-employed taxpayers.
The Act, as amended, continues to generate numerous questions. What kinds
of policies does it cover? Does it help people who are currently uninsured? Does it
help people with preexisting medical conditions? How does it affect health insurance
premiums? How do its requirements interact with the Consolidated Omnibus Budget
Reconciliation Act (COBRA) continuation coverage? Answers to those questions,
as well as other commonly asked questions, are provided, as well as descriptions of
each of the major sections of HIPAA.
Some of the answers provided may not be definitive. This is because, in some
cases, final regulations have not yet been promulgated. Other regulations, such as
those defining the administrative simplification provisions, remain under
development. In addition, the answers to many questions about the requirements on
the individual health insurance market depend upon particular state responses to the
Act. For some provisions, states were allowed the choice of implementing the
HIPAA requirements (“the federal fallback”) or establishing acceptable alternative
mechanisms.



Contents
Part I. The Act in General...........................................1
Does HIPAA help individuals who are uninsured?................2
Are employers required to offer health insurance as a benefit?.......3
Part II. Health Insurance Reforms.....................................3
Portability ....................................................3
What is creditable coverage?.................................3
What is a preexisting medical condition?.......................4
What is a preexisting medical condition limitation period?.........4
Portability in the Group Market...................................5
How do people take full advantage of the portability provisions
of the Act?...........................................5
How long can a group health plan restrict coverage for a
preexisting medical condition?...........................5
What is late enrollment?....................................6
What is a waiting period? How does it differ from a preexisting
condition limitation period?..............................6
Do plans and issuers have any discretion in the method of
crediting prior coverage?...............................7
Do these protections apply to an individual’s spouse and children ?..7
Portability and Guaranteed Availability in the Individual Insurance
Market ..................................................7
Who is eligible for group-to-individual market portability and
guaranteed availability under the Act?......................8
What are the limitations of the group-to-individual portability
and guaranteed availability protections?....................8
What are the requirements for an acceptable alternative state
mechanism? ..........................................9
How have states implemented this provision?...................10
Special Enrollment Periods in the Group Market....................13
Non-Discrimination in the Group Market..........................14
Can a group health plan refuse to enroll individuals with
a history of illness or disability or high medical expenses?
Can it drop someone from coverage who becomes sick
or starts using a lot of medical care?......................14
Can an employer condition coverage under its health plan
on passing a physical examination?.......................15
Can a group plan refuse to enroll individuals who engage
in high-risk recreational activities?.......................15
Can a group plan exclude coverage of treatments for injuries
obtained while engaging in high-risk recreational activities?...15
Do these non-discrimination protections apply to an individual’s
spouse and children?..................................16
Does the Act restrict the premium amounts that an employer
can charge for health insurance?.........................16



Guaranteed Issue and Guaranteed Renewability.....................16
Can health insurance issuers drop or cancel coverage for
groups because of high medical costs?....................17
Federally Required Benefits.....................................17
Mental Health Parity......................................17
Newborns’ and Mothers’ Health Protection Act.................18
Women’s Health and Cancer Rights Act of 1998................18
Can an employer exclude coverage for specific types of illnesses,
such as cancer, or acquired immune deficiency syndrome
(AIDS) or treatment of injuries associated with high-risk
activities? ...........................................18
General Questions About the Health Insurance Reforms..............19
Do the requirements of the Act apply to the plans of
employers that provide for dental-only coverage
or vision-only coverage?...............................19
Do the requirements of the Act apply to association-
sponsored group health plans?...........................19
Can states impose requirements on insurers selling to group
health plans that are different from those in the Act?.........19
Do the insurance reforms apply to Federal Employees'
Health Benefits Plans (FEHBP)?.........................20
Does the Act regulate the premium amount that an issuer
can charge an eligible individual?........................20
Implementation and Enforcement................................20
How are the insurance requirements of the Act enforced?.........20
What regulations have been promulgated to define HIPAA?.......21
COBRA Continuation Coverage.................................26
How does COBRA continuation coverage interact with HIPAA?...26
Does HIPAA make any changes in COBRA continuation
of coverage requirements?..............................26
Part III. Other Provisions..........................................27
Administrative Simplification...................................27
Medical Savings Accounts......................................28
Health Insurance for Self-Employed Taxpayers.....................29
Self-Insured Plans............................................29
Long-Term Care..............................................29
Accelerated Death Benefits.....................................31
State Insurance Pools..........................................31
Treatment of Certain Health Insurance Providers....................32
IRA Distributions for Medical Expenses and Insurance...............32
Organ and Tissue Donation Information...........................32
List of Tables
Table 1. State Group-to-Individual Insurance Portability Mechanisms.......10
Table 2. Federal Insurance Regulations Promulgated under HIPAA.........22



The Health Insurance Portability and
Accountability Act (HIPAA) of 1996:
Overview and Guidance on
Frequently Asked Questions
The Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191,
HIPAA) provided for changes in the health insurance market and imposed certain
federal requirements on health insurance plans offered by public and private
employers. It guaranteed the availability and renewability of health insurance
coverage for certain employees and individuals, and limited the use of preexisting
condition restrictions. The Act established federal standards for insurers, health
maintenance organizations (HMOs), and employer plans, including those who self-
insure. However, it allowed states and sometimes insurers substantial state flexibility
for compliance with the federal requirements.
HIPAA also included tax provisions relating to health insurance. It permitted
a limited number of small businesses and self-employed individuals to contribute to
tax- advantaged medical savings accounts (MSAs) established in conjunction with
high-deductible health insurance plans. It increased the deduction for health
insurance that self-employed taxpayers may claim. In addition, it allowed long-term
care expenses to be treated like deductible medical expenses and clarified the tax
treatment of long-term care insurance.
HIPAA amended the Employee Retirement Income Security Act (ERISA), the
Public Health Service (PHS) Act, and the Internal Revenue Code (IRC). In general,
requirements on employer plans are found in the ERISA and IRC amendments;
requirements on health insurance issuers, such as insurance carriers and health
maintenance organizations (HMOs) are found in the PHS Act and ERISA
amendments. The increased deduction for the self-employed, tax-favored MSAs, and
long-term care provisions are amendments to the IRC.
Part I. The Act in General
The basic intent of HIPAA’s health insurance provisions is to lower the
possibility that people and small employers will lose existing health plan coverage,
and to make it easier for individuals to switch plans or to purchase coverage on their
own if they lose employer-offered coverage. The health insurance reforms ensure
that people who are moving from one job to another or from employment to
unemployment are not denied health insurance because they have a preexisting
medical condition (portability) and limit the waiting time before a plan covers any
preexisting medical condition for participants and beneficiaries in group health plans.



The reforms were also intended to guarantee that individuals and employers who
choose to purchase coverage are able to find a plan (guaranteed issue) and that
individuals already covered, as well as employers that offer coverage to their
employees, are able to renew their coverage (guaranteed renewal). Finally, the health
insurance provisions prohibit discrimination on the basis of health status (non-
discrimination) and require plans to offer special enrollment periods.
Other HIPAA provisions seek to make health insurance more affordable. The
Act raised the tax deduction for health insurance premiums paid by the self-
employed. MSAs coupled with qualified high deductible health insurance plans were
made available on a trial basis to a limited number of individuals. New tax
incentives were made available to encourage individuals and employers to purchase
long-term care insurance. Finally, the Act included administrative simplification and
privacy provisions instructing the Secretary of HHS to issue standards addressing the
electronic transmission of health information and the privacy of personally
identifiable medical information.
Additional federal protections have been added since the passage of HIPAA.
The protections required plans that cover newborn delivery to allow for a minimum
two-day hospital stay under certain conditions, required plans that offer mental health
services to offer them subject to similar limitations as other health benefits, and
required plans that cover mastectomy to also cover reconstructive surgery. In
addition, the deduction allowed for premium costs for the self-employed was
changed.
Does HIPAA help individuals who are uninsured? HIPAA’s insurance
provisions were designed to help insured Americans who have a preexisting medical
condition and have stayed in a job because they fear that they would lose coverage
for such a condition if they change to a new employer or move to an individual
policy. It also would help those who have been denied the option to purchase
insurance as an individual or through their employer because of their health status.
They do not address the larger problem of the uninsured, estimated to be 45 million
people in 2003, although other HIPAA provisions, such as the tax deductibility of
health insurance costs for the self-employed, may encourage some uninsured, self-
employed individuals to purchase coverage for themselves.
It is also the case that HIPAA largely addresses the availability of insurance and
does not regulate the price of health insurance coverage.1 Some evidence suggests
that the cost of health insurance in the individual market for individuals taking
advantage of HIPAA’s group-to-individual portability provisions is significantly
higher than the cost for individuals who could otherwise obtain insurance. This may
be discouraging many “HIPAA eligibles” from buying insurance.2 Whether this
experience continues over the long run remains to be seen.


1 Insurance that is regulated by state law may be subject to state premium limits. There are
no premium limits on self-insured employer plans.
2 U.S. General Accounting Office, Health Insurance Standards: New Federal Law Creates
Challenges for Consumers, Insurers, Regulators, GAO/HEHS-98-67 (February 1998).

Are employers required to offer health insurance as a benefit? No,
the Act does not require employers to offer or pay for health insurance for their
employees. Also, the Act does not require employers to offer or pay for family
coverage (spouses and dependents). Finally, the Act does not require employers to
cover part time, seasonal, or temporary employees. However, an employer who
elects to sponsor a group health plan has to comply with certain requirements of the
Act. These requirements: (a) restrict the use of preexisting condition limitation
periods; (b) prohibit an employer plan from discriminating on the basis of health
status in determining the eligibility of an employee to enroll in a group health plan
(and the employee’s spouse and dependents if the plan provides family coverage); (c)
prohibit an employer plan from requiring an individual to pay premiums or
contributions which are greater than those charged to a similarly situated individual
on the basis of health status; and (d) mandate documentation of creditable coverage.
Part II. Health Insurance Reforms
Portability
HIPAA’s “portability” protection means that once a person obtains creditable
health plan coverage, he or she can use evidence of that coverage to reduce or
eliminate any preexisting medical condition exclusion period that might otherwise
be imposed when moving to another health plan. The protections apply when a
person moves from one group health plan to another, from a group health plan to an
individual policy, or from an individual policy to a group health plan. The concept
of portability is really one of being able to maintain coverage and being given credit
for having been insured when changing health plans. It does not mean that an
individual can take a specific health insurance policy from one job to another.
What is creditable coverage? The concept of creditable coverage is that
individuals are given credit for previous insurance when applying for a new plan.
Under the Act, creditable coverage is coverage under any of the following: (a)3
a group health plan; (b) health insurance coverage, including individual health
insurance coverage; (c) Medicare; (d) Medicaid; (e) military health care;4 (f) a
medical care program of the Indian Health Service or of a tribal organization; (g) a
state health benefits risk pool; (h) the Federal Employee Health Benefits Program;
(i) a public health plan (as defined in regulations); (j) a health benefit plan under


3 Health insurance coverage is defined as benefits consisting of medical care (provided
directly, through insurance or reimbursement, or otherwise and including items and services
paid for as medical care) under any hospital or medical service policy or certificate, hospital
or medical service plan contract or HMO contract offered by a health insurance issuer.
4 “Military health care” is care described under 10 U.S.C. Part 55.

Section 5(e) of the Peace Corps Act (22 U.S.C. 2504(e)); or (k) the State Children’s
Health Insurance Program (SCHIP).5
What is a preexisting medical condition? Under the Act, a preexisting
medical condition is a physical or mental condition for which medical advice,
diagnosis, care, or treatment was recommended or received within the 6-month
period ending on the enrollment date. The enrollment date is the date of enrollment
of the individual in the health plan or insurance, if earlier, the first day of the waiting6
period for such enrollment. Pregnancy is not considered a preexisting medical
condition. Also, a preexisting medical condition limit or exclusion may not be
imposed on covered benefits for newborns who are covered under creditable
coverage within 30 days of birth. Finally, a preexisting medical condition limit or
exclusion may not be imposed on covered benefits for newly adopted children or
children newly placed for adoption, if the child becomes covered under creditable
coverage within 30 days of the adoption or placement.
Final regulations7 implementing the health coverage portability provisions of
HIPAA addressed other types of benefit exclusions that are not designated as
preexisting condition exclusions by the plan, but are considered to be so by the
regulators. Examples of these specific benefit exclusions include provisions
excluding coverage of pregnancy until 12 months after the individual is eligible for
benefits, or provisions excluding treatment of injuries relating to accidents that
occurred prior to enrollment. Plans are required to bring those exclusions into
compliance with HIPAA portability provisions by July 1, 2005.
The Act also prohibits the use of genetic information as a preexisting condition,
unless there is a diagnosis of a preexisting medical condition related to the
information. For example, evidence of a positive test for the gene that predisposes
a woman to inheritable breast cancer cannot be treated as a preexisting condition,
unless a diagnosis of breast cancer is made within the 6-month period described
above.
What is a preexisting medical condition limitation period? During
this period, a plan may exclude or restrict coverage of a participant’s or beneficiary’s
preexisting medical condition. Under the Act, a group health plan is prohibited from
imposing more than a 12-month preexisting condition limitation period (18 months
for late enrollees) on an HIPAA-eligible participant or beneficiary. As described
below, that period is reduced by the amount of the individual’s creditable coverage.
In the individual market, HIPAA-eligible individuals also have portability protection,


5 Having creditable coverage does not necessarily make an individual eligible for the group-
to-individual market protections. See below for a discussion of the limitations of these
protections.
6 See below for more information on limitation and waiting periods.
7 U.S. Department of the Treasury, Department of Health and Human Services, and
Department of Labor, “Final Regulations for Health Coverage Portability for Group Health
Plans and Group Health Insurance Issuers Under HIPAA Titles I & IV,” 69 Federal Register

78720 (Dec. 30, 2004).



although the circumstances under which those protections apply are complex as
described in more detail below.
Portability in the Group Market
HIPAA requires group health plans (plans that are offered to an employment-
based group — including both employers and employee organizations) that are
covered by the Act to meet the following requirements related to portability:
!When a person with prior creditable coverage first enrolls in a group health
plan, the plan cannot impose a limitation period on a preexisting condition
that is longer than 12 months (18 months for late enrollees as defined below).
The length of the allowed preexisting condition limitation period is based on
any creditable coverage that an individual may have. The plan cannot apply
any preexisting condition waiting period on pregnancy, a covered newborn,
or on any covered child under 18 who is adopted (even if the adoption is not
finalized). However, the employer may still require individuals to work for
a period of time before they are allowed to participate in the health plan. This
is called a “waiting period” and should not be confused with a “preexisting
condition limitation period.”8
!Employers who sponsor group health plans are required to provide enrollees
with a certificate that states the amount of creditable coverage accumulated
and whether or not the enrollee was subject to a waiting period under the
employer’s plan. Individuals can use this certificate to demonstrate prior
creditable coverage when moving to a new group or individual health
insurance plan. The Act does not require an employer to continue offering
coverage to enrollees who have left their jobs, except under COBRA
continuation provisions as described below.
How do people take full advantage of the portability provisions of
the Act? To benefit from the Act, individuals should maintain coverage under a
health insurance plan without experiencing significant lapses in coverage. Since the
portability protection only applies to people with “continuous coverage”, which the
statute defines as coverage with no lapses of 63 or more days, individuals should not
allow their insurance coverage to lapse for 63 or more days.
How long can a group health plan restrict coverage for a
preexisting medical condition? Coverage of a preexisting medical condition
may be limited or excluded for up to 12 months for those who enroll in a health plan
when first eligible to enroll. In the case of late enrollment, the maximum permitted
limitation is 18 months.
For those moving from one group plan to another group plan, or from individual
to group coverage, the new plan must reduce any preexisting condition limitation
period by one month for every month that such individuals had creditable coverage
under a previous plan, provided that they enroll when first eligible and had no break


8 See below for more information on limitation and waiting periods.

in previous coverage of 63 or more continuous days. For example, individuals with
6 months of prior creditable coverage could face a maximum preexisting condition
limitation period of 6 months. Individuals with 11 months of prior creditable
coverage could face a maximum limitation period of 1 month. Once a 12-month
limitation period is met, no new limitation may ever be imposed as long as
continuous coverage is maintained (that is, there is no break in coverage lasting
longer than 62 days), even if there is a change in jobs or health plans. If there is a
period of 63 consecutive days during which individuals have no creditable coverage,
they may be subject to as much as a 12-month preexisting condition exclusion period
(or an 18 month exclusion for late enrollees).9
Individuals establish eligibility for a waiver of preexisting condition limitations
by presenting certifications that document prior creditable coverage. Health plans
and health insurance issuers must supply written certifications of: the period of
creditable coverage under the plan; coverage (if any) under COBRA continuation
provisions; and any waiting or affiliation periods imposed. The certification must be
provided: (1) when a participant is no longer covered under the plan or otherwise
becomes covered under a COBRA continuation provision; (2) after termination of
COBRA coverage, if applicable; and (3) upon a request which is made not later then
24 months after coverage ends. The interim rules issued by the three agencies
administering the Act provide guidance and model certification forms to streamline
this process.10 In general, the certification must be provided in writing.
What is late enrollment? Late enrollment occurs when an individual enrolls
in a group health plan other than during: (a) the first period in which the individual
is eligible to enroll under the plan, or (b) a special enrollment period. As described
above, a group health plan may require a late enrollee to wait 18 months before a
preexisting condition is covered.
What is a waiting period? How does it differ from a preexisting
condition limitation period? A waiting period is a set amount of time an
employee must wait before he or she is eligible to enroll in a health plan. For
example, an employer may require an employee to work for 6 months before health
insurance benefits become available. The Act does not limit this type of waiting
period — employers and health insurance issuers are free to determine the length of
a waiting period. However, the Act requires that any waiting period be applied
uniformly without regard to the health status of potential plan participants or
beneficiaries. Also, days in a waiting period are not taken into account when
determining whether an individual has experienced a break in coverage of 63 or more
days.
This differs from a preexisting condition exclusion limitation period which
allows plans to exclude coverage for certain preexisting health conditions for up to
12 months (or 18 months), as described above. Any waiting period required before
an employee or his or family member can become a plan participant or beneficiary
must run concurrently with any preexisting condition limitation period. For


9 See “What Is Late Enrollment?” below.
10 69 Federal Register 16894 (Apr. 8, 1997).

example, if an employer required an employee without any creditable coverage to
work for 5 months before he or she could enroll in the firm’s health plan, then the
preexisting condition limitation period imposed on the coverage of that individual
could not exceed 7 months from the date of actual enrollment in the plan. If that
individual had 7 or more months of creditable coverage, then no preexisting
condition limitation period could be imposed on the coverage under the new plan.
Do plans and issuers have any discretion in the method of crediting
prior coverage? Yes, when an individual changes plans, the new benefit package
may cover some benefits that were not covered under his or her most recent prior
plan, and the law allows the new plan or issuer some discretion in applying prior
creditable coverage to those new benefits. Plans and issuers may choose between
two alternatives when determining creditable coverage: 1) they can chose to include
all periods of coverage from qualified sources and thus not look at any specific
benefits; or 2) they can examine prior coverage on a benefit-specific basis, and are
allowed to exclude from creditable coverage any categories or classes of benefits not
covered under the most recent prior plan. The April 8, 1997 interim rule defines the
categories of benefits that may be considered separately to be: (a) mental health; (b)11
substance abuse treatment; (c) prescription drugs; (d) dental care; or (e) vision care.
Thus, for example, if a prior plan did not cover prescription drugs, and the new plan
includes this benefit, the new plan may exclude coverage of prescription drugs for up
to 12 months under this second method. If the second method is chosen, plans or
issuers must disclose its use at the time of enrollment or sale of the plan, and apply
it uniformly.
Do these protections apply to an individual’s spouse and children ?
Under a group health plan, an employer is not required to offer coverage to an
individual’s spouse or children. If the employer does offer family coverage, the same
protections apply to a spouse and dependents. Coverage may not be denied because
a family member is sick, and preexisting condition restrictions are limited as
described above.
Portability and Guaranteed Availability in the Individual
Insurance Market
HIPAA guarantees the availability of a plan and prohibits pre-existing condition
exclusions for certain eligible individuals who are moving from group health
insurance to insurance in the individual market. States have the choice of either
enforcing the HIPAA individual market guarantees, referred to as the “federal
fallback”, or they may establish an “acceptable alternative state mechanism”. In
states using the federal fallback approach, HIPAA requires all health insurance
issuers operating in the individual health insurance market to offer coverage to all
eligible individuals and prohibits them from placing any limitations on the coverage
of any preexisting medical condition.
Issuers can comply with the Act’s requirements in three ways:


11 69 Federal Register 16932, 16945-46, 16961-62.

(1) they must offer eligible individuals access to coverage to every individual
insurance policy they sell in the state; or
(2) they must offer eligible individuals access to coverage to their two most
popular insurance policies (based on premium volume); or
(3) they must offer eligible individuals access to a lower-level and higher-level
coverage. These two policies must include benefits that are substantially similar
to other coverage offered by the issuer in the state, and must include risk
adjustment, risk spreading, or financial subsidization.
Issuers can refuse to cover individuals seeking portability from the group market
if financial or provider capacity would be impaired. This means, for example, that
if a network-based plan like an HMO can demonstrate that it is filled to capacity,
then it would not have to accept eligible individuals. It would have to apply this
exception uniformly, without regard to the health status of applicants.
Who is eligible for group-to-individual market portability and
guaranteed availability under the Act? An eligible individual must have:
!creditable health insurance coverage for 18 months or longer;
!most recent coverage under a traditional employer group plan, governmental
plan, or church plan;
!exhausted any COBRA (or other continuation) coverage;12
!no eligibility for coverage under any employment-based plan, Medicare or
Medicaid; and
!no breaks in coverage of 63 or more days.13
Individuals purchasing insurance on their own who do not meet these eligibility
criteria, are not protected by HIPAA’s portability and guaranteed availability
provisions. These individuals may be protected under state laws.
What are the limitations of the group-to-individual portability and
guaranteed availability protections? The group-to-individual portability and
guaranteed availability protections apply only to individuals whose most recent
coverage was provided through traditional employer-based group arrangements,


12 Individuals may have continuation coverage that is not COBRA coverage under FEHBP
or under state continuation of coverage laws.
13 An eligible individual must have 18 months of creditable health insurance coverage, at
least the last day of which was under a group health plan. A child is deemed to be an
eligible individual if the child was covered under any creditable coverage within 30 days of
birth, adoption, or placement for adoption, and the child has not had a break in coverage of
63 or more days. (Issuers are not required, however, to offer family coverage.) 69 Federal
Register 16996 (Apr. 8, 1997)..

governmental plans or church-sponsored plans. Group plans are defined as those
meeting the ERISA definition, which is limited to those sponsored through a
traditional employer-employee relationship or an employment-based association.
Governmental plans are also defined in ERISA. They are plans that are established
or maintained for its employees by the Government of the United States, the
government of a state or a political subdivision of a state. This limitation means that
people whose most recent coverage was sponsored by the military (CHAMPUS and
TRICARE), many college-sponsored student plans, the Peace Corps, the Veterans
Administration, the Indian Health Service, Medicare, Medicaid and SCHIP are not
eligible for the federal group-to-individual portability and guaranteed availability
protections. (State laws, however, may offer these individuals such protections.)
What are the requirements for an acceptable alternative state
mechanism? An acceptable alternative state mechanism for coverage of eligible
individuals must:
!provide a choice of health insurance coverage to all eligible individuals;
!not impose any preexisting condition restrictions; and
!include at least one policy form of coverage that is comparable to either
comprehensive health insurance coverage offered in the individual market in
the state, or a standard option of coverage available under the group or
individual health insurance laws in the state.
In addition to these requirements, a state may implement one of the following
mechanisms:
!certain National Association of Insurance Commissioners (NAIC) Model
Acts14 ;
!a qualified high-risk pool15 that meets certain specified requirements; or
!other risk spreading or risk adjustment approach, or financial subsidies for
participating insurers or eligible individuals; or
!any other mechanism under which eligible individuals are provided a choice
of all individual health insurance coverage otherwise available.


14 The NAIC Model Acts include the Small Employer and Individual Health Insurance
Availability Model Act, as it applies to individual health insurance coverage, and as revised
in state regulations to meet all the necessary requirements and the Individual Health
Insurance Portability Model Act, as adopted on June 3, 1996 and revised in state regulation
to meet all necessary requirements.
15 A high-risk pool is generally the insurer of last resort, typically for sicker and/or older
individuals who: (1) are denied coverage in the private market; (2) are offered only
restricted coverage; or (3) cannot find less expensive coverage.

Examples of potential alternative state mechanisms include health insurance
coverage pools or programs, mandatory group conversion policies, guaranteed issue
of one or more plans of individual health insurance coverage, open enrollment by one
or more health insurance issuers, or a combination of such mechanisms.
How have states implemented this provision? Table 1 provides
information on how each state has implemented the Act’s group-to-individual
portability provisions. As of December 2003, the District of Columbia and 10 states
(Arizona, Delaware, Hawaii, Maryland, Missouri, Nevada, North Carolina, Rhode
Island, Tennessee, and West Virginia) utilize the federal fallback mechanism.
Missouri is also the only state that does not enforce these standards itself, and as a
result CMS is responsible for enforcement in Missouri. As shown in Table 1, many
states have elected to provide group-to-individual portability through high-risk pools,
while others utilize a combination of high-risk pools, existing state insurance reform
laws, or other mechanisms. To obtain more information on a state’s health insurance
regulation of the individual market, individuals may wish to contact that state’s
department of insurance.
Table 1. State Group-to-Individual Insurance Portability
Mechanisms
StateGroup-to-Individual Portability Provision
AlabamaAlternative mechanism — high-risk health insurance pool.
AlaskaAlternative mechanism — high-risk health insurance pool.
ArizonaFederal fall-back.
ArkansasAlternative mechanism — high-risk health insurance pool.
CaliforniaAlternate mechanism — plans must offer two most popular products.
ColoradoAlternative mechanism — high-risk health insurance pool.
ConnecticutAlternative mechanism — high-risk health insurance pool.
DelawareFederal fall-back.
District ofFederal fall-back.
Columbia
FloridaAlternative mechanism — guaranteed issue to HIPAA-eligible persons.
Health plans required to offer a choice of conversion plans, one of
which must be the state approved “standard policy” currently offered
in the small group market.
GeorgiaAlternative mechanism — assigned risk pool. HIPAA-eligible persons
may apply for coverage to the Insurance Commissioner who then
“assigns” eligible individuals to health plans based on a health plan’s
pro rata volume of individual health insurance business done in the
state.
HawaiiFederal fall-back.



StateGroup-to-Individual Portability Provision
IdahoAlternative mechanism — existing state insurance reform laws,
including guaranteed issue of three products (basic, standard, and
catastrophic), guaranteed renewal, preexisting condition limitations of
12/6, and also retains pregnancy as a preexisting condition (not in
compliance with HIPAA), coverage gap is 63 days, rating bands to limit
rate variations to a range of 1.7 to 1 for experience, health status and
duration and allows demographic adjustments for age and gender.
IllinoisAlternative mechanism — high-risk health insurance pool.
IndianaAlternative mechanism — high-risk health insurance pool.
IowaAlternative mechanism — high-risk health insurance pool.
KansasAlternative mechanism - high-risk health insurance pool.
KentuckyAlternative mechanism — high-risk health insurance pool.
LouisianaAlternative mechanism — high-risk health insurance pool.
MaineAlternative mechanism — existing state insurance reform laws,
including guaranteed issue of all products, guaranteed renewal, no
preexisting condition waiting period applied to HIPAA-eligibles and
12/6 for non-HIPAA eligibles, coverage gap of 63 days, community
rating with adjustments limited to a range of 1.5 to1 for age, smoking
status, industry, and geography.
MarylandFederal fall-back.
MassachusettsAlternate mechanism — existing state insurance reform laws, including
guaranteed issue of three products, guaranteed renewal, preexisting
condition limitations of 6/6 and coverage gap of 63 days, modified
community rating with adjustments for age, geography and benefit level
limited to a range of 2 to 1.
MichiganAlternate mechanism — Blue Cross Blue Shield plan will enroll
HIPAA eligibles.
MinnesotaAlternative mechanism — high-risk health insurance pool.
Mississippi Alternative mechanism — high-risk health insurance pool.
MissouriFederal fall-back with HHS enforcement.
MontanaAlternative mechanism — high-risk health insurance pool.
NebraskaAlternative mechanism — high-risk health insurance pool.
NevadaFederal fall-back.
NewAlternative mechanism — high-risk health insurance pool.


Hampshire

StateGroup-to-Individual Portability Provision
New JerseyAlternative mechanism — existing state insurance law, including
guaranteed issue of five standardized products, guaranteed renewal, no
preexisting condition waiting period applied to HIPAA eligibles (for all
others preexisting condition limitations of 12/6), coverage gap of 30
days, pure community rating.
New MexicoAlternative mechanism — HIPAA-eligibles can choose to obtain
coverage through either the high-risk health insurance pool or the
purchasing alliance.
New YorkAlternative mechanism — existing state insurance reform laws,
including guaranteed issue of all products, guaranteed renewal, no
preexisting condition waiting period applied to HIPAA eligibles (for all
others preexisting condition limitations of 12/6), coverage gap of 63
days, community rating with adjustments permitted for family
composition and geographic regions.
NorthFederal fall-back.
Carolina
North DakotaAlternative mechanism — high-risk health insurance pool.
OhioAlternative mechanism — separate open enrollment period for HIPAA
eligibles until health plans meet their enrollment caps.
OklahomaAlternative mechanism — high-risk health insurance pool.
OregonAlternative mechanism — high-risk health insurance pool.
PennsylvaniaAlternative mechanism — Blue Cross and Blue Shield Plans serve as
the guaranteed issue carrier.
Rhode IslandFederal fall-back.
SouthAlternative mechanism — high-risk health insurance pool.
Carolina
South DakotaAlternative mechanism — existing state insurance reform laws,
including guaranteed issue to HIPAA-eligibles until these enrollees
represent 2% of annual earned premium, guaranteed renewal,
preexisting condition limitations to 12/6, and also retains pregnancy as
a preexisting condition (not in compliance with HIPAA), coverage gap
is 63 days, rating reform limits adjustments for health status and claims
experience to 2.2 to 1.
Tennessee Federal fall-back.
TexasAlternative mechanism — high-risk health insurance pool.



StateGroup-to-Individual Portability Provision
UtahAlternative mechanism — combines high-risk health insurance pool
and existing insurance market guaranteed issue requirement.
Individuals who are denied coverage by a plan and then are judged by
objective guidelines to be “too healthy” must be covered by the health
plan that had previously denied their coverage. Individuals who are not
deemed “too healthy” would be eligible for coverage in the high-risk
pool.
VermontAlternative mechanism — existing state insurance reform laws,
including guaranteed issue of all products, guaranteed renewal, no
preexisting condition waiting period applied to HIPAA eligibles (for all
others preexisting condition limitations of 12/12), coverage gap of 63
days, community rating with health plans required to limit rating
adjustments to a range of 1.5 to 1 for one or more factors approved by
the Commissioner.
VirginiaAlternative mechanism — guaranteed issue of all currently offered non-
group products to HIPAA eligibles.
WashingtonAlternative mechanism — high-risk health insurance pool.
West VirginiaFederal fall-back.
Wisconsin Alternative mechanism — high-risk health insurance pool.
Wyoming Alternative mechanism — high-risk health insurance pool.
Source: Blue Cross and Blue Shield Association, State Legislative Health Care and Insurance Issues.
2003 Survey of Plans. Washington, December 2003.
Note: (1) For preexisting condition limitations there may be two numbers, such as 12/6. The first
number denotes the exclusion period and the second number denotes the allowable look-back period.
The federal maximum under HIPAA is 12/6, although states may impose shorter limits. (2)
Additionally, for coverage gaps, HIPAA requires that all periods of creditable coverage be aggregated
or combined, provided that the lapse between periods of coverage is less than 63 days. Individual
states may require health plans to give credit for prior coverage even if the lapse was longer than 63
days. (3) Rating bands are laws that restrict a plans use of experience, health status or duration of
coverage in setting premiums rates for individuals. For example, a state may set the band of 2 to 1 for
health status.
Special Enrollment Periods in the Group Market
As an adjunct to its portability requirement, the Act provides for two different
special enrollment periods to ensure that people losing group health insurance
coverage can more easily obtain other group coverage when it is available. The two
special enrollment periods are:
(1) Individual Losing Other Coverage. A group health plan or an issuer offering
coverage in connection with a group health plan must allow an employee who is



eligible, but not enrolled, to become covered under the plan if the following
conditions are met:16
!The employee or dependent was covered under a group health plan or had
health insurance coverage at the time coverage was previously offered to the
employee or dependent. For example, the employee may have been covered
by a spouse’s employer and declined coverage under his own employer’s plan.
!The employee stated in writing at the time of declining enrollment that the
reason for declining was that he or she was covered under another health
insurance plan. This condition applies only if the plan sponsor or issuer
requires such a written statement.
!The employee’s or dependent’s previous coverage was under a COBRA
continuation provision that had become exhausted or was under some other
coverage that had been terminated as a result of a loss of eligibility for the
coverage (for reasons such as: legal separation, divorce, death, termination of
employment, or reduction in the number of hours of employment), or because
the employer contribution towards such coverage was terminated.
To take advantage of a special enrollment period, the employee would have to
request enrollment no later than 30 days after the date in which his or her prior
coverage was exhausted or terminated.
(2) Dependent Beneficiaries. This special enrollment period applies to individuals
who become dependents through marriage, birth, adoption, or placement of adoption.
Generally, this provision applies if a group health plan makes dependent coverage
available, and the new dependent’s spouse or parent is either a participant or eligible
(including meeting any waiting periods) to be a participant under the plan. The
newly dependent individual must be allowed to enroll as a beneficiary under the plan;
however, enrollment must be sought within 30 days of the qualifying event (e.g., the
marriage). Employees or spouses who are eligible, but not previously enrolled in the
plan, may also enroll during this special enrollment. Coverage is effective on the
date of the birth, adoption, or placement for adoption. In the case of marriage,
coverage is effective no later than the first day of the month beginning after the date
the request for enrollment is received.
Non-Discrimination in the Group Market
Can a group health plan refuse to enroll individuals with a history
of illness or disability or high medical expenses? Can it drop someone
from coverage who becomes sick or starts using a lot of medical care?
No, the Act prohibits a group health plan and an issuer offering group health
coverage from establishing rules for eligibility for any individual to enroll under the


16 The employee’s dependent would also be allowed to enroll, if family coverage is provided
under the terms of the plan.

plan based on health status-related factors.17 These factors include health status,
medical condition (including both physical and mental illnesses), claims experience,
receipt of health care, medical history, genetic information, evidence of insurability
(including conditions arising out of domestic violence) and disability. Group health
plans are also prohibited from failing to re-enroll a participant or beneficiary on the
basis of health status-related factors. HIPAA also prohibits plans from charging
differential premiums for enrollees within a group plan based on these health status-
related factors.
Can an employer condition coverage under its health plan on
passing a physical examination? No, the Act prohibits employer plans and
issuers of group health coverage from establishing rules of eligibility to enroll under
the terms of the plan that discriminate based on one or more health-status related
factors.
Can a group plan refuse to enroll individuals who engage in high-
risk recreational activities? No, these individuals cannot be denied enrollment
in a group health plan, based on HIPAA’s non-discrimination provision. Group plans
or issuers offering group health coverage cannot use information about an
individual’s health status to either deny coverage or charge differential premiums.
On January 8, 2001, the Department of Labor issued a preliminary final ruling with
comment period, defining the nondiscrimination provisions of HIPAA. In this ruling,
“health status” is defined very broadly to include “evidence of insurability” which in
turn includes a provision that prohibits excluding coverage for individuals who
participate in high-risk activities.18 Thus, this broad interpretation extends the
nondiscrimination protections to individuals who engage in high-risk recreational
activities.
Can a group plan exclude coverage of treatments for injuries
obtained while engaging in high-risk recreational activities? HIPAA’s
protection extend to enrollment policies and premiums. The protection does not
address the benefits that are covered by these plans. Therefore, there is no federal
requirement to cover treatments for injuries associated with high-risk activities, even
if these treatments are otherwise covered under the plan. For example, a plan may
exclude coverage for a broken leg if it occurs as a result of a high- risk activity.


17 In the individual market there are no federal rules explicitly limiting denials based on
health status. On the other hand, portability and guaranteed issue protections may apply (see
above section on Portability and Guaranteed Availability in the Individual Insurance
Market).
18 This ruling stems from language in the conference report on HIPAA:
The inclusion of evidence of insurability in the definition of health status is
intended to ensure, among other things, that individuals are not excluded from
health care coverage due to their participation in activities such as motorcycling,
snowmobiling, all-terrain vehicle riding, horseback riding, skiing, and other
similar activities.
H.Rept.104-736, 104th Cong., 2d Sess. 186 (1996).

Do these non-discrimination protections apply to an individual’s
spouse and children? Under a group health plan, an employer is not required
to offer coverage to an individual’s spouse or children. If the employer does offer
family coverage, the same non-discrimination protections apply to a spouse and any
other dependents as defined under the terms of the plan. Coverage may not be denied
because a family member is sick, and preexisting condition restrictions are limited
as described above.
Does the Act restrict the premium amounts that an employer can
charge for health insurance? No, the Act does not restrict premium amounts
that an employer or insurer can charge. It also expressly permits an employer or
group health insurer to offer premium discounts or rebates, or modify otherwise
applicable copayments or deductibles, for participation in health promotion and
disease prevention programs. However, the Act does prohibit a health plan from
charging an individual a higher premium than the premium charged for another
similarly situated individual enrolled in the plan on the basis of any health-related
factor, such as a preexisting medical condition.
Guaranteed Issue and Guaranteed Renewability
The Act requires insurers, HMOs, and other issuers of health insurance selling
in the small group market to accept any small employer that applies for coverage,
regardless of the health status or claims history of the employer’s group.19 This
requirement is often referred to as “guaranteed issue.” The Act defines a small
employer as one with two to 50 employees. (If, on the first day of the plan year, the
plan has fewer than two participants who are current employees, it is not considered
a small group and would not be covered by this “guaranteed issue” requirement.)
Under guaranteed issue, the issuer must accept for enrollment under the policy, not
just the employer’s group, as a whole, but also every eligible individual in the20
employers’ group who is eligible for and applies for timely enrollment. Exceptions
to guaranteed issue are provided in the Act for network plans that might otherwise
exceed capacity limits or in the event that the employer’s employees do not live,
work, or reside in the network plan’s area.
Employer groups with more than 50 employees are not protected by this
requirement unless otherwise required under state law. In the past, health insurance
issuers usually did not examine the health status or medical history of larger
employer groups when deciding whether to accept such groups for coverage. The
Act requires the Secretary of Health and Human Services (HHS) and the General
Accounting Office (renamed the Government Accountability Office in July 2004) to
report every three years, beginning in December 2002, on access to health insurance
in the large group market.


19 This is consistent with most state health insurance reforms which primarily apply to the
small group market (typically defined as 2 to 25, 2 to 35 or 2 to 50 employees). However,
some state laws provide for guaranteed issue of groups with as few as one employee.
20 The interim rules interpret the guaranteed issue requirement to apply to all products
actively marketed by an issuer in the small group market. 69 Federal Register 16971 ( Apr.

8, 1997).



Can health insurance issuers drop or cancel coverage for groups
because of high medical costs? No, the Act requires all health insurance
issuers to continue coverage for any group, regardless of health status or use of
services, if the group requests renewal. This requirement is known as guaranteed
renewability. An issuer may drop coverage in cases of non-payment of premiums,
fraud, or similar reasons not related to health status, such as violation of participation21
or contribution rules. But, there are no limits on amounts insurers may charge.
Federally Required Benefits
As originally passed, HIPAA did not require an employer or issuer of group
health insurance to offer specific benefits. Twice since its passage Congress added
to HIPAA’s protections by mandating specific benefits, but in each case only for
plans that cover certain services. As part of the FY1997 appropriations bill for the
Departments of Veterans Affairs and Housing and Urban Development (VA-HUD),
Congress included provisions that (1) require plans that cover mental health services
to provide limited mental health “parity”, and (2) prohibit plans that cover newborn22
delivery from limiting hospital stays for newborn delivery to less than two days.
The FY1999 Omnibus Appropriations Act incorporated the Women’s Health and
Cancer Rights Act, which requires plans that cover mastectomy as a treatment for
breast cancer to also cover reconstructive surgery.23
Mental Health Parity. Private health insurers often provide less coverage for
the treatment of mental illnesses than they do for the treatment of other illnesses. For
example, health plans may limit treatment of mental illnesses by covering fewer
hospital days and outpatient office visits, and increase cost sharing for mental health
care by raising deductibles and copayments. Twenty-two states have passed full-
parity laws that require health plans to impose the same treatment limitations and
financial requirements on their mental health coverage as they do on their medical
and surgical coverage. Several other states have enacted legislation that requires
health plans to provide certain specified mental health benefits (but not full parity).
However, these state laws have a limited impact because they do not cover self-
insured plans. ERISA exempts self-insured plans from state regulation. Nationwide,
about 52% of covered workers are in a self-insured plan, according to the 2003
KFF/HRET survey of employer health benefits.
In 1996, Congress passed the Mental Health Parity Act (MHPA), which
amended ERISA and the Public Health Service Act to establish new federal standards


21 An example of a participation rule is a requirement set by the issuer that 80% of all full
time employees participate in the employer’s group health plan. An example of a
contribution requirement is that all participants in the health plan must pay 20% of the plan
premium. These requirements are used to protect the issuer from a selection bias (also
known as “adverse selection”) in which only sick members of an employer’s group sign up
for insurance coverage.
22 FY1997 appropriations bill for the Departments of Veterans Affairs and Housing and
Urban Development (P.L. 104-204, Title VII).
23 In addition to HIPAA’s limited federal protections, most states have their own mandates
for insurers operating in their states.

for mental health coverage offered by employer-sponsored plans.24 Identical
provisions were later added to the Internal Revenue Code.25 The MHPA is limited
in scope and does not compel insurers to provide full-parity coverage. For group
plans that choose to offer mental health benefits, the MHPA requires parity only for
annual and lifetime dollar limits on coverage. Plans may still impose more restrictive
treatment limitations and cost sharing requirements on their mental health coverage.
The MHPA includes several other limitations. Employers with 50 or fewer
employees are exempt from the law. In addition, employers that experience an
increase in claims costs of at least 1% as a result of MHPA compliance can apply for
an exemption. The MHPA currently is authorized through December 31, 2005.
The 107th Congress tried unsuccessfully to enact legislation (S. 543) that would
have amended and expanded the MHPA by requiring plans that choose to offer
mental health benefits to provide full-parity coverage. Full-parity legislation is
strongly supported by advocates of the mentally ill and enjoys broad bipartisan
support among lawmakers. Employers and health insurance organizations oppose
such legislation because of concerns that it will drive up health care costs. For more
information, see CRS Report RL31657, Mental Health Parity.
Newborns’ and Mothers’ Health Protection Act. The Newborns’ and
Mothers’ Health Protection Act was also passed as part of P.L. 104-204. This Act
prohibits group health plans and issuers offering group coverage from restricting the
hospital length of stay for childbirth for either the mother or newborn child to less
than 48 hours for normal deliveries and to less than 96 hours for caesarian deliveries.
Women’s Health and Cancer Rights Act of 1998. Enacted in 1998, Title
IX of the FY1999 Omnibus Appropriations Act26 requires group plans and health
insurance issuers that provide coverage for mastectomies also to cover prosthetic
devices and reconstructive surgery. The provision included a requirement that
beneficiaries be notified of available coverage for prostheses and treatment of
physical complications of reconstructive procedures.
Can an employer exclude coverage for specific types of illnesses,
such as cancer, or acquired immune deficiency syndrome (AIDS) or
treatment of injuries associated with high-risk activities? Federal law
does not prohibit employers from excluding treatment of specific illnesses or
conditions from their health benefit plans. On the other hand, a number of factors
limit certain employers’ ability to exclude specific illnesses from coverage. Most
states have enacted legislation requiring that specific benefits or coverage be included
in insured products. Some employers, particularly small ones, purchasing insurance
products have little or no discretion in choosing or excluding specific types of
services or procedures. This is because many insurance companies and HMOs have
a set menu of products that do not vary considerably from one employer group to


24 P.L. 104-204, Title VII, codified at 29 U.S.C. 1185a and 42 U.S.C. 300gg-5. These
provisions were part of the FY1997 VA-HUD appropriations bill.
25 P.L. 105-34, Section 1531(a)(4), codified at 26 U.S.C. 9812.
26 P.L. 105-277, Title IX: Women’s Health and Cancer Rights.

another. For self-funded plans, however, ERISA prevents state laws from applying
and benefits are crafted by each individual employer plan. Thus only the few federal
requirements enacted in HIPAA and its amendments (described above) place specific
coverage requirements on these self-funded plans.
General Questions About the Health Insurance Reforms
Do the requirements of the Act apply to the plans of employers that
provide for dental-only coverage or vision-only coverage? No, such
specific benefit plans do not have to comply with the requirements of the Act if they
meet certain conditions spelled out in the Act. To be exempt, for example, the
dental-only policy would have to be provided under a separate policy, certificate, or
contract of insurance or not otherwise be an integral part of the plan.
Do the requirements of the Act apply to association-sponsored
group health plans? Yes, association plans must comply with the various
requirements of the Act relating to group health coverage. For example, the sponsor
of an association plan cannot drop a group from coverage because of the use of
medical services by the group’s members. Moreover, the association plan must
comply with the restrictions on the use of preexisting medical condition limitation
periods, provide for creditable coverage, and renew coverage except in limited cases.
However, nothing under the Act requires that an association plan accept for coverage
individuals who are not members of the association.
Can states impose requirements on insurers selling to group health
plans that are different from those in the Act? Yes, states may impose their
own requirements. But HIPAA ensures that state laws do not prevent the application
of its consumer protections. For example, state laws regulating rating continue to
apply because the Act generally does not address rating practices. On the other hand,
the Act’s provisions relating to portability, such as restrictions on the use of
preexisting medical condition limitation periods override state laws. Exceptions
include specific types of state laws that provide for greater portability, such as state
laws that:
!define a preexisting medical condition to be one that existed for less than 6
months prior to becoming covered (instead of the 6 months required under the
Act);
!provide for preexisting medical condition limitation periods shorter than 12
(and 18) months in the Act; and
!allow for breaks in continuous coverage longer than the 62-day period27
specified under the Act.
Thus, for example, a state may prohibit issuers selling to group health plans from
imposing more than a 6-month preexisting medical condition limitation period on


27 Other possible types of state laws providing for greater consumer protections are also
specified in the Act.

enrollees, instead of the 12-month limit in the Act. However, state laws that allowed
such limitation periods in excess of 12 months would be overridden by the
requirement of the Act.
Do the insurance reforms apply to Federal Employees' Health
Benefits Plans (FEHBP)? While there are no specific references in HIPAA or
the subsequent benefits mandates that apply the requirements specifically to FEHBP,
the plans provided by the FEHBP program are presumed to fall under the HIPAA
definition of “group health plan.” As a result, the federal Office of Personnel
Management, which administers the FEHBP program, complies with the HIPAA
requirements.
Does the Act regulate the premium amount that an issuer can
charge an eligible individual? No, the Act does not place any restrictions on the
premium amount that issuers can charge. However, some states limit insurance
premiums in the individual market and more may decide to do so in the future. Such
limits would then apply because the Act does not preempt or override either current
or future state laws regulating the cost of insurance.
Implementation and Enforcement
The Secretaries of HHS, Labor, and Treasury are required to jointly enforce the
provisions of the Act. The Secretary of Labor enforces the requirements on employer
plans under Title I of ERISA. The Secretary of Labor is also generally given
authority to promulgate regulations necessary to carry out the provisions of the Act
relating to group health plans and health insurance issuers in connection with any
group health plan. The Secretary of Treasury enforces requirements on all group
health plans under the Internal Revenue Code. Requirements on health insurance
issuers (such as insurance carriers and HMOs) are enforced by the Secretary of HHS
to the extent that such requirements are not enforced by the states. The Secretaries
are required to coordinate their activities to avoid duplication of effort.
States have the primary responsibility for enforcing HIPAA’s access, portability
and renewability standards applying to insurers in both the group and individual
markets. If they do not pass laws that substantially enforce these standards, however,
DHHS must do the enforcing itself. As of 2001, only Missouri had not enacted
enabling legislation.
How are the insurance requirements of the Act enforced?
Noncomplying group health plans covered under ERISA may be subject to civil
money penalties, and both plans and issuers can be sued by participants and
beneficiaries to recover any benefits due under the plan. The Secretary of Labor has
the investigative authority to determine compliance with the law’s requirements. For
group health plans, generally the IRS can fine a noncomplying employer $100 per
day per violation.
Requirements on issuers will be enforced by the states. For Missouri, the
Secretary of HHS enforces the provisions. The Secretary may impose a fine of $100



for each day the entity (the issuer or a nonfederal governmental plan)28 is out of
compliance. The Act gives the Secretary of HHS the authority to promulgate
regulations needed to carry out the provisions of the Act relating to requirements on
issuers of coverage.
What regulations have been promulgated to define HIPAA? The
following table lists the regulations regarding HIPAA’s insurance provisions. For
regulations on HIPAA’s administrative simplification and privacy provisions see
CRS Report RL30620, Health information standards, privacy and security:
HIPAA’s administrative simplification regulations, by Stephen Redhead.


28 “A nonfederal governmental plan” is a plan sponsored by a state or local governmental
entity.

Table 2. Federal Insurance Regulations Promulgated under HIPAA
Date of IssueTitlePurposeStatusCitation
April 8, 1997Health Insurance Portability forInterim rules governing access, portabilityComment periodInternal Revenue
Group Health Plans; Interimand renewability requirements for groupended July 7,Service (IRS): 26
Rules and Proposed Rulehealth plans and issuers of health insurance1997CFR Part 54
coverage offered in connection with a group
health plan.Pension Welfare
B e ne fits
Ad mi ni str a tio n
(PWBA): 29 CFR
Part 2590
Health Care
Fi na nc i ng
Ad mi ni str a tio n
(HCFA): 45 CFR
iki/CRS-RL31634Subtitle A, Parts 144
g/wand 146, 45 CFR
s.orPart 148
leakApril 8, 1997Individual Market HealthPortability from group to individualComment periodHealth Care
://wikiInsurance Reform; Interim finalrule with comment periodcoverage; federal rules for access in theindividual market; state alternativeended July 7,1997FinancingAdministration
httpmechanisms to federal rules(HCFA): 45 CFR
Part 148
December 22,Mental Health Parity; InterimInterim rules governing parity betweenComment periodIRS: 26 CFR Part 54
1997Rules medical/surgical benefits and mental healthended on March
HIPAA Mental Health Paritybenefits in group health plans and health23, 1998PWBA: 29 CFR Part
Act; Proposed Ruleinsurance coverage offered by issuers in2590
connection with a group health plan.
HCFA: 45 CFR Part
146



Date of IssueTitlePurposeStatusCitation
December 29,Application of HIPAA GroupClarification of regulations with respect toFinal (clarifiesIRS: 26 CFR Part 54
1997Market Portability Rules totreatment of benefits under flexibleregulation issued
Health Flexible Spendingspending arrangements for the purposes ofApril 8, 1997)PWBA: 29 CFR Part
Arrangements; Final Rulegroup market portability.2590
Application of HIPAA Group
Market Rules to IndividualsHCFA: 45 CFR
Who Were Denied CoverageParts 144 and 146
Due to a Health Status-Related
Factor; Final Rule
October 27,Group Health Plans and HealthInterim rules providing guidance toComment periodIRS: 26 CFR Part 54
1998Insurance Issuers Under theemployers, group health plans, healthended January
Newborns and Mothers Healthinsurance issuers, and participants and25, 1999PWBA: 29 CFR Part
Protection Act; Joint Interimbeneficiaries relating to new requirements2590
Rulefor hospital lengths of stay in connection
with childbirth.HCFA: 45 CFR
Parts 144, 146 and
iki/CRS-RL31634 148
g/wAugust 20,Federal Enforcement in GroupDetails procedures for enforcing TitleComment periodHCFA: 45 CFR
s.or1999and Individual Health InsuranceXXVII of the Public Health Service Act asended OctoberParts 144, 146, 148
leakMarkets; Interim Ruleadded by HIPAA and as amended, in states19, 1999and 150
that do not enforce the requirements of these
://wikiacts. Delineates the process for taking
httpenforcement actions against non-federal
government plans, and, in those states in
which HCFA (now named CMS) is directly
enforcing the requirements, health insurance
issuers that are not complying with the
requirements.
October 25,Health Insurance Portability;Solicitation of additional comments onComment periodIRS: 26 CFR Part 54
1999Final Ruleinterim rules published on April 8, 1997ended January
regarding a number of portability, access25, 2000PWBA: 29 CFR Part
and renewability provisions as well as2590
comments reflecting the experience that
interested parties have had with the interimHCFA: 45 CFR
regulations. Also clarifies definition of lateSubtitle A, Parts 144
enrollee for purposes of applying pre-and 146


existing exclusion period.

Date of IssueTitlePurposeStatusCitation
January 8,Nondiscrimination in HealthInterim rules regarding provisionsComment periodIRS: 26 CFR Part 54
2001Coverage in the Group Market;prohibiting discrimination based on a healthended April 9,
Interim Final Rules andfactor for group health plans and issuers of2001PWBA: 29 CFR Part
Proposed Ruleshealth insurance coverage in connection2590
with a group health plans. Proposed
standards for defining bona fide wellnessHCFA: 45 CFR Part
programs. 146
March 9, 2001Interim Final Rules forDelays for 60 days, the effective dates forFinalIRS: 26 CFR Part 54
Nondiscrimination in Healththe nondiscrimination rule published on
Coverage in the Group MarketJanuary 8, 2001PWBA: 29 CFR Part
2590
HCFA: 45 CFR Part
146
December 30,Group Health Plans andFinal regulations governing portabilityFinalIRS: 26 CFR Parts
iki/CRS-RL316342004Insurance Issuers; Access,requirements for group health plans and54 and 602
g/wPortability, and Renewabilityissuers of health insurance coverage offered
s.orRequirementsin connection with a group health plan. EBSA: 29 CFR Part
leak 2590
://wikiCMS: 45 CFR Parts
http144 & 146
December 30,Health Coverage Portability;Describes how the period that determinesProposed withIRS: 26 CFR Part 54
2004Tolling Certain Time Periodswhether a significant break in coverage hascomment period
and Interaction with Family andoccurred is to be tolled in cases in which ato end on MarchEBSA: 29 CFR Part
Medical Leave Actcertificate of creditable coverage is not30, 20052590
provided on or before the day coverage
ceases and when a person is on leave underCMS: 45 CFR Part
the Family Medical Leave Act146
December 30,Request for Information onSolicits comments about benefit-specificThe DepartmentsIRS: 26 CFR Part 54
2004Benefit-Specific Waitingwaiting periods allowing for the public torequests
Periods Under HIPAAprovide input into any criteria used tocomments beEBSA: 29 CFR Part
Titles I & IVdetermine whether a benefit-specific waitingprovided on or2590
period utilized by a group health plan orbefore March 30,
issuer is a preexisting condition exclusion2005.CMS: 45 CFR Part
under HIPAA.146



Source: Congressional Research Service
No tes:
PWBA — Pension and Welfare Benefits Administration. Changed its name to the Employee Benefits Security Administration (EBSA).
HCFA Healthcare Financing Administration. Changed its name to Centers for Medicare and Medicaid Services (CMS).
CFR Code of Federal Regulations.


iki/CRS-RL31634
g/w
s.or
leak
://wiki
http

COBRA Continuation Coverage
How does COBRA continuation coverage29 interact with HIPAA? A
person’s COBRA continuation coverage is considered creditable coverage in the
case of an individual who moves from one group policy to another group policy or
from a group policy to an individual policy. This allows an individual to move from
COBRA to a new health plan without having to wait for coverage of any preexisting
medical condition under the new plan, providing the individual does not have a lapse
in coverage of 63 or more days.
With respect to HIPAA’s individual market protections, the situation is
somewhat more complex. One of the requirements for eligibility for guaranteed
availability and portability in the individual market is that an individual must first
have elected and exhausted any available COBRA or other continuation coverage.
Eligible individuals who do not have access to COBRA or other continuation
coverage may move directly to the individual market. Additionally, in the individual
market, it is important to note that the insurer accepting the eligible individual for
coverage can charge whatever rate is allowed under state law. (The Act does not
limit the premiums that insurers can charge.)
Does HIPAA make any changes in COBRA continuation of coverage
requirements? Yes, the Act makes several changes to the laws providing for
COBRA continuation of coverage. It provides:
!a clarification that a disabled qualified beneficiary and all other qualified
family members of the beneficiary are also eligible for the additional 11
months of COBRA;
!that the qualifying event of disability applies in the case of a qualified
beneficiary who is determined under the Social Security Act to be disabled
during the first 60 days of COBRA coverage;
!that a qualified beneficiary for COBRA coverage includes a child who is born
to, or placed for adoption with, the covered employee during the period of
COBRA coverage; and
!that COBRA can be terminated if a qualified beneficiary becomes covered
under a group health plan which does not contain any exclusion or limitation
affecting a participant or his or her beneficiaries because of the requirements
of the Act.
It should also be noted that under the Medical Savings Account (MSA)
provisions of the Act (see below), individuals may withdraw funds from their MSAs
without penalty to pay their COBRA premiums.


29 The Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA, P.L. 99-272)
requires employers with 20 or more employees to offer continued group health insurance
coverage to employees and their dependents after certain events. See CRS Report RL30626,
Health Insurance Continuation Coverage under COBRA, by Heidi G. Yacker.

Part III. Other Provisions
In addition to the insurance provisions discussed above, HIPAA includes other
provisions affecting health care. This section briefly summarizes these provisions
and refers readers to other CRS reports where available.30
Administrative Simplification
In addition to provisions relating to private health insurance, HIPAA directed
the Secretary of HHS to issue standards to support and promote the electronic
transmission of health care information between payers and providers. The standards
specify the content and format of electronic health care claims and other common
administrative and financial health care transactions (e.g., health plan enrollment,
referrals). They are intended to streamline administrative operations within the
health care system, which currently stores and transmits health information in
numerous paper and electronic formats. In 2001 Congress enacted the
Administrative Simplification Compliance Act (P.L. 107-105), which enabled payers
and providers to seek a one-year extension on the October 16, 2002 deadline for
compliance with the electronic transactions and codes standards.
HIPAA’s administrative simplification provisions also instructed the Secretary
of HHS to develop security standards and safeguards, which health plans and
providers must incorporate into their operations to protect health information from
unauthorized access, use, and disclosure. Health care providers and most health
plans must be in compliance with the security standards by April 21, 2005. In
addition, HIPAA directed the Secretary to develop standards for unique health
identifiers (i.e., ID numbers) for patients, employers, health plans, and providers.
CMS has issued standards for both the employer and provider identifiers, but the
health plan identifier remains under development. In each fiscal year since FY1999,
Congress has prevented CMS from developing a standard for the unique patient
identifier by inserting language in the agency’s annual appropriations bill. The
language prohibits the use of funds for developing a unique patient identifier standard
unless legislation is enacted specifically approving such a standard.
The growing use of information technology in the management, administration,
and delivery of health care has led to increasing public concern over the privacy of
medical information. Patients are worried about who has access to their medical
records without their express authorization. They fear that their personal health
information will be used against them to deny insurance, employment, and housing,
or to expose them to unwanted judgment and scrutiny. Lawmakers addressed these
concerns by including in HIPAA’s administrative simplification provisions a
timetable for developing standards to protect the privacy of health information.
HIPAA gave Congress until August 21, 1999, to enact comprehensive health privacy
legislation, otherwise the Secretary was instructed to develop privacy standards.


30 Not included in this summary are HIPAA provisions that were revenue raisers; these
related to company-owned life insurance, individuals who lose U.S. citizenship or who were
long-term residents and terminate U.S. residency, and interest allocation rules for financial
institutions.

Congress was unable to meet its own deadline and so the Secretary proceeded to
develop a health information privacy rule. The final rule was issued on December
28, 2000, and modifications to the rule were published on August 14, 2002. For
more information on the privacy rule, see CRS Report RS20500, Medical Records
Privacy: Questions and Answers on the HIPAA Final Rule. Information on the
status and implementation of all the HIPAA administrative simplification standards
is at [http://aspe.os.dhhs.gov/admnsimp].
Medical Savings Accounts
HIPAA authorized tax-advantaged medical savings accounts (MSAs) under a
demonstration that began in 1997. MSAs (now formally called Archer MSAs) are
personal savings accounts for unreimbursed medical expenses. They can be used to
pay for health care not covered by insurance, including deductibles and copayments.
The legislation provided that MSAs may be established by taxpayers who have
qualifying high deductible insurance (and none other, with some exceptions) and who
either are self-employed or are employees covered by the high deductible plan
established by their small employer.
Employer contributions to MSAs are not subject to either income or
employment taxes, while contributions made by individuals — allowed only if the
employer does not contribute — are allowed as an above-the-line deduction (not
limited to itemizers). MSAs are held in trust by insurance companies, banks, and
other financial institutions, and whatever earnings they have are exempt from taxes.
Withdrawals are not taxed if they are for medical expenses unreimbursed by
insurance or otherwise, while other distributions, being non-qualified, are included
in gross income and subject with some exceptions to an additional 15% penalty.
HIPAA set a deadline(originally December 31, 2000) for establishing new
accounts and limited the total to various ceilings, eventually 750,000 accounts. In
October, 2002, the IRS estimated that there would be 78,913 MSA returns filed for
tax year 2001; it also determined that 20,592 taxpayers who did not make
contributions in 2001 established accounts in the first six months of 2002. These
numbers were far less than the 750,000 statutory ceiling.31 Later amendments
extended the deadline for new accounts to December 31, 2003. Although no new
MSAs may be created, with some exceptions, current owners can maintain their
accounts and, provided they have a qualifying high-deductible insurance, can
continue to make contributions. However, most MSA owners can now have HSAs,
and their MSA balances can be rolled over into the new accounts.


31 IRS Announcement 2002-90. MSAs are not counted toward the statutory ceiling if the
owners were previously uninsured; moreover, all accounts established by an individual are
added together, and married individuals opening separate accounts are treated as having one
account. The small number of MSA accounts opened can be attributed to a number of
factors including product familiarity, consumer aversion to financial risk, and the reluctance
of insurance agents to sell lower-priced policies; however, statutory restrictions undoubtedly
have played some role.

For more information about MSAs and HSAs, see CRS Report RS21573, Tax-
Advantaged Accounts for Health Care Expenses: Side-by-Side Comparison, by Bob
Lyke and Chris L. Peterson, and CRS Report RL32467, Health Savings Accounts, by
Bob Lyke, Chris L. Peterson, and Neela Ranade. For current legislative activity on
tax-advantaged accounts, see CRS Issue Brief IB98037, Tax Benefits for Health
Insurance and Expenses: Current Legislation, also by Bob Lyke.
Health Insurance for Self-Employed Taxpayers
HIPAA increased the portion of premiums that self-employed taxpayers may
deduct from income for the purposes of determining federal taxes owed. Under prior
law, the deduction was 30% of health insurance costs; HIPAA increased it to 40%
in 1997; 45% in 1998 through 2002; 50% in 2003; 60% in 2004; 70% in 2005; and

80% in 2006 and thereafter. Subsequent legislation (P.L. 105-34 and P.L. 105-277)


accelerated and increased the percentages set by HIPAA. Beginning in 2003, 100%
of health insurance costs can be deducted. As discussed below, HIPAA also allowed
self-employed taxpayers to take account of long-term care insurance premiums in
making this deduction.
Self-Insured Plans
HIPAA provided that payments for personal injury or sickness through an
arrangement having the effect of accident or health insurance are excluded from gross
income (that is, they are exempt from taxation), provided the arrangement has
adequate risk shifting and is not merely a reimbursement arrangement. Thus with
respect to taxes, payments from self-insured plans covering self-employed
individuals are treated like payments from commercial insurance.
Long-Term Care
HIPAA established new rules regarding the tax treatment of long-term care
insurance and expenses, effective January 1, 1997. Qualified long-term care
insurance is treated as accident and health insurance, and benefits are treated as
amounts received for personal injuries and sickness and reimbursement for medical
expenses actually incurred. As a consequence, benefits are excluded from gross
income (that is, exempt from taxation). The exclusion for benefits paid on a per diem
or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or (2) the32
cost of long-term care services.
Employer contributions to the cost of qualified long-term care insurance
premiums are excluded from the gross income of the employee. The exclusion does


32 Treating long-term care insurance as accident and health insurance and excluding benefits
from gross income also exempts the inside buildup of the insurance from taxation. Long-
term care insurance usually has premiums that do not increase with age (aside from optional
inflation adjustments for some policies); premiums for early years of a policy and the
earnings on them (the inside buildup) help pay for costs later on. The tax treatment of
nonqualified long-term care insurance remains uncertain.

not apply to insurance provided through employer-sponsored cafeteria plans or
flexible spending accounts.
Unreimbursed long-term care expenses are allowed as itemized deductions to
the extent they and other unreimbursed medical expenses exceed 7.5% of adjusted
gross income. Long-term care insurance premiums can be counted as these expenses
subject to age-adjusted limits. In 2005, these limits range from $270 for persons age

40 or less to $3,400 for persons over age 70.


Self-employed individuals are allowed to include long-term care insurance
premiums in determining their above-the-line deduction (not limited to itemizers) for
health insurance expenses. Only amounts not exceeding the age-adjusted limits can
be included. So limited, 100% of the cost of the insurance may be claimed as a
deduction in 2005, as described above.
Qualified long-term care insurance is defined as a contract that covers only long-
term care services; does not pay or reimburse expenses covered under Medicare; is
guaranteed renewable; does not provide for a cash surrender value or other money
that can be paid, assigned, or pledged as collateral for a loan, or borrowed; applies
all refunds of premiums and all policy holder dividends or similar amounts as a
reduction in future premiums or to increase future benefits; and meets certain
consumer protection standards. Policies issued before January 1, 1997, and meeting
a state’s long-term care insurance requirements at the time the policy was issued are
considered qualified insurance for purposes of favorable tax treatment.
Qualified long-term care services are defined as necessary diagnostic,
preventive, therapeutic, curing, treating, mitigating, and rehabilitative services, and
maintenance or personal care services, which are required by a chronically ill
individual, and are provided according to a plan of care prescribed by a licensed
health care practitioner. However, amounts paid for services provided by the spouse
of a chronically ill person or by a relative directly or through a partnership,
corporation, or other entity will not be considered a medical expense eligible for
favorable tax treatment, unless the service is provided by a licensed professional.
Chronically ill persons are defined as those individuals:
!unable to perform without substantial assistance from another individual at
least two of the following activities of daily living (ADLs)for a period of at
least 90 days due to a loss of functional capacity: bathing, dressing,
transferring, toileting, eating, and continence;33
!having a level of disability similar to the level of disability specified for
functional impairments (as determined by the Secretary of the Treasury in
consultation with the Secretary of Health and Human Services); or
!requiring substantial supervision to protect them from threats to health and
safety due to severe cognitive impairment.


33 A qualified long-term care insurance contract must take into account at least five of these
six activities.

HIPAA required that a licensed health practitioner (physician, registered
professional nurse, licensed social worker, or other individual prescribed by the
Secretary of the Treasury) certify that a person meets these criteria within the
preceding 12-month period.
Accelerated Death Benefits
HIPAA clarified that accelerated death benefits (that is, benefits paid before
death) received under a life insurance contract on the life of an insured terminally or
chronically ill individual are excluded from gross income. Also excluded are
amounts received from a viatical settlement provider for the sale or assignment of a
life insurance contract.34 These exclusions do not apply to amounts paid to persons
other than the insured if they have an insurable interest in the insured for business
reasons.
A terminally ill individual is one who has been certified by a physician as
having an illness or physical condition which can reasonably be expected to result in
death within 24 months of the date of certification.
A chronically ill individual is defined the same way as for long-term care (see
the previous section). In this case, the exclusion of accelerated death benefits is
limited to the actual costs of long-term care incurred by the individual that are not
compensated by insurance or otherwise. The exclusion for benefits paid on a per
diem or other periodic basis is limited to the greater of (1) $240 a day (in 2005) or
(2) the costs of long-term care services.35 Contracts must not pay or reimburse
expenses which are reimbursable under Medicare or would be but for the application
of a deductible or coinsurance amount. In addition, contracts are subject to the
consumer protection provisions specified in the tax code for long-term care
insurance, except for analogous standards specifically applying to chronically ill
individuals that are adopted by the National Association of Insurance Commissioners
or the state in which the policyholder resides.
State Insurance Pools
HIPAA added two types of organizations to the list of those expressly exempt
from the federal income tax: (1) state-sponsored membership organizations that
provide insurance coverage or medical care to high-risk individuals, and (2) state-
sponsored workmen’s compensation reinsurance organizations. Organizations in
either classification must meet a number of requirements.


34 Viatical settlement providers must be regularly engaged in the business of purchasing or
accepting assignment of life insurance contracts on the lives of terminally or chronically ill
individuals. They must be licensed in the state where the insured individual resides or meet
certain National Association of Insurance Commissioners standards.
35 Excess per diem or other regular payments are not taken into account if the individual has
been certified as terminally ill.

Treatment of Certain Health Insurance Providers
HIPAA allowed health insurance providers (other than health maintenance
organizations) that are organized and governed under state laws specifically and
exclusively applying to not-for-profit health insurance or service organizations to
deduct 25% of claims and expenses incurred during the year, less adjusted surplus.
Previously this tax treatment applied only to Blue Cross and Blue Shield
organizations.
IRA Distributions for Medical Expenses and Insurance
HIPAA provided that the 10% early withdrawal penalty would no longer apply
to individual retirement account (IRA) distributions used to pay medical expenses in
excess of 7.5% of adjusted gross income. In addition, it provided that the penalty
would not apply to IRA distributions used to pay health insurance premiums after
separation from employment in the case of an individual who receives 12 consecutive
weeks of unemployment compensation.
Organ and Tissue Donation Information
HIPAA required the Secretary of the Treasury to include organ and tissue donor
information, to the extent practicable, in the mailing of individual income tax refunds
from February 1, 1997 through June 30, 1997. authorized tax-advantaged medical
savings accounts (MSAs) under a demonstration that began in 1997.36


36 Under HIPAA, no new MSAs (with some exceptions) were to be established after
December 31, 2000; the cut-off would have been earlier had thresholds on the number of
accounts been exceeded. P.L. 106-554 extended the deadline for new accounts to December

31, 2002.