Self-insured group health plans must obtain a HPID if they control their own business activities, actions or policies (e.g., selecting a TPA or health care platform), or are controlled by an entity that is not a health plan such as an employer. These plans are referred to as Controlling Health Plans ("CHPs"). Since most self-insured plans are controlled by their employer sponsors, most will be considered CHPs and the HPID requirement applies. Small self-insured plans have always been given an extra year to apply for the HPID. "Small" means a self funded plan with claims paid, annually, of $5 million or less.
Like every other governmental bureaucratization, the application process has been far more complicated than it should have been. CMS's instructions were unclear. Web pages and documents used varying language and marched employers through byzantine steps. The process has been so bad that insurance brokerages and law firms had to hold webinars just to try and help employers obtain these government codes. One client called us, rightfully frustrated, because in order for her to register her business, the website required her to input her personal social security number for "identity" purposes. Sounds like a great idea, doesn't it?
Well, the cacophony of complaints (along with an apparent recommendation that these numbers not be used at all by National Committee on Vital and Health Statistics) finally reached the appropriate crescendo. And we have yet another Friday afternoon, holiday-weekend Obamacare delay.
CMS has just announced that it is suspending enforcement of the HIPAA HPID requirements until further notice. The following statement is on the CMS website:
Statement of Enforcement Discretion regarding 45 CFR 162 Subpart E - Standard Unique Health Identifier for Health Plans
Effective October 31, 2014, the Centers for Medicare & Medicaid Services (CMS) Office of e-Health Standards and Services (OESS), the division of the Department of Health & Human Services (HHS) that is responsible for enforcement of compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) standard transactions, code sets, unique identifiers and operating rules, announces a delay, until further notice, in enforcement of 45 CFR 162, Subpart E, the regulations pertaining to health plan enumeration and use of the Health Plan Identifier (HPID) in HIPAA transactions adopted in the HPID final rule (CMS-0040-F).
This enforcement delay applies to all HIPAA covered entities, including healthcare providers, health plans, and healthcare clearinghouses.
On September 23, 2014, the National Committee on Vital and Health Statistics (NCVHS), an advisory body to HHS, recommended that HHS rectify in rulemaking that all covered entities (health plans, healthcare providers and clearinghouses, and their business associates) not use the HPID in the HIPAA transactions (see http://ncvhs.us/wp-content/uploads/2014/10/140923lt5.pdf). This enforcement discretion will allow HHS to review the NCVHS’s recommendation and consider any appropriate next steps.
