HIPAA – ERISA Benefits Law

DOL and IRS Extend Certain Timeframes for Employee Benefit Plans, Participants, and Beneficiaries Affected by the COVID-19 Outbreak

On May 4, 2020, the Employee Benefits Security Administration (EBSA, which is part of the U.S. Department of Labor) and the Internal Revenue Service (IRS) issued joint guidance extending certain timeframes otherwise applicable to group health plans, disability and other welfare plans, pension plans, and their participants and beneficiaries under ERISA and the Code.

This guidance will require Plan Sponsors to temporarily revise their administrative practices and their form notices used in connection with COBRA, HIPAA’s Special Enrollment rights, and ERISA Claim Procedures.

I. Background

HIPAA requires group health plans to provide special enrollment rights for certain people upon the loss of eligibility for other coverage, or upon the addition of a dependents due to birth, adoption, etc. Generally, group health plans must allow such individuals to enroll in the group health plan if they are otherwise eligible and if enrollment is requested within 30 days of the occurrence of the event.

COBRA permits qualified beneficiaries who lose coverage under a group health plan to elect continuation health coverage. COBRA generally provides a qualified beneficiary a period of at least 60 days to elect COBRA continuation coverage under a group health plan. Plans are required to allow payment of premiums in monthly installments, and plans cannot require payment of premiums before 45 days after the day of the initial COBRA election. COBRA continuation coverage may be terminated for failure to pay premiums timely.

Under the COBRA rules, a premium is considered paid timely if it is made not later than 30 days after the first day of the period for which payment is being made. Notice requirements prescribe time periods for employers to notify the plan of certain qualifying events and for individuals to notify the plan of certain qualifying events or a determination of disability. Notice requirements also prescribe a time period for plans to notify qualified beneficiaries of their rights to elect COBRA continuation coverage.

ERISA requires plans to establish and maintain reasonable claims procedures and imposes additional rights and obligations with respect to internal claims and appeals and external review for non-grandfathered group health plans.

II. Temporary Extensions Under the Guidance

All of the foregoing provisions include timing requirements for certain acts in connection with employee benefit plans, some of which have been temporarily modified by the new guidance. These changes, and the implications for Plan Sponsors, are summarized below.

A. Relief for Plan Participants, Beneficiaries, Qualified Beneficiaries, and Claimants

Subject to a one year statutory duration limitation, all group health plans, disability and other employee welfare benefit plans, and employee pension benefit plans subject to ERISA or the Code must disregard the period from March 1, 2020 until sixty (60) days after the announced end of the National Emergency (the “Outbreak Period”) for all plan participants, beneficiaries, qualified beneficiaries, or claimants wherever located in determining the following periods and dates—

(1) The 30-day period (or 60-day period, if applicable) to request special enrollment under ERISA section 701(f) and Code section 9801(f)

Implications for employers:

Work with your third-party administrator and insurance carriers to ensure the extended special enrollment period is implemented for the duration of the Outbreak Period, which could require retroactive coverage as far back as March 1.
Determine whether and how to communicate the extension to employees.

(2) The 60-day election period for COBRA continuation coverage under ERISA section 605 and Code section 4980B(f)(5)

(3) The date for making COBRA premium payments pursuant to ERISA section 602(2)(C) and (3) and Code section 4980B(f)(2)(B)(iii) and (C)

(4) The date for individuals to notify the plan of a qualifying event or determination of disability under ERISA section 606(a)(3) and Code section 4980B(f)(6)(C)

Implications for Employers:

This exacerbates the adverse selection issue inherent in COBRA because Plans may have to provide retroactive coverage for many months.
The problem is made worse by the fact that, even though qualified beneficiaries theoretically have to pay for the retroactive coverage, if they elect COBRA right after the qualifying event, they do not have to pay until after the Outbreak Period ends. This means a qualified beneficiary could elect COBRA and receive the coverage) and then subsequently decide not to pay for it. Plan Sponsors and insurers will then have the option of retroactively terminating the coverage and trying to adjust the claims already paid.
Work with your third-party administrator and insurance carriers to ensure they have implemented the extended COBRA periods.
Either temporarily revise your COBRA notices and forms or ensure a temporary cover is added to all COBRA communications as necessary to inform employees and qualified beneficiaries of the extended timeframes.

(5) The date within which individuals may file a benefit claim under the plan’s claims procedure pursuant to 29 CFR 2560.503-1

(6) The date within which claimants may file an appeal of an adverse benefit determination under the plan’s claims procedure pursuant to 29 CFR 2560.503-1(h)

Implications for Employers:

Work with your third-party administrator and insurance carriers to ensure they have implemented the extended claims periods.
Either temporarily revise your claims notices and forms or ensure a temporary cover is added to all claims communications as necessary to inform employees and qualified beneficiaries of the extended timeframes.
This will impact health flexible spending accounts (“FSAs”) and health reimbursement arrangements (“HRAs”) that have run-out periods that extended beyond March 1, 2020. Because the Outbreak Period began on March 1, 2020, any health FSAs and HRAs that have March or April deadlines for submitting prior-year expenses for reimbursement, will need to extend the deadline until 60 days after the Outbreak Period ends to submit expenses for reimbursement for the 2019 plan year.

(7) The date within which claimants may file a request for an external review after receipt of an adverse benefit determination or final internal adverse benefit determination pursuant to 29 CFR 2590.715-2719(d)(2)(i) and 26 CFR 54.9815-2719(d)(2)(i), and

(8) The date within which a claimant may file information to perfect a request for external review upon a finding that the request was not complete pursuant to 29 CFR 2590.715-2719(d)(2)(ii) and 26 CFR 54.9815-2719(d)(2)(ii)

Implications for employers:

Work with your third-party administrator and insurance carriers to ensure they have implemented the extended claim review periods.
Either temporarily revise your claims notices and forms or ensure a temporary cover is added to all claims communications as necessary to inform employees and qualified beneficiaries of the extended timeframes.

B. Relief for Group Health Plans

With respect to group health plans, and their sponsors and administrators, the Outbreak Period shall be disregarded when determining the date for providing a COBRA election notice under ERISA section 606(c) and Code section 4980B(f)(6)(D).

Implication for Employers:

Plan administrators are not required to provide the COBRA election notice during the Outbreak Period. As a practical matter, however, plan administrators likely will want to timely provide election notices to encourage qualified beneficiaries to timely elect and pay for COBRA coverage.

EEOC Wellness Regulations Sent to EEOC For Review (AARP v US EEOC)

The United States District Court for the District of DC has concluded in the case of AARP v. United States Equal Employment Opportunity Commission, that the EEOC’s final wellness regulations are arbitrary and capricious, and has therefore sent them back to the EEOC for review. The regulations address the impact of the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA) on employer-sponsored wellness programs.

The Plaintiff in the case, the AARP, argued that permitting incentives of up to 30% of the cost of coverage is an unreasonable interpretation of the term “voluntary” because the incentive is too high to give employees a meaningful choice whether to participate in programs requiring disclosure of ADA-protected information. It further argued that the EEOC’s reversal of its prior position on the meaning of “voluntary”, which precluded incentives, was unsupported, inadequately explained, and thus, arbitrary and capricious.

The court ruled that the EEOC has not justified its conclusion that the 30% incentive level is a reasonable interpretation of voluntariness. Rejecting the EEOC’s argument that 30% is appropriate because it harmonizes the EEOC regulations with HIPAA as amended by the ACA, the court explained that HIPAA’s 30% incentive cap is not intended to serve as an interpretation of the term “voluntary” since voluntariness of participation is not an issue under HIPAA. Moreover, the court pointed out, the EEOC regulations are inconsistent with the HIPAA regulations in other respects. For instance, the EEOC regulations extend the 30% cap to participatory wellness programs to which the HIPAA cap does not apply. While holding that the EEOC made its decision arbitrarily, the court did not vacate the regulations, noting that they have been applicable for eight months. Instead, the court remanded the regulations to the EEOC for reconsideration. For now, the EEOC’s final wellness regulations will remain in effect, pending the EEOC’s review of the regulations.

Background

Wellness programs are regulated in part by the Health Insurance Portability and Accountability Act (HIPAA), as amended by the Affordable Care Act (ACA), as well as by HIPAA’s implementing regulations.

HIPAA prevents health plans and insurers from discriminating on the basis of “any health status related factor,” but allows covered entities to offer “premium discounts or rebates” on a plan participant’s copayments or deductibles in return for that individual’s compliance with a wellness program. A “reward” or incentive may include a discount on insurance costs or a penalty that increases the plan participant’s costs because of non-participation in the wellness program. See 26 C.F.R. § 54.9802-1(f)(1)(i).

The ACA’s amendments to HIPAA, and the accompanying implementing regulations, allow plans and insurers to offer incentives of up to 30% of the cost of coverage in exchange for an employee’s participation in a health-contingent wellness program, a kind of wellness program in which the reward is based on an insured individual’s satisfaction of a particular health-related factor. See Incentives for Nondiscriminatory Wellness Programs in Group Health Plans (“the 2013 HIPAA regulations” or “2013 HIPAA rule”), 78 Fed. Reg. 33,158, 33,180. Neither the ACA nor the 2013 HIPAA regulations impose a cap on incentives that may be offered in connection with participatory wellness programs, which are programs that do not condition receipt of the incentive on satisfaction of a health factor. Id. at 33,167.

However, because employer-sponsored wellness programs often involve the collection of sensitive medical information from employees, including information about disabilities or genetic information, these programs often implicate the ADA and GINA as well. As both the ADA and GINA are administered by EEOC, this brings wellness programs within EEOC’s purview.

The ADA prohibits employers from requiring medical examinations or inquiring whether an individual has a disability unless the inquiry is both job-related and “consistent with business necessity.” 42 U.S.C. § 12112(d)(4)(A). But the ADA makes some allowances for wellness programs: it provides that an employer may conduct medical examinations and collect employee medical history as part of an “employee health program,” as long as the employee’s participation in the program is “voluntary”. Id. § 12112(d)(4)(B). The term “voluntary” is not defined in the statute.

Similarly, GINA prohibits employers from requesting, requiring, or purchasing “genetic information” from employees or their family members. The definition of genetic information includes an individual’s genetic tests, the genetic tests of family members such as children and spouses, and the manifestation of a disease or disorder of a family member. Like the ADA, GINA contains an exception that permits employers to collect this information as part of a wellness program, as long as the employee’s provision of the information is voluntary. Again, the meaning of “voluntary” is not defined in the statute.

Thus, while HIPAA and its implementing regulations expressly permit the use of incentives in wellness programs, uncertainty existed as to whether the “voluntary” provisions of the ADA and GINA permit the use of incentives in those wellness programs that implicate ADA- or GINA-protected information.

The EEOC previously took the position that in order for a wellness program to be “voluntary,” employers could not condition the receipt of incentives on the employee’s disclosure of ADA- or GINA-protected information. However, in 2016 the EEOC promulgated new rules reversing this position. Those are the rules at issue in this case. The new ADA rule provides that the use of a penalty or incentive of up to 30% of the cost of self-only coverage will not render “involuntary” a wellness program that seeks the disclosure of ADA-protected information. See ADA Rule, 81 Fed. Reg. at 31,133–34. Likewise, the new GINA rule permits employers to offer incentives of up to 30% of the cost of self-only coverage for disclosure of information, pursuant to a wellness program, about a spouses’s manifestation of disease or disorder, which, as noted above, falls within the definition of the employee’s “genetic information” under GINA.2 See GINA Rule, 81 Fed. Reg. at 31,144.

Unlike the 2013 HIPAA regulations, which place caps on incentives only in health-contingent wellness programs, the incentive limits in the new GINA and ADA rules apply both to participatory and health-contingent wellness programs.

HHS Announces Two More Significant HIPAA Privacy and Security Settlements

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has announced two more significant settlements in cases of alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) involving electronic protected health information (ePHI). These settlements highlight the need for HIPAA covered entities and their business associates to:

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of their ePHI;
Implement policies and procedures and facility access controls to limit physical access to their electronic information systems;
Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
Assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI;
Reasonably safeguard laptops with unencrypted ePHI (or better yet, secure all ePHI);
Implement policies and procedures to prevent, detect, contain, and correct security violations; and
Obtain satisfactory assurances in the form of a written business associate contract from their business associates that they will appropriately safeguard all ePHI in their possession.

In addition, if it has been more than a few years since you conducted a security and privacy assessment and adopted privacy and security policies and procedures under HIPAA, you should be working on updating that assessment and the resulting policies and procedures. As in many areas, making a good faith effort at compliance is half the job.

Details

In the first case, Advocate Health Care Network (Advocate) agreed to a settlement with OCR for multiple potential HIPAA violations involving ePHI pursuant to which Advocate agreed to pay a $5.55 million settlement and adopt a corrective action plan. This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals whose information was affected by Advocate, one of the largest health systems in the country. OCR began its investigation in 2013, when Advocate submitted three breach notification reports pertaining to separate and distinct incidents involving its subsidiary, Advocate Medical Group (“AMG”). The combined breaches affected the ePHI of approximately 4 million individuals. The ePHI included demographic information, clinical information, health insurance information, patient names, addresses, credit card numbers and their expiration dates, and dates of birth. OCR’s investigations into these incidents revealed that Advocate failed to:

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of its ePHI;
Implement policies and procedures and facility access controls to limit physical access to the electronic information systems housed within a large data support center;
Obtain satisfactory assurances in the form of a written business associate contract that its business associate would appropriately safeguard all ePHI in its possession; and
Reasonably safeguard an unencrypted laptop when left in an unlocked vehicle overnight.

Read the Advocate Health Care Network resolution agreement and corrective action plan.

In the second case, the University of Mississippi Medical Center (UMMC) agreed to settle multiple alleged violations of HIPAA. OCR’s investigation of UMMC was triggered by a breach of unsecured ePHI affecting approximately 10,000 individuals. During the investigation, OCR determined that UMMC was aware of risks and vulnerabilities to its systems as far back as April 2005, yet no significant risk management activity occurred until after the breach, due largely to organizational deficiencies and insufficient institutional oversight. UMMC will pay a resolution amount of $2,750,000 and adopt a corrective action plan to help assure future compliance with HIPAA Privacy, Security, and Breach Notification Rules. On March 21, 2013, OCR was notified of a breach after UMMC’s privacy officer discovered that a password-protected laptop was missing from UMMC’s Medical Intensive Care Unit (MICU). UMMC’s investigation concluded that it had likely been stolen by a visitor to the MICU who had inquired about borrowing one of the laptops. OCR’s investigation revealed that ePHI stored on a UMMC network drive was vulnerable to unauthorized access via UMMC’s wireless network because users could access an active directory containing 67,000 files after entering a generic username and password. The directory included 328 files containing the ePHI of an estimated 10,000 patients dating back to 2008. Further, OCR’s investigation revealed that UMMC failed to:

implement its policies and procedures to prevent, detect, contain, and correct security violations;
implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI; and
notify each individual whose unsecured ePHI was reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach.

University of Mississippi is the state’s sole public academic health science center with education and research functions. In addition it provides patient care in four specialized hospitals on the Jackson campus and at clinics throughout Jackson and the state. Its designated health care component, UMMC, includes University Hospital, the site of the breach in this case, located on the main UMMC campus in Jackson.

Read the University of Mississippi resolution agreement and corrective action plan.

Significant Changes Proposed for Form 5500

On July 21, 2016 the Department of Labor (DOL), the Internal Revenue Service (IRS) and the Pension Benefit Guaranty Corporation (PBGC) published proposed rules that would make significant revisions to the Form 5500 Annual Return/Report as of the 2019 filing year.

DOL explains in a Fact Sheet that the proposed form revisions and the DOL’s related implementing regulations are intended to address changes in applicable law and in the employee benefit plan and financial markets, and to accommodate shifts in the data the DOL, IRS and PBGC need for their enforcement priorities, policy analysis, rulemaking, compliance assistance, and educational activities.

The major proposed changes are summarized below:

Retirement Plan Changes– The new Form 5500 will request more information about participant accounts, contributions, and distributions. It will also ask about plan design features, including whether the plan uses a safe harbor or SIMPLE design and whether it includes a Roth feature. The form will also ask about investment education and investment advice features, default investments, rollovers used for business start-ups (ROBS), leased employees, and pre-approved plan designs. Schedule R will include new questions about participation rates, matching contributions, and nondiscrimination.

Group Health Plan Changes– The most significant change for health plans is that all ERISA group health plans, including small plans that are currently exempt from filing, will be required to file a Form 5500. The new filing requirement includes a new Schedule J (Group Health Plan Information), which will list the types of health benefits provided, the plan’s funding method (self insured or fully insured), information about participant and employer contributions, information about COBRA coverage, whether the plan is grandfathered under health care reform, and whether it includes a high deductible health plan, HRA, or health FSA. In addition, most filings (except those for small fully insured plans) would have to provide financial and claims information, disclose stop-loss carriers, third party administrators and other plan service providers, and provide details regarding compliance with HIPAA, GINA, health care reform and other compliance issues.

Other Changes– The proposed changes affect many of the existing Form 5500 schedules, including:
- Schedule C would be revised to coordinate with the service provider fee disclosure rules.
- Schedule C would be required from some small plans currently exempt from filing it.
- Schedule H would be expanded to include questions on fee disclosures, annual fair market valuations, designated investment alternatives, investment managers, plan terminations, asset transfers, administrative expenses and uncashed participant checks.
- Schedule I would be eliminated.
- Small plans that currently file Schedule I would generally need to file Schedule H.

Effective Date– The new Form 5500 is expected to be required as of the 2019 plan year filings.

Proposed Rule Making Form 5500 Changes

OCR Launches Phase 2 of HIPAA Audit Program

As a part of its continued efforts to assess compliance with the HIPAA Privacy, Security and Breach Notification Rules, the HHS Office for Civil Rights (OCR) has begun its next phase of audits of covered entities and their business associates.

In its 2016 Phase 2 HIPAA Audit Program, OCR will review the policies and procedures adopted and employed by covered entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. These audits will primarily be desk audits, although some on-site audits will be conducted.

The 2016 audit process begins with verification of an entity’s address and contact information. An email is being sent to covered entities and business associates requesting that contact information be provided to OCR in a timely manner. OCR will then transmit a pre-audit questionnaire to gather data about the size, type, and operations of potential auditees; this data will be used with other information to create potential audit subject pools.

The OCR’s detailed audit protcol is available here.

If an entity does not respond to OCR’s request to verify its contact information or pre-audit questionnaire, OCR will use publically available information about the entity to create its audit subject pool. Therefore an entity that does not respond to OCR may still be selected for an audit or subject to a compliance review.

To learn more about OCR’s Phase 2 Audit program, click on one of the links below:

When Will the Next Round of Audits Commence?

Who Will Be Audited?

On What Basis Will Auditees Be Selected?

How Will the Selection Process Work?

How Will the Audit Program Work?

What if an Entity Doesn’t Respond to OCR’s Requests for Information?

What is the General Timeline for an Audit?

What Happens After an Audit?

How Will Consumers Be Affected?

Will Audits Differ Depending on the Size and Type of Participants?

Will Auditors Look at State-Specific Privacy and Security Rules in Addition to HIPAA’s Privacy, Security, and Breach Notification Rules?