PART IV. HIPAA EVALUATION DESIGN

Peter D. Jacobson, Stephen H. Long, and M. Susan Marquis

I. INTRODUCTION

Scope of Evaluation DESIGN

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires the Department of Health and Human Services to report on the effectiveness of the Title I provisions of HIPAA in providing access to health insurance and ensuring coverage security for the currently insured. This document describes components of a design for undertaking such an evaluation. The design builds on the literature review and database review described in earlier parts of this report, and on the policy database developed by the Institute for Health Policy Solutions (IHPS) as part of this project. The (IHPS) database describes the pre- and post-HIPAA status of group and individual insurance market provisions in each state and so identifies states in which the HIPAA legislation resulted in important insurance market changes.

Our approach to evaluation design is to identify a small number of key implementation and outcome questions that relate to access, premiums, benefits, or employment--the key outcomes addressed in our literature review. We suggest an approach or approaches to answer each question. Thus our proposed evaluation design is modular; a subset of the suggested modules may be combined to form an evaluation of selected topics. We, however, do not recommend the questions and topics that should be given priority by HCFA(now known as CMS) in putting together a final evaluation design.

We focus our evaluation design on changes brought about by the HIPAA legislation. In doing this, we propose designs to measure the effects of reform packages that have been adopted to conform to HIPAA, but we do not propose designs to evaluate the generic elements of group or individual market reform in HIPAA (such as guaranteed issue, guaranteed renewal). Many of these generic elements had been enacted as small group reforms in most states prior to HIPAA and there are a number of evaluations that have been produced or are underway to evaluate these. We limit our proposed evaluation to studying packages of market reforms that are subsequent to the HIPAA legislation.

We emphasize implementation questions and qualitative designs. We focus on implementation questions and qualitative studies because there exist limited data for quantitative investigation. Even with ongoing surveys, lags for most data mean that data for 1998 (the first full year of HIPAA implementation) would not be available for analysis until 2000 or even later, delaying information until late 2001 or later. Moreover, for a more complete quantitative evaluation of the impacts of HIPAA, an evaluator would prefer to give the legislation time to play out its effects. Thus, one would want to evaluate a year later than 1998, delaying results even further. However, Congress will want more timely feedback on the legislation and its effects. Our proposed evaluation plan does include some quantitative components, but they are limited to simple quantitative indicators that can be gathered quickly, and to analyses using the Current Population Survey in order to gain early results.

In addition, most observers believe that the magnitude of HIPAA’s effects will be small and concentrated among small segments of the population, such as those in at-risk industries, or persons in poor health—our literature review contained in Part II confirms this. HIPAA was designed to eliminate the most grievous inequities in the insurance market. Therefore, it will be difficult to show measurable effects with most existing data collection efforts because they are general population surveys, and so do not have a sufficient sample of target groups. Furthermore, it is difficult to design surveys or studies to identify representative samples of these vulnerable target groups.

We also focus on implementation issues in our design because an extensive literature shows that an effective implementation process is integral to successful policymaking, in part because program objectives are likely to be interpreted differently by various levels of government. Conceptually, we anticipate that certain barriers will emerge that will be difficult for individual HIPAA eligibles to surmount given their diffuse interests relative to the concentrated interests of the insurance industry. In particular, prices quoted to HIPAA eligibles may exceed prevailing rates in the individual market. In some cases, reforms brought about by HIPAA may also lead insurers to raise group rates. Further, insurers have little incentive to encourage brokers to enroll HIPAA eligibles, and may, as anecdotal evidence indicates, also delay the application process. Although employers have little incentive to work on behalf of individual HIPAA eligibles, they may have a corporate objective to convince remaining employees that the firm will facilitate HIPAA coverage. If implementation is to be facilitated, some concerted effort by the state and HCFA(now known as CMS) will be needed to overcome these barriers.

According to a recent GAO report, state insurance regulators have encountered implementation barriers resulting in part from the lack of federal guidance. Before policymakers and stakeholders can take action to address the perceived weaknesses in the HIPAA structure, we must accurately assess how HCFA(now known as CMS) and the states are enforcing HIPAA provisions, what seems to be working, what the potential barriers to implementation are, and what covered populations or services have been most affected by the implementation process. Therefore, our evaluation questions include assessing the extent to which these and other barriers limit HIPAA coverage and the extent to which the state and HCFA(now known as CMS) adopt policies to overcome these barriers. Finally, because HIPAA is viewed by many as a model for the new Federalism, understanding the implementation barriers may be as, or more important, than quantifying outcomes.

Limitations on proposed scope

There are a number of important topics related to HIPAA that are not addressed in our evaluation proposal. We do not propose efforts that we believe are duplicative of efforts that are underway. Thus, for example, we exclude evaluations of the generic small group insurance market reforms as discussed above.

A second example relates to efforts to inform consumers of their rights under HIPAA. This is an important implementation issue, however there is an extant project at Georgetown University to study consumer information and HIPAA. We believe HCFA(now known as CMS) needs to focus resources on questions that are not being addressed already.

Similarly, we do not propose developing and monitoring indicator measures when we are aware of other efforts that are underway. For example, Deborah Chollet and her colleagues have recently undertaken considerable effort to measure the structure of the group and individual insurance markets in selected states. While the effects of HIPAA on this structure are of interest, the development of reliable measures of structure entails considerable investment and we do not believe HCFA(now known as CMS) should devote resources to duplicate the ongoing work of Chollet and others.

Our evaluation proposal also is limited to the implementation and effects of Title I of HIPAA. We do not address other titles of the act which provide for specific tax incentives, programs to prevent health care fraud and abuse, a demonstration of Medical Savings Accounts, specific benefit mandates, and administrative simplification because these issues are beyond the scope of this contract.

ORGANIZATION OF REMAINDER OF REPORT

The next section of this report provides a general overview of the proposed evaluation design. It discusses comparison groups and data for the quantitative components of the evaluation. It describes generic aspects of the qualitative evaluation including site selection, case study interviews, and data analysis.

The final section of the report then covers the specific evaluation topics that we propose. It is organized by the four key outcomes that we considered in the literature review chapter: access, price, benefits, and employment. For each of these topic areas, we pose one or more key questions and present an approach to address the issue. The discussion in section III highlights the unique elements of the quantitative or qualitative design that are not addressed in the general discussion found in section II.

II. RESEARCH DESIGN

QUANTITATIVE EVALUATION

Contrast Groups

Small Group Market Analyses. Our proposed quantitative design components focus on before-after comparisons of an outcome of interest in a state or group of states. Because states differed in their regulations prior to the implementation of HIPAA, we look to form clusters of states that had a similar pre-regulatory environment and examine changes post-HIPAA within this cluster of similar states. Ideally, we also want to identify a control group of states which had pre-HIPAA regulations that matched or exceeded the HIPAA reform requirements. Changes that we observe in these states are a measure of secular trend in states that adopted new regulation in response to HIPAA. That is, by comparing the change in an outcome among states which adopted legislation to conform to HIPAA requirements with the change in states that did not need to do so, we can infer how much of the observed change is due to the legislation and how much to secular change. The central feature of our recommended evaluation design is therefore the identification of these state groups.

Table 1 presents our suggested analytic groupings for analyzing the effect of the HIPAA group insurance market reforms. Based on an analysis of the IHPS small group database, we identified groups of states in which the small group insurance market legislation lacked one or more of the HIPAA requirements and so required new state regulation to conform to HIPAA. For example, Alabama (shown as group A), is the only state that did not limit pre-existing conditions or require guarantee renewal or guaranteed issue of some group product in the pre-HIPAA period. Similarly, we have identified

a group of states (group B) which included some of the HIPAA requirements but lacked guaranteed issue. Group C includes states with pre-HIPAA requirements that required guaranteed issue, but only of a limited number of insurance products; HIPAA requires this of all products sold in the small group market.

Group D is our group of control states. It includes states that had adopted regulations that met the HIPAA minimum requirements prior to the federal legislation. Group D does not include all states that had passed small group legislation that met the HIPAA requirements. We hypothesize that the degree of premium rating restriction may be an important factor in premium change and stability of offer rates. Therefore, we choose control states that have rating restrictions that are comparable to the rate restrictions in our 3 groups of study states. Specifically, we look for control states that do not exclude health status as a factor in setting premiums in the small group market.

The basic analysis strategy then is to compare change in an outcome of interest in one of the state groups A, B, or C with change in the control states in group D. This difference is a measure of the effect of new legislation to meet the HIPAA requirement. For example, a contrast between states in Group B and D is a measure of the effect of guaranteed issue in the small group market. Contrasting states in Group C and D provides an estimate of the effect of requiring guaranteed issue of all products.

Individual Market Analyses. Table 2 presents comparison groups for analyses of the effects of the group to individual portability provisions of HIPAA. The objective is to find groups of states that have adopted a similar implementation strategy and had similar pre-HIPAA regulatory provisions in the individual market. We focus on the two implementation strategies that have been adopted by most states: the federal fallback standards or use of a state risk pool. We do not include other strategies for several reasons.

First, most of the states that have adopted more expanded guaranteed issue provisions than required by the federal standards had such legislation in place prior to HIPAA. Second, while there are several other alternative mechanisms in place, such as mandatory conversion, these are typically state specific. Thus, it is more difficult to generalize any findings. Any change we observe might reflect situational effects. When we have a larger group of states, situation specific effects can be assumed to average out over the group.

A problem in our comparison groups for the individual market analysis is that we do not have a good temporal control. Virtually all of the states that had adopted individual market reforms prior to HIPAA that met or exceed the HIPAA minimum requirements also had tight rating restrictions. Changes in these states will not reflect the effect of new access regulations, but will reflect the tight premium regulation in these markets. Therefore we do not believe that they serve as good controls for changes that would have occurred in the unregulated markets of states that have adopted the federal fallback or risk pool alternative to meet the HIPAA standards. Instead, the evaluation in the individual market will focus on contrasts between different models of HIPAA implementation in previously unregulated markets. This will not answer questions about overall effects of reform, but rather whether one model appears to have different access, premium, and employment effects than the other.

We present four comparison groups in Table 2. In addition to the HIPAA implementation strategy, we differentiate states based on their pre-HIPAA regulatory profile. In particular, we distinguish states that had some regulations limiting pre-existing condition exclusions in individual coverage and providing for portability in satisfying any such exclusions from those that did not.

Data Sources

Our suggested quantitative evaluation designs emphasize the use of the Current Population Survey. Timeliness is a critical factor in this recommendation. The March CPS, which includes information about insurance coverage, is typically available within 6 months of the interview period. Thus, the evaluator would be able to conduct quantitative analyses in late 1999 and early 2000 using the March 1999 CPS as the post-HIPAA measure. Most other data collection efforts would not begin to yield data to perform analyses until 2001 or later.

A disadvantage of the CPS for this purpose is small samples in some states. Thus, when a comparison group includes a small number of small states, the sample size will not be sufficient to produce reliable estimates. We discuss power to detect differences under the specific topics below. For comparisons that cannot be made using a single CPS, HCFA(now known as CMS) may wish to arrange for some longer term evaluation that would involve either pooling multiple years of post-HIPAA experience as measured by the CPS or using some of the other databases that we have described in Part III. Moreover, even when the contrast involves a number of states, our design will permit the evaluator to detect effects of HIPAA only if they are moderate or substantial. We do not present a design that would be able to reject the hypothesis that HIPPA has any, including very small, effects on the outcomes of interest. The magnitude of the effects that we can detect with our design are discussed in more detail below.

In addition to the CPS, some of our designs include other sources of data to address specific issues related to HIPAA and its implementation. These are described in section III where we lay out the proposed topics and specific designs.

QUALITATIVE EVALUATION

Case Study Methods

Qualitative methods are appropriate for studying how and why systems change and the political and social context in which these changes occur. The qualitative evaluation would involve elite interviews in selected sites to understand the implementation of HIPAA. To gain various perspectives, individuals from the following entities would be interviewed: 1) state officials involved in HIPAA implementation; 2) a sample of large and small employers; 3) insurers; and 4) a sample of HIPAA eligibles. In case study interviews, the desired strategy is to triangulate, that is, to obtain more than one voice for each group of interest, so that each conclusion is corroborated by more than one respondent. Thus one would want to interview more than one representative from each group. Interviews should be coded to ensure that all responses are included in synthesizing the results; software is commercially available to use for this purpose.

HCFA(now known as CMS) officials responsible for federally enforcing implementation in those states that have not passed conforming legislation should also be interviewed. As well as a discussion focusing on HCFA(now known as CMS)’s compliance strategy, the interview would cover efforts to communicate to or coordinate with all states.

We would expect that each state selected for case study would be visited once, for a period of 3-5 days. Follow-up telephone interviews would be conducted to clarify interview notes or to solicit additional information. Before visiting each state, the team should review the available data and determine an agenda for whom to interview and specific topics for discussion. A standard interview guide would be developed and used to collect the information not available from documented sources. This semi-structured format would serve as a guide to note-taking, ensure that all topics are covered, and ensure consistency across states. The interview guide should be pre-tested in a state that will not be part of the final site selection.

The interviews would focus on the specific issues discussed in Section III. Many of the questions would be the same across all sites, however some questions would vary between sites to cover implementation issues related to differing legal environments. For example, in states using high-risk pools as an alternative HIPAA mechanism, the interview would include questions about risk pool funding, the premium schedule, and the methodology for determining premiums. In states that have adopted guaranteed issue, the interview would focus on the number and characteristics of guaranteed issue plans, risk adjustment or risk-spreading mechanisms, marketing practices, and enforcement.

In advance of the interviews, the evaluator should collect available documentary evidence. A data checklist should be developed and distributed requesting that documents be provided or made available to the site visit team for review. Materials that are not available in advance should be obtained while on-site. The checklist might include specific enforcement data, trends in employee access to HIPAA services, and premium changes over time. In addition, the checklist would ask for studies conducted by any of the parties on the effects of HIPAA, and would inquire about on-going or planned studies.

Data Analysis

The data analysis would focus on synthesizing the results of the case study interviews and document reviews and on extracting a set of cross-cutting themes, or lessons, that can be applied by policymakers to achieve HIPAA’s goals. The primary form of analysis would be descriptive, comparing and contrasting information across sites along the dimensions of interest, namely access to insurance coverage, premium pricing, and market responses.

Initially, this would involve writing separate case studies for each state visited. Once the case studies are drafted, they should be sent to at least one respondent at each site for technical review. Comments received from the reviewer would be incorporated into the case studies. After the set of case studies has been developed and reviewed, the individual case study results would be compared and contrasted to identify common themes and key differences between the sites. For the final report, the results of the case studies would be synthesized to provide a comprehensive analysis of HIPAA compliance efforts.

Site Selection

The selection of sites would depend on the scope of questions described in section III that the evaluation will encompass. The candidate questions that we lay out below cover enforcement, the notification process, market responses, risk spreading mechanism, and risk pool implementation. Since not all states would be examined in case studies, the selection of sites would be based primarily on the ability to draw comparisons across states with different approaches to insurance reform. For example, to study enforcement, an evaluator would want to compare states that are implementing the federal fallback standards (such as CO, MD, TN), with states that have allowed enforcement of the standards to fall under HCFA(now known as CMS)’s, aegis (e.g. CA, MO), with states that have had individual market reforms in place for a longer period of time (e.g. NY, NJ, VT, or WA). An evaluator would also want to compare enforcement models and effectiveness in states that enacted new legislation to meet the HIPAA group market standards (e.g. AL, IL, CO, MO) with states that had such legislation in place (e.g. CA, TX, NY, NJ, WA)

To understand the implementation of the risk-spreading mechanisms and market responses, an evaluator would want to include states that have adopted the federal fallback standards (e.g. CO, CA, MO, TN), with states that have adopted a risk pool alternative (e.g. AL, IL, TX), with states that have enacted guaranteed issue provisions in the small group market that go beyond the fallback standards (e.g. WA, NY, VT, NJ). Investigation of problems in extending risk pools to HIPAA eligibles would include expansion of existing risk pools (e.g. IL, CT, MN) and states that have introduced new risk pools (e.g. AL, TX).

A core set of states that would provide some variation on the key dimensions to address all of the issues we propose below would include: AL, CA, CO, IL, MO, TX, WA.

III. SPECIFIC EVALUATION TOPICS AND DESIGNS

This section lists details the specific evaluation questions and designs in each of the four topic areas.

Access to insurance

Question A. How effective is the HIPAA model of federal standards/state implementation?

A number of observers view HIPAA as a model for the new Federalism. Under this model, the federal government establishes minimum standards, but states have flexibility with respect to implementation and are charged with enforcement. The federal government serves as enforcer only if the state fails to act.

Before adopting this as a general model of federal/state cooperation, there are several implementation questions that policymakers will wish to answer. First, do the federal standards establish a floor, or do they become a ceiling? In the case of HIPAA, the question is whether states that had gone beyond the federal standards begin to roll back reforms. For example, Nevada had regulations on pre-existing conditions exclusions in small group insurance policies that exceeded the HIPAA minimums, but has recently passed legislation to match the HIPAA requirements.

A second important question related to this model is what enforcement techniques are effective? Little is currently known about what mechanisms states use for enforcement—for example, do states rely on the grievance process to detect non-compliance? Do they impose reporting requirements to monitor the extent to which the market is responding to reforms? What other techniques are employed? What enforcement mechanisms are most effective? Even less is know about the effects of federal enforcement activities and how states will respond.

Answers to the first question can be obtained by monitoring changes in state law over time. IHPS developed a database structure and abstracting procedures for summarizing key elements of state law over time related to insurance regulation in the small group and individual insurance markets. A baseline describing regulations in the pre-HIPAA period (1996 and 1997) is complete. Continuing this abstracting process over time would provide data to measure how states’ regulations have changed in response to the HIPAA legislation.

To study enforcement mechanisms to ensure access, we recommend a four-phase study. The first three phases would be conducted as part of the qualitative case studies described generically above. The first task would be to categorize the enforcement mechanisms used by states and HCFA(now known as CMS) to implement HIPAA. The second part of the task would construct a typology of the various enforcement models. Once this typology is constructed, the third part of the task would be to develop measures of effectiveness and compare selected state models and HCFA(now known as CMS) activities in states included in the case studies. The case study analysis would lead to a typology of state mechanisms, hypotheses about effectiveness, and a protocol for measurement that would then be applied on a national basis.

Phase One: Problem Identification. Recent articles in the trade press have identified certain problems that have limited employee access to HIPAA benefits, including reduced brokerage commissions for enrolling HIPAA beneficiaries, application delays, and large price increases for coverage similar to that which the employee formerly maintained. The case study protocol would include a module to address what steps have been taken within the selected states to identify these and other problems that limit access to HIPAA coverage. For example, the protocol would include the following questions to be covered in the site visit interviews. Has the state put in place routine compliance review mechanisms to identify how HIPAA is being implemented or do states wait for complaints? Has the state implemented a voluntary compliance regime that encourages firms to self-correct without sanctions? Once a problem limiting access to HIPAA is identified, what steps are taken to eliminate the barrier? Does the state maintain a grievance process for employee complaints? If so, has the state analyzed the grievance process data to determine the types of problems employees repeatedly face in seeking HIPAA benefits?

Phase Two: Typology. A second product of this task would be an enforcement typology. To develop the typology the site visit interview protocol would address the following types of questions in states with conforming legislation. Which state agency has primary responsibility for HIPAA enforcement? Has the agency issued regulations or guidelines to employers and employees? How does the enforcement process work within each state? What data are collected to observe changes over time? Have states experimented with different enforcement models? If so, what lessons have they learned from these experiments? Have state agencies experienced any problems with the implementing legislation that might limit its ability to ensure access to HIPAA benefits? Have states solicited advice and cooperation from HCFA(now known as CMS) on enforcement concerns? What sanctions are available for non-compliance with HIPAA? Have any sanctions been imposed?

In states without conforming legislation, the typology would address these additional types of questions. Does HCFA(now known as CMS) attempt to develop partnerships with state agencies, in effect delegating enforcement to the state? How similar are the processes adopted by HCFA(now known as CMS) to those in states with conforming legislation? Has HCFA(now known as CMS) adopted a particular state model for use in non-conforming states? Has HCFA(now known as CMS) developed a mechanism for communicating its approach to states with conforming legislation and vice versa?

Phase Three: Effectiveness Measures. The third product from this task would be a set of hypotheses about the effectiveness of the various enforcement regimes, including a set of defined and measurable outcomes. Measures of effectiveness of the enforcement model might include the numbers of HIPAA eligibles enrolled after enforcement measures are taken relative to pre-enforcement enrollment, and reductions in the average processing times for HIPAA applications. Other measures depend on what types of barriers to enrollment are identified in the first part of this task. The case study interviews would be used to determine what types of outcome measurements are available from states and to gather the data for the sites selected for case study.

Two types of data would be collected to measure effectiveness. The first type would address HIPAA marketing activities. Is the marketing effort directed at employees? How do the states involve the business community in marketing the program? How does the state measure its effectiveness in complying with HIPAA? The second type would include any state information on the number of HIPAA eligibles and enrollees, changes over time in participation rates, and whether the state meets or exceeds federal minimum standards. Additional data would be sought to understand the grievance and complaint processes. How many HIPAA-related complaints have been filed, for what issues, and with what results?

The hypotheses about effectiveness would be tested in the comparative case studies. The purpose of the comparative case studies would be to assess the effectiveness of the states’ HIPAA activities using the typology described above. The findings would be used to refine the typology and measurement procedures for a national survey of state enforcement.

Phase Four: National Survey of State Regulators. The case study development work would yield a set of measures to describe the different enforcement models that have been identified, a set of measures of effectiveness, and a set of hypotheses about the relationships among these measures. The case study efforts will have identified what types of measures can be reported by most states. With this development work, we suggest that a fourth phase of this task would be to develop and administer a survey of state regulators on a national basis in order to have a comprehensive picture of state enforcement practices and their effectiveness.

Question B. How does the notification process work and what problems exist?

For HIPAA to achieve its goals, all involved parties must receive adequate notification of its provisions. The legislation requires that employers provide certification to employees and dependents as they leave a group plan. However, there is little known about how the notification process works in practice. This task, which would be a part of the case study, would interview state officials, employers, employee representatives, business groups (including business health purchasing coalitions), insurers, and HIPAA eligibles to better understand the notification process. It will be important to identify the specific roles played by the state, employers, and insurers and to identify problems in the notification process.

The case study protocol would include the following types of question to address issues related to the notification process. When are individuals notified? How and by whom are they are notified? What resources are made available to advise them and answer questions? Does the state specify the terms of the notification, including the content and timing of the notice? How does the state monitor the notification process? In particular, does the state monitor timeliness of the application process? What sanctions are imposed for not adhering to established notification processes and timeliness? For example, does the state mandate that the notice include a state official’s phone number to contact in case of delay? Does the state impose any reporting requirements on employers or insurers? Has the state analyzed those data? Are the costs of the notification process measured, and have there been attempts to reduce the costs? Do the participants maintain data on the volume of notifications?

Employers play an important role in the notification process. The case study protocol would include the following questions to understand this role: What steps have employers taken to meet HIPAA requirements? Have they gone beyond state and federal mandates in the notification process? Do employers develop their own systems for meeting their obligations? Are there differences between large and small employers? For example, do large employers delegate their responsibilities to third party administrators while small employers provide notification themselves? Do large employers designate a HIPAA sign-up specialist within their employee benefits office?

Anecdotal evidence suggests that employers and insurers believe that the notification process imposes burdensome administrative costs. To evaluate this claim, the case study interviews should address the following issues: Is there sufficient documentation to support the charge that notification is burdensome? Have employers and insurers implemented new systems to track HIPAA eligibles? To what extent have these groups experimented with less burdensome alternatives? Have these groups formally requested changes in the notification process?

In addition to informing HCFA(now known as CMS) about the notification process, we propose that the evaluator use this component of the case study as an opportunity to develop information to help in designing other data collection efforts to evaluate HIPAA. As we discuss in more detail under Question D below, we suggest that the evaluation include a survey of a sample of notifications to learn more about the number of HIPAA eligibles and who they are. The discussions surrounding the process of notification described here would be used in this later task to design the sampling process. That is, we use this task as the source of information about the parties responsible for notification—insurer, employer, TPA--and how this varies among different employer types. These responsible parties present sources of frames or lists from which to select a sample of notifications. Furthermore, the entity that tracks employer and dependent eligibility is a likely source of data about COBRA exhaustion rates—data which are also needed to help answer questions about the number of HIPAA eligibles. We suggest that the evaluator use this task to gather information about the tracking files and the kind of data that might be available to determine COBRA exhaustion rates. The use of these data is described under Question D below.

QUESTION C. What are the effects of HIPAA induced legislation in the small group market on employment based coverage?

Among the key access questions about the HIPAA group reforms are :

• What are the changes in enrollment in employer-sponsored plans by employees in small groups?
• What are the changes in rates of offering coverage by small employers?
• What are the effects on the structure of the market?

The design to address these questions is shown in Table 1 and discussed above. It involves a comparison of changes over time in groups of states that have implemented reform to comply with HIPAA (groups A, B, and C) with states that had previously met the HIPAA standards (group D). The data sources are discussed next.

What are the changes in enrollment in employer-sponsored plans by employees in small groups? A contrast between the state groups in the change the proportion of employees in small groups covered by group insurance can be made using data from the March CPS in the pre-and post-HIPAA period. (We define small to be fewer than 100 workers because the March CPS employer size questions do not allow one to identify groups of fewer than 50). A difference-in-differences design, such as we propose, is quite demanding in sample size because it involves a four group comparison. Based on sample sizes in the 1997 March survey, we estimate that the evaluator would have better than 95 percent power to detect a difference of 4 percentage points in change between group B and D or group C and D. This is equivalent to a 10 percent change in enrollment in the states with new legislation compared to a constant rate in the control group, and power of about 50-60 percent to detect a 5 percent change in enrollment.

Unfortunately, group A in Table 1, which includes states that implemented the greatest change in their small group insurance regulations to conform to HIPAA, consists of a single, small state. Consequently, an evaluator cannot expect to obtain reliable change estimates for this state group. Matters are somewhat better if successive March surveys in the pre- and post-HIPAA period are pooled to make estimates for this state. By pooling data for two years for both the before and after observations, one would have about 70 percent power to detect a 15 percent change in participation in group insurance among those in small groups in group A relative to a constant rate in group D (or about a 6 percentage point difference in the rate of change between the state groups).

HIPAA was intended to eliminate some of the most serious abuses in the market. Thus, as well as the effect on overall participation in group plans, policymakers will be interested in the effects on groups that previously had difficulty in acquiring group coverage. Certain industries, for example, are known to be singled out as poor risks by insurers and the CPS can be used to make a pre-post comparison of enrollment among those in small groups in at-risk industries. However, when subsetting the sample, pooling of years in both the pre- and post-period may be necessary for reliable results. Focusing on employees in small groups in industries that are often redlined, one would have less than 50 percent power to detect a 15 percent change in participation among these employees in state groups B or C relative to a constant rate in the control states using a single March CPS. By pooling over two years for the pre and post period, however, power can be improved to about 70 percent.

What are the changes in rates of offering coverage by small employers? The CPS does not collect information about whether employees are offered an employer sponsored-plan if they are not enrolled in one. Therefore, answering this question requires an alternative data source. Studying employer behavior is best accomplished through information about individual employers. The MEPS-IC provides information about a large sample of employers, and permits state level analyses in most states (see Part III for more details). Lags in data availability place this data source outside of the time frame of the scope of the evaluation that we have defined. Information about 1999 would not be expected to be available for analysis until the middle of 2001. However, we include it here because it is the best source for studying employer response to HIPAA. Based on the same design for the 1996 survey, the MEPS-IC would provide 80 percent power to detect a 4 percentage point difference in change over time between state group B and the control group D, and a difference of 3 percentage points between group C and group D.

What are the effects on the structure of the market? As we discussed above, Deborah Chollet and her colleagues have developed methods for synthesizing and integrating multiple data sources to produce measures of market structure. We do not believe the HCFA(now known as CMS) sponsored evaluation should duplicate those efforts. However, a simple measure of the count of the number of carriers in the market is a gross indicator of change that HCFA(now known as CMS) may wish to monitor. Regulator interviews conducted by IHPS as part of a Robert Wood Johnson Foundation study to measure insurance market regulations and characteristics that mediate their effect, indicated that most state insurance departments are able to provide this simple measure. This data might be collected during the case studies, or the national survey of regulators discussed under Question A above.

Question D. What are the access effects of HIPAA in the individual market?

We have identified three important sub-components of this question that we suggest HCFA(now known as CMS) incorporate in its evaluation design:

• How many HIPAA eligible individuals are there and who are they?
• How many HIPAA eligibles benefit from the reforms and what are the access effects?
• What are the implementation issues in adopting risk pools as the alternative mechanism?

How many HIPAA eligible individuals are there. Who are they? Estimates of the number of persons who are HIPAA-eligible differ widely. For example, HIAA estimated potentially 3 million additional insured lives in the individual market annually, whereas Klerman put this estimate at only 0.6 million. The estimates differ because of different assumptions about the rate of job turnover, and different assumptions about the percent who are eligible among job leavers. The latter depends on length of prior coverage; eligibility, take-up, and exhaustion of COBRA coverage or continuation policies required by state law; eligibility for other employment based health insurance; and eligibility for public insurance. Accurately estimating these transitions is essential for knowing how many HIPAA eligibles there are. But estimates require panel data to find job changers and then observe their destinations and choices. The only extant data base to do this is the SIPP—a 24-36 month panel survey of a nationally representative sample of the U.S. population.

We considered recommending use of SIPP data to try to model the number of HIPAA eligibles, but rejected this idea for several reasons. First, there are a number of shortcomings of the SIPP data for this purpose. The survey doesn’t ask about COBRA coverage directly, it has to be inferred. The panels aren’t long enough to observe exhaustion of COBRA coverage for most individuals, so assumptions or modeling of this is required. One needs retrospective information on prior health insurance coverage to identify whether there were 18 months of continuous coverage prior to leaving the group plan, which is not available in SIPP. Second, Klerman used the SIPP data in his modeling of the number of HIPAA eligibles, and so there aren’t likely to be significant gains from additional effort using these data.

Instead, we suggest new and better data might be obtained by drawing a sample from notifications of creditable coverage, and interviewing persons selected 2 to 3 months later to measure initial transitions and eligibility for other insurance. This would not be a nationally representative sample. However, by selecting notifications from employers in different size groups and different industries, one could represent experiences of different types of employees. National weights could be estimated from another source (such as the SIPP or CPS) to apply to the sampled experiences.

As indicated above, we suggest that the case study of the notification process would be important to help identify the source of the sampling frame. This, we expect, will vary for different types of employers. For example, large employers (or their agents) may have developed systems to do their own tracking and notification whereas small employers may rely on the insurer to do so.

A survey of recent job leavers, drawn from the notifications, would provide important information about transitions, such as the number who go to another insured job, the number who are eligible for another family member’s group insurance, the number who participate in Medicaid, the number who take up COBRA coverage and the number who decline it. This survey however would not inform the evaluation about another key transition, namely the share of those who elect COBRA coverage who exhaust the benefit and thereby become HIPAA eligible. We expect, however, that the same systems that track employees and dependents creditable coverage would be able to provide information about COBRA exhaustion rates. That is, the sources used to sample notifications must have group coverage enrollment files and could provide exhaustion rates for their covered populations. (At least this possibility should be explored). While not representative, again the sources would provide information for a variety of groups of different size and from different industries.

How many HIPAA eligibles benefit from the reforms and what are the access effects? Answering this question is difficult because there aren’t good strategies for identifying and studying those who are HIPAA eligible and, even once the are identified, there is not a baseline against which to measure change. Therefore, we offer several indirect indicators.

First, the proposed survey of notifications just described would inform about the number of persons who are HIPAA-eligible at the time of the survey who have enrolled in individual insurance plans. Absent baseline enrollment rates among persons who satisfy HIPAA eligibility requirements, the new measure might be compared to coverage rates in individual plans among the population who do not have group or public insurance. A second indirect indicator is enrollment by HIPAA eligibles in risk pools in states that have adopted this as the alternative arrangement. Three out of four states queried that have adopted risk pools as the alternative mechanism indicated that their enrollment systems distinguish HIPAA eligibles from other enrollees and would permit this measurement. This suggests that there may be promise in this approach. The National Association of State Comprehensive Health Insurance Plans (NASCHIP) is currently surveying its members on these issues in preparation for a late September 1998 meeting. The survey instrument includes questions about the number of HIPAA applicants to the risk pool, the number of HIPAA eligible individuals who have enrolled in the risk pool, and the number of HIPAA applicants who have failed to qualify. Therefore, a centralized source of information should be available to HCFA(now known as CMS)’s evaluator. Neither of these measures directly answers the question posed because we do not have a baseline measure to indicate what would have happened to these individuals absent HIPAA; but each indicator provides some measure of the scope of HIPAA.

Another approach is to look at general access effects; that is, to measure changes in insurance coverage in a defined population—such as those without group or public coverage. This measure incorporates both the rate of HIPAA eligibility among the population and access effects for the HIPAA eligible population. Thus, it understates the access effects on the target, HIPAA eligible population. This component of the evaluation would use the design shown in Table 2 and data from the CPS. Based on an analysis of sample sizes in the March 1997 CPS sample, the evaluator would have greater than 80 percent power to detect an increase of about 3 percentage points pre- and post- HIPAA in coverage under individual insurance policies among persons without employer or public insurance in state groups A, B, and C shown in Table 2. This is an increase in coverage of about 15 percent, given that individual coverage in this population is about 18 percent. To detect a change of 2 percentage points (a 10 percent change), one would have about 60 percent power for group A and 75 percent power for groups B and C. Since group D consists of only 2 small states, one pre-and post-HIPAA survey do not produce reliable estimates. By pooling two years in the pre- and post-HIPAA period, we estimate that an evaluator would have about 60 percent power to detect an increase in insurance coverage of about 3 percentage points.

Contrasting the different implementation models (that is comparing change across two of the groups shown in Table 2), is somewhat more demanding on sample size. We estimate that a single pre-and post measurement using the CPS would allow an evaluator to detect a 3 percentage point difference in the rate of change between any pair of group A, B, or C.

Policymakers will also be interested in whether HIPAA has improved access for vulnerable population groups. Therefore, we investigated whether the CPS would provide sufficient sample to measure change in coverage among persons without employer group or public insurance who are in poor or fair health. Because having poor or fair health is a relatively infrequent event, changes in coverage over time would have to be quite substantial to detect them with a single pre- and post-observation from the CPS. For groups B and C, we estimate that the evaluator would have 80 percent power to detect an increase of about 7 percentage points over time using a single CPS for the pre- and post-period; for group A, a change of about 8 percentage points could be detected with 80 percent power. Again, pooling data for multiple years would improve the power.

What are the implementation issues in adopting risk pools as the alternative mechanism? This task would focus on issues in implementing changes to risk pools needed to provide access using a state high-risk pool as the alternative mechanism. It would be accomplished through two mechanisms. First, updating the individual market database developed by IHPS would provide monitoring information on regulatory changes made in state high risk pools to qualify as an alternative mechanism. Second, we suggest that risk pool implementation be part of the case study protocol. The following topics would be covered: What changes to existing risk pools have been made by states to attract HIPAA eligibles? Do states subsidize the costs for low-income HIPAA eligibles? How has HIPAA affected rate-setting in the risk-pool arrangements? What types of products are offered through the high risk pool and how has choice and type of product changed? How do states track and measure HIPAA eligibles’ participation rates in expanded risk pools? Have states developed new information products to inform HIPAA eligibles about the risk pool? What is the application process; how easy is it to apply; has a process been established to enroll individuals within the 63 day period? In selecting sites, the evaluator would want to include states that have modified existing risk pools as an alternative mechanism as well as one or both states that have developed new risk pools for the HIPAA eligible population. The comparative study of these different cases would provide information about differences between new and existing risk pools in the number of HIPAA eligibles who are attracted and retained, the different rate-setting experiences, and other differences in implementation. Information being collected by NASCHIP, discussed above, could be used as part of the site-selection process.

PREMIUMS

We will focus here on questions about changes in premiums in the individual market. The states that adopted new guaranteed issue or guaranteed renewal provisions in the small group market have not typically introduced new rating restrictions. Thus, we would not expect premiums of groups that purchased insurance prior to HIPAA to change—unless insurers do not risk rate, as discussed in Part II. The average level of paid premiums might rise if more expensive groups enter the market because of the small group reforms, but this is likely to be a small effect. To investigate this change, one would want to study employers who offer insurance and the premiums they pay. As we have noted, the MEPS-IC data are best suited for this purpose, but they are not available within the time frame of our proposed evaluation. Over the longer run, one could look at average premium changes in the contrast groups shown in Table 1. We estimate that samples in the MEPS-IC survey would be large enough to detect a 10 percent increase in premiums in group B or C relative to constant premiums in group D with 80 percent power.

Our recommendation for the HCFA(now known as CMS) evaluation focuses on two topics: (1) the risk spreading mechanism states have adopted and (2) the change in premiums in the individual market.

Question E. How is the risk-spreading requirement being implemented?

This question would be addressed using the case studies and monitoring state regulation through updates of the regulatory database. The IHPS individual database captures some measures of state law requiring risk spreading among carriers. Updates of the database would track changes in these regulations nationwide. The case study would be used to gather greater detail about how states are implementing this provision of the law. The case study interview would collect detailed information about the mechanisms that selected states have adopted to meet the risk spreading requirement of HIPAA—e.g. premium caps in risk pools, subsidies for HIPAA eligibles, requiring carriers to contribute to a state fund for risk spreading, other techniques. The interview protocol would include questions about the determination of the mechanism (e.g. the determination of the cap, the subsidy schedule, the carrier assessments), and enforcement procedures.

Question F. How has HIPAA affected premiums in the individual market?

Data are lacking to provide a thorough analysis of this question. Our database review did not uncover any extant source of data to provide information on average premiums. A few sources exist to measure aggregate premiums, but they do not provide information about enrollments or data to standardize premiums for population or benefits.

However, some trends in individual market premiums can be measured using information from risk pools. Most risk pools include a cap on premiums that is tied to individual market rates. Thus, the risk pool administrators acquire information about prevailing rates in the individual market. Monitoring the information that risk pools have, by monitoring changes in the risk pool premium caps , provides data on trends in individual market premiums. Several states that have adopted federal standards have existing risk pools, including CA, CO, MO, and TN. We checked informally with two of these states (CO and MO) on the availability of data about individual market premiums. Both indicated that they do periodically (either annually or semi-annually) collect information from the top five carriers on premiums and that this information would be available to monitor trends in the individual markets in these states.

Individual market premiums may also be affected in states that have adopted the state risk pool as the alternative mechanism, if the broadening of the risk pool alters the remaining risk in the individual market. Thus, the evaluation would collect information from risk pools in states that have used it as the alternative mechanism as well as states that have adopted guaranteed issue. The design in Table 2 presents comparison groups for studying the effects of different HIPAA implementation models on market premiums.

Another way to measure whether participating HIPAA eligibles are a high risk group is to monitor costs per participant in states that have a high risk pool. At minimum, changes in cost per participant in the pre- and post-HIPAA period can be compared using data from Communicating for Agriculture (see the database review in Part III). In addition, our informal discussions with six high risk pools suggested that more detailed information on claims costs and participant months by plan type are available for the pre- and post HIPAA period. This would permit the evaluator to adjust claims costs for any changes over time in the type of plans selected. In addition, it appears likely that control for population composition—at least age-sex mix—may also be data that the risk pools could provide. States were less certain that these cost data could be separated for HIPAA and non-HIPAA participants—though three of the four risk pools that we contacted in states that have adopted the risk pool as their alternative mechanism indicated that their data systems would permit separate estimates. The NASCHIP survey discussed earlier is also attempting to obtain some of these measures from risk pools. In particular, the survey asks about claims payments for HIPAA eligibles, the number of low-risk HIPAA enrollees (as measured by small claims), and the number of high-risk HIPAA enrolless (as measured by claims in excess of $25,000 to date).

BENEFITS

QUESTION G: What have been insurer responses to the HIPAA legislation?

We suggest that evaluating the market’s response to HIPAA eligibility be a major focus of the case studies. HIPAA was designed to eliminate practices that discriminate against employer groups and their members or individuals purchasing insurance. The case studies would identify strategies adopted by insurers to facilitate or circumvent HIPAA requirements. As the dominant players in the small group and individual health insurance markets, how insurers adapt to HIPAA will determine whether HIPAA eligibles actually receive HIPAA benefits.

Specifically, the case study would focus on how insurers market HIPAA coverage, including any steps insurers might take to discourage HIPAA coverage. For example, the interview protocol should determine whether insurers use financial incentives to brokers to discourage them from selling to HIPAA eligibles in the individual market or to high risk groups. Other incentives to investigate would include pricing and benefits coverage strategies that make HIPAA coverage unattractive, such as the use of long waiting periods for costly medical conditions, benefits limits or exclusions, restrictive riders, or a benefit design structure that artificially segments the market. The case study would also attempt to assess whether insurers have exited from certain markets.

Some reports have suggested that insurers have implemented new rating methodologies because of HIPAA’s pre-existing condition requirements and have increased premiums. The case studies would complement the quantitative measures of premium change described earlier. They would question insurers about the bases for their rating methodologies, particularly to assess the allegation by GAO that HIPAA-eligibles are charged higher rates because insurers expect this group to be in poorer health, on average, than other policyholders. The case study would question insurers about evidence that the HIPAA-eligible population is in fact at higher risk than other employees. The case study interview should attempt to understand other objections or problems insurers are experiencing with HIPAA-eligibles.

The case study would also interview employers to assess their responses to changes in product offerings and prices. For instance, have employers responded by implementing changes in covered benefits? Have employers been able to offer similar benefits at the same price?

Employment effects

Question H. Are HIPAA induced changes in the small group market related to increases in employee turnover?

This analysis would follow the design shown in Table 1—that is, a comparison of changes in turnover in selected groups of states pre- and post- HIPAA with the change in the control states in group D. Each monthly CPS provides data to measure job change in the past week. This is a rare event, and so very large sample sizes are needed to detect a difference over time. Consequently, this proposed analysis would not be useful in detecting small effects of HIPAA on turnover. However, by pooling data for each monthly CPS in a year to obtain both the pre- and post HIPAA measures, we estimate that the CPS does provide moderate power to detect differences within the range suggested by the literature. Some estimates of the effect of insurance on turnover have placed the estimate at a 25 percent increase. The sample obtained by pooling all CPS surveys in a year prior to and post-HIPAA would have about 65 percent power to detect an effect of this magnitude for state groups B or C (that is, a 25 percent increase in turnover in state group B or C relative to a constant rate in group D).

Ideally one would look at turnover among those in insured jobs. Unfortunately, the CPS does not collect information on insurance every month. Therefore, the evaluation would have to focus on turnover among all employees. Consequently, a 25 percent increase in turnover is probably much larger than one might reasonably expect. As we have noted elsewhere, one can improve power to detect smaller effects by pooling observations over multiple years in the CPS. Using two years in the pre- and post period, one could detect a 20 percent increase in turnover (relative to the control states) with about 65 percent power.

Question I. Does group to individual portability affect early retirement decisions.

This analysis would be similar to that suggested for Question H. It would use the design shown in Table 2 and the CPS to address whether there was a decrease in the probability of being employed among individuals age 60-64 in the post-HIPAA period. Small samples in this age group included in any single CPS would necessitate pooling surveys. Using all respondents in this age group interviewed in a year prior to and post-HIPAA, the analysis would detect a decrease in employment in state groups A, B, or C of about 10 percent (or 4 percentage points) with 80 percent power. This design would provide 80 percent power to detect differences in the rate of change between two of these models of 5 percentage points.

Return to table of contents.

Exit to Health Policy Home Page