Baseline Information for Evaluating the Implementation of the Health Insurance Portability and Accountability Act of 1996: Final Report. Access to insurance

A number of observers view HIPAA as a model for the new Federalism. Under this model, the federal government establishes minimum standards, but states have flexibility with respect to implementation and are charged with enforcement. The federal government serves as enforcer only if the state fails to act.

Before adopting this as a general model of federal/state cooperation, there are several implementation questions that policymakers will wish to answer. First, do the federal standards establish a floor, or do they become a ceiling? In the case of HIPAA, the question is whether states that had gone beyond the federal standards begin to roll back reforms. For example, Nevada had regulations on pre-existing conditions exclusions in small group insurance policies that exceeded the HIPAA minimums, but has recently passed legislation to match the HIPAA requirements.

A second important question related to this model is what enforcement techniques are effective? Little is currently known about what mechanisms states use for enforcement—for example, do states rely on the grievance process to detect non-compliance? Do they impose reporting requirements to monitor the extent to which the market is responding to reforms? What other techniques are employed? What enforcement mechanisms are most effective? Even less is know about the effects of federal enforcement activities and how states will respond.

Answers to the first question can be obtained by monitoring changes in state law over time. IHPS developed a database structure and abstracting procedures for summarizing key elements of state law over time related to insurance regulation in the small group and individual insurance markets. A baseline describing regulations in the pre-HIPAA period (1996 and 1997) is complete. Continuing this abstracting process over time would provide data to measure how states’ regulations have changed in response to the HIPAA legislation.

To study enforcement mechanisms to ensure access, we recommend a four-phase study. The first three phases would be conducted as part of the qualitative case studies described generically above. The first task would be to categorize the enforcement mechanisms used by states and HCFA(now known as CMS) to implement HIPAA. The second part of the task would construct a typology of the various enforcement models. Once this typology is constructed, the third part of the task would be to develop measures of effectiveness and compare selected state models and HCFA(now known as CMS) activities in states included in the case studies. The case study analysis would lead to a typology of state mechanisms, hypotheses about effectiveness, and a protocol for measurement that would then be applied on a national basis.

Phase One: Problem Identification. Recent articles in the trade press have identified certain problems that have limited employee access to HIPAA benefits, including reduced brokerage commissions for enrolling HIPAA beneficiaries, application delays, and large price increases for coverage similar to that which the employee formerly maintained. The case study protocol would include a module to address what steps have been taken within the selected states to identify these and other problems that limit access to HIPAA coverage. For example, the protocol would include the following questions to be covered in the site visit interviews. Has the state put in place routine compliance review mechanisms to identify how HIPAA is being implemented or do states wait for complaints? Has the state implemented a voluntary compliance regime that encourages firms to self-correct without sanctions? Once a problem limiting access to HIPAA is identified, what steps are taken to eliminate the barrier? Does the state maintain a grievance process for employee complaints? If so, has the state analyzed the grievance process data to determine the types of problems employees repeatedly face in seeking HIPAA benefits?

Phase Two: Typology. A second product of this task would be an enforcement typology. To develop the typology the site visit interview protocol would address the following types of questions in states with conforming legislation. Which state agency has primary responsibility for HIPAA enforcement? Has the agency issued regulations or guidelines to employers and employees? How does the enforcement process work within each state? What data are collected to observe changes over time? Have states experimented with different enforcement models? If so, what lessons have they learned from these experiments? Have state agencies experienced any problems with the implementing legislation that might limit its ability to ensure access to HIPAA benefits? Have states solicited advice and cooperation from HCFA(now known as CMS) on enforcement concerns? What sanctions are available for non-compliance with HIPAA? Have any sanctions been imposed?

In states without conforming legislation, the typology would address these additional types of questions. Does HCFA(now known as CMS) attempt to develop partnerships with state agencies, in effect delegating enforcement to the state? How similar are the processes adopted by HCFA(now known as CMS) to those in states with conforming legislation? Has HCFA(now known as CMS) adopted a particular state model for use in non-conforming states? Has HCFA(now known as CMS) developed a mechanism for communicating its approach to states with conforming legislation and vice versa?

Phase Three: Effectiveness Measures. The third product from this task would be a set of hypotheses about the effectiveness of the various enforcement regimes, including a set of defined and measurable outcomes. Measures of effectiveness of the enforcement model might include the numbers of HIPAA eligibles enrolled after enforcement measures are taken relative to pre-enforcement enrollment, and reductions in the average processing times for HIPAA applications. Other measures depend on what types of barriers to enrollment are identified in the first part of this task. The case study interviews would be used to determine what types of outcome measurements are available from states and to gather the data for the sites selected for case study.

Two types of data would be collected to measure effectiveness. The first type would address HIPAA marketing activities. Is the marketing effort directed at employees? How do the states involve the business community in marketing the program? How does the state measure its effectiveness in complying with HIPAA? The second type would include any state information on the number of HIPAA eligibles and enrollees, changes over time in participation rates, and whether the state meets or exceeds federal minimum standards. Additional data would be sought to understand the grievance and complaint processes. How many HIPAA-related complaints have been filed, for what issues, and with what results?

The hypotheses about effectiveness would be tested in the comparative case studies. The purpose of the comparative case studies would be to assess the effectiveness of the states’ HIPAA activities using the typology described above. The findings would be used to refine the typology and measurement procedures for a national survey of state enforcement.

Phase Four: National Survey of State Regulators. The case study development work would yield a set of measures to describe the different enforcement models that have been identified, a set of measures of effectiveness, and a set of hypotheses about the relationships among these measures. The case study efforts will have identified what types of measures can be reported by most states. With this development work, we suggest that a fourth phase of this task would be to develop and administer a survey of state regulators on a national basis in order to have a comprehensive picture of state enforcement practices and their effectiveness.

For HIPAA to achieve its goals, all involved parties must receive adequate notification of its provisions. The legislation requires that employers provide certification to employees and dependents as they leave a group plan. However, there is little known about how the notification process works in practice. This task, which would be a part of the case study, would interview state officials, employers, employee representatives, business groups (including business health purchasing coalitions), insurers, and HIPAA eligibles to better understand the notification process. It will be important to identify the specific roles played by the state, employers, and insurers and to identify problems in the notification process.

The case study protocol would include the following types of question to address issues related to the notification process. When are individuals notified? How and by whom are they are notified? What resources are made available to advise them and answer questions? Does the state specify the terms of the notification, including the content and timing of the notice? How does the state monitor the notification process? In particular, does the state monitor timeliness of the application process? What sanctions are imposed for not adhering to established notification processes and timeliness? For example, does the state mandate that the notice include a state official’s phone number to contact in case of delay? Does the state impose any reporting requirements on employers or insurers? Has the state analyzed those data? Are the costs of the notification process measured, and have there been attempts to reduce the costs? Do the participants maintain data on the volume of notifications?

Employers play an important role in the notification process. The case study protocol would include the following questions to understand this role: What steps have employers taken to meet HIPAA requirements? Have they gone beyond state and federal mandates in the notification process? Do employers develop their own systems for meeting their obligations? Are there differences between large and small employers? For example, do large employers delegate their responsibilities to third party administrators while small employers provide notification themselves? Do large employers designate a HIPAA sign-up specialist within their employee benefits office?

Anecdotal evidence suggests that employers and insurers believe that the notification process imposes burdensome administrative costs. To evaluate this claim, the case study interviews should address the following issues: Is there sufficient documentation to support the charge that notification is burdensome? Have employers and insurers implemented new systems to track HIPAA eligibles? To what extent have these groups experimented with less burdensome alternatives? Have these groups formally requested changes in the notification process?

In addition to informing HCFA(now known as CMS) about the notification process, we propose that the evaluator use this component of the case study as an opportunity to develop information to help in designing other data collection efforts to evaluate HIPAA. As we discuss in more detail under Question D below, we suggest that the evaluation include a survey of a sample of notifications to learn more about the number of HIPAA eligibles and who they are. The discussions surrounding the process of notification described here would be used in this later task to design the sampling process. That is, we use this task as the source of information about the parties responsible for notification—insurer, employer, TPA--and how this varies among different employer types. These responsible parties present sources of frames or lists from which to select a sample of notifications. Furthermore, the entity that tracks employer and dependent eligibility is a likely source of data about COBRA exhaustion rates—data which are also needed to help answer questions about the number of HIPAA eligibles. We suggest that the evaluator use this task to gather information about the tracking files and the kind of data that might be available to determine COBRA exhaustion rates. The use of these data is described under Question D below.

Among the key access questions about the HIPAA group reforms are :

• What are the changes in enrollment in employer-sponsored plans by employees in small groups?
• What are the changes in rates of offering coverage by small employers?
• What are the effects on the structure of the market?

The design to address these questions is shown in Table 1 and discussed above. It involves a comparison of changes over time in groups of states that have implemented reform to comply with HIPAA (groups A, B, and C) with states that had previously met the HIPAA standards (group D). The data sources are discussed next.

What are the changes in enrollment in employer-sponsored plans by employees in small groups? A contrast between the state groups in the change the proportion of employees in small groups covered by group insurance can be made using data from the March CPS in the pre-and post-HIPAA period. (We define small to be fewer than 100 workers because the March CPS employer size questions do not allow one to identify groups of fewer than 50). A difference-in-differences design, such as we propose, is quite demanding in sample size because it involves a four group comparison. Based on sample sizes in the 1997 March survey, we estimate that the evaluator would have better than 95 percent power to detect a difference of 4 percentage points in change between group B and D or group C and D. This is equivalent to a 10 percent change in enrollment in the states with new legislation compared to a constant rate in the control group, and power of about 50-60 percent to detect a 5 percent change in enrollment.

Unfortunately, group A in Table 1, which includes states that implemented the greatest change in their small group insurance regulations to conform to HIPAA, consists of a single, small state. Consequently, an evaluator cannot expect to obtain reliable change estimates for this state group. Matters are somewhat better if successive March surveys in the pre- and post-HIPAA period are pooled to make estimates for this state. By pooling data for two years for both the before and after observations, one would have about 70 percent power to detect a 15 percent change in participation in group insurance among those in small groups in group A relative to a constant rate in group D (or about a 6 percentage point difference in the rate of change between the state groups).

HIPAA was intended to eliminate some of the most serious abuses in the market. Thus, as well as the effect on overall participation in group plans, policymakers will be interested in the effects on groups that previously had difficulty in acquiring group coverage. Certain industries, for example, are known to be singled out as poor risks by insurers and the CPS can be used to make a pre-post comparison of enrollment among those in small groups in at-risk industries. However, when subsetting the sample, pooling of years in both the pre- and post-period may be necessary for reliable results. Focusing on employees in small groups in industries that are often redlined, one would have less than 50 percent power to detect a 15 percent change in participation among these employees in state groups B or C relative to a constant rate in the control states using a single March CPS. By pooling over two years for the pre and post period, however, power can be improved to about 70 percent.

What are the changes in rates of offering coverage by small employers? The CPS does not collect information about whether employees are offered an employer sponsored-plan if they are not enrolled in one. Therefore, answering this question requires an alternative data source. Studying employer behavior is best accomplished through information about individual employers. The MEPS-IC provides information about a large sample of employers, and permits state level analyses in most states (see Part III for more details). Lags in data availability place this data source outside of the time frame of the scope of the evaluation that we have defined. Information about 1999 would not be expected to be available for analysis until the middle of 2001. However, we include it here because it is the best source for studying employer response to HIPAA. Based on the same design for the 1996 survey, the MEPS-IC would provide 80 percent power to detect a 4 percentage point difference in change over time between state group B and the control group D, and a difference of 3 percentage points between group C and group D.

What are the effects on the structure of the market? As we discussed above, Deborah Chollet and her colleagues have developed methods for synthesizing and integrating multiple data sources to produce measures of market structure. We do not believe the HCFA(now known as CMS) sponsored evaluation should duplicate those efforts. However, a simple measure of the count of the number of carriers in the market is a gross indicator of change that HCFA(now known as CMS) may wish to monitor. Regulator interviews conducted by IHPS as part of a Robert Wood Johnson Foundation study to measure insurance market regulations and characteristics that mediate their effect, indicated that most state insurance departments are able to provide this simple measure. This data might be collected during the case studies, or the national survey of regulators discussed under Question A above.

We have identified three important sub-components of this question that we suggest HCFA(now known as CMS) incorporate in its evaluation design:

• How many HIPAA eligible individuals are there and who are they?
• How many HIPAA eligibles benefit from the reforms and what are the access effects?
• What are the implementation issues in adopting risk pools as the alternative mechanism?

How many HIPAA eligible individuals are there. Who are they? Estimates of the number of persons who are HIPAA-eligible differ widely. For example, HIAA estimated potentially 3 million additional insured lives in the individual market annually, whereas Klerman put this estimate at only 0.6 million. The estimates differ because of different assumptions about the rate of job turnover, and different assumptions about the percent who are eligible among job leavers. The latter depends on length of prior coverage; eligibility, take-up, and exhaustion of COBRA coverage or continuation policies required by state law; eligibility for other employment based health insurance; and eligibility for public insurance. Accurately estimating these transitions is essential for knowing how many HIPAA eligibles there are. But estimates require panel data to find job changers and then observe their destinations and choices. The only extant data base to do this is the SIPP—a 24-36 month panel survey of a nationally representative sample of the U.S. population.

We considered recommending use of SIPP data to try to model the number of HIPAA eligibles, but rejected this idea for several reasons. First, there are a number of shortcomings of the SIPP data for this purpose. The survey doesn’t ask about COBRA coverage directly, it has to be inferred. The panels aren’t long enough to observe exhaustion of COBRA coverage for most individuals, so assumptions or modeling of this is required. One needs retrospective information on prior health insurance coverage to identify whether there were 18 months of continuous coverage prior to leaving the group plan, which is not available in SIPP. Second, Klerman used the SIPP data in his modeling of the number of HIPAA eligibles, and so there aren’t likely to be significant gains from additional effort using these data.

Instead, we suggest new and better data might be obtained by drawing a sample from notifications of creditable coverage, and interviewing persons selected 2 to 3 months later to measure initial transitions and eligibility for other insurance. This would not be a nationally representative sample. However, by selecting notifications from employers in different size groups and different industries, one could represent experiences of different types of employees. National weights could be estimated from another source (such as the SIPP or CPS) to apply to the sampled experiences.

As indicated above, we suggest that the case study of the notification process would be important to help identify the source of the sampling frame. This, we expect, will vary for different types of employers. For example, large employers (or their agents) may have developed systems to do their own tracking and notification whereas small employers may rely on the insurer to do so.

A survey of recent job leavers, drawn from the notifications, would provide important information about transitions, such as the number who go to another insured job, the number who are eligible for another family member’s group insurance, the number who participate in Medicaid, the number who take up COBRA coverage and the number who decline it. This survey however would not inform the evaluation about another key transition, namely the share of those who elect COBRA coverage who exhaust the benefit and thereby become HIPAA eligible. We expect, however, that the same systems that track employees and dependents creditable coverage would be able to provide information about COBRA exhaustion rates. That is, the sources used to sample notifications must have group coverage enrollment files and could provide exhaustion rates for their covered populations. (At least this possibility should be explored). While not representative, again the sources would provide information for a variety of groups of different size and from different industries.

How many HIPAA eligibles benefit from the reforms and what are the access effects? Answering this question is difficult because there aren’t good strategies for identifying and studying those who are HIPAA eligible and, even once the are identified, there is not a baseline against which to measure change. Therefore, we offer several indirect indicators.

First, the proposed survey of notifications just described would inform about the number of persons who are HIPAA-eligible at the time of the survey who have enrolled in individual insurance plans. Absent baseline enrollment rates among persons who satisfy HIPAA eligibility requirements, the new measure might be compared to coverage rates in individual plans among the population who do not have group or public insurance. A second indirect indicator is enrollment by HIPAA eligibles in risk pools in states that have adopted this as the alternative arrangement. Three out of four states queried that have adopted risk pools as the alternative mechanism indicated that their enrollment systems distinguish HIPAA eligibles from other enrollees and would permit this measurement. This suggests that there may be promise in this approach. The National Association of State Comprehensive Health Insurance Plans (NASCHIP) is currently surveying its members on these issues in preparation for a late September 1998 meeting. The survey instrument includes questions about the number of HIPAA applicants to the risk pool, the number of HIPAA eligible individuals who have enrolled in the risk pool, and the number of HIPAA applicants who have failed to qualify. Therefore, a centralized source of information should be available to HCFA(now known as CMS)’s evaluator. Neither of these measures directly answers the question posed because we do not have a baseline measure to indicate what would have happened to these individuals absent HIPAA; but each indicator provides some measure of the scope of HIPAA.

Another approach is to look at general access effects; that is, to measure changes in insurance coverage in a defined population—such as those without group or public coverage. This measure incorporates both the rate of HIPAA eligibility among the population and access effects for the HIPAA eligible population. Thus, it understates the access effects on the target, HIPAA eligible population. This component of the evaluation would use the design shown in Table 2 and data from the CPS. Based on an analysis of sample sizes in the March 1997 CPS sample, the evaluator would have greater than 80 percent power to detect an increase of about 3 percentage points pre- and post- HIPAA in coverage under individual insurance policies among persons without employer or public insurance in state groups A, B, and C shown in Table 2. This is an increase in coverage of about 15 percent, given that individual coverage in this population is about 18 percent. To detect a change of 2 percentage points (a 10 percent change), one would have about 60 percent power for group A and 75 percent power for groups B and C. Since group D consists of only 2 small states, one pre-and post-HIPAA survey do not produce reliable estimates. By pooling two years in the pre- and post-HIPAA period, we estimate that an evaluator would have about 60 percent power to detect an increase in insurance coverage of about 3 percentage points.

Contrasting the different implementation models (that is comparing change across two of the groups shown in Table 2), is somewhat more demanding on sample size. We estimate that a single pre-and post measurement using the CPS would allow an evaluator to detect a 3 percentage point difference in the rate of change between any pair of group A, B, or C.

Policymakers will also be interested in whether HIPAA has improved access for vulnerable population groups. Therefore, we investigated whether the CPS would provide sufficient sample to measure change in coverage among persons without employer group or public insurance who are in poor or fair health. Because having poor or fair health is a relatively infrequent event, changes in coverage over time would have to be quite substantial to detect them with a single pre- and post-observation from the CPS. For groups B and C, we estimate that the evaluator would have 80 percent power to detect an increase of about 7 percentage points over time using a single CPS for the pre- and post-period; for group A, a change of about 8 percentage points could be detected with 80 percent power. Again, pooling data for multiple years would improve the power.

What are the implementation issues in adopting risk pools as the alternative mechanism? This task would focus on issues in implementing changes to risk pools needed to provide access using a state high-risk pool as the alternative mechanism. It would be accomplished through two mechanisms. First, updating the individual market database developed by IHPS would provide monitoring information on regulatory changes made in state high risk pools to qualify as an alternative mechanism. Second, we suggest that risk pool implementation be part of the case study protocol. The following topics would be covered: What changes to existing risk pools have been made by states to attract HIPAA eligibles? Do states subsidize the costs for low-income HIPAA eligibles? How has HIPAA affected rate-setting in the risk-pool arrangements? What types of products are offered through the high risk pool and how has choice and type of product changed? How do states track and measure HIPAA eligibles’ participation rates in expanded risk pools? Have states developed new information products to inform HIPAA eligibles about the risk pool? What is the application process; how easy is it to apply; has a process been established to enroll individuals within the 63 day period? In selecting sites, the evaluator would want to include states that have modified existing risk pools as an alternative mechanism as well as one or both states that have developed new risk pools for the HIPAA eligible population. The comparative study of these different cases would provide information about differences between new and existing risk pools in the number of HIPAA eligibles who are attracted and retained, the different rate-setting experiences, and other differences in implementation. Information being collected by NASCHIP, discussed above, could be used as part of the site-selection process.