Baseline Information for Evaluating the Implementation of the Health Insurance Portability and Accountability Act of 1996: Final Report. Question B. How does the notification process work and what problems exist?


For HIPAA to achieve its goals, all involved parties must receive adequate notification of its provisions. The legislation requires that employers provide certification to employees and dependents as they leave a group plan. However, there is little known about how the notification process works in practice. This task, which would be a part of the case study, would interview state officials, employers, employee representatives, business groups (including business health purchasing coalitions), insurers, and HIPAA eligibles to better understand the notification process. It will be important to identify the specific roles played by the state, employers, and insurers and to identify problems in the notification process.

The case study protocol would include the following types of question to address issues related to the notification process. When are individuals notified? How and by whom are they are notified? What resources are made available to advise them and answer questions? Does the state specify the terms of the notification, including the content and timing of the notice? How does the state monitor the notification process? In particular, does the state monitor timeliness of the application process? What sanctions are imposed for not adhering to established notification processes and timeliness? For example, does the state mandate that the notice include a state official’s phone number to contact in case of delay? Does the state impose any reporting requirements on employers or insurers? Has the state analyzed those data? Are the costs of the notification process measured, and have there been attempts to reduce the costs? Do the participants maintain data on the volume of notifications?

Employers play an important role in the notification process. The case study protocol would include the following questions to understand this role: What steps have employers taken to meet HIPAA requirements? Have they gone beyond state and federal mandates in the notification process? Do employers develop their own systems for meeting their obligations? Are there differences between large and small employers? For example, do large employers delegate their responsibilities to third party administrators while small employers provide notification themselves? Do large employers designate a HIPAA sign-up specialist within their employee benefits office?

Anecdotal evidence suggests that employers and insurers believe that the notification process imposes burdensome administrative costs. To evaluate this claim, the case study interviews should address the following issues: Is there sufficient documentation to support the charge that notification is burdensome? Have employers and insurers implemented new systems to track HIPAA eligibles? To what extent have these groups experimented with less burdensome alternatives? Have these groups formally requested changes in the notification process?

In addition to informing HCFA(now known as CMS) about the notification process, we propose that the evaluator use this component of the case study as an opportunity to develop information to help in designing other data collection efforts to evaluate HIPAA. As we discuss in more detail under Question D below, we suggest that the evaluation include a survey of a sample of notifications to learn more about the number of HIPAA eligibles and who they are. The discussions surrounding the process of notification described here would be used in this later task to design the sampling process. That is, we use this task as the source of information about the parties responsible for notification—insurer, employer, TPA--and how this varies among different employer types. These responsible parties present sources of frames or lists from which to select a sample of notifications. Furthermore, the entity that tracks employer and dependent eligibility is a likely source of data about COBRA exhaustion rates—data which are also needed to help answer questions about the number of HIPAA eligibles. We suggest that the evaluator use this task to gather information about the tracking files and the kind of data that might be available to determine COBRA exhaustion rates. The use of these data is described under Question D below.