Current Developments Under ACA (Affordable Care Act) and HIPAA/HITECH Frances King Quick Shareholder...

Current Developments Under ACA

(Affordable Care Act) and HIPAA/HITECH

Frances King QuickShareholder

Maynard Cooper & Gale P.C.

April 10, 2013

2

Upcoming Compliance Requirements

ACA

Shared Responsibility (“Play or Pay”)

Waiting Periods

PCORI Fees

Increased Medicare Tax on High Earners

Health Flexible Spending Accounts

Automatic Enrollment

3

Upcoming Compliance Requirements

HIPAA/HITECH

New Business Associate Agreements

Security Breach

Updated Notice of Privacy Practices

Individual Right to Access Electronic PHI

Marketing Communications

Sale of PHI

GINA

4


In 2014, “large employers” must offer full-time employees “minimum essential coverage” that is “affordable” and provides “minimum value”

“Large employer”: 1. employed on average 50+ full-time employees on business days during

prior year, including full-time equivalents for part-time employees2. include members of the employer’s controlled group and any affiliated

service group

Transition period for employees on the cusp of 50 full-time employees allows an employer to use any consecutive six month period during 2013 to determine whether it employed at least 50 full-time employees; round down, so that 49.9 = 49, not 50

5


Who is a full-time employee?– Works 30+ hours/week (130 + hours/month) on average

Optional safe harbors for categorizing employees – On-going employees– New employees reasonably expected to work full-time– New employees: variable and seasonal employees

Dependent coverage is generally required after 2014 (transitional relief in 2013)

6


For new employees reasonably expected to work full-time, offer coverage to the employee within the first three full months of employment.

7


Safe harbor stability period for ongoing employees:

– Uses Standard Measurement Period to gauge whether employee averages at least 30 hours/week during employer-determined period of 3-12 consecutive months, treat as a full-time employee

– Stability Period – period of at least 6 consecutive months (and not shorter than the Standard Measurement Period) during which employee must be treated as full-time employee or not

– If determined not to be a full-time employee, the Stability Period (when you can hold the employee out of the plan) cannot be shorter than the Measurement Period

– Administrative Period – up to 90-day period between the Standard Measurement Period and the Stability Period to enable employer to identify, notify, and enroll employees

– 2013 Transition relief permits a transition Measurement Period that is no less than 6 months and no more than 12 months and which begins by July 1, 2013

8


Example of 12-month Standard Measurement Period: Only full-time employees are eligible to participate in the employer’s group health plan

– Employer elects to use:• 12-month Standard Measurement Period: Oct. 15 – Oct. 14• 2 month Administrative Period: Oct. 15 – Dec. 14• 12-month Stability Period: Jan.1 – Dec.31

On-going employees Susie and Mark have been employed for several years and both worked at least 30 hours/week during all prior years. Susie worked at least 30 hours/week during the Standard Measurement Period beginning Oct. 15, 2015 and ending Oct. 14, 2016. Mark was employed on average 30 hours per week for all Standard Measurement Periods before Oct. 15, 2015 – Oct. 14, 2016, when he did not average 30 hours of service/week. Because Susie was employed for the entire Standard Measurement Period beginning Oct. 15, 2015 and ending Oct. 14, 2016, Susie is an ongoing employee for the Stability Period starting Jan. 1, 2017. Susie worked at least 30 hours/week during the period October 15, 2015 – October 14, 2016, so she is treated as a full-time employee during the Stability Period from January 1, 2017 – December 31, 2017 and is offered coverage that lasts during the entire Stability Period.

9


Mark, on the other hand, did not work full-time during the Standard Measurement Period from Oct. 15, 2015 - Oct. 14, 2016. Because Mark did not work full-time during this Standard Measurement Period, Mark is not required to be offered coverage for the Stability Period in 2017, including the Administrative Period from October 15, 2017 through Dec. 31, 2017. However, because Mark was employed on average 30 hours/week during the prior Standard Measure Period, Mark is offered coverage through the end of the 2016 Stability Period. Mark and Susie’s employer is compliant because the Measurement and Stability Periods are no longer than 12 months, the Stability Period for ongoing employees who work full-time during the Standard Measurement Period is not shorter than the Standard Measurement Period, the Stability Period for ongoing employees who do not work full-time during the Standard Measurement Period is no longer than the Standard Measurement Period (12 months), and the Administrative Period is no longer than 90 days.

10


Example of 2013 transitional rule: Only full-time employees are eligible to participate in the employer’s group health plan

– Employer elects to use in 2013:• 6-month Standard Measurement Period: April 15, 2013 – October 14, 2013• 2 month Administrative Period: October 15, 2013 – December 14, 2013• 12-month Stability Period: January 1, 2014 – December 31, 2014

– On-going employee Doris works at least 30 hours/week during the period April 15, 2013 – October 14, 2013, so she is treated as a full-time employee during the period January 1, 2014 – December 31, 2014, even if she fails to work 30 hours/week during the next Standard Measurement Period, The Administrative Period does not exceed 90 days. The Stability Period does not exceed the Standard Measurement Period.

11


Optional Safe Harbor for New Employees: Variable Hour and Seasonal Employees

– Variable Hour Employee – as of the start date, it cannot be determined if the employee is reasonably expected to work 30 hours/week on average

– Variable Hour Employee – until 2015, may take into account whether the variable hour employee will be terminated during the Initial Measurement Period

– Seasonal Employee – at least through 2014, can use a reasonable, good faith interpretation to determine who is a seasonal employee

• The Preamble to the proposed regulations requests comments on whether to impose a time limit of six months

12


Optional Safe Harbor for New Employees: Variable Hour Employees and Seasonable Employees:

– Initial Measurement Period is generally the same as the Measurement Period for ongoing employees except may use employee’s start date/first of month following start date as the beginning date

– Initial Measurement Period and Administrative Period cannot extend beyond the last day of the first calendar month beginning on or after the first anniversary of the employee’s start date (13 months plus a few)

– The Stability Period for variable hour and seasonable employees cannot be more than one month longer than the Initial Measurement Period, and cannot exceed the remainder of the Standard Measurement Period (plus any associated administrative period) in which the Initial Measurement Period ends.

– If the status of a variable-hour or seasonal employee has a material change to full-time status (e.g., promotion to full-time) during the Initial Measurement Period, the employee is treated as full-time as of the first day of the 4th month following the change in status, or, if earlier, and the employee averages 30 hours per week during the Initial Measurement Period, the first day of the first month following the end of the Initial Measurement Period (including any administrative period).

– Once a new employee has been employed for an Initial Measurement Period, analysis of whether the individual is a full-time employee switches to that used for ongoing employees

13


May have different measurement periods and stability periods for different categories of employees:

– Bargained/non-bargained– Different bargaining groups

– Salaried/hourly

– Employees in different states

14


First tier assessable payment: If fail to offer coverage to at least 95% of full-time employees annual penalty if at least 1 full-time employee is certified as having enrolled in an exchange and received a premium tax credit/cost-sharing reduction

Annual penalty = $2,000 x (number of full-time employees – 30)

15


Second tier assessable payment: If offer unaffordable coverage to any employee that does not provide minimum value annual penalty if at least 1 full-time employee is certified as having enrolled in an exchange and received a premium tax credit/cost-sharing reduction

Annual penalty = lesser of:

1. $3,000 x number of full-time employees who receive premium tax credits or cost-sharing assistance, or

2. $2,000 x (number of full-time employees – 30)

16


“Unaffordable coverage”:

– employee’s required contribution for self-only coverage > 9.5% of employee’s household income

• Form W-2 wages (Box 1) (pro rata, during coverage period)• Rate of pay (hourly rate times 130 hours per month or monthly salary)• Federal poverty level for singles

– the plan pays < 60% of covered expenses (i.e., health coverage that has an actuarial value < 60%)

• Blue Cross Blue Shield of Alabama PPO 320 Plan• Largest small group insurance product in Alabama

17


Non-calendar year plans have until first day of 2014 plan year

The assessable payments are excise taxes and are not deductible

Collectively bargained employees: If employer is required to contribute to a multi-employer plan for a full-time employee, and the multi-employer plan offers coverage to the employee (and dependents) which is affordable and provides minimum value, employer will not have an assessable payment with respect to the employee

18


Determine if the shared responsibility rules apply (whether the sponsor is a “large employer”)

Identify individuals who are full-time employees and consider using the safe harbors methods to categorize employees (establish a Measurement Period, Stability Period, and Administrative Period)

Develop administrative procedures and update systems to identify full-time employees on a regular basis

19

Waiting Periods

Waiting Period – period of time that must pass before coverage for an individual, who is otherwise eligible to enroll in a plan, can become effective

No group health plan (including a grandfathered plan) can impose a waiting period > 90 days

Applies to collectively bargained plans

90 calendar days; cannot delay until 91st day

20

Waiting Periods

90 day waiting period begins – when the employee is otherwise eligible for coverage (full-time, eligible job classification, etc.)

For newly hired variable hour employees, the plan may establish a measurement period of up to 12 months to determine whether the employee meets the plan’s eligibility requirements

Effective: Plan years on and after January 1, 2014

21

Patient-Centered Outcomes Research Institute (“PCORI”)

ACA imposed new fees on insurers and self-funded health plan sponsors under sections 4375 and 4376

The tax under section 4375 funds the Patient-Centered Outcomes Research Institute, or PCORI

PCORI fees will be used to research ways to deliver cost-effective health care using evidence-based medical research

Payable annually for 7 years, starting with the first plan year ending after October 1, 2012

22


The due date for plan years ending in October, November and December 2012 is July 31, 2013

Returns for plan years ending in January through September 2013 will be due July 31, 2014

PCORI fees are paid using Form 720

23


For the first year, the PCORI fee is $1 multiplied by the average number of lives covered under the plan during the year

COBRA beneficiaries are included in the count

Plans subject to the fee are:– medical plans

– prescription drug plans

– HRAs

– self-insured vision and dental plans, if provided without a separate election or premium charge

24


Applies to retiree only plans

Fee applies separately to each plan, except that employer may disregard lives that are covered solely under a fully insured plan

Multiple self-funded arrangements with the same plan year may be treated as a single self-funded health plan for purposes of calculating the fee

Employer must pay separate fee for HRA participation unless the employee is in both a self-funded health plan and the HRA

25


HRA that is integrated with an insured health plan is treated as a separate plan subject to the fee

Exempt plans– Stand-alone dental and vision benefits– Most health FSAs– On-site clinics– EAPs, wellness programs and disease management programs that

do not provide “significant benefits in the nature of medical care or treatment”

26


Insurer pays the fee and files the return for insured plans

Employer files the return and pays the fee for self-funded plans

Because the fee is treated as an excise tax, it is not chargeable to an employer’s self-funded plan

27


Sponsors of self-funded plans can determine the number of covered lives by:

– Actual count method (number of insured lives)

– Snapshot method (number of insured lives)

– Form 5500 method (sum of number of participants at beginning and end of year)

28

Increased Medicare Tax on High-Earners

Beginning in 2013, employers must withhold an additional 0.9% Medicare tax from employees who earn more than $200,000

Additional tax applies only to employee, not to the employer

Additional withholding (and tax) applies only to earnings in excess of the threshold amount

Employees are taxed based on threshold amounts of $200,000 for single taxpayers, $250,000 for married filing jointly; $125,000 for married filing separately

29


The amount that an employee can contribute to a health flexible spending account is limited to $2,500

Effective: Plan years beginning after December 31, 2012– Example: If a plan has a non-calendar year plan year, such as

November 1-October 31, the $2,500 limit first applies with the plan year beginning on November 1, 2013

Plans have until December 31, 2014 to be amended to reflect the new limit

30


Cafeteria plans may be amended to permit one mid-year salary reduction change related to health plans with fiscal plan years starting in 2013 without a change in status

The mid-year change applies where the applicable health plan has a fiscal plan year

The regulations permit a retroactive amendment to allow election changes if adopted by December 31, 2014

31

Automatic Enrollment

A large employer (> 200 full-time employees) must automatically enroll new full-time employees in its group health plan and must continue enrollment of current employees

Employees must be given notice and the opportunity to opt-out

Delayed effective date: Once regulations are issued by the DOL, which are expected after 2014

32

HIPAA/HITECH Act Regulations – Business Associate Agreements (“BAA”)

Business Associate Agreements (“BAAs”) may need to be updated to reflect new HITECH regulationsAdd security breach, subcontractor obligations, and security/privacy languageDeadlines for compliance:

– If BAA in place on Jan. 25, 2013, and not renewed before Sept. 23, 2013, transition period available until the earlier of renewal date of BAA or Sept. 23, 2014

– Otherwise, deadline is Sept. 23, 2013

33


New direct liability for business associate for HIPAA failures

– Impermissible uses and disclosures of PHI

– Failure to notify covered entity of a breach

– Failure to provide employee access to PHI

– Failure to comply with HIPAA security standards

Business associate still has contractual liability for breach of BAA

34


BAA design topics– Specify which party gives notice to individuals of breach– Who pays the cost of breach notifications– Right to review or approve breach notices– Agency issues

If plan retains control over services provided by business associate such that business associate is the plan’s agent, the plan can be liable for business associate’s acts

– Agency determined under federal common law– Based on authority to control the business associate– Contractual control or actual control– Labels will not defeat agency status

35

HIPAA/HITECH Act Regulations – Security Breach

A plan (covered entity) is required to notify affected individuals when a breach of unsecured PHI occurs

Must notify HHS immediately if breach involves 500 individuals or more, and keep a log of smaller breaches to file annually with HHS

Must notify media if breach involves more than 500 residents in a state

36


New standard for determining whether a breach occurs

– Old threshold was whether the impermissible disclosure or use of PHI would cause “significant risk” of harm to the individual

– New threshold is whether there is a “low probability” that the PHI has been compromised

– Factors to consider: Type of PHI, who received it and whether they used it or viewed it, acts taken to mitigate the risk

37


Business associate notifies plan (covered entity) of breach within 60 days of discovery, then plan notifies affected individuals within 60 daysIf business associate is agent of plan, the two 60-day periods are collapsed into one 60-day period for plan to notify individual of breach, starting with date the business associate discovered the breachResponsibility for risk assessment, breach determination and notification of individual rests with plan

38

HIPAA/HITECH Act Regulations – Notice of Privacy Practices (“NPP”)

Your plan’s Notice of Privacy Practices (“NPP”) must include notice of material changes

New material changes include:– Right to notice upon breach of unsecured PHI

– No use or disclosure of genetic information for underwriting purposes

– Right to opt out of fund-raising communications

39


Distribute the new NPP or a description of the material change within 60 days after material change

If the plan has a website, post the NPP or description of change on the website by Sept. 23, 2013

If the plan does not use a website, provide hard copy of revised NPP or a description of the change (including how to get a revised NPP) by November 22, 2013 (within 60 days after the change)

40


Health care providers must provide notice of individual’s right to restrict disclosures from the health care provider to your health plan when individual pays full cost of health care out-of-pocket

– Not required to be in plan’s NPP– Health FSA and HSA are considered out-of-pocket; provider can

disclose information if necessary to determine payment– HRA is not considered out-of-pocket because employer-funded

Review your current NPP to see if it complies with the final regulations

41

HIPAA/HITECH Act Regulations –Right to Access Electronic PHI

Covered individuals have a right to access PHI from the plan

The plan must allow access by inspection or copying, as requested by the individual, within 30 days (60 days where information is stored offsite)

May have one 30-day extension to provide access

Beginning Sept. 23, 2013, if the information is stored electronically, the individual has the right to request the PHI in electronic form

42

HIPAA/HITECH Act Regulations – Right to Access Electronic PHI

If individual requests PHI in specific form and format, such as Word or HTML, and the information is “readily producible,” must provide information in requested form as links or attachments

If information is not “readily producible” in the requested format, must provide in some electronic form (pdf)

43

HIPAA/HITECH Act Regulations – Right to Access Electronic PHI

Allowed to charge for labor and supplies in producing the electronic format

Individual may designate (in writing and signed) a third party to receive the electronic PHI (family member, provider, etc.)

44

HIPAA/HITECH Act Regulations / Marketing Communications

In general, authorization is required for plan to send communication that encourages individual to purchase or use a product or serviceIf the communication is for treatment or health care operations, authorization is required if the plan or a business associate receives financial remuneration for making the communicationThe authorization must state if the financial remuneration is paid by or on behalf of a third partyTypes of affected communications:

– Information about provider or the plan network– Discounts or coupons for health products or services– New or improved plan benefits

45

HIPAA/HITECH Act Regulations /Marketing Communications

Exceptions to authorization requirement, even if financial remuneration is paid

– Face-to-face communications– Promotional gift of nominal value– Promoting good health in general– Information about government programs such as Medicare and Medicaid

Exceptions to authorization requirement where financial remuneration is limited to reasonable cost of making the communication (no profit)

– Information about generic drugs– Refill reminders– Reminders to take medicine– For self-administered or biologic drugs, information about the drug delivery

system (e.g., insulin)

46

HIPAA/HITECH Act Regulations Sale of PHI

General prohibition on sale of PHI without authorization

The authorization must acknowledge that the plan or business associate will receive payment (remuneration) for disclosing PHI

Payment can be direct or indirect, and includes non-financial (in-kind) remuneration

47

HIPAA/HITECH Act RegulationsSale of PHI

Exceptions to general prohibition on sale of PHI without authorization include:

– For treatment and payment purposes under HIPAA – For any permitted disclosure, as long as the remuneration is

limited to the reasonable cost of preparing and sending the PHI– Cost of providing individuals with access to PHI or an accounting

of disclosures– Public health activities– Reasonable cost of research – For services rendered by a business associate, if the only

remuneration paid to the business associate is for the services– Disclosures otherwise required by law

48

HIPAA/HITECH Act Regulations Genetic Information Nondiscrimination Act (“GINA”)

The Genetic Information Nondiscrimination Act (“GINA”) prohibits group health plans from using genetic information for underwriting purposes

Underwriting includes providing any reward or benefit for providing genetic information

Genetic information includes family history

Genetic information is considered PHI

49

HIPAA/HITECH Act Regulations Genetic Information Nondiscrimination Act (“GINA”)

Applies to almost all group health plans (dental, vision, supplemental coverages)

Does not apply to long term care plans

If you are doing anything with family history, may trigger HIPAA privacy concerns

50

HIPAA/HITECH Act Regulations Privacy Unexpected Exposure

Unencrypted laptop computers

Portable electronic storage devices (USB hard drive)

Inability to determine whether electronic devices contain unencrypted PHI

Curious employees who have technical know-how

“Bring your own device”

51

Questions/Discussion

Current Developments Under ACA (Affordable Care Act) and HIPAA/HITECH Frances King Quick Shareholder...

Documents

Transcript of Current Developments Under ACA (Affordable Care Act) and HIPAA/HITECH Frances King Quick Shareholder...