Office of the Secretary, HHS.
This proposed rule would rescind the adopted standard unique health plan identifier (HPID) and the implementation specifications and requirements for its use and the other entity identifier (OEID) and implementation specifications for its use. The decision to propose to rescind the adopted standards was made following a careful assessment of industry input, as well as HHS's intention to explore options for a more effective standard unique health plan identifier in the future.
To be assured consideration, comments must be received at one of the addresses provided below, no later than 5 p.m. on February 19, 2019.
In commenting, please refer to file code CMS-0054-P. Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission.
Comments, including mass comment submissions, must be submitted in one of the following three ways (please choose only one of the ways listed):
1. Electronically. You may submit electronic comments on this regulation to http://www.regulations.gov. Follow the “Submit a comment” instructions.
2. By regular mail. You may mail written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-0054-P, P.O. Box 8013, Baltimore, MD 21244-8013.
Please allow sufficient time for mailed comments to be received before the close of the comment period.
3. By express or overnight mail. You may send written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-0054-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
For information on viewing public comments, see the beginning of the SUPPLEMENTARY INFORMATION section.
Start Further Info
FOR FURTHER INFORMATION CONTACT:
Lorraine Doo, (410) 786-6597, for all policy questions.
Rosali Topper, (410) 786-7260, for information about website content and frequently asked questions.
Gladys Wheeler, (410) 786-0273, for information about the Health Plan and Other Entity Enumeration System (HPOES).
Heinz Stokes-Murray, (410) 786-0383, and LaKisha Brown, (410) 786-1798, for general information.
End Further Info
Start Supplemental Information
Inspection of Public Comments: All comments received before the close of the comment period are available for viewing by the public, including any personally identifiable or confidential business information that is included in a comment. We post all comments received before the close of the comment period on the following website as soon as possible after they have been received: http://www.regulations.gov. Follow the search instructions on that website to view public comments.
A. Statutory and Regulatory History
Section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) added section 1173 to the Social Security Act (the Act) and required, among other things, that the Secretary of the Department of Health and Human Services (HHS or the Secretary) adopt a standard unique health plan identifier. The stated purpose of section 261 of HIPAA is to improve the effectiveness and efficiency of the health care system by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information and reducing the clerical burden on patients, health care providers, and health plans.
Section 1173(b)(1) of the Act specifies that, in adopting a standard unique identifier for health plans, the Secretary must take into account multiple uses for the identifier, and section 1173(b)(2) of the Act provides that, in adopting a standard health plan identifier, the purposes for which the identifier may be used must be specified. Congress renewed the requirement for the Secretary to adopt a standard unique health plan identifier in section 1104(c)(1) of the Patient Protection and Affordable Care Act (Pub. L. 111-148) ((as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) and collectively known as the Affordable Care Act) by requiring the Secretary to promulgate a final rule to establish a unique health plan identifier, as described in section 1173(b) of the Act and based on the input of the National Committee on Vital and Health Statistics (NCVHS).
To implement these statutory provisions, we adopted the HPID and OEID via a final rule published on September 5, 2012 (77 FR 54664) entitled Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for the International Classification of Diseases, 10th Edition (ICD-10-CM and ICD-10-PCS) Medical Data Code Sets (hereafter, referred to as the September 2012 final rule). The September 2012 final rule did the following:
- Adopted the HPID as the standard unique identifier for health plans.
- Defined the terms “Controlling health plan” (CHP) and “Subhealth plan” (SHP). The definitions of these two terms differentiate health plan Start Printed Page 65119entities that are required to obtain an HPID and those that are eligible, but not required, to obtain an HPID.
- Required all covered entities to use an HPID whenever a covered entity identifies a health plan in a covered transaction.
- Established requirements for CHPs and SHPs in order to enable health plans to obtain HPIDs to reflect different business arrangements so they can be identified appropriately in HIPAA transactions.
- Adopted a data element to serve as an “other entity identifier” (OEID).
++ The OEID functions as an identifier for entities that are not health plans, health care providers, or individuals (including, for example, third party administrators, transaction vendors, clearinghouses, and other payers), but that need to be identified in HIPAA transactions.
++ Did not require other entities to obtain an OEID, but permitted them to obtain and use one if they need to be identified in covered transactions.
For more detailed information regarding the statutory and regulatory history of the HPID and OEID or HIPAA legislation and regulations, see the April 17, 2012 proposed rule titled “Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for ICD-10-CM and ICD-10-PCS Medical Data Code Sets” (77 FR 22952 through 22954), (hereinafter referred to as the April 2012 proposed rule) and the September 5, 2012 final rule (77 FR 54666).
B. Adoption of the Health Plan Identifier (HPID) and Other Entity Identifier (OEID)
The NCVHS Subcommittee on Standards conducted a public hearing about the health plan identifier between July 19 and 21, 2010. Industry stakeholders—including representatives from health plans, health care provider organizations, health care clearinghouses, pharmacy industry representatives, standards developers, professional associations, representatives of Federal and State public programs, the Workgroup on Electronic Data Interchange (WEDI), the National Uniform Billing Committee (NUBC), the National Uniform Claim Committee (NUCC), and individuals with health plan identifier proposals—provided in-person and written testimony at the hearing. Stakeholder testimony focused on the use and need for an HPID to: Facilitate the appropriate routing of HIPAA transactions; reduce the cost of managing financial and administrative information; reduce dissatisfaction among health care providers and patients/members by improving communication with health plans and intermediaries; and provide information about health plan products and benefits. Stakeholders provided suggestions on the types of entities to be identified in HIPAA transactions, those that should be eligible to obtain an HPID, and the level of enumeration needed for each plan (for example, the legal entity, product, and benefit package). For a full discussion of the key topics and recommendations from that NCVHS hearing, see the April 2012 proposed rule (77 FR 22956 and 22957).
Following the hearing in 2010, the NCVHS submitted recommendations to the Secretary regarding the HPID, including definitions and types of entities that should be eligible for enumeration. In that recommendation letter, the NCVHS advised HHS to collaborate across federal agencies and to request stakeholder input on each topic through national associations, Designated Standards Maintenance Organizations (also known as standards development organizations or SDOs), and WEDI. The letter included observations relating to the levels of entity enumeration, and the format and content of the HPID. It also included recommendations for a publicly accessible directory database to support the enumeration system and process, as well as testing, use of the HPID on a health plan ID card, exempting its use in pharmacy transactions, and improving its use through operating rules. The full text of the letter can be found on the NCVHS website at: https://www.ncvhs.hhs.gov/wp-content/uploads/2014/05/100930lt1.pdf.
After the receipt of the NCVHS recommendations, and upon internal review, HHS published the April 2012 proposed rule incorporating several of the recommendations, including the following proposals:
- The adoption of a standard for a unique health plan identifier, the HPID, for use in HIPAA transactions.
++ The concepts of Controlling health plan and Subhealth plan.
++ The requirement that all controlling health plans, including self-funded health plans, obtain an HPID.
- The creation of a new data element—the OEID—for use by entities that do not meet the definition of a health plan, but that need to be identified in HIPAA transactions.
- Requirements and provisions for the implementation of the HPID and OEID.
The policy in the September 2012 final rule (77 FR 54666 and 54667) that requires health plans to enumerate with an HPID attempted to address the issues associated with health plans being identified in HIPAA transactions with different numbers originating from multiple sources and with multiple, proprietary formats. We believed that the various identifiers, assigned by different governmental or private organizations, were the identifiers health plans used to represent themselves in the HIPAA transactions. These identifiers included the National Association of Insurance Commissioners' (NAIC) Company code, the U.S. Department of Labor (DOL) and the Internal Revenue Service (IRS) Employer Identification Number (EIN) number, the Tax Identification Number (TIN), and proprietary numbers assigned by clearinghouses. We refer herein to the various identifiers that identify payers in the HIPAA transactions as Payer IDs. We did not define the term payer in the September 2012 final rule, but are aware that while the industry uses the terms payer and health plan interchangeably, they do not have the same meaning when referenced for purposes of a transaction.
We believed our policies specifying requirements for health plans to obtain identifiers, and use them in HIPAA transactions when appropriate, resolved, or took steps towards resolving, the issues of transaction routing, difficulty determining patient eligibility, and challenges identifying the health plan during claims processing. Specifically, we assumed the HPID framework, with the use of CHPs and SHPs, would address any industry confusion of having multiple ways to identify a health plan in a transaction. In the September 2012 final rule (77 FR 54667), we explained which entities would be required to obtain and use an HPID in HIPAA transactions in order to identify the plan in the appropriate loops and segments of the transactions. We stated that we believed the adoption of the HPID and the OEID would increase standardization within HIPAA transactions and provide a platform for other regulatory and industry initiatives, and that their adoption would allow for a higher level of automation for health care provider offices, particularly for provider processing of billing and insurance-related tasks, eligibility responses from health plans, and remittance advice that describes healthcare claim payments.
However, the importance of the distinction between the HPID and Payer IDs, and the industry's use of, and reliance on, Payer IDs in the HIPAA Start Printed Page 65120transactions, became evident after publication of the September 2012 final rule when health plans and insurers began to prepare for enumeration and realized the impact of having to accommodate the HPID rather than a Payer ID in the HIPAA transactions.
C. Events Leading to This Proposed Rule
After publication of the September 2012 final rule, we conducted outreach on the enumeration process (for example, we held webinars and attended industry conferences), published guidance on our website, and hosted an email box to receive industry inquiries. Through these initiatives, we received questions from health plans and providers about a number of issues, including: How many HPIDs health plans should obtain; why self-funded plans were being required to obtain an HPID; how the HPID and Payer IDs were to be used together in the HIPAA transactions; whether certain providers could or should obtain OEIDs (for example, atypical providers); which HPID would be used for enforcement actions; and whether or how the HPID database would be made accessible to industry for look-up and verification. In October 2012, organizations began to apply for HPIDs, and 11,000 numbers were assigned between that date and October 2014. As the enumeration process began, professional associations for both health plans and health care providers submitted feedback that stated there was no need for the HPID in HIPAA transactions, and that the policy requirements were problematic, costly, and burdensome.
The NCVHS Standards Subcommittee held a hearing on February 19, 2014, and sent a letter to the Secretary on May 15, 2014, summarizing participant comments and providing recommendations (https://www.ncvhs.hhs.gov/wp-content/uploads/2014/05/140515lt2.pdf).
The NCVHS wrote:
[T]estifiers indicated that there is confusion on how the HPID and OEID should be used. Many health plans face challenges with respect to the definitions of controlling health plan (CHP) and sub-health plan (SHP); the use of HPID for group health plans that do not conduct HIPAA standard transactions (the self-insured plans); and the cost to health plans, clearinghouses and providers because software has to be modified to account for the HPID. Testifiers questioned the impact on health plans, third-party payers (TPAs) and Administrative Services Only (ASO) self-insured groups and the degree of granularity required to enumerate. Others expressed concerns that the HPID database would not be accessible and without public access to the HPID database, the identifier is of no value to trading partners; validation cannot be performed; a crosswalk would not be possible among Medicaid proprietary plans, and the data collection did not include reference to the Bank Identification Number/Processor Control Number (BIN/PCN) used in pharmacy claims processing. Concern was also expressed that self-insured health plans are not aware of the requirements that apply to them.
On June 10, 2014, the NCVHS held another hearing and sent a follow-up letter to the Secretary on September 23, 2014 titled “Letter to the Secretary, Findings from the June 2014 NCVHS Hearing on Coordination of Benefits, Health Plan Identifier (HPID), and ICD-10 Delay,” in which it recommended that HHS specify that the HPID not be used in HIPAA transactions, that the HPID's use be better clarified, and that the HPID not replace the existing Payer IDs. See https://www.ncvhs.hhs.gov/wp-content/uploads/2014/10/140923lt5.pdf. Specifically, the NCVHS highlighted the following items from the June 2014 stakeholder testimony:
- Lack of clear business need and purpose for using HPID and OEID in health care administrative transactions.
- Confusion about how the HPID and OEID would be used in administrative transactions, including strong concerns that HPID might replace current Payer IDs which were widely in use between covered entities.
- Challenges faced by health plans with respect to the definitions of CHPs and SHPs.
- Use of the HPID for group health plans that do not conduct HIPAA transactions.
- Cost to health plans, clearinghouses, and providers for modifying software to account for the HPID.
In response to the NCVHS's 2014 recommendations, HHS took two administrative actions.
First, on October 31, 2014, through a statement of enforcement discretion,
HHS delayed enforcement of the regulations pertaining to HPID enumeration and use of the HPID in the HIPAA transactions in order to review the NCVHS' recommendations and to consider any appropriate next steps. The enforcement discretion, which remains in effect, means that HHS will not impose penalties if it determines a covered entity is out of compliance with the HPID requirements of the September 2012 final rule.
The effect of the enforcement discretion has been two-fold: (1) In general, it appears that industry has taken little action to implement the requirements of the September 2012 final rule; and (2) we have not published any further educational, outreach, or guidance materials on the industry's use of the HPID and OEID.
Second, in the May 29, 2015 Federal Register (80 FR 30646), we published a request for information (RFI) to solicit additional public input to determine whether HPID policies were still warranted. Through the RFI, we sought public comment on three (3) topics: (1) The HPID enumeration structure, including the use of the CHP/SHP and OEID concepts; (2) use of the HPID in HIPAA transactions in conjunction with the Payer ID; and (3) whether changes to the nation's health care system since the issuance of the September 2012 final rule had altered perspectives about the need for the HPID.
We received 53 timely comments in response to the RFI, with the overwhelming majority of submissions recommending that the HPID not be required in the HIPAA transactions, either alone or in combination with the Payer IDs. A small minority of commenters continued to support the concept of a standard health plan identifier, though not the specific HPID adopted by HHS, believing it may have some value for enforcement or HIPAA health plan certification of compliance. Although many commenters acknowledged that they had supported the creation of a standard health plan identifier in the proposed rule and understood its policy intent, in response to the RFI they warned that inclusion of the HPID in the transactions would create significant administrative problems without corresponding benefit due, at least in part, to a confusing framework.
A commenter stated that, regardless of the enumeration schema, converting from the Payer IDs to the HPID would be costly for all stakeholders because of the potential for misrouting transactions and disrupting claims processing, while multiple commenters indicated that the health care community had become adept at using the Payer IDs, and that those, along with the operating rules, were enabling benefits and cost savings of the HIPAA transactions.
In response to the third topic in the RFI, “whether the changes in health care had altered perspectives about the need for an HPID,” some commenters stated that too much time had elapsed since industry had been using the Payer Start Printed Page 65121IDs in transactions, and the industry had established appropriate routing technologies. These commenters said that the requirement for a standard unique health plan identifier no longer represented best practices for how information was exchanged between health plans and health care providers. A number of commenters stated that the health care system was continuing to undergo innovation and experimentation with care delivery and payment models. These commenters noted that the market required flexibility to enable continued innovation to mature, and suggested that HHS allow payers, clearinghouses, and third party administrators more time to adapt to the evolving health care environment before implementing a unique health plan identifier. Other commenters stated that if there were other proposed purposes or future use cases for a standard health plan identifier, a lawful and compelling business case for its intended use should be made and sufficient opportunity for comment be available in the Federal Register. We did not receive specific recommendations or alternative proposals for consideration.
In summary, from the NCVHS hearings as well as comments on the May 2015 RFI, several common themes emerged. First, the industry already has satisfactorily functioning mechanisms to route claims and other HIPAA transactions using the existing Payer IDs. Second, it would likely be a costly, complicated, and burdensome disruption for the industry to have to implement the HPID because it would require mapping existing Payer IDs to the new HPIDs, which would likely result in the misrouting of claims and other transactions. Third, the HPID framework does not provide added value for other anticipated purposes, such as including certain information in the transaction, including the name of the health plan name, the level of benefits or coverage description (medical, dental, vision, pharmacy), or co-payment and co-insurance responsibility for certain services (for example, certain optional and required coverage types).
The Affordable Care Act amended HIPAA to require the Secretary to adopt a set of operating rules for each of the HIPAA transactions with the intent of creating as much uniformity in the implementation of the HIPAA standards as possible. Operating rules are business rules for the exchange of electronic information, and are not already defined by a standard. HHS named the Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CORE) the authoring entity for the operating rules, which labels its operating rules in Phases as they are developed and approved. To date, HHS has adopted operating rules for three HIPAA transactions—eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) and remittance advice. On July 8, 2011, HHS adopted the CAQH CORE Phase I and Phase II operating rules for the eligibility for a health plan and health care claim status transactions (77 FR 40458), and on August 10, 2012, HHS adopted the CAQH CORE Phase III operating rules for the health care electronic funds transfers (EFT) and remittance advice transaction (77 FR 48008). For additional information about the operating rules and the designation of the operating rules authoring entity, we refer the reader to the July 8, 2011 interim final rule (77 FR 40458) and the August 10, 2012 interim final rule (77 FR 48008).
Specific to the HPID and challenges for its use with eligibility for a health plan and claim status transactions, the operating rules require that coverage description data elements be provided by a health plan in HIPAA transactions (CORE Phase I Operating Rule 154 and CORE Phase II Operating Rule 260: Eligibility & Benefits (270/271) Data Content Rule version 2.1.0 March 2011).
For example, health plans must support an explicit request for content related to 12 service types specified in the Phase I operating rules in the eligibility transaction, and the Phase II operating rule provides a list of 51 service types for which health plans must provide some type of information to providers in both the eligibility and claim status responses. Providers need information about health plan coverage type along with a Payer ID to successfully determine: If an individual is eligible for services, what coverage can be provided, the co-payments that are due, and where to submit the final claim for processing. The operating rules combined with Payer IDs enable improved communication between health plans and providers. The HPID as adopted does not enable information about benefits, coverage, or payment, in part because it is only to be used for routing, and in part because it does not contain any “intelligence” about the health plan with which the coverage for the patient is associated.
On May 3, 2017, the NCVHS held another hearing on the HPID to solicit industry input on the business needs for the HPID, its use in HIPAA transactions, and to confirm whether the testimony from the 2014 and 2015 NCVHS hearings was still valid. The questions for testifiers were as follows:
- What identifiers are used today and for what purpose?
- What business needs do you have that are not adequately met with the current scheme?
- What benefits do you see that the current HPID model provides? Does it meet those needs?
- What challenges do you see with the current HPID model?
- What recommendations do you have going forward regarding health plan identifiers and the HPID final rule?
At the May 3, 2017 NCVHS hearing, testimony was consistent with that from the February and June 2014 hearings and the May 2015 RFI. Health plans, providers, self-funded/Employee Retirement Income Security Act (ERISA) plans, clearinghouses, and vendors confirmed that the HPID did not satisfy a business need, did not provide other value, and its implementation would be costly and disruptive.
Furthermore, industry indicated that it wished to continue using the Payer IDs instead of the HPID, and health plans and providers testified consistently that, even if required to use the HPID, they would not give up use of the Payer IDs. Importantly, as had been indicated in 2014 and 2015, multiple testifiers in 2017 reiterated that the health plan is the HIPAA covered entity that establishes the payment policies, but the payer is the entity that needs to be identified in the transactions. Organizations had evaluated the HPID policy and determined they could not use the HPID. Testifiers stated that it would be too confusing to make the change to using the HPID because it is not clear which of the components—CHP, SHP or OEID—should be used in HIPAA transactions in place of the Payer IDs. One testifier noted that if none of those entities is the payer, the transaction routing process will be disrupted. Furthermore, testifiers were concerned about the cost to map Payer IDs to HPIDs without knowing how many HPIDs an entity has obtained, especially across the many systems and organizations involved. Stakeholders informed HHS that mapping would be a complex endeavor that would impact all parties. Mapping could be made more difficult by the potential for other changes in the edits and rules that would be required for reporting, provider enrollment, payer distribution, rerouting, and other related tasks.Start Printed Page 65122
The May 2017 hearing provided additional confirmation of what HHS was previously told by health plan and provider testifiers in hearings. Moreover, those same testifiers were beginning to experience a positive return on investment due to use of the CAQH CORE operating rules adopted in July 2011. Both health plan and provider testifiers explained that operating rules supporting the eligibility and health care claim status transactions drive down the cost of using the HIPAA transactions—communication is faster, the contents of the transactions are more predictable, and the information more reliable. Based on industry testimony, use of Payer IDs in these transactions also appears to facilitate the provision of needed health plan information.
Overall, there was near unanimity from testifiers that HHS should rescind the HPID and OEID. The oral and written testimony can be found on the NCVHS website at https://www.ncvhs.hhs.gov/meeting-calendar/agenda-of-the-may-3-2017-ncvhs-subcommittee-on-standards-hearing-on-health-plan-identifier-hpid/.
In a June 21, 2017 letter to the Secretary,
the NCVHS wrote that testifiers were unanimous regarding their preferred use of Payer IDs versus the HPID. The net of all the testimony was that while Payer IDs do not identify the health plan, they identify the payers, which is necessary to meet transaction routing needs. The NCVHS wrote that they heard from testifiers that the HPID interferes with the established processes and provides no value to industry. The NCVHS made three recommendations to HHS in this letter:
- HHS should rescind its September 2012 final rule which required health plans to obtain and use the HPID.
- HHS should communicate its intent to rescind the HPID final rule to all affected industry stakeholders as soon as a decision is made. HHS should provide the applicable guidance on the effect a rescission may have on all parties involved.
- HHS should continue with the 2014 HPID enforcement discretion until publication of a final regulation rescinding the HPID final rule.
For a full discussion of the key topics and recommendations from all of the NCVHS hearings from 2010 through 2017, we refer readers to the text of the documents on the NCVHS website: https://www.ncvhs.hhs.gov/subcommittees-work-groups/subcommittee-on-standards/.
Industry has provided substantial input to the NCVHS and HHS regarding the use of identifiers, the terminology surrounding identifiers, and routing of standard transactions. We acknowledge that we envisioned the HPID as being foundational to other industry uses in the future, though we did not specifically describe these uses in the September 2012 final rule. Given the uncertainty and confusion about the HPID framework and enumeration, we believe it would be useful to reassess any future standard health plan identifier with additional input from industry. Several testifiers stated that any use case for a health plan identifier should be clearly defined in advance, and that ample opportunity for public comment be made available, and we agree that public input has often been useful for assessing complex concepts. We will consider options for industry engagement in the future.
The OEID was intended to identify entities that are not health plans, health care providers, or individuals. As specified in 45 CFR 162.514, these other entities are not required to obtain an OEID, but may obtain one if they need to be identified in covered transactions. During the outreach period in 2013, covered entities submitted questions about the enumeration, purpose, and use of the OEID. Commenters asked about its value in their responses to the 2015 RFI. In general, the industry continued to seek greater specificity and definitive information about uses for the OEID.
To date, a total of 99 OEIDs have been assigned. None of the industry surveys conducted to date have collected data on the use of the OEID in HIPAA transactions, and none of the testifiers or commenters requested that it be retained for future use.
III. Provisions of the Proposed Regulations
As noted previously, the HPID and OEID were adopted in the September 2012 final rule under the statutory authority of HIPAA and the Affordable Care Act. However, as we describe in this section of this proposed rule, we now believe, based on recommendations from the NCVHS and overwhelming and persistent industry input, the HPID and OEID do not, and cannot, serve the purpose for which they were adopted. Therefore, this rule proposes to remove Subpart E—Standard Unique Health Identifier for Health Plans at 45 CFR 162, as well as the definitions of “Controlling health plan” (CHP) and “Subhealth plan” (SHP) at 45 CFR 162.103.
Two primary areas of industry concern emerged from the May 2015 RFI. These concerns were emphatically repeated in all the post-final rule industry feedback, through direct inquiries to HHS and NCVHS hearings testimony and recommendations. Industry has developed best practices for use of Payer IDs for purposes of conducting the HIPAA transactions. The adopted HPID does not have a place in these transactions, and from industry's perspective, does not facilitate administrative simplification.
We now better understand the significance of providers being able to identify the payer in a HIPAA transaction. The provider needs to know which organization should receive an inquiry about a patient's eligibility for services, or which entity will receive the health care claim transactions. The organization that needs to be identified in transactions is the payer, rather than the health plan. Industry has clearly communicated that they are successfully routing transactions using the various Payer IDs, and cannot use the HPID. Payers often contract with many health plans or own a network of health plans which operate in different geographic regions. In their letters and testimony, payers maintained that the process of determining how to designate and enumerate the health plans as CHPs or SHPs was a significant challenge. Many organizations were concerned about being able to accurately conduct what they deemed a complicated analysis to determine corporate entity ownership and organizational relationships, and make the right decisions about enumeration. According to health care providers, their information exchange systems are programmed to identify the payers in the transactions, not the individual health plan. Once enumeration was complete, neither the payers nor the providers were confident that the mapping would be accurate. Regardless of the enumeration, according to testimony and comments, requiring covered entities to use the HPID in HIPAA transactions would not have addressed any remaining routing challenges, provided information about the services covered under a health plan's benefit package, or allowed for a higher level of automation for health care provider offices, particularly for provider processing of billing and insurance-related tasks, eligibility responses from health plans, and remittance advice that describes health care claim payments.
Likewise, when we adopted the OEID, we believed that because entities other than health plans were identified in Start Printed Page 65123HIPAA transactions in a similar manner as health plans, establishing the OEID would increase efficiency. The few comments we received on the OEID in any forum have led us to believe that the identifier is not useful or necessary, and that the fields where the OEID would go in the HIPAA transactions can be successfully populated using other numbers such as the TIN, EIN, or North American Industry Classification System code from the NAIC. Similar to the HPID, we now understand that providing another data element for other entities does not add value for industry's business processes.
Second, it would be a costly, complicated, and burdensome disruption for the industry to have to implement the HPID because it would require mapping existing Payer IDs to HPIDs. This process was perceived as complicated, with the potential for wide-scale misrouting of claims and other transactions.
We also believe it is appropriate to remove the definitions of controlling health plan (CHP) and subhealth plan (SHP) at 45 CFR 162.103. Those terms were established in the September 2012 final rule in association with the HPID requirements. Because the two terms are integrally related to the HPID requirements, we believe they would have no application if we finalize our proposal to rescind the HPID.
Finally, should we finalize this proposal to rescind the HPID and OEID, rather than having each entity deactivate their HPIDs and OEIDs, we are proposing that we would deactivate each HPID and OEID record in the Health Plan and Other Entity Enumeration System (HPOES) on behalf of each enumerated entity, and notify the manager of record at the current email address in the system. We propose that HHS would store the numbers for 7 years in accordance with federal record keeping requirements and that HHS would not regulate any actions entities may take with their existing HPID identifiers or their use. We propose that entities that acquired HPIDs and OEIDs would be free to retain and use these identifiers at their own discretion.
There are two legislative enactments that require us to adopt a standard unique health plan identifier, and in this proposed rule we have provided a history of our efforts to do so. We will continue to work with industry on other solutions to meet those requirements, and we remain open to industry and NCVHS discussion and recommendations for an appropriate use case that might eliminate or reduce costs and burden on covered entities.
We welcome comments on these proposals.
IV. Collection of Information Requirements
This document does not impose information collection requirements, that is, reporting, recordkeeping or third-party disclosure requirements. Consequently, there is no need for review by the Office of Management and Budget under the authority of the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.).
However, it must be noted that the information collection request (ICR) associated with the HPID was previously approved under OMB control number 0938-1166 and subsequently expired May 31, 2016. HHS incurred a violation of the PRA when the ICR expired. As stated earlier in this document, we are proposing to rescind the adoption of the HPID and the other entity identifier (OEID) along with the implementation specifications and requirements for the use of the HPID and OEID; therefore, we will not be seeking to reinstate the ICR previously approved under 0938-1166.
V. Response to Comments
Because of the large number of public comments we normally receive on Federal Register documents, we are not able to acknowledge or respond to them individually. We will consider all comments we receive by the date and time specified in the DATES section of this preamble; and when we proceed with a subsequent document, we will respond to the comments in the preamble to that document.
VI. Regulatory Impact Statement
We have examined the impact of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).
Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A Regulatory Impact Analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This rule does not reach the economic threshold and thus is not considered a major rule, thus we are not required to prepare an RIA. We discuss our approach to Executive Order 12866 and demonstrate that this rule would not have economically significant effects because it would not only remove requirements perceived by industry as burdensome, but it would rescind a regulation that has effectively never been implemented by industry. We have described in detail the history and impact in the preamble, and provide more information later in this section.
The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of less than $7.5 million to $38.5 million in any 1 year. Individuals and states are not included in the definition of a small entity. We are not preparing an analysis for the RFA because we have determined, and the Secretary certifies, that this proposed rule would not have a significant economic impact on a substantial number of small entities.
In addition, section 1102(b) of the Act requires us to prepare an RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 603 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and the Secretary certifies, that this proposed rule would not have a significant impact on the operations of a substantial number of small rural hospitals.
Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2018, that threshold is approximately $150 million. This rule would have no consequential effect on state, local, or Start Printed Page 65124tribal governments or on the private sector.
Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. Since this regulation does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.
Executive Order 13771, titled Reducing Regulation and Controlling Regulatory Costs, was issued on January 30, 2017, and requires that the costs associated with significant new regulations “shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least two prior regulations.” This proposed rule is expected to be an E.O. 13771 deregulatory action. Details on the estimated cost savings of this proposed rule can be found in the rule's economic analysis.
A. Cost and Savings
As stated previously, and shown in this section, we estimate that this proposed rule would not have economically significant effects on industry. We refer readers to the September 2012 final rule where we made several references to the large measure of uncertainty in the assumptions of our original impact analysis. In some cases we indicated that the HPID would be “foundational” to subsequent activities such as the automation of the Coordination of Benefits (COB) process (77 FR 54705). We also stated that the costs and benefits associated with the HPID were applicable only to entities that are directly involved in sending or receiving HIPAA transactions and that the cost estimates were based on the number of health plans that would use the HPID in the transactions, though we did not have data on how many health plans were actually identified in HIPAA transactions, as opposed to “other entities” that were, instead, identified in HIPAA transactions (77 FR 54703). Therefore, we said that we had no assurance of how many health plans would use the HPID in standard transactions, and took a conservative approach to the costs to health plans. We were aware that covered entities were using Payer IDs to identify the health plan or the responsible entity in transactions. Though a few commenters did not agree with the methodology we chose for our cost analysis in the proposed rule, we did not change it in the September 2012 final rule.
For the estimated cost and benefits of implementation and use of HPID, we reiterate the narrative from the April 2012 proposed rule: The discussion needs to be understood in the context of the initial belief that the HPID would be foundational to other administrative simplification initiatives, both those initiated by industry and those regulated by State or Federal governments. In the proposed and final rules published in 2012, we suggested that if other initiatives did not follow, then the HPID would likely have little substantive impact (77 FR 22977). Since we essentially imposed a delay on implementing the HPID through the enforcement discretion, its use has not had an impact on other administrative simplification initiatives. Rather, industry has made its own operational improvements by other means.
In the April 2012 proposed rule, we stated that the possible cost and benefit impacts are reflective of the uncertainty inherent in the health care industry. However, to illustrate the foundational aspects of the HPID, we estimated an increase in the use of two transactions, eligibility for a health plan and health care claim status, in the range of 1 to 2 percent per year, for 10 years, starting in 2015. The increase could be attributable to the implementation of the HPID (77 FR 22977). We also estimated a 1 to 3 percent increase in the use of the electronic health care payment and remittance advice transaction attributable to implementation of the HPID because the routing of that transaction is especially important for the payment process. Yet, despite HPID compliance having been under enforcement discretion, all three of these transactions have seen modest increases in use. Thus, our assumption that an increase in the use of those transactions could be attributed to the HPID was incorrect. As we have explained elsewhere in this proposed rule, some of the increases (and therefore savings) may be due to use of the adopted operating rules and some may be due to improved system capabilities. CAQH conducts a study each year to assess the utilization of the transactions and operating rules, and tries to identify savings opportunities from their use. The most recent report from 2016 shows progressive adoption of the eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) and remittance advice transactions. The transactions use Payer IDs for routing and other payer and health plan identification purposes. We acknowledge that while this study only includes those payers, plans, and providers that participated, it is nonetheless indicative of a positive trend in the utilization rate without use of the HPID. Table 1 shows the steady increase in industry's use of three transactions over a period of 4 years, which includes 2 years where HPID rule was in effect but compliance action was not taken due to the ongoing enforcement discretion.
We do not attempt to attribute other cost savings to this proposed rule because we do not have industry data regarding expenditures, if any, for anticipated system implementation and transition costs such as software and software development, testing, training, and other conversion costs. To the best of our knowledge, expenditures have not been made to prepare for use of the HPID during the enforcement discretion period, nor have new contracts been executed for the services of software system vendors, billing companies, transaction vendors, and/or health care clearinghouses to facilitate the transition to the HPID. We invite industry comment on our assumptions.Start Printed Page 65125
Certain funds have already been expended and cannot be recouped by the federal government and by those organizations that have already applied for and obtained an HPID or OEID. The federal government spent $1.5 million to build the components of the enumeration system specific to the HPID and OEID, and currently spends $45,000 annually for operations and maintenance. We cannot account for the cost of legal personnel that may have been expended in conducting the analysis for the number or type of HPIDs or OEIDs that may have been acquired.
As a result of our proposal to rescind the HPID and OEID, we believe there would be modest cost avoidance (savings). First, we assume there will be no costs for enumeration of new health plans or other entities while the September 2012 final rule remains in effect due largely to the ongoing enforcement discretion, and because there is no growth in the number of overall health plans. We base this assumption on data from our April 2012 proposed rule, in which we reported that from 2013 to 2018, industry trends indicate that the number of health plans will remain constant, or even decrease.
Our calculations reflected that there would be no statistically significant growth in the number of health plans or other entities and we calculated zero growth in new applications (77 FR 22971). We acknowledge that some of our assumptions in the April 2012 proposed rule may be outdated, and welcome industry feedback on our use of those assumptions for purposes of this analysis.
In the April 2012 proposed rule, we estimated that there would be up to 15,000 entities that would be required to, or would elect to, obtain an HPID or OEID. We based this number on the data in Chart 2 from the April 2012 proposed rule which is republished here for reference (77 FR 22970).
Table 2—Number and Type of Entities That Were Expected To Obtain an HPID or OEID
|Type of entity||Number of entities|
|Self-insured group health plans, health insurance issuers, individual and group health markets, HMOs including companies offering Medicaid managed care||* 12,000|
|Medicare, Veterans Health Administration, Indian Health Service||** 1,827|
|TriCare and State Medicaid programs||60|
|Clearinghouses and Transaction vendors||*** 162|
|Third Party Administrators||**** 750|
|* Report to Congress: Annual Report on Self-Insured Group Health Plans,” by Hilda L. Solis, Secretary of Labor, March 2011.|
|** Patient Protection and Affordable Care Act; Standards Related to Reinsurance, Risk Corridors, and Risk Adjustment, 2011 Federal Register (Vol. 76), July, 2011,” referencing data from www.healthcare.gov.|
|*** Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards; Proposed Rule http://edocket.access.gpo.gov/2008/pdf/E8-19296.pdf, based on a study by Gartner.|
|**** Summary of Benefits and Coverage and the Uniform Glossary; Notice of Proposed Rulemaking http://www.gpo.gov/fdsys/pkg/FR-2011-08-22/pdf/2011-21193.pdf.|
As we stated earlier in this proposed rule, slightly fewer than 11,000 entities applied for and obtained an HPID immediately following publication of the September 2012 final rule. The cost for enumeration was explained in the April 2012 proposed rule (77 FR 22970). Health plans and other entities were required to complete the application or update form online through the Health Plan and Other Entity Enumeration System (HPOES). Any changes to a health plan's information are submitted to the same system. Most applications were received shortly after publication of the September 2012 final rule, subsequent to which the application rate slowed down considerably. Between May 2016 and May 2017, 156 applications for HPIDs were received.
The HPID and OEID application is a one-time burden, and our cost savings estimate for this proposed rule is based on the elimination of that burden. For purposes of this impact analysis, we make an estimate of the elimination of that burden. We have proposed a method to help industry implement this proposal in a cost effective way if it is finalized, by HHS deactivating the HPIDs and OEIDs. The cost savings are estimated as follows: We estimated that it would take 30 minutes to complete the on-line application form or make updates, and used an hourly labor rate of approximately $23/hour, the average wage reported for professional and business services sector, based on data from the Department of Labor, Bureau of Labor Statistics, June 2011, “Average hourly and weekly earnings of production and nonsupervisory employees (1) on private nonfarm payrolls.” (https://www.bls.gov/news.release/empsit.t24.htm). If we increase the rate to account for 2017 dollar values (March 2017 table), to $31/hour, this represents a unit cost of $15.00 per HPID or OEID application. For the initial enumeration of 11,000 entities, this would have been $165,000.
Rather than having each entity individually deactivate their HPIDs and OEIDs if this proposed rule is finalized, HHS is proposing that it would deactivate each HPID and OEID record in the HPOES and notify the manager of record at the current email address available in the system. The HPIDs and OEIDs would be stored securely in the HHS record system for 7 years. There would be no further cost to the enumerated entities. We believe that the cost to HHS will not be substantial for this task because it will be conducted as part of regular staff activities.
We also estimated the potential savings for those entities that might have already updated their HPID or OEID records before the HHS deactivation and based our assumption on the actual number of updates to the HPOES system since 2013. Each year, an average of 95 records, or 1 percent of Start Printed Page 65126valid applications have been deactivated or updated. Using the same formula, if 1 percent of the current organizations (110 entities) update their HPIDs/OEIDs, the cost would be $1,650 (110 × $15). To account for any increase in wages and benefits, we multiply this by two (2), and arrive at a sum of $3,300. This proposed rule might result in savings of $3,300 if finalized. We typically provide ranges in an impact analysis, and so provide a high range of 3 percent as well. Therefore, our calculation means 330 entities would make updates, for a total high end savings estimate of $9,900 (330 × $15) × 2. However, should this proposed rule be finalized, those updates would not be necessary and organizations that have obtained HPIDs or OEIDs would not need to take any action. See Table 3 for a summary of the savings for updates that would not have to be made to HPIDs and OEIDs after 2019.
We welcome industry feedback on our assumptions, estimates, and the deactivation of the HPID and OEIDs.
3. Summary of Costs and Savings for the Proposal To Rescind the HPID
Table 3—Savings (Cost Avoidance)—Updates That Would not Have To Be Made to HPIDs and OEIDs After 2019
|Updates to enumeration||$3,300||$9,900||$0||$0||$0||$0||$0||$0||$0|
D. Regulatory Review Costs
If regulations impose administrative costs on private entities, such as the time needed to read and interpret a proposed rule, we should estimate the cost associated with the review of our documents. We assume that commenters on this proposed rule will be representative of HIPAA covered entities and their business associates—primarily health plans, health care clearinghouses, health care providers and vendors. However, it is not possible to accurately quantify the number of entities, or the number of individuals within each organization who will participate in reviewing the proposed rule. Our best estimate is based on the number of organizations who have submitted comments on previous regulations related to HIPAA standards and operating rules, and organizations who have participated in NCVHS hearings. HHS has received comments from approximately 100 to 150 commenters on past HIPAA regulations, and there are a similar number of organizations who either testify or listen to the NCVHS hearings. We assume this number will hold true for this proposed rule. We acknowledge that this assumption may result in an understatement or overstatement of the cost calculation for the review of this proposed rule. We also recognize that this proposed rule will affect covered entities in different ways, however, both health plans and health care providers have provided feedback on this topic in the past, and may have a positive or negative response to the proposal. For purposes of our estimate we assume that each reviewer reads approximately 50 percent of the proposed rule. Using the wage information from the BLS for Computer and Information Systems managers for insurance carriers (Code 11-3021), we estimate that the cost of reviewing the proposed rule is $70.07 per hour, including overhead and fringe benefits (https://www.bls.gov/oes/current/oes113021.htm). Assuming an average reading speed, we estimate that it will take approximately 2.5 hours for these individuals to review half of the proposed rule. We estimate that multiple individuals from 150 organizations will read the proposed rule, and that the key readers are likely the information systems manager and legal staff. We selected the information systems manager for purposes of this analysis. For each information systems manager that reviews the rule, the estimated cost is $175.17 (2.5 hours × $70.7). Therefore, we estimate that the total cost of reviewing this proposed rule is $175 × 150 reviewers = $26,250. Though we acknowledge that our estimate for the total number of reviewers may be high, we are trying to provide an estimate for the burden of reviewing our proposal and welcome feedback if appropriate.
E. Alternatives Considered
We are not required to provide alternatives for our proposal because we are not providing a full regulatory impact analysis, and we have fully discussed our reasons for proposing to rescind the HPID and OEID throughout this proposed rule. However, we did consider several alternatives before making this proposal, including the effects of these alternatives. We are providing our rationale for not selecting these options in accordance with OMB Circular A-4, which directs agencies to consider a range of regulatory and non-regulatory alternatives, including different choices defined by statute, different compliance dates, market-oriented approaches, and different enforcement methods, to name a few.
We considered, but did not propose, to allow covered entities to apply for and use the HPID or OEID voluntarily between willing trading partners. We rejected this option because there has been no demand for the use of these identifiers. Industry has clearly stated that there is no business use case for the HPID and OEID, and there is no anticipated benefit or savings from its use in the HIPAA transactions or for other purposes. An entirely voluntary model using the HPID and OEID would likely result in confusion in its implementation and impose costs on trading partners who did not choose to implement the two identifiers. We also rejected this option because it would be inconsistent with the statutory requirement to adopt an identifier for health plans that would be required for use.
We considered retaining the option of allowing health plans to obtain an HPID and enumerate as a CHP or SHP for their own systems, and use the identifier for their own purposes. Given the low enumeration numbers over the past 4 years, we decided not to pursue this alternative because we believe it would be confusing to the industry to enable enumeration without providing federal guidance on the use of the HPID. We determined that it was best to rescind the entire scheme (HPID, OEID, CHPs, and SHPs), and leave room to hear from industry about further business changes that may inform specific needs in a future standard unique health plan identifier.
At the May 3, 2017 NCVHS hearing, two commenters suggested that HHS consider alternative uses of the HPID, such as placing the HPID on health insurance identification cards to assist Start Printed Page 65127with better understanding of patient coverage and benefits (including its use in patient medical records to help clarify a patient's healthcare benefit package). A commenter stated that the HPID could be used for enforcement or certification of compliance of health plans. The adoption of a standard unique health plan identifier is required by statute, and HHS remains open to industry and NCVHS discussion and recommendations for appropriate use case(s) that meet the requirements of administrative simplification and will explore options for a more effective standard unique health plan identifier in the future.
We solicit and welcome comments on our proposal, on the alternatives we have identified, and on other alternatives that we could consider, as well as on the costs and benefits of a health plan identifier.
In accordance with the provisions of Executive Order 12866, this proposed rule was reviewed by the Office of Management and Budget.
Start List of Subjects
List of Subjects in 45 Part 162
End List of Subjects
- Administrative practice and procedures
- Electronic Transactions
- Health facilities
- Health insurance
- Reporting and recordkeeping requirements
For the reasons set forth in the preamble, the Department of Health and Human Services proposes to amend 45 CFR part 162 to read as follows:
PART 162—ADMINISTRATIVE REQUIREMENTS
Start Amendment Part
1. The authority citation for part 162 is revised to read as follows: End Amendment Part
Start Amendment Part
2. Section 162.103 is amended by removing the definitions of “Controlling health plan (CHP)” and “Subhealth plan (SHP)”. End Amendment Part
Subpart E [Removed and Reserved]
Start Amendment Part
3. Part 162 is amended by removing and reserving Subpart E. End Amendment Part
End Supplemental Information
Dated: December 6, 2018.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2018-27435 Filed 12-18-18; 8:45 am]
BILLING CODE 4120-01-P