Frost Brown Todd LLC Employee Benefits Alert: Employers with Health Plans Have New Obligations
This Alert highlights some important aspects of new legislation affecting employer health plans, including:
- COBRA (partial tax subsidy of participant cost)
- SCHIP (special enrollment rights)
- Mental Health Parity (extension and expansion of parity with other benefits)
- HIPAA privacy rules (for self-funded health plans)
- Upcoming HIPAA privacy notice distribution deadline for many large health plans
As we noted in our Employee Benefits Alert on February 18, 2009, the new Stimulus Act (the American Recovery and Reinvestment Act of February 17, 2009) gives employees who are involuntarily terminated between September 1, 2008 and December 31, 2009 a 65% discount on COBRA premiums for up to 9 months. Once the employee elects coverage and pays 35% of the premium, the employer must provide the coverage and recoup the remaining 65% by claiming a credit on the employer's next deposit of payroll taxes (employer and employee FICA and employee income tax withholding remittances are all available for this credit).
See our earlier Alert for more background and the details on the notices that must be mailed no later than April 14, 2009 to avoid penalties. We also wanted to highlight a few issues based on frequent questions:
Subsidy Applies To Involuntary Terminations. The subsidy is available to all employees who are involuntarily terminated, even if termination is for cause such as poor performance or attendance issues. Only employees who are terminated due to gross misconduct and who are therefore not eligible for COBRA are excluded from the subsidy. Courts have construed the gross misconduct exception to COBRA very narrowly and employee termination situations rarely rise to the level of gross misconduct. The subsidy is also available for spousal and dependent coverage provided due to an employee's involuntary termination. While employees who were not enrolled in the health plan when they were terminated, and therefore never had a COBRA right, do not get one now because of the new law, employees involuntarily terminated within the new law's effective period and who rejected or failed to elect COBRA timely now get a second chance.
Subsidy Applies Only to the Premium the Employee is Required to Pay. If the employer agrees to pay some portion of an employee's COBRA premium as part of a severance arrangement, then the 65% subsidy only applies to the portion the employee is required to pay. Severance arrangements must be very carefully worded so as not to imply that the 65% subsidy is consideration the employer is providing in exchange for a release, or that the reduction in cost due to the subsidy is an employer-provided benefit.
Employer contracts to pay $500 of employee's $1000 premium for family coverage during the COBRA period. After the subsidy is considered, the employee must pay 35% of $500, or $175, and then the subsidy the employer will recoup via payroll tax credits will be $325. The employer must still pay the other $500.
Employer does not contract to pay any of employee's $1,000 premium. The employee must pay $350, and then the subsidy is $650.
Employer agrees the employee can have COBRA at a cost of 35% of the normal COBRA premium, expecting the difference to be reimbursed through the subsidy. In this case, the employer is only eligible for a subsidy of 65% of the total cost to the employee, not 65% of the total pre-subsidy COBRA rate. So, on a $1,000 COBRA premium, the employee would be obligated to pay $350, and would be eligible to reduce that to $122.50, $227.50 is covered by the tax subsidy, and the employer will be out of pocket for $650.
The Children's Health Insurance Program Reauthorization Act of 2009 (the "Act") was signed into law on February 4, 2009. This Act funds and expands the existing State Children's Health Insurance Program ("SCHIP") effective April 1, 2009, and imposes new requirements on employer health plans designed to make it easier for states to facilitate the coverage.
The Act allows states to pay some of the cost of employer-provided health coverage, rather than providing coverage directly to SCHIP-eligible children. States cannot pay premiums for coverage under high-deductible health plans, health care flexible spending accounts, and plans for which the employer does not cover 40% or more of the cost. The state may make subsidy payments directly to the eligible employee or may pay the employer. While employers can opt out of taking funds directly from the states, they will still have obligations under the law. Employers must observe new special enrollment events, notify employees of state SCHIP programs, and respond to state information requests about employer-provided plans.
- Effective April 1, 2009, there are two new special enrollment rights that group health plans must observe: (1) termination of Medicaid or SCHIP coverage due to loss of eligibility, and (2) becoming eligible for Medicaid or SCHIP coverage. In either case, the participant has 60 days after the event to notify the employer and elect the coverage or change in coverage. Only eligible participants may enroll; employers are not required to change their plan provisions regarding which classifications of employees are eligible for coverage. Most Section 125 cafeteria plans will need amendment to note this new 60 day special enrollment right.
- If a state provides premium assistance for a state Medicaid plan or to SCHIP-eligible individuals, the employer must provide a state-specific notice to employees of the state assistance. Model notices are to be provided by the Department of Labor and HHS by February 4, 2010, and employers must provide the notice in advance of each plan year beginning after the model notices are issued.
- The Act requires group health plans to report, upon a state's request, information the state needs to determine employees' eligibility for premium assistance, including plan benefits and eligibility and cost information.
The Mental Health Parity Act of 1996 prohibited health plans from having separate lifetime limits for mental health benefits, but plans could still impose deductibles and co-payments and limits on treatment sessions or days of inpatient care for mental health treatment, even if those same limits were not imposed on other health conditions. The Mental Health Parity and Addiction Equity Act of 2008 (the "Parity Act") applies to group health plans (including self-funded plans) sponsored by employers with 51 or more employees, and requires that mental health and substance abuse benefits, if they are provided, be on the same terms as other benefits.
The Parity Act does not require a group health plan to provide mental health and substance abuse benefits, but if a plan provides mental health or substance abuse benefits, it must provide them on the same terms as medical or surgical benefits. Under the Parity Act, a plan cannot impose different financial requirements (e.g., deductibles, co-pays, out-of-pocket expenses), treatment limitations, or out-of-network coverage on mental health and substance abuse benefits. Finally, any criteria used by a plan to make medical necessity determinations with respect to mental health or substance abuse benefits must be available to participants and providers upon request. For self-funded plans, mental health conditions and substance abuse disorders should be defined in the terms of the group health plan's plan document.
The Parity Act does allow an employer to qualify for an exemption from the requirements on a year by year basis. If an employer experiences a specific cost increase after implementing the Act, it may be eligible for an exemption from the Act's requirements. A group health plan can elect exemption if its total costs increase by more than 2% in the first year or by 1% in subsequent years. In order to claim the exemption, the plan must receive an actuarial determination that the plan has experienced a cost increase due to the Act. It appears that the exemption could first be used for 2011 based on 2010 costs, and then every other year thereafter. Governmental notice filings and notices to participants and beneficiaries are required when the exemption is used.
The Parity Act is effective for plan years after October 3, 2009. For calendar plan years, this means an effective date of January 1, 2010. For group health plans maintained pursuant to a collective bargaining agreement in effect on October 3, 2008, the effective date is the later of (1) January 1, 2010, and (2) the date on which the collective bargaining agreement terminates.
The Stimulus Act expands HIPAA privacy and security standards imposed on insurers, health plans and medical providers. There are new requirements for business associates, new requirements to account for disclosures and provide notice of privacy breaches, and new rights for individuals to obtain records electronically and to protect information where services have been paid in full.
Self-funded health plans, including medical flexible spending benefits using a third party administrator or covering more than 50 employees, will need to update their business associate agreements and their privacy policies and procedures to comply with the new rules.
Business Associate Agreements Expanded. Self-funded health plans and other covered entities such as health care providers and insurers are required to have "business associate agreements" with vendors and service providers who come into contact with protected health information, so that the business associates are also required to protect that health information. The Stimulus Act requires that business associates follow the same rules as covered entities in protecting health information. Business associates must evaluate appropriate physical and electronic security measures and create written policies to ensure protected health information is used only for permitted purposes, must mitigate improper disclosures where possible, and must train staff on compliance and impose sanctions on staff members involved in any violation.
Notification of Privacy Breaches: Until now, covered entities had to evaluate whether it would be necessary as part of mitigation of a privacy breach to notify the individual whose health information was or may have been compromised. The Stimulus Act now requires that individuals be notified of any improper disclosure or privacy breach without unreasonable delay and no later than 60 days after the discovery. "Prominent media outlets" in the area as well as the Department of Health and Human Services ("HHS") must also be notified if more than 500 individuals are involved. The covered entity must notify HHS annually of all breaches involving data that was not secured in a manner described in regulations (yet to be issued). The notice requirement will go into effect 30 days after final regulations are issued, which is expected to be later this year.
Expanded Accounting for Disclosures. A participant in a health plan can demand an accounting of disclosures of their health information, but no accounting of disclosures for treatment, payment or health plan operations was previously required. Under the Stimulus Act changes, an accounting of these standard disclosures for treatment, payment or healthcare operations must now be provided for the prior three years. Other disclosures must be tracked for six years. These rules will not apply until at least January 1, 2011.
Access to Electronic Records and Restrictions on Disclosures. Participants now have the right to request disclosure of medical records in electronic form to the extent the covered entity holds the records in that form. This is to be effective February 16, 2010. Individuals also have the right to restrict disclosures, and covered entities will now be required to follow a request that no disclosures be made regarding treatment where that treatment has been paid in full.
Enforcement: The HIPAA enforcement provisions have also changed, increasing the potential penalties, subjecting business associates to penalties, authorizing audits of covered entities and investigation of complaints, and authorizing state attorney generals to bring civil actions against HIPAA violators seeking statutory damages and attorney fees. The maximum monetary penalties are now graded based upon whether the breach was without knowledge of the covered entity, due to reasonable cause, or due to willful neglect. The civil penalty provisions are effective immediately.
Under the HIPAA privacy rules, group health plans must provide a privacy notice to participants when they first become covered by the plan and again every three years. While the three year notice can inform participants of the where to obtain a copy of the privacy notice, it seems just as easy to re-distribute the full notice.
- Group health plans that are self-insured by the employer and which have annual medical claims of more than $5,000,000 were initially required to provide the Notice of Privacy Practices by April 14, 2003, so April 14, 2009 is the deadline for the second three-year reminder notice.
- Small health plans with claims of not more than $5,000,000 had an initial notice date of April 14, 2004, so the second thee-year reminder notice is due April 14, 2010.
- Plans that began or became self-funded at a different time then when the law first applied may be on a different three-year schedule. Many plans provide the notice each year along with open enrollment materials.
For assistance with these compliance obligations, please contact any of the attorneys in Frost Brown Todd's Employee Benefits Practice Group.