HPID Requirement Delayed Indefinitely
(comments: 0)
On Oct. 31, 2014, CMS announced that enforcement of HIPAA's health plan identifier (HPID) requirement has been delayed indefinitely. As background, HIPAA requires health plans to obtain an HPID, which is to be used by the plan in certain HIPAA-related transactions. The HPID is a unique identifier for the plan, similar to a taxpayer identification number—a standard number that applies in all transactions so that the parties involved know the true identity of the plan. Large health plans (those with annual receipts of more than $5 million) were supposed to obtain an HPID by Nov. 5, 2014 while small health plans had an additional year to comply. The HPID regulations also introduced two new (and somewhat confusing) terms—“controlling health plan” (CHP) and “sub-health plan” (SHP). A CHP is a plan that controls its own business operations, and which is required to obtain its own HPID. A SHP, on the other hand, is a plan that takes direction from a controlling health plan, and which is not required to obtain its own HPID (although a CHP can direct an SHP to obtain an HPID or obtain one on their behalf).
Generally speaking, in the fully insured context, the insurer is responsible for obtaining an HPID. In the self-insured context, though, the employer assumes that responsibility. CMS had recently published several items of guidance to assist insurers and employers in determining which health plans must obtain an HPID and in walking through the process of obtaining the HPID. Those items were covered in the Oct. 7, 2014, edition of Compliance Corner.
The announced delay pushes off HPID penalty enforcement indefinitely for all health insurers and health plans. Importantly, the announcement also references a letter from the National Committee on Vital and Health Statistics (NCVHS) to HHS recommending that covered entities not use the HPID in connection with HIPAA transactions. NCVHS's recommendation is based on several conclusions, including a lack of clear business need and purpose for using HPID in health care administrative transactions, confusion about how the HPID would be used in conjunction with the current payer identification numbers that have already been widely adopted in the industry, and costs to health plans if software has to be modified to account for the HPID. NCVHS also cited the challenges faced by health plans with respect to the definitions of 'controlling health plans' and 'sub-health plans', something employers have been struggling with over the past year as they attempted to understand and comply with the HPID rules.
With an indefinite delay in enforcement and a recommendation that lacks support for the HPID's purpose, the HPID requirement's future is unknown. For now, though, it is clear that insurers and employers will not be penalized for failing to obtain an HPID by the above dates. NFP Benefits Compliance will continue to monitor developments on this issue.