For example, HIPAA requires all products carriers offer in the small group market to be sold to any small employer that applies, but it does not extend the same requirement to the large group or individual markets.Similarly, HIPAA requires that certain individuals leaving group coverage be guaranteed access to coverage in the individual market—“group to individual guaranteed access.” However, no similar guarantees of access exist for people in the individual market who have coverage today but might lose it in the future. HIPAA Guarantees Access to Coverage for Individuals Leaving Group Plans, but Consumer Ability to Obtain This Coverage Is Compromised

To ensure that individuals losing group coverage have guaranteed access—regardless of health status—to individual market coverage, HIPAA provides states with two different approaches. Some carriers initially attempted to discourage consumers from applying for products with guaranteed access rights, and some are charging premiums 140 to 600 percent of the standard rate. Carriers charge higher rates, in part, because they believe HIPAA-eligible individuals will, on average, be in poorer health and hence would likely have higher medical costs. Consumers who do not understand these rights may be disappointed or even be at risk of losing their group-to-individual portability rights. Among other restrictions, eligible individuals must have had at least 18 months of creditable coverage (the most recent of which must have been group coverage) with no break of more than 63 consecutive days; have exhausted any COBRA or other continuation coverage available; not be eligible for any other group coverage, or Medicare or Medicaid; and not have lost group coverage because of nonpayment of premiums or fraud. In addition to these restrictions, consumers need to be aware of other factors in order to exercise their rights. Issuers of Health Coverage Concerned About HIPAA’s Administrative Burden and Possible Unintended Consequences

Issuers of health coverage have several concerns about the unintended consequences of certain HIPAA requirements. While issuers generally have complied with this requirement, some suggest that a more limited requirement, such as issuing the certificates only to consumers who request them, would serve the same purpose for less cost. State Insurance Regulators Cite Lack of Sufficient Clarity or Detail in Some HIPAA Regulations as Hindering Implementation Efforts

State regulators have encountered difficulties implementing HIPAA provisions in instances where federal regulations lacked sufficient clarity or detail. Regulators believe that the HIPAA provision that allows issuers who cease offering coverage throughout the individual and group markets to not renew the coverage of an individual or a group creates uncertainties that may affect their ability to regulate insurance. HHS Given New Health Insurance Regulatory Role If States Decline to Implement and Enforce HIPAA Standards

Unlike Labor and the Treasury, HHS was given a new regulatory role under HIPAA. Federal agencies issued further guidance at the end of 1997 and expect to continue issuing guidance in 1998. It requires three federal agencies, state legislatures and insurance regulators, and issuers of health coverage to coordinate their efforts. Agency Comments

The Departments of Health and Human Services, Labor, and the Treasury commented on a draft of this report. GAO Comments

1. GAO Comments

1. Consequently, we focused on the activities of those implementing the law—state and federal regulators and issuers—and emphasized areas where preliminary evidence signaled emerging challenges. 3. 4. 5. 6. The Health Insurance Portability and Accountability Act of 1996: Early Implementation Concerns (GAO/HEHS-97-200R, Sept. 2, 1997).
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the implementation of the Health Insurance Portability and Accountability Act (HIPAA), focusing on issues affecting: (1) consumers; (2) issuers of health coverage, including employers and insurance carriers; (3) state insurance regulators; and (4) federal regulators. GAO also reviewed efforts undertaken by federal agencies to address some of the concerns and challenges that have arisen.

What GAO Found

GAO noted that: (1) although HIPAA provides people losing group coverage the right to guaranteed access to coverage in the individual market regardless of health status, consumers attempting to exercise their right have been hindered by carrier practices and pricing and by their own misunderstanding of this complex law; (2) among the 13 states where this provision first took effect, many consumers who had lost group coverage experienced difficulty obtaining individual market coverage with guaranteed access rights, or they paid significantly higher rates for coverage; (3) some carriers have discouraged individuals from applying for the coverage or charged them rates 140 to 600 percent of the standard premium; (4) carriers charge higher rates because they believe individuals who attempt to exercise HIPAA's individual market access guarantee will, on average, be in poorer health than others in the individual market; (5) many consumers do not realize that the access guarantee applies only to those leaving group coverage who meet other eligibility criteria; (6) individuals must have previously had at least 18 months of coverage, exhausted any residual employer coverage available, and applied for individual coverage within 63 days of group coverage termination; (7) consumers who misunderstand these restrictions are at risk of losing their right to coverage; (8) issuers of health coverage believe certain HIPAA regulatory provisions result in: (a) an excessive administrative burden; (b) unanticipated consequences; and (c) the potential for consumer abuse; (9) although issuers appear to be generally complying with the requirement to provide a certificate of coverage to all individuals terminating coverage, some issuers continue to suggest that the process is burdensome and costly and that many of these certificates may not be needed; (10) these issuers, as well as many state regulators, believe that issuing the certificates only to consumers who request them would serve the purpose of the law for less cost; (11) state insurance regulators have encountered difficulties in their attempts to implement and enforce HIPAA provisions where they found federal guidance to lack sufficient clarity or detail; (12) federal regulators face an unexpectedly large regulatory role under HIPAA that could strain the Department of Health and Human Services' resources and impair its oversight and effectiveness; and (13) partly in response to health insurance issuers' and state regulators' concerns, federal agencies issued further regulatory guidance intended to clarify current HIPAA regulations.