PPACA Provisions

Several PPACA provisions that became effective January 1, 2014, limited  the ability of issuers to deny coverage or charge higher premiums to  individuals and small groups based on health risks or certain other  factors. As a result,  many previously uninsured individuals entered the insurance market,  possibly for the first time, and issuers lacked historical information about  their health care and use of medical services.uninsured individuals who are most in need of health care may be more  likely than others to purchase insurance during the transition, resulting in  a pool of enrollees that have unknown and potentially higher medical  costs than the broader population. The Department of Health and Human Services (HHS)
Each of the risk mitigation programs applies to a different group of  issuers. CMS Considered Market Characteristics and Program Duration When Designing PPACA’s Three Risk Mitigation Programs

CMS considered a range of insurance market characteristics—such as  demographics and the availability of market data—in making decisions  about how to design PPACA’s three risk mitigation programs. CMS’s  design decisions also reflected the temporary status of the reinsurance  and risk corridors programs. CMS’s Design of the Risk Adjustment Program Reflects Multiple Factors That Influence Cost Variation in the Individual and Small Group Markets under PPACA

While the Medicare risk adjustment programs served as the basis for the  PPACA risk adjustment program, CMS’s design of the PPACA program  reflects key differences that exist between Medicare and PPACA markets,  including differences in demographics, the availability of enrollee data,  and each program’s benefit design and premium-setting structure. CMS indicated that “in the  unlikely event of a shortfall in the 2016 benefit year, HHS will use  other sources of funding, subject to availability of appropriations.”

	CMS Considered Privacy and Security in Developing Systems for Collecting Issuer Risk Mitigation Data and Experienced Significant Delays CMS Considered Privacy, Security, and Efficiency When Developing Data Collection Systems for PPACA’s Risk Mitigation Programs

CMS chose data collection systems for the risk mitigation programs that  were intended to address privacy and security concerns and maximize  efficiencies. CMS delayed implementation of the new data collection  system for the risk adjustment and reinsurance programs by nearly a year  as it revised its plans for implementing the distributed data approach. This would have allowed issuers to upload enrollment and claims data on  a monthly basis starting in January 2014, and CMS planned to use these  data to generate issuer reports during 2014:
CMS planned to provide quarterly reports to issuers with the  estimated amount of reinsurance program payments they would  receive for benefit year 2014. 2). CMS Established Some Processes to Monitor the Accuracy of Issuer Data for the Three Risk Mitigation Programs and Initiated Efforts to Evaluate the Permanent Risk Adjustment Program CMS Established Some Data Verification Processes and Audit Procedures for the Risk Mitigation Programs, and Others Are under Development

To a varying extent, CMS has developed or has plans to develop data  verification checks or audit procedures for each of PPACA’s three risk  mitigation programs. In addition, CMS has initiated efforts to evaluate the  permanent risk adjustment program but has not finalized the details of the  evaluation. In November 2014, CMS issued a  request for contractors to submit bids to conduct a range of services  related to Medicare and the PPACA insurance market reforms, including  research and development for the PPACA risk adjustment program. The  bid request identified general research and development tasks for the risk  adjustment program, such as analysis of the impact of market and  enrollee factors on the model, evaluation of the accuracy of the risk  adjustment program, and research to support adaptation of the model. As of April 2015, CMS expected to  award this contract in the spring of 2015, although the agency had not  specified the timing and scope of the evaluation. It is critical that CMS  similarly understands whether or not the new PPACA risk adjustment  model is accurately reflecting costs, and CMS’s continued effort to carry  out this evaluation will be important to the program’s success. Issuers identified design concerns specific to each PPACA risk mitigation  program and provided mixed responses regarding the effect of CMS’s  implementation delays and technical assistance. Most Issuers Interviewed Said That All Three Risk Mitigation Programs Encouraged Their Participation in the Individual Health Insurance Market, and Two Programs Affected Their Premiums

Most of the 12 issuers we interviewed said that, beginning in 2014, the  PPACA risk adjustment program positively influenced their participation in  the individual health insurance market and that the PPACA reinsurance  and risk corridors programs positively influenced their participation in the  market and also led them to set lower premiums than they otherwise  would have offered. Issuers Provided Mixed Responses Regarding the Effect of CMS’s Implementation Delays and Technical Assistance

Most of the 12 issuers we interviewed supported CMS’s choice of the  distributed data collection approach for the risk adjustment and  reinsurance programs, although they offered mixed responses about how  they were affected by CMS’s decision to change how it implemented the  EDGE servers and the resulting delays in implementation:
Six of the issuers we interviewed said that the delays in implementing  the EDGE servers were exceedingly disruptive or significant to them.
Why GAO Did This Study

PPACA resulted in significant changes to the private individual and small group health insurance markets in 2014 that expanded the availability and affordability of coverage. However, some of these provisions reduced issuers' ability to mitigate the risk of high-cost enrollees by limiting their ability to deny coverage or charge higher premiums based on individuals' health risks and other factors. Issuers also faced increased risk starting in 2014 because these provisions were expected to result in the enrollment of many previously uninsured individuals, who have unknown and potentially higher medical costs than the broader population. To limit these risks, PPACA required the establishment of three risk mitigation programs.
GAO was asked to provide information on the design and development of these three programs and on issuer perspectives on them. In this report, GAO describes: (1) the factors that guided CMS's design of these programs, (2) the data collection systems CMS developed for these programs, (3) CMS's plans to monitor and evaluate the programs, and (4) issuer experiences with the programs. GAO reviewed regulations, guidance, and documentation about design and implementation activities and interviewed CMS officials. GAO also interviewed officials from a non-representative sample of 12 issuers that offered individual market coverage in 2014 and were selected based on variation in enrollment, location, and market experience.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) considered market characteristics and program duration in designing the three programs mandated by the Patient Protection and Affordable Care Act (PPACA) to mitigate the risks issuers of health insurance faced starting in 2014. Each of the three programs—risk adjustment, reinsurance, and risk corridors—was intended to account for a different source of issuer risk, such as enrollee health status or high-cost medical claims. CMS considered a range of market characteristics—including demographics and the availability of data—in making decisions about how to design each of the programs. CMS's design decisions also reflected the temporary status of the reinsurance and risk corridors programs, which are set to expire after 3 years. While CMS considered similar Medicare risk mitigation programs during the design process, key differences in the markets served by Medicare and the PPACA programs resulted in different approaches to their design.
CMS considered privacy and security concerns in developing systems for collecting issuer data for the risk mitigation programs and experienced multiple implementation delays. For example, for the risk adjustment and reinsurance programs, CMS elected to use a system that allows sensitive enrollee claims data to remain with issuers while providing CMS with only summary data. However, CMS delayed implementation of data collection systems for these programs by nearly a year as it revised its plans to reduce administrative burden and accommodate issuer preferences. Therefore, CMS was unable to provide issuers with most of the periodic, interim reports it had originally planned to generate throughout 2014.
CMS developed or had plans to develop data verification or audit procedures for all three programs. CMS had also initiated efforts to evaluate the permanent risk adjustment program but had not finalized the details of the evaluation. In November 2014, CMS issued a request for contractors to submit bids to conduct a range of services, including research and development tasks for the risk adjustment program such as: analyze the impact of market and enrollee factors on the model; evaluate the accuracy of the program; and conduct research to support adaptation of the model. As of April 2015, CMS officials expected to award the contract in the spring of 2015, although the agency had not finalized a date for completing that evaluation. CMS's continued effort to carry out this evaluation will be important to assessing the program's success.
Most of the 12 issuers GAO interviewed said that the three risk mitigation programs encouraged their participation in the individual health insurance market, and two of the programs allowed them to lower their premiums. Issuers identified design concerns specific to each PPACA risk mitigation program and provided mixed responses regarding the effect of CMS's implementation delays and technical assistance.
In commenting on a draft of this report, the Department of Health and Human Services described CMS's data collection strategy for these programs and its efforts to ensure the appropriate level of technical support for issuers.