Transitional Deadline for Business Associate Agreements – September 22, 2014
On January 25 2013, the Department of Health and Human Services (HHS) issued its final Omnibus Rule, mandating, among other things, that covered entities update their Business Associate Agreements (“BAAs”) with service providers who maintain, utilize, or come into contact with protected health information (“PHI”). Group health plans are considered covered entities and the Omnibus Rule’s expansion of the definition Business Associate meant that several plans entered into BAAs with a variety of service providers by or before last September.
Many existing BAAs were updated with an effective date of September 23, 2013 or earlier, to comply with the Omnibus Rule. However, transitional relief was extended to BAAs in place prior to the issuance of the Omnibus Rule, so long as it was not revised between March 26 and September 23, 2013. (Revisions to or renewals of BAAs during that time frame were required to comply with the Omnibus Rule by September 23, 2013). Several employer-sponsored group health plans have BAAs which fall into the transitional relief group and have not been revised or updated since prior to January 25, 2013. The deadline for these transitional BAAs to be updated and comply with the Omnibus Rule was September 22, 2014. Entities that have missed the deadline for transitional BAAs should be prepared to demonstrate good faith attempts to become compliant with the Omnibus Rule in a timely fashion, and update all non-compliant BAAs immediately.
Health Plan Identifier Filing Deadline – November 5, 2014 (Delayed Indefinitely, see below for more details)
Group health plans are also subject to the Health Plan Identifier (“HPID”) rule as required by HIPAA and ACA. The HPID is a unique, ten-digit number that health plans will be required to use in standard electronic transactions, like payment of health claims. Plans are permitted and encouraged to use the HPID in other ways to promote efficiency in administering health benefits. For example, HPIDs may be published on participant’s health insurance cards and may be used on medical records to identify the participant’s benefits.
Health plans must apply for and obtain a unique HPID by November 5, 2014, although there is an extension until November 5, 2015 for “small” health plans (those with annual receipts of $5 million or less pursuant to 45 CFR 160.103). All health plans must begin using the HPID in standard transactions by November 7, 2016, the “full implementation date”. Third-party administrators and administrative managers often handle the HPID application process and can assist health plans in navigating the online process maintained by the Center for Medicare and Medicaid Services (CMS).
CMS Delays HPID Requirement – October 31, 2014
The new HIPAA requirement for health plans to obtain the unique 10-digit, government assigned number known as the Health Plan Identifier (HPID) has been delayed indefinitely. On Friday, October 31, 2014, the Department of Health and Human Services, through the Centers for Medicare and Medicaid Services (CMS) announced a delay to both the requirement to obtain the HPID by November 5, 2014 as well as the requirement to use the HPID in reporting standard transactions. (The process of obtaining the HPID through the online process with CMS is referred to as “enumeration”.) For health plans that have already obtained the HPID, the delay in the enumeration process is not helpful, but for those plans that have struggled with the process of obtaining the HPID by November 5, this delay provides some relief. Continue to review updates to this matter on the CMS website. The explanation of the delay can be found here: http://www.cms.gov/Regulations-and-Guidance/HIPAAAdministrative-Simplification/Affordable-Care-Act/Health-Plan-Identifier.html.