Compliance Monthly Update
November 2024
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Federal Compliance Update
No Surprises Act regulations upheld by Fifth Circuit.
On October 30, the Fifth Circuit issued another ruling in a series of cases over the surprise billing provisions under the No Surprises Act (which is part of the Consolidated Appropriations Act, 2021). As a reminder, the No Surprises Act (NSA) expanded patient protections to shield individuals from surprise medical bills for certain out-of-network emergency and non-emergency services and provides an independent dispute resolution (IDR) process to resolve payment disputes between health plans and providers.
- At issue in this appellate ruling was how the surprise billing rules calculate a plan’s qualifying payment amount (QPA) as well as certain disclosure rules. The QPA is a key factor in determining how much a plan must pay out-of-network providers in certain situations.
- The lower court had previously concluded that portions of the rules and agency guidance on calculating the QPA conflict with statutory language and vacated QPA calculation provisions that, among other things, allow the inclusion of “ghost rates” for services that a provider has not provided, exclude single-case agreements for air ambulance services, and exclude bonus and incentive payments. The court also vacated provisions that require initial payment decisions for air ambulance services within 30 days after the receipt of all necessary information but let stand the contested disclosure rules, holding that they were a reasonable exercise of agency discretion.
- The Fifth Circuit, on appeal, reversed the lower court’s decision to vacate the provisions relating to QPA calculations, holding that (1) the inclusion of ghost rates is permissible because the statute contains no requirement that a service must previously have been performed by a provider for that rate to be included in the calculation; (2) the exclusion of single-case agreements is aligned with statutory intent and ensures that the QPA reflects market rates under typical contract negotiations; and (3) the exclusion of bonuses and incentive payments is permissible because the statute gives the agencies discretion as to whether to include such payments. However, the Fifth Circuit upheld the lower court’s decision to vacate the rules interpreting the 30-day deadline for payment determinations, explaining that the statute does not give the agencies rulemaking authority over deadlines, as it does for setting the methods of calculating the QPA. And the Fifth Circuit upheld the NSA disclosure requirements, agreeing with the trial court that they were reasonable and reasonably explained.
2025 retirement plan limits announced including updated income thresholds for determining HCEs and key employees.
On November 1, IRS Notice 2024-80 was released (along with a news release) with 2025 dollar limits and thresholds relevant to 401(k) plans. The IRS notice also includes the income thresholds for determining who is a “highly compensated employee” (HCE) and who is a “key employee” when conducting group health plan nondiscrimination testing.
HIPAA Security Risk Assessment (SRA) Tool updated.
On November 1, HHS announced an updated version of the interactive HIPAA Security Risk Assessment (SRA) Tool. The HIPAA Security Rule requires covered entities and business associates to conduct a risk assessment that helps ensure it is compliant with HIPAA’s administrative, physical, and technical safeguards. A risk assessment also helps reveal areas where protected health information (PHI) could be at risk. The SRA Tool is designed to help conduct the risk assessment as required by HIPAA and walks users through multiple choice questions. The answers to those questions show whether corrective action is necessary to comply with the HIPAA Security Rule. The updates to the SRA Tool track with HHS’s focus on cybersecurity threats.
Potential group health plan changes under Trump’s second term.
When Trump takes office next year, it is highly unlikely there will be another attempt to repeal and replace the Affordable Care Act (ACA). However, the new administration may look to make smaller scale (yet still possibly significant) changes within the ACA and other health benefits rules. There will likely also be continued bipartisan support to lower prescription costs and to build upon transparency requirements. We will keep you updated of any developments during the Trump administration.
State/Local Compliance Update
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
Alaska
Alaska voters pass paid sick leave ballot measure.
Ballot Measure No. 1 was passed by voters on November 5 adding Alaska to the growing and constantly evolving list of state paid leave mandates. The new law applies to all employers and employees in Alaska (with limited exceptions). Effective July 1, 2025, Alaska employers with fewer than 15 employees must provide up to 40 hours of paid sick leave each year. Employers with 15 or more employees must provide up to 56 hours of paid sick leave per year. Employees will earn one hour of paid sick leave for every 30 hours worked. All accrued, unused hours must carry over to the following year, but employers may limit annual usage to the 40 or 56 hours based on the employer’s size. Leave may be taken for employees’ own health matters; to care for ill family members; and for issues related to domestic violence, sexual assault, or stalking of the employee or the employee’s family member. The Alaska law includes exceptions for certain categories of employment, including some individuals not subject to the Alaska minimum wage, and agricultural workers. Employers are required to give employees written notice of their entitlement to paid sick leave, the amount of paid sick leave they accrue, and the prohibition against retaliation. This notice must be given at the commencement of employment or within 30 days of the new law’s effective date of July 1, 2025. Employers with operations in Alaska should review their existing leave policies to ensure compliance with this new law.
California
San Francisco announces changes to minimum standards under the HCAO.
As a reminder, the Health Care Accountability Ordinance (HCAO) applies to most San Francisco contractors and tenants (including those at the San Francisco International Airport and the Port of San Francisco). The HCAO requires covered employers to offer a compliant health plan to their covered employees, to make payments to the city for use by the Department of Public Health, or, under limited circumstances, to make payments directly to their covered employees. If employers wish to comply with the HCAO by offering a compliant health plan, the health plan must meet all the HCAO minimum standards. San Francisco recently announced the minimum standards that are effective January 1, 2025. See the San Francisco Health Care Accountability Ordinance website for more information.
California limits insurers’ use of AI in utilization management.
Governor Newsom signed SB 1120 (the Physicians Make Decisions Act) which requires California health and disability insurers using artificial intelligence (AI), algorithms, or other similar software for utilization reviews or other utilization management functions to not replace healthcare provider decision making for those functions. While California insurers may still use AI to supplement these utilization review functions, the ultimate medical necessity determinations under their plans must be made by a licensed physician or other licensed healthcare professional competent to evaluate the specific clinical issues involved in the healthcare services requested by the provider.
Colorado
Constitutional amendment repeals ban on use of public money to pay for abortion.
On November 5, Colorado voters approved Constitutional Amendment 79 that makes abortion a constitutional right in Colorado to prevent any future law from undoing current protections. Constitutional Amendment 79 also repeals a prior constitutional ban on state and local government funding for abortion services. This means that insurance plans sponsored by public entities in Colorado can now cover abortion services.
Missouri
Missouri voters pass paid sick leave ballot measure.
Proposition A was passed by voters on November 5 that increases the minimum wage and adds Missouri to the list of states with paid leave requirements. Effective May 1, 2025, employers with fewer than 15 employees must provide up to 40 hours of paid sick leave each year, and employers with 15 or more employees must provide up to 56 hours of paid sick leave per year. Employees will earn one hour of paid sick leave for every 30 hours worked. Employees must be permitted to carry over up to 80 hours of unused sick leave to the following year, unless the employer pays out the unused sick time at the end of the year. Employers may limit annual usage to 40 or 56 hours depending on the employer’s size. Leave under the Missouri law may be taken for an employee’s illness, injury, medical treatment or care of a family member, as well as for closures caused by a public health emergency. The law also provides safe leave for employees (or employee’s family member) who are victims of domestic violence or sexual assault. The law covers most employers except the federal or state government. The law also excludes several categories of employees, including but not limited to casual babysitters, incarcerated workers, volunteers, and retail or services businesses with annual sales less than $5,000. Employers with operations in Missouri should review their existing leave policies to ensure compliance with this new law.
Nebraska
Nebraska voters pass paid sick leave ballot measure.
Initiative 436 was passed by voters on November 5 which adopts the Nebraska Health Families and Workplaces Act that requires employers with Nebraska employees (with limited exceptions) to provide paid leave. Effective October 1, 2025, Nebraska employers with fewer than 20 employees must provide up to 40 hours of paid sick leave each year, and employers with 20 employees or more must provide up to 56 hours of paid sick leave per year. Employees will earn one hour of paid sick leave for every 30 hours worked up to the 40 or 56-hour maximum. All accrued unused hours must carry over to the following year, unless an employer opts to pay out the unused sick time at the end of the year. While all hours carry over, employers may limit annual usage to 40 or 56 hours, consistent with the employer’s size. Employees may take leave for their own or a family member’s mental or physical illness, injury, or health condition, medical treatment or diagnosis, or care, as well as for work, school, or place of care closures caused by a public health emergency requiring an employee to self-isolate or care for a family member. The law covers private sector employees who work at least 80 hours per year in Nebraska and are not covered by the Railroad Unemployment Insurance Act. Employers with operations in Nebraska should review their existing leave policies to ensure compliance with this new law.
New Jersey
New Jersey releases 2025 contribution structure for disability and family leave programs.
As a reminder, New Jersey’s temporary disability insurance program (TDI) provides qualifying employees with up to 26 weeks of cash benefits through either a state or private employer plan. For 2025, the employee contribution will be 0.23% of an employee’s earnings. Employers will be moved to a lesser contribution table and will be notified of their required contribution through the state’s Employer Access Contribution rates for employers vary from 0.10% to 0.75% of the taxable wage base, which will increase from $42,300 to $43,300 in 2025. For family leave insurance (FLI), in 2025 workers will contribute 0.33% of the first $165,800 in wages, up from 0.09% in 2023. There are no employer contributions to New Jersey FLI. For more information see the NJ TDI and FLI webpages.
Washington
Washington Paid Family and Medical Leave (PFML) 2025 premium rates announced.
Effective January 1, 2025, the WA PFML total premium rate will be 0.92% (up from 0.74% for 2024) of wages up to the Social Security cap of $176,100. The total contribution of 0.92% is split between employers and employees, depending on the size of the employer. Employers with 50 or more employees working in the state of Washington will contribute at least 28.48% of the total premium, and their Washington state employees will pay 71.52% of the premium. Employers with fewer than 50 employees working in the state of Washington are not required to contribute the employer portion of the premium. However, they must still withhold the employee premium or pay the employees’ premiums on their behalf. See the State’s PFML website for more information.
