Compliance Monthly Update: April 2024
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
2025 Benefit and Payment Parameters and ACA FAQ (Part 66) on EHB Rx drug requirements.
On April 2, HHS released final regulations (and an associated news release and fact sheet) for benefit payment parameters and other ACA market rules for 2025. The final regulations are primarily of interest to insurers and state Exchanges/Marketplaces. Note, however, that the final regulations and an ACA FAQ (which was issued at the same time as the final regulations) clarify certain essential health benefits
(EHB) prescription drug requirements and codify the HHS policy that prescription drugs that a plan covers in excess of those covered by a state’s EHB-benchmark plan are considered EHBs and are subject to the annual limitation on cost-sharing and the prohibition on annual and lifetime dollar limits (unless the coverage of the drug is subject to a state mandate).
The provision applies only to non-grandfathered individual and small group market plans that are subject to the requirement to provide EHBs. The FAQ clarifies that the regulations do not apply to large group market and self-insured health plans – but indicates that the regulatory agencies intend to propose future rulemaking that will require these plans to treat prescription drugs covered by the plan in excess of the applicable EHB benchmark as EHBs for purposes of the annual limitation on cost-sharing and the prohibition on annual and lifetime limits.
Future guidance along these lines could undermine certain current plan designs. For example, some plans (working with vendors) have implemented programs to control drug spend, often referred to as “co-pay or cost-sharing maximizers” or “variable copay programs” where the plan determines cost-sharing for a non-EHB drug based on the maximum amount of copay assistance that a patient could receive from a drug manufacturer. Because the drug is not considered an EHB, this cost-sharing amount would not be subject to the cost sharing limits – and, therefore, could exceed the limits with the intent that the cost-sharing will be covered by the drug manufacturer assistance. These programs are designed to allow plans to use the full benefit of drug manufacturer payment assistance. Also, the ability of plans to characterize some prescription drugs as non-EHBs allows plans to cover certain high-cost drugs (which might otherwise be cost-prohibitive), because the plan is able to impose more substantial cost-sharing, and not count the cost-sharing to the max out-of-pocket limit, and/or impose annual or lifetime dollar limits.
2025 Medicare Part D plan design requirements and the impact on the "creditable" status of group health plans.
CMS issued Final CY 2025 Part D Redesign Program Instructions which have been updated due to changes made to Medicare Part D by the Inflation Reduction Act of 2022 (IRA). The IRA made several changes that impact the structure of the defined standard Medicare Part D drug benefit. The changes increase the richness (or the actuarial value) of the Part D benefit (e.g., by providing a cap on out-of-pocket spending of $2,000, beginning in 2025).
- This is relevant to group health plans because plan sponsors are required to notify Medicare-eligible plan participants (and CMS) whether plan coverage is “creditable” (i.e., if it has an actuarial value that equals or exceeds standard Part D) or if the coverage is “non-creditable.” If an individual has creditable coverage, they avoid the penalty for joining Part D late (i.e., after they are first eligible).
- he draft instructions (discussed last month) provided that a method that was previously available to do a simplified calculation of the actuarial value for plans would no longer be available, leaving a more complex and costly method to assess the actuarial value. However, in the final instructions, HHS acknowledged receiving numerous comments expressing concern that the Part D benefit changes in the IRA will increase the actuarial value of the Part D benefit in 2025 to the point where group health plans meeting previous creditable coverage requirements may no longer meet the requirements. So, CMS clarified in the final instructions that it will continue to permit the use of the creditable coverage simplified determination methodology for 2025. But the final instructions further state that CMS will reevaluate the continued use of the existing creditable coverage simplified determination methodology, or establish a revised methodology, for 2026.
- • Whoever is determining a plan’s creditably status (which is typically the carrier or TPA) will need to review the plan’s prescription drug benefits and determine its status for 2025. It appears that most plans will continue to use the simplified creditable coverage determination method for 2025, and under this method, a plan’s creditability status likely will not change.
- But plan sponsors should be prepared for potential modifications or a completely new simplified method for 2026 and beyond. And with the newly enriched Part D benefit under the IRA, it may be more difficult for plans to demonstrate that their coverage is creditable, particularly for HDHPs.
- Remember that plan sponsors are not required to offer plans that provide creditable coverage. But, if a plan’s status is changing from creditable to non-creditable based on the new Part D benefit design requirements, plan sponsors should consider issuing a special communication regarding the change and provide the notice of non-creditable coverage to allow participants to determine if they should enroll in Part D to avoid a potential late enrollment penalty. Also, Medicare provides individuals with a special enrollment period within 2 full months of the later of (1) a loss of creditable coverage or (2) when notified that coverage is no longer creditable.
Ninth Circuit clarifies pleading standard for Mental Health Parity violations.
In a ruling involving a health insurer’s use of algorithms to process substance use disorder claims, the Ninth Circuit has allowed litigation under the Mental Health Parity and Addiction Equity Act (MHPAEA) and ERISA to proceed.
- The participant in this case alleged that the insurer applied a more rigorous review process (involving use of a system of algorithms) to benefits for outpatient, out-of-network (OON) mental health and substance use disorder (MH/SUD) treatments than to otherwise comparable medical/surgical (M/S) treatments. The court addressed standards for MHPAEA plaintiffs in pleading claims involving a plan’s internal claims administration processes.
- As a reminder, MHPAEA requires that any limitations on MH/SUD benefits in a plan be no more restrictive than the predominant treatment limitations applied to substantially all covered M/S benefits. To succeed, a plaintiff must show a plan that offers both M/S and MH/SUD benefits imposed a more restrictive limitation on MH/SUD treatment than limitations on treatment for M/S issues. The court identified three situations in which such a violation might occur:
- Facial exclusion cases (a plaintiff can allege that a plan contains an exclusion that is discriminatory on its face).
- “As-applied” cases (a plaintiff can allege that a plan contains a facially neutral term that is discriminatorily applied to MH/SUD treatment).
- Internal process cases (a plaintiff can allege that a plan administrator applies an improper internal process that results in the exclusion of an MH/SUD treatment).
- The Ninth Circuit classified this case in the 3rd category, noting that the participant alleged the insurer used improper internal procedures to adjudicate whether outpatient, OON MH/SUD claims were covered under the plan. At issue, as a result, was the correct pleading standard for improper internal process cases under MHPAEA. Then, the Ninth Circuit indicated that to plead an internal process case, a plaintiff must:
- (a) Simply allege facts that adequately suggest that the challenged process is specific to MH/SUD claims.
- (b) Plausibly allege the existence of a procedure for assessing MH/SUD claims that is more restrictive than the one used to evaluate other claims in the same classification.
- (c) And offer some reason for believing that an MH/SUD claim denial was affected by a process that did not apply to M/S claims (though merely alleging an MH/SUD-related denial, with nothing more, is unlikely to meet this standard).
- Under these standards, the court held that the participant’s allegations were adequate to allege a plausible MHPAEA violation, and therefore, the participant’s claim should not be dismissed.
- Plan sponsors should note that this ruling only addresses the pleading standard – a plaintiff still must prove the existence of a violation of the Parity Act. However, with this pleading standard, it opens the door to putative class actions based on alleged MHPAEA violations and likely will result in situations in which discovery and class certification litigation will be more common.
IRS FAQs on the tax treatment of work-life referral services.
The IRS released FAQ guidance on the tax treatment of employer-provided work-life referral (WLR) services. WLR services generally are employer-provided benefits to assist employees in finding resources and support for personal, work, or family challenges through informational and referral consultations. These benefits are typically integrated into an EAP or bundled with other employer services, and encompass a wide range of employee support – including guidance on accessing child and elder care, health care, and financial and legal services, as well as assistance with related paperwork and administrative tasks. This IRS FAQ guidance states that, for tax purposes, WLR services are treated as de minimis fringe benefits and, therefore, are excluded from income and are exempt from employment taxes (FICA, FUTA, and income tax withholding). In general, a de minimis fringe benefit (which is not subject to income taxation) is a small and infrequent perk that is impractical to account for due to its minimal value and rare occurrence. The IRS takes the position that WLR benefits are to be treated as de minimis fringe benefits because they are used infrequently by employees and only when an employee faces one of the challenges the programs are designed to address.
FAQ guidance addressing Change Healthcare cyberattack.
On April 19, HHS issued FAQ guidance related to its investigation of the recent ransomware cyberattack on Change Healthcare (a unit of UnitedHealthcare Group (UHG)). Change Healthcare serves as a HIPAA business associate for health plans and providers nationwide. Last month, HHS announced in a letter (discussed in our March compliance update) that they initiated an investigation into the incident to determine whether a breach of protected health information (PHI) occurred.
HHS notes in the FAQ guidance that while there have been no HIPAA breach reports related to the cyberattack (yet), the investigation was opened due to the threat posed to health care and billing information operations nationwide. Covered entities and business associates are reminded of their obligations under HIPAA to have business associate agreements in place and to ensure that timely breach notification occurs. HHS explains that, for regulated entities impacted by the cyberattacks, a breach is presumed to have occurred unless it is demonstrated that there is a low probability that the PHI has been compromised (as outlined in the breach notification rule). HHS will update their guidance as needed and provide links to resources to help covered entities and business associates satisfy their HIPAA compliance obligations.
HIPAA privacy rule amendment to support reproductive health care privacy.
On April 22, HHS issued a final rule (and an associated fact sheet and press release) amending the HIPAA privacy rule to support reproductive health care privacy. This is in response to concerns about the confidentiality of protected health information (PHI) following the U.S. Supreme Court’s Dobbs decision holding that the Constitution does not prohibit states from regulating or banning abortion. This final rule:
- Expands the definition of “health care” to include “reproductive health care” – which is care that affects the health of the individual in all matters related to the reproductive system and to its functions and processes.
- Prohibits the use or disclosure of PHI by a covered entity or business associate (i.e., regulated entities) for a criminal, civil, or administrative investigation into or proceeding against a person in connection with seeking, obtaining, providing, or facilitating reproductive health care, where the health care is lawful. Regulated entities are also prohibited from using or disclosing PHI for the purpose of identifying an individual, health care provider, or other person for purposes related to such an investigation or proceeding where the reproductive care is lawful. Reproductive health care is presumed to be lawful unless the regulated entity has actual or factual knowledge that it was unlawful.
- Requires when a regulated entity receives a request for PHI relating to health oversight activities, judicial or administrative proceedings, law enforcement purposes, or disclosures to coroners or medical examiners, and the PHI is potentially related to reproductive health care, the entity must obtain a signed attestation. The final rule provides details on content and distribution requirements for the attestation, as well as specifics of what makes it valid or defective. HHS intends to publish a model attestation prior to the rule’s compliance date of December 22, 2024.
- Requires the HIPAA Notice of Privacy Practices (NPP) be revised to reflect these rules on reproductive health care privacy and provisions on confidentiality of medical records relating to individuals with substance use disorders. Note that compliance with this NPP provision is not required until February 16, 2026.
- Permits disclosure to law enforcement only when regulated entities suspect an individual of obtaining reproductive health care where the disclosure is not subject to the prohibition, is required by law, and meets all applicable conditions of the Privacy Rule permission to use or disclose PHI.
HHS provides update on progress of advanced explanation of benefits guidance.
On April 23, HHS released a high level update on its progress toward advanced explanation of benefits (AEOB) rulemaking and implementation. The update does not include any discussion of the timeframe for implementation of this requirement for group health plans – although the need to develop new technical standards (discussed below) suggests further delay.
As a reminder, the transparency provisions of the Consolidated Appropriations Act, 2021 (CAA) require health care providers to provide an individual’s health plan a good faith estimate (GFE) of the expected charges for furnishing an item or service (upon scheduling or at the participant’s request). Upon receiving a provider’s GFE, health plans must send the participant an AEOB that includes the GFE and other information, such as the provider’s network status and an estimate of the amount the plan is required to pay.
The regulatory agencies have deferred enforcement of the GFE and AEOB requirements for plans until regulations implementing the requirements are issued and applicable. HHS advised that delays in issuing regulations were attributed to complexities in developing technical infrastructure for transmission of data from providers to plans and insurers. In this update, HHS notes that in a study it conducted of the health care industry’s business and technology needs and the capabilities of providers and payers, researchers recommended that HHS propose a single data exchange standard for the receipt of GFEs by payers and the transmission of AEOBs from payers to providers. The study suggested that existing technical standards may not be sufficient to meet the insured GFE and AEOB requirements – so, new standards may need to be developed to ensure successful implementation. It appears, therefore, that final rules implementing the AEOB requirement should not be expected anytime soon.
Final regulations expand ACA Section 1557 nondiscrimination protections.
On April 26, HHS issued final regulations (and a news release, fact sheet, and FAQs) expanding protections under ACA Section 1557, which prohibits discrimination in certain health programs and activities on the basis of race, color, national origin, sex, age, or disability.
As background, the original Section 1557 regulations (that took effect in 2016) applied broadly to all health programs and activities funded or administered by HHS, including Exchange insurers – even with respect to plans and services they offered outside an Exchange or, in some instances, as TPAs for employer group health plans. In 2020, HHS repealed significant portions and narrowed the regulations so that entities not principally engaged in providing health care (such as most health insurers) were regulated only with respect to their health care activities funded by HHS (rather than their entire operations).
In these new 2024 final regulations, HHS reinstates the scope of the 2016 regulations and expands the rules further. These regulations will likely be subject to litigation and challenges (as were the prior 2016 and 2020 regulations). Highlights of the new regulations include:
- Application to insurers, TPAs, and PBMs. These regulations return to a broader definition of health programs and activities and clarify that health insurers that receive federal financial assistance are covered entities – and the rules apply to all the operations of a covered entity, including an insurer’s TPA activities. PBMs are also covered by the regulations if they receive federal financial assistance or are part of another covered entity’s operations. Although, the regulations do not include group health plans as covered entities since most group health plans are not recipients of federal financial assistance – the rules will indirectly apply to group health plans through their carrier, TPA, or PBM. Note also that the rules do not directly apply to employers with regard to their employment practices, including the provision of employee health benefits as a plan sponsor.
- Religious freedom protections. Covered entities may rely on applicable federal religious freedom and conscience laws to dispute the application of Section 1557. The final regulations provide an administrative process for obtaining a written assurance of exemption.
- Discriminatory benefit designs. HHS reiterates that covered entities are prohibited from implementing benefit designs that discriminate on any protected basis but declined to define the term or provide specific examples in the regulations. However, the preamble suggests that benefit design features subject to the rules would include, (1) coverage, exclusions, and limitations of benefits; (2) prescription drug formularies; (3) cost-sharing (including copays, coinsurance, and deductibles); (4) utilization management techniques (such as step therapy and prior authorization); (5) medical management standards (including medical necessity standards); (6) provider network design; and (7) reimbursement rates to providers and standards for provider admission to participate in a network. The regulations include a delayed applicability date (the first day of the plan year beginning on or after January 1, 2025) to the extent that they require design changes to coverage newly subject to Section 1557.
- Discrimination on the basis of sex. Consistent with developing case law on identifying unlawful sex discrimination, the regulations provide that “discrimination on the basis of sex” specifically includes discrimination based on sexual orientation, gender identity, sex characteristics, pregnancy, and sex stereotypes. While covered entities are not required to provide coverage for a particular health service (for example, surgical treatment for gender dysphoria), the final rules prohibit the exclusion of categories of services in a discriminatory manner.
- Artificial intelligence (AI) support tools. The final rule requires covered entities to make reasonable efforts to identify and mitigate risks of discrimination by patient care decision support tools (such as AI or clinical algorithms) that use factors that measure race, color, national origin, sex, age, or disability. This covers, for example, tools used by insurers for screening, risk prediction, diagnosis, prognosis, clinical decision-making, treatment planning, health care operations, and allocation of resources, such as automated decision systems supported by AI for prior authorization and medical necessity analyses. HHS explains that they are trying to balance technology’s role in reducing health disparities and increasing access to care with the need for responsible use of these tools that does not lead to discrimination in patient care.
- Required notices. Covered entities must begin providing an annual notice of nondiscrimination along with a notice of the availability of language assistance services to participants, beneficiaries, enrollees, and applicants. The FAQs accompanying the final regulations note that HHS has prepared sample notices in multiple languages to assist with this requirement.
- Effective date. The effective dates vary based on the specific requirement. The general effective date is 60 days after the rules are published in the Federal Register (on May 6, 2024). However, benefit design changes are not required until the first day of the first plan year beginning on or after January 1, 2025. The notice of nondiscrimination is required within 120 days after the general effective date and the notice of availability of language assistance services is required within one year after the general effective date. For detailed information on the effective dates, see FAQ #4.
DOL rescinds association health plan regulations.
On April 29, the DOL issued final regulations (and a fact sheet and news release) officially rescinding prior association health plan (AHP) regulations that were issued in 2018. The 2018 AHP guidance had attempted to broaden the definition of an AHP to allow more groups of unrelated employers to join together to get better pooled rates. But a court struck down those rules in 2019, and the DOL gave employers a short period of time to wrap up any AHP that had relied on the 2018 guidance. The DOL has now officially rescinded those prior AHP rules to
“resolve and mitigate any uncertainty” regarding the 2018 rule. This should not impact any current plan sponsors because there should not be any AHPs currently in existence that rely on the 2018 rule. Any current AHP needs to comply with the more restrictive pre-2018 AHP guidance that an employer group or association will be an “employer” that may establish a single ERISA plan if it is a “bona fide” association of employers with a genuine organizational relationship and an ability to control the association. As noted in the fact sheet, these plans are generally multiple employer welfare arrangements (MEWAs) that are subject to ERISA and may also be subject to state insurance laws.
State/Local Compliance Update: April 2024
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
Idaho
Idaho PBM reform legislation signed into law. On April 1, Governor Little signed HB 596 with wide ranging PBM reforms that focus on transparency and reporting. Highlights of the bill include:
- Requires PBMs to report all rebates and to use pass-through pricing instead of spread pricing.
- Requires network adequacy standards at or above Medicare.
- Limits patient steering.
- Prohibits use of arbitrary accreditation standards.
- Sets parameters for what can be considered a specialty drug.
- Establishes reimbursement appeals processes. development. This law is set to take effect on July 1 and will likely face legal challenges.
Illinois
Updates to Cook County Paid Leave Ordinance. On March 14, Cook County passed an amendment to the new Cook County Paid Leave Ordinance. The amendment postpones the implementation of the ordinance for public school districts and park districts until January 1, 2025. In addition, the County approved a final draft of proposed rules that clarify certain employee rights and employer responsibilities under the ordinance. As a reminder, last year Cook County passed a new Paid Leave Ordinance (that replaced the preexisting Cook County Earned Sick Leave Ordinance) that requires employers to offer paid leave that can be used for any reason to most employees in Cook County. Under the new ordinance (that was effective December 31, 2023) covered employees can earn and use up to 40 hours of paid leave annually. Employers must post a paid leave notice that will be provided by the County in a conspicuous place at each facility in the County. A notice must also be provided to employees when they are hired. The new County ordinance largely mirrors that of the statewide Paid Leave for All Workers Act (PLAWA) which took effect on January 1, 2024. Employers covered by this new ordinance are covered only by the local law and not the statewide PLAWA. See the Cook Country Paid Leave Ordinance webpage for updates and additional guidance.
New York
New York is first state to mandate paid prenatal leave. On April 22, Governor Hochul signed new legislation expanding New York’s Paid Family Leave Law to provide 20 hours of paid leave for attending prenatal medical appointments (“paid prenatal personal leave”). This benefit is in addition to state sick or paid leave under New York’s Paid Family Leave Law (that provides employees with paid family leave for qualifying absences such as bonding with a newborn, adopted, or fostered child, or caring for a family member with a serious health condition). Under the new law (that takes effect January 1, 2025) employers must provide a separate bank of paid prenatal leave for employees to use without reducing existing paid leave benefits, including paid family leave. This new leave entitlement was included in New York’s final 2025 budget.
Pennsylvania
Pennsylvania aligns federal and state tax treatment of DCAPs. Pennsylvania HB 1300 was signed into law and changes the state’s tax treatment of dependent care assistance programs (DCAPs) so that contributions are excludable from income for state personal income tax purposes. This change brings Pennsylvania into alignment with the federal tax treatment, which allows employees to exclude from income up to $5,000 (or $2,500, if married and filing separately) contributed to a DCAP. Note that this change is retroactive for the 2023 tax year. Employers in Pennsylvania should take note of the updates made by HB 1300 and review whether they made the necessary adjustments to employees’ Forms W-2. If employers have issued Forms W-2 to employees that include amounts contributed to dependent care assistance programs in employees’ taxable wages, they may want to consider issuing corrected forms or written statements to employees to verify amounts employees self-correct. The state provided additional information for employers and employees HERE.
