Compliance Monthly Update: August 2024
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Fiduciary breach lawsuit filed against Wells Fargo.
On July 30, a class-action lawsuit was filed by health plan participants against the Wells Fargo group health plan alleging a breach of ERISA fiduciary duties related to the plan’s prescription drug benefits. This is the second case following up on the ongoing and similar Johnson & Johnson case discussed in the February compliance update. These cases are likely the first in a new trend of fiduciary litigation against group health plans. With that in mind, plan sponsors should engage in prudent fiduciary decision-making processes for designing their benefit plans and in their selection of PBMs and other vendors. ERISA does not require plan fiduciaries to select the lowest cost vendors, rather they should make prudent decisions taking in the various factors in the vendor selection process to ensure the plans are designed and administered in participants best interests. Having good documentation and a process in place for making prudent group health plan decisions will generally be the most effective shield against potential lawsuits.
Updated model CHIP Notice released.
The DOL has released a new model employer CHIP Notice (available HERE) with information current as of July 31, 2024. As a reminder, group health plans that maintain a plan with participants who reside in a state that provides premium assistance under Medicaid or CHIP have an annual notice requirement to notify employees of the potential opportunities for premium assistance. The model CHIP notice is updated periodically to reflect changes in the states that offer premium assistance and changes to the relevant state contact information.
Fifth Circuit affirms vacation of portions of surprise billing regulations.
On August 2, the Fifth Circuit affirmed a lower court ruling to vacate key portions of the final regulations implementing the independent dispute resolution (IDR) provisions of the No Surprises Act (NSA). The NSA expanded patient protections to shield individuals from surprise medical bills for certain out-of-network services. The regulatory agencies had issued final regulations related to the “qualifying payment amount” (QPA) and plan payment procedures through the IDR process. Citing the recent Supreme Court Loper Bright decision, the Fifth Circuit held that the regulations improperly restricted the arbitrators’ authority to consider the various factors specified in the NSA when deciding on reimbursement amounts for out-of-network providers’ services. The court held that the regulations wrongly put a thumb on the scale in favor of one factor, the QPA, which is determined exclusively by the insurer and would result in lower reimbursement amounts. This is the latest in a series of rulings leaving the IDR regulations in flux. The regulatory agencies have previously advised in FAQ guidance that plans and insurers are expected to calculate QPAs using a good faith, reasonable interpretation of the NSA and the regulations that remain in effect.
HHS increases civil monetary penalties for HIPAA, MSP, and SBC noncompliance.
On August 8, HHS announced adjusted penalty amounts effective for penalties assessed on or after August 8, 2024, for violations occurring on or after November 2, 2015. The indexed amounts for violations are as follows:
- The HIPAA Privacy and Security Rules have four tiers of violations that reflect increasing levels of culpability, with minimum and maximum penalty amounts within each tier and an annual cap on penalties for multiple violations of an identical provision.
- No Knowledge. For violations where the covered entity does not know about the violation (and by exercising reasonable diligence, would not have known about the violation) the penalty amount is between $141 and $71,162 for each violation. The calendar year penalty cap is $2,134,831 for all violations of an identical requirement.
- Reasonable Cause. If the violation is due to reasonable cause, the penalty amount is between $1,424 and $71,162 for each violation. The calendar year penalty cap is $2,134,831 for all violations of an identical requirement.
- Willful Neglect (but corrected within 30 days). For corrected violations that are caused by willful neglect, the penalty amount is between $14,232 and $71,162 for each violation. The calendar year penalty cap is $2,134,831 for all violations of an identical requirement.
- Willful Neglect (but not corrected within 30 days). For violations caused by willful neglect that are not corrected, the penalty amount is between $71,162 and $2,134,831 per violation. The calendar year penalty cap is $2,134,831 for all violations of an identical requirement.
- Medicare Secondary Payer (MSP) rules prohibit plans from “taking into account” the Medicare entitlement of employees and dependents. The violation for offering incentives to Medicare-eligible individuals not to enroll in a plan that would otherwise be primary is $11,524.
- Summary of Benefits and Coverage (SBC) generally must be provided to participants and beneficiaries before enrollment and during open enrollment. The penalty for a willful failure to provide an SBC is $1,406.
State/Local Compliance Update: July 2024
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
California
San Francisco 2025 HCSO expenditure rates posted.
San Francisco has posted the 2025 minimum healthcare expenditure (HCE) rates under the San Francisco Health Care Security Ordinance (HCSO). The HCSO applies to employers that must obtain a San Francisco business registration certificate and have at least 20 employees in any location if at least one works in the city or county of San Francisco. The HCE is the minimum amount covered employers must spend on healthcare for each hour worked by a covered employee. Employers subject to the HCSO also need to submit an annual reporting form by each April 30 and comply with notice posting requirements. Also note that self-insured employers have until February 1 each year to top-off expenditure rates for the prior year if the employer failed to make the required healthcare expenditures during the prior year.
Colorado
Maximum number of employees to qualify for fully insured, small group market coverage in Colorado is reducing in 2026.
Governor Polis signed SB24-073 that effective January 1, 2025, amends the definition of “small employer” (for purposes of providing fully insured health insurance coverage) as any person that employs an average of at least one but not more than 50 employees during the calendar year.
- Current law defines a “small employer” as any individual, firm, corporation, partnership, or association that employs between one and 100 employees during a calendar year.
- An employer that has a small group health benefit plan before January 1, 2026, and would no longer qualify as a “small employer” under the changes made by SB24-073 may elect to keep their small group health benefit plan for 5 years after the date of issuance. Such employer may also switch between small group health benefit plans offered by the carrier during those 5 years but may only switch to plans that are one metal level above or below their existing plan. Once an employer elects to enter the large group health benefit market, the employer may not return to the small group health benefit market within the 5-year period.
- Note also that the law requires the commissioner of insurance to conduct an actuarial review of rate filings submitted by insurance carriers that offer small group health benefit plans to determine whether the change to the definition of “small employer” would increase premiums for the majority of individuals covered by small group health benefit plans by more than 3%. If the premiums would increase by more than 3%, then the change to the “small employer” definition made by SB24-073 will be repealed.
Colorado amends regulations on when small group health plans can terminate adult dependent coverage due to age.
Under Amended Regulation 4-2-43, for small employer group plans, dependent coverage cannot be terminated, on the basis of age, before the end of the plan year in which the dependent attains age 26. This expands on the ACA requirement, where if a plan provides dependent coverage for children, the coverage must be available until age 26—which in most cases was administered so that coverage would be available until the end of the month in which the dependent turned 26.
