Compliance Monthly Update: June 2024
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Reminder that PCORI fee and filing is due by July 31.
The annual ACA Patient-Centered Outcomes Research Institute (PCORI) filing and fee on insurers and sponsors of self-funded medical plans (including HRAs) is coming up. The filing and payment due July 31, 2024, is required for policy and plan years that ended during the 2023 calendar year. For plan years that ended January 1, 2023 – September 30, 2023, the fee is $3.00 per covered life. For plan years that ended October 1, 2023 – December 31, 2023
(including calendar year plans that ended December 31, 2023), the fee is $3.22 per covered life. The PCORI fee is reported and paid using IRS Form 720. See the Form 720 Instructions for more information and instructions on reporting and paying the fee. As a reminder:
- Insurers report and pay the fee for fully insured group medical plans.
- For self-funded plans, the plan sponsor (e.g., the employer) reports and pays the fee.
- An employer that sponsors an HRA along with a fully insured medical plan must pay the PCORI fee based on the number of employees (dependents are not included in this count) participating in the HRA, while the insurer pays the PCORI fee on the individuals (including dependents) covered under the insured plan.
- Where an employer maintains an HRA along with a self-funded medical plan and both have the same plan year, the employer pays a single PCORI fee. Each person covered by both plans is only counted once. If the HRA covers anyone who is not also covered under the self-funded medical plan, the sponsor counts those individuals using the one life per participant rule.
Updated Change Healthcare Cybersecurity Incident FAQs.
On May 31, HHS updated their Change Healthcare Cybersecurity Incident FAQs and issued a press release to make clear that:
- Covered entities impacted by the Change Healthcare breach may delegate to Change Healthcare the tasks of providing the required HIPAA breach notifications on their behalf.
- Only one entity—which could be the covered entity itself or Change Healthcare—needs to complete breach notifications to impacted individuals, HHS, and where applicable the media.
- If covered entities work with Change Healthcare to perform the required breach notifications in a manner consistent with the HITECH Act and HIPAA Breach Notification Rule, they would not have additional HIPAA breach notification obligations.
Supreme Court dismisses case challenging FDA approval of abortion medication.
On June 13, the US Supreme Court issued a ruling preserving the FDA approval and availability of mifepristone (known as the abortion pill). The Court unanimously dismissed the case on procedural grounds holding that the plaintiffs (anti-abortion doctors and medical groups) did not have standing to sue. Because the Court’s decision did not address the underlying merits of the case, this issue could be before the Court again at some point.
IRS issues FAQs and sample plan document for educational assistance programs.
On June 17, the IRS issued FAQs addressing educational assistance programs (EAPs) and also provided a sample document that employers can use as a template plan document for their own program. As a reminder, an EAP established under IRS Code Section 127 allows employers to provide employees with tax-free qualified educational assistance benefits—including payments for tuition, fees, books, supplies, and equipment. Since March 27, 2020, they also include payments by an employer for an employee’s principal or interest payments on qualified education loans, but this change is temporary and set to expire at the end of 2025 (unless extended by Congress). Employees may exclude from their gross income up to
$5,250 in qualified educational assistance benefits per year. Employers are not required to report these benefits on employee’s Form W-2, and amounts paid under these programs generally are deductible by the employer as business expenses. An EAP must be established in a written plan document and are subject to nondiscrimination testing requirements that prohibit discrimination in favor of highly compensated employees.
Court invalidates part of HIPAA online tracking technologies guidance.
On June 20, a federal court issued a ruling vacating part of an HHS bulletin regarding the HIPAA obligations of covered entities and business associates when using online tracking technologies. Tracking technologies (such as pixels, cookies, and web beacons) are scripts or codes that collect and analyze information about users as they interact with a website or app. The HHS bulletin was issued in 2023 to address potential impermissible disclosures of protected health information (PHI) when tracking technologies are used. At issue in this case was HHS’ broad interpretation of PHI to include a user’s IP address when the user visits a public facing, unauthenticated webpage with information about specific health conditions or healthcare providers (“Proscribed Combination”). The court found the HHS bulletin unlawfully expanded the definition of PHI to include data that could not reasonably identify an individual or their health condition without knowing the user’s subjective intent for the visit, and therefore, the Proscribed Combination related guidance cannot be enforced and is to be removed from the bulletin. The bulletin now includes a note about this decision and a statement that “HHS is evaluating its next steps.”
Fifth Circuit limits prior Braidwood ACA preventive care ruling—leaving preventive care mandate requirements intact (at least for now).
On June 21, a three-judge panel at the Fifth Circuit issued a mixed ruling on the validity of the ACA preventive health services mandate. The Fifth Circuit upheld a lower-court ruling that preventive-care mandates for ACA health plans are unconstitutional, but the court said the ruling should apply only to the plaintiffs.
- As background, the ACA requires health plans to cover preventive care with no cost-sharing for participants, and the ACA empowers three agencies—the U.S Preventive Services Task Force (PSTF), the Health Resources and Services Administration (HRSA), and the Advisory Committee on Immunization Practices (ACIP)—to determine what kinds of preventive care fall within each category of mandatory coverage by issuing guidelines or recommendations.
- In March of 2023, a district court ruled in the Braidwood case that the ACA requirement to provide preventive care as recommended by the PSTF is unconstitutional and issued a nationwide injunction that prohibited the federal government from enforcing the ACA preventive care mandate. However, that district court ruling was stayed pending the outcome of the appeal.
- The Fifth Circuit has now affirmed that the PSTF’s members have not been validly appointed under the Constitution because they were not nominated by the President and confirmed by the Senate. The court explained that this appointment process is necessary due to the level of power exercised by the PSTF in making recommendations on preventive services required to be covered under the ACA. Under this ruling, HHS is enjoined from enforcing PSTF recommendations, but only as to the Braidwood plaintiffs. The court reversed the trial court’s decision to vacate all agency actions taken to enforce the preventive care mandates and to universally block the agencies from enforcing the mandates with a nationwide injunction. The court withheld judgment and remanded the case back to the trial court to determine if the members of HRSA and ACIP were also unconstitutionally appointed.
- So, although the Fifth Circuit has ruled that some aspects of the ACA preventive service requirements are unconstitutional, those requirements still apply to group health plans nationwide (except for the plaintiffs who brought this lawsuit). Therefore, the preventive services requirement remains intact for now.
- Plan sponsors should monitor this litigation as it proceeds and be on the lookout for regulatory guidance that may be released addressing this ruling. The issues regarding the HRSA and ACIP will be presented to the district court. The government may also seek rehearing by the full Fifth Circuit to consider the constitutional issue, or the government may seek Supreme Court review of the issue.
Supreme Court overturns Chevron deference and opens door to increased legal challenges to federal regulations.
On June 28, the US Supreme Court overturned long standing precedent under which courts afforded deference to federal regulation agencies’ interpretation of a statute administered by the agency if the statute was silent or ambiguous regarding the applicable issue (initially set forth in the 1984 Chevron Supreme Court ruling). The overturning of Chevron fundamentally alters the landscape of administrative law. And while the specific impacts are still unclear, it will affect the world of employee benefits.
- The Supreme Court held that Chevron deference conflicts with the Administrative Procedure Act (APA), which establishes procedures for agency action. And the APA’s judicial review provisions require courts to apply their own judgment in deciding questions of law, and do not provide for any deference on legal matters. Note that the APA does provide for judicial deference to agencies on factual matters (but not questions of law).
- In overruling Chevron, the Supreme Court is now instructing courts to exercise their independent judgment in interpreting the law, and consequently, courts may not defer to an agency interpretation of the law simply because the statute is ambiguous. However, the Supreme Court noted that the holdings of prior cases that relied on Chevron deference remain lawful and may not be overturned solely because they relied on Chevron.
- This decision should have far-ranging impacts on essentially all federal rulemaking, including regulations impacting group health plans. There is expected to be an increase in challenges to agency guidance, with regulatory provisions more likely to be limited or overturned entirely, which likely will create a period of uncertainty as new judicial precedents are established. The decision may also impact how Congress drafts future legislation and how agencies approach rulemaking.
State/Local Compliance Update: June 2024
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
Colorado
Colorado enacts law regulating the use of AI systems. Governor Polis has signed Senate Bill 24-205, “Concerning Consumer Protections in Interactions with Artificial Intelligence Systems,” making Colorado the first state to enact a broad regulatory framework for the development and use of artificial intelligence (AI) systems. The law takes effect February 1, 2026, and generally focuses on “high-risk” AI systems, which are defined as any AI system that, when deployed, makes, or is a substantial factor in making, a consequential decision. A “consequential decision” means a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of, among other services, health care services. The new law generally will require developers of “high-risk” AI systems and the businesses that use them to take extensive measures to avoid algorithmic discrimination—a use of AI that results in “unlawful differential treatment or impact” based on a protected classification such as age, race, sex or religion. Colorado employers that use AI, or are considering using AI, should consider what, if any, steps they may have to take to ensure that the necessary AI governance programs and risk management policies and processes are in place when the new law takes effect in 2026.
District of Columbia (DC)
Increase to 2025 payroll tax for Universal Paid Family Leave Program. On June 12, the DC City Council passed the 2025 fiscal year budget which includes a 0.49% increase (from 0.26% to 0.75%) to the mandatory employer payroll tax to support the Universal Paid Family Leave Program. Previously, the program mandated that payroll taxes paid by employers cover the cost of providing paid family leave to employees working DC. Now, under the changes made by the Council, a portion of the money collected from employers to fund the program is no longer being allocated directly to financing the benefits granted by the program. That is, rather than depositing this increase into the Universal Paid Leave Fund for future program expenses, the Council’s revised budget would redirect this money into the District’s General Fund to be spent on other, unrelated programs. This would mark the first time since the passage of the Universal Paid Leave law in 2016 that program payroll taxes would be used for purposes other than paid leave.
Maine
Proposed rules issued for Maine’s Paid Family and Medical Leave Program. The Maine DOL released proposed rules governing the Maine Paid Family and Medical Leave Program. The proposed rules provide greater detail as to how Maine plans to implement and enforce the new program that provides Maine employees up to 12 weeks of family and medical leave benefits over a one-year period. Employees can begin receiving paid leave benefits on May 1, 2026, and employer contributions to the plan funding those benefits begins on January 1, 2025.
Michigan
BCBS of Michigan dropping coverage of GLP-1 weight loss drugs. Blue Cross Blue Shield of Michigan has announced that their large group, fully-insured plans will no longer cover GLP-1 drugs (e.g., Ozempic and Wegovy) to treat obesity beginning in 2025. The insurer cited concerns over safety, effectiveness, and cost as the reasons for the decision.
Minnesota
Minnesota amends Earned Sick and Safe Time Act and Paid Family Leave Law. Governor Walz has signed legislation amending the Minnesota Earned Sick and Safe Time (ESST) Act that went into effect January 1, 2024. Some of the changes include increased potential penalties, clarification of the rate of pay for ESST, an amended definition of “employee,” and amended reasons for use of ESST. The legislation also amended the Minnesota Paid Family Leave (PFL) Law that goes into effect January 1, 2026. The PFL changes include amended definitions, clarifications on minimum increments of leave, small employer assistance grants, and a reduced small employer premium rate.
Minnesota enacts data privacy law. Minnesota has become the latest state to enact a comprehensive consumer data privacy law. The Minnesota law adopts a similar framework as most other state privacy laws. The law applies to legal entities that conduct business in Minnesota or produce products or services targeted to Minnesota residents and: (a) during a calendar year, control or process personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) derive over 25% of gross revenue from the sale of personal data and process or control personal data of at least 25,000 consumers. Note, however, that the law exempts covered entities and business associates subject to HIPAA and exempts data that is considered PHI under HIPAA.
