Pulling it together: high-risk pools can manage HIPAA compliance costs by taking a step-by-step approach. (Health Insurance Portability and Accountability Act).
One approach to this public need is the creation of special high-risk pools to provide health insurance for such individuals and their families. High-risk pools usually are state-mandated nonprofit associations offering comprehensive health insurance benefits to the "medically uninsurable." These pools, now operating in 30 states, guarantee access to health insurance at regulated rates for approximately 173,000 individuals nationwide, protecting them from catastrophic medical bills. High-risk pools also help keep private insurance markets viable.
As commercial insurers and employer plans attempt to control costs through stricter underwriting criteria and greater benefit limitations, high-risk pools have become an increasingly important safety net for hard-to-insure risks. New government mandates on all insurance products, however, such its the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, throw down yet another challenge to providing cost-effective coverage to risk-pool constituents.
In many ways, HIPAA's declaration of an individual's right to privacy for Iris or her medical information seems ideally suited for those with pre-existing conditions. Members of this group have legitimate concerns that knowledge of their conditions could be misused by employers, sales organizations and the community. Nonetheless, HIPAA compliance has an immediate cost impact that provides a special challenge to high-risk pools to continue cost-effective operations and to preserve a public-policy mission.
HIPAA and High-Risk Pools
Three issues are especially significant for high-risk pools in meeting regulations such as those in HIPAA, and ha managing their costs:
* Many of the people insured through high-risk pools have a chronic or serious medical condition. Therefore, the confidentiality and security of medical information, and even confidentiality of the individual's participation in the pool, are especially critical.
* The enrolled population in any given state pool is likely to be relatively small, averaging a few thousand insureds. Thus, there is little opportunity to spread fixed costs for compliance across a significant base of insureds.
* Premiums are limited, as are high-risk-pool budgets, thus providing little opportunity to "pass on" to insureds additional operating costs that might result from compliance efforts.
A closer look at how the Health Reinsurance Association, a high-risk pool based in Connecticut, managed the administrative simplification provisions of HIPAA provides insight on operational issues and their resolution. The association's first step was to determine, with outside legal help, that the high-risk pool was a "covered entity. "As a covered entity, it had to meet HIPAA's privacy and security standards and be capable of accepting and processing standard electronic transactions when requested by its business partners.
As a result of this legal determination, HRA's board, under the direction of its risk-pool administrator, Pool Administrators Inc., decided to invest in a comprehensive overhaul of systems and procedures to align its business operations with HIPAA's privacy, security and transaction mandates. PAI was especially mindful of the significant risk of wrongful disclosure that stemmed from the higher than standard use of treatment services and the tar more frequent need to share information among providers for the high-risk individuals it served.
"With only approximately 2,400 insured members, HRA's compliance budget was limited. Moreover, premiums only partially covered operational costs. The state's private insurers, who also comprised the organization's board of directors, covered the difference between operational costs and received premiums," said Karl Ideman, president of Wetherfield, Conn.-based PAI.
HRA relies on PAI as its plan administrator for enrollment, eligibility and billing, as well as coordination of third-party administrative contracts for provider networks and claims. The pool had previously established and funded a paper-intensive operational process and a technical environment that would not have been able to meet the standards required for HIPAA security and transactions.
As the plan administrator, PAI could have modified existing operations sufficiently, at some cost, for meeting the privacy requirements. The legacy system that HRA had funded, however, lacked capabilities to send and receive transactions in the new standard formats, and system security capacities were similarly limited. HRA decided that the compliance investment must produce additional benefits and efficiencies to assure the pool's longer-term viability and minimize costs.
With the compliance effort, HRA established the following strategic goals:
* Improve business efficiencies and effectiveness through technology.
* Reduce business costs by automating and integrating processes.
* Improve quality and audit ability of information.
* Protect personal health information through policies, procedures and training.
* Develop a compliance program that would be replicated for other state high-risk pools that may choose to take advantage of PAI's administrative services and thus better manage their own compliance costs.
HRA, working through PAI, began its compliance efforts with an emphasis on understanding current operations and the use of state-of-the art technologies.
Initial activities included:
* Preparing detailed documented privacy policies and procedures.
* Reviewing the current technical environment.
* Reviewing the functional business requirements and identification of all HIPAA needs.
* Reviewing the data structures to ensure that they met the HIPAA electronic data interchange standards.
* Evaluating the technical infrastructure and identifying all the HIPAA issues.
* Reviewing the technological security structure and vulnerability.
Based on that review, HRA completed its compliance activities according to the following priorities:
* Achieving HIPAA awareness, education and high-level regulatory review.
* Reviewing and modifying current procedures and organizational structure.
* Assessing detailed functional specifications required under HIPAA, including information technology application and technical infrastructure needs.
* Developing information systems work flow and process flow to ensure HIPAA compliance.
* Building a focused system and application that specifically addressed those needs.
To effectively manage costs and to help identify, efficiencies better, HRA relied on Milliman USA as an outside consultant with HIPAA expertise and a long history of supporting the high-risk pool. An additional advantage of using this nationally recognized firm was to provide assurance on the compliance effort to regulators and to insurance company board members.
Throughout the HIPAA implementation process, PAI on behalf of HRA took a number of steps to more effectively manage costs. PAI, for example, made a point of limiting the consultant's role to evaluation, design and review functions, relying on lower-cost internal staff and boutique contracting firms for the day-to-day effort necessary for achieving compliance. Systems modifications to achieve transaction compliance also incorporated changes important to HIPAA's privacy and security roles.
Ultimately, however, the greatest cost benefits will derive from reducing paper and telephone communications between PAI and its business associates for reporting on enrollment and enrollment updates and responding to enrollee and provider concerns on eligibility and claim payment status. These staff-intensive activities currently constitute the greatest portion of HRA's administrative costs.
As an insurer, HRA is clearly defined as a health plan and a covered entity under HIPAA. Moreover, given the nature of its insured population and public visibility, compliance with nationally recognized information privacy and security practices was essential. HRA sought to control compliance costs through maximizing the in-house resources of its administrator, PAI, to achieve compliance.
Even this level of effort, however, raises issues of economies of scale. Although HIPAA allows for tests of "reasonableness," there also is a basic level of privacy, security and documentation necessary for compliance. Furthermore, many of the security and transaction needs lot an operational information system remain the same regardless of the size of the insured population.
This suggests that over the long run, consolidating risk-pool operations with one or two administrators may be the best approach to manage regulatory requirements and still enable high-risk pools to fulfill an important public need through providing private insurance coverage to high-risk populations.
How High-Risk Pools Work
Many states currently run successful and well-managed high-risk pools, but they are structured and funded differently. There is no one high-risk-pool model that fits all markets, because insurance supply and demand differ from state to state. The preferred model:
* Responds to the characteristics of the individual market in a particular state;
* Effectively improves access without disrupting the voluntary market; and
* Considers the existing sources of supply otherwise available through the public and private sectors.
Karl Ideman, president of Pool Administrators Inc. located in Wethersfield, Conn., and his staff serve as the account managers for more than 20 reinsurance and risk pools. Ideman said several factors make a high-risk pool effective. "Successful pools spread risk and loss equitably to all members so that no member is hit with a disproportionate share of its losses. Given that claims will exceed premiums, there should be no expected positive return to the pool members from its operation. What's important is the return from better outcomes of care management and cost-effective administration. Care management of substandard risks requires integrated techniques and sophisticated predictive models. Cost-effective administration can be achieved if systems and staff are tailored to the special needs of the risk pool and its substandard population."
Among PAI's clients is the Health Reinsurance Association of Connecticut, a high-risk pool with a consistent cost-effective track record. "The Health Reinsurance Association is financially efficient because it has a larger mix of risks and reaches additional ranks of the uninsured in a state with one of the lowest percentages of uninsured in the nation," said Ideman. "Group conversion is available if carriers choose not to provide it themselves. Subsidized low-income plans are offered to individuals, and may be offered to members of small employer groups who are low-income qualified. HRA can also assume reinsurance coverage from individual market carriers or may cede whole group coverage to a separate program, the Connecticut Small Employer Health Reinsurance Pool."
Funding High-Risk Pools
Beneficiary premiums paid to high-risk pools cover approximately 50% of costs, with state legislatures employing a range of mechanisms to cover the remaining amounts. Funding alternatives encompass state general revenues, specially designated state funds, service charges to hospitals, premium tax credits and health-insurer assessments that may be based on premiums or the number of covered lives.
High-risk-pool insurance premiums are usually greater than standard insurance coverage. Premium rates are typically capped by state law at between 150% and 200% of the market rates to protect the high-risk insured from truly exorbitant rates. Even with these higher premiums, high-risk pools can lose money because of the substandard risks they insure.
New federal funding streams for high-risk pools could establish further alternatives for targeted subsets of the uninsured population over the next several years. These programs respond to private health-care payer concerns that the low-income population is not a desirable market segment for privately financed products. The new programs may include many workers who are currently uninsured but earn less than 200% of the federal poverty guidelines.
High-Risk-Pool Coverage and Operations
High-risk-pool insurance generally has no exclusions but may have waiting periods for coverage of pre-existing conditions. Under the Health Insurance Portability and Accountability Act of 1996, individuals with continuous coverage in the group market, not broken by more than 63 days, can access coverage without any waiting periods in a state alternative mechanism. The alternative mechanism relieves individual market insurance carriers of their guarantee issue obligation for all products and meets the HIPAA portability requirements for eligible individuals, many of whom are high-cost risks.
"Day-today high-risk-pool operations may be administered through either a private contractor or state office" said Ideman. "The administrator also serves the pool board of directors, which has plan fiduciary responsibility to tam the pool in a fair manner for the insured risks and the participating carriers. Contracting out this function mitigates the risk of managing the human resource issues in an employee-based organization."
John Phelan is health-care consultant with Milliman USA and an industry expert on HIPAA regulations and implementation.
|Printer friendly Cite/link Email Feedback|
|Title Annotation:||Group Health|
|Date:||Jan 1, 2004|
|Previous Article:||The birth of a legendary building. (Humana Inc.'s headquarters, Louisville, Kentucky).|
|Next Article:||New life & annuity products emphasize better guarantees.|