THE "HIPAA POLICE" ARE HERE

After several years during which the Department of Health and Human Services (HHS) operated essentially in “complaint-driven” mode with respect to enforcement of the HIPAA Privacy and Security Rules, recent activity suggests a trend toward stricter HIPAA enforcement.  The latest evidence comes in a recently-announced settlement between HHS and the Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates, Inc. (collectively, MEEI).

In this settlement, MEEI has agreed to pay $1.5 million to settle potential violations of the HIPAA Security Rule.  MEEI also agreed to develop a corrective action plan that includes reviewing and revising its existing Security Rule policies and procedures and retaining an independent monitor for a three-year period to conduct semi-annual assessments of MEEI’s compliance with the corrective action plan and report back to HHS.

HHS began its investigation of MEEI after MEEI submitted a breach report, as required by the HIPAA Breach Notification Rule.  The report indicated that an unencrypted personal laptop containing the electronic protected health information (ePHI) of MEEI patients and research subjects had been stolen.  The HHS investigation concluded that MEEI had failed to comply with certain requirements of the HIPAA Security Rule – particularly with respect to the confidentiality of ePHI maintained on portable devices – and that those failures had continued over an extended period of time.

The MEEI settlement is just the latest in a string of recent penalties and settlements stemming from alleged HIPAA privacy and security violations.  From 2003 through 2010, HHS reported that it had received nearly 58,000 privacy complaints and, of those, had resolved more than 52,000.  In fact, during this initial eight-year period after the HIPAA Privacy Rule went into effect, HHS did not impose a single civil monetary penalty for HIPAA violations. 

In February of 2011, however, HHS imposed a $4.3 million penalty against Cignet Health of Prince George’s County, Maryland.  HHS found that Cignet had failed to respond to patients’ requests for access to their medical records and that Cignet refused to cooperate in HHS’s investigation.  Later that same month, Massachusetts General Hospital entered into a $1 million settlement with HHS arising out of an incident in which an employee left paper records containing the PHI of 192 patients, including patients with HIV/AIDS, on the subway.

The recent increase in enforcement efforts may be partially attributable to the fact that the available civil penalties increased dramatically as a result of the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009.  The HITECH Act provides HHS with substantial leverage in settlement negotiations. 

These steep penalties and settlements should serve as a reminder of how important it is to comply with the HIPAA Privacy and Security Rules.  Health plan sponsors should review their existing policies and procedures and remain vigilant in their training of employees.

This Legislative Update is brought to you by:

FULL TIME EMPLOYEES 90 DAY WAITING PERIOD

Starting in 2014, larger employers (generally, those with 50 or more employees) may face "shared responsibility" penalties if any of their "full-time" employees receive subsidized health coverage through an "Affordable Insurance Exchange."  At the same time, virtually all employer health plans will become subject to a 90-day limit on any eligibility waiting period.  On August 31, the agencies charged with implementing health care reform issued additional guidance on both of these requirements.

In Notice 2012-58, the IRS outlines several safe-harbor methods for determining whether "variable hour" or seasonal employees fall within the "full-time" category (which is generally defined as working 30 or more hours per week).  And in Notice 2012-59, the IRS explains how the maximum 90-day eligibility waiting period is affected by various types of eligibility conditions.  (Notice 2012-59 was also issued in virtually identical form by both the Department of Labor - as Technical Release 2012-02 - and the Department of Health and Human Services.)

"Full-Time" Employees

In guidance issued late last year (Notice 2011-36), the IRS first proposed a "look-back/stability period" safe harbor by which plan sponsors could determine whether ongoing (as opposed to newly hired) employees fall within the "full-time" category for purposes of the shared responsibility penalties.  Under this safe harbor, a sponsor may track an employee's hours during a "standard measurement period" of 3 to 12 months.  If an employee averages at least 30 hours per week during that period, he or she would be considered full-time during a subsequent "stability period" of at least six months (but no shorter than the measurement period).  If an employee averages fewer than 30 hours per week, he or she would not be considered full-time during the subsequent stability period - even if he or she actually works 30 or more hours per week.

Earlier this year (in Notice 2012-17), the IRS proposed a similar - though slightly different - approach for determining whether a new employee meets this full-time threshold.  (For this purpose, a "new" employee is defined as one who has not yet completed a standard measurement period.)  If a new employee is reasonably expected to work at least 30 hours per week, he or she would be considered full-time as of the date of hire.  

However, if it cannot reasonably be determined whether a new employee is expected to meet this 30-hour threshold (thereby constituting a "variable hour employee"), the sponsor would be allowed to count the employee's actual hours during his or her first 3 months (or, in limited cases, 6 months) and then apply rules similar to those previously proposed for ongoing employees.
In response to numerous comments, the IRS has now extended to 12 months the maximum measurement period for newly hired employees.  As a result, this "initial measurement period" could now be as long as the "standard measurement period" applicable to ongoing employees.

Moreover, Notice 2012-58 would allow plan sponsors to apply this 12-month initial measurement period not only to variable hour employees, but also to seasonal employees.  And through at least the end of 2014, sponsors would be allowed to use any reasonable, good-faith definition of a "seasonal employee."
Notice 2012-58 also allows for an "administrative period" between any measurement period and its related stability period.  This administrative period is intended to allow a plan sponsor to determine which employees are eligible for coverage, notify those employees of that fact, and then enroll them in the plan.  In general, an administrative period may last for up to 90 days.

There are various constraints on this provision, however.  For instance, to prevent a lengthy administrative period from creating a gap in coverage for an ongoing employee, any administrative period for an ongoing employee must overlap with the prior stability period.  Accordingly, any ongoing employee who was considered full-time during the prior stability period must retain that status throughout the following administrative period.

Moreover, if a plan sponsor chooses to use an initial measurement period of 12 months, the subsequent administrative period must be shorter than 90 days.  This is because the total combined length of an initial measurement period plus the subsequent administrative period may not exceed 13 months, plus any portion of a month remaining until the first day of the following month.

As a general rule, Notice 2012-58 requires that a plan use the same measurement period for all employees.  Of course, a plan sponsor may - and probably will - use an initial measurement period that differs from the standard measurement period.  The initial measurement period will likely run from each employee's date of hire, whereas the standard measurement period will not.
In either event, the Notice would allow for different measurement periods (and associated stability periods) in the following four circumstances:

1. Collectively bargained versus non-collectively bargained employees;
2. Salaried versus hourly employees;
3. Employees of different entities; and
4. Employees located in different states. 

Notice 2012-58 also provides guidance on rules to be followed when transitioning an employee from his or her initial measurement period to the plan's standard measurement period.  Once an employee has been employed for an entire standard measurement period, he or she must be retested for full-time status using that standard measurement period.  If the employee would be considered a full-time employee using that standard measurement period, he or she must be considered full-time during the associated stability period - even if the employee would not be considered full-time during the remainder of his or her initial stability period.

90-Day Limit on Eligibility Waiting Period

Unlike the shared responsibility penalties (which will apply only to larger employers), the 90-day limit on eligibility waiting periods will apply to virtually all employer health plans - regardless of the employer's size and even if a plan remains "grandfathered" under health care reform.  All employers should thus familiarize themselves with the guidance in Notice 2012-59.

Citing regulations issued in 2004, the agencies define a "waiting period" as "the period that must pass before coverage for an employee or dependent who is otherwise eligible to enroll under the terms of a group health plan can become effective."  (Emphasis added.)  Consistent with the italicized language, the agencies note that nothing in health care reform requires a plan to provide coverage to any particular category of employees.  (Of course, as noted earlier, a large employer may incur a shared responsibility penalty if the exclusion of a full-time employee results in that employee receiving subsidized coverage through an Exchange.)

Much of Notice 2012-59 is devoted to explaining when the agencies will view an eligibility condition as being designed to avoid compliance with the 90-day waiting period limitation - and therefore a violation of this requirement.  For instance, a plan may validly require that an employee be in an eligible job classification - such as hourly, salaried, or working at a specified location - in order to participate.  And any period in an ineligible classification need not be counted against the 90-day limit. On the other hand, any eligibility condition that is based solely on the lapse of time may last no longer than 90 days.

So far, this is all clear enough.  But the guidance then goes on to address certain harder cases.  For instance, what if a plan conditions an employee's eligibility on working "full-time" (under either the 30-hour-per-week standard or otherwise) and an employee is hired on a variable hour or seasonal basis?  Here, Notice 2012-59 refers to the "initial measurement period" concept outlined in Notice 2012-58.  As explained above, this concept could allow for a period of up to twelve months (plus a brief administrative period) for a plan to determine whether an employee has satisfied this eligibility condition - even though such a period greatly exceeds 90 days.

What about a different type of eligibility condition, such as one offering coverage to part-time employees only after they have completed a total of 1200 hours of service?  An example in Notice 2012-59 specifically approves of this approach, even though the employee in that example was therefore required to work nearly a year before entering the plan.  Interestingly, however, the Notice appears to set a 1200-hour limit on such an eligibility condition, noting that the agencies would consider a requirement to complete more than 1200 hours to be designed to avoid compliance with the 90-day waiting period limitation.

Finally, Notice 2012-59 connects the 90-day limit on eligibility waiting periods to the shared responsibility penalties discussed in Notice 2012-58.  It does so by noting that a large employer may require even a full-time employee to satisfy a waiting period of up to 90 days without thereby running the risk of incurring a shared responsibility penalty.  Moreover, during that waiting period, the employee may qualify for subsidized coverage through an Exchange.  In this way, the Notice closes an analytical gap in the statutory language.

What to Do Now

Although neither of the requirements discussed in this article will take effect until January 1, 2014, sponsors of employer health plans will want to begin planning for their implementation well before that date.  In fact, any employer planning to use the look-back/stability period safe harbor for identifying full-time employees during 2014 must begin counting hours of service during 2013.

Moreover, the agencies have stated that this interim guidance will remain in effect through at least the end of 2014 - with any more restrictive guidance taking effect no earlier than 2015.  Accordingly, employers can be certain that these are the rules that will apply during the first year the requirements are effective.

IRS ISSUES TEMPORARY GUIDANCE FOR IDENTIFYING FULL-TIME EMPLOYEES AND APPLYING WAITING PERIODS

On Aug. 31, the IRS issued Notices 2012-58 and 2012-59, which provide safe harbors for 2014 (and perhaps beyond that date) on how to address some of the open questions on how the employer-shared responsibility penalties will apply.

The notices affirm that employers that hire new employees who are reasonably expected to work full-time on an annual basis and who do work full-time during the first 90 days of employment must offer those employees minimum-value, affordable coverage by the end of that period or pay a penalty.

The rules described in the notices will provide substantial relief to employers that have seasonal employees or hire employees who work variable (fluctuating) hours.  Under the safe harbor, employers with employees in these categories may use a measurement period of up to 12 months to determine whether the employee is full time.  The rules are complex but essentially require a corresponding period of time after the measurement period during which the employee's status as a full-time or non-full-time employee will be deemed to continue, regardless of actual hours worked.  No penalty will apply during the measurement period, even if coverage is not offered.

The notices also:

• Confirm that employers may use W-2 income when determining whether coverage is affordable (but do not clarify how this standard applies -- if at all -- to dependent coverage)
  ---
• Clarify that during an eligibility waiting period (including an extended measurement period for seasonal or variable-hours employees), an employee is not considered to have access to affordable, minimum value coverage for purposes of the premium tax credit
  ---
• Clarify that the extended measurement period for seasonal and variable hours employees is an acceptable exception to the requirement that waiting periods not exceed 90 days

The notices are available at http://www.irs.gov/pub/irs-drop/n-12-58.pdf and http://www.irs.gov/pub/irs-drop/n-12-59.pdf .

Spencer Fane will be providing a Compliance Alert on this topic in the near future.  UBA will be posting an updated PPACA Summary by the end of this week and is in the process of updating the "Counting Employees" guide for advisors to reflect this new guidance. 

This update brought to you by: