Home My Bar Page CLE Bar Journal Contact Us Membership Directory

Job Bank
News and Publications
Member Services
Judges' Benchbooks
Emeritus Program

Case Maker

Law Pay

Legally Speaking


Issue: February, 2005
Author: Angela M. Stewart

pdf Printable Version (PDF)

HIPAA: An Individual-Friendly Concept; Not an Individual-Friendly Law

The Health Insurance Portability and Accountability Act (HIPAA) was passed by Congress on August 21, 1996 to address major problems in health care, including job lock, which occurs when an individual will not change jobs for fear of losing health benefits, and improper access to individuals’ personally identifiable health information. The noble purpose that Congress stated for HIPAA was:

[T]o amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.”

HIPAA is a broad and expansive statute covering many aspects of health care. The five titles of HIPAA are: Health Care Access, Portability, and Renewability; Preventing Health Care Fraud and Abuse, Administrative Simplification, Medical Liability Reform; Tax Related Health Provisions; Application and Enforcement of Group Health Plan Requirements; and Revenue Offsets. This piece will address Title I of HIPAA, which was to deal with job lock among other things. There will be an additional HIPAA piece in the March issue of the Wyoming Lawyer.

Recognizing the problems with health care coverage in the U.S., Congress attempted to remedy some of those problems through the passage of this act. The General Accounting Office (GAO) noted in a Letter Report to Congress:

Millions of Americans face discontinuity in their health care coverage when they change employers, and others do not change jobs because of concerns about losing health care coverage. In fact, individuals with health problems may face extended periods in which their new health plan does not cover their medical conditions because of exclusions for preexisting conditions.
. . . .
We estimate that up to 21 million Americans a year would benefit from federal legislation that would waive preexisting condition exclusions for individuals who have had continuous health care coverage. In addition, perhaps as many as 4 million Americans who at some time have been unwilling to leave their jobs because of concern about losing their health care coverage would benefit from national portability standards. Such a change, however, could possibly increase premiums, according to insurers.

This piece focuses on sections of Title I of HIPAA, which addresses “Health Care Access, Portability, and Renewability.” While HIPAA has a noble purpose and a seemingly sincere backdrop, Title I of HIPAA does not go far enough to protect individuals. A major problem with HIPAA is that practitioners do not fully understand HIPAA mandates and individuals have no way of understanding their rights and responsibilities under the act. This article is meant to provide a basic understanding of HIPAA’s preexisting condition exclusion and the prohibition on discrimination based on health status, both of which are found in Title I of HIPAA.

Title I deals specifically with portability, access, and renewability in group health plans. Group health plan is defined as “an employee welfare benefit plan to the extent that the plan provides medical care . . . to employees and their dependents . . . directly or through insurance, reimbursement, or otherwise.” If an individual is a member of a health insurance plan through that individual’s employer, he or she is deemed to be in a group health plan.

Preexisting Condition Exclusions
One aim of HIPAA is to increase portability through limitations on “preexisting condition exclusions,” defined as “a limitation or exclusion of benefits relating to a condition based on the fact that the condition was present before the date of enrollment for such coverage, whether or not any medical advice, diagnosis, care, or treatment was recommended or received before such date.”
HIPAA limits when insurance companies can impose exclusions. Insurers can only impose an exclusion if:

(1) such exclusion relates to a condition (whether physical or mental), regardless of the cause of the condition, for which medical advice, diagnosis, care, or treatment was recommended or received within the 6-month period ending on the enrollment date;
(2) such exclusion extends for a period of not more than 12 months (or 18 months in the case of a late enrollee) after the enrollment date; and
(3) the period of any such preexisting condition exclusion is reduced by the aggregate of the periods of creditable coverage . . . applicable to the participant or beneficiary enrollment date.

Essentially, the first point establishes a 6-month look-back period for the insurance provider to inquire about preexisting conditions. If an individual received “medical advice, diagnosis, care, or treatment” or if any of those were recommended within a 6-month time frame before enrolling for coverage, the insurance provider can impose an exclusion and not cover that condition. Any conditions that were not diagnosed, cared for, or treated (or recommended to be diagnosed, cared for, or treated) within that 6-month window, the insurance provider cannot impose an exclusion on that specific condition. However, all of these restrictions are still subject to the terms of the provider’s policy. If a condition is excluded from coverage for all individuals, then the provider can make that exclusion across the board.

The 6-month look-back period ends with the enrollment date. The enrollment date is “the date of enrollment of the individual in the plan or coverage or, if earlier, the first day of the waiting period for such enrollment.” This provision allows the look-back period to stop when the individual is enrolled in the health insurance plan. However, if there is a waiting period before an individual is actually eligible for coverage, the look-back period starts on the first day of that waiting period. “The term ‘waiting period’ means . . . the period that must pass with respect to the individual before the individual is eligible to be covered for benefits under the terms of the plan.”

The second limitation allows the insurance provider to deny coverage for an acknowledged preexisting condition but only for twelve (12) months, or eighteen (18) months for a late enrollee. After that 12-month period, even the preexisting condition should be covered, unless the policy excludes it for other valid reasons. If that condition would be covered under the normal policy, it will only be covered to extent the policy allows. Just because the condition was preexisting, does not give it preferential or less coverage than any other covered condition.

“The term ‘late enrollee’ means . . . a participant or beneficiary who enrolls under the plan other than during– (A) the first period in which the individual is eligible to enroll under the plan, or (B) a special enrollment period . . . ” This section allows an insurer to extend the time it can exclude coverage for a preexisting condition if the individual does not enroll in the plan the first chance that individual gets or if that person falls into a category that puts him or her in a “special enrollment period”.

The third limitation reduces the amount of time the preexisting condition exclusion can be in effect by the amount of time the individual had creditable coverage. Basically, if an individual has had any sort of health care coverage, that coverage will count to reduce the length of time the preexisting condition exclusion can be in effect.
However, there is a caveat to creditable coverage. “A period of creditable coverage shall not be counted, with respect to enrollment of an individual under any group health plan, if, after such period and before the enrollment date, there was a 63-day period during all of which the individual was not covered under any creditable coverage.” If there is a 63-day or more gap between the last day of previous coverage and the enrollment date, an individual will not get any credit for that previous coverage. However, “any period that an individual is in a waiting period for any coverage under a group health plan (or for group health insurance coverage) or is in an affiliation period . . . shall not be taken into account in determining the continuous period . . .” The waiting period before an individual actually gets coverage will not count as a gap coverage. For example, if an individual’s last day of coverage under a previous employer was December 31, and that individual started a new job on January 15, but had to wait 60 days for coverage under the new employer, there would be a 75-day span where the individual is not technically covered. However, as the 60-day wait is not counted towards a break in coverage, the individual will not be subject to preexisting condition exclusions.

There are exceptions to the requirement that there not be a gap in coverage. Newborns cannot have exclusions imposed on them if the newborn is covered under creditable coverage within 30 days of birth. Additionally, no exclusion can be imposed for an adopted child, who is under 18 years old, if that child has creditable coverage as of the 30th day after the date of adoption or placement of adoption.

After a newborn or adopted child has had 63 days without creditable coverage, the exception will not protect them from an exclusion. This provision prevents the exception from being applied after a newborn or adopted child could have obtained coverage, but then the coverage lapsed for at least 63 days. However, this provision does not add much to HIPAA since the exception can only be invoked if the newborns or adopted children obtain coverage within 30 days of birth or adoption, respectively. It appears that the lawmakers were simply making it clear that the exception only applies when the newborn or adopted child becomes eligible for coverage.

An exclusion cannot be imposed based on pregnancy. This provision is very important as the cost of prenatal care and childbirth care is relatively high. It would be bad policy to tie an individual expecting to have a child to a particular job because the next employer’s insurance company or provider could exclude coverage for prenatal care or childbirth based on a preexisting condition exclusion.
For an individual to get credit for creditable coverage, that individual has to be able to prove that he or she had such health care coverage. Therefore, HIPAA requires a group health insurer to provide the individual with a certificate of creditable coverage. The insurance company or provider must provide this certificate -

(i) at the time an individual ceases to be covered under the plan or otherwise becomes covered under a COBRA continuation provision, (ii) in the case of an individual becoming covered under such a provision, at the time the individual ceases to be covered under such provision, and (iii) on the request on behalf of an individual made not later than 24 months after the date of cessation of the coverage described in clause (i) or (ii), whichever is later.

Basically, this certificate is to be given to the individual when some sort of coverage ends. It could be the entire plan under (i), or just a specific provision, as in (ii). If the insurance company or provider for whatever reason does not provide a certificate of creditable coverage to the individual at the end of coverage, that individual can request the certificate. The provider is required to provide that certificate if the request is made by the individual within 24 months of the cessation of coverage.

The time frame in which the insurance provider must provide the certificate is not specified in HIPAA. “The certification under clause (i) may be provided, to the extent practicable, at a time consistent with notices required under any applicable COBRA continuation provision.” If COBRA applies, the time the certificate should be furnished should comply with time frames set out in COBRA, but only “to the extent practicable”. There are no specific requirements for either subsections (ii) or (iii), either. Insurance providers are not on a set timeline, which could be a problem for someone who seeks to apply for coverage immediately after the cessation of previous coverage. While HIPAA does not require a turn-around time for previous insurance providers to produce a certificate of creditable coverage, the law does allow for the Secretary of Health and Human Services to establish some rules to protect individuals from being harmed by long turn-around times.

HIPAA does establish some information required to be on the certificate of coverage. The certificate must be written verification of “(i) the period of creditable coverage of the individual under such plan and the coverage (if any) under such COBRA continuation provision, and (ii) the waiting period (if any) (and affiliation period, if applicable) imposed with respect to the individual for any coverage under such plan.” The dates are generally what is important for creditable coverage, and the certificate is to address dates.

If the extent of the previous coverage is an issue for specific provisions or conditions in the new coverage, the certificate will not suffice. However, “[t]o the extent that medical care under a group health plan consists of group health insurance coverage, the plan is deemed to have satisfied the certification requirement under this paragraph if the health insurance issuer offering the coverage provides such certification in accordance with this paragraph.” It appears that a certificate of creditable coverage does not need to meet the date and waiting period requirements if the previous insurance provider gives a certificate explaining that “medical care” was provided by the previous insurer.

Occasionally an individual does not sign up for, or include a dependent on, insurance coverage at the first opportunity because the individual and/or dependents already have other coverage. Therefore, HIPAA allows individuals and dependents who previously had other coverage and are eligible for the “new” plan but are losing that other coverage to enroll under the “new” group plan. HIPAA conditions enrollment on the following:

(A) The employee or dependent was covered under a group health plan or had health insurance coverage at the time coverage was previously offered to the employee or dependent. (B) The employee stated in writing at such time that coverage under a group health plan or health insurance coverage was the reason for declining enrollment, but only if the plan sponsor or issuer (if applicable) required such a statement at such time and provided the employee with notice of such requirement (and the consequences of such requirement) at such time. (C) The employee’s or dependent’s coverage described in subparagraph (A)—(i) was under a COBRA continuation provision and the coverage under such provision was exhausted; or (ii) was not under such a provision and either the coverage was terminated as a result of loss of eligibility for the coverage (including as a result of legal separation, divorce, death, termination of employment, or reduction in the number of hours of employment) or employer contributions toward such coverage were terminated. (D) Under the terms of the plan, the employee requests such enrollment not later than 30 days after the date of exhaustion of coverage described in subparagraph (C)(i) or termination of coverage or employer contribution described in subparagraph (C)(ii).

HIPAA has additional requirements before mandating coverage for dependents. The dependents must be given a special enrollment period if “a group health plan makes coverage available with respect to a dependent of an individual” and “the individual is a participant under the plan” . The dependent qualifies “through marriage, birth, or adoption or placement for adoption”.

A dependent special enrollment period under this subparagraph shall be a period of not less than 30 days and shall begin on the later of—(i) the date dependent coverage is made available, or (ii) the date of the marriage, birth, or adoption or placement for adoption (as the case may be).

This provision gives an individual 30 days after a marriage, birth, or adoption to enroll his or her dependent in the group health care plan. After that 30-day window has passed, the dependents no longer get special treatment for enrollment.

If dependents are enrolled within the 30-day period, a traditional waiting period cannot be imposed on the dependent.
[T]he coverage of the dependent shall become effective—(i) in the case of marriage, not later than the first day of the first month beginning after the date the completed request for enrollment is received; (ii) in the case of a dependent’s birth, as of such birth; or (iii) in the case of a dependent’s adoption or placement for adoption, the date of such adoption or placement for adoption.

This provision obviously shortens any waiting period that insurance providers generally require. In fact, birth and adoption trigger immediate coverage, which is certainly beneficial. The marriage trigger may require some wait time, but no more than a month. Once again, HIPAA protects newborns and newly adopted children.
Nondiscrimination based on health status

HIPAA also deals with prohibiting discrimination against individual participants and beneficiaries based on health status.
[A] group health plan, and a health insurance issuer offering group health insurance coverage in connection with a group health plan, may not establish rules for eligibility (including continued eligibility) of any individual to enroll under the terms of the plan based on any of the following health status-related factors in relation to the individual or a dependent of the individual: (A) Health status. (B) Medical condition (including both physical and mental illness). (C) Claims experience. (D) Receipt of health care. (E) Medical history. (F) Genetic information. (G) Evidence of insurability (including conditions arising out of acts of domestic violence). (H) Disability.

These health status-related factors provide a significant amount of protection for health insurance applicants applying for a group health plan. When health insurers set policies and accept applicants, they generally want the healthiest participants. Therefore, this provision limits the insurers’ ability to exclude individuals from the health plan, based on very indicative factors. This provision of HIPAA provides some protection to individuals applying and participating in group health care plans.

However, HIPAA does not require that insurers provide certain benefits, that insurers provide certain coverage, or coverage that insurers provide coverage at certain restricted prices. HIPAA requires that “similarly situated individuals” are treated similarly for receiving coverage or not. The above stated factors could not be incorporated in determining who is similarly situated. For example, it would seem that age, familial status and type of work performed would be acceptable factors to consider. Like in other anti-discrimination statutes, individuals must be classified by factors other than those factors which are prohibited.

HIPAA goes further and also restricts longer waiting periods for individuals with protected health status-related factors. “Rules for eligibility to enroll under a plan include rules defining any applicable waiting period for such enrollment.” Therefore, any rules or requirements by the statute for eligibility are to be similarly applied to waiting periods.

This equal treatment or anti-discrimination language also applies to the health care premiums required by the group health plan. An individual cannot be required to pay higher premiums than other similarly situated individuals because of a protected health status-related factor. While this provision requires equal treatment of similarly situated individuals, there is no limit on the amount of contribution the insurer can require. The only limit is that all similarly situated individuals are required to pay comparable premiums. Those premiums could be quite exorbitant, but as long as they are applied across the board to individuals in similar situations, the premiums will not violate HIPAA. Specifically, HIPAA states, nothing in this provision
shall be construed—(A) to restrict the amount than an employer may be charged for coverage under a group health plan; or (B) to prevent a group health plan, and a health insurance issuer offering group health insurance coverage, from establishing premium discounts or rebates or modifying otherwise applicable copayments or deductibles in return for adherence to programs of health promotion and disease prevention.

While HIPAA sets a federal bar for group health plans that states must meet or exceed , in this writer’s opinion HIPAA does not provide enough protection for individuals. Any individual rights under HIPAA are so convoluted and hard to access and understand that those rights are not likely to be exercised, and the remedies available are few and unsatisfying.

The enforcement of HIPAA is the joint responsibility of the Secretary of Health and Human Services and the individual states. HIPAA allows states to regulate insurers, but it does not mandate that states monitor and regulate. If the Secretary finds that states are not enforcing HIPAA, the Secretary can step in and enforce the law.
If liability is found, “[t]he maximum . . . penalty imposed . . . is $100 for each day for each individual with respect to which such failure occurs.” However, [i]n determining the amount of any penalty to be assessed . . . the Secretary shall take into account the previous record of compliance of the entity being assessed . . . and the gravity of the violation.” The Secretary is limited in the imposition of penalties. “No civil money penalty shall be imposed under this paragraph on any failure during any period for which it is established to the satisfaction of the Secretary that none of the entities against whom the penalty would be imposed knew, or exercising reasonable diligence would have known, that such failure existed.” Additionally, “[n]o civil money penalty shall be imposed . . . on any failure if such failure was due to reasonable cause and not to willful neglect, and such failure is corrected during the 30-day period beginning on the first day any of the entities against whom the penalty would be imposed knew, or exercising reasonable diligence would have known, that such failure existed.” The penalties for HIPAA violations seem weak, and again seem to let the individual down.

While HIPAA is a good attempt to help protect individuals in the health care insurance arena, the law itself is inaccessible to individuals and painful and time-consuming for professionals. The ideas behind HIPAA are valuable and admirable; however, the law must be modified to achieve the goals and purpose HIPAA was designed to accomplish.

Angela M. Stewart is originally from Fulda, Minnesota. She received her Bachelor’s at Southwest Minnesota State University; is currently a third year law student at the University of Wyoming School of Law; and is planning to practice law in South Dakota.