Implementation of HIPAA

Pursuant to a congressional request, GAO provided information on alternative state approaches to implementing the group-to-individual portability provision of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

GAO noted that: (1) most states include as part of their alternative mechanisms regulations of premium rates, a requirement for risk spreading, or a subsidy; (2) designed to moderate the high rates anticipated for the less healthy, high-cost HIPAA-eligibles, these methods are used in almost all of the 37 alternative mechanism states--of which 22 employ a high-risk pool and 15 have a guaranteed-issue requirement for carriers; (3) in contrast, the federal rules, under which 13 states operate, do not address premium rates or contain an explicit risk-spreading requirement under all circumstances; (4) under the risk-pool approach, eligible individuals who have lost group coverage are guaranteed a choice of coverage options within a state's high-risk pool program; (5) most of the 22 states using high-risk pools had them in place before HIPAA was enacted; to meet federal criteria for an acceptable alternative mechanism, states merely had to modify the rules; (6) each state using the risk-pool approach caps premium rates for coverage in the pool at 200 percent or less of the rate that a healthy individual would pay in the individual insurance market; (7) seven states have a 200-percent cap, 14 states have a 125- to 175-percent cap, and 1 state has a 100-percent cap; (8) a subsidy mechanism, typically assessments on health insurance carriers, spreads the additional costs of the less healthy across multiple carriers; (9) under the guaranteed-issue approach in 15 states, certain carriers must offer individual market coverage to HIPAA-eligible individuals; (10) however, in contrast to some federal fallback states, most states with the guaranteed-issue requirement also try to moderate rates, often as part of state insurance reforms predating HIPAA; (11) some of these states regulate premiums and others explicitly require risk spreading; (12) six states subject coverage available to HIPAA-eligible individuals to some form of community rating; that is, with limited exceptions, all individuals are charged the same price for coverage; (13) three states use rate banding or other premium regulations that allow rates to vary within specified bounds; (14) three states cap premium rates at 150 to 200 percent of the standard rate; (15) another two states do not regulate rates directly but use an explicit risk-spreading requirement that may moderate rates for HIPAA-eligible individuals indirectly; and (16) finally, two states' alternative mechanisms contain neither premium rate regulation nor an explicit risk-spreading requirement.