Implementation of HIPAA

Nearly four years after the Health Insurance Portability and Accountability Act of 1996 (HIPAA) became law, the Health Care Financing Administration (HCFA) continues to be in the early stages of fully identifying where federal enforcement will be required. HCFA has assumed regulatory activities, such as reviewing carrier policies and marketing practices, in the three states that had voluntarily notified HCFA of their failure to enforce HIPAA. HCFA has also identified more than 20 states where it questions whether they have conforming laws, but it is still determining whether they are enforcing the standards through other regulatory means or whether other states' laws fully conform with federal standards. Agency officials did not provide explicit time periods for completing these reviews, and until they are complete, HCFA is largely reacting to consumers' complaints as a means of fulfilling its statutory mandate. Although nearly 600 self-funded state and local government plans have opted out of at least one of the federal standards, HCFA has yet to fully determine its enforcement responsibilities among the remaining nonfederal government plans and is instead relying on complaints from enrollees to identify compliance problems. The final regulations on HIPAA's nondiscrimination provisions are being reviewed by HCFA and the Departments of Labor and the Treasury and should be issued in the summer of 2000.

GAO noted that: (1) HCFA has overcome some barriers it had previously identified as contributing to its minimalist approach to enforcing HIPAA and the related laws, including clarifying its regulatory authority and having sufficient staff resources for HIPAA oversight and enforcement; (2) however, nearly 4 years after HIPAA's enactment, HCFA continues to be in the early stages of fully identifying where federal enforcement will be required; (3) to varying degrees, HCFA has assumed regulatory activities, such as reviewing carrier policies and marketing practices, in the three states that had voluntarily notified HCFA of their failure to enforce HIPAA; (4) beyond these activities, HCFA has identified more than 20 states where it questions whether they have conforming laws, but it is still in the process of determining whether these states are enforcing the standards through other regulatory means or whether other states' laws are fully in conformance with the federal standards; (5) agency officials did not provide explicit time periods for completing these reviews, and until they are complete, HCFA is largely reacting to consumers' complaints as a means of fulfilling its statutory mandate; (6) although nearly 600 self-funded state and local government plans have opted out of at least one of the federal standards, HCFA has yet to fully determine its enforcement responsibilities among the remaining nonfederal government plans and is instead relying on complaints from enrollees to identify compliance problems; (7) the final regulations regarding HIPAA's nondiscrimination provisions remain pending and are under review by HCFA, the Department of Labor, and the Department of the Treasury; and (8) anticipated issuance is sometime in the summer of 2000.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone: