PPI in the News Compliance Corner - November 10, 2022 Archive
You are here: Home / PPI in the News / Compliance Corner - November 10, 2022 Archive

On September 22, 2022, in Howard v. Ivy Creek of Tallapoosa, LLC et al., the US District Court for the Middle District of Alabama ruled that a delegation of COBRA notice obligations to a third-party administrator (TPA) did not absolve the employer of COBRA notice liability. The plaintiff, Pamela Howard, sued her former employer Ivy Creek of Tallapoosa (Ivy Creek) and Ivy Creek’s COBRA TPA, UMR Inc., alleging failure to provide a COBRA election notice. Howard brought a second claim against Ivy Creek under ERISA for failure to provide requested plan documents.

Ivy Creek maintained a self-insured medical plan for which it served as both plan sponsor and plan administrator. UMR was the TPA for the plan under an administrative service agreement with Ivy Creek, which included the responsibility of handling claims and issuing COBRA continuation notices. Howard worked for Ivy Creek as a nursing assistant from March 2015 until March 2019, when she suffered a debilitating aneurysm. In June 2019, Ivy Creek notified Howard by letter that she had been terminated after exhausting her medical leave. The letter also indicated that she would be provided COBRA election notices for continuation of her dental and medical coverages. Howard was timely provided the COBRA election notice for dental coverage but not for her medical coverage. The medical coverage COBRA election notice was mailed by UMR to Howard’s former residential address. The notice was returned to UMR as undeliverable, but UMR did not alert Ivy Creek of the delivery problem. Several months later, Howard sent requests to Ivy Creek for information on her medical COBRA continuation rights. She also requested plan documents through her legal counsel. These requests were ignored, and the lawsuit followed.

In addressing the COBRA claim, the court began with the premise that a plan administrator (typically, the employer) must be able to prove a good faith effort was made to provide the COBRA election notice, although proof of receipt is not required. Howard claimed Ivy Creek and UMR violated COBRA by failing to mail her election notice to her last-known address — the same address to which Ivy Creek mailed the employment termination letter and dental COBRA election notice. Ivy Creek disclaimed liability because it contracted with UMR to provide medical COBRA election notices. The court found such delegation of a ministerial task does not absolve Ivy Creek of COBRA liability as the plan administrator.

As to UMR, the court found its failure to provide Howard with the medical COBRA election notice was a direct result of Ivy Creek’s failure to notify UMR of Ms. Howard’s updated address. Under the administrative services agreement, Ivy Creek was responsible for notifying UMR of address changes. Moreover, the court found UMR owed no fiduciary duty to Howard and held no liability under the COBRA statute, even though it may have breached its contractual agreement with Ivy Creek by not communicating that the notice was returned as undeliverable.

In addressing the claim for failure to provide plan documents, the court began with the premise that ERISA requires plan administrators to disclose certain plan documents upon “the written request of any participant or beneficiary.” A plan administrator who fails to make a required disclosure to a participant or beneficiary within 30 days may be liable for penalties up to $110 per day. Participants include former employees with “a colorable claim to vested benefits.” The court found that Howard, a former employee who alleges she would have received COBRA coverage but for her employer’s failure to provide the required notice, was an ERISA participant entitled to plan documents.

The Howard case serves as another important reminder for employers to review their COBRA notice procedures, whether that means internal procedures or those followed by a TPA. If a former employee (or other COBRA-qualified beneficiary) sues for failure to offer COBRA coverage, most courts have held that the plan administrator (typically, the employer) has the burden of proving a good faith effort was made to provide the election notice. To that end, employers should adopt reliable procedures for ensuring TPAs are timely notified of employee address changes. This case also serves as a good reminder for ERISA plan administrators to have adequate procedures in place to respond to plan document requests timely and completely.

Howard v. Ivy Creek of Tallapoosa, LLC et al. »

October is National Cybersecurity Awareness month, and the Department of Health and Human Services (HHS) issued a newsletter to educate stakeholders on the importance of cybersecurity awareness.

Specifically for health insurance plans, cybersecurity awareness falls under the HIPAA Security Rule which covers electronic protected health information (ePHI). PHI is information about a participant’s past, present, or future physical or mental health condition and information about payment for medical care or treatment which could be used to identify the participant. When the information is transmitted or maintained in electronic form, it is known as ePHI and falls under HIPAA’s Security Rule, although entities should also be concerned with HIPAA’s Privacy Rule which regulates the physical security and confidentiality of PHI in all formats.

The HIPAA Security Rule requires covered entities to have documented policies and procedures in place to respond to potential security incidents, including identifying, responding to, mitigating, and documenting security incidents and their outcomes. Employers who sponsor a group health plan have responsibilities under those rules, including identifying a privacy and security officer, conducting risk analysis, training workforce members, maintaining written policies and procedures, and safeguarding protected health information.

The HHS newsletter reminds entities of their obligations to protect ePHI and includes a real-world example of the conclusion of a recent HHS Office for Civil Rights (OCR) investigation. This investigation concerned Oklahoma State University – Center for Health Sciences (OSU-CHS) in which a hacker successfully gained unauthorized access to a server containing ePHI, resulting in the disclosure of ePHI of nearly 300,000 individuals. Although OSU-CHS initially reported the breach, the investigation found numerous violations, eventually leading to a monetary settlement of $875,000 and additional corrective action requirements. It is a cautionary tale to other entities of the need to better protect ePHI.

Both the recent settlement news and the HHS newsletter serve as reminders to covered entities that OCR is actively pursuing HIPAA violations, especially those related to data security. Employers should conduct routine risk assessments and review their HIPAA obligations with their advisers and outside counsel when developing a comprehensive strategy for adhering to HIPAA’s privacy, security and breach response requirements.

HHS: October 2022 OCR Cybersecurity Newsletter »

HHS recently released an updated federal independent dispute resolution (IDR) process guidance document. The agency issued the guidance document for group health plans and insurers who are seeking to resolve a payment claim for items and services covered by the surprise billing protections under the No Surprises Act (NSA) of the Consolidated Appropriations Act, 2021 (CAA, 2021).

The NSA provisions apply to both insured and self-funded group health plans and are effective for plan years beginning on or after January 1, 2022. The NSA provisions protect participants from surprise bills for out-of-network (OON) emergency and air ambulance services, as well as certain OON services received at in-network facilities. The NSA limits participant cost-sharing for covered OON services, leaving plans and insurers to address the balance of the bill from an OON provider or facility. In states with an applicable All-Payer Model Agreement or specified state law (which generally applies to fully insured plans), the OON provider rate is determined by the All-Payer Model Agreement or state law. Otherwise, if a plan or insurer and provider cannot agree on the OON payment amount after a 30-day negotiation period, then either party can initiate the federal IDR process.

The guidance document follows the issuance of final rules in August regarding the NSA surprise billing requirements and federal IDR process. The final rules modified prior guidance on the federal IDR process after a Texas court found the prior guidance inconsistent with the CAA, 2021 statutory language. Please see our prior articles on the August 2022 final rules and February 2022 court ruling.

Under the final rules, the arbitrator in the federal IDR process (termed the “certified IDR entity”) must select the offer of the disputing party that best represents the value of the OON item or service under dispute after considering the qualifying payment amount, which is the median contracted rate for the item or service in the geographic region, as well as all permissible additional information submitted by the parties. Such additional information may include, for example, the level of training, experience, and quality and outcomes measurements of the provider, or the complexity of providing the service to the participant. The final rules also require certified IDR entities to explain their payment determinations and underlying rationale in a written decision submitted to the parties.

Accordingly, the guidance document provides detailed information about the federal IDR process that incorporates these changes from the final rules. The IDR process is conducted through the federal portal designed for this purpose. The guidance document explains the specific steps in the process, such as how the disputing parties engage in open negotiation prior to the federal IDR process, initiate the federal IDR process, and select a certified IDR entity. This information is summarized in helpful charts that include the applicable timeframes for each step and links to required notices. Instructions are also provided regarding submissions of offers and IDR fee payments, among other items.

Employers that sponsor group health plans, particularly those that sponsor self-insured plans, should be aware of the updated federal IDR process guidance document, which applies to all items and services covered by the NSA that are provided on or after October 25, 2022 (for plan years beginning on or after January 1, 2022). Items and services that are furnished before October 25, 2022, are subject to a prior guidance document. HHS may issue additional guidance in the future to address specific questions or scenarios submitted by the public.

Federal Independent Dispute Resolution Process Guidance for Disputing Parties »

On October 21, 2022, the IRS issued Notice 2022-55, which provides certain cost-of-living adjustments for a wide variety of tax-related items, including retirement plan contribution maximums and other limitations. Several key figures are highlighted below. These cost-of-living adjustments are effective January 1, 2023.

The elective deferral limit for employees who participate in 401(k), 403(b), most 457 plans and the federal government’s Thrift Savings Plan increases from $20,500 to $22,500 in 2023. Additionally, the catch-up contribution limit for employees aged 50 and over who participate in any of these plans increases from $6,500 to $7,500. Accordingly, participants in these plans who have reached age 50 will be able to contribute up to $30,000 in 2023.

The annual limit for Savings Incentive Match Plan for Employees (SIMPLE) retirement accounts has increased from $14,000 to $15,500.

The annual limit for defined contribution plans under Section 415(c)(1)(A) increases to $66,000 (from $61,000). The limitation on the annual benefit for a defined benefit plan under Section 415(b)(1)(A) also increases to $265,000 (from $245,000). Additionally, the annual limit on compensation that can be considered for allocations and accruals increases from $305,000 to $330,000.

The threshold for determining who is a highly compensated employee under Section 414(q)(1)(B) increases to $150,000 (from $135,000). The dollar limitation concerning the definition of a key employee in a top-heavy plan increases from $200,000 to $215,000.

Employers should review the notice for additional information. Sponsors of benefits with limits that are changing will need to determine whether their plan documents automatically apply the latest limits or must be amended to recognize the adjusted limits. Any applicable changes in limits should also be communicated to employees.

Notice 2022-55 »

Employers with employees in Massachusetts should be aware of MCC and HIRD requirements and take necessary actions even when their primary business is located outside of the state. These two requirements are outlined below.

Health Insurance Responsibility Disclosure (HIRD)

About HIRD: The HIRD form is a state annual reporting requirement in Massachusetts. The HIRD form collects employer-level information about employer-sponsored health insurance plans to assist MassHealth (the state’s Marketplace) in identifying members who can participate in and who may be eligible for premium assistance from MassHealth.

Covered employers: An employer who has (or had) six or more employees in Massachusetts any month during the past 12 months prior to the HIRD due date must comply with the HIRD form requirement.

Due date: December 15 of the reporting year annually (the form is available on the MassTaxConnect website starting November 15).

Information reported on HIRD: Covered employers must report a separate HIRD form for each FEIN. Further, employers that maintain multiple plan options must file a separate HIRD form for each plan.

The HIRD form(s) should include information on the plan(s) offered to Massachusetts employees for the employer’s upcoming plan year. If plan information for the upcoming plan year is not available, then employers must provide information only for a plan or plans offered to Massachusetts employees for the current plan year. If the employer’s current plan year ends on or before December 31 (e.g., a calendar year plan), an employer must report plan information for the upcoming plan year.

Though the employer is ultimately responsible for ensuring the information is provided in a timely and accurate manner, the form may be completed by its payroll vendor.

Filing method: The HIRD reporting is filed through the MassTaxConnect (MTC) web portal electronically only, and paper forms are not accepted.

MA HIRD Form FAQs »
MassTaxConnect (MTC) »
MA HIRD Form Instructions »

MA Individual Mandate — Minimum Credible Coverage (MCC) and Form MA 1099-HC

About MCC and Form MA 1099-HC: Massachusetts requires its residents (over the age of 18) to carry minimum creditable coverage (MCC) or pay a penalty. It is a similar requirement to the now repealed ACA Individual Mandate; however, a MCC determination involves a more in-depth review. Employers that provide MCC to Massachusetts residents are required to distribute Form MA 1099-HC to those residents and submit reporting electronically to the Department of Revenue (DOR) by January 31, following the end of the medical plan year. However, employers are not required to offer MCC, and there's no penalty if the coverage the employer offers does not meet the MCC standard. For fully insured plans issued in MA, the insurers generally administer these requirements on behalf of the employers.

Covered employers: All employers with at least one Massachusetts resident employee must comply with the Form MA 1099-HC requirement. For fully insured plans sitused in the state, insurers generally prepare and provide Form MA 1099-HC to the state resident employees and report to the DOR on behalf of employers. It is recommended that employers that sponsor fully insured group health plans confirm with their carriers accordingly. For self-insured plans and non-Massachusetts employers, employers are required to distribute Form MA 1099-HC with their Massachusetts resident employees and file with the DOR by January 31. Employers can obtain draft copies of Form 1099-HC on the DOR website.

If an employer is unsure if its plan is considered MCC, the employer can request the Health Connector to make the determination.

Due date: January 31, following the end of the medical plan year.

Information reported on MA Form 1099-HC: A Form 1099-HC indicates the months that the employees and any dependents had MCC in the previous year.

Filing method: Employers must submit Form MA 1099-HC information to DOR electronically in properly formatted XML through MassTaxConnect. For additional information about how to file Form MA 1099-HC information, please refer to the state site, “ Submitting Information to DOR”.

The Form MA 1099-HC needs to be sent only to the primary subscriber.

Mass Healthcare – Frequently Asked Questions for Employers »
Health Connector – Employer Advisory »
Health Connector – HDHPs and MCC Requirements »