October 2009

When an employer invests the time and money in implementing a new benefits plan for employees, it wants the plan to be a success, attract employee participation and increase employee loyalty, and come in at the budgeted amount. Achieving these ends is easier with some plans than others, and consumer-directed health plans, in particular, can have a rough entry into a company’s benefits package. This might be because consumer-directed health plans are not as readily understood by employees as other types of health plans, or it might be because employees — rightly or not — suspect the plan is a cost-cutting measure for the employer rather than a benefits option that might meet their needs.

Employers can take steps when designing, implementing, and communicating a consumer-directed health plan to increase the likelihood that employees will embrace the plan enthusiastically — or at least give it serious consideration if choosing from a menu of plan options.

A study from Aetna shows how a thoughtful and strategic consumer-directed health plan implementation can have positive results. Aetna interviewed employers that had achieved significant success with their consumer-directed health plans — annualized cost trend rates 50% below average, and combined employer/employee savings of $15 million per 10,000 employees over a four-year period. These employers had four things in common concerning their consumer-directed health plan strategy:

1. Fostered a culture of health care consumerism among all employees, beginning with senior executives.
2. Implemented a focused employee communication and education campaign.
3. Offered wellness programs and incentives for healthy behaviors, as well as 100% coverage for preventive care.
4. Carefully constructed a benefits package that included appropriate levels of employee responsibility.

An issue brief from the Center for Studying Health System Change, in analyzing factors critical to consumer-directed health plan adoption, notes that these plans are complex, requiring employee understanding of the federal tax rules for the savings account component of the plan, including contribution caps and what medical expenses can be paid with health savings account funds. Consequently, consumer-directed health plans require extensive employee education. In fact, a study from Towers Perrin concluded that even a well-designed consumer-directed health plan is not likely to be effective unless it is combined with a thorough and continuous education strategy. The study found that people often misunderstand the risk associated with the savings account component of a consumer-directed health plan, because they confuse it with other forms of health care coverage. For example, they think the use-it-or-lose-it rule associated with flexible spending accounts applies, and don’t understand that their health savings account funds will roll over from year to year.

In looking back over the factors identified in the surveys cited above, the following — at a minimum — should be considered critical to consumer-directed health plan success:

• Position the consumer-directed health plan as part of an overall health and wellness strategy. Cover preventive care generously, and provide incentives for employees to get and stay healthy.
• Educate employees on the ways in which a consumer-directed health plan is similar to a traditional plan, and the ways in which it is different. Employees need to understand that although their health plan deductible will be higher, their financial risk is limited, and is offset to a degree by lower premium costs.
• Show the company’s commitment to the consumer-directed health plan by engaging top management in plan buy-in and by making some type of company contribution to the account portion of the plan.
• Communicate the plan on an ongoing basis. Publicize good experiences, and share cost-savings data.

Consumer-directed health plans can be a win-win for employers and employees, but for that to happen employees need to embrace the plan, and the consumer-oriented mindset that goes along with it.

Health Savings Accounts (HSAs), part of the consumer-directed approach to health care, provide a tax-favored way for individuals to save for and pay for medical expenses. HSAs also offer employers a way to better define their contribution for health care and transfer to employees more control over how health plan dollars are spent.

To add an HSA to a benefits menu, an employer must offer a high deductible health plan (HDHP). An individual must be covered by an HDHP to participate in an HSA.

The basic definition of an HDHP is this: A plan with a minimum deductible of $1,100 for individuals/$2,200 for families, and an out-of-pocket expense limit that does not exceed $5,600 for individuals/$11,200 for families (2008 limits). Previous guidance clarifies that “family coverage” means any coverage other than self-only.

Notice 2004-71 provides extensive guidance on what types of expenses are counted as out-of-pocket expenses, for purposes of determining whether the plan meets the requirement that such expenses not exceed the published limits. As would be expected, amounts paid to satisfy a deductible are counted, as are copayment and coinsurance amounts, even if they would not count against the deductible under the terms of the plan. In the case of cumulative embedded deductibles under family coverage, a plan would not qualify as an HDHP for families where the number of covered individuals is large enough that the cumulative deductible could exceed the $11,200 limit (such as for a family of six with a per person deductible of $2,000 and no cap or maximum family deductible). Notice 2004-71 lists certain types of expenses that are not counted toward the out-of-pocket expense limit:

• Premiums
• Amounts paid above the usual, customary, and reasonable (UCR).
• Precertification penalties, including higher coinsurance amounts for out-of-network providers.
• Amounts paid for services that are not covered benefits under the plan.
• Amounts paid after the lifetime plan maximum is reached (the Notice cites as reasonable a plan with a $1 million lifetime benefit maximum).
• Amounts paid after annual or lifetime limits on specific benefits are reached, so long as these limits are reasonable.

On this last bullet point, Notice 2004-71 states that restrictions or exclusions on specific benefits are reasonable only if “ … significant other benefits remain available under the plan in addition to … ” those subject to the restriction. This Notice provides an example of a plan (self-only coverage) with a $1,100 deductible (2008 minimum deductible) and 100% plan coverage thereafter, up to a $1 million lifetime maximum, and a $10,000 annual limit on benefits for any single condition. Because the annual single-condition limit is not reasonable, expenses incurred by an individual after meeting the deductible are counted toward the HDHP $5,600 out-of-pocket expense limitation (2008 individual out-of-pocket maximum).

A plan without an expressly stated limit on out-of-pocket expenses can still qualify as an HDHP, if the terms of the plan are such that the $5,600 individual/$11,200 family maximum cannot be exceeded. For example, a plan with a $2,000 deductible for self-only coverage that pays 100% of expenses after the deductible satisfies the maximum out-of-pocket requirement for HDHPs, even if it does not contain an express out-of-pocket maximum.

The economic stimulus package enacted earlier this year includes provisions that extend and strengthen the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These changes affect employer health plans significantly, together with the various vendors and contractors that provide services to these plans.

HIPAA regulates the use and disclosure of an individual’s protected health information held by health care providers, health plans, and health care clearinghouses (referred to under HIPAA as covered entities).

Vendors and contractors to health plans — such as those providing legal services, accounting services, consulting services, information technology and the like — are considered business associates and previously were not subject to the HIPAA privacy and security rules directly. They did, however, sign business associate agreements to maintain the privacy and security of protected health information, so as to enable the covered entities they contracted with to comply with HIPAA.

In a significant change to this approach, the Health Information Technology for Economic and Clinical Health Act (HITECH), part of the American Recovery and Reinvestment Act of 2009 (ARRA), extends HIPAA’s privacy and security provisions to business associates that provide services to health plans, thus making them directly subject to these provisions in the same way that covered entities are, and also subject to the same direct government penalties as covered entities in the event of a breach. In another significant change, HITECH specifies breach notification procedures that must be followed when there is an unauthorized disclosure of unsecured protected health information. Under regulations issued by the Department of Health and Human Services, these provisions require both the covered entity and business associate to notify each affected individual directly (including any individual whose unsecured protected health information “is reasonably believed” to have been compromised) of a breach “without unreasonable delay but in no case later than 60 calendar days after discovery of the breach.” The regulations specify methods of notice, including use of prominent media outlets if the breach is believed to involve more than 500 individuals. They also specify the information that should be included in a breach notification.

The regulations also define the technologies and methodologies that can be used to secure protected health information. Because the breach notification requirements apply only to unsecured protected health information, when health information is secured in the ways outlined in the regulations, the breach notification requirements do not come into play.

HITECH also directs that penalties collected in enforcement proceedings will be channeled back for additional enforcement efforts. Some commentators have noted that this might indicate more aggressive enforcement of HIPAA’s privacy and security efforts down the road.

Employer health plans and other covered entities will need to review and amend their contracts with health plan service providers to reflect these changes. HITECH states specifically that HIPAA requirements that relate to security and that are applicable to covered entities, in addition to now being applicable to business associates, “shall be incorporated into the business associate agreement between the business associate and the covered entity.”

The Department of Health and Human Services has issued initial guidance on HITECH provisions, but more will be forthcoming. The timetable for implementation of HITECH provisions affecting the HIPAA privacy and security requirements varies. Given the complexity of these new rules, and their potential impact if not followed, companies with health plans subject to HIPAA should take steps now to ensure they are up to speed with compliance.