Looking Ahead to 2022: Compliance Topics for Employer-Sponsored Health and Welfare Plans

Author: Petula Workman, J.D., CEBS

The passage of the Consolidated Appropriations Act, 2021 (CAA) added many new compliance requirements for group health plans.¹In addition, the Departments of Health and Human Services, Labor and Treasury (the Departments) have issued regulations implementing transparency requirements under the Patient Protection and Affordable Care Act (ACA) that also impact group health plans. Some of these new requirements – such as the prohibition against gag clauses – are already in effect. Others, such as a requirement to include specific information on medical plan ID cards, will become effective for plan years that begin in 2022.

The requirements of the No Surprises Act under the CAA will begin to take effect in January 2022. The Departments issued significant guidance on these new requirements in July and October 2021. The guidance issued so far is comprehensive, but the Departments may very well issue additional guidance clarifying or fine-tuning in 2022. Gallagher's Technical Bulletins No Surprises Act – Part 1 and No Surprises Act – Part 2describe the key points of the No Surprises Act requirements.

However, there are other major requirements under both the CAA and the ACA for which limited (or no) guidance has yet been provided.

What's expected?

In the preamble to the surprise billing regulations, the Departments stated that regulations would not be provided by the end of 2021 for several requirements that will be effective beginning in January 2022. In the interim, group health plans are expected to make good faith efforts to comply. However, the regulators did indicate that they expect to provide at least some guidance in 2022 for the following requirements:

Medical identification cards
Medical identification (ID) cards issued to individuals must include the following information:

1. any applicable deductible,
2. any applicable out-of-pocket maximum, and
3. a telephone number and internet website address that the individual may use to obtain consumer assistance information.

Plans are expected to include major medical deductible and out-of-pocket maximum, a telephone number, and an internet website on the cards. Additional deductibles and out-of-pocket limits could also be provided on a website that is accessed through a Quick Response code on an individual's ID card – or a hyperlink in the case of a digital ID card. The Departments anticipate providing additional guidance for plans that have complex coverage designs.

Continuity of care

Group health plans will be required to notify individuals who are considered to be continuing care patients when a termination of a contractual relationship causes a change in a provider's network status. A continuing care patient is an individual who, with respect to a provider, is:

1. Undergoing a course of treatment for a serious and complex condition,
2. Undergoing a course of institutional or inpatient care,
3. Scheduled to undergo non-elective surgery including, postoperative care for the surgery,
4. Pregnant and undergoing a course of treatment for the pregnancy, or
5. Terminally ill and receiving treatment for such illness from the provider.

The requirement may be triggered when a healthcare provider agreement ceases or does not renew (unless based on failure to meet quality standards or fraud), a termination of the benefits provided because of a change in the terms of participation of the provider or a termination of a contract between a group medical plan and insurer. The notice to the individual must give the continuing care patient an opportunity to elect transitional care or to have care continued as if the termination had not occurred, until the end of 90 days or when the individual is no longer a continuing care patient – whichever is earlier.

Accurate provider directories

Group health plans are required to have a process to verify and update their health care provider directory at least every 90 days and remove those they cannot verify. Plans will need to have a process to respond to network health care provider inquiries within one business day (and keep records of those communications). Plans will also need to establish a database with a list of each health care provider with which they have a direct or indirect contractual relationship for services covered under the plan containing appropriate provider information. Finally, plans must include a notification that the information was accurate as of the date of publication and that the individual should contact the plan to obtain the most current provider directory information.

The CAA also requires that healthcare providers submit certain information to group health plans that will enable those plans to comply with their directory requirement.

Gag clauses

The CAA added a requirement that prohibits plan provisions that restrict information on price and quality, sometimes referred to as a gag clause. A group health plan may not enter into an agreement with a provider, network of providers, third-party administrator or other vendor such as a pharmacy benefit manager that would directly or indirectly restrict the group health plan from:

1. Providing provider-specific cost or quality of care information or data, through a consumer engagement tool or any other means, to referring providers, the plan sponsor, enrollees, or individuals eligible to become enrollees of the plan.
2. Electronically accessing de-identified claims and encounter information or data for each enrollee in the plan or coverage, upon request and consistent with Health Insurance Portability and Accountability Act (HIPAA) privacy regulations, Genetic Information Nondiscrimination Act (GINA), and Americans with Disabilities Act (ADA).
3. Sharing information or data described in 1 or 2 above, or directing that such data be shared with a HIPAA business associate consistent with HIPAA privacy, GINA, and ADA regulations.

This requirement was effective on December 27, 2020, and group health plans should already be in compliance. The Department stated that they consider this requirement to be "self-implementing" without the need for regulatory guidance. However, the statute also requires that group health plans submit attestations of compliance. The Departments have indicated that they anticipate providing guidance on how plans should submit their attestations of compliance, and stated that they expect to begin collecting attestations in 2022. Hopefully, the Departments will provide guidance in the near future.

Healthcare cost reporting

ACA Transparency regulations issued in October 2020 require non-grandfathered health plans (and health insurers) to make certain healthcare cost data publically available in machine-readable files. The data must be provided in two files – an "In-Network Rate File" and an "Allowed Amount File." The first file must show negotiated rates for all covered items and services between the plan (or insurer) and in-network providers. The second file must show both the historical payments to, and billed charges from, out-of-network providers. A third file, which would include certain prescription drug cost information, is currently delayed until additional guidance is issued.

The requirement originally had a January 2022 effective date but has been delayed until July 2022. Gallagher's Technical Bulletin "New Transparency Requirements for Group Health Plans" provides more detailed information.

Prescription drug cost reporting

The CAA requires plans to report certain information about prescription drug and health care spending. In general, plans are required to provide the following information:

• General information regarding the plan;
• Number of covered participants and beneficiaries;
• The 50 most frequently dispensed brand prescription drugs;
• The 50 costliest prescription drugs by total annual spending;
• The 50 prescription drugs with the greatest increase in plan or coverage expenditures from the previous year;
• Total annual health care spending, broken down by type of cost (hospital care; primary care; specialty care; prescription drugs; and other medical costs, including wellness services);
• Average monthly premium paid by the employer;
• Average monthly premium paid by participants;
• Prescription drug rebates, fees, and other remuneration paid by drug manufacturers to the plan in each therapeutic class of drugs, as well as for each of the 25 drugs that yielded the highest amount of rebates; and
• The impact of prescription drug rebates, fees, and other remuneration on premiums and out-of-pocket costs.

The Departments provided guidance in November 2021. Group health plans will be required to submit their first report to the Departments with information for calendar years 2020 and 2021 by December 27, 2022.

What's delayed?

Two important requirements under the CAA and ACA have been delayed until the Departments issue implementing guidance.

Prescription drug costs transparency

Reporting on prescription drug costs is also included in transparency regulations under the ACA. The transparency rules under the ACA generally require plans to make certain information about prescription drug prices publicly available in a machine-readable file. Enforcement of this ACA requirement is delayed until the Departments issue guidance using a notice-and-comment rulemaking process. Gallagher's Technical Bulletin "New Transparency Requirements for Group Health Plans" provides more information.

Advanced Explanation of Benefits

The CAA requires healthcare providers to provide a good faith estimate of the cost of scheduled items or services to plans and insurers and to the individual upon request. When requested, group health plans will be required to provide an advance Explanation of Benefits (EOB) using the cost information obtained from healthcare providers. The advance EOB must contain the following information:

• Whether or not the provider is a participating provider and, for participating providers, the contract rate under the plan for the item or service. If the provider is not participating, a description of how the individual may obtain information on providers that are participating providers.
• Good faith estimates of:
  1. the cost as stated by the provider,
  2. the amount the plan is responsible for paying,
  3. the amount of the individual's cost-sharing,
  4. the amount the individual has incurred toward meeting the plan's deductible and out-of-pocket maximum,
  5. if the service is subject to medical management (e.g., prior authorization or concurrent review), a disclaimer that coverage for the service is subject to medical management,
  6. a disclaimer that the information is only an estimate based on the services reasonably expected at the time and that it is subject to change, and
  7. any other information that the plan deems is appropriate that is consistent with the CAA requirements.

In the preamble to the October 2021 Surprise Billing regulations, the Departments stated that the requirement to provide advance EOBs is delayed until guidance is issued. The Departments acknowledge that plans and healthcare providers need time to build the infrastructure that will make possible the transfer of information that will be needed in order for plans to create advance EOBs.

What might come?

There are two other areas where guidance has not been specifically promised but might be coming in 2022.

Wellness incentives

The Equal Employment Opportunity Commission (EEOC) issued wellness regulations in 2016 that included rules for incentives (rewards or penalties) permitted under the ADA and GINA. HIPAA rules governing incentives were already in place. In response to a December 2017 court order, the EEOC removed the incentive provisions from its regulations effective January 2019. Since the EEOC did not issue any new guidance, plans were left with no concrete rules to use to determine what if any incentive would satisfy the previous vague requirement that the incentive "must not be coercive." In January 2021, the EEOC issued proposed regulations that included guidance on permissible incentives but shortly thereafter withdrew those proposed regulations leaving employers with the same problem – how to determine if an incentive is permissible. The only guidance provided since then – rules for incentives related to COVID-19 vaccinations – does not give employers guidance on incentives for anything other than COVID-19 vaccinations.

Although the EEOC has not given any hints about when the wellness incentive guidance might be issued, we can always hope that it will be sometime in 2022.

HIPAA privacy, security, and breach notification requirements

For several years, the Department of Health and Human Services (HHS) has been working on guidance for the HIPAA Privacy, Security and Breach Notification requirements. They issued a request for information in December 2018 and provided proposed regulations in December 2020. The comment period for these proposed regulations closed on May 6, 2021. Although much of the proposed regulations focus on healthcare providers, some of the proposed changes, such as a substantial decrease in the amount of time a covered entity would have to respond to an individual's request for access to protected health information, will affect group health plans. Many hope that HHS will issue guidance sometime in 2022.

Employer action steps

Because group health plans are required to operate in good faith compliance until additional guidance is provided, there are a number of steps that employers sponsoring group health plans may want to take:

• Discuss needed changes for medical ID cards with the plan's insurer or TPA to include the required information in 2022 cards.
• Confirm with the plan's insurer and/or TPA that they are able to identify continuing care patients and send the required notice offering the individual a choice between transitional treatment or continued care.
• Work with the plan's insurer and/or TPA to ensure that provider directories are up-to-date and that a process is in place to respond to individual and healthcare provider inquiries.
• Review existing contracts with insurers, TPAs, and other vendors and remove any provisions that might violate the gag rule.
• Find out what steps your insurer and/or TPA are taking to comply with the ACA requirement to provide healthcare cost data in machine-readable files by July 2022.
• Review the recently issued prescription drug reporting requirements and confirm with the plan's insurer, TPA and Pharmacy Benefit Manager that they are on track to report 2020 and 2021 calendar year data as required no later than December 27, 2022.
• Inquire about what steps the plan's insurer and/or TPA is taking to ensure that they will be able to provide advance EOBs once the Departments issue guidance and the infrastructure needed to transfer information is in place.
• Watch for more guidance from the Departments and possibly the EEOC!