Implementation of HIPAA:

Progress Slow in Enforcing Federal Standards in Nonconforming States

HEHS-00-85: Published: Mar 31, 2000. Publicly Released: Apr 25, 2000.

Additional Materials:

Contact:

Kathryn G. Allen
(202) 512-3000
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Pursuant to a congressional request, GAO reviewed the Health Care Financing Administration's (HCFA) enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), focusing on: (1) HCFA's progress in enforcing HIPAA and related laws in states lacking conforming statutes; (2) HCFA's role in enforcing HIPAA for state and local government health plans; and (3) the status of pending federal regulations regarding HIPAA's nondiscrimination provisions that restrict health plans from excluding employees, or varying benefits, premiums, or employer contributions, on the basis of health status.

GAO noted that: (1) HCFA has overcome some barriers it had previously identified as contributing to its minimalist approach to enforcing HIPAA and the related laws, including clarifying its regulatory authority and having sufficient staff resources for HIPAA oversight and enforcement; (2) however, nearly 4 years after HIPAA's enactment, HCFA continues to be in the early stages of fully identifying where federal enforcement will be required; (3) to varying degrees, HCFA has assumed regulatory activities, such as reviewing carrier policies and marketing practices, in the three states that had voluntarily notified HCFA of their failure to enforce HIPAA; (4) beyond these activities, HCFA has identified more than 20 states where it questions whether they have conforming laws, but it is still in the process of determining whether these states are enforcing the standards through other regulatory means or whether other states' laws are fully in conformance with the federal standards; (5) agency officials did not provide explicit time periods for completing these reviews, and until they are complete, HCFA is largely reacting to consumers' complaints as a means of fulfilling its statutory mandate; (6) although nearly 600 self-funded state and local government plans have opted out of at least one of the federal standards, HCFA has yet to fully determine its enforcement responsibilities among the remaining nonfederal government plans and is instead relying on complaints from enrollees to identify compliance problems; (7) the final regulations regarding HIPAA's nondiscrimination provisions remain pending and are under review by HCFA, the Department of Labor, and the Department of the Treasury; and (8) anticipated issuance is sometime in the summer of 2000.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: As reported in GAO-01-652R, CMS completed a review of state laws related to three of the four federal laws and identified states where it was necessary for it to enforce at least one of the federal standards. To varying degrees, CMS has undertaken enforcement actions in these states. Before fully determining state conformance with the Mental Health Parity Act, CMS is waiting to see whether Congress reauthorizes the law, which is to sunset on September 30, 2001. To satisfy its statutory obligations, CMS will assess state enforcement of these federal standards on an ongoing basis.

    Recommendation: The Administrator, HCFA, should complete the established federal process for determining whether federal enforcement will be required in additional states as quickly as possible, to include developing a consistent strategy and time period for enforcing HIPAA and the related laws' provisions in the states that lack conforming enforcement authority.

    Agency Affected: Department of Health and Human Services: Health Care Financing Administration

  2. Status: Closed - Implemented

    Comments: The interim final rules on nondiscrimination in health coverage in the group market were issued January 8, 2001.

    Recommendation: HCFA, Labor, and Treasury should promptly complete regulations related to HIPAA's nondiscrimination provisions.

    Agency Affected: Department of Labor

  3. Status: Closed - Implemented

    Comments: The interim final rules on nondiscrimination in health coverage in the group market were issued January 8, 2001.

    Recommendation: HCFA, Labor, and Treasury should promptly complete regulations related to HIPAA's nondiscrimination provisions.

    Agency Affected: Department of the Treasury

  4. Status: Closed - Implemented

    Comments: The interim final rules on nondiscrimination in health coverage in the group market were issued January 8, 2001.

    Recommendation: HCFA, Labor, and Treasury should promptly complete regulations related to HIPAA's nondiscrimination provisions.

    Agency Affected: Department of Health and Human Services: Health Care Financing Administration

 

Explore the full database of GAO's Open Recommendations »

Sep 29, 2016

Sep 28, 2016

Sep 15, 2016

Sep 14, 2016

Sep 12, 2016

Sep 9, 2016

Sep 6, 2016

Looking for more? Browse all our products here