Breaking the rules

Many private and public health insurers are violating federal rules for the rapid electronic handling of queries for information about patients' coverage, according to insurance claims transmission experts.

The rules, some of which have been in legal effect for more than a year, are intended to help healthcare providers and patients figure out before the care is delivered whether patients are covered for particular services and how much they will have to pay out of pocket. That's particularly important with the growth of high-deductible health plans, which make patients more conscious of how much they'll have to pay.

In one case, the CMS, a health IT consultant and an agent representing a healthcare provider teamed up successfully to pressure one health insurer to meet the rule requirements following the threat of sanctions under the Health Insurance Portability and Accountability Act.

“I'm aware of at least a dozen payers—and they're not small health plans, they're ones that people know—that are not compliant,” said Joseph Gonzalez, senior vice president of Secure EDI, a healthcare clearinghouse headquartered in Charlotte, N.C., and the current president of the Cooperative Exchange, the trade group representing the clearinghouse industry.

America's Health Insurance Plans and the Blue Cross and Blue Shield Association did not comment by deadline.

The CMS also did not provide someone to be interviewed for this story. According to its website, its “primarily complaint driven” HIPAA enforcement strategy has been to “provide technical assistance” and “seek cooperation of all parties.” Through Jan. 31, 2013, the CMS has received 839 complaints for alleged HIPAA rules violations, and all but 14 of those cases are closed. With the new rules, the CMS has “recognized the need for an enhanced enforcement process,” that is “in development” with audits and “potential noncompliance penalties.”

The consultant, Stanley Nachimson, a Baltimore-area specialist in health IT issues, said he was representing a client who wanted to remain anonymous out of concern over possible retaliation by the plan. His client, an agent of a provider organization, wasn't receiving all the information from a particular health insurer required under the new standards and operating rules. Nachimson also declined to identify the private insurer.

One set of rules not being met spell out a federal mandate to use the ASC X12 Version 5010 standards for electronic claims transmission, Nachimson said. HHS required the conversion prior to the ICD-10 diagnostic and procedural codes conversion next year. HHS was empowered to order the changes under the “administrative simplifications” provisions of the HIPAA law designed to squeeze costs out of the healthcare system through computerization.

The compliance deadline for the 5010 rule was Jan. 1, 2012, but to accommodate many stragglers, HHS twice postponed its enforcement date until July 1, 2012.

Another set of rules not being met, Nachimson alleged, are the operating rules that flowed out of the Patient Protection and Affordable Care Act. The compliance deadline for claims status and eligibility transactions of these rules was Jan. 1, 2013.

On real-time queries, the response time is supposed to be 20 seconds. On eligibility inquiries submitted in batches, overnight responses are deemed compliant. Nachimson said the fast turnarounds enable providers to tell patients in advance, “You haven't met your deductible yet this year, or your coverage is 80/20, the bill is $100, you owe us $20. There is a lot benefit in these (new) standards if the plans use them.”

By not complying with the rules, this particular insurer, which offers coverage in about half of U.S. states, was causing providers “a significant disadvantage in not knowing the full extent of a patient's insurance coverage,” Nachimson said.

After talking with the plan and getting nowhere, Nachimson contacted the CMS, which has enforcement authority for administrative simplification under HIPAA. “We filed a complaint and sent it in to CMS and said these guys are not compliant and showed them 10 or 12 places where they were not,” he said. That was around May. 1. The CMS forwarded his complaint to the payer, he said.

The insurer replied Aug. 1. “They said, 'OK, we're going to change all of these,' ” he said. “The vast majority were done by the beginning of August.” These changes benefit all trading partners of the insurer, not just the one filing the complaint, he noted.

“It's a huge win for providers,” said Robert Tennant, senior policy adviser for the MGMA, particularly as patients face higher deductibles, copayments and other cost-sharing under their plan designs. “It's one thing to miss out on a $20 copay, it's another thing to miss out on a $1,000 deductible.”

Nachimson said he and his client are satisfied with the insurer's remedial actions. “The way this industry moves, three months isn't bad.” Nachimson and other experts say many insurers are not complying with the rules. “I wouldn't say it's endemic, but it's not an uncommon practice for this to happen,” he said. “I would guess there are plenty of health plans, Medicaid included, that are not yet following the rules.”

John Kelly, a principal business adviser at Edifecs, Bellevue, Wash., a claims-management services provider to payers and providers, corroborated that. He said there are some plans with “antiquated systems.” When it comes to state Medicaid programs, he said, lots of people say their transactions “are not compliant.”

Kelly said the state Medicaid agencies “will flat out say, yes, we know. We're working on it.” They “feel a little less threatened that they would get penalized” and thus have been “a little bit slower” to seek compliance.

But clearinghouse officials are reluctant to report noncompliant insurers, said Tim McMullen, executive director of the Cooperative Exchange. “We see our role as clearinghouses to mediate as much as possible.”

Secure EDI's Gonzalez said that for insurers, with all the other healthcare reform issues they face, fixing their systems to meet the electronic reporting requirements to providers on patients' insurance coverage “is not in the top 10 things they're worried about.” He attributed insurers' lack of concern and compliance to their perception of a relaxed federal enforcement climate.

The plans won't focus on these rules, he said, “unless there are fines, and they have to be substantial. The first person to get fined $1 million is going to wake everybody else up.”

Follow Joseph Conn on Twitter: @MHJConn