HIPAA: eligibility, guaranteed issue, renewability…

What HIPAA is

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law with two jobs that the exam tests together:

Portability and access: people should be able to get, keep and move health coverage without being shut out because of their health.
Accountability and privacy: health information that identifies a person must be protected, with real penalties when it is misused.

HIPAA's coverage rules were later strengthened by the Affordable Care Act (ACA). The current federal text is what you are given here, and it reflects both laws.

Eligibility: no discrimination by health status

HIPAA bars a group health plan or insurer from basing eligibility or premiums for an individual on health status-related factors. Those factors include:

health status, medical condition (physical or mental) and claims experience
receipt of health care, medical history and genetic information
evidence of insurability and disability

A plan may still set rules that apply to everyone alike, such as a waiting period for new hires or a full-time-employee requirement. What it cannot do is single out a sick employee or dependent.

Guaranteed issue (guaranteed availability)

Under federal law, each health insurance issuer that offers coverage in the individual or group market in a State must accept every employer and individual in the State that applies for that coverage, subject to the limits below.

The issuer may still:

restrict enrollment to open or special enrollment periods; special enrollment must be offered for qualifying events such as loss of other coverage, marriage, birth or adoption
for a network plan, limit coverage to people who live, work or reside in the service area, and deny new applicants if it shows it lacks the capacity to serve them
deny coverage if it shows it lacks the financial reserves to underwrite more business

Either denial must be applied uniformly, without regard to claims experience or any health status-related factor. An issuer that denies coverage on capacity or reserve grounds may not offer coverage in that area or market for 180 days; after a reserves denial, it must also show sufficient reserves if the State requires, whichever comes later.

Guaranteed renewability

An issuer must renew or continue in force individual or group coverage at the option of the plan sponsor or the individual. It may nonrenew or discontinue only for these reasons:

Nonpayment of premiums or contributions
Fraud or intentional misrepresentation of material fact
Violation of participation or contribution rules (group plans)
The issuer leaves the market
Movement outside the service area of a network plan
Association membership ceases, if coverage was offered only through a bona fide association

Getting sick, filing large claims or getting older is never a reason to nonrenew.

Four colored columns titled HIPAA: four protections. The first column, Eligibility, says plans may not use medical condition, claims experience, medical history, genetic information, or insurability and disability, although rules applied to everyone alike are allowed. The second column, Guaranteed issue, says the insurer must accept applicants, with limits and exceptions for open or special enrollment periods, applicants outside the service area, lack of network capacity and lack of financial reserves; any such denial must be uniform, and the insurer then cannot sell there for at least 180 days. The third column, Renewability, says coverage renews at the insured's option and lists the six reasons for nonrenewal: nonpayment, fraud, violating participation rules, the insurer leaving the market, moving out of the service area, and association membership ending; dropping a product needs 90 days' notice and leaving a market needs 180 days' notice with no reentry for 5 years. The fourth column, Privacy, names the covered entities, health plans, clearinghouses and providers, and lists the criminal penalties: 50,000 dollars and 1 year for a knowing violation, 100,000 dollars and 5 years under false pretenses, and 250,000 dollars and 10 years with intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm. — HIPAA's coverage and privacy protections, with the narrow exceptions under each

When the insurer leaves a product or a market

Discontinuing one type of coverage: at least 90 days' notice, and the insurer must offer every affected sponsor or individual the option to buy its other coverage in that market, acting uniformly.
Leaving the market entirely: at least 180 days' notice to the State and every covered sponsor or individual, and the insurer may not reenter that market in that State for 5 years.

At renewal, an issuer may make a uniform modification to a large group product, or to a small group product (other than coverage available only through bona fide associations) if the change is consistent with State law and applies uniformly to all groups with that product.

Portability and pre-existing conditions

HIPAA originally limited, rather than banned, pre-existing condition exclusions in group plans:

a 6-month look-back for conditions diagnosed or treated before enrollment
an exclusion of no more than 12 months (18 months for a late enrollee)
the exclusion reduced by prior creditable coverage, as long as there was no break of 63 days or more

The ACA replaced this framework: for plan years beginning in 2014, group and individual health coverage generally may not impose pre-existing condition exclusions. Grandfathered individual policies and excepted benefits are outside that ban. Expect the exam to test HIPAA's original numbers and also to know that the ACA eliminated them for most coverage.

Privacy protections

HIPAA's Privacy Rule protects protected health information (PHI): individually identifiable health information held by a covered entity. Covered entities are health plans (including insurers and HMOs), health care clearinghouses and health care providers who bill electronically. Their business associates must also protect PHI.

Key rules:

PHI may be used or disclosed for treatment, payment and health care operations; most other uses need the individual's written authorization.
Use and disclose only the minimum necessary.
Health plans and health care providers generally must give individuals a Notice of Privacy Practices, and individuals have the right to see and get a copy of their records and to request corrections.

Penalties for wrongful disclosure

Anyone who knowingly obtains or discloses individually identifiable health information in violation of HIPAA, including an employee who does so without authorization, faces criminal penalties in three tiers:

Basic offense: up to $50,000 and 1 year in prison
Under false pretenses: up to $100,000 and 5 years
With intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm: up to $250,000 and 10 years

Memory hook: 50 / 1, 100 / 5, 250 / 10. The worse the motive, the higher both numbers climb.

HIPAA: eligibility, guaranteed issue, renewability, and privacy protections