Health Plan Identifier (HPID) Requirements: October 2014 Update

This article was written by Lisa Klinger, J.D. & Susan Grassli, J.D.

PDF of this Article: 10-8-14 HPID Summary of Process Update October 2014

The U.S. Department of Health and Human Services (HHS), through its division CMS, recently issued answers to frequently asked questions about HPIDs. The answers provide welcome clarification to the HPID requirement, and this summary includes these clarifications. (To see the Frequently Asked Questions in full, please see https://questions.cms.gov/faq.php?id=5005&rtopic=1851&rsubtopic=8230.)

Quick Summary

Most health plans must obtain a Health Plan Identifier (HPID) to help identify a health plan in certain HIPAA “standard transactions” by November 5^th of either 2014 or 2015 (depending on plan size—see below). A health plan is a plan that provides or pays the cost of medical care. The HPID is a 10-digit identifier that will be unique for each health plan but will be in the same format. There is no charge for a health plan to obtain a HPID, and it can be obtained through the CMS Enterprise Portal.

Controlling Health Plans (CHPs) and Subhealth Plans (SHPs) Defined

A health plan must determine whether it is a controlling health plan (CHP) or a Sub Health Plan (SHP)

Controlling Health Plan (CHP):

CHPs are health plans that control their own business activities, actions or policies; or are controlled by entities that are not health plans.
- All CHPs are required to get an HPID, even if they don’t conduct “standard transactions.”

Sub Health Plan (SHP):

SHPs are health plans over which a CHP exercises sufficient control by directing its business actions, activities or policies.
- For example, an insured health plan offered by a carrier is the CHP, and an employer’s insured health plan is the SHP, because the carrier directs the business actions, activities and policies of the employer’s insured health plan
- A CHP can either obtain one HPID on behalf of itself and the subhealth plans, or it can direct each of the subhealth plans to obtain their own HPID.
- An SHP is not required by law to obtain an HPID but may opt to obtain one or be directed by a CHP to obtain one

Self-funded Plans and Fully Insured Plans

Self-Funded Plans:

Many self-insured plans are controlling health plans and are required to get an HPID whether they conduct standard transactions or not. Sponsors of self-funded plans are responsible to obtain the HPID on behalf of the plan. A self-insured health plan must answer two questions to determine whether it must obtain an HPID.

Question 1: Does it meet the definition of health plan ?
- A health plan is an individual or group plan that provides or pays the cost of medical care
- “Health plan” should not be confused with the term “payer” which may include a health plan but also may designate other entities that do not meet the definition of a health plan, such as a third party administrator (TPA).
Question 2: If it meets the definition of a health plan, is it a controlling health plan (CHP) as defined above?

Third-party administrators (TPA) act on behalf of self-insured plans, but TPAs are not health plans and are not required to obtain HPIDs. Nor are they required to enumerate or identify themselves as health plans in standard transactions. However, TPAs may voluntarily obtain “Other Entity Identifiers” (OEIDs). Since many sponsors of self-insured plans contract with third-party administrators (TPAs) or other vendors to administer their health plan operations, they may not be aware of this requirement or understand it. A health plan may authorize an entity like a TPA to obtain an HPID on its behalf, although this is unlikely given the complexity of the process and the fact that an “Authorizing Official” of the plan sponsor must approve the application, as explained below. Even if the TPA does obtain an HPID on behalf of the plan, the HPID still belongs to the health plan, not the TPA.

Fully-Insured Plans:

All controlling health plans (CHPs) must acquire an HPID, including fully-insured plans. However, for fully insured plans, the Health Insurance Issuer (Carrier) is responsible to obtain the HPID on behalf of the plan. The Carrier is the entity that controls the fully-insured controlling health plan (CHP). Since all CHPs are required to obtain HPIDs, the carrier must obtain the HPID for the fully-insured plan. The individual employer plans are sub health plans (SHPs) to the fully-insured CHPs. Per regulation, SHPs may obtain HPIDs, but are not required to (unless directed to do so by the CHP).

Flexible Spending Accounts (FSAs), Health Reimbursement Arrangements (HRAs), Health Savings Account (HSAs), Wrap-Plans, and Cafeteria Plans

The CMS FAQS clarify that FSAs and HSAs are individual accounts directed by the consumer to pay health care costs. As such, they do not require an HPID.

HRAs may require an HPID if they meet the definition of a health plan. HRAs that cover only deductibles or out-of-pocket costs do not require HPIDs as these are more like additional plan benefits than stand-alone plans.

Wrap-plans and cafeteria plans can be composed of combinations of health plan arrangements (i.e., self-insured, fully-insured, FSA, HSA, HRA). The rules governing these types of plans are the same as for the particular plan types. For example, a wrap-plan that includes a fully-insured medical plan, self-insured dental plan, and HRA that covers deductibles, would require the employer to obtain an HPID only for the self-insured dental plan. The carrier would be responsible for obtaining the HPID for the fully-insured medical plan. The HRA only covers deductibles; therefore, an HPID is not required.

Effective Dates

November 5, 2014 is the deadline by which large plans must obtain an HPID

A large plan is defined as a plan with annual receipts of over $5 million dollars for the prior plan year.

November 5, 2015 is the deadline by which small plans must obtain an HPID

A small plan is a plan with annual receipts of $5 million dollars or less.

November 7, 2016 is the full implementation date for actually using the HPID in standard transactions. See below for an explanation of “standard transactions” and the use of the HPID in standard transactions.

“Annual Receipts” Defined

Annual receipts for fully-insured health plans: the amount of total premiums paid for health insurance during the plan’s last full fiscal year.

Annual receipts for self-insured plans: the total amount paid for health care claims (but not including stop-loss or administrative costs) by the employer, plan sponsor or benefit fund, as applicable to their circumstances, on behalf of the plan during the plan’s last full fiscal year. This applies to both funded and unfunded self-insured plans.

Plans that provide health benefits through a mix of purchased insurance and self-insurance should combine proxy measures (i.e., premiums plus claims paid) to determine their total annual receipts.

Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) 121.104 to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts.

What are the Steps to Obtaining the HPID?

The HPID is obtained through the Health Plan and Other entity Enumeration System (HPOES). It is housed within the Centers for Medicare and Medicaid Services (CMS) Health Insurance Oversight System (HIOS) which is now integrated with the CMS Enterprise portal found at https://portal.cms.gov.

Obtaining an HPID is not a 10-15 minute process, so don’t wait until November 4^th to go online and obtain an HPID! Start this process now, with plenty of time to spare. The next two pages of this article below detail the process to obtain an HPID.

Information that will be needed as part of the process includes:

Company information: Company name, Federal EIN, domiciliary address
Authorizing Official : First & last name, Title, Phone number, email address
Health plan’s NAIC or Payer ID used in standard transactions

CMS has a reference guide, user manual and even a YouTube video that detail how to obtain an HPID. The links to these are listed at the end of this article.

Part 1: Accessing CMS Enterprise Portal and HIOS

□ Step 1: Navigate to the CMS Enterprise Portal (https://portal.cms.gov) and click “New User Registration.”

□ Step 2: Complete the New User Registration process and receive email confirmation of user registration.

□ Step 3: Navigate back to the CMS portal and login using the new credentials.

□ Step 4: To establish access to HIOS through the CMS Enterprise portal, click “Request Access Now” and then “Request New System Access,” selecting “HIOS” and “HIOS User” from the dropdown.

□ Step 5: Navigate to the HIOS registration page using the URL provided on the page and complete the HIOS user registration process.

□ Step 6: Once the HIOS user registration request has been reviewed and approved by the HIOS Helpdesk, an email containing the HIOS authorization code will be provided.

□ Step 7: Repeat steps 3 and 4 in the CMS Enterprise Portal and enter the authorization code on the “Request New System Access” page.

□ Step 8: Log out of the CMS Enterprise Portal and log back in. Users should see a yellow “HIOS” button on the top left of the dashboard indicating successful access established to HIOS.

□ Step 9: Click on the yellow HIOS button, followed by the “Access HIOS” link to navigate to the HIOS Homepage.

Part 2: HIOS Organization Registration

□ Step 1: Click on the “Manage an Organization” button on the HIOS homepage. To determine if the organization already exists in HIOS, users will search by Federal Employer Identification Number (FEIN).

□ Step 2: If the organization does not exist in HIOS, users will need to register their organization by selecting an organization type, clicking on “Create Organization,” and filling out the information on the page including the domiciliary address.

□ Step 3: Receive an email notification once the organization request has been reviewed and approved by the HIOS Helpdesk.

Part 3: HIOS Role Management

□ Step 1: Once the organization has been successfully registered, click on “Role Management” button on the HIOS home page.

□ Step 2: Navigate to the “Request Role” tab, select the HPOES module, the requested role (Submitter or Authorizing Official), and identify the company association for the user by entering the FEIN, and submit the role request.

□ Step 3: Receive an email notification once the role request has been reviewed and approved by the HIOS Helpdesk.

Part 4: CHP HPID Application (Submitter User)

□ Step 1: Click on the “HPOES” button on the HIOS homepage.

□ Step 2: Select the “Create Profile and Apply for HPID” button under the Controlling Health Plan (CHP) Function section of the HPOES homepage to initiate a CHP HPID application for the associated organization.

□ Step 3: Select the organization from the dropdown and provide either an NAIC number or Payer ID. If the Submitter user does not wish to provide either, they may enter “Not Applicable” in the Payer ID field. The organization must have an approved Authorizing Official in order to proceed forward with the application.

□ Step 4: Certify to the accuracy of the application and submit it for approval.

□ Step 5: Receive email confirmation of their CHP application submission.

Part 5: Official CHP HPID Application (Authorizing Official)

□ Step 1: Receive an email notification when an application has been submitted and is awaiting their approval.

□ Step 2: Click on the “HPOES” button on the HIOS homepage.

□ Step 3: Navigate to the “Pending Tasks” button on the HPOES homepage and select the application to be reviewed.

□ Step 4: Approve or reject the application.

□ Step 5: Once the Authorizing Official approves the application, an HPID will be assigned to the CHP.

Part 6: HPID or OEID Number has been assigned!

As noted above, obtaining an HPID is not a 10-15 minute process, so don’t wait until November 4^th to start this process.

Why is an HPID Required?

HIPAA requires medical providers, health insurers, group health plans, TPAs, and other parties involved in HIPAA “standard transactions” to use standard identifiers (same length and format) to identify themselves, and also to use standard formats and code sets for the electronic data being exchanged in a “standard transaction.” HIPAA standard transactions include: medical and dental claims and encounters, payment and remittance advice, claims status request and response, eligibility and benefit inquiry and response, benefit enrollment and disenrollment, referrals and authorizations, and premium payment.

The purpose of requiring standard identifiers, formats and code sets is to increase the efficiency and accuracy of the transactions. Currently health plans are identified in these transactions using various identifiers that differ in length and format. The HPID is a 10-digit identifier that will be unique for each health plan but will be in the same format.

Although TPAs almost always conduct HIPAA standard transactions on behalf of the self-insured plans they administer (and use their own unique standard identifiers in such transactions), the plans themselves are also required to obtain HPIDs if the health plans are identified in the standard transactions (which would likely always be the case). Additionally, the HPID will be used to help HHS implement various administrative simplification initiatives. For example, an upcoming major compliance requirement in 2015 will be that health plans must certify to HHS that they are in compliance with HIPAA’s electronic transaction standards. Under this “Certification of Compliance” process, HHS will use the HPID to track CHPs that have met the certification requirements. Additionally, group health plans must disclose their HPID when requested.

What Penalties Apply if a Health Plan does Not Obtain an HPID?

The HPID regulations do not specify a particular penalty if a health plan fails to obtain an HPID. It appears that the penalty would be the same as the civil monetary penalty that applies for violations of HIPAA’s administrative simplification rules. This means if a plan does not obtain an HPID due to “willful neglect,” HHS could impose a penalty of $50,000, plus an additional penalty of $50,000 each time a standard transaction is made for the plan and should but does not include an HPID. There is an annual cap of $1.5 million for violations of the same requirement.

Additional Background Information

The HPID was initially created in 1996 under HIPAA. The final rule adopting a 10-digit HPID for health plans was published September 5, 2012. The final rule was developed by the Office of E-Health Standards and Services (OESS). OESS is part of the Centers for Medicare & Medicaid Services (CMS). The Administrative Simplification provision of the Affordable Care Act (ACA) also included requirements for group health plans to obtain HPIDs.

HIPAA also requires other entities to obtain unique identifiers if they are identified in standard transactions:

The National Provider Identifier (NPI), implemented in 2004, required medical providers to obtain unique, standardized identifiers.
Plan sponsors identified in standard transactions must be identified by their federal employer identification numbers (EINs).
The Other Entity Identifier (OEID) is a voluntary identifier for third-party administrators, repricers and health care clearinghouses, but is required if the entity is identified in standard transactions.
HIPAA also required HHS to develop standard individual identifiers (similar to Social Security numbers), but this might not happen due to public resistance.