The Baldwin Bulletin- May 2023

A Compliance Newsletter by: The Baldwin Regulatory Compliance Collaborative (BRCC)

Welcome to the May 2023 issue of the Baldwin Bulletin – a monthly guide to important legal news and employee benefits-related industry happenings, designed to keep you abreast of the latest developments.

This month’s issue of the Baldwin Bulletin focuses on providing employers with important 2023 compliance deadlines, as well as certain compliance issues that potentially will have a significant impact on employers over the next several months.

Upcoming 2023 Compliance Deadlines

Employers must comply with numerous reporting and disclosure requirements throughout the year in connection with their group health plans. The attached Compliance Timeline explains key compliance deadlines for employer-sponsored group health plans for the remainder of the year. In particular, please note the following upcoming deadlines:

*https://www.cms.gov/Medicare/Prescription-Drug-Coverage/CreditableCoverage/CCDisclosureForm.html

**Updated Instructions

President Biden Announces Early End to COVID National Emergency; Outbreak Period still ends July 10

On April 10, 2023, President Biden signed a joint resolution ending the COVID-19 national emergency that had been in place since early 2020. Although President Biden signed the resolution ending the national emergency declaration on April 10, the Departments of Labor (DOL), Health and Human Services (HHS) and the U.S. Treasury (collectively, the Departments) have informally indicated that the May 11, 2023, date announced in FAQs Part 58 represents the end of the national emergency for purposes of ending the outbreak period 60 days later.

Employer Action Items

• Please review our previously issued Alert, containing  helpful employer action steps, along with three tables of action items to assist employers with the upcoming end of the public health emergency (PHE), national emergency, and outbreak periods. Note that the Alert was issued prior to President Biden’s announcement, and like FAQ, Part 58, assumes a May 11, 2023, end-date for the termination of the national emergency and corresponding end to the outbreak period on July 10, 2023.

Background

As noted above, the administration had previously announced a May 11, 2023, ending to both the PHE and the national emergency. The signing of the joint resolution only terminated the national emergency as of April 10, 2023. With respect to the national emergency, various employee benefit plan deadlines had been extended by disregarding an “outbreak period” from March 1, 2020, until 60 days after the announced end of the national emergency. Once the outbreak period ends, health plans can return to their nonextended deadlines for purposes of HIPAA special enrollment, COBRA continuation coverage, claims and appeals procedures, and certain plan related notices.

Thus, it would seem that the outbreak period end-date should be June 9, 2023 (60 days after the end of the national emergency). However, deciphering administrative law in this area can be challenging. The resolution signed by President Biden apparently only ended the national emergency under the National Emergencies Act and not certain declarations made under the Stafford Act which the Departments had authority over. Consequently, because the Departments indicated in FAQ Part 58 that the national emergency would end on May 11, 2023, they consider May 11, 2023, to be the end of the national emergency for purposes of determining the end of the outbreak period 60 days later, on July 10, 2023.

More Information

As part of the April 10th announcement, the Department of Labor provided additional guidance on the end of the COVID-19 public health emergency and national emergency, including:

• Tips for employers and health plan sponsors
• Five ways the end of the public health emergency could affect your health coverage

Updated Instructions for June 1 RxDC Reporting Deadline

Employer Action Items

• Contact Responsible Parties. Reach out to carriers, third-party administrators (TPAs) and pharmacy benefit managers (PBMs) to learn their specific RxDC reporting process and any instructions or deadlines that plan sponsors need to follow to ensure that such parties will be timely filing the report on your behalf.
• Review TPA agreements. Confirm that the written agreement with the third party submitting the RxDC report has been updated to include this reporting responsibility.
• Report Data not Otherwise Reportable by TPA and PBMs. If there is a gap in information being reported by the carrier, TPA and PBM, make arrangements to report that data on your own (including to obtain a Health Insurance Oversight System (HIOS) account) or engage a vendor to handle the reporting on your behalf.
• See our prior Compliance Alert from February 17, 2023, with additional information and action items, available here.

Background

Under the Consolidated Appropriations Act, 2021 (CAA), insurance companies and employer-based health plans must annually submit an RxDC report containing information about prescription drugs and health care spending. The Rx stands for prescription drug, and the DC stands for data collection. This includes both fully insured and self-insured health plans, grandfathered and non-grandfathered plans, as well as those subject to ERISA and those not subject to ERISA, including nonfederal governmental entities and church plans.

In anticipation of the upcoming reporting deadline of June 1, 2023 (for the 2022 reference year), the Department of Health and Human Services (HHS) issued updated reporting instructions on March 3, 2023 (see here.).  The instructions include detailed explanations of the plan lists (P1-P3), data files (D1-D8) and other information to be reported.  The following is a list of some of the most significant changes made in the most recent instructions from the prior instructions:

• Specified that RxDC reporting requirements do not apply to retiree-only plans.
• Added option for multiple vendors to submit the same data file on behalf of the same plan, issuer, or carrier.
• Added option for a reporting entity to create multiple submissions in HIOS for the same reference year.
• Renamed column J in D1 from “ASO/TPA Fees Paid” to “Admin Fees Paid” to reflect that self-funded plans pay administrative fees to other types of companies, such as PBMs.
• Specified that prescription drug rebates should be subtracted from premium equivalents in D1 regardless of whether the rebate received in the reference year is retrospective or prospective.
• Specified that stop-loss reimbursements should be subtracted from premium equivalents in D1.
• Specified that stop-loss reimbursements should not be subtracted from total spending in D2.
• Specified that rebates expected but not yet received should be subtracted from total spending.

More Information:

Additional information, including specific reporting instructions, FAQs and training webinars, is available here.  Outside vendor assistance is also available to assist clients.

End of Public Health Emergency Also Ends HIPAA Enforcement Notification Discretion

The U.S. Department of Health and Human Services (HHS)’ Office of Civil Rights (OCR) recently announced that the Notifications of Enforcement Discretion issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act during the COVID-19 public health emergency will expire at 11:59 p.m. on May 11, 2023, due to the expiration of the COVID-19 public health emergency.

Employer Action Items

• Be prepared for increased enforcement activity. The expiration of the Notifications of Enforcement Discretion means that OCR is about to rev up its HIPAA enforcement efforts- the flexibilities that it has shown during the COVID pandemic are going away, demonstrating the continued need for covered entities to improve compliance with HIPAA, including the need for risk analysis and management, information system activity review, and audit and access controls.
• Comply with HIPAA’s privacy and data security requirements. Employers who create, use, disclose and/or maintain PHI must be able to demonstrate their compliance with the HIPAA administrative simplification requirements on an ongoing basis and that their employees be adequately and appropriately trained on a timely and reoccurring basis.

Background

The OCR is the primary agency arm charged with enforcement of the Privacy Rule and Security Rule provisions of HIPAA. While Congress extended many of the telehealth coverage flexibilities permanently or until December 31, 2024, this policy change will no longer permit providers to use technology such as unsecure iPads, smart phones, or other technology for telehealth services unless they meet the stringent HIPAA patient privacy requirements after August 9, 2023.

OCR is providing a 90-calendar day transition period for covered health care providers to come into compliance with the HIPAA Rules with respect to their provision of telehealth. The transition period will be in effect beginning on May 12, 2023, and will expire at 11:59 p.m. on August 9, 2023. OCR will continue to exercise its enforcement discretion and will not impose penalties on covered health care providers for noncompliance with the HIPAA Rules that occur in connection with the good faith provision of telehealth during the 90-calendar day transition period.

More Information

OCR’s notification may be found here.

OCR Issues Proposed HIPAA Privacy Rule for Confidentiality of Reproductive Health Care

The U.S. Department of Health and Human Services (HHS)’ Office of Civil Rights (OCR) recently issued a Proposed Privacy Rule in response to the confusion and concern caused by the new legal landscape in the wake of the Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization last year that overturned a woman’s federal right to an abortion.

Employer Action Items

The OCR expects HIPAA covered entities and business associates to take the following action steps:

• Once Finalized, Implement Requirements of Proposed Privacy Rule. Develop, implement, and maintain compliance documentation, including an attestation form; updated business associate agreements, policies, and procedures; and training materials.

Background

The OCR is the primary agency arm charged with enforcement of the Privacy Rule and Security Rule provisions of the Health Insurance Portability and Accountability Act (“HIPAA”). As indicated above, the Proposed Privacy Rule was issued in response to the confusion and concern caused by the new legal landscape in the wake of the Supreme Court’s Dobbs ruling. Per the Notice of Proposed Rulemaking (NPRM), when a Final Rule is issued, the total timeframe for compliance would likely be 240 days (60 days from the publication of the Final Rule plus 180 days).

More Information

Below are links to the proposed changes to the HIPAA Privacy Rule in OCR’s Proposed Rule, Fact Sheet, and other guidance:

• The proposed changes would only apply to HIPAA covered entities and their business associates – not individuals. As explained in OCR guidance, the existing Privacy Rule permits, but does not require, certain disclosures to law enforcement and others, subject to specific conditions.
• Using or disclosing certain protected health information for “non-health care” purposes would be prohibited.
• The Fact Sheet and other guidance materials address health information of individuals crossing state lines for reproductive health care and are available here and here, respectively.

Guidance on Implications of the Braidwood Ruling on ACA’s Preventive Services Requirement

The Departments of Health and Human Services, Labor and the U.S. Treasury (collectively, the Departments) have issued frequently asked questions (FAQs) to provide initial guidance on how the recent Braidwood court decision affects the requirement to cover preventive services without cost sharing under the Affordable Care Act (ACA). The Departments anticipate issuing additional guidance in the future to further address plans’ and issuers’ obligations in light of the decision.

Employer Action Items

No plan changes are needed at this time. The future impact of the Braidwood decision is unclear; the ruling may be put on hold pending appeal and ultimately reversed or upheld by a higher court. In the meantime, employers that want to make changes to their preventive care benefits should carefully review their options. Additionally, employers that make any plan changes should make sure to timely notify plan participants.

Background

On March 30, 2023, the U.S. District Court for the Northern District of Texas ruled in Braidwood v. Becerra that the ACA’s preventive care coverage requirements based on an “A” or “B” rating by the U.S. Preventive Services Task Force (USPSTF) on or after the Affordable Care Act’s ACA’s enactment on March 23, 2010, violate the U.S. Constitution. Accordingly, the court granted an injunction against the enforcement of those requirements and vacated the Departments’ related enforcement actions. The Biden administration disagrees with the court’s decision and filed a notice of appeal on March 31, 2023, and a motion for a stay on April 12, 2023.

The FAQs include the following important guidance for employer-sponsored health plans:

• Due to the Braidwood decision, health plans are not required to cover preventive care items or services that have an “A” or “B” recommendation by USPSTF on or after March 23, 2010 (the effective date of the ACA). However, the Departments nonetheless strongly encourage plans and issuers to continue to cover such items and services without cost sharing;
• Health plans must continue to cover, without cost sharing, items and services recommended with an “A” or “B” rating by the USPSTF before March 23, 2010, in addition to other recommended preventive care services; and
• State laws regarding preventive care coverage requirements for insured health plans are not impacted by the Braidwood

More Information

Previously issued FAQs are available at https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/affordable-care-act/for-employers-and-advisers/aca-implementation-faqs and https://www.cms.gov/CCIIO/Resources/Fact-Sheets-and-FAQs#Affordable_Care_Act.

Payroll Tax Withholding for Washington Cares Fund to Begin July 1, 2023

Payroll tax withholding under the Washington Long Term Care Act will begin on July 1, 2023, for companies with employees in Washington State, unless an employee qualifies for an exemption. As such, employers need to not only prepare themselves to withhold that tax, but also identify those employees who are exempt from the withholding.

Employer Action Items

• Review the WA Cares Toolkit Calendar. The toolkit includes long content that can be used for months through July, short content and graphics covering a range of topics, videos and designed materials, and frequently asked questions (FAQs).
• Proactively communicate with employees about WA Cares- early and often. Workers often look to their employers for guidance as their most direct and trusted source of information. Furthermore, communication is more effective when sending as a stand-alone message versus as part of a broader communication piece.
• The content of the communications should include information on the benefit, not just the contribution requirement. In order to fully understand the program they are paying into, workers need to get information on how to qualify for the benefit and what services the benefit can be used to pay for. In addition, consider including a reminder to employees that if they want to apply for an exemption, they should do so as soon as possible in light of the upcoming payroll tax withholding. Here is a list of required employee documentation by exemption type.
• Provide resources to managers as well as all Human Resources and payroll professionals as they are most likely to be approached by employees with questions. These groups of staff need to be able to answer questions and point employees to more information.

Background

On May 13, 2019, Washington became the first state in the nation to establish a state-operated public insurance program to pay for long-term care services, to be funded solely through employee payroll assessments. Unlike private long-term care insurance, which requires premiums even after retirement, contributions to the fund will only be made while an individual is working and stop when work stops.

On January 27, 2022, the Washington Legislature and Governor Inslee announced reforms to address coverage gaps and delay program implementation by 18 months.  Workers, who did not receive an exemption, will now begin contributing to the WA Cares Fund on July 1, 2023. These workers can earn a maximum of $36,500 in lifetime long-term care insurance (adjusted annually for inflation) by contributing 0.58% of their wages in premiums while they are working.

More Information

For more information, please visit the WA Cares Fund website and also review these FAQs. For questions about how to use the toolkit or to request additional materials, contact wacaresfund@dshs.wa.gov. Please include “toolkit” in your subject line.

Question of the Month

Question: Is a health care flexible spending account (FSA) subject to COBRA?

Answer: The general rule is yes. However, in most cases COBRA may be offered on a special limited basis.

• The requirement doesn’t apply to FSAs that are maintained by a church, the federal government, or employers not otherwise subject to COBRA because they had fewer than 20 employees during the preceding calendar year.
• If the following conditions are satisfied, COBRA may be offered on a more limited basis. Most, if not all, health care FSAs meet these requirements.
• The maximum benefit payable under the health care FSA during a year to any participant cannot exceed two times the participant’s salary reduction election under the health FSA for the year or, if greater, the salary reduction election plus $500. The health care FSA will satisfy this condition as long as the annual coverage amount equals the annual salary reduction election.
• Other group health coverage must be available to health care FSA participants for the year due to their employment and cannot be limited to excepted benefits, such as stand-alone dental or vision benefits.
• The maximum premium that may be charged for a year of COBRA coverage under the health care FSA must equal or exceed the maximum benefit available under the health FSA for the year. Health care FSAs funded entirely with participant contributions generally meet this condition because COBRA premiums must be calculated based on the cost to the plan of providing coverage, and the cost to the plan will generally equal the elected annual coverage amount because employees tend to incur claims nearly equal to their elected coverage amounts.
• For those health care FSAs that meet the above requirements, COBRA can be limited in two ways (Note that COBRA notice requirements still apply regardless):
• The maximum COBRA coverage period may terminate at the end of the year in which the qualifying event occurs; and
• The health FSA is not required to offer COBRA coverage to qualified beneficiaries whose accounts are “overspent” as of the date of the qualifying event. An individual’s account is overspent if the remaining annual limit (the difference between the annual election amount and the reimbursable claims submitted before the date of the qualifying event) is less than or equal to the COBRA premiums that would be required for the remainder of the year.

Source: Thompson Reuters.