HHS Proposes Regulations to Eliminate Health Plan Identifiers (HPIDs)

HHS has issued proposed regulations that would rescind the requirement for health plans to obtain unique health plan identifiers (HPIDs). The proposed regulations would also eliminate voluntary other entity identifiers (OEIDs). Although HIPAA required HHS to establish standards for HPIDs, HHS did not act on the requirement until the Affordable Care Act (ACA) instructed HHS to issue final HPID regulations by October 1, 2012, in consultation with the National Committee on Vital and Health Statistics (NCVHS). HHS issued final regulations in September 2012 (see our Checkpoint article), setting a November 5, 2014 deadline for larger health plans to obtain HPIDs (and providing an additional year for smaller health plans). Under the final regulations, mandatory HPIDs were to be used to identify health plans—and voluntary OEIDs were to be used to identify other entities (such as TPAs)—in HIPAA standard transactions. Shortly before the 2014 deadline, however, HHS announced an indefinite enforcement delay, citing an NCVHS report questioning the business need, purpose, benefit, and value of HPIDs (see our Checkpoint article). HHS subsequently sought public comments regarding possible changes to its policy on HPIDs (see our Checkpoint article), and a 2017 NCVHS report recommended rescission of the final regulations (see our Checkpoint article).

The proposed regulations follow the recommendation of the 2017 report. In support of rescinding HPIDs and OEIDs, HHS cited confusion regarding the regulatory terminology, the industry’s adoption of other satisfactorily functioning mechanisms to identify payers, and the cost and burden of having to implement HPIDs. HHS also noted uncertainty over application of HPIDs to self-insured health plans, which generally contract with third parties to conduct standard transactions. In FAQ guidance available through its Go-to-Answers webpage, HHS notes that, if the proposed regulations are finalized, it will stop issuing HPIDs and OEIDs, deactivate all previously issued HPIDs and OEIDs in the Health Plan and Other Entity Enumeration System (HPOES), and provide email notification to each health plan’s or other entity’s designated contact person. Health plans and other entities would be permitted to use previously issued HPIDs and OEIDs, but HHS would not maintain HPOES as a central database and would not issue new identifiers (e.g., for health plans or other entities experiencing organizational changes). Comments on the proposed regulations are due by February 19, 2019.

EBIA Comment: Given HHS’s HPID enforcement delay (which remains in effect) and NCVHS’s continuing skepticism about the usefulness of HPIDs, the proposal to eliminate HPIDs is not surprising. Still, because two separate statutes require some form of standard unique identifier for health plans, HHS says it will explore options for a more effective identifier in the future. So, while HPIDs may not survive in their current form, health plans and others involved in HIPAA standard transactions should continue to monitor developments in this area. For more information, watch for updates to EBIA’s HIPAA Portability, Privacy & Security manual at Section XXXII.J (“Unique Health Identifiers”). See also EBIA’s Self-Insured Health Plans manual at Section XXXI.F (“EDI Standards”).

Contributing Editors: EBIA Staff.