Health Care Law Reform : Health Care Lawyer & Attorney : McDermott Will & Emery Law Firm : Managed Care, Product Regulations

The Facts

Both the Senate and House health reform bills would impose Medical Loss Ratio (MLR) requirements on insurers. MLR measures the percentage of an insurer’s premium revenue spent on health care services. In the House bill, the Secretary of HHS would have to establish the MLR at or above 85 percent. Any issuer with a lower MLR would have to provide “rebates to enrollees of the amount by which the issuer’s medical loss ratio is less than the level so specified.” The House bill also would impose MLR requirements on Managed Care Organizations (MCOs) and Medicare Advantage Plans (MA Plans). The Senate bill is less onerous for insurers because the MLR is currently set at 80 percent and state taxes would be excluded from the MLR determination. Note, however, that potential revisions to the Senate bill reportedly include a 90 percent MLR. In the House bill, the MLR provision would expire January 1, 2013 (excepting the MA Plan and MCO requirements), while the Senate’s would remain in effect until December 31, 2013. 

What’s at Stake

Health insurance issuers could potentially be forced to provide significant rebates. The cost of these rebates will greatly depend on which costs are excluded from the MLR determination. Also, the MLR provisions in the House bill applicable to MA Plans and MCOs have no sunset provisions, thus increasing their potential long-term impact.

Steps to Consider

• Follow the legislation closely because it is a very fluid process, and assess its impact.
• Understand the impact of the proposed MLR requirements and be prepared to adapt quickly to their requirements.
• Closely analyze which details are left to the Secretary of HHS to define by regulation. The rulemaking process will provide an opportunity for advocacy, should MLR provisions be enacted.

• Email This
• Print
• Share Link

The Facts

The Health Information Technology for Economic and Clinical Health Act (HITECH Act) includes significant investment in health information technology to facilitate the adoption of a U.S.-wide health information network and requires HIPAA covered entities, business associates, vendors of personal health records and related entities to notify individuals when their personal health information is subject to a breach of security.  The U.S. Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) recently issued rules relating to these security breach notification requirements.  Compliance with these regulations will require the expenditure of significant time and expense, and, therefore, health care and related industries should begin immediately familiarizing themselves with the rulemakings and updating their processes and procedures to comply accordingly. 

What’s at Stake

HIPAA covered entities, business associates, vendors of personal health records and related entities could be subject to penalties for not properly notifying patients or customers, as applicable, of security breaches involving the patients’ or customers’ individually identifiable health information.  Note that while the HHS rule is effective September 23, 2009, HHS will delay enforcement for six months.  This means that HHS will not impose sanctions for failure to provide the required notification for breaches discovered before February 22, 2010.  Similarly, while the FTC rule is effective September 24, 2009, the FTC will delay enforcement for six months.  This means that the FTC will not impose sanctions for failure to provide the required notification for breaches discovered before February 22, 2010.

Steps to Consider

• If your organization is a HIPAA covered entity, business associate, vendor of personal health records or related entity, review the HHS and FTC regulations, which can be viewed here and here, respectively. 
• Affected entities should immediately begin to develop a compliance plan, because the effective date of the HHS rule is September 23, 2009, and the effective date of the FTC rule is September 24, 2009.
• Consider filing comments on the HHS rule on or before the October 23, 2009, deadline. 
• For a summary of these regulations, review McDermott’s White Paper entitled “Regulatory Update: HITECH’s HHS and FTC Security Breach Notification Requirements.”

• Email This
• Print
• Share Link