Policy Documents

No. 78 How to Implement Kassebaum-Kennedy (html)

Conrad F. Meier –
March 25, 1997

Changes are being made to the national health insurance market that will have far-reaching consequences for the cost and quality of health care in the U.S. During current legislative sessions, state legislators face the formidable task of implementing the mandates set forth in The Health Insurance Portability and Accountability Act of 1996 (Public Law 104 - 191), popularly known as the Kassebaum-Kennedy health care reform bill.

The analysis that follows clarifies key provisions, examines some issues behind the provisions, describes the likely effects on the nation’s health care system, corrects errors made in interpreting the law by the Department of Health and Human Services (HHS) and the National Association of Insurance Commissioners (NAIC), and reviews the options available to state legislators and administrators.


As is discussed in more detail below, state governments are given considerable leeway in how they go about implementing HIPAA. States may take a conservative approach to implementation, doing no more than is necessary to facilitate efforts by the private insurance market to achieve the portability and coverage requirements set forth by the law and remain consistent with the intent of the Act. Other states, however, may take this opportunity to establish more stringent provisions that could lead, intentionally or otherwise, to much greater state government control over health care.

It is important to understand that HIPAA does not require extensive state government regulation of either the individual or group health insurance markets. This point has not been adequately communicated to state legislators, perhaps because many of those responsible for communicating what HIPAA requires and how it should be implemented support a larger role for government in health care than is currently the case in most states.

HIPAA provides some useful insurance reforms, but it also contains flaws because its authors misunderstood the problem of health insurance availability and did not take seriously the consequences of hasty implementation. While the bill addresses the issues of portability and guaranteed issue, the main focus of HIPAA seems to be more on enforcement and greater regulation of an already highly regulated market. If not careful, state legislators can cause unprecedented federal regulations to be layered over current state regulations in the small group and individual health insurance markets.

Because even a conservative interpretation of HIPAA will require some degree of new regulation and restrictions on insurers, we should not expect, nor should officials promise, a reduction of health care costs or a drop in the percent of the general population that is uninsured. Prices are likely to rise as competition is discouraged and the cost of regulatory compliance increases, and rising prices are likely to lower the percent of the population that is covered by private health insurance.

Many of the group and individual market provisions of The Health Insurance Portability and Accountability Act of 1996 (HIPAA) must be made effective at the state level no later than July 1, 1997. The four-year Medical Savings Account demonstration project began on January 1, 1997. An implementation schedule appears at the end of this report.


Supporters of health care reform frequently claim that denial of insurance coverage to people with pre-existing medical conditions is a serious problem in the U.S. The solution that is often recommended is to require that everyone be offered insurance at affordable rates, so-called “guaranteed issue.” Closely related to the issue of access to insurance is the issue of renewability. Some reformers claim there is a serious “job-lock” problem (i.e., people fear losing their jobs because their health insurance coverage would terminate), and that guaranteed renewability regardless of employment or health status should therefore be required by law.

How Big a Problem?

Previous health care debates have taught us that bad data and bad theory equal bad policy. As Beaufort B. Longest, Jr., Ph.D., has observed, if the theory in a policy is wrong, the policy cannot be effectively implemented, since it will not solve the stated problem. It makes no difference that the goals are admirable.<1> In the case of guaranteed issue, the data concern how many people genuinely lack access to health insurance. The theory concerns why such persons are not insured.

According to the Agency of Health Care Policy and Research, a branch of the U.S. Public Health Service, only 1 percent of the general population (about 2 million people) has ever been denied health insurance for medical reasons.<2> While we do not know how many people pay higher or “rated” insurance premiums due to health conditions, we do know from the nationwide Behavioral Risk Factor Surveillance System<3> that about 6 percent of the population says it is in “fair or poor health.”

Very few people stay uninsured or unemployed for long periods of time. The latest verifiable estimates suggest that 40 million people are uninsured at any one time.<4> During a 12-month period, 58 million people may be uninsured for at least one month. Most uninsured spells are temporary, half last less than six months, and nearly three-fourths last less than 12 months.<5> Only 15 to 18 percent of all episodes of being uninsured last longer than 24 months.

Since most health insurance access is tied to the job market, being uninsured is similar to and usually the result of being temporarily unemployed. The vast majority of people will experience both conditions at some time in their lives without becoming either poor or unhealthy.

One reason lapses in insurance tend to be so brief is because many states have already passed laws and established programs to guarantee access in cases involving pre-existing conditions and other factors that could make buying insurance difficult. Other reasons include: Hospitals are required to provide emergency service without consideration of a patient’s ability to pay; treatment of non-emergency medical conditions, with few exceptions, can be postponed until insurance is reestablished; those who are most likely to be uninsured are relatively young and healthy, and therefore least likely to need medical care; and finally, lacking insurance does not stop a person from buying needed medical services with cash from savings, credit, or borrowing.<6>

These data suggest that the phenomenon of people being temporarily without insurance is not a problem that requires a total overhaul of insurance practices. And yet, that is precisely the “problem” that HIPAA was enacted to “solve.”

What HIPAA Requires

In developing policy, Congress determined that job-lock affects interstate commerce and is, therefore, the subject of federal jurisdiction, not state insurance regulation.<7> Prior to HIPAA, states had exclusive jurisdiction to regulate insurance. Though they still have jurisdiction, any state law inconsistent with the Act will be preempted.

The new health insurance coverage guarantees required by HIPAA are guaranteed issue for small business (2 to 50 employees) and “eligible individuals” and collective renewal of health insurance in all markets. More specifically:<8>

  • Small group insurers must offer at least one standard policy available to every small employer with 2 to 50 employees. Large group insurers may issue insurance on an “accept-reject” basis to employers with 51 or more employees. (That is, if the insurer accepts the group it may not exclude high-risk employees or those with pre-existing conditions, and if it rejects a group it must reject the whole group and not only the high-risk members.)
  • No group insurer is allowed to condition individual eligibility on health status, medical condition (physical and mental condition), claims experience, receipt of health care, medical history, genetic information, evidence of insurability (including hazardous activities and conditions arising out of domestic violence), or disability of any member of the group.
  • “Eligible Individuals” must be guaranteed access to some type of coverage. To qualify as an “Eligible Individual,” a person must have had 18 months of prior coverage under a group plan, have elected and exhausted continued benefits coverage under COBRA (typically 18 months), and not be eligible for any other group health coverage.
  • All group and individual insurance must be collectively renewable. This means that an insurer who elects to cancel a policy because of high claim costs is forbidden from offering any insurance in that market in that state for five years.

How to Comply with Small Group Provisions

HIPAA defines a small business as having as many as 50 or as few as 2 employees. The Health and Human Services Department (HHS) Press Office mistakenly reports the definition as being “50 and fewer employees.”<9> HHS’s false definition would allow a single, self-employed person to qualify as a small business, a situation that would pervert the individual insurance market and contradict HIPAA’s other provisions allowing self-employed individuals to deduct a gradually increasing percentage of insurance premiums from their taxable income.

The National Association of Insurance Commissioners (NAIC), too, makes a mistake in interpreting this part of HIPAA. NAIC’s draft template for state implementation of the Act says the Act requires guaranteed issue of all small group plans offered by an insurer in that state because “the act does not . . . limit its guaranteed issue requirement to two packages.”<10> That may be literally true, but neither does HIPAA specifically require guaranteed issue of all small group policies offered by an insurer. This omission is significant because when the Act addresses guaranteed issue in the individual insurance market, it is very specific about the kinds of coverage affected (see below).

Because HIPAA does not does not require states to force insurers to guarantee issue all small group policies, Virginia has complied with HIPAA by enacting legislation requiring guaranteed issue of only a basic policy complying with the NAIC’s 1992 small group model legislation. Other states, including Oklahoma, Georgia, Idaho, Utah, and South Dakota are in the process of adopting the same compliance strategy. This approach complies with HIPAA and allows the rest of the insurance market to function normally.

How To Comply with Individual Insurance Provisions

The definition of “Eligible Individual” is very narrow and intended to reinforce the notion that once a person is in the insurance system (in this case, insured for 18 months or longer), he or she should be given the opportunity to buy insurance regardless of employment status. A very small number of people meeting these requirements has any difficulty getting insurance under the current system.

In interpreting HIPAA’s provisions for individual health insurance, the NAIC makes the same mistake as it made when addressing the small group market. Its draft template states that “the bill [HIPAA] provides for guaranteed issue of all products to eligible individuals.”<11> But HIPAA is clear that guaranteeing issue of all products is only one of many choices available to state regulators in determining how to craft an acceptable set of policies for the individual health insurance market.

States may choose to require firms to offer two different health insurance coverage plans that comply with the new federal guidelines and regulations regarding the individual health insurance market,<12> or they may choose among the following alternatives:

  • A qualified high-risk pool following the NAIC Model Health Plan for Uninsurable Individuals Act;
  • The NAIC Individual Health Insurance Portability Model Act;
  • The NAIC Small Employer and Individual Health Insurance Availability Model Act;
  • A risk-adjustment, risk-spreading, or risk-subsidization method; or
  • A method under which eligible individuals have a choice of all available health insurance products.

It is not necessary for state governments to radically change their current regulatory policies to comply with HIPAA. In fact, many states may already meet the Act’s individual insurance requirements by operating state-based high-risk insurance pools for the difficult-to-insure. These pools, currently insuring over 100,000 individuals in 28 states, <13> generally charge premiums that are 25 to 50 percent higher than those charged a healthy person.

According to the American Academy of Actuaries study, “The uninsurable population in these states [with high-risk pools] already has access to health insurance, in most cases at premium rates at or below what those insurers would charge for individuals with high expected health care costs.”<14> States with high-risk pools can continue this proven approach and apply to have the requirements of HIPAA waived.

The risk-pool approach works because it removes the high health-risk individual from the standard-risk insurance pool. This makes it unnecessary for insurers to increase premiums for everyone or community-rate the premium in order to compensate for the extraordinarily high health insurance claims that would otherwise occur in the standard-risk pool. The rest of the insurance market is therefore able to function normally.

Besides high-risk pools, Medical Savings Accounts also hold promise as a market-based reform that expands access and improves portability. The next section discusses them in greater detail.


Understanding MSAs

An MSA is a trust or custodial account created exclusively for the benefit of the account holder and subject to rules similar to those applied to individual retirement accounts (IRAs). Instead of buying expensive low-deductible health insurance, an MSA allows individuals to purchase less-expensive high-deductible insurance and place the premium savings in the savings account, to be saved and allowed to accumulate until needed to pay for medical expenses. MSAs wean health care consumers from their excessive reliance on third-party payment of their medical bills, thereby addressing one of the most fundamental reasons for health care price inflation, waste and inefficiency.<15>

Banks, insurance companies, and other approved entities may become trustees of MSAs. HIPAA limits MSAs to the self-employed and employees in small group plans with between 2 and 50 employees (two populations more likely to be without insurance than the general population) when coupled with a high-deductible health insurance policy.

Other provisions of HIPAA related to MSAs are:

  • Individuals are allowed a tax-free contribution to and tax-free distributions from an MSA of up to 65 percent of the health policy plan deductible from $1,500 to $2,250, with family coverage set at 75 percent of the deductible between $3,000 to $4,500.
  • Maximum out-of-pocket expenses are established for individuals at $3,000 and $5,500 for a family policy.
  • Funds withdrawn for nonmedical expenses are taxable as income and subject to a 15 percent penalty--unless such withdrawals are made after age 65 or at the onset of a disability.
  • Interest earned on funds that accumulate in an MSA is also tax-free.
  • There are no “sunset” rules for MSAs. Those who establish them get to keep them after the four-year project is concluded.
  • At death, any remaining funds may be included in the decedent’s gross estate under rules similar to those governing IRA funds.

Cap on Enrollment

HIPAA restricts the number of MSAs that may qualify for favorable federal tax treatment to 750,000 people who had health insurance coverage at any time during the prior six months, but there is no limit on the number of people who can sign up for MSAs who were without insurance coverage during the prior six months. Recruitment from both classes must stop when the cap of 750,000 previously insured persons is reached.

The cap on MSAs limits the ability of states to use them to expand access to and the portability of health insurance. State legislators nevertheless can enact or expand state-level MSAs, promote the viability of the concept, and lobby their congressional counterparts to remove the ceiling on the number of federally approved MSAs.

There was little reason to limit MSAs to a demonstration project. Over one thousand employer groups, both public and private, already have established what amounts to MSA plans for their employees through a federal pre-tax plan called Sec. 125 Medical Spending Accounts (Cafeteria Plans). The program, with over a million enrollees, differs from MSAs in that persons enrolled in cafeteria plans lose whatever funds are left in their account at the end of each calendar year (the so-called “use it or lose it” rule). MSAs, by allowing people to “use it or keep it,” would go even further than cafeteria plans to reduce employer health insurance costs and individual out-of-pocket medical expenses while restoring patient power to health care consumers.

MSAs Are Creditable Health Coverage

The NAIC, in the same draft statement to state regulators mentioned earlier, makes two statements regarding MSAs that could mislead policy makers. The NAIC claims that MSAs are not creditable health coverage and therefore would not be considered an option for guaranteeing coverage to Eligible Individuals. The NAIC also claims that when the pilot program ends, existing MSA account holders may keep their accounts but will no longer be able to make tax-deferred deposits into their accounts.<16> Both statements appear to be wrong.

HIPAA contains a list describing health insurance coverage that would meet the requirement that Eligible Individuals be given access to insurance. There is no indication in the Act that specific individual or group health insurance policies would fail to qualify on account of the size of the deductible they establish, nor (and consequently) any suggestion of where or how such a line would be drawn. If the authors of the NAIC statement feel high-deductible insurance doesn’t provide sufficient protection from medical bills, then they fail to understand the self-insurance role played by an MSA. It seems obvious that HIPAA considers an MSA accompanied by high-deductible insurance to be creditable health insurance.

The NAIC statement also incorrectly states that “if Congress does not specifically extend the program after the year 2000, those participants with MSAs will be allowed to keep them, but without favorable tax treatment.”<17> But once again, HIPAA contains language that clearly allows individuals who establish MSAs prior to the cut-off date to contribute to their accounts on a tax-preferred basis after the program ends, as long as they maintain high-deductible health insurance policies.<18>

To further clarify, individuals who do not open an MSA prior to the cut-off date may still establish a tax-preferred plan if they become employed by a small employer that established an MSA program before the cut-off date.<19>

A Flawed Experiment?

The restrictions placed on MSAs limit the number of people who can buy them and make their purchase complicated and maintenance very complex. The program is encumbered by dozens of intricate statutory conditions on employers and insurers and requires tight policing by the IRS. For example, a small employer who grows beyond the employee limit within the four-year demonstration period could be forced to change policies.

The Treasury Department is required to evaluate the MSA experiment and report to Congress on the adequacy of high-deductible insurance purchased in conjunction with MSAs. More bureaucracy is created by establishing an independent health policy organization to study and report on the impact on health care spending, adverse selection, and preventive care.

Many small employers already are overwhelmed by bookkeeping and regulatory compliance paperwork. The MSA program, with its strict reporting requirements, is not designed to be an appealing option for harried small business owners. Moreover, the artificially small pool of potential policyholders is not an inviting opportunity for commercial insurers. The small size of the experiment will limit the competition to a small number of companies already specializing in high-deductible health insurance. And while some insurers may welcome the lack of competition, the result will be higher premiums for consumers facing limited choices.

The unusual restrictions placed on this free-market product ensure that the demonstration project will not be able to answer many of the questions posed by MSA opponents. According to Merrill Matthews, Jr., Ph.D., vice president of domestic policy for the National Center for Policy Analysis, “For example, will MSAs result in ‘adverse selection’--in which the healthy move into one plan while the sick remain in another? By limiting the demonstration to 50 or fewer employees, Congress has virtually guaranteed that the answer will be no.”<20>

State legislators need to understand that adverse selection can occur only when employees have a choice between two or more employer-provided health insurance plans. The reality is that almost all small employers offer only one health insurance plan. Without the ability to switch insurance coverage, adverse selection barely exists.

Despite these problems, the MSA legislation is off to a good start. Whether or not it makes it to the finish line remains to be seen. The Congressional Budget Office estimated that the health insurance provisions in HIPAA could help some 150,000 people gain insurance. Medical Savings Accounts, however, could have helped millions were it not for the Congressional limit of 750,000.


One of the most promising ways to expand access to health insurance and improve portability is to allow people to open Medical Savings Accounts in conjunction with high-deductible health insurance policies. The lower cost of the premiums brings the price of health insurance within reach for millions of people who are presently priced out of the health insurance marketplace, while the MSA provides cash for first-dollar coverage of routine or unexpected small medical expenses.

Unlike insurance coverage mandates or community rating, MSAs work with rather than against underlying market forces in the health care industry. MSAs give consumers a reason to ask for prices and comparison shop for less expensive health care, behavior that was common before World War II and changes in tax policy that led to our present over-reliance on third-party insurers.<21>

HIPAA was a breakthrough for MSAs by authorizing over 750,000 accounts to be opened. Many states have already passed MSA legislation granting state tax breaks, and these accounts are helping to demonstrate the power of such a reform. But to be effective, deposits to MSAs must be free of federal taxes, in order to put out-of-pocket spending on a level playing field with employer-paid insurance premiums.

State legislators should lobby their congressional counterparts to remove the ceiling on the number of MSAs allowed under HIPAA. Short of that happening, they should consider state tax deductions or credits to make state-level MSAs attractive compared to employer-paid insurance. Such efforts should qualify as part of an effort to implement HIPAA.


Three alternatives to risk pools and MSAs, all of them less sensitive to the consequences of forcing compliance on the health insurance marketplace, are mandating coverage, regulating prices, and requiring insurers to use “community rating.” Past experience suggests that these alternatives are unsound.

Problems with Health Insurance Mandates

Imposing mandates to achieve federally required coverage guarantees may have seemed to Congress to be a new idea, but mandates have a long and ignoble history at the state level. State regulations already impose rules on the health care system by requiring insurance coverage for a vast array of very specific benefits. Some one thousand state laws mandating insurance coverage of specific conditions are in place today, costing health care consumers more than $60 billion a year.<22>

In Missouri, where I live, these mandates have been responsible for adding an average of 25 percent to the cost of standard-issue health insurance premiums. Repealing mandates nationally would reduce average premiums by some 30 percent.<23> It is estimated that one in five small firms that are not now offering health insurance benefits would do so in an environment free of state-mandated benefits.

Some state legislators see passage of HIPAA as an opportunity to mandate that all businesses purchase health insurance for their employees or pay a payroll tax (typically between 7 and 10 percent) to help fund a public health insurance program for those not covered by private insurance. The Clinton Administration resurrected “play or pay” as a funding mechanism for its managed competition plan after it became apparent that managed competition would increase, rather than decrease, health care spending. But “play or pay” has many disadvantages of it own.

In an editorial condemning “play or pay,” The New York Times said “The lowest-paid workers would be hardest hit.”<24> The Washington Post agreed, saying “Among the great unspoken disadvantages of this is that it would likely be regressive, hurting the very people it is meant to help, in that left to itself the increased cost would further depress the wages of the already low-paid workers who are the majority of the working uninsured.”<25>

“Play or pay,” which is intended to benefit the working poor, would have just the opposite effect. Large companies and companies that employ high-paid workers might be able to raise prices enough to recover the cost of the new benefit, or reduce salaries by the amount of the new burden. But small businesses and businesses that pay low wages often are unable to make these adjustments, and must instead lay off employees. If salaries are already at or near the minimum wage, for example, making an offsetting wage reduction would be illegal.<26>

Under “play or pay,” the cost of insurance is likely to increase even faster than in the past. Since health insurance no longer would be subject to contract negotiations between management and labor, employers and employees no longer would be able to weigh the benefits of insurance against its costs. Since purchase of the policy would be mandatory, premiums could be expected to rise, and complex formulas and regulatory mechanisms to determine the “just” price undoubtedly would find their way onto next year’s legislative agenda.

Pressure could be expected to mount for expanding the range of treatments covered by the mandated insurance policies, just as state insurance mandates have multiplied in recent years. The result would be rising insurance premiums and still more employers dropping their private insurance coverage and choosing instead to pay the payroll tax. As companies with poor health-claims experience turn over their workforces to the tax-funded public program, its costs would rise disproportionately.<27>

Problems with Price Controls

State legislators commonly promise business leaders that their reforms would rein in the cost of employee health insurance. But experience indicates that prices rise rather than fall as government intervention increases. When called on this matter, some legislators respond by proposing “temporary” price controls on health care providers and insurers.

Imposing price controls on health care providers would be a tremendously costly mistake. Price controls, in the words of C. Jackson Grayson, Jr., “have not worked in 40 centuries.They will not work now.”<28> Grayson, who was chairman of the Nixon Price Commission between 1971 and 1973, presents seven reasons why price controls will not work in health care. Together they make a compelling case against price controls:

1. “Getting into controls is a lot easier than getting out of them.” Once in place, price controls make “fixing” the original problem even more difficult. Politicians soon fear that lifting the controls will result in a price explosion . . . which it invariably does.

2. “No matter how clever the price control designers, they cannot prevent distortions.” Cost-shifting, unbundling services, black markets, shortages, and more resulted from price controls in the 1970s and are likely to be repeated if price controls are tried in the 1990s.

3. “Quality does not improve with controls.” What we want is greater efficiency and higher quality for the dollars we spend on health care. What price controls deliver is temporarily lower prices at a steep cost in lost quality.

4. “Cost controls actually increase costs.” The cost of enforcing and complying with price controls would be massive. Doctors, hospital administrators, and insurance companies are already buried with paperwork; price controls would double or triple that burden.

5. “Controls breed more controls.” The Nixon price controls started with 3-1/2 pages of regulations and ended with 1,534. Every decision on how the price controls applied to one product or service led to the need for new decisions on other goods and services . . . ad infinitum.

6. “Voluntary becomes mandatory.” Voluntary price controls are usually only a prelude to mandatory controls. Recommending voluntary controls, therefore, is not a prudent compromise or accommodation; it is a definite step toward mandatory price controls and all the costs that will follow.

7. “Global budgets don't work.” There is no way to enforce global budgets because there is no political will to counter the interest groups that support higher spending. Spending doesn’t stop when a budget ceiling is reached.

Problems with Community Rating

A variation on price controls already being used in some states is “community rating.” State regulators force insurance companies and HMOs to charge uniform premiums for the young and healthy as well as the sick and elderly. This arrangement has historically resulted in soaring insurance costs for everyone it touches.<29>

A comprehensive study of community rating prepared by the Council for Affordable Health Insurance found New York, New Jersey, Vermont, Kentucky, Connecticut, Massachusetts, and Florida have experienced significant premium inflation while failing to improve access using regulations that require private insurers to offer guaranteed issue and renewability.<30>

Requiring insurers to accept previously insured people applying for individual coverage would distort the individual health insurance market by making the individual insurer the insurer of last resort. Employees with significant health problems who become unable to work would go to the individual market for health insurance. Since the premiums they previously paid had gone to the most recent employers’ plans, other insurers would then have to pick up the cost of expensive health care for the individual. This, then, would create a “cost-shifting” effect of significant proportions, undermining the profitability of some insurers while rewarding various kinds of risk-avoidance tactics.

The practice of risk shifting is already a problem in some states, where a state’s high-risk pool has become a dumping-ground for those employers and insurance agents seeking to remove unhealthy employees from their employee groups. Indiana recently refined its high-risk pool to make it illegal to “carve out” and dump employees with health problems. In the event that some form of community rating is imposed on group insurers, similar restrictions would have to be in place to prevent group insurers from dumping high-risk people into the individual insurance market.

The millions of mostly healthy Americans who are currently uninsured are potential buyers in the individual policy market. Rising premiums would encourage them to stay uninsured (rather than pay inflated premiums that subsidize the health care of the older and less healthy) and encourage others to drop their coverage on the assumption that they could not be turned down or charged a premium when they eventually need medical treatment and apply for health insurance. This temptation to “game” the system would further fuel the rise in insurance costs. State government efforts to contain prices will likely force many individual insurers to withdraw from the most hostile markets, reducing competition and further fueling the price spiral.

If state legislators are not careful, the provision of guaranteed issue would be similar to forcing banks to issue loans and mortgages without asking for a financial statement or checking a credit history. It would be like buying fire insurance after the fire.

Some states may try to comply with HIPAA’s coverage requirements through hybrid experiments on the risk-pool approach or, as is possible in Pennsylvania or Michigan, mandating that Blue Cross become the insurer of last resort. These alternatives tend to drive up the health insurance premium costs for all individual and small group insurance plans in the state. Consequently, they exacerbate the very uninsured problem they seek to solve.


HIPAA gives states at least five ways to reach its objectives of expanded access and portability of health insurance for eligible individuals, besides the option of simply enforcing federal regulations. One of these ways--the state-based high-risk pool--is already being used successfully by 28 states to provide access to health insurance for the difficult-to-insure. Before contemplating policy changes, state legislators would do well to ask whether their state’s current efforts to expand access don’t already meet HIPAA requirements.

The problem that HIPAA sets out to solve--persons involuntarily without health insurance for extended periods of time--is dramatically smaller than Congress seemed to think when it drafted the law. This means the intent of the law can be fulfilled with much less intervention by state governments than many health care reform advocates want. It also means there is little justification for imposing heavy-handed regulations on the entire health insurance industry if the population needing help is just 1 percent or less of the general population.

Three avenues that state policy makers are advised to avoid are coverage mandates, price controls, and community rating. State governments have extensive experience with mandates, none of it good. Employer mandates drive people out of the private health insurance market and into the ranks of the uninsured or into subsidized public programs. Price controls don’t work and cause market distortions and waste. Community rating poses the risk of destabilizing small group insurance markets by shifting risk among insurers and encouraging socially unproductive conduct by consumers and insurers alike.


Enforcement, Privacy, and Fraud

Enforcement and regulation to standards seem to be the main focuses of HIPAA. States are given the primary responsibility for enforcing provisions outlined in HIPAA, but if the states fail to act, the Secretary of Health and Human Services can impose civil monetary penalties on the states. The Secretary of Labor will enforce these rules for self-insured plans (ERISA) and the Secretary of Treasury may impose tax penalties on employers or insurance plans that are not in compliance.

HIPAA establishes an expansive data collection apparatus at the federal level, including the storage and dissemination of patient records. Each person will have a “patient identifier” code in order to organize patient medical records that are scattered about in different files and databases of doctors, laboratories, hospitals, or HMOs.<31>

A new health care fraud and abuse control program is created and will be coordinated by the HHS Office of the Inspector General and the Department of Justice with funding appropriated from the Medicare Hospital Insurance Fund. The new Fraud and Abuse Control Program will:

  • Establish the Medicare Integrity Program;
  • Require exclusion from Medicare and Medicaid for felony convictions related to health care fraud or controlled substances;
  • Create a program to encourage Medicare beneficiaries to report fraud and abuse;
  • Expand conditions under which civil monetary penalties and sanctions can be imposed on HMOs participating in Medicare;
  • Establish a database of adverse actions taken against health care providers; and
  • Make willful transfers of assets to gain Medicaid eligibility subject to criminal penalties.

HIPAA requires all health care providers and all health insurance plans that engage in electronic administrative and financial transactions to use a single set of national standards and identifiers. The Act preempts any contrary provisions of state law, but does not supercede any provision of state law that the HHS deems necessary to control fraud and abuse. This database is to be available to federal and state government agencies pursuant to any procedures set by the Secretary of Health and Human Services.

In a long reach that could end up in the courts, the federal government wants not only available information on medical history, claims billing, and payments, but also enrollment and disenrollment data, eligibility, premium payments, claims status, and referral information. The Act requires all health professionals to disclose to the government the details of every patient encounter, including diagnosis, test results, therapy, charges, and 32 pieces of demographic data on every patient.<32> These provisions could mean the end of patient privacy and confidentiality of the physician-patient relationship.

Maryland has already begun the practice by collecting information--without patient consent--even if you paid for the medical care out-of-pocket. In Boston, clinicians who had promised AIDS patients confidentiality were shocked when federal auditors demanded and received patients’ names.<33>

In the text of the conference report, Congress stated its good intention to protect the privacy of Americans. But good intentions may not be enough. As journalists have pointed out recently, unauthorized leaks could result in confidential data being sent into e-mail boxes all over the world. Unauthorized disclosure of confidential information--even FBI files--has occurred during recent administrations.

State legislators need to be aware of the opportunities created by HIPAA for harassment of doctors who refuse to share medical information about their patients or to participate in the myriad new bureaucratic programs that could arise from the new anti-fraud provisions. The danger that medical files will no longer be confidential or could be the subject of tampering should be alarming to all civil libertarians and people committed to sound medical ethics.

State legislators should consider instructing their insurance commissioners and other health care officials to report on current measures taken and future measures to be taken to protect the confidentiality of medical records and the freedom of medical professionals to conduct their practices in ways that meet their own high ethical standards. Any new legislation, programs, or policies adopted in the name of “implementing HIPAA” should contain specific language addressing these issues, with mechanisms for hearings about and action taken in response to possible instances of abuse or violation of privacy.

Helping the Self-Employed

A long-overdue tax inequity faced by the self-employed has been the limited deductibility of their health insurance premium costs. HIPAA finally addresses this problem, allowing for the deduction to increase from the current 40 percent of premiums to 80 percent by 2006 and thereafter.<34> (HHS incorrectly reports that the 80 percent deduction is to be phased in by 2002.<35>) States should amend their tax codes, if necessary, to follow the federal lead.

Long-Term Care Insurance

Congress also at last recognized that consumers can be encouraged to take responsibility for financing their long-term health care. HIPAA clarifies that long-term care insurance (LTC) will be treated like accident and health insurance if the policy is a qualified LTC policy. Thus, benefits up to $63,875 a year are excluded from taxable income, and premiums are tax deductible.

Many of the requirements for a qualified LTC policy are based on the 1993 (not 1996) NAIC Long-Term Model Care Act. A qualified LTC policy must start benefit payments when a policyholder cannot perform at least two activities of daily living (ADLs) which include “eating, bathing, dressing, toileting, transferring and incontinence.” A policy that does not take into consideration at least five ADLs is not qualified. There are provisions to “grandfather” existing long-term policies that met state LTC requirements at the time of issue.

To prevent consumers from turning LTC into tax-free retirement accounts, HIPAA limits the circumstances under which qualified polices can begin paying benefits. To receive tax-exempt benefits, an insured must be too senile to live independently or else need help with two of the ADLs.

Many states seem to have applied an even hand when regulating insurers in the LTC market. If there is a weakness in state regulation it is not in regulation of the insurers, but in the regulation of some poorly trained or unscrupulous insurance agents who sell LTC. With favorable tax treatment, LTC will become a booming market. States may want to apply more stringent consumer protection laws. If state laws are less stringent than HIPAA, the federal law prevails.

Medi-gap Insurance

As of November 5, 1991, people age 65 or older could not be denied medi-gap insurance coverage (i.e., private insurance supplementing Medicare’s coverage) for six months immediately following enrollment in Medicare Part B. Part B covers major medical expenses and is premium- supported government health insurance. HIPAA provides for further consumer protection by requiring insurers to clearly identify any medi-gap policy that duplicates Medicare benefits. States need do nothing as they already comply with previous law. States may once again wish to apply more stringent consumer protections than are provided by the law.

Viatical Insurance Settlements

This provision allows qualified individuals to take advantage of their life insurance policies by receiving tax-free advance payments from the death benefit proceeds. This “living benefits” feature of many life insurance policies is not a new idea, but HIPAA now allows people to get relief from taxes in order to pay for health-care related expenses. This provision benefits millions of Americans, particularly the elderly suffering from chronic diseases and life-threatening illnesses.<36>


HIPAA will affect many health insurance reforms previously initiated at the state level. Given the breadth of the Act, the proposed timetable for implementation appears to be hasty and very aggressive.

It is not too late to ask Congress to reconsider the issue of portability and review the consequences of certain fraud and administrative provisions. Legislators also still have time to evaluate the negative consequences of their own recent attempts to force the health insurance market to behave according to anti-market theories.

New Jersey legislators, for example, are currently working to revise community rating practices in order to combat significant premium inflation in their state, while also seeking to restore medical underwriting. Kentucky legislators are trying to revise earlier attempts at health insurance reform that have chased insurance providers out of the state’s individual health insurance market. These efforts hold significant lessons for Congress and for those attempting to implement HIPAA in other states.

Since the states retain most of their authority to find ways to best implement HIPAA, time should be spent considering the many options available to state policy makers. In seeking to ensure a well-ordered health care system, state legislators should consider the following policy options:

  • Expand COBRA benefit extensions to workplaces with as few as two employees, to protect workers from the effects of long-term illnesses or job losses.
  • Expand high-risk health insurance pools to accommodate people with special health care needs and restore the right of insurers to medically underwrite for risk.
  • Abandon the idea of community-rated insurance premiums. Community rating has become a hidden tax on young, healthy workers to subsidize health care for older, less healthy people. Eventually, everyone pays higher premiums.
  • Lobby Congress to expand the pilot Medical Savings Account program and expand state-based MSA programs to provide relief from the high cost of low-deductible insurance plans and encourage patients to become better health care shoppers.
  • Repeal insurance coverage mandates and various special laws that have allowed special interest groups to unnecessarily raise the price of insurance premiums by 30 percent.
  • Allow small employers to form purchasing cooperatives that would be exempt from expensive state mandates. This would enable small employers to purchase health insurance at the discounted prices now enjoyed only by large group employers.
  • Take away the tax break given to employers for providing insurance to their employees, and give it instead to employees. Doing so would allow employees to own their health insurance policies without facing a tax penalty, paving the way for true portability.
  • Lobby Congress to restore tax equity by allowing a 100 percent tax deduction on health insurance premiums for the self-employed. This would help about 18 million people immediately.<37>

The public seems to have little or no knowledge of what state legislators must accomplish on a tight schedule. A 1996 awareness study conducted by Princeton Survey Research Associates found that 57 percent of the public knew nothing about the Kassebaum-Kennedy bill or the Health Insurance Portability and Accountability Act of 1996, and 31 percent were only mildly aware.<38> For this reason, many elected officials are hearing very little from their constituents on this issue.

Voters will wake up quickly, however, if state legislators do not implement HIPAA cautiously and with great deliberation. Some elected officials will be tempted to use HIPAA as a cover for pressing for state interventions in the health insurance marketplace that go well beyond what is necessary to expand access and improve portability. Should that happen, new laws could force employers to drop health insurance benefits because of rising premiums, cause millions of people to drop their individual health insurance, and make it impossible for doctors to guarantee confidentiality.

Aggrieved voters in 1998 could hardly be blamed for voting against those incumbents who set out to improve the nation’s health care system, but only succeeded in making it worse.

Conrad F. Meier, Rhu, is (2002 update) managing editor of The Heartland Institute’s Health Care News newspaper and a Heartland Senior Fellow. He is a retired health insurance consultant and past Missouri state chairman of the health insurance committee of the National Association of Life Underwriters, and was recently on assignment to the Center for Advanced Social Research at the University of Missouri at Columbia. He can be reached by e-mail at meier@heartland.org.


1 Beaufort B. Longest, Jr., “Policy Implementation,” in Health Policymaking in the United States, AUPHA Press/Health Administration Press, 1994, page 91.

2 Karen M. Beauregard, “Persons Denied Private Health Insurance Due To Poor Health,” Agency for Health Care Policy and Research, Report No. 92-0016, December 1991.

3 CFM Research, Columbia, Mo., analysis of the 1995 Behavioral Risk Factor Surveillance System health study available at www.cdc.gov/nchswww/datawh/ftpserv.

4 Katherine Shwartz, “Counting Uninsured Americans: Background Memorandum,” Kaiser Health Reform Project, January 1994.

5 Katherine Shwartz and Timothy D. McBride, “Spells Without Health Insurance: Distributions of Durations and Their Link to Point-in-Time Estimates of the Uninsured,” Inquiry, Fall 1990.

6 See Joseph L. Bast, Richard C. Rue, and Stuart A. Wesbury, Jr., Why We Spend Too Much on Health Care (Chicago, IL: The Heartland Institute, 1993), pages 73-78.

7 The author is not a lawyer, but a similarly loose reading of the commerce clause recently led the U.S. Supreme Court to rule the Safe Schools Act unconstitutional. Perhaps a similar challenge could be made to HIPAA.

8 Public Law 104 -191, August 21, 1996, “Health Insurance Portability and Accountability Act of 1996” (henceforth “HIPAA”), Section 2702, Section 2711, pages 26, 27, 28, 29.

9 Health and Human Services Press Office, “Health Insurance Portability and Accountability Act of 1996,” August 21, 1996. Contact HHS, 202/690-6343.

10 National Association of Insurance Commissioners (NAIC), “Draft Template for the State Implementation of the Health Insurance Portability and Accountability Act of 1996,” October 1996.

11 NAIC, ibid., page 28.

12 HIPAA, Section 2741.

13 One of these states, Texas, has an unfunded risk pool. Indications are that the pool will be funded during the 1997 General Legislative session.

14 American Academy of Actuaries, “Comments on the Effect of S.1028 on Premiums in the Individual Health Insurance Market,” February 20, 1996, page 5.

15 See John C. Goodman and Gerald L. Musgrave, Patient Power: Solving America’s Health Care Crisis; Joseph Bast, Richard Rue, and Stuart Wesbury, op cit.; American Medical Association, “Why the American Medical Association Supports Medical Savings Accounts,” Analysis, 1994.

16 NAIC, op. cit., page 40.

17 Ibid.

18 HIPAA, Section 301, page 103.

19 Ibid.

20 Merrill Matthews, Jr., Ph.D., “ Medical Savings Account Legislation: The Good, the Bad, the Ugly.” Brief Analysis No. 211, National Center for Policy Analysis, August 19, 1996.

21 Peter Temin, “An Economic History of American Hospitals,” in H.E. Frech III, ed., Health Care in America: The Political Economy of Hospitals and Health Insurance (San Francisco, CA: Pacific Research Institute, 1988), pages 75-97.

22 Bast, Rue, and Wesbury, op. cit., page 110, cite a 1991 estimate of 700 state mandates. At least 300 more have been added since then.

23 John C. Goodman and Gerald Musgrave, “Freedom of Choice in Health Insurance,” Policy Report, National Center for Policy Analysis, November 1988.

24 The New York Times, May 26, 1991.

25 The Washington Post, December 11, 1991.

26 Roy E. Cordato, “Universal Health Care at Any Cost,” IRET Byline, Institute for Research on the Economics of Taxation, February 20, 1989.

27 Alain C. Enthoven, “Market Forces and Health Care Costs,” Journal of the American Medical Association, November 20, 1991, page 2752.

28 C. Jackson Grayson, Jr., “Experience Talks: Shun Price Controls,” The Wall Street Journal, March 29, 1993.

29 Conrad F. Meier, “Wrong Prescription for What Ails Us,” Essay, April 1996, The Heartland Institute. Available through PolicyBot. Point your Web browser to http://www.heartland.org, click on the PolicyBot icon, and request document #3236407.

30 “State Health Insurance Reform: Experience with Community Rating and Guaranteed Issue in the Small Group and Individual Markets,” Council for Affordable Health Insurance, 1996. Available through PolicyBot. Request documents #3236304, 3236408, 3236409, 3236410, and 3236411.

31 Sen. Nancy L. Kassebaum, Letter to the Editor, The Wall Street Journal, June 7, 1996, page A13. Kassebaum says the fraud and abuse provisions were part of a broader package attached to her health insurance reform bill by Senators Dole and Roth.

32 Forbes, May 20, 1996.

33 “The End of Medical Privacy,” editorial, The Wall Street Journal, June 7, 1996, page A13.

34 HIPAA, Subtitle B, Section 311, page 118.

35 Health and Human Services Press Office, op. cit.

36 Thousands of people who are said to be “uninsured” receive benefits from life insurance policies to pay for health care expenses, indicating again that estimates of the number of uninsureds is unreliable.

37 According to 1994 GAO data, the 18 million people with individual health insurance include family farmers, recent college graduates, early retirees, and those working for companies that do not provide health benefits.

38 Survey designed by the Kaiser Family Foundation, Harvard University, and Princeton Survey Research Associates. Copies and findings (#1166) are available from the Kaiser Family Foundations public request line, 800/658-4533.

Quick Link