2019-23507. Administrative Simplification: Rescinding the Adoption of the Standard Unique Health Plan Identifier and Other Entity Identifier

AGENCY:

Office of the Secretary, HHS.

ACTION:

Final rule.

SUMMARY:

This final rule rescinds the adopted standard unique health plan identifier (HPID) and the implementation specifications and requirements for its use and the other entity identifier (OEID) and implementation specifications for its use. This final rule also removes the definitions for the “Controlling health plan” (CHP) and “Subhealth plan” (SHP).

DATES:

This final rule is effective on December 27, 2019.

FOR FURTHER INFORMATION CONTACT:

Lorraine Doo, [phone] or [e-mail].

Brian James, [phone] or [e-mail] for questions regarding the Health Plan and Other Entity Enumeration System (HPOES).

SUPPLEMENTARY INFORMATION:

I. Background

Section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) added section 1173 to the Social Security Act (the Act), which requires that the Secretary of the Department of Health and Human Services (HHS or the Secretary) adopt a standard unique health plan identifier.

Congress renewed the requirement for the Secretary to adopt a standard unique health plan identifier in section 1104(c)(1) of the Patient Protection and Affordable Care Act (Pub. L. 111-148) (as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) and collectively known as the Affordable Care Act or ACA) by requiring the Secretary to promulgate a final rule to establish a unique health plan identifier, as described in section 1173(b) of the Act and based on the input of the National Committee on Vital and Health Statistics (NCVHS), no later than October 1, 2012.

In compliance with that Affordable Care Act requirement, in the September 5, 2012 Federal Register (77 FR 54664), we published a final rule titled “Administrative Simplification: Adoption of a Standard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for the International Classification of Diseases, 10th Edition (ICD-10-CM and ICD-10-PCS) Medical Data Code Sets” (hereafter referred to as the September 2012 final rule). The September 2012 final rule adopted a standard unique health identifier for health plans (the HPID) and an “other entity identifier” (the OEID) for an entity that is not a health plan, individual, or health care provider, but that needs to be identified in a HIPAA transaction. Entities that qualified for an OEID were not required to obtain or use that identifier.

Soon after publication of the September 2012 final rule, industry stakeholders, in particular, health plans, identified a number of implementation challenges with the policy. Health plans and their provider trading partners provided substantial input to HHS and the NCVHS about barriers to implementation of the HPID. Stakeholders informed HHS that the HPID was not needed for routing HIPAA transactions nor did it provide information about health plan products and benefits. Further, they stated it would not reduce the cost of managing financial and administrative information, and that if they were to implement the HPID, it would impose significant costs instead of decreasing them. Stakeholders also indicated that the OEID had minimal value and stated they were confused about the enumeration, purpose, and use of the OEID. Since 2014, only 99 organizations have applied for and received OEIDs.

Based on industry's concerns about the September 2012 final rule, HHS issued a statement of enforcement discretion in October 2014,^[1] which delayed enforcement of the requirements pertaining to HPID enumeration and use of the HPID in the HIPAA transactions. Enforcement discretion meant that HHS would not impose penalties if it determined a covered entity was out of compliance with the September 2012 final rule. Between 2014 and 2018, HHS continued to receive input from stakeholders and from the NCVHS, requesting that the regulatory mandate for the HPID be removed.

In the December 19, 2018 Federal Register (83 FR 65118), we published a proposed rule titled “Administrative Simplification: Rescinding the Adoption of the Standard Unique Health Plan Identifier and Other Entity Identifier” (hereafter referred to as the December 2018 proposed rule). There, we provided an overview of the HPID history, and described industry testimony and recommendations to the NCVHS and the NCVHS's recommendations to us about the HPID. We included specific information from stakeholders to the NCVHS that the HIPD and OEID did not, and could not, serve the purposes for which they had been adopted. In addition, we included the NCVHS's September 23, 2014 recommendation to us that the HIPD not be used in administrative transactions. We also committed to exploring options for a more effective standard unique health plan identifier in the future, and with respect to which we would collaborate with stakeholders in an open process (83 FR 65122). For more detailed information about the industry response to the adoption of the HPID and OEID and the NCVHS's recommendations to us, see the December 2018 proposed rule (83 FR 65119 through 65122).

II. Provisions of the Proposed Rule and the Analysis of and Responses to Public Comments

As stated previously, the HPID and OEID were adopted in the September 2012 final rule under the statutory authorities of HIPAA and the Affordable Care Act. In the December 2018 proposed rule, we described how we came to understand, based on recommendations from the NCVHS and overwhelming industry input, that the HPID and OEID do not meet the need for which they were adopted. Therefore, we proposed to remove Subpart E—Standard Unique Health Identifier for Health Plans at 45 CFR part 162. We also proposed to remove the definitions of “Controlling health plan” (CHP) and “Subhealth plan” (SHP) at 45 CFR 162.103 as those terms are integrally related to the HPID requirements, without which they would have no application (83 FR 65123).

Finally, we proposed that if we finalized our proposal to rescind the HPID and OEID, we would deactivate each HPID and OEID record in the Health Plan and Other Entity Enumeration System (HPOES) on behalf of each enumerated entity, as opposed to each entity having to do so itself, and would notify the manager of record at the current email address in the system (83 FR 65123). In addition, we proposed to store the identifiers for 7 years in accordance with federal recordkeeping requirements, and proposed that we would not regulate any actions entities may take with their existing HPID and OEID identifiers, such that they would be free to retain and use these identifiers at their own discretion (83 FR 65123). We welcomed comments on all of our proposals.

In response to the December 2018 proposed rule, we received 19 pieces of timely correspondence from major associations representing health plans, self-funded group employer plans, and providers, as well as from large vendors and other individual organizations. All of the timely submissions supported our proposal to rescind the HPID and OEID and remove the definitions of CHP and SHP, while the late commenter opposed our proposal to rescind the identifiers. Several commenters supported our proposal that we deactivate the identifiers on behalf of the entities that had obtained them. Most of the commenters thanked us for our proposal to rescind the HPID and OEID and for HHS's continued efforts to reduce administrative burden on clinicians so they can focus on providing patient care.

Commenters' main points included the following:

• A preference for use of Payer IDs.
• No need for, or value in, the HPID.
• Reducing the burden on self-funded groups or health plans.
• The cost of implementing the HPID.
• Communications about the deactivation of the HPIDs/OEIDs.
• The importance of industry engagement in any future discussions about appropriate business or use cases for a standard health plan identifier.

A summary of the public comments received, and our responses follow.

A. Use of the HPID vs. Payer IDs

In the December 2018 proposed rule, we provided an overview of stakeholder feedback regarding adoption of the HPID, explaining that the industry had developed best practices for the use of Payer IDs, which are non-HIPAA-based industry-derived identifiers, for purposes of conducting the HIPAA transactions, and that the HPID did not have a place in these transactions (83 FR 65122). We explained that stakeholders stated that the organizations that need to be identified in HIPAA transactions are the payers rather than the health plans, and that industry is successfully routing transactions using the Payer IDs and could not use the HPID to do so (83 FR 65122).

Comment: Several commenters stated that they appreciated HHS acknowledging the distinction between the HPID and Payer IDs, the industry's use of, and reliance on, Payer IDs in the HIPAA transactions, and the impact of having to accommodate a new identifier. A commenter noted that Payer IDs are the common denominator for payers, physicians, and the patients they serve, that permit entities to communicate effectively using HIPAA electronic transactions such as claims, eligibility, claim status, and enrollment. Another commenter wrote that, in general, the need for a health plan identifier changed between the enactment of HIPAA and HHS's adoption of the HPID. As industry gained experience with the transaction standards adopted under HIPAA, it was able to resolve, via Payer IDs, the issue of identifying the payer for routing transactions. Commenters explained that, at this point, the HPID would have been an impediment to the effective use of the HIPAA transactions. One large provider group wrote that, while the HPID had been intended to solve routing issues identified at the time HIPAA was enacted in 1996, in today's environment, using the Payer IDs, providers no longer experienced routing issues. This group further noted that expending resources on implementing the HPID would be wasteful and would hurt the industry, including providers, vendors, clearinghouses, and payers.

Response: We have acknowledged that industry is effectively using Payer IDs to route and exchange the HIPAA transactions, and appreciate the confirmation from commenters. This final rule rescinds the HPID and the implementation specifications and requirements for its use.

Comment: A commenter opposed the proposal to rescind the HPID, stating that removal of the identifiers would create more ambiguity for health care claims transactions and would obscure relationships between financially responsible entities. The commenter stressed the importance of a provider's ability to determine the entity that will be receiving eligibility requests and the entity that is financially responsible to remit payment for covered healthcare services.

Response: We acknowledged in the December 2018 proposed rule that covered entities will need to know how each party to a transaction is identified and which parties are financially responsible or will be able to respond to the transactional inquiries. According to the input we received over the past several years from health plans and providers, Payer IDs adequately identify the entity that will receive the eligibility request, be financially responsible for the claim, and remit payment. Other commenters confirmed that Payer IDs are used successfully to route transactions for these specific purposes. Within these transactions, Payer IDs identify the payer that has responsibility for the information identified in this comment (that is, routing and receiving an eligibility request or bearing financial responsibility for a claim) and other relevant information needed by the receiver. Not only do the views of stakeholders and the recommendations from the NCVHS presented to us for several years consistently run counter to this commenter's views, we also note that, due to the continuing enforcement discretion, the HPID has not seen widespread implementation, thus we question how its rescission could create ambiguity or obscure the relationships between covered entities. Nevertheless, the commenter reminds us of the critical importance of maintaining an industry-wide perspective as we explore future rulemaking pertaining to the HIPAA transactions and a unique health plan identifier.

Comment: A commenter opposed the rescission of the HPID on the basis that the HPID—(1) should be included in contractual arrangements between health plans, payers, and third-party service providers when these organizations act on behalf of self-funded employers; and (2) is important to identify the entity that has financial control or responsibility and to whom the provider may need to appeal for adverse benefit determinations.

Response: We note that the health care system is complex, particularly with respect to the arrangements between self-funded employer groups, health plans, third-party administrators, and providers. The NCVHS hearings and other public forums have yielded no information supporting the use of the HPID by self-funded employer groups or their business associates, while, by contrast, self-funded employer groups have consistently opposed the use of HPID. In response to the December 2018 proposed rule, other commenters confirmed that use of the HPID would have increased costs not only to their members, but also to providers, and that the HPID would not have improved transactions or information exchange. Rather, they reiterated that continued use of Payer IDs by their business associates on their behalf was the appropriate and correct technical and business solution.

B. Use of the OEID

We adopted the OEID because we believed that entities that were not health plans, but identified in HIPAA transactions in a manner similar to health plans, could use the OEID in HIPAA transactions, which we believed would increase standardization (77 FR 54665). Since publication of the September 2012 final rule, 99 OEIDs have been assigned in the HPOES. We do not have any information regarding actual use of the OEID in the HIPAA transactions.

Comment: Several commenters stated that there was no value or efficiency gained from using the OEID if an organization provided one in a transaction. A few commenters strongly agreed with our proposal that the identifier was not necessary or useful; however, they did not provide specific details in their written comments.

Response: We thank the commenters for their feedback. We also believe the low number of applications for OEIDs is an indicator that the OEID does not provide the intended value. We are finalizing our proposal to rescind the OEID as well.

C. Costs of the HPID

Comment: Several commenters stated that the cost of implementing the HPID would have outweighed the benefits. Most of the commenters agreed that there was no return on investment for implementing the HPID because Payer IDs already serve the purpose of routing transactions. Some commenters reiterated what HHS stated in the December 2018 proposed rule regarding the costs and burden of mapping the existing Payer IDs to HPIDs. Some of these commenters from self-funded employer groups stated that they do not perform most health care transactions, such as eligibility determinations, claims status, or EFT and remittance advice, but, rather, they engage third party administrators (TPAs) to do so on their behalf. Therefore, compliance with the HPID final rule would have involved new administrative procedures and would have required extensive coordination with multiple TPAs, with the administrative and cost burden greatly outweighing any utility of the HPID.

A few commenters praised the proposal and commented that, for large organizations with numerous subparts, the HPID enumeration burden was far greater and more complex than HHS had envisioned when the HPID was adopted. These commenters explained that the HPID enumeration was further complicated by confusion about the requirements for self-funded, fully insured, and combination fully insured and self-funded groups. The commenters wrote that the policy resulted in high implementation cost projections that would have yielded little to no return on investment. The commenters believe that the traditional payers and TPAs supporting these groups would have incurred considerable cost that they likely would have passed on to the provider community had HPIDs been required in standard transactions. These commenters also confirmed that existing Payer IDs were sufficient to identify the payer and any other information needed to process HIPAA transactions.

Response: We are confirming our cost/benefit analysis that the costs to implement the HPID outweigh the return on investment. We reiterate in the Regulatory Impact Analysis that certain assumptions we made in the estimates of the 2012 proposed and final rules may have been misplaced or did not come to fruition, and that other activities have provided cost savings benefits for industry. This final rule yields cost avoidance for covered entities.

D. Definitions

We proposed to remove the definitions of controlling health plan (CHP) and subhealth plan (SHP) at 45 CFR 162.103 because those terms were established in association with, and were integrally related to, the HPID requirements and would no longer have application were the HPID and OEID rescinded.

Comment: A few commenters supported the proposal to remove the definitions of CHP and SHP.

Response: We thank the commenters for their support and are finalizing our proposal to remove the definitions.

E. Deactivation of HPIDs and OEIDs

We proposed to deactivate each HPID and OEID record in the Health Plan and Other Entity Enumeration System (HPOES) on behalf of each enumerated entity, and to notify the manager of record at the current email address in the system. In addition, we proposed to store the numbers for 7 years and to permit entities with HPIDs and OEIDs to retain and use them at their own discretion, such that HHS would not regulate any actions entities take with these existing identifiers (83 FR 65123).

Comment: Several commenters supported HHS's proposed role in the deactivation of HPIDs and OEIDs. A commenter requested that HHS consider notifying all authorized users on file for each HPID and OEID in HPOES in the event the individual in our records may have left an entity or changed email addresses. Another commenter suggested that HHS publicly notify the industry upon completion of the deactivation of the identifiers.

Response: We appreciate the support of our proposal to deactivate HPIDs and OEIDs on behalf of the entities who obtained them. We also agree that it is important to communicate effectively (widely broadcast) to the stakeholder community after we complete the deactivation process and thank the commenter for that suggestion.

HIOS is the Health Insurance Oversight System—a secure HHS web-based application that collects and stores information about health plans, insurance companies, and issuers for national programs. HPOES is a HIOS module that assigns and manages HPIDs and OEIDs. On or after the publication date of this final rule in the Federal Register, HHS will send an email notice to all active HIOS users explaining the deactivation of the HPIDs and OEIDs and the upcoming HPOES changes. We recognize that many HIOS users will not have enumerated for an HPID or OEID, but know it is likely that many personnel, roles, and organizational affiliations may have changed since entities enumerated (obtained their identifiers). Therefore, transmitting this information to all active HIOS users will ensure that our first communication regarding the HPID deactivation process reaches the greatest number of potentially affected entities and individuals. Through outreach to HIOS users, we believe the information about the pending HPID and OEID deactivation will most effectively reach appropriate individuals in each enumerated entity.

On or after the effective date of the final rule, HHS will deactivate all HPIDs and OEIDs. The HPOES module will remain open for an additional 60 days after HPID and OEID deactivation for viewing by HPOES module users to enable entities to capture data about their HPID or OEID.

On or after the effective date of the final rule, HHS will also do the following:

• Post a notice on the HPOES homepage and the Centers for Medicare & Medicaid Services (CMS) website indicating that the deactivation for HPIDs and OEIDs has occurred and that new HPID and OEID applications will no longer be accepted. The notices will provide contact information for a help desk and the HHS administrative simplification office email.
• Send an email to HPOES module users informing them that all HPID and OEID numbers have been deactivated and that the HPOES system will remain open for 60 days to view information.
• Update the CMS website with information about the HPID and OEID deactivation activities and timeline.

Comment: A few commenters stated that, upon deactivation of the HPIDs and OEIDs within the HPOES, the infrastructure to support the numbers would be removed and any HPIDs and OEIDs remaining in use would be rogue numbers operating outside the framework for standard code sets and electronic transactions for which HIPAA was intended. These commenters requested that HHS consider terminating the use of the HPIDs and OEIDs at the same time as their deactivation. They also suggested that, if there is a need to continue using the HPIDs and OEIDs for a period of time, the cases for use be clearly defined. The commenters requested that HPIDs and OEIDs be excluded from use within standard electronic transactions after termination.

Response: In the December 2018 proposed rule, we proposed that entities with HPIDs and OEIDs could retain and use these identifiers at their own discretion and that HHS would not regulate any actions entities take with their existing HPIDs and OEIDs (83 FR 65123). We appreciate the commenters' concerns regarding the need to define use cases for HPIDs and OEIDs after deactivation and agree that, to ensure the effectiveness of the HIPAA transactions and drive efficiency, trading partners should collaborate and agree upon the best identifiers for exchanging and routing transactions.

We have no indication that entities are using the HPIDs for any other purposes at this time. We did not receive sufficient input to warrant developing additional policies regarding the use of deactivated HPIDs or OEIDs for other purposes once the HPOES module is closed, but we will monitor our administrative simplification email box and the complaint system for any indications of issues.

F. Industry Input on a Possible Future Standard Unique Health Identifier for Health Plans

In the proposed rule, we acknowledged there are statutory requirements that HHS adopt a standard unique health identifier for health plans, and that we look forward to future industry and NCVHS discussions of appropriate use or business cases regarding such an identifier that might reduce costs or burden on covered entities (83 FR 65123).

Comment: A commenter stated that, given the uncertainty and confusion about the HPID and its enumeration scheme, they strongly supported our proposal to engage industry and provide an opportunity for public input regarding any consideration of a future standard identifier for health plans. Another commenter echoed the concerns about the uncertainty of the HPID, and indicated that HIPAA requires HHS to take into account multiple uses for a health plan identifier and to specify the purposes for which such an identifier may be used. These commenters indicated that it would be very difficult to use one identifier for multiple business use cases if the use cases are not compatible. The commenters urged HHS to confer with stakeholders before considering future alternatives or proposing any future uses of an identifier, particularly if the identifier would be used for multiple purposes.

Response: We appreciate the willingness of industry to engage on this topic of unique health plan identifiers in the future. We encourage stakeholders to continue considering business cases for a standard health plan identifier and to share those options with the Secretary or NCVHS.

After review of the public comments received, we are finalizing our proposals to remove Subpart E—Standard Unique Health Identifier for Health Plans at 45 CFR part 162, as well as the definitions of “Controlling health plan” (CHP) and “Subhealth plan” (SHP) at 45 CFR part 162.103 without modification. In this final rule, we are also affirming that HHS will conduct the deactivation activities on behalf of the enumerated entities and communicate to affected organizations and stakeholders about the deactivation process.

III. Collection of Information Requirements

This document does not impose information collection requirements, that is, reporting, recordkeeping or third-party disclosure requirements. Consequently, there is no need for review by the Office of Management and Budget under the authority of the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.).

However, it must be noted that the information collection request (ICR) associated with the HPID was previously approved under OMB control number 0938-1166 and subsequently expired May 31, 2016. HHS incurred a violation of the PRA when the ICR expired. As stated earlier in this document, we proposed to rescind the adoption of the HPID and the other entity identifier (OEID) along with the implementation specifications and requirements for the use of the HPID and OEID; therefore, we are not seeking to reinstate the ICR previously approved under 0938-1166.

IV. Regulatory Impact Statement

We have examined the impact of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A Regulatory Impact Analysis (RIA) is prepared for major rules with economically significant effects ($100 million or more in any 1 year). This rule does not reach the economic threshold and is not considered a major rule, thus we are not required to prepare an RIA. We provided a detailed history of the events leading to this final rule in the December 2018 proposed rule (83 FR 65120). We discuss our approach to Executive Order 12866 and demonstrate that this rule would not have economically significant effects because it not only removes requirements perceived by industry as burdensome, but it rescinds a regulation that, as a practical matter, was never operationalized or implemented by industry and thus had no demonstrable costs or savings. This final rule has been determined to be a qualitatively deregulatory action.

The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of less than $7.5 million to $38.5 million in any 1 year. Individuals and states are not included in the definition of a small entity. We are not preparing an analysis for the RFA because we have determined, and the Secretary certifies, that this final rule would not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare an RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and the Secretary certifies, that this final rule would not have a significant impact on the operations of a substantial number of small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2019, that threshold is approximately $154 million. This final rule will have no consequential effect on state, local, or tribal governments or on the private sector.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a final rule that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. Since this regulation does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

Executive Order 13771, titled Reducing Regulation and Controlling Regulatory Costs was issued on January 30, 2017, and requires that the costs associated with significant new regulations “shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least two prior regulations.” This final rule is an E.O. 13771 deregulatory action. Details on the estimated cost savings of this final rule are stated in the rule's economic analysis.

A. Cost and Savings

As stated previously, and shown in this section, we estimate that this final rule will not have economically significant effects on industry. We again point readers to the September 2012 final rule where we referred to the large measure of uncertainty in the assumptions of our original impact analysis. In some cases, we indicated that the HPID would be “foundational” to subsequent activities such as the automation of the Coordination of Benefits (COB) process (77 FR 54705). In other cases, we stated that the costs and benefits associated with the HPID were applicable only to entities that are directly involved in sending or receiving HIPAA transactions and that the cost estimates were based on the number of health plans that would use the HPID in the transactions. However, we did not have data on how health plans were being identified in HIPAA transactions (77 FR 54703). Therefore, we stated that we had no assurance of how many health plans would use the HPID in standard transactions, and took a conservative approach to the costs to health plans. We were aware that covered entities were using Payer IDs to identify the health plan or the responsible entity in transactions. Although a few commenters did not agree with the methodology we chose for our cost analysis in the April 2012 proposed rule, we did not alter it in the September 2012 final rule.

With respect to the estimated cost and benefits of implementation and use of the HPID, the December 2018 proposed rule reiterated the narrative from the April 2012 proposed rule, where we explained that the HPID would be foundational to other administrative simplification initiatives, both those initiated by industry, and those regulated by State or Federal governments. In the 2012 rulemaking, we suggested that if other initiatives did not follow, then the HPID would likely have little substantive impact (77 FR 22977). We explained that the HPID was intended to enable other initiatives, and would have been part of the larger picture of standardizing billing and insurance-related transactions and tasks (77 FR 54703). The HPID did not have the benefits or savings anticipated in the 2012 rulemaking, in part because of the longstanding enforcement discretion, and in part because industry identified other strategies to increase efficiency in how they conducted those transactions and other administrative functions.

In the April 2012 proposed rule, we stated that the possible cost and benefit impacts were reflective of the uncertainty inherent in the health care industry. To illustrate the foundational aspects of the HPID, we estimated its implementation might contribute to a: (1) 1 to 2 percent per year, for 10 years, increase in the use the eligibility for a health plan and health care claims status transactions; and (2) 1 to 3 percent increase in the use of the electronic health care electronic funds transfers (EFT) and remittance advice transaction, as routing of those transactions is especially important for the payment process (77 FR 22977). However, despite our exercise of enforcement discretion with respect to HPID compliance, the use of all three of these transactions has modestly increased, and we believe our assumptions that use of the HPID would contribute to an increase in the use of those transactions were incorrect. As we explained in the December 2018 proposed rule, some of the increases (and therefore savings) might have been due to the use of the adopted operating rules, while some might have been due to improved system capabilities.

The Council for Affordable Quality Healthcare (CAQH) conducts a study each year (the CAQH Index) to assess the utilization of the administrative transactions and operating rules, and tries to identify savings opportunities from their use. The most recent report from 2018 continues to show progressive adoption of the eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) and remittance advice transactions. Entities conducting these transactions use Payer IDs for routing, other payer, and health plan identification purposes. While this study only includes those health plans and providers that participate by providing data, it remains indicative of a positive trend in the utilization rate for these transactions without the HPID. Table 1 shows the steady increase in industry's use of the three transactions over 6 years, which includes the 4 years when the HPID rule was in effect but, we believe, not in use due to the ongoing enforcement discretion. Recently, there has been a slight decline in use of the remittance advice transaction. CAQH is working with providers and health plans to understand reasons for that decrease in use.

TABLE 1—CAQH Study Participant Adoption Rate of Certain Standard Transactions *

	Claim status (fully electronic) (%)	Eligibility (%)	Remittance advice (%)
2013	48	65	43
2014	50	65	46
2015	57	71	50
2016	63	76	55
2017	69	79	56
2018	71	85	48
* CAQH 2018 Efficiency Index, https://www.caqh.org/​sites/​default/​files/​explorations/​index/​report/​2018-index-report.pdf.

We cannot attribute other cost savings to this final rule because we do not anticipate any system transition costs, testing, or other conversion costs related to the deactivation of the identifiers. Consistent with our statements in the December 2018 proposed rule, covered entities did not make expenditures to prepare for use of the HPID during the enforcement discretion period. Organizations also did not execute new contracts for the services of software system vendors, billing companies, transaction vendors, and/or health care clearinghouses to facilitate the transition to the HPID. We invited industry comment on our assumptions regarding the cost estimates, and received support for the assumption that the costs would have outweighed the benefits of implementing the HPID.

Comment: Several commenters supported our analysis in the December 2018 proposed rule, suggesting that the cost of implementing the HPID would have outweighed any benefits. These commenters agreed that there was no return on investment for implementing the HPID because Payer IDs already serve the purpose of routing transactions. The commenters also noted that it would have been costly, complicated, and burdensome to implement the HPID because it would have required the mapping of existing Payer IDs to HPIDs. Specifically, a commenter stated it did not perform most health care transactions itself and, instead, engaged TPAs to perform these functions on its behalf. The commenter noted that complying with the HPID final rule would have required new and costly administrative procedures and extensive coordination with multiple TPAs that would have outweighed the utility of the HPID.

Response: We thank commenters for validating our updated assumptions in the December 2018 proposed rule impact analysis regarding the lack of a return on investment from the September 2012 final rule. The commentary from stakeholders regarding the cost of HIPD implementation and the inability to demonstrate an improvement in administrative efficiencies from such implementation has been consistent for several years, as demonstrated by review of the HPID testimony on the NCVHS website at https://ncvhs.hhs.gov/​meetings/​agenda-of-the-may-3-2017-ncvhs-subcommittee-on-standards-hearing-on-health-plan-identifier-hpid/​ or the December 2018 proposed rule at 83 FR 65118.

1. Costs

The federal government has already expended certain operating funds, as have those organizations that applied for and obtained an HPID or OEID. For example, the federal government spent $1.5 million to build the components of the enumeration system and spent $45,000 annually for operations and maintenance through 2018. As we stated in the December 2018 proposed rule, we cannot account for industry legal or administrative expenditures in the analysis of the number or type of HPIDs or OEIDs obtained following publication of the September 2012 final rule.

Costs associated with the deactivation—preparing communications, posting alerts on the HPOES web page, updating the DNS website, and programming to turn off system access to the HPOES module—are considered agency operating costs that HHS will absorb, without the need for additional funds.

2. Savings (Cost Avoidance)

We believe that this final rule rescinding the HPID and OEID will yield modest savings (cost avoidance). First, as enforcement discretion remains in effect, we assume there are no new costs for health plan or other entity enumeration of new health plans or other entities. In the December 2018 proposed rule, we acknowledged that some of the assumptions in our 2012 rulemaking were outdated and requested industry feedback on our use of those assumptions for purposes of the analysis, but received no comments. Therefore, we are using the same data to confirm that this final rule provides a modest savings/cost avoidance.

Based on the data in Chart 2 of the April 2012 proposed rule (77 FR 22970), and reprinted here for reference, we estimated there would be up to 15,000 entities that would be required, or would elect, to obtain an HPID or OEID.

TABLE 2—Number and Type of Entities That Were Expected To Obtain an HPID or OEID

Type of entity	Number of entities
Self-insured group health plans, health insurance issuers, individual and group health markets, HMOs including companies offering Medicaid managed care	* 12,000
Medicare, Veterans Health Administration, Indian Health Service	** 1,827
TriCare and State Medicaid programs	60
Clearinghouses and Transaction vendors	*** 162
Third Party Administrators	**** 750
Total	15,000
* Report to Congress: Annual Report on Self-Insured Group Health Plans by Hilda L. Solis, Secretary of Labor, March 2011.
** Patient Protection and Affordable Care Act; Standards Related to Reinsurance, Risk Corridors, and Risk Adjustment, July 8, 2011 Federal Register (76 FR 40458) referencing data from www.healthcare.gov.
*** Health Insurance Reform; Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards; Proposed Rule, http://edocket.access.gpo.gov/​2008/​pdf/​E8-19296.pdf,, based on a study by Gartner.
**** Summary of Benefits and Coverage and the Uniform Glossary; Notice of Proposed Rulemaking, http://www.gpo.gov/​fdsys/​pkg/​FR-2011-08-22/​pdf/​2011-21193.pdf.

As we stated in the December 2018 proposed rule, slightly fewer than 11,000 entities applied for and obtained an HPID immediately following publication of the September 2012 final rule. We explained the cost calculation for enumeration in the April 2012 proposed rule (77 FR 22970). Health plans and other entities were required to complete the application or update form online through the HPOES. We received most applications shortly after publication of the September 2012 final rule, subsequent to which the application rate slowed considerably. Between May 2016 and May 2017 we received only 156 applications for HPIDs, and, since the December 2018 proposed rule was published, we have received only 5 applications.

The HPID and OEID application is a one-time burden, and for purposes of this impact analysis, we estimated the impact of eliminating that burden.

The cost avoidance calculation associated with rescinding the HPID and OEID is premised upon the same method that we used to estimate the cost to apply for an HPID or OEID. We estimated that it took 30 minutes to complete the online application or make updates, and used an hourly labor rate of approximately $23/hour, the average wage reported for professional and business services sector, based on data from the Department of Labor, Bureau of Labor Statistics, June 2011, “Average hourly and weekly earnings of production and nonsupervisory employees (1) on private nonfarm payrolls.” (https://www.bls.gov/​news.release/​empsit.t24.htm). If we increase the rate to account for 2018 dollar values (March 2018 table), to $31/hour, this represents a unit cost of $15.00 per HPID or OEID application. For the initial enumeration of 11,000 entities, this cost would have been $165,000. Thus, to deactivate an HPID or OEID, we can assume the cost avoidance would be the same.

Additionally, we estimate the potential savings (cost avoidance) for those entities that might have already updated their HPID or OEID records before the HHS deactivation and base our assumption on the actual number of updates to the HPOES system since 2013. Each year, an average of 95 records, or 1 percent of active applications, are deactivated or updated. Using the same unit cost described earlier in this rule, if 1 percent of the current organizations (110 entities) updated their HPIDs/OEIDs, the cost would be $1,650 (110 × $15). To account for any increase in wages and benefits, we multiply this by 2, and arrive at a sum of $3,300. This final rule may result in savings of $3,300. We typically provide ranges in an impact analysis, and so provide a high range of 3 percent as well. Therefore, our calculation means 330 entities would have made updates, for a total high-end savings estimate of $9,900 (330 × $15) × 2. When this final rule becomes effective, these updates will not be necessary or possible. Organizations that have obtained HPIDs or OEIDs will not be able to make changes to their accounts after the effective date of the final rule. See Table 3 for a summary of the savings for updates that will not be made to HPIDs and OEIDs on or after the effective date of the final rule.

We proposed a cost-effective method to implement the HPID and OEID rescission, and finalize that proposal in this final rule. As described earlier, HHS will deactivate the HPIDs and OEIDs on behalf of each entity and notify designated contacts in the HIOS system, while in a second wave of communication we will notify all active users in the HPOES module that the identifiers have been deactivated.

We requested industry feedback on our assumptions and estimates regarding the deactivation of the HPIDs and OEIDs. We received support from commenters for our proposal that we would conduct the deactivation at HHS. Commenters suggested we notify several individuals on record at each company in case turnover had occurred. In Section II. E. of this final rule, we describe the deactivation process and communication strategy we will employ.

3. Summary of Costs and Savings for the Proposal To Rescind the HPID

Table 3—Savings (Cost Avoidance)—Updates That Would Not Have To Be Made to HPIDs and OEIDs After 2020

Savings	2020		2021	2022	2023	2024	2025	2026	2027
	1%	3%
Updates to enumeration	$3,300	$9,900	$0	$0	$0	$0	$0	$0	$0
Total	3,300	9,900

D. Regulatory Review Costs

Regulations impose administrative costs on private entities, such as the time needed to read and interpret a proposed rule, and we included estimates for the costs associated with the review of our documents. We assumed that commenters on the proposed rule would be representative of HIPAA covered entities and their business associates—primarily health plans, health care clearinghouses, health care providers, and vendors. However, it was not possible to quantify or estimate the number of entities, or number of individuals within each entity, who would participate in reviewing the proposed rule. Our best method of estimation was premised on the number of organizations that submitted comments on previous HIPAA standards and operating rules-related regulations as well as organizations that had participated in NCVHS hearings. HHS has received comments from approximately 100 to 150 commenters on past HIPAA regulations, while a similar number of organizations testify at or listen to NCVHS hearings. We acknowledged our assumptions may be imperfect and might result in an under- or -overstatement of the cost calculation for the review of the proposed rule, and we also recognized that the proposed rule might affect various types of covered entities in different ways, thus influencing the numbers of individuals or entities that may have read the proposed rule. For purposes of our estimate, we assumed that each reviewer would read approximately 50 percent of the proposed rule. We estimated that multiple individuals from 150 entities would read the proposed rule and that the key readers would likely be the information systems manager and legal staff. Using the wage information from the BLS for Computer and Information Systems managers for insurance carriers (Code 11-3021), we estimated that the cost of reviewing the proposed rule would be $70.07 per hour, including overhead and fringe benefits (https://www.bls.gov/​oes/​current/​oes113021.htm). Assuming an average reading speed, we estimated that it would take approximately 2.5 hours for a person to review half of the proposed rule. For each reviewer, the estimated cost was projected to be $175.17 (2.5 hours × $70.7), and we estimated the total industry cost of reviewing the proposed rule to be $175 × 150 reviewers = $26,250. We received no comments on this section of the proposed rule.

E. Alternatives Considered

We were not required to provide alternatives for our proposal in the December 2018 proposed rule because we did not provide a full regulatory impact analysis. Furthermore, we fully discussed our reasons for proposing to rescind the HPID and OEID. However, we did consider several alternatives before making our proposal, including the effects of these alternatives. We provided our rationale for not selecting these options in accordance with OMB Circular A-4, which directs agencies to consider, among other things, a range of regulatory and non-regulatory alternatives, including different choices defined by statute, different compliance dates, market-oriented approaches, and different enforcement methods.

We considered allowing covered entities to apply for and use the HPID or OEID voluntarily for their own purposes, or between willing trading partners, but rejected this option because there had been no demand for the use of these identifiers. Industry clearly stated that there was no business use case for the HPID and OEID and there was no anticipated benefit or savings from their use in HIPAA transactions or for other purposes. A voluntary model employing the HPID and OEID likely would have resulted in confusion and disagreement between trading partners, thereby also likely engendering costs.

At the May 3, 2017 NCVHS hearing, two commenters suggested that HHS consider alternative uses of the HPID, such as placing it on health insurance identification cards to assist with better understanding of patient coverage and benefits (including its use in patient medical records to help clarify a patient's healthcare benefit package). A commenter stated that the HPID could be used for enforcement or certification of compliance of health plans.

As we have noted, the statute requires us to adopt a standard unique health plan identifier. HHS remains open to industry and NCVHS discussion and recommendations for appropriate business case(s) that meet the requirements of administrative simplification and we will explore options for a more effective standard unique health plan identifier.

We did not receive any comments on these proposals, nor were any alternatives offered.

In accordance with the provisions of Executive Order 12866, this final rule was reviewed by the Office of Management and Budget.

List of Subjects in 45 CFR Part 162

• Administrative practice and procedures
• Electronic transactions
• Health facilities
• Health insurance
• Hospitals
• Medicaid
• Medicare
• Reporting, and recordkeeping requirements

For the reasons set forth in the preamble, the Department of Health and Human Services amends 45 CFR part 162 to read as follows:

PART 162—ADMINISTRATIVE REQUIREMENTS

1. The authority citation for part 162 is revised to read as follows:

Authority: 42 U.S.C. 1320d—1320d-9 and secs. 1104 and 10109 of Pub. L. 111-148, 124 Stat. 146-154 and 915-917.

§ 162.103

[Amended]

2. Section 162.103 is amended by removing the definitions of “Controlling health plan (CHP)” and “Subhealth plan (SHP)”.

Subpart E—[Removed]

3. Subpart E, consisting of §§ 162.502 through 162.514, is removed and reserved.

Dated: October 15, 2019.

Alex M. Azar II,

Secretary, Department of Health and Human Services.

Footnotes

1.  Statement of Enforcement Discretion regarding 45 CFR 162 Subpart E—Standard Unique Health Identifier for Health Plans https://www.cms.gov/​Regulations-and-Guidance/​Administrative-Simplification/​Unique-Identifier/​HPID.html.